style: format core skill orchestration

refactor(skill): compose generic box mounts in core
feat(skill): use SDK store without box execution
2026-09-05 17:17:14 +00:00 · 2026-09-05 23:18:17 +08:00 · 2026-09-05 23:09:46 +08:00 · 2026-09-05 19:49:35 +08:00 · 2026-09-05 01:19:28 +08:00 · 2026-09-05 00:55:18 +08:00
225 changed files with 9846 additions and 3689 deletions
@@ -1,5 +1,5 @@
 name: 漏洞反馈
-description: 【供中文用户】报错或漏洞请使用这个模板创建，不使用此模板创建的异常、漏洞相关issue将被直接关闭。由于自己操作不当/不甚了解所用技术栈引起的网络连接问题恕无法解决，请勿提 issue。容器间网络连接问题，参考文档 https://link.langbot.app/zh/docs/network  
+description: 【供中文用户】报错或漏洞请使用这个模板创建，不使用此模板创建的异常、漏洞相关issue将被直接关闭。由于自己操作不当/不甚了解所用技术栈引起的网络连接问题恕无法解决，请勿提 issue。容器间网络连接问题，参考文档 https://langbot.app/docs/zh/workshop/network-details
 title: "[Bug]: "
 labels: ["bug?"]
 body:
@@ -22,7 +22,7 @@ body:
  - type: textarea
    attributes:
      label: 异常情况
-      description: 完整描述异常情况，什么时候发生的、发生了什么。**请附带日志信息。** 
+      description: 完整描述异常情况，什么时候发生的、发生了什么。**请附带日志信息。**
    validations:
      required: true
  - type: textarea
@@ -1,5 +1,5 @@
 name: Bug report
-description: Report bugs or vulnerabilities using this template. For container network connection issues, refer to the documentation https://link.langbot.app/en/docs/network
+description: Report bugs or vulnerabilities using this template. For container network connection issues, refer to the documentation https://langbot.app/docs/en/workshop/network-details
 title: "[Bug]: "
 labels: ["bug?"]
 body:
@@ -7,23 +7,42 @@ on:
 jobs:
  build-dev-image:
    runs-on: ubuntu-latest
-    # 如果是tag则跳过
    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    permissions:
+      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

-      - name: Generate Tag
-        id: generate_tag
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Generate image metadata
+        id: image
+        shell: bash
        run: |
-          # 获取分支名称，把/替换为-
-          echo ${{ github.ref }} | sed 's/refs\/heads\///g' | sed 's/\//-/g'
-          echo ::set-output name=tag::$(echo ${{ github.ref }} | sed 's/refs\/heads\///g' | sed 's/\//-/g')
-      - name: Login to Registry
-        run: docker login --username=${{ secrets.DOCKER_USERNAME }} --password ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build Docker Image
-        run: |
-          docker buildx create --name mybuilder --use
-          docker build -t rockchin/langbot:${{ steps.generate_tag.outputs.tag }} . --push
+          set -euo pipefail
+          branch_tag="${GITHUB_REF#refs/heads/}"
+          branch_tag="${branch_tag//\//-}"
+          echo "branch_tag=${branch_tag}" >> "$GITHUB_OUTPUT"
+          echo "sha_tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push immutable Core image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            rockchin/langbot:${{ steps.image.outputs.branch_tag }}
+            rockchin/langbot:${{ steps.image.outputs.sha_tag }}
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
@@ -1,59 +0,0 @@
-name: Build and deploy production
-
-on:
-  push:
-    branches: [deploy/prod]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: langbot-production
-  cancel-in-progress: false
-
-env:
-  CORE_IMAGE: ${{ secrets.DOCKER_USERNAME }}/langbot
-  CLOUD_IMAGE: ${{ secrets.DOCKER_USERNAME }}/langbot-cloud-core
-  SPACE_REF: 58253c53933f95d81b035fbe2efedb55b6c1a82b
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build exact Core image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.CORE_IMAGE }}:prod-${{ github.sha }}
-            ${{ env.CORE_IMAGE }}:deploy-prod
-          cache-from: type=gha,scope=core-prod
-          cache-to: type=gha,mode=max,scope=core-prod
-      - name: Checkout production Cloud adapter
-        uses: actions/checkout@v4
-        with:
-          repository: langbot-app/langbot-space
-          ref: ${{ env.SPACE_REF }}
-          token: ${{ secrets.CLA_PAT }}
-          path: .space
-      - name: Build exact Cloud Core image
-        uses: docker/build-push-action@v6
-        with:
-          context: .space
-          file: .space/Dockerfile.cloud
-          push: true
-          build-args: LANGBOT_CORE_IMAGE=${{ env.CORE_IMAGE }}:prod-${{ github.sha }}
-          tags: |
-            ${{ env.CLOUD_IMAGE }}:prod-${{ github.sha }}
-            ${{ env.CLOUD_IMAGE }}:deploy-prod
-          cache-from: type=gha,scope=cloud-core-prod
-          cache-to: type=gha,mode=max,scope=cloud-core-prod
@@ -43,8 +43,8 @@ Run the narrowest useful test first, then broader checks when confidence is need
 ## Where to Look

 - Architecture map: `ARCHITECTURE.md`.
- Dev environment guide: https://docs.langbot.app/zh/develop/dev-config.
- Plugin runtime / CLI / SDK debugging: https://docs.langbot.app/zh/develop/plugin-runtime.
+- Dev environment guide: https://langbot.app/docs/zh/develop/dev-config.
+- Plugin runtime / CLI / SDK debugging: https://langbot.app/docs/zh/develop/plugin-runtime.
 - API-key auth: `docs/API_KEY_AUTH.md`.
 - Box deep-dive notes: `docs/review/box-architecture.md` and related files.
 - In-repo skills: `skills/` is the single source of truth for LangBot agent skills.
@@ -169,14 +169,17 @@ The Plugin Runtime supports stdio and WebSocket control transports. Direct local

 ## Box Runtime and Skills

-Box is the sandbox subsystem used by native agent tools, stdio MCP servers, skill authoring, and managed processes.
+Box is the optional sandbox subsystem used by native execution tools, stdio MCP servers, agent-side skill authoring, and managed processes. Skill storage and read-only access are Core responsibilities and remain available without Box.

 In this repo:

- `pkg/box/service.py` is the application-facing facade for exec, sessions, managed processes, skill CRUD, status, reconnects, quotas, mounts, and sandbox profiles.
+- `pkg/box/service.py` is the application-facing facade for exec, sessions, managed processes, status, reconnects, quotas, generic mounts, and sandbox profiles.
 - `pkg/box/connector.py` connects to the Box Runtime over stdio, Windows subprocess+WebSocket, or remote WebSocket.
- `pkg/provider/tools/loaders/native.py`, `mcp_stdio.py`, and skill loaders depend on Box availability.
- `pkg/skill/manager.py` loads skills from the Box runtime, falling back to local `data/skills` when needed.
+- `pkg/provider/tools/loaders/native.py` is the Core orchestration seam: the
+  Skill loader supplies generic read-only mounts to Box execution. `mcp_stdio.py`
+  and execution-backed tools depend on Box availability.
+- `pkg/skill/repository.py` is the thin async/Workspace adapter over the Plugin SDK's execution-independent `SkillStore`; `skills.root` owns its location independently of Box.
+- `pkg/skill/manager.py` caches the Core repository catalog for progressive disclosure. Activation and read-only resource tools do not require Box; script execution and Workspace mutation still do.

 Durable Box Workspace storage is shared across placement generations, but
 sandbox sessions and managed processes are generation-scoped. LangBot validates
@@ -187,11 +190,17 @@ retires stale processes and closes already-attached relays.
 In `langbot-plugin-sdk`:

 - `src/langbot_plugin/box/server.py` implements `lbp box` and the WebSocket endpoints on `:5410`.
- `src/langbot_plugin/box/runtime.py` owns sandbox sessions and managed processes.
+- `src/langbot_plugin/box/runtime.py` owns sandbox sessions, generic read-only mounts, and managed processes.
 - `backend.py`, `nsjail_backend.py`, and `e2b_backend.py` implement sandbox backends.
- `skill_store.py` manages skill packages from the Box side.
+- `src/langbot_plugin/skill_store.py` is consumed by Core, not Box. Core turns
+  selected package roots into generic read-only mounts; Box does not understand
+  Skill names, metadata, revisions, files, or CRUD.

-Important config keys live under `box:` in `src/langbot/templates/config.yaml`: `box.enabled`, `box.backend`, `box.runtime.endpoint`, and `box.local.*`. Start LangBot with `--standalone-box` when connecting to an externally launched Box runtime.
+Skill storage uses `skills.root`. Box execution config lives under `box:`:
+`box.enabled`, `box.backend`, `box.runtime.endpoint`, and `box.local.*`. The old
+`box.local.skills_root` key is read only as an online-upgrade fallback and is
+marked for removal in the next major version. Start LangBot with
+`--standalone-box` when connecting to an externally launched Box runtime.

 ## HTTP API, Web UI, and MCP Server

@@ -1,4 +1,4 @@
-FROM node:22-alpine AS node
+FROM --platform=$BUILDPLATFORM node:22-alpine AS node

 WORKDIR /app

@@ -62,7 +62,7 @@ RUN apt-get update \
    && apt-get install -y --no-install-recommends nodejs \
    && rm -f /tmp/nodesource_setup.sh \
    && python -m pip install --no-cache-dir uv \
-    && uv sync \
+    && uv sync --extra seekdb \
    && apt-get purge -y --auto-remove curl git gnupg \
    && rm -rf /var/lib/apt/lists/* \
    && touch /.dockerenv
@@ -19,9 +19,9 @@ English / [简体中文](README_CN.md) / [繁體中文](README_TW.md) / [日本
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">Website</a> ｜
-<a href="https://link.langbot.app/en/docs/features">Features</a> ｜
-<a href="https://link.langbot.app/en/docs/guide">Docs</a> ｜
-<a href="https://link.langbot.app/en/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/en/insight/features">Features</a> ｜
+<a href="https://langbot.app/docs/en/insight/guide">Docs</a> ｜
+<a href="https://langbot.app/docs/en/tags/readme">API</a> ｜
 <a href="https://space.langbot.app/cloud">Cloud</a> ｜
 <a href="https://space.langbot.app">Plugin Market</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">Roadmap</a>
@@ -49,7 +49,7 @@ LangBot is an **open-source, production-grade platform** for building AI-powered
 - **Web Management Panel** — Configure, manage, and monitor your bots through an intuitive browser interface. No YAML editing required.
 - **Multi-Pipeline Architecture** — Different bots for different scenarios, with comprehensive monitoring and exception handling.

-[→ Learn more about all features](https://link.langbot.app/en/docs/features)
+[→ Learn more about all features](https://langbot.app/docs/en/insight/features)

 📍 Practical guides: [deploy a multi-platform AI bot in 5 minutes](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/), [connect DeepSeek to WeChat, Discord, and Telegram](https://langbot.app/en/blog/connect-deepseek-to-wechat/), [run a Dify Agent in Discord, Telegram, and Slack](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/), and [build an n8n-powered chatbot](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/).

@@ -83,12 +83,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### One-Click Cloud Deploy

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**More options:** [Docker](https://link.langbot.app/en/docs/docker) · [Manual](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**More options:** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [Manual](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -150,7 +151,7 @@ _Note: Public demo environment. Do not enter sensitive information._
 | [302.AI](https://share.302ai.cn/SuTG99)                                                                             | Gateway      | ✅     |
 | [Qiniu](https://www.qiniu.com/ai/agent)                                                                           | Gateway      | ✅     |

-[→ View all integrations](https://link.langbot.app/en/docs/features)
+[→ View all integrations](https://langbot.app/docs/en/insight/features)

 ---

@@ -21,9 +21,9 @@
 [![star](https://gitcode.com/RockChinQ/LangBot/star/badge.svg)](https://gitcode.com/RockChinQ/LangBot)

 <a href="https://langbot.app">官网</a> ｜
-<a href="https://link.langbot.app/zh/docs/features">特性</a> ｜
-<a href="https://link.langbot.app/zh/docs/guide">文档</a> ｜
-<a href="https://link.langbot.app/zh/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/zh/insight/features">特性</a> ｜
+<a href="https://langbot.app/docs/zh/insight/guide">文档</a> ｜
+<a href="https://langbot.app/docs/zh/tags/readme">API</a> ｜
 <a href="https://space.langbot.app/cloud">Cloud</a> ｜
 <a href="https://space.langbot.app">扩展市场</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">路线图</a>
@@ -49,7 +49,7 @@ LangBot 是一个**开源的生产级平台**，用于构建 AI 驱动的即时
 - **Web 管理面板** — 通过浏览器直观地配置、管理和监控机器人，无需手动编辑配置文件。
 - **多流水线架构** — 不同机器人用于不同场景，具备全面的监控和异常处理能力。

-[→ 了解更多功能特性](https://link.langbot.app/zh/docs/features)
+[→ 了解更多功能特性](https://langbot.app/docs/zh/insight/features)

 📍 实践指南：[5 分钟部署多平台 AI 机器人](https://langbot.app/zh/blog/deploy-ai-bot-in-5-minutes/)、[将 DeepSeek 接入微信、企业微信与 Discord](https://langbot.app/zh/blog/connect-deepseek-to-wechat/)、[让 Dify Agent 跑在 Discord、Telegram 和 Slack 上](https://langbot.app/zh/blog/dify-agent-discord-telegram-slack/)，以及[用 n8n 构建多平台 AI 聊天机器人](https://langbot.app/zh/blog/n8n-multi-platform-ai-chatbot/)。

@@ -83,12 +83,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### 一键云部署

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/zh-CN/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**更多方式：** [Docker](https://link.langbot.app/zh/docs/docker) · [手动部署](https://link.langbot.app/zh/docs/manual-deploy) · [宝塔面板](https://link.langbot.app/zh/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/zh/deploy/langbot/kubernetes)
+**更多方式：** [Docker](https://langbot.app/docs/zh/deploy/langbot/docker) · [手动部署](https://langbot.app/docs/zh/deploy/langbot/manual) · [宝塔面板](https://langbot.app/docs/zh/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/zh/deploy/langbot/kubernetes)

 ---

@@ -151,7 +152,7 @@ docker compose --profile all up -d
 | [百宝箱Tbox](https://www.tbox.cn/open) | 智能体平台 | ✅ |
 | [七牛云Qiniu](https://www.qiniu.com/ai/agent) | 聚合平台 | ✅ |

-[→ 查看完整集成列表](https://link.langbot.app/zh/docs/features)
+[→ 查看完整集成列表](https://langbot.app/docs/zh/insight/features)

 ### TTS（语音合成）

@@ -19,9 +19,9 @@
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">Inicio</a> ｜
-<a href="https://link.langbot.app/en/docs/features">Características</a> ｜
-<a href="https://link.langbot.app/en/docs/guide">Documentación</a> ｜
-<a href="https://link.langbot.app/en/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/en/insight/features">Características</a> ｜
+<a href="https://langbot.app/docs/en/insight/guide">Documentación</a> ｜
+<a href="https://langbot.app/docs/en/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">Mercado de Plugins</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">Hoja de Ruta</a>

@@ -48,7 +48,7 @@ LangBot es una **plataforma de código abierto y grado de producción** para con
 - **Panel de Gestión Web** — Configure, gestione y monitoree sus bots a través de una interfaz de navegador intuitiva. Sin necesidad de editar YAML.
 - **Arquitectura Multi-Pipeline** — Diferentes bots para diferentes escenarios, con monitoreo completo y manejo de excepciones.

-[→ Conocer más sobre todas las funcionalidades](https://link.langbot.app/en/docs/features)
+[→ Conocer más sobre todas las funcionalidades](https://langbot.app/docs/en/insight/features)

 📍 Guías prácticas: [desplegar un bot de IA multiplataforma en 5 minutos](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/), [conectar DeepSeek a WeChat, Discord y Telegram](https://langbot.app/en/blog/connect-deepseek-to-wechat/), [ejecutar un Dify Agent en Discord, Telegram y Slack](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/) y [crear un chatbot con n8n](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/).

@@ -82,12 +82,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### Despliegue en la Nube con un Clic

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**Más opciones:** [Docker](https://link.langbot.app/en/docs/docker) · [Manual](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**Más opciones:** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [Manual](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -148,7 +149,7 @@ docker compose --profile all up -d
 | [302.AI](https://share.302ai.cn/SuTG99) | Pasarela | ✅ |
 | [Qiniu](https://www.qiniu.com/ai/agent) | Pasarela | ✅ |

-[→ Ver todas las integraciones](https://link.langbot.app/en/docs/features)
+[→ Ver todas las integraciones](https://langbot.app/docs/en/insight/features)

 ---

@@ -19,9 +19,9 @@
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">Accueil</a> ｜
-<a href="https://link.langbot.app/en/docs/features">Fonctionnalités</a> ｜
-<a href="https://link.langbot.app/en/docs/guide">Documentation</a> ｜
-<a href="https://link.langbot.app/en/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/en/insight/features">Fonctionnalités</a> ｜
+<a href="https://langbot.app/docs/en/insight/guide">Documentation</a> ｜
+<a href="https://langbot.app/docs/en/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">Marché des Plugins</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">Feuille de Route</a>

@@ -48,7 +48,7 @@ LangBot est une **plateforme open-source de niveau production** pour créer des
 - **Panneau de Gestion Web** — Configurez, gérez et surveillez vos bots via une interface navigateur intuitive. Aucune édition de YAML requise.
 - **Architecture Multi-Pipeline** — Différents bots pour différents scénarios, avec surveillance complète et gestion des exceptions.

-[→ En savoir plus sur toutes les fonctionnalités](https://link.langbot.app/en/docs/features)
+[→ En savoir plus sur toutes les fonctionnalités](https://langbot.app/docs/en/insight/features)

 📍 Guides pratiques : [déployer un bot IA multiplateforme en 5 minutes](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/), [connecter DeepSeek à WeChat, Discord et Telegram](https://langbot.app/en/blog/connect-deepseek-to-wechat/), [exécuter un Dify Agent dans Discord, Telegram et Slack](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/) et [créer un chatbot avec n8n](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/).

@@ -82,12 +82,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### Déploiement Cloud en un Clic

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**Plus d'options :** [Docker](https://link.langbot.app/en/docs/docker) · [Manuel](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**Plus d'options :** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [Manuel](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -148,7 +149,7 @@ docker compose --profile all up -d
 | [ShengSuanYun](https://www.shengsuanyun.com/?from=CH_KYIPP758) | Plateforme GPU | ✅ |
 | [Qiniu](https://www.qiniu.com/ai/agent) | Passerelle | ✅ |

-[→ Voir toutes les intégrations](https://link.langbot.app/en/docs/features)
+[→ Voir toutes les intégrations](https://langbot.app/docs/en/insight/features)

 ---

@@ -19,9 +19,9 @@
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">ホーム</a> ｜
-<a href="https://link.langbot.app/ja/docs/features">機能</a> ｜
-<a href="https://link.langbot.app/ja/docs/guide">ドキュメント</a> ｜
-<a href="https://link.langbot.app/ja/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/ja/insight/features">機能</a> ｜
+<a href="https://langbot.app/docs/ja/insight/guide">ドキュメント</a> ｜
+<a href="https://langbot.app/docs/ja/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">プラグインマーケット</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">ロードマップ</a>

@@ -48,7 +48,7 @@ LangBot は、AI搭載のインスタントメッセージングボットを構
 - **Web管理パネル** — 直感的なブラウザインターフェースからボットの設定、管理、監視が可能。YAML編集は不要。
 - **マルチパイプラインアーキテクチャ** — 異なるシナリオに異なるボットを配置し、包括的な監視と例外処理を実現。

-[→ すべての機能について詳しく見る](https://link.langbot.app/ja/docs/features)
+[→ すべての機能について詳しく見る](https://langbot.app/docs/ja/insight/features)

 📍 実践ガイド: [5分でマルチプラットフォームAIボットをデプロイ](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/)、[DeepSeekをWeChat・Discord・Telegramに接続](https://langbot.app/en/blog/connect-deepseek-to-wechat/)、[Dify AgentをDiscord・Telegram・Slackで動かす](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/)、[n8n連携チャットボットを構築](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/)。

@@ -82,12 +82,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### ワンクリッククラウドデプロイ

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**その他:** [Docker](https://link.langbot.app/en/docs/docker) · [手動デプロイ](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**その他:** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [手動デプロイ](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -148,7 +149,7 @@ docker compose --profile all up -d
 | [302.AI](https://share.302ai.cn/SuTG99) | ゲートウェイ | ✅ |
 | [Qiniu](https://www.qiniu.com/ai/agent) | ゲートウェイ | ✅ |

-[→ すべての統合を表示](https://link.langbot.app/en/docs/features)
+[→ すべての統合を表示](https://langbot.app/docs/en/insight/features)

 ---

@@ -19,9 +19,9 @@
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">홈</a> ｜
-<a href="https://link.langbot.app/en/docs/features">기능</a> ｜
-<a href="https://link.langbot.app/en/docs/guide">문서</a> ｜
-<a href="https://link.langbot.app/en/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/en/insight/features">기능</a> ｜
+<a href="https://langbot.app/docs/en/insight/guide">문서</a> ｜
+<a href="https://langbot.app/docs/en/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">플러그인 마켓</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">로드맵</a>

@@ -48,7 +48,7 @@ LangBot은 AI 기반 인스턴트 메시징 봇을 구축하기 위한 **오픈
 - **웹 관리 패널** — 직관적인 브라우저 인터페이스로 봇을 구성, 관리 및 모니터링. YAML 편집 불필요.
 - **멀티 파이프라인 아키텍처** — 다양한 시나리오에 맞는 다양한 봇 구성, 종합 모니터링 및 예외 처리.

-[→ 모든 기능 자세히 보기](https://link.langbot.app/en/docs/features)
+[→ 모든 기능 자세히 보기](https://langbot.app/docs/en/insight/features)

 📍 실전 가이드: [5분 만에 멀티 플랫폼 AI 봇 배포하기](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/), [DeepSeek를 WeChat, Discord, Telegram에 연결하기](https://langbot.app/en/blog/connect-deepseek-to-wechat/), [Dify Agent를 Discord, Telegram, Slack에서 실행하기](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/), [n8n 기반 챗봇 만들기](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/).

@@ -82,12 +82,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### 원클릭 클라우드 배포

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**더 많은 옵션:** [Docker](https://link.langbot.app/en/docs/docker) · [수동 배포](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**더 많은 옵션:** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [수동 배포](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -148,7 +149,7 @@ docker compose --profile all up -d
 | [302.AI](https://share.302ai.cn/SuTG99) | 게이트웨이 | ✅ |
 | [Qiniu](https://www.qiniu.com/ai/agent) | 게이트웨이 | ✅ |

-[→ 모든 통합 보기](https://link.langbot.app/en/docs/features)
+[→ 모든 통합 보기](https://langbot.app/docs/en/insight/features)

 ---

@@ -19,9 +19,9 @@
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">Главная</a> ｜
-<a href="https://link.langbot.app/en/docs/features">Возможности</a> ｜
-<a href="https://link.langbot.app/en/docs/guide">Документация</a> ｜
-<a href="https://link.langbot.app/en/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/en/insight/features">Возможности</a> ｜
+<a href="https://langbot.app/docs/en/insight/guide">Документация</a> ｜
+<a href="https://langbot.app/docs/en/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">Магазин плагинов</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">Дорожная карта</a>

@@ -48,7 +48,7 @@ LangBot — это **платформа с открытым исходным к
 - **Веб-панель управления** — Настраивайте, управляйте и мониторьте ваших ботов через интуитивный браузерный интерфейс. Ручное редактирование YAML не требуется.
 - **Мультиконвейерная архитектура** — Разные боты для разных сценариев с комплексным мониторингом и обработкой исключений.

-[→ Подробнее обо всех возможностях](https://link.langbot.app/en/docs/features)
+[→ Подробнее обо всех возможностях](https://langbot.app/docs/en/insight/features)

 📍 Практические руководства: [развернуть мультиплатформенного ИИ-бота за 5 минут](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/), [подключить DeepSeek к WeChat, Discord и Telegram](https://langbot.app/en/blog/connect-deepseek-to-wechat/), [запустить Dify Agent в Discord, Telegram и Slack](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/) и [создать чат-бота на n8n](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/).

@@ -82,12 +82,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### Облачное развертывание одним кликом

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**Другие варианты:** [Docker](https://link.langbot.app/en/docs/docker) · [Ручная установка](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**Другие варианты:** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [Ручная установка](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -148,7 +149,7 @@ docker compose --profile all up -d
 | [ShengSuanYun](https://www.shengsuanyun.com/?from=CH_KYIPP758) | Платформа GPU | ✅ |
 | [Qiniu](https://www.qiniu.com/ai/agent) | Шлюз | ✅ |

-[→ Смотреть все интеграции](https://link.langbot.app/en/docs/features)
+[→ Смотреть все интеграции](https://langbot.app/docs/en/insight/features)

 ---

@@ -21,9 +21,9 @@
 [![star](https://gitcode.com/RockChinQ/LangBot/star/badge.svg)](https://gitcode.com/RockChinQ/LangBot)

 <a href="https://langbot.app">官網</a> ｜
-<a href="https://link.langbot.app/zh/docs/features">特性</a> ｜
-<a href="https://link.langbot.app/zh/docs/guide">文件</a> ｜
-<a href="https://link.langbot.app/zh/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/zh/insight/features">特性</a> ｜
+<a href="https://langbot.app/docs/zh/insight/guide">文件</a> ｜
+<a href="https://langbot.app/docs/zh/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">外掛市場</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">路線圖</a>

@@ -50,7 +50,7 @@ LangBot 是一個**開源的生產級平台**，用於建構 AI 驅動的即時
 - **Web 管理面板** — 透過瀏覽器直觀地配置、管理和監控機器人，無需手動編輯設定檔。
 - **多流水線架構** — 不同機器人用於不同場景，具備全面的監控和異常處理能力。

-[→ 了解更多功能特性](https://link.langbot.app/zh/docs/features)
+[→ 了解更多功能特性](https://langbot.app/docs/zh/insight/features)

 📍 實踐指南：[5 分鐘部署多平台 AI 機器人](https://langbot.app/zh/blog/deploy-ai-bot-in-5-minutes/)、[將 DeepSeek 接入微信、企業微信與 Discord](https://langbot.app/zh/blog/connect-deepseek-to-wechat/)、[讓 Dify Agent 跑在 Discord、Telegram 和 Slack 上](https://langbot.app/zh/blog/dify-agent-discord-telegram-slack/)，以及[用 n8n 建構多平台 AI 聊天機器人](https://langbot.app/zh/blog/n8n-multi-platform-ai-chatbot/)。

@@ -84,12 +84,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### 一鍵雲端部署

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/zh-CN/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**更多方式：** [Docker](https://link.langbot.app/zh/docs/docker) · [手動部署](https://link.langbot.app/zh/docs/manual-deploy) · [寶塔面板](https://link.langbot.app/zh/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/zh/deploy/langbot/kubernetes)
+**更多方式：** [Docker](https://langbot.app/docs/zh/deploy/langbot/docker) · [手動部署](https://langbot.app/docs/zh/deploy/langbot/manual) · [寶塔面板](https://langbot.app/docs/zh/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/zh/deploy/langbot/kubernetes)

 ---

@@ -164,7 +165,7 @@ docker compose --profile all up -d
 |-----------|------|
 | 阿里雲百煉 | [外掛](https://github.com/Thetail001/LangBot_BailianTextToImagePlugin) |

-[→ 查看完整整合列表](https://link.langbot.app/zh/docs/features)
+[→ 查看完整整合列表](https://langbot.app/docs/zh/insight/features)

 ---

@@ -19,9 +19,9 @@
 [![GitHub stars](https://img.shields.io/github/stars/langbot-app/LangBot?style=social)](https://github.com/langbot-app/LangBot/stargazers)

 <a href="https://langbot.app">Trang chủ</a> ｜
-<a href="https://link.langbot.app/en/docs/features">Tính năng</a> ｜
-<a href="https://link.langbot.app/en/docs/guide">Tài liệu</a> ｜
-<a href="https://link.langbot.app/en/docs/api">API</a> ｜
+<a href="https://langbot.app/docs/en/insight/features">Tính năng</a> ｜
+<a href="https://langbot.app/docs/en/insight/guide">Tài liệu</a> ｜
+<a href="https://langbot.app/docs/en/tags/readme">API</a> ｜
 <a href="https://space.langbot.app">Chợ Plugin</a> ｜
 <a href="https://langbot.featurebase.app/roadmap">Lộ trình</a>

@@ -48,7 +48,7 @@ LangBot là một **nền tảng mã nguồn mở, cấp sản xuất** để x
 - **Bảng quản lý Web** — Cấu hình, quản lý và giám sát bot thông qua giao diện trình duyệt trực quan. Không cần chỉnh sửa YAML.
 - **Kiến trúc đa Pipeline** — Các bot khác nhau cho các kịch bản khác nhau, với giám sát toàn diện và xử lý ngoại lệ.

-[→ Tìm hiểu thêm về tất cả tính năng](https://link.langbot.app/en/docs/features)
+[→ Tìm hiểu thêm về tất cả tính năng](https://langbot.app/docs/en/insight/features)

 📍 Hướng dẫn thực hành: [triển khai bot AI đa nền tảng trong 5 phút](https://langbot.app/en/blog/deploy-ai-bot-in-5-minutes/), [kết nối DeepSeek với WeChat, Discord và Telegram](https://langbot.app/en/blog/connect-deepseek-to-wechat/), [chạy Dify Agent trên Discord, Telegram và Slack](https://langbot.app/en/blog/dify-agent-discord-telegram-slack/) và [xây dựng chatbot với n8n](https://langbot.app/en/blog/n8n-multi-platform-ai-chatbot/).

@@ -82,12 +82,13 @@ cd LangBot/docker
 docker compose --profile all up -d
 ```

+
 ### Triển khai đám mây một cú nhấp

 [![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/en-US/templates/ZKTBDH)
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.app/template/yRrAyL?referralCode=vogKPF)

-**Thêm tùy chọn:** [Docker](https://link.langbot.app/en/docs/docker) · [Thủ công](https://link.langbot.app/en/docs/manual-deploy) · [BTPanel](https://link.langbot.app/en/docs/bt-panel) · [Kubernetes](https://docs.langbot.app/en/deploy/langbot/kubernetes)
+**Thêm tùy chọn:** [Docker](https://langbot.app/docs/en/deploy/langbot/docker) · [Thủ công](https://langbot.app/docs/en/deploy/langbot/manual) · [BTPanel](https://langbot.app/docs/en/deploy/langbot/one-click/bt) · [Kubernetes](https://langbot.app/docs/en/deploy/langbot/kubernetes)

 ---

@@ -148,7 +149,7 @@ docker compose --profile all up -d
 | [302.AI](https://share.302ai.cn/SuTG99) | Cổng | ✅ |
 | [Qiniu](https://www.qiniu.com/ai/agent) | Cổng | ✅ |

-[→ Xem tất cả tích hợp](https://link.langbot.app/en/docs/features)
+[→ Xem tất cả tích hợp](https://langbot.app/docs/en/insight/features)

 ---

@@ -1,97 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-cd /opt/langbot-cloud-prod
-TAG=${1:?usage: deploy.sh prod-<40-char-sha>}
-[[ "$TAG" =~ ^prod-[0-9a-f]{40}$ ]] || { echo 'invalid immutable image tag' >&2; exit 2; }
-[[ -s .env ]] || { echo '/opt/langbot-cloud-prod/.env is missing' >&2; exit 3; }
-
-rendered_compose=$(docker compose config)
-grep -Fq 'LANGBOT_SPACE_CONTROL_PLANE_URL: https://space.langbot.app' <<<"$rendered_compose" || {
-  echo 'Cloud control-plane URL must be https://space.langbot.app' >&2
-  exit 4
-}
-grep -Fq 'SPACE__URL: https://space.langbot.app' <<<"$rendered_compose" || {
-  echo 'Cloud user-facing Space URL must be https://space.langbot.app' >&2
-  exit 5
-}
-grep -Eq 'LANGBOT_TELEMETRY_INGEST_TOKEN: .+' <<<"$rendered_compose" || {
-  echo 'Cloud telemetry ingest token must be configured' >&2
-  exit 6
-}
-
-update_env() {
-  local key=$1 value=$2
-  python3 - "$key" "$value" <<'PY'
-from pathlib import Path
-import os
-import sys
-
-path = Path('.env')
-key, value = sys.argv[1:]
-lines = path.read_text().splitlines()
-updated = False
-for index, line in enumerate(lines):
-    if line.startswith(f'{key}='):
-        lines[index] = f'{key}={value}'
-        updated = True
-        break
-if not updated:
-    lines.append(f'{key}={value}')
-temporary = Path('.env.tmp')
-temporary.write_text('\n'.join(lines) + '\n')
-os.chmod(temporary, 0o600)
-temporary.replace(path)
-PY
-}
-update_env LANGBOT_IMAGE_TAG "$TAG"
-set -a
-. ./.env
-set +a
-: "${CLOUD_V2_CONTROL_PLANE_TOKEN:?CLOUD_V2_CONTROL_PLANE_TOKEN is required}"
-
-for attempt in 1 2 3 4 5; do
-  if docker compose pull postgres redis migrate plugin-runtime core; then
-    break
-  fi
-  if [ "$attempt" -eq 5 ]; then
-    echo "docker compose pull failed after $attempt attempts" >&2
-    exit 1
-  fi
-  delay=$((attempt * 10))
-  echo "docker compose pull failed (attempt $attempt/5); retrying in ${delay}s" >&2
-  sleep "$delay"
-done
-docker compose up -d postgres redis
-for _ in $(seq 1 60); do
-  if docker compose exec -T postgres pg_isready -U langbot_operator -d langbot >/dev/null 2>&1; then break; fi
-  sleep 2
-done
-docker compose exec -T postgres pg_isready -U langbot_operator -d langbot >/dev/null
-
-docker compose exec -T postgres psql -v ON_ERROR_STOP=1 -U langbot_operator -d langbot \
-  -v runtime_password="$POSTGRES_RUNTIME_PASSWORD" <<'SQL'
-SELECT format('CREATE ROLE langbot_runtime LOGIN PASSWORD %L', :'runtime_password')
-WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'langbot_runtime')\gexec
-ALTER ROLE langbot_runtime PASSWORD :'runtime_password';
-GRANT CONNECT ON DATABASE langbot TO langbot_runtime;
-REVOKE CREATE ON SCHEMA public FROM PUBLIC, langbot_runtime;
-REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM langbot_runtime;
-REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM langbot_runtime;
-ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public REVOKE ALL ON TABLES FROM langbot_runtime;
-ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public REVOKE ALL ON SEQUENCES FROM langbot_runtime;
-GRANT USAGE ON SCHEMA public TO langbot_runtime;
-SQL
-
-docker compose --profile tools run --rm migrate
-
-docker compose up -d --remove-orphans plugin-runtime core
-for _ in $(seq 1 90); do
-  if docker compose exec -T core python -c 'import urllib.request; urllib.request.urlopen("http://127.0.0.1:5300/healthz", timeout=3)' >/dev/null 2>&1; then
-    docker compose ps
-    exit 0
-  fi
-  sleep 2
-done
-docker compose logs --tail=200 core plugin-runtime >&2
-exit 1
@@ -1,162 +0,0 @@
-services:
-  postgres:
-    image: pgvector/pgvector:pg17
-    container_name: langbot-cloud-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: langbot
-      POSTGRES_USER: langbot_operator
-      POSTGRES_PASSWORD: ${POSTGRES_OPERATOR_PASSWORD}
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    healthcheck:
-      test: [CMD-SHELL, "pg_isready -U langbot_operator -d langbot"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-    networks: [internal]
-
-  redis:
-    image: redis:7.4-alpine
-    container_name: langbot-cloud-redis
-    restart: unless-stopped
-    command: [redis-server, --appendonly, "yes", --requirepass, "${REDIS_PASSWORD}"]
-    volumes:
-      - redis-data:/data
-    healthcheck:
-      test: [CMD-SHELL, "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
-      interval: 5s
-      timeout: 5s
-      retries: 20
-    environment:
-      REDIS_PASSWORD: ${REDIS_PASSWORD}
-    networks: [internal]
-
-  migrate:
-    image: rockchin/langbot-cloud-core:${LANGBOT_IMAGE_TAG}
-    profiles: [tools]
-    command: [uv, run, langbot, migrate, --cloud]
-    environment: &core-env
-      TZ: Asia/Shanghai
-      SYSTEM__INSTANCE_ID: ${CLOUD_V2_INSTANCE_UUID}
-      SYSTEM__EDITION: cloud
-      SYSTEM__RECOVERY_KEY: ${SYSTEM_RECOVERY_KEY}
-      SYSTEM__JWT__SECRET: ${JWT_SECRET}
-      SYSTEM__LIMITATION__MAX_BOTS: "2"
-      SYSTEM__LIMITATION__MAX_PIPELINES: "3"
-      SYSTEM__LIMITATION__MAX_EXTENSIONS: "3"
-      SYSTEM__LIMITATION__MAX_KNOWLEDGE_BASES: "2"
-      API__WEBHOOK_PREFIX: https://cloud.langbot.app
-      API__WEBUI_URL: https://cloud.langbot.app
-      WORKSPACE__INVITATIONS__PUBLIC_WEB_URL: https://cloud.langbot.app
-      DATABASE__USE: postgresql
-      DATABASE__POSTGRESQL__URL: postgresql+asyncpg://langbot_runtime:${POSTGRES_RUNTIME_PASSWORD}@postgres:5432/langbot
-      DATABASE__CLOUD_MIGRATION__OPERATOR_DSN_ENV: LANGBOT_CLOUD_MIGRATION_DSN
-      LANGBOT_CLOUD_MIGRATION_DSN: postgresql://langbot_operator:${POSTGRES_OPERATOR_PASSWORD}@postgres:5432/langbot
-      VDB__USE: pgvector
-      VDB__PGVECTOR__USE_BUSINESS_DATABASE: "true"
-      VDB__PGVECTOR__ALLOWED_DIMENSIONS: "384,512,768,1024,1536"
-      PLUGIN__ENABLE: "true"
-      PLUGIN__RUNTIME_WS_URL: ws://plugin-runtime:5400/control/ws
-      PLUGIN__DISPLAY_PLUGIN_DEBUG_URL: wss://cloud.langbot.app/plugin/debug/ws
-      PLUGIN__WORKER__MAX_CPUS: "0.25"
-      PLUGIN__WORKER__MAX_MEMORY_MB: "256"
-      PLUGIN__WORKER__MAX_PIDS: "128"
-      PLUGIN__WORKER__MAX_WORKERS: "16"
-      PLUGIN__WORKER__MAX_TOTAL_CPUS: "4.0"
-      PLUGIN__WORKER__MAX_TOTAL_MEMORY_MB: "4096"
-      PLUGIN__WORKER__REQUIRE_HARD_LIMITS: "true"
-      LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN: ${PLUGIN_RUNTIME_CONTROL_TOKEN}
-      # Cloud v2 currently grants no managed Box capability. Keep the shared
-      # runtime deployed but disable Core integration until a hard-quota-capable
-      # backend can satisfy the fail-closed Cloud readiness contract.
-      BOX__ENABLED: "false"
-      BOX__BACKEND: nsjail
-      BOX__RUNTIME__ENDPOINT: ws://box:5410
-      BOX__ADMISSION__REQUIRED: "true"
-      BOX__ADMISSION__LOGICAL_SESSION_ID: global
-      BOX__ADMISSION__REQUIRED_BACKEND: nsjail
-      BOX__ADMISSION__MAX_SESSIONS: "1"
-      BOX__ADMISSION__MAX_MANAGED_PROCESSES: "0"
-      BOX__ADMISSION__CPUS: "0.25"
-      BOX__ADMISSION__MEMORY_MB: "256"
-      BOX__ADMISSION__WORKSPACE_QUOTA_MB: "256"
-      BOX__LOCAL__HOST_ROOT: /app/data/box
-      BOX__LOCAL__DEFAULT_WORKSPACE: /app/data/box
-      BOX__LOCAL__ALLOWED_MOUNT_ROOTS: /app/data/box
-      LANGBOT_BOX_CONTROL_TOKEN: ${BOX_CONTROL_TOKEN}
-      MCP__STDIO__ENABLED: "false"
-      LANGBOT_SPACE_CONTROL_PLANE_URL: https://space.langbot.app
-      LANGBOT_SPACE_CONTROL_PLANE_TOKEN: ${CLOUD_V2_CONTROL_PLANE_TOKEN}
-      LANGBOT_TELEMETRY_INGEST_TOKEN: ${CLOUD_V2_CONTROL_PLANE_TOKEN}
-      LANGBOT_SPACE_CONTROL_PLANE_PUBLIC_KEY: ${CLOUD_V2_MANIFEST_PUBLIC_KEY}
-      LANGBOT_SPACE_CONTROL_PLANE_KEY_ID: ${CLOUD_V2_MANIFEST_KEY_ID}
-      SPACE__URL: https://space.langbot.app
-    depends_on:
-      postgres: {condition: service_healthy}
-    networks: [internal]
-
-  plugin-runtime:
-    image: rockchin/langbot:${LANGBOT_IMAGE_TAG}
-    container_name: langbot-cloud-plugin-runtime
-    restart: unless-stopped
-    command: [uv, run, python, -m, langbot_plugin.cli.__init__, rt]
-    environment:
-      LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN: ${PLUGIN_RUNTIME_CONTROL_TOKEN}
-    volumes:
-      - plugin-data:/app/data
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-    cgroup: host
-    privileged: true
-    expose: ["5400"]
-    networks: [internal]
-
-  box:
-    image: rockchin/langbot:${LANGBOT_IMAGE_TAG}
-    container_name: langbot-cloud-box
-    restart: unless-stopped
-    command: [uv, run, lbp, box, --host, 0.0.0.0, --ws-control-port, "5410"]
-    environment:
-      LANGBOT_BOX_CONTROL_TOKEN: ${BOX_CONTROL_TOKEN}
-      LANGBOT_BOX_ROOT: /app/data/box
-    volumes:
-      - box-data:/app/data/box
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-    cgroup: host
-    privileged: true
-    expose: ["5410"]
-    networks: [internal]
-
-  core:
-    image: rockchin/langbot-cloud-core:${LANGBOT_IMAGE_TAG}
-    container_name: langbot-cloud-core
-    restart: unless-stopped
-    environment: *core-env
-    volumes:
-      - core-data:/app/data
-      - box-data:/app/data/box
-    depends_on:
-      postgres: {condition: service_healthy}
-      redis: {condition: service_healthy}
-      plugin-runtime: {condition: service_started}
-      box: {condition: service_started}
-    expose: ["5300"]
-    healthcheck:
-      test: [CMD-SHELL, "python -c 'import urllib.request; urllib.request.urlopen(\"http://127.0.0.1:5300/healthz\", timeout=3)'" ]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 30s
-    networks: [internal, shared-network]
-
-networks:
-  internal:
-  shared-network:
-    external: true
-
-volumes:
-  postgres-data:
-  redis-data:
-  plugin-data:
-  box-data:
-  core-data:
@@ -1,5 +1,5 @@
 # Docker Compose configuration for LangBot
-# For Kubernetes deployment, see kubernetes.yaml and the deployment guide at https://docs.langbot.app
+# For Kubernetes deployment, see kubernetes.yaml and the deployment guide at https://langbot.app/docs
 version: "3"

 services:
@@ -27,8 +27,8 @@ services:

  # The Box sandbox runtime is optional. It is only started when you run
  # ``docker compose --profile box up`` (or ``docker compose --profile all
-  # up``). With Box off, LangBot keeps the dashboard / skills list visible
-  # (read-only) but disables sandbox tools, skill add/edit and stdio MCP —
+  # up``). With Box off, LangBot keeps skill management, activation, and
+  # read-only resources available but disables execution tools and stdio MCP —
  # set ``box.enabled: false`` in ``data/config.yaml`` (or
  # ``BOX__ENABLED=false`` in the langbot service env below) to match.
  langbot_box:
@@ -47,11 +47,10 @@ services:
    restart: on-failure
    environment:
      - TZ=Asia/Shanghai
-      # Shared control-plane secret used to authenticate both the RPC socket
-      # and managed-process relay. Generate once (for example with
-      # ``openssl rand -hex 32``) and export it before enabling this profile.
-      # An empty value is accepted by Compose so Box can remain optional, but
-      # the Box runtime itself fails closed when the profile is started.
+      # Optional shared control-plane secret used to authenticate both the RPC
+      # socket and managed-process relay. Leave unset on both OSS services, or
+      # generate one with ``openssl rand -hex 32`` and set the same value on
+      # both ends. Strongly recommended when the deployment is Internet-accessible.
      - LANGBOT_BOX_CONTROL_TOKEN=${LANGBOT_BOX_CONTROL_TOKEN:-}
      # Box has its own process-wide blocking-work budget.
      - LANGBOT_BLOCKING_EXECUTOR_MAX_WORKERS=${LANGBOT_BLOCKING_EXECUTOR_MAX_WORKERS:-8}
@@ -74,13 +73,18 @@ services:
    container_name: langbot
    volumes:
      - ./data:/app/data
+      # Core owns the SkillRepository even when the Box profile is disabled.
+      # Keep this path identical to langbot_box so optional execution can
+      # consume the same Workspace-scoped package revisions.
+      - ${LANGBOT_BOX_ROOT:-${PWD}/data/box}:${LANGBOT_BOX_ROOT:-${PWD}/data/box}
    restart: on-failure
    environment:
      - TZ=Asia/Shanghai
      # Optional. Leave unset on both OSS services, or match plugin Runtime.
      - LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN=${LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN:-}
-      # Must match the value supplied to langbot_box. The token is sent only
-      # in WebSocket handshake headers, never in URLs or action payloads.
+      # When set, this must match langbot_box. If both ends leave it unset,
+      # OSS permits the connection without token authentication. The token is
+      # sent only in WebSocket handshake headers, never in URLs or payloads.
      - LANGBOT_BOX_CONTROL_TOKEN=${LANGBOT_BOX_CONTROL_TOKEN:-}
      # Core process-wide blocking-work admission. These are native config
      # overrides and are persisted with the effective data/config.yaml.
@@ -92,7 +96,9 @@ services:
      # box.* and are forwarded to the Box runtime via INIT RPC.
      - BOX__LOCAL__HOST_ROOT=${LANGBOT_BOX_ROOT:-${PWD}/data/box}
      - BOX__LOCAL__DEFAULT_WORKSPACE=default
-      - BOX__LOCAL__SKILLS_ROOT=skills
+      # TODO(next-major): default LANGBOT_SKILLS_ROOT to ${PWD}/data/skills
+      # after the historical Box storage path no longer needs zero-copy upgrades.
+      - SKILLS__ROOT=${LANGBOT_SKILLS_ROOT:-${LANGBOT_BOX_ROOT:-${PWD}/data/box}/skills}
      - BOX__LOCAL__ALLOWED_MOUNT_ROOTS=${LANGBOT_BOX_ROOT:-${PWD}/data/box}
      - BOX__DOCKER__CPU_LIMIT_ENABLED=${LANGBOT_BOX_DOCKER_CPU_LIMIT_ENABLED:-true}
    ports:
@@ -1,7 +1,7 @@
 # Kubernetes Deployment for LangBot
 # This file provides Kubernetes deployment manifests for LangBot based on docker-compose.yaml
 #
-# Full deployment guide (zh/en/ja): https://docs.langbot.app -> Installation -> Kubernetes
+# Full deployment guide (zh/en/ja): https://langbot.app/docs -> Installation -> Kubernetes
 #
 # Usage:
 #   kubectl -n langbot create secret generic langbot-plugin-runtime-control \
@@ -214,8 +214,9 @@ spec:
 # Deployment for LangBot Box (sandbox) runtime
 #
 # The Box runtime backs LangBot's sandbox tools (exec / read / write / edit /
-# glob / grep), the `activate` skill tool, skill add/edit, and stdio-mode MCP
-# servers. It is OPTIONAL: if you do not deploy it, set `BOX__ENABLED=false` on
+# glob / grep), Skill script execution, and stdio-mode MCP servers. Skill
+# activation, resources, and management remain Core-owned without Box. Box is
+# OPTIONAL: if you do not deploy it, set `BOX__ENABLED=false` on
 # the langbot Deployment (or `box.enabled: false` in config.yaml) so the
 # dashboard renders cleanly with sandbox features disabled.
 #
@@ -448,14 +449,15 @@ spec:
              key: token
        # box.local.* config — forwarded to the Box runtime via INIT RPC. The
        # host_root MUST match the box-root hostPath mountPath below AND the box
-        # Deployment's box-root mountPath, so that skill package paths resolve
-        # identically on both sides and on the node's Docker daemon.
+        # Deployment's box-root mountPath, so generic package mount paths
+        # resolve identically on both sides and on the node's Docker daemon.
        - name: BOX__LOCAL__HOST_ROOT
          value: "/app/data/box"
        - name: BOX__LOCAL__DEFAULT_WORKSPACE
          value: "default"
-        - name: BOX__LOCAL__SKILLS_ROOT
-          value: "skills"
+        - name: SKILLS__ROOT
+          # TODO(next-major): use /app/data/skills after the legacy path window.
+          value: "/app/data/box/skills"
        - name: BOX__LOCAL__ALLOWED_MOUNT_ROOTS
          value: "/app/data/box"
        volumeMounts:
@@ -218,8 +218,8 @@ metadata:
 spec:
  categories: [popular, global]
  help_links:
-    zh: https://docs.langbot.app/zh/platforms/http-bot
-    en: https://docs.langbot.app/en/platforms/http-bot
+    zh: https://langbot.app/docs/zh/platforms/http-bot
+    en: https://langbot.app/docs/en/platforms/http-bot
  config:
    - { name: inbound_secret,       type: string, required: true,  default: "" }
    - { name: callback_url,         type: string, required: false, default: "" }
@@ -10,6 +10,19 @@ uvx langbot

 This will automatically download and run the latest version of LangBot.

+SeekDB support is optional and is not installed by the command above. If you
+want to use the SeekDB vector database or the built-in SeekDB embedding model,
+run LangBot with the `seekdb` extra:
+
+```bash
+uvx --from 'langbot[seekdb]@latest' langbot
+```
+
+The extra includes native dependencies whose supported operating systems may
+be narrower than LangBot's. In particular, the current Apple Silicon wheels
+require macOS 15 or later. The default Chroma backend does not have this
+requirement.
+
 ## Install with pip/uv

 You can also install LangBot as a regular Python package:
@@ -20,6 +33,10 @@ pip install langbot

 # Using uv
 uv pip install langbot
+
+# Include optional SeekDB support
+pip install 'langbot[seekdb]'
+# or: uv pip install 'langbot[seekdb]'
 ```

 Then run it:
@@ -101,7 +118,7 @@ uvx langbot

 ## System Requirements

- Python 3.10.1 or higher
+- Python 3.11 or higher (lower than Python 4)
 - Operating System: Linux, macOS, or Windows

 ## Differences from Source Installation
@@ -16,12 +16,20 @@ This document describes how to use OceanBase SeekDB as the vector database backe

 ## Installation

-SeekDB support is automatically included when you install LangBot. The required dependency `pyseekdb` is listed in `pyproject.toml`.
+SeekDB is an optional LangBot feature. A normal LangBot installation uses
+Chroma by default and does not install `pyseekdb` or its native bindings.

-If you need to install it manually:
+Choose the command that matches how you run LangBot:

 ```bash
-pip install pyseekdb
+# PyPI / uvx
+uvx --from 'langbot[seekdb]@latest' langbot
+
+# Installed package
+pip install 'langbot[seekdb]'
+
+# Source checkout
+uv sync --extra seekdb
 ```

 ## ⚠️ Platform Compatibility
@@ -30,31 +38,36 @@ pip install pyseekdb

 | Platform | Status | Notes |
 |----------|--------|-------|
-| Linux | ✅ Supported | Full embedded mode support via `pylibseekdb` |
-| macOS | ❌ Not Supported | `pylibseekdb` is Linux-only; use server mode instead |
-| Windows | ❌ Not Supported | `pylibseekdb` is Linux-only; use server mode instead |
+| Linux x86_64 / ARM64 | ✅ Supported | Full embedded mode support via `pylibseekdb` |
+| macOS 15+ on Apple Silicon | ✅ Supported | Requires the macOS ARM64 `pylibseekdb` wheel |
+| macOS 14 or earlier on Apple Silicon | ❌ Not currently supported | The published native wheel requires macOS 15+; follow [oceanbase/seekdb#1324](https://github.com/oceanbase/seekdb/issues/1324) |
+| macOS on Intel | ❌ Not currently supported | No embedded binding is selected by `pyseekdb` |
+| Windows | ❌ Not currently supported | No Windows `pylibseekdb` wheel is published |

-**Important**: Embedded mode requires the `pylibseekdb` library, which is only available on Linux. If you're on macOS or Windows, you must use server mode.
+**Important**: Embedded mode requires a compatible `pylibseekdb` wheel. Do not
+force-install or retag a wheel built for a newer macOS release: the bundled
+binaries also declare macOS 15 as their minimum deployment target.

 ### Server Mode (Docker)

 | Platform | Status | Notes |
 |----------|--------|-------|
 | Linux | ✅ Supported | Full Docker support |
-| macOS | ⚠️ Known Issue | Docker container initialization failure - [See Issue #36](https://github.com/oceanbase/seekdb/issues/36) |
-| Windows | ⚠️ Untested | Should work but not yet tested |
-
-**macOS Users**: Currently, SeekDB Docker containers have an initialization issue on macOS ([oceanbase/seekdb#36](https://github.com/oceanbase/seekdb/issues/36)). Until this is resolved, we recommend:
- Using ChromaDB or Qdrant as alternatives
- Connecting to a remote SeekDB server on Linux if available
+| macOS | ✅ Supported by Docker Desktop | The previous slow-disk startup issue was fixed upstream in [oceanbase/seekdb#36](https://github.com/oceanbase/seekdb/issues/36) |
+| Windows | ⚠️ Depends on the container runtime | Use a Linux container and follow the upstream image documentation |

 ### Server Mode (Remote Connection)

 | Platform | Status | Notes |
 |----------|--------|-------|
-| All Platforms | ✅ Supported | Connect to SeekDB running on a remote Linux server |
+| Linux | ✅ Supported | Install the `seekdb` extra and connect to the remote server |
+| macOS 15+ on Apple Silicon | ✅ Supported | Install the `seekdb` extra and connect to the remote server |
+| macOS 14 or earlier on Apple Silicon | ⚠️ Blocked by upstream packaging | `pyseekdb` currently requires the unavailable native wheel even for server-only use; follow [#1324](https://github.com/oceanbase/seekdb/issues/1324) |
+| macOS on Intel / Windows | ✅ Server mode only | Embedded bindings are not available |

-**Recommendation for macOS/Windows users**: Deploy SeekDB on a Linux server and connect via server mode configuration.
+Remote server mode does not use embedded storage at runtime. However, whether
+the Python client can be installed still depends on `pyseekdb`'s package
+metadata for the current platform.

 ## Configuration

@@ -170,22 +183,23 @@ Key methods:

 ### Import Error

-If you see: `ImportError: pyseekdb is not installed`
+If you see: `SeekDB support is not installed`

 Solution:
 ```bash
-pip install pyseekdb
+uv sync --extra seekdb
+# or: uvx --from 'langbot[seekdb]@latest' langbot
 ```

-### Embedded Mode Error on macOS/Windows
+### Embedded Mode Is Unavailable on the Current Platform

 **Error**:
 ```
 RuntimeError: Embedded Client is not available because pylibseekdb is not available.
-Please install pylibseekdb (Linux only) or use RemoteServerClient (host/port) instead.
 ```

-**Cause**: `pylibseekdb` is only available on Linux platforms.
+**Cause**: No compatible `pylibseekdb` wheel is installed for the current OS,
+CPU architecture, Python version, and macOS deployment target.

 **Solution**: Use server mode instead:
 1. Deploy SeekDB on a Linux server or VM
@@ -208,29 +222,6 @@ vdb:
  use: chroma  # or qdrant
 ```

-### Docker Container Fails on macOS
-
-**Symptoms**:
-```bash
-docker run -d -p 2881:2881 oceanbase/seekdb:latest
-# Container exits immediately with code 30
-```
-
-**Error in logs**:
-```
-[ERROR] Code: Agent.SeekDB.Not.Exists
-Message: initialize failed: init agent failed: SeekDB not exists in current directory.
-```
-
-**Cause**: This is a known issue with SeekDB Docker containers on macOS. See [oceanbase/seekdb#36](https://github.com/oceanbase/seekdb/issues/36).
-
-**Status**: Under investigation by OceanBase team.
-
-**Workaround Options**:
-1. **Use alternatives**: ChromaDB or Qdrant work perfectly on macOS
-2. **Remote server**: Deploy SeekDB on a Linux server and connect remotely
-3. **Wait for fix**: Monitor the GitHub issue for updates
-
 ### Connection Error (Server Mode)

 If SeekDB server is not reachable, check:
@@ -252,7 +243,7 @@ For large datasets:
 - SeekDB GitHub: https://github.com/oceanbase/seekdb
 - pyseekdb SDK: https://github.com/oceanbase/pyseekdb
 - OceanBase Documentation: https://oceanbase.ai
- LangBot Documentation: https://docs.langbot.app
+- LangBot Documentation: https://langbot.app/docs

 ## License

@@ -103,11 +103,11 @@ This log records implementation choices made while delivering the Workspace arch
 - Decision: New Core JWTs require `iss=langbot-core`, an audience derived from the immutable instance UUID, and an expiry. Legacy community tokens are accepted only when they have the historical issuer, carry no audience, and the active policy is the OSS singleton policy.
 - Reason: A token issued by one instance must not authenticate against another instance that happens to share a secret, and a compatibility decoder must not become an alternate path around the SaaS trust boundary.

-### Runtime control transports authenticate before protocol dispatch
+### Runtime control transports support opt-in shared-secret authentication

- Decision: External Plugin Runtime and Box WebSocket control channels require independent strong shared secrets in handshake headers. Locally managed child processes receive ephemeral secrets through their environment; secrets are not placed in URLs, process arguments, request payloads, or logs. Box additionally binds the first authenticated control channel to one trusted instance. Plugin Runtime debug and control credentials remain separate.
- Reason: Workspace context inside an RPC payload is not trustworthy until the transport peer itself is authenticated. Separating control and debug credentials also limits accidental privilege reuse.
- Deployment consequence: Docker Compose and Kubernetes wire one shared secret to each host/runtime pair. An empty external-runtime secret fails startup instead of silently exposing an unauthenticated socket.
+- Decision: OSS external Plugin Runtime and Box WebSocket control channels preserve tokenless standalone compatibility when the corresponding control token is unset. When a Runtime configures a token, it validates the independent shared secret in the handshake before protocol dispatch. Locally managed child processes still receive ephemeral secrets through their environment; secrets are not placed in URLs, process arguments, request payloads, or logs. Box additionally pins the first control channel to one declared instance identity. Plugin Runtime debug and control credentials remain separate.
+- Reason: Local OSS development must remain backward compatible, while exposed or shared Runtime endpoints can opt into transport authentication. Separating control and debug credentials also limits accidental privilege reuse.
+- Deployment consequence: Docker Compose and Kubernetes should wire one strong shared secret to each host/runtime pair. Both sides must use the same value for protection to be effective; a Runtime configured with a token rejects clients that omit it or send a different value.

 ### Dashboard WebSocket sessions are tenant runtime objects

@@ -22,6 +22,7 @@
 │       │                    │       (shared 容器, 多 process)       │
 │       │                    │                                      │
 │       │                    ├──> SkillToolLoader (activate 工具)    │
+│       │                    │       └─ build_execution_mounts()    │
 │       │                    │                                      │
 │       │                    ├──> SkillAuthoringToolLoader          │
 │       │                    │                                      │
@@ -33,7 +34,7 @@
 │    ├─ Workspace quota 检查                                         │
 │    ├─ 输出截断 (head+tail)                                         │
 │    ├─ Session ID 模板解析 (resolve_box_session_id)                 │
-│    ├─ 技能挂载组装 (build_skill_extra_mounts)                      │
+│    ├─ 通用只读挂载接收 (read_only_mounts)                          │
 │    ├─ 重连循环 (_reconnect_loop, 指数退避)                          │
 │    └─ BoxRuntimeConnector                                          │
 │         ├─ 心跳 loop (20s ping)                                    │
@@ -41,7 +42,7 @@
 │              │  Action RPC (stdio 或 WebSocket)                    │
 │                                                                    │
 │  SkillManager (skill_mgr)                                          │
-│    └─ 从 Box runtime 拉取 skills, 不可用时回落 data/skills          │
+│    └─ 从 Core SkillRepository 加载 Workspace-scoped skills          │
 └──────────────────────────────────────────────────────────────────┘
               │
               ▼
@@ -59,10 +60,8 @@
 │    NsjailBackend ──┘  (本地 CLI 或 fallback 到容器内 CLI)            │
 │    E2BBackend         (云沙箱, 需要 E2B_API_KEY)                    │
 │                                                                   │
-│  BoxSkillStore                                                    │
-│    ├─ list / get / create / update / delete                       │
-│    ├─ scan_skill_directory / read_skill_file / write_skill_file   │
-│    └─ preview_skill_zip / install_skill_zip (zip 或 GitHub)        │
+│  Generic mount admission                                         │
+│    └─ allow-list + read-only + normalized target validation       │
 │                                                                   │
 │  aiohttp 单端口服务 (默认 :5410):                                    │
 │    /rpc/ws                                       — Action RPC      │
@@ -85,7 +84,7 @@
 **核心设计原则**:
 - Box Runtime 作为独立进程运行，通过 Action RPC 与 LangBot 主进程通信，两者复用 SDK 的 IO 层（Handler → Connection → Controller）
 - 一个 session_id 对应一个容器/沙箱实例。同一 session 内可并存多条 mount 与多个 managed process
- Skill / 默认 exec / MCP Server 共享同一个 session 容器（详见 [box-session-scope.md](./box-session-scope.md)）
+- Skill 仅是 Core 组装 mount 的业务来源；Box 与默认 exec / MCP Server 只共享通用 session 和 mount 机制（详见 [box-session-scope.md](./box-session-scope.md)）

 ---

@@ -93,7 +92,7 @@

 ### 2.1 BoxService (`pkg/box/service.py`, 722 行)

-应用层门面，协调 Profile、安全校验、配额、连接、Skill 挂载与 Session 模板：
+应用层门面，协调 Profile、安全校验、配额、连接、Core 生成的只读挂载与 Session 模板：

 主要公开方法（按定义顺序）：

@@ -105,7 +104,7 @@ BoxService
  ├─ available (property)                      连接状态
  │
  ├─ resolve_box_session_id(query)             从 pipeline 模板解析 session_id
-  ├─ build_skill_extra_mounts(query)           组装 pipeline-bound skill 的挂载列表
+  ├─ execute_tool(..., read_only_mounts=...)   接收 Core 组装的通用只读挂载
  │
  ├─ execute_tool(parameters, query)           Agent 调用 exec 时的入口
  │    ├─ _apply_profile / build_spec
@@ -122,12 +121,6 @@ BoxService
  ├─ stop_managed_process(session_id, pid)     单独停止某个 managed process
  ├─ get_managed_process_websocket_url(...)    返回 WS attach URL
  │
-  ├─ list_skills() / get_skill(name)           Skill 元数据
-  ├─ create_skill / update_skill / delete_skill  Skill CRUD
-  ├─ scan_skill_directory(path)                扫描目录
-  ├─ list_skill_files / read_skill_file / write_skill_file
-  ├─ preview_skill_zip / install_skill_zip     zip / GitHub 安装
-  │
  ├─ shutdown() / dispose()                    清理：RPC SHUTDOWN + 进程终止
  ├─ get_status() / get_sessions() / get_recent_errors()
  └─ get_system_guidance()                     LLM 系统提示
@@ -137,7 +130,7 @@ BoxService

 **输出截断**: 默认 4000 字符上限，保留前 60% + 后 40%，中间插入 `[...truncated...]`。

-**Skill 挂载合并**: `execute_tool()` 调用时，`build_skill_extra_mounts(query)` 会把当前 pipeline-bound 的所有 skill 的 `package_root` 作为 `extra_mounts` 加入 BoxSpec，挂在 `/workspace/.skills/<name>`。LLM 通过 `activate` 工具显式激活某个 skill 后，工具调用才允许引用这个 skill 的虚拟路径。
+**Skill 挂载合并**: native loader 调用 `skill.build_execution_mounts()`，把当前 pipeline-bound 的所有 skill 的 `package_root` 转成普通只读 mount，再通过 `BoxService.execute_tool(..., read_only_mounts=...)` 交给 Box，挂在 `/workspace/.skills/<name>`。LLM 通过 `activate` 工具显式激活某个 skill 后，工具调用才允许引用这个 skill 的虚拟路径；BoxService 和 Box Runtime 都不知道这些 mount 来自 Skill。

 ### 2.2 BoxRuntimeConnector (`pkg/box/connector.py`, 357 行)

@@ -171,11 +164,10 @@ BoxService
 ```
 SkillManager
  ├─ initialize()                  调用 reload_skills()
-  ├─ reload_skills()               先从 Box runtime list_skills()，
-  │                                 不可用则回落 data/skills/ 扫描
-  ├─ refresh_skill_from_disk()     单 skill 重新加载
+  ├─ reload_skills()               从 Core SkillRepository 加载
+  ├─ refresh_skill_from_disk()     检查单 skill 的缓存状态
  ├─ get_skill_by_name(name)
-  └─ get_managed_skills_root()     返回 Box 视角的 skills_root 路径
+  └─ build_skill_aware_prompt_addition() 生成渐进披露索引
 ```

 skill 元数据通过 `parse_frontmatter` 解析 `SKILL.md` 头部（`name` / `description` / `instructions`），不再做整体扫描的代价（典型 < 50 个）。
@@ -295,7 +287,7 @@ start_managed_process(session, spec):

 单端口 aiohttp 服务（默认 5410），通过路径区分（commit `8c71ec5` 合并端口）：

-1. **Action RPC** (`/rpc/ws`): `BoxServerHandler` 处理所有 action，包括 `INIT` 配置注入、skill store 操作等
+1. **Action RPC** (`/rpc/ws`): `BoxServerHandler` 处理 `INIT`、exec、session、managed-process 与状态等通用 action
 2. **WS Relay** (`/v1/sessions/{id}/managed-process/ws` 与 `/v1/sessions/{id}/managed-process/{pid}/ws`): 双向桥接 WebSocket ↔ 指定 managed process stdin/stdout

 stdio 模式同样会在 5410 启动 aiohttp，专门承担 managed process attach；Action RPC 走 stdin/stdout。
@@ -304,7 +296,7 @@ stdio 模式同样会在 5410 启动 aiohttp，专门承担 managed process atta

 `ActionRPCBoxClient` 封装 `Handler.call_action()` 调用：

- 25+ 方法对应 25+ 个 RPC action（exec / session / managed-process / skill / status / shutdown）
+- 方法对应 exec / session / managed-process / status / shutdown 等通用 RPC action，不暴露 Skill CRUD
 - 错误还原: `_translate_action_error()` 通过字符串前缀匹配还原 SDK 侧异常类型
 - `execute()` timeout = 300s，其他默认 15s
 - `BoxRuntimeClient` 是 ABC，供后续可能的非 RPC 实现复用
@@ -343,23 +335,32 @@ stdio 模式同样会在 5410 启动 aiohttp，专门承担 managed process atta

 `BoxSpec` 校验器: `workdir` 默认继承 `mount_path`；`host_path` 支持 POSIX 和 Windows 路径；设置 `host_path` 时 `workdir` 必须在 `mount_path` 下。

-### 3.7 BoxSkillStore (`box/skill_store.py`, 647 行)
+### 3.7 SkillStore (`langbot_plugin.skill_store`)

-新增模块（commit `4ab3502`），把 skill 持久化收归 Box runtime：
+Skill 包存储最初位于 Box Runtime；issue #2410 将通用实现抽到 Plugin SDK 顶层，由 Core 独占存储和 revision 语义：

 ```
-BoxSkillStore
+SkillStore
  ├─ list_skills() / get_skill(name)
  ├─ create_skill(data) / update_skill(name, data) / delete_skill(name)
  ├─ scan_skill_directory(path)            扫描目录返回候选 skill 包列表
-  ├─ list_skill_files(name, path)          浏览 skill 内文件树
-  ├─ read_skill_file(name, path) / write_skill_file(name, path, content)
+  ├─ list_skill_resources(name, path, revision)  按 revision 浏览只读资源
+  ├─ read_skill_resource(name, path, revision)   按 revision 读取 UTF-8 资源
+  ├─ read_skill_file(...) / write_skill_file(...) 管理侧文件接口
  ├─ preview_skill_zip(zip_bytes, ...)     不落盘预览 zip 内容
  └─ install_skill_zip(zip_bytes, ...)     解压、校验、复制到 skills_root
     └─ 支持 source_subdir / target_suffix（commit 1aa043f）
 ```

-GitHub 安装路径：HTTP 层（`api/http/service/skill.py`）先 `git clone` 拉取，再走 `install_skill_zip` 或 directory 路径。Skill 文件存放于 `box.local.skills_root`（默认 `skills`，相对 `host_root`），容器内对应 `/workspace/.skills/`。
+GitHub 安装路径由 Core HTTP 层下载归档，再交给 SkillRepository。Skill 文件位于独立的 `skills.root`，执行时由 Core 组装成通用只读 `BoxMountSpec` 并挂载到 `/workspace/.skills/`。Box 的正常模型、客户端和 Runtime 不包含 `skill_name`、Skill CRUD、revision 或 `SKILL.md` 语义。
+
+滚动升级只保留一个隔离桥：`box/legacy_skill_compat.py` 让旧 Core 暂时调用新 Box，并把旧 `skill_name` 转为普通只读 mount。部署顺序必须先升级 Box、再升级 Core。该模块有 `TODO(next-major)`，下一大版本删除；正常架构不依赖它。
+
+下一大版本的删除清单（当前均有 `TODO(next-major)`）：
+
+1. 删除 SDK `box/legacy_skill_compat.py` 及 Server 中唯一的注册/转换钩子。
+2. 删除 Core 对 `box.local.skills_root` 的配置 fallback。
+3. 新安装默认从历史 `./data/box/skills` 切到 `./data/skills`；届时 Box 部署只需只读访问 Core 明确下发的通用 artifact root。

 ### 3.8 Security (`box/security.py`, 52 行)

@@ -463,7 +464,7 @@ BuildAppStage.run(ap)
  ├─ ap.tool_mgr = tool_mgr
  │
  ├─ ... (platform, pipeline) ...
-  ├─ SkillManager.initialize()    (从 Box runtime 加载 skill 列表)
+  ├─ SkillManager.initialize()    (从 Core SkillRepository 加载 skill 列表)
  └─ ... (RAG, HTTP, plugins) ...
 ```

@@ -480,7 +481,7 @@ except Exception as e:
    logger.warning(f"Box runtime unavailable: {e}")
 ```

-**静默降级**: Box 初始化失败不会阻止应用启动，仅导致 6 个 native tool、所有 Skill 工具和 MCP-in-Box 工具不暴露给 LLM。与 Plugin 的行为不同（Plugin 失败会抛异常）。
+**静默降级**: Box 初始化失败不会阻止应用启动。6 个 native tool、`register_skill` 和 MCP-in-Box 工具不暴露给 LLM；`activate` 与 Skill 只读资源工具继续由 Core 提供。与 Plugin 的行为不同（Plugin 失败会抛异常）。

 ### 5.3 销毁流程

@@ -504,13 +505,16 @@ Box 额外做了 RPC SHUTDOWN 通知 Runtime 主动清理容器，比 Plugin 的
 ### config.yaml (重构后)

 ```yaml
+skills:
+    root: './data/box/skills'  # Core-owned；Box 关闭时仍可管理/读取
+
 box:
    enabled: true         # 整个 Box 子系统的总开关。设为 false 时：
                          #  - 不连接远程 Box runtime，不 fork 本地 stdio 子进程
                          #  - sandbox 工具 (exec/read/write/edit/glob/grep) 不暴露给 LLM
-                          #  - skill 添加/编辑 / GitHub 安装 / 文件写入全部拒绝
+                          #  - Agent 从 sandbox 注册 skill 的能力不可用
                          #  - stdio 模式的 MCP server 启动时报错（http/sse 模式不受影响）
-                          #  - skill 列表/读取保持只读可用
+                          #  - skill 管理、激活和只读资源保持可用
                          # BOX__ENABLED 环境变量可覆盖（统一约定）
    backend: 'local'      # 'local' (探测) / 'docker' / 'nsjail' / 'e2b'
                          # 由 box.backend / BOX__BACKEND 选择后端
@@ -522,7 +526,6 @@ box:
        image: ''                       # 覆盖 profile 默认 image
        host_root: './data/box'         # 工作区挂载根，Docker 部署需绝对路径
        default_workspace: ''           # 默认 '<host_root>/default'
-        skills_root: 'skills'           # Box 管理的 skill 包目录（相对 host_root）
        allowed_mount_roots:            # 默认 ['<host_root>']
            - './data/box'
            - '/tmp'
@@ -561,16 +564,17 @@ volumes:
 | 消费方 | Box 可用 | Box 不可用(disabled 或 failed) |
 |---|---|---|
 | native exec/read/write/edit/glob/grep 工具 | 暴露给 LLM | **不暴露** |
-| `activate` / `register_skill` 工具 | 暴露给 LLM | **不暴露** |
+| `activate` / Skill resource 工具 | 暴露给 LLM | 暴露给 LLM |
+| `register_skill` 工具 | 暴露给 LLM | **不暴露**；直接调用返回 `sandbox_unavailable` |
 | stdio MCP server | 在 Box 内启动 | **`_init_stdio_python_server` 抛 RuntimeError** 拒绝;不退化到宿主 stdio |
 | http/sse MCP server | 正常 | 正常(不依赖 Box) |
-| Skill 列表/读取 (`list_skills`/`get_skill`/`read_skill_file`) | 走 Box runtime | 走 LangBot 本地 `data/skills/` 只读 fallback |
-| Skill 创建/编辑/安装/写文件 | 走 Box runtime | **HTTP 400** + 明确错误信息(`_require_box_for_write`) |
+| Skill 列表/读取 (`list_skills`/`get_skill`/`read_skill_file`) | 走 Core SkillRepository | 走 Core SkillRepository |
+| Skill 创建/编辑/安装/写文件 | 走 Core SkillRepository | 走 Core SkillRepository |
 | Pipeline AI 配置中 `box-session-id-template` | 正常生效 | **前端 banner** 提示字段无效 |
-| Pipeline 扩展页 `enable_all_skills` / 绑定 skill | 可编辑 | **前端禁用** + banner |
+| Pipeline 扩展页 `enable_all_skills` / 绑定 skill | 可编辑 | 可编辑 |
 | 仪表盘 Box 状态卡片 | 绿点 / "已连接" | 灰点 / "已禁用"(disabled) 或 红点 / "已断开"(failed) |

-> 后端拒写的边界条件:如果 `ap.box_service` **完全没装**(老式 dev mode,没经过 BuildAppStage),`_require_box_for_write` 视作 no-op,保留 `data/skills/` 本地路径——以兼容历史测试与最小化设置。生产环境总会装 `ap.box_service`,因此该 fallback 不会被触发。
+> Core 的 SkillRepository 是 `langbot_plugin.skill_store.SkillStore` 的异步 Workspace 适配层。默认 `skills.root` 保持原 `data/box/skills/tenants/...` 布局，升级时无需移动已安装 Skill；旧 `box.local.skills_root` 仅作为在线升级 fallback，并将在下一大版本删除。Box 只消费 Core 下发的通用只读 mount。

 ### Pipeline 配置 (templates/metadata/pipeline/ai.yaml)

@@ -52,8 +52,8 @@
 ### S5. 挂载校验缺口 — Med-High

 - **位置**: SDK `box/security.py` `_BLOCKED_HOST_PATHS_POSIX`；`box/backend.py` 的 `extra_mounts` 处理
- **现状**: ① SDK 黑名单仍不含 `/`（前缀匹配，`host_path="/"` 可通过，挂载整个宿主 fs）；用户 home、`/usr`、`/opt`、`/tmp` 也未拦截。② `validate_sandbox_security` 只校验 `spec.host_path`，**从不遍历 `spec.extra_mounts`**——LangBot 侧 `allowed_mount_roots` 也只校验 `host_path`。当前 `extra_mounts` 仅由 `build_skill_extra_mounts` 内部填充（agent 不可达），但缺乏纵深防御：一旦 S1 的无认证 RPC 被触达，extra_mounts 可挂任意宿主路径，两层都不拦。
- **要求**: SDK 黑名单加入 `/`（或改白名单）；`extra_mounts` 在 SDK 与 LangBot 两侧都纳入挂载校验。
+- **现状**: grant-enforced 模式已经由 Core 与 Runtime 双重校验通用只读 mount（绝对路径 allow-list、存在性、只读模式、规范化且位于 `/workspace` 下的目标）；它不再有 Skill 特例。遗留风险仅在 admission-disabled 的低信任直连场景：通用 `extra_mounts` 仍未统一套用 grant-enforced 白名单。
+- **要求**: admission-disabled 的外部控制面也复用同一套通用 mount 校验；SDK 黑名单加入 `/`（或全面改白名单）。

 ### S6. 容器加固缺失 — Med

@@ -18,7 +18,7 @@ has shipped the design largely as written:
 | Docker / nsjail / E2B backends apply extra mounts | ✅ Shipped | Last gap closed by SDK commit `0fea9b1` (E2B) |
 | `box-session-id-template` in `local-agent` pipeline config | ✅ Shipped | `templates/metadata/pipeline/ai.yaml`, default `{launcher_type}_{launcher_id}` |
 | `BoxService.resolve_box_session_id(query)` | ✅ Shipped | `pkg/box/service.py:166` |
-| `BoxService.build_skill_extra_mounts(query)` | ✅ Shipped | `pkg/box/service.py:189` |
+| `skill.build_execution_mounts(ap, query)` | ✅ Shipped | Core composes read-only packages; Box receives generic mounts |
 | Skill exec uses unified container + extra mounts | ✅ Shipped | `pkg/provider/tools/loaders/native.py` skill branch |
 | MCP-in-Box uses shared persistent session, multi-process | ✅ Shipped (earlier than originally scoped) | SDK commit `529088e`, LangBot `mcp_stdio.py:_build_box_session_id` |
 | `BoxManagedProcessSpec.process_id` + multi-process per session | ✅ Shipped | `BoxRuntime` keeps `managed_processes: dict[pid, _ManagedProcess]` |
@@ -51,7 +51,7 @@
 | BoxService workspace quota | 优秀 | 前置/后置配额检查、超额清理 |
 | BoxService 输出截断 | 优秀 | 短/精确边界/长输出、独立 stderr |
 | BoxService 可观测性 | 优秀 | 状态报告、error ring buffer、buffer 上限 |
-| BoxService session 模板 | 良好 | `resolve_box_session_id` + `build_skill_extra_mounts` 在 service / native / mcp 三处都有覆盖 |
+| BoxService session / mount contract | 良好 | `resolve_box_session_id` + generic `read_only_mounts`; Skill mount composition is covered in the Core loader |
 | RPC client/server 协议 | 优秀 | execute/get_sessions/delete/create/conflict error |
 | BoxRuntimeConnector | 良好 | local/remote 模式、Docker 平台、relay URL、心跳与重连回调 |
 | BoxWorkspaceSession | 良好 | payload 构建、managed process 路径重写、stage host file |
@@ -6,7 +6,7 @@ Minimal, dependency-light clients for the LangBot **HTTP Bot** platform adapter.
 They show the whole loop: signing a request, pushing a message, and receiving
 multi-part replies on a callback endpoint.

-Full guide: [docs.langbot.app — HTTP Bot](https://docs.langbot.app/en/usage/platforms/http-bot).
+Full guide: [docs.langbot.app — HTTP Bot](https://langbot.app/docs/en/usage/platforms/http-bot).
 Machine-readable contract: [`docs/http-bot-openapi.json`](../../docs/http-bot-openapi.json).

 ## Files
@@ -6,7 +6,7 @@
 它们完整展示了整条链路:对请求签名、推送一条消息、在回调端点接收
 1→M 的多段回复。

-完整指南:[docs.langbot.app —— HTTP Bot](https://docs.langbot.app/zh/usage/platforms/http-bot)。
+完整指南:[docs.langbot.app —— HTTP Bot](https://langbot.app/docs/zh/usage/platforms/http-bot)。
 机器可读的接口契约:[`docs/http-bot-openapi.json`](../../docs/http-bot-openapi.json)。

 ## 文件清单
@@ -6,7 +6,7 @@ A single self-contained HTML page that demos the LangBot **Page Bot**
 (`web_page_bot`) embeddable chat widget — the one you drop onto any website with
 a single `<script>` tag.

-Full guide: [docs.langbot.app — Page Bot](https://docs.langbot.app/en/usage/platforms/webpage).
+Full guide: [docs.langbot.app — Page Bot](https://langbot.app/docs/en/usage/platforms/webpage).

 ## Files

@@ -6,7 +6,7 @@
 (`web_page_bot`) 的可嵌入聊天组件 —— 也就是你用一行 `<script>` 标签就能放到任意
 网站上的那个组件。

-完整指南：[docs.langbot.app —— 页面机器人](https://docs.langbot.app/zh/usage/platforms/webpage)。
+完整指南：[docs.langbot.app —— 页面机器人](https://langbot.app/docs/zh/usage/platforms/webpage)。

 ## 文件清单

@@ -1,6 +1,6 @@
 [project]
 name = "langbot"
-version = "4.10.7"
+version = "4.10.10"
 description = "Production-grade platform for building agentic IM bots"
 readme = "README.md"
 license-files = ["LICENSE"]
@@ -70,8 +70,7 @@ dependencies = [
    "langchain-text-splitters>=1.1.2",
    "chromadb>=1.0.0,<2.0.0",
    "qdrant-client (>=1.15.1,<2.0.0)",
-    "pyseekdb==1.1.0.post3",
-    "langbot-plugin @ git+https://github.com/langbot-app/langbot-plugin-sdk.git@9d216208cdfb41f0cb7fcb64632e2a46816d6dc6",
+    "langbot-plugin==0.5.7",
    "asyncpg>=0.30.0",
    "line-bot-sdk>=3.19.0",
    "matrix-nio>=0.25.2",
@@ -108,9 +107,14 @@ classifiers = [
    "Topic :: Communications :: Chat",
 ]

+[project.optional-dependencies]
+seekdb = [
+    "pyseekdb==1.1.0.post3",
+]
+
 [project.urls]
 Homepage = "https://langbot.app"
-Documentation = "https://docs.langbot.app"
+Documentation = "https://langbot.app/docs"
 Repository = "https://github.com/langbot-app/LangBot"

 [project.scripts]
@@ -1349,7 +1349,8 @@
            "local-agent",
            "tools",
            "e2b",
-            "nsjail"
+            "nsjail",
+            "host"
          ],
          "automation": "",
          "setup_automation": [],
@@ -27,10 +27,11 @@ The `all` / `box` profile starts three services:
 - `langbot_box` — Box sandbox runtime (`:5410`). Uses the host Docker socket to
  spawn sandbox containers, so the **Box root host path and in-container path
  must be identical** (`BOX__LOCAL__HOST_ROOT=${LANGBOT_BOX_ROOT:-${PWD}/data/box}`).
-  Its RPC and managed-process relay require a shared
-  `LANGBOT_BOX_CONTROL_TOKEN` (at least 32 non-whitespace characters) in both
-  the LangBot and Box containers. Generate it once with `openssl rand -hex 32`;
-  never put it in `box.runtime.endpoint` or commit it to config.
+  OSS allows its RPC and managed-process relay to run without a token when both
+  sides leave `LANGBOT_BOX_CONTROL_TOKEN` unset. For an exposed endpoint, set
+  the same value of at least 32 non-whitespace characters in both the LangBot
+  and Box containers. Generate it once with `openssl rand -hex 32`; never put
+  it in `box.runtime.endpoint` or commit it to config.

 A Compose deployment may optionally set
 `LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN` on both `langbot` and
@@ -47,7 +48,7 @@ tools, skill add/edit, and stdio MCP are disabled. Set `box.enabled: false`
 ## Kubernetes

 See `docker/kubernetes.yaml` and the deployment guide at
-https://docs.langbot.app. `docker/deploy-k8s-test.sh` is a test helper.
+https://langbot.app/docs. `docker/deploy-k8s-test.sh` is a test helper.

 ## config.yaml (generated at `data/config.yaml` on first run)

@@ -62,7 +63,7 @@ Key settings:
 | `api.global_api_key` | **Global API key** for the HTTP API + MCP server. Non-empty = accepted with no login/DB record; no `lbk_` prefix required. Empty = disabled. Plaintext — trusted/internal only, serve over HTTPS. |
 | `plugin.runtime_ws_url` | Standalone plugin runtime WS URL (e.g. `ws://langbot_plugin_runtime:5400/control/ws`) |
 | `box.enabled` | Master switch for the Box sandbox runtime |
-| `box.backend` | `local` (Docker/nsjail autopick) / `docker` / `nsjail` / `e2b`; env override `BOX__BACKEND` |
+| `box.backend` | `local` (Docker/nsjail autopick) / `docker` / `nsjail` / `e2b` / explicit unsafe `host`; env override `BOX__BACKEND` |
 | `box.runtime.endpoint` | External Box runtime URL (e.g. `ws://127.0.0.1:5410`); empty = local auto-managed |

 Many keys have `ENV__SUBKEY` overrides (e.g. `BOX__BACKEND`, `BOX__ENABLED`).
@@ -74,6 +75,10 @@ Many keys have `ENV__SUBKEY` overrides (e.g. `BOX__BACKEND`, `BOX__ENABLED`).
  with `--standalone-runtime`.
 - Box has a parallel `--standalone-box` flag; the Docker box host is
  `langbot_box:5410`.
+- `box.backend: host` runs commands directly as the Box Runtime system user.
+  It is never auto-selected, provides no sandbox isolation, and is only for
+  trusted local development. A WebSocket-controlled host backend requires
+  `LANGBOT_BOX_CONTROL_TOKEN`; local stdio control is allowed.

 ## Global API key — enabling for agents/automation

@@ -92,5 +97,7 @@ login session. See `langbot-mcp-ops` for using it, and `docs/API_KEY_AUTH.md`.
 - "No supported sandbox backend (Docker / nsjail / E2B)" with Docker running
  usually means the user isn't in the `docker` group →
  `sudo usermod -aG docker <user>` and restart in a new shell.
+- Do not use `box.backend: host` as a production fallback. It cannot enforce
+  image, filesystem, network, PID, CPU, memory, or storage isolation.
 - Box root host/container path mismatch breaks sandbox container creation.
 - Don't commit a non-empty `api.global_api_key` to version control.
@@ -75,6 +75,8 @@ shape as the corresponding HTTP API request body. Discover resources with the
 `list_*` / `get_*` tools before mutating; identifiers are UUIDs. Reads require
 `resource.view`; mutations require `resource.manage`. All service calls inherit
 the immutable Workspace context authenticated at the MCP transport boundary.
+Pass `is_default: true` to `create_pipeline` only when the Workspace does not
+already have a default pipeline.

 ## How to use

@@ -6,7 +6,8 @@ description: Browse and search the LangBot Space marketplaces (plugins, MCP serv
 # LangBot Space MCP Operations

 LangBot Space (space.langbot.app) exposes an **MCP server** so user-facing AI
-agents can browse and search the marketplaces (plugins, MCP servers, skills).
+agents can browse and search the marketplaces (plugins, MCP servers, skills) and
+rank live models for automated setup.

 ## Endpoint

@@ -46,10 +47,12 @@ Authorization: Bearer lbpat_...uests without a valid PAT get `401 Unauthorized`.
 | `list_plugins` / `search_plugins` / `get_plugin` | Plugin marketplace |
 | `list_mcp_servers` / `search_mcp_servers` / `get_mcp_server` | MCP-server marketplace |
 | `list_skills` / `search_skills` / `get_skill` | Skill marketplace |
+| `select_models` | Live best-first model list for setup wizards; optional `category` filter |

 `list_*` and `search_*` are paged (`page`, `page_size`). `get_*` takes
 `author` + `name`. The tool surface mirrors the REST endpoints under
-`/api/v1/marketplace/*` and is read/browse only.
+`/api/v1/marketplace/*`; `select_models` mirrors `/api/v1/models/selection`.
+All tools are read-only.

 ## How to use

@@ -58,12 +61,16 @@ Authorization: Bearer lbpat_...uests without a valid PAT get `401 Unauthorized`.
 3. Use `search_plugins` / `search_mcp_servers` / `search_skills` to find items,
   then `get_*` for details (e.g. to obtain author/name for installation in
   LangBot itself).
+4. For automatic local-agent setup, call `select_models` (optionally with
+   `category`) and choose the first compatible item. Ordering is latest probe
+   state (available, unprobed, unavailable), then Space recommendation. Each
+   item includes `availability.up`, `last_probed_at`, latency, and HTTP status.

 ## Implementation & maintenance (for Space developers)

 - Server: `internal/controller/mcp/server.go` (official Go MCP SDK
  `github.com/modelcontextprotocol/go-sdk`). Tools call the service layer
-  (`PluginService`, `MCPService`, `SkillService`) directly.
+  (`PluginService`, `MCPService`, `SkillService`, `ModelStatusService`) directly.
 - Mount: `internal/controller/api.go` at `/mcp` and `/mcp/*any`.
 - Auth: PAT via `AccountService.ValidatePersonalAccessToken`.
 - Docs: `docs/MCP_SERVER.md`.
@@ -13,6 +13,7 @@ tags:
  - tools
  - e2b
  - nsjail
+  - host
 skills:
  - langbot-env-setup
  - langbot-testing
@@ -23,7 +24,7 @@ env:
  - LANGBOT_LOCAL_AGENT_PIPELINE_NAME
 preconditions:
  - "LANGBOT_LOCAL_AGENT_PIPELINE_URL or LANGBOT_LOCAL_AGENT_PIPELINE_NAME points to the local-agent pipeline under test."
-  - "LangBot is started with the sandbox backend intended for this run, such as e2b or nsjail."
+  - "LangBot is started with the Box backend intended for this run, such as e2b, nsjail, or explicit host development mode."
  - "The selected model route supports tool/function calling strongly enough to invoke sandbox tools."
 steps:
  - "Start LangBot with the target sandbox backend and confirm the Box status UI or LANGBOT_BACKEND_URL /api/v1/box/status reports the expected backend."
@@ -33,7 +34,7 @@ steps:
 checks:
  - "UI: Debug Chat final assistant response contains E2E_OK:<skill-name>."
  - "Logs: The model called exec, register_skill, activate, then exec again from the activated skill path."
-  - "Logs: The selected backend name is the expected one, such as e2b or nsjail."
+  - "Logs: The selected backend name is the expected one, such as e2b, nsjail, or host."
  - "Skill store: The registered package and activated writeback match references/sandbox-skill-authoring.md."
  - "Box status: recent_error_count is 0 after the run."
 evidence_required:
@@ -4,7 +4,7 @@

 Verify that Local Agent can use sandbox tools to create, register, activate, and use a LangBot skill package through the same path a user would exercise in Debug Chat.

-This flow applies to Docker, nsjail, and E2B backends. API calls are useful diagnostics, but the primary pass/fail signal is the model-driven Debug Chat tool sequence.
+This flow applies to Docker, nsjail, E2B, and the explicit host development backend. Host runs commands directly as the Box Runtime user and must never be treated as sandbox-isolation coverage. API calls are useful diagnostics, but the primary pass/fail signal is the model-driven Debug Chat tool sequence.

 ## Preconditions

@@ -13,6 +13,7 @@ This flow applies to Docker, nsjail, and E2B backends. API calls are useful diag
   - `BOX_BACKEND=e2b` when validating E2B.
   - `BOX_BACKEND=nsjail` when validating nsjail.
   - `BOX_BACKEND=local` or `docker` when validating local container fallback.
+   - `BOX_BACKEND=host` only when validating explicit, trusted local direct execution.
 3. Confirm `/api/v1/box/status` reports `available: true` and the expected backend name.
 4. Confirm Debug Chat uses a model with function-calling ability.
 5. Confirm backend logs say native sandbox tools are available.
@@ -71,7 +72,7 @@ Backend logs should show:
 - `register_skill`
 - `activate`
 - a second `exec` whose workdir is `/workspace/.skills/<skill-name>`
- `backend=e2b`, `backend=nsjail`, or the expected local backend
+- `backend=e2b`, `backend=nsjail`, `backend=host`, or the expected local backend

 After the run, verify the skill store through the UI or API:

@@ -125,6 +126,8 @@ For E2B raw HTTP diagnostics, include a valid template id such as `base`; a miss
 - Session metadata should keep LangBot logical paths such as `/workspace`; storing provider-internal paths can make later requests look incompatible.
 - nsjail versions differ. Some expose only `--disable_clone_new*` flags and use `--bindmount` instead of `--rw_bind`.
 - On WSL, cgroup v2 may exist but not be writable. The backend should warn and fall back to rlimits rather than fail the sandbox.
+- The host backend does not honor sandbox image, network, rootfs, process, or
+  resource isolation. Use a disposable workspace and low-privilege account.
 - If `ALL_PROXY` uses a SOCKS URL and `socksio` is not installed, some Python HTTP clients can fail during startup. Prefer consistent HTTP proxy variables unless SOCKS support is installed.

 ## Related Troubleshooting
@@ -3,7 +3,7 @@ title: "Native sandbox tools are unavailable even though a backend is configured
 date: 2026-05-18
 symptoms:
  - "Backend logs show Native sandbox tools (exec/read/write/edit/glob/grep) are NOT available."
-  - "The Box runtime later reports that E2B, nsjail, or Docker is configured."
+  - "The Box runtime later reports that E2B, nsjail, Docker, or explicit host mode is configured."
  - "Debug Chat does not expose exec, register_skill, or activate as usable tools."
 patterns:
  - "Native sandbox tools ... are NOT available"
@@ -19,6 +19,7 @@ fix_steps:
  - "Ensure the Box runtime reselects a backend when get_backend_info is called and the cached backend is empty."
  - "For E2B, verify the key without printing it and confirm any required template setting."
  - "For nsjail, run nsjail --help and confirm the binary is on PATH for the LangBot process."
+  - "For trusted local development only, explicitly set box.backend=host; never use host as a production sandbox fallback."
 verification: "Run sandbox-skill-authoring-e2e. Logs should show Native sandbox tools are available and /api/v1/box/status should report available=true with the expected backend."
 related_cases:
  - sandbox-skill-authoring-e2e
@@ -16,7 +16,7 @@ asciiart = r"""
               |___/              

 ⭐️ Open Source 开源地址: https://github.com/langbot-app/LangBot
-📖 Documentation 文档地址: https://docs.langbot.app
+📖 Documentation 文档地址: https://langbot.app/docs
 """


@@ -1,13 +1,14 @@
 from __future__ import annotations

 import asyncio
-import httpx
-import typing
 import json
+import os
+import typing
+from pathlib import Path
+
+import httpx

 from .errors import DifyAPIError
-from pathlib import Path
-import os

 _MAX_DIFY_RESPONSE_BYTES = 1024 * 1024
 _MAX_DIFY_SSE_LINE_BYTES = 1024 * 1024
@@ -15,6 +16,32 @@ _MAX_DIFY_STREAM_BYTES = 16 * 1024 * 1024
 _MAX_DIFY_UPLOAD_BYTES = 10 * 1024 * 1024


+def _decode_sse_data(line: bytes) -> dict[str, typing.Any] | None:
+    data = line[5:].strip()
+    if not data or data == b'[DONE]':
+        return None
+    try:
+        payload = json.loads(data.decode('utf-8'))
+    except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+        raise DifyAPIError('Dify SSE data line is not valid JSON') from exc
+    if not isinstance(payload, dict):
+        raise DifyAPIError('Dify SSE event is not a JSON object')
+    return payload
+
+
+def _decode_upload_response(body: bytes) -> dict[str, typing.Any]:
+    try:
+        response = json.loads(body)
+    except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+        raise DifyAPIError('Dify upload response is not valid JSON') from exc
+    if not isinstance(response, dict):
+        raise DifyAPIError('Dify upload response is not a JSON object')
+    payload = response.get('data', response)
+    if not isinstance(payload, dict) or not isinstance(payload.get('id'), str) or not payload['id']:
+        raise DifyAPIError('Dify upload response does not contain a valid file id')
+    return payload
+
+
 async def _read_limited_response(
    response: httpx.Response,
    *,
@@ -56,16 +83,16 @@ async def _iter_sse_json(
            line = raw_line.rstrip(b'\r').strip()
            if not line or not line.startswith(b'data:'):
                continue
-            payload = json.loads(line[5:].decode('utf-8', errors='replace'))
-            if isinstance(payload, dict):
+            payload = _decode_sse_data(line)
+            if payload is not None:
                yield payload
        if len(buffer) > _MAX_DIFY_SSE_LINE_BYTES:
            raise DifyAPIError('Dify SSE event exceeds the runtime limit')

    line = bytes(buffer).rstrip(b'\r').strip()
    if line.startswith(b'data:'):
-        payload = json.loads(line[5:].decode('utf-8', errors='replace'))
-        if isinstance(payload, dict):
+        payload = _decode_sse_data(line)
+        if payload is not None:
            yield payload


@@ -242,7 +269,7 @@ class AsyncDifyServiceClient:
        file: httpx._types.FileTypes,
        user: str,
        timeout: float = 30.0,
-    ) -> str:
+    ) -> dict[str, typing.Any]:
        # 处理 Path 对象
        if isinstance(file, Path):
            if not file.exists():
@@ -271,6 +298,6 @@ class AsyncDifyServiceClient:
            timeout=timeout,
        ) as response:
            body = await _read_limited_response(response)
-            if response.status_code != 201:
+            if response.status_code not in (200, 201):
                raise DifyAPIError(f'{response.status_code} {body.decode(errors="replace")}')
-        return json.loads(body)
+        return _decode_upload_response(body)
@@ -697,9 +697,10 @@ class DingTalkClient:
        if not await self.check_access_token():
            await self.get_access_token()

-        cardData: dict = {'cardParamMap': _stringify_card_param_map(card_param_map)}
+        template_params = dict(card_param_map or {})
        if card_data_config is not None:
-            cardData['config'] = json.dumps(card_data_config)
+            template_params['config'] = card_data_config
+        cardData: dict = {'cardParamMap': _stringify_card_param_map(template_params)}

        body: dict = {
            'cardTemplateId': card_template_id,
@@ -422,6 +422,69 @@ class QQOfficialClient:
                await self.logger.error(f'Failed to send private message: {response_data}')
                raise ValueError(response)

+    async def _send_markdown_msg(
+        self,
+        target_type: str,
+        target_id: str,
+        content: str,
+        msg_id: Optional[str] = None,
+        event_id: Optional[str] = None,
+        msg_seq: int = 1,
+    ) -> None:
+        """Send a Markdown message to a C2C user or QQ group."""
+        if not await self.check_access_token():
+            await self.get_access_token()
+
+        if target_type == 'c2c':
+            url = f'{self.base_url}/v2/users/{target_id}/messages'
+        elif target_type == 'group':
+            url = f'{self.base_url}/v2/groups/{target_id}/messages'
+        else:
+            raise ValueError(f'Unsupported Markdown target type: {target_type}')
+
+        data: dict[str, Any] = {
+            'msg_type': 2,
+            'markdown': {'content': content},
+            'msg_seq': msg_seq,
+        }
+        if msg_id:
+            data['msg_id'] = msg_id
+        if event_id:
+            data['event_id'] = event_id
+
+        async with self._http_client_context() as client:
+            headers = {
+                'Authorization': f'QQBot {self.access_token}',
+                'Content-Type': 'application/json',
+            }
+            response = await client.post(url, headers=headers, json=data)
+            if response.status_code != 200:
+                response_data = await httpclient.parse_json_response(response)
+                await self.logger.error(f'Failed to send Markdown message: {response_data}')
+                raise ValueError(response)
+
+    async def send_private_markdown_msg(
+        self,
+        user_openid: str,
+        content: str,
+        msg_id: Optional[str] = None,
+        event_id: Optional[str] = None,
+        msg_seq: int = 1,
+    ) -> None:
+        """Send a Markdown C2C message."""
+        await self._send_markdown_msg('c2c', user_openid, content, msg_id, event_id, msg_seq)
+
+    async def send_group_markdown_msg(
+        self,
+        group_openid: str,
+        content: str,
+        msg_id: Optional[str] = None,
+        event_id: Optional[str] = None,
+        msg_seq: int = 1,
+    ) -> None:
+        """Send a Markdown QQ group message."""
+        await self._send_markdown_msg('group', group_openid, content, msg_id, event_id, msg_seq)
+
    async def send_group_text_msg(
        self,
        group_openid: str,
@@ -46,6 +46,14 @@ CMD_RESPOND_MSG = 'aibot_respond_msg'
 CMD_RESPOND_WELCOME = 'aibot_respond_welcome_msg'
 CMD_RESPOND_UPDATE = 'aibot_respond_update_msg'
 CMD_SEND_MSG = 'aibot_send_msg'
+# Media upload protocol (3 steps: init -> chunk * N -> finish). The
+# command names below match the WeCom AI Bot long-connection protocol.
+CMD_UPLOAD_INIT = 'aibot_upload_media_init'
+CMD_UPLOAD_CHUNK = 'aibot_upload_media_chunk'
+CMD_UPLOAD_FINISH = 'aibot_upload_media_finish'
+
+# Default upload chunk size: 512 KB before base64 encoding.
+_UPLOAD_CHUNK_SIZE = 512 * 1024

 _DEDUP_CACHE_MAX = 4096
 _STREAM_CACHE_MAX = 1024
@@ -495,6 +503,145 @@ class WecomBotWsClient:
        body['chatid'] = chat_id
        return await self._send_reply(req_id, body, cmd=CMD_SEND_MSG)

+    # ------------------------------------------------------------------
+    # Media upload (image / voice / file)
+    # ------------------------------------------------------------------
+
+    async def upload_media(
+        self,
+        data: bytes,
+        filename: str = 'attachment',
+        media_type: str = 'file',
+    ) -> Optional[dict]:
+        """Upload *data* to the WeCom AI Bot CDN and return the parsed ACK.
+
+        Implements the three-step protocol documented for the WeCom
+        AI Bot:
+
+        1. ``aibot_upload_media_init`` — declare media type, file name,
+           size, MD5 and chunk count; receive ``upload_id``.
+        2. ``aibot_upload_media_chunk`` — send each chunk (base64-encoded
+           bytes) until done; receive per-chunk ACK.
+        3. ``aibot_upload_media_finish`` — finalize the upload; receive
+           ``media_id``.
+
+        Returns a dict with the final ``media_id`` (and the raw
+        ``finish`` ACK) on success, or ``None`` on any failure. The
+        caller is expected to ignore the result and continue
+        gracefully — the framework will keep working without media
+        delivery.
+        """
+        import base64 as _b64
+        import hashlib as _hl
+
+        if not data:
+            return None
+
+        file_size = len(data)
+        file_md5 = _hl.md5(data).hexdigest()
+        total_chunks = (file_size + _UPLOAD_CHUNK_SIZE - 1) // _UPLOAD_CHUNK_SIZE
+        if total_chunks == 0:
+            total_chunks = 1
+
+        # Step 1: init.
+        init_req_id = _generate_req_id(CMD_UPLOAD_INIT)
+        init_body = {
+            'type': media_type,
+            'filename': filename,
+            'total_size': file_size,
+            'total_chunks': total_chunks,
+            'md5': file_md5,
+        }
+        init_ack = await self._send_reply(
+            init_req_id,
+            init_body,
+            cmd=CMD_UPLOAD_INIT,
+        )
+        if not init_ack or init_ack.get('errcode', 0) != 0:
+            await self.logger.warning(f'upload_media init failed: ack={init_ack!r}')
+            return None
+        upload_id = (
+            init_ack.get('upload_id')
+            or init_ack.get('body', {}).get('upload_id')
+            or init_ack.get('data', {}).get('upload_id')
+        )
+        if not upload_id:
+            await self.logger.warning(f'upload_media init returned no upload_id: ack={init_ack!r}')
+            return None
+
+        # Step 2: chunks.
+        for index in range(total_chunks):
+            start = index * _UPLOAD_CHUNK_SIZE
+            end = min(start + _UPLOAD_CHUNK_SIZE, file_size)
+            chunk_bytes = data[start:end]
+            chunk_req_id = _generate_req_id(CMD_UPLOAD_CHUNK)
+            chunk_body = {
+                'upload_id': upload_id,
+                'chunk_index': index,
+                'base64_data': _b64.b64encode(chunk_bytes).decode('ascii'),
+            }
+            chunk_ack = await self._send_reply(
+                chunk_req_id,
+                chunk_body,
+                cmd=CMD_UPLOAD_CHUNK,
+            )
+            if not chunk_ack or chunk_ack.get('errcode', 0) != 0:
+                await self.logger.warning(f'upload_media chunk {index} failed: ack={chunk_ack!r}')
+                return None
+
+        # Step 3: finish.
+        finish_req_id = _generate_req_id(CMD_UPLOAD_FINISH)
+        finish_body = {'upload_id': upload_id}
+        finish_ack = await self._send_reply(
+            finish_req_id,
+            finish_body,
+            cmd=CMD_UPLOAD_FINISH,
+        )
+        if not finish_ack or finish_ack.get('errcode', 0) != 0:
+            await self.logger.warning(f'upload_media finish failed: ack={finish_ack!r}')
+            return None
+
+        media_id = (
+            finish_ack.get('media_id')
+            or finish_ack.get('body', {}).get('media_id')
+            or finish_ack.get('data', {}).get('media_id')
+        )
+        if not media_id:
+            await self.logger.warning(f'upload_media finish returned no media_id: ack={finish_ack!r}')
+            return None
+        return {'media_id': media_id, 'ack': finish_ack}
+
+    async def _reply_media(
+        self,
+        req_id: str,
+        media_id: str,
+        kind: str,
+    ) -> Optional[dict]:
+        """Send a media reply (image / voice / file) referencing *media_id*.
+
+        ``kind`` is one of ``'image'``, ``'voice'``, ``'file'``. Uses
+        the standard ``aibot_respond_msg`` command with a per-kind
+        body key (matches the convention documented for the WeCom
+        AI Bot SDK).
+        """
+        if kind not in {'image', 'voice', 'file'}:
+            await self.logger.warning(f'_reply_media called with unknown kind={kind!r}')
+            return None
+        body = {
+            'msgtype': kind,
+            kind: {'media_id': media_id},
+        }
+        return await self._send_reply(req_id, body, cmd=CMD_RESPOND_MSG)
+
+    async def reply_image(self, req_id: str, media_id: str) -> Optional[dict]:
+        return await self._reply_media(req_id, media_id, 'image')
+
+    async def reply_file(self, req_id: str, media_id: str) -> Optional[dict]:
+        return await self._reply_media(req_id, media_id, 'file')
+
+    async def reply_voice(self, req_id: str, media_id: str) -> Optional[dict]:
+        return await self._reply_media(req_id, media_id, 'voice')
+
    async def push_stream_chunk(self, msg_id: str, content: str, is_final: bool = False) -> bool:
        """Push a streaming chunk for a given message ID.

@@ -789,6 +936,13 @@ class WecomBotWsClient:
                    'chat_type': message_data.get('type', 'single'),
                }
                self._prune_stream_state()
+                # Send an initial empty stream frame so the WeCom client
+                # shows its built-in loading spinner while the pipeline
+                # processes the message (e.g. RAG retrieval).
+                try:
+                    await self.reply_stream(req_id, stream_id, '', finish=False)
+                except Exception:
+                    await self.logger.warning(f'Failed to send initial stream frame: {traceback.format_exc()}')
            message_data['stream_id'] = stream_id
            message_data['req_id'] = req_id

@@ -295,6 +295,34 @@ class WecomCSClient:
                raise Exception('Failed to send message')
            return data

+    @_bounded_token_retry
+    async def send_image_msg(self, open_kfid: str, external_userid: str, msgid: str, media_id: str):
+        if not await self.check_access_token():
+            self.access_token = await self.get_access_token(self.secret)
+
+        url = f'{self.base_url}/kf/send_msg?access_token={self.access_token}'
+        payload = {
+            'touser': external_userid,
+            'open_kfid': open_kfid,
+            'msgid': msgid,
+            'msgtype': 'image',
+            'image': {
+                'media_id': media_id,
+            },
+        }
+
+        async with self._http_client_context() as client:
+            response = await client.post(url, json=payload)
+
+            data = await httpclient.parse_json_response(response)
+            if data['errcode'] == 40014 or data['errcode'] == 42001:
+                self.access_token = await self.get_access_token(self.secret)
+                return await self.send_image_msg(open_kfid, external_userid, msgid, media_id)
+            if data['errcode'] != 0:
+                await self.logger.error(f'发送图片失败：{data}')
+                raise Exception('Failed to send image message')
+            return data
+
    async def handle_callback_request(self):
        """处理回调请求（独立端口模式，使用全局 request）。"""
        return await self._handle_callback_internal(request)
@@ -218,6 +218,7 @@ class MonitoringRouterGroup(group.RouterGroup):
            pipeline_ids = quart.request.args.getlist('pipelineId')
            start_time_str = quart.request.args.get('startTime')
            end_time_str = quart.request.args.get('endTime')
+            user_query = quart.request.args.get('userQuery')
            is_active_str = quart.request.args.get('isActive')
            limit = int(quart.request.args.get('limit', 100))
            offset = int(quart.request.args.get('offset', 0))
@@ -237,6 +238,7 @@ class MonitoringRouterGroup(group.RouterGroup):
                pipeline_ids=pipeline_ids if pipeline_ids else None,
                start_time=start_time,
                end_time=end_time,
+                user_query=user_query,
                is_active=is_active,
                limit=limit,
                offset=offset,
@@ -396,7 +398,14 @@ class MonitoringRouterGroup(group.RouterGroup):
        @self.route('/sessions/<session_id>/analysis', methods=['GET'], permission=Permission.RESOURCE_VIEW)
        async def get_session_analysis(session_id: str, request_context: RequestContext) -> str:
            """Get detailed analysis for a specific session"""
-            analysis = await self.ap.monitoring_service.get_session_analysis(request_context, session_id)
+            start_time = parse_iso_datetime(quart.request.args.get('startTime'))
+            end_time = parse_iso_datetime(quart.request.args.get('endTime'))
+            analysis = await self.ap.monitoring_service.get_session_analysis(
+                request_context,
+                session_id,
+                start_time=start_time,
+                end_time=end_time,
+            )

            # Always return success with the analysis data
            # The frontend will handle the 'found: false' case
@@ -39,7 +39,13 @@ class PipelinesRouterGroup(group.RouterGroup):
            permission=Permission.RESOURCE_MANAGE,
        )
        async def _(request_context: RequestContext) -> str:
-            pipeline_uuid = await self.ap.pipeline_service.create_pipeline(request_context, await quart.request.json)
+            pipeline_data = await quart.request.json
+            create_as_default = pipeline_data.get('is_default') is True
+            pipeline_uuid = await self.ap.pipeline_service.create_pipeline(
+                request_context,
+                pipeline_data,
+                default=create_as_default,
+            )
            return self.success(data={'uuid': pipeline_uuid})

        @self.route(
@@ -113,6 +113,24 @@ class BotsRouterGroup(group.RouterGroup):
            )
            return self.success(data={'sent': True})

+        @self.route(
+            '/<bot_uuid>/test-inbound',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def _(bot_uuid: str, request_context: RequestContext) -> str:
+            json_data = await quart.request.get_json(silent=True) or {}
+            try:
+                result = await self.ap.bot_service.send_http_bot_test_message(
+                    request_context,
+                    bot_uuid,
+                    str(json_data.get('message') or ''),
+                )
+            except ValueError as exc:
+                return self.http_status(400, -1, str(exc))
+            return self.success(data=result)
+
        @self.route(
            '/<bot_uuid>/admins',
            methods=['GET'],
@@ -398,7 +398,16 @@ class PluginsRouterGroup(group.RouterGroup):

            # Get debug URL from config
            plugin_config = self.ap.instance_config.data.get('plugin', {})
-            debug_url = plugin_config.get('display_plugin_debug_url', 'http://localhost:5401')
+            debug_url = plugin_config.get(
+                'display_plugin_debug_url',
+                'ws://localhost:5401/plugin/debug/ws',
+            )
+            parsed_debug_url = urlparse(debug_url)
+            if parsed_debug_url.scheme in {'http', 'https'}:
+                debug_url = parsed_debug_url._replace(
+                    scheme='wss' if parsed_debug_url.scheme == 'https' else 'ws',
+                    path=parsed_debug_url.path or '/plugin/debug/ws',
+                ).geturl()

            return self.success(
                data={
@@ -2,9 +2,6 @@ from __future__ import annotations

 import quart

-from langbot.pkg.cloud.entitlements import EntitlementFeatureUnavailableError
-from langbot_plugin.box.errors import BoxError
-
 from ...authz import Permission
 from ...context import RequestContext
 from .. import group
@@ -24,12 +21,7 @@ class SkillsRouterGroup(group.RouterGroup):
        async def list_skills(request_context: RequestContext) -> quart.Response:
            try:
                skills = await self.ap.skill_service.list_skills(request_context)
-            except EntitlementFeatureUnavailableError:
-                # Plans without managed sandbox support have no runnable skills.
-                # Treat that capability absence as an empty collection so the
-                # shared UI can render normally instead of surfacing a 500.
-                return self.success(data={'skills': []})
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
            return self.success(data={'skills': skills})

@@ -47,7 +39,7 @@ class SkillsRouterGroup(group.RouterGroup):
            try:
                skill = await self.ap.skill_service.create_skill(request_context, data)
                return self.success(data={'skill': skill})
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))

        @self.route(
@@ -59,7 +51,7 @@ class SkillsRouterGroup(group.RouterGroup):
        async def get_skill(skill_name: str, request_context: RequestContext) -> quart.Response:
            try:
                skill = await self.ap.skill_service.get_skill(request_context, skill_name)
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
            if not skill:
                return self.http_status(404, -1, 'Skill not found')
@@ -77,13 +69,13 @@ class SkillsRouterGroup(group.RouterGroup):
                try:
                    skill = await self.ap.skill_service.update_skill(request_context, skill_name, data)
                    return self.success(data={'skill': skill})
-                except (ValueError, BoxError) as exc:
+                except ValueError as exc:
                    return self.http_status(400, -1, str(exc))

            try:
                await self.ap.skill_service.delete_skill(request_context, skill_name)
                return self.success()
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))

        @self.route(
@@ -105,7 +97,7 @@ class SkillsRouterGroup(group.RouterGroup):
                    include_hidden=include_hidden,
                )
                return self.success(data=result)
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))

        @self.route(
@@ -118,7 +110,7 @@ class SkillsRouterGroup(group.RouterGroup):
            try:
                result = await self.ap.skill_service.read_skill_file(request_context, skill_name, path)
                return self.success(data=result)
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))

        @self.route(
@@ -136,7 +128,7 @@ class SkillsRouterGroup(group.RouterGroup):
            try:
                result = await self.ap.skill_service.write_skill_file(request_context, skill_name, path, content)
                return self.success(data=result)
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))

        @self.route(
@@ -170,7 +162,7 @@ class SkillsRouterGroup(group.RouterGroup):
            try:
                skill = await self.ap.skill_service.install_from_github(request_context, data)
                return self.success(data={'skills': skill})
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
            except Exception:
                raise
@@ -194,7 +186,7 @@ class SkillsRouterGroup(group.RouterGroup):
            try:
                preview = await self.ap.skill_service.preview_install_from_github(request_context, data)
                return self.success(data={'skills': preview})
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
            except Exception:
                raise
@@ -219,7 +211,7 @@ class SkillsRouterGroup(group.RouterGroup):
                    source_paths=form.getlist('source_paths'),
                )
                return self.success(data={'skills': skill})
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
            except Exception:
                raise
@@ -242,7 +234,7 @@ class SkillsRouterGroup(group.RouterGroup):
                    filename=file.filename or '',
                )
                return self.success(data={'skills': preview})
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
            except Exception:
                raise
@@ -261,5 +253,5 @@ class SkillsRouterGroup(group.RouterGroup):
            try:
                result = await self.ap.skill_service.scan_directory_async(request_context, path)
                return self.success(data=result)
-            except (ValueError, BoxError) as exc:
+            except ValueError as exc:
                return self.http_status(400, -1, str(exc))
@@ -206,6 +206,20 @@ class SystemRouterGroup(group.RouterGroup):

            return self.success(data={})

+        @self.route(
+            '/wizard/recommended-model',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def _(request_context: RequestContext) -> str:
+            """Resolve Space's best available chat model to this Workspace."""
+            try:
+                model = await self.ap.space_service.get_recommended_chat_model(request_context)
+            except ValueError as exc:
+                return self.http_status(503, -1, str(exc))
+            return self.success(data=model)
+
        @self.route(
            '/tasks',
            methods=['GET'],
@@ -14,13 +14,6 @@ from ...service.user import ControlPlaneDirectoryRequiredError, PublicRegistrati

@group.group_class('user', '/api/v1/user')
 class UserRouterGroup(group.RouterGroup):
-    @staticmethod
-    def _origin(value: str) -> tuple[str, str, int | None] | None:
-        parsed = urlsplit(value)
-        if parsed.scheme not in {'http', 'https'} or not parsed.hostname:
-            return None
-        return parsed.scheme, parsed.hostname.casefold(), parsed.port
-
    def _validate_space_redirect_uri(self, redirect_uri: str, *, bind: bool) -> str:
        parsed = urlsplit(redirect_uri)
        if (
@@ -38,17 +31,8 @@ class UserRouterGroup(group.RouterGroup):
            if query != {'mode': ['bind']}:
                raise ValueError('Invalid Space binding redirect_uri')
        elif query:
-            raise ValueError('Invalid Space login redirect_uri')
+            raise ValueError('Invalid LangBot Account login redirect_uri')

-        redirect_origin = self._origin(redirect_uri)
-        api_config = self.ap.instance_config.data.get('api', {})
-        trusted_origins = {
-            self._origin(str(api_config.get(config_key, '') or '').strip())
-            for config_key in ('webui_url', 'webhook_prefix')
-        }
-        trusted_origins.discard(None)
-        if redirect_origin not in trusted_origins:
-            raise ValueError('Untrusted redirect_uri origin')
        return redirect_uri

    async def initialize(self) -> None:
@@ -202,6 +186,9 @@ class UserRouterGroup(group.RouterGroup):
            json_data = await quart.request.json
            code = json_data.get('code')
            state = json_data.get('state')
+            redirect_uri = json_data.get('redirect_uri') or (
+                quart.request.url_root.rstrip('/') + '/auth/space/callback'
+            )
            launch_assertion = json_data.get('launch_assertion')
            workspace_uuid = json_data.get('workspace_uuid')

@@ -215,8 +202,11 @@ class UserRouterGroup(group.RouterGroup):
                return self.fail(1, 'Missing authorization code')
            if not state:
                return self.fail(1, 'Missing state parameter')
+            if not str(code).startswith('v4_'):
+                return self.fail(1, 'Unsupported Space OAuth code contract')

            try:
+                redirect_uri = self._validate_space_redirect_uri(str(redirect_uri), bind=False)
                consumed_state = await self.ap.user_service.consume_space_oauth_state_details(state, 'login')
                # Exchange code for tokens
                launch_workspace_uuid = consumed_state.launch_workspace_uuid
@@ -234,24 +224,36 @@ class UserRouterGroup(group.RouterGroup):
                    code,
                    workspace_uuids,
                    workspace_created_ats,
+                    redirect_uri=redirect_uri,
                )
                access_token = token_data.get('access_token')
                refresh_token = token_data.get('refresh_token')
                expires_in = token_data.get('expires_in', 0)
+                cloud_workspace_uuid = token_data.get('cloud_workspace_uuid')

                if not access_token:
                    return self.fail(1, 'Failed to get access token from Space')

-                # Authenticate and create/update local user
+                cloud_mode = getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud'
+                if cloud_mode and launch_workspace_uuid and launch_workspace_uuid != cloud_workspace_uuid:
+                    return self.fail(1, 'Space OAuth Workspace binding mismatch')
+                target_workspace_uuid = launch_workspace_uuid or cloud_workspace_uuid
+                if cloud_mode:
+                    if not target_workspace_uuid:
+                        return self.fail(1, 'Space OAuth response is missing the Cloud Workspace binding')
+                    await self.ap.directory_projection_service.reconcile_workspaces((target_workspace_uuid,))
+
+                # Authenticate only after the signed, exact Workspace delta has
+                # established the Account and membership runtime shadow rows.
                jwt_token, user_obj = await self.ap.user_service.authenticate_space_user(
                    access_token, refresh_token, expires_in
                )

-                if launch_workspace_uuid:
+                if target_workspace_uuid:
                    try:
                        access = await self.ap.workspace_collaboration_service.resolve_account_workspace(
                            user_obj.uuid,
-                            launch_workspace_uuid,
+                            target_workspace_uuid,
                        )
                    except Exception:
                        self.ap.logger.warning('Rejected Space OAuth launch for unauthorized Workspace')
@@ -338,6 +340,7 @@ class UserRouterGroup(group.RouterGroup):
            if cloud_mode:
                capabilities['password_login_enabled'] = False
            capabilities['authenticated_invitation_acceptance_enabled'] = cloud_mode
+            capabilities['invitation_registration_enabled'] = not cloud_mode
            return self.success(data={'initialized': True, **capabilities})

        @self.route('/set-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
@@ -382,12 +385,17 @@ class UserRouterGroup(group.RouterGroup):
            json_data = await quart.request.json
            code = json_data.get('code')
            state = json_data.get('state')
+            redirect_uri = json_data.get('redirect_uri') or (
+                quart.request.url_root.rstrip('/') + '/auth/space/callback?mode=bind'
+            )

            if not code:
                return self.http_status(400, -1, 'Missing authorization code')

            if not state:
                return self.http_status(400, -1, 'Missing state parameter')
+            if not str(code).startswith('v4_'):
+                return self.http_status(400, -1, 'Unsupported Space OAuth code contract')

            try:
                user_obj = await self.ap.user_service.consume_space_oauth_state(state, 'bind')
@@ -400,7 +408,10 @@ class UserRouterGroup(group.RouterGroup):
                return self.http_status(400, -1, 'Only local accounts can bind to Space')

            try:
-                updated_user = await self.ap.user_service.bind_space_account(user_obj.user, code)
+                redirect_uri = self._validate_space_redirect_uri(str(redirect_uri), bind=True)
+                updated_user = await self.ap.user_service.bind_space_account(
+                    user_obj.user, code, redirect_uri=redirect_uri
+                )
                jwt_token = await self.ap.user_service.generate_jwt_token(updated_user)
                return self.success(
                    data={
@@ -416,7 +427,7 @@ class UserRouterGroup(group.RouterGroup):
                    'Bind the LangBot Account with the same email as this local Account',
                )
            except ValueError:
-                return self.http_status(400, -1, 'Space account binding failed')
+                return self.http_status(400, -1, 'LangBot Account binding failed')
            except Exception:
                raise

@@ -443,6 +454,10 @@ class UserRouterGroup(group.RouterGroup):
                    }
                )

+            projection_service = self.ap.directory_projection_service
+            if projection_service is None:
+                raise SpaceLaunchError('Cloud directory projection is unavailable')
+            await projection_service.reconcile_workspaces((launch['workspace_uuid'],))
            account = await self.ap.user_service.get_user_by_uuid(launch['account_uuid'])
            if account is None:
                raise SpaceLaunchError('Launch Account is not projected into Core')
@@ -1,6 +1,7 @@
 from __future__ import annotations

 import uuid
+import json
 import sqlalchemy

 from ....core import app
@@ -8,6 +9,8 @@ from ....entity.persistence import bot as persistence_bot
 from ....entity.persistence import pipeline as persistence_pipeline
 from ....workspace.errors import WorkspaceNotFoundError
 from .tenant import TenantContext, require_workspace_uuid, scope_statement
+from ....utils import httpclient
+from ....platform.sources import http_bot_signing


 class BotService:
@@ -80,6 +83,7 @@ class BotService:
            'wecomcs',
            'LINE',
            'lark',
+            'http_bot',
        ]:
            webhook_prefix = self.ap.instance_config.data['api'].get('webhook_prefix', 'http://127.0.0.1:5300')
            extra_webhook_prefix = self.ap.instance_config.data['api'].get('extra_webhook_prefix', '')
@@ -133,7 +137,16 @@ class BotService:

        bot = await self.get_bot(context, bot_data['uuid'], include_secret=True)

-        await self.ap.platform_mgr.load_bot(context, bot)
+        try:
+            await self.ap.platform_mgr.load_bot(context, bot)
+        except Exception:
+            # The bot row was already inserted above; without this rollback a
+            # failing adapter constructor (e.g. a missing optional credential
+            # key) would leave a permanently disabled orphan bot in the DB.
+            await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.delete(persistence_bot.Bot).where(persistence_bot.Bot.uuid == bot_data['uuid'])
+            )
+            raise

        return bot_data['uuid']

@@ -216,6 +229,53 @@ class BotService:

        return [log.to_json() for log in logs], total_count

+    async def send_http_bot_test_message(
+        self,
+        context: TenantContext,
+        bot_uuid: str,
+        message: str,
+    ) -> dict:
+        """Send a signed test message through the HTTP Bot public ingress."""
+        bot = await self.get_bot(context, bot_uuid, include_secret=True)
+        if bot is None:
+            raise WorkspaceNotFoundError('Bot not found')
+        if bot.get('adapter') != 'http_bot':
+            raise ValueError('Inbound test is only available for HTTP Bot')
+        if not bot.get('enable'):
+            raise ValueError('Bot must be enabled before sending a test message')
+
+        text = message.strip()
+        if not text or len(text) > 2000:
+            raise ValueError('Test message must contain 1 to 2000 characters')
+
+        payload = {
+            'session_id': f'wizard-{uuid.uuid4().hex}',
+            'sender': {'id': 'wizard-user', 'name': 'Wizard Test'},
+            'message': [{'type': 'Plain', 'text': text}],
+        }
+        body = json.dumps(payload, ensure_ascii=False, separators=(',', ':')).encode()
+        config = bot.get('adapter_config') or {}
+        headers = {'Content-Type': 'application/json'}
+        if config.get('signature_required', True):
+            secret = str(config.get('inbound_secret') or '')
+            if not secret:
+                raise ValueError('HTTP Bot inbound signing secret is required')
+            timestamp, signature = http_bot_signing.sign(secret, body)
+            headers[http_bot_signing.HEADER_TIMESTAMP] = timestamp
+            headers[http_bot_signing.HEADER_SIGNATURE] = signature
+
+        port = int(self.ap.instance_config.data.get('api', {}).get('port', 5300))
+        session = httpclient.get_session()
+        async with session.post(
+            f'http://127.0.0.1:{port}/bots/{bot_uuid}',
+            data=body,
+            headers=headers,
+        ) as response:
+            result = await httpclient.read_json_limited(response)
+            if response.status not in {200, 202}:
+                raise ValueError(result.get('msg') or f'HTTP Bot test failed with status {response.status}')
+            return result.get('data') or {}
+
    async def send_message(
        self,
        context: TenantContext,
@@ -1257,6 +1257,7 @@ class MonitoringService:
        pipeline_ids: list[str] | None = None,
        start_time: datetime.datetime | None = None,
        end_time: datetime.datetime | None = None,
+        user_query: str | None = None,
        is_active: bool | None = None,
        limit: int = 100,
        offset: int = 0,
@@ -1274,6 +1275,14 @@ class MonitoringService:
            conditions.append(persistence_monitoring.MonitoringSession.start_time >= start_time)
        if end_time:
            conditions.append(persistence_monitoring.MonitoringSession.start_time <= end_time)
+        if user_query and user_query.strip():
+            user_pattern = f'%{user_query.strip()}%'
+            conditions.append(
+                sqlalchemy.or_(
+                    persistence_monitoring.MonitoringSession.user_id.ilike(user_pattern),
+                    persistence_monitoring.MonitoringSession.user_name.ilike(user_pattern),
+                )
+            )
        if is_active is not None:
            conditions.append(persistence_monitoring.MonitoringSession.is_active == is_active)

@@ -1365,6 +1374,8 @@ class MonitoringService:
        self,
        context: TenantContext,
        session_id: str,
+        start_time: datetime.datetime | None = None,
+        end_time: datetime.datetime | None = None,
    ) -> dict:
        """Get bounded session details with full statistics computed in SQL."""
        workspace_uuid = require_workspace_uuid(context)
@@ -1478,12 +1489,17 @@ class MonitoringService:
            )
        )
        tool_stats = tool_stats_result.one()
+        tool_conditions = [
+            persistence_monitoring.MonitoringToolCall.workspace_uuid == workspace_uuid,
+            persistence_monitoring.MonitoringToolCall.session_id == session_id,
+        ]
+        if start_time is not None:
+            tool_conditions.append(persistence_monitoring.MonitoringToolCall.timestamp >= start_time)
+        if end_time is not None:
+            tool_conditions.append(persistence_monitoring.MonitoringToolCall.timestamp <= end_time)
        tool_query = (
            sqlalchemy.select(persistence_monitoring.MonitoringToolCall)
-            .where(
-                persistence_monitoring.MonitoringToolCall.workspace_uuid == workspace_uuid,
-                persistence_monitoring.MonitoringToolCall.session_id == session_id,
-            )
+            .where(*tool_conditions)
            .order_by(persistence_monitoring.MonitoringToolCall.timestamp.asc())
            .limit(detail_limit + 1)
        )
@@ -25,6 +25,7 @@ _PUBLIC_SKILL_FIELDS = (
    'description',
    'instructions',
    'package_root',
+    'revision',
    'created_at',
    'updated_at',
 )
@@ -53,38 +54,11 @@ class SkillService:
    def __init__(self, ap: app.Application) -> None:
        self.ap = ap

-    def _box_service(self):
-        box_service = getattr(self.ap, 'box_service', None)
-        if box_service is not None and getattr(box_service, 'available', False):
-            return box_service
-        return None
-
-    def _require_box(self, action: str):
-        """Return the Box service or raise if it is not available.
-
-        Box is the only source of truth for skills. Every read and write
-        operation goes through it — there is no local-filesystem fallback.
-        """
-        box_service = self._box_service()
-        if box_service is not None:
-            return box_service
-        ap_box = getattr(self.ap, 'box_service', None)
-        if ap_box is None:
-            reason = 'not initialised'
-        elif not getattr(ap_box, 'enabled', True):
-            reason = 'disabled in config (box.enabled = false)'
-        else:
-            connector_error = getattr(ap_box, '_connector_error', '') or 'currently unavailable'
-            reason = f'unavailable: {connector_error}'
-        raise ValueError(
-            f'{action} requires the Box runtime, which is {reason}. '
-            f'Enable Box in config.yaml (box.enabled = true) and ensure the '
-            f'runtime is reachable before retrying.'
-        )
-
-    def _require_box_for_write(self, action: str) -> None:
-        """Backwards-compatible alias preserved for clarity at call sites."""
-        self._require_box(action)
+    def _repository(self):
+        repository = getattr(self.ap, 'skill_repository', None)
+        if repository is None:
+            raise ValueError('Skill repository is not initialised')
+        return repository

    async def _execution_context(self, context: TenantContext) -> ExecutionContext:
        workspace_uuid = require_workspace_uuid(context)
@@ -113,20 +87,11 @@ class SkillService:

    async def list_skills(self, context: TenantContext) -> list[dict]:
        execution_context = await self._execution_context(context)
-        # When Box is unavailable, surface an empty list rather than raising —
-        # the skills page should render cleanly, and the UI separately renders
-        # a "Box disabled / unavailable" banner via useBoxStatus.
-        box_service = self._box_service()
-        if box_service is None:
-            return []
-        return [self._serialize_skill(skill) for skill in await box_service.list_skills(execution_context)]
+        return [self._serialize_skill(skill) for skill in await self._repository().list_skills(execution_context)]

    async def get_skill(self, context: TenantContext, skill_name: str) -> Optional[dict]:
        execution_context = await self._execution_context(context)
-        box_service = self._box_service()
-        if box_service is None:
-            return None
-        skill = await box_service.get_skill(execution_context, skill_name)
+        skill = await self._repository().get_skill(execution_context, skill_name, snapshot=True)
        return self._serialize_skill(skill) if skill else None

    async def get_skill_by_name(self, context: TenantContext, name: str) -> Optional[dict]:
@@ -134,22 +99,25 @@ class SkillService:

    async def create_skill(self, context: TenantContext, data: dict) -> dict:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Creating a skill')
-        created = await box_service.create_skill(execution_context, data)
+        created = await self._repository().create_skill(execution_context, data)
+        await self._reload_skills(execution_context)
+        return self._serialize_skill(created)
+
+    async def import_skill_directory(self, context: TenantContext, path: str, data: dict) -> dict:
+        execution_context = await self._execution_context(context)
+        created = await self._repository().import_skill_directory(execution_context, path, data)
        await self._reload_skills(execution_context)
        return self._serialize_skill(created)

    async def update_skill(self, context: TenantContext, skill_name: str, data: dict) -> dict:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Editing a skill')
-        updated = await box_service.update_skill(execution_context, skill_name, data)
+        updated = await self._repository().update_skill(execution_context, skill_name, data)
        await self._reload_skills(execution_context)
        return self._serialize_skill(updated)

    async def delete_skill(self, context: TenantContext, skill_name: str) -> bool:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Deleting a skill')
-        await box_service.delete_skill(execution_context, skill_name)
+        await self._repository().delete_skill(execution_context, skill_name)
        await self._reload_skills(execution_context)
        return True

@@ -162,24 +130,27 @@ class SkillService:
        max_entries: int = 200,
    ) -> dict:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Browsing skill files')
-        return await box_service.list_skill_files(execution_context, skill_name, path, include_hidden, max_entries)
+        return await self._repository().list_skill_files(
+            execution_context,
+            skill_name,
+            path,
+            include_hidden,
+            max_entries,
+        )

    async def read_skill_file(self, context: TenantContext, skill_name: str, path: str) -> dict:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Reading a skill file')
-        return await box_service.read_skill_file(execution_context, skill_name, path)
+        return await self._repository().read_skill_file(execution_context, skill_name, path)

    async def write_skill_file(self, context: TenantContext, skill_name: str, path: str, content: str) -> dict:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Editing skill files')
-        result = await box_service.write_skill_file(execution_context, skill_name, path, content)
+        result = await self._repository().write_skill_file(execution_context, skill_name, path, content)
        await self._reload_skills(execution_context)
        return result

    async def install_from_github(self, context: TenantContext, data: dict) -> list[dict]:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Installing a skill from GitHub')
+        repository = self._repository()
        owner = str(data['owner']).strip()
        repo = str(data['repo']).strip()
        release_tag = str(data.get('release_tag', '')).strip()
@@ -198,7 +169,7 @@ class SkillService:

        zip_bytes = await self._download_github_asset(asset_url)
        filename = f'{repo}-{release_tag.lstrip("v").replace("/", "-") or "source"}.zip'
-        installed = await box_service.install_skill_zip(
+        installed = await repository.install_skill_zip(
            execution_context,
            zip_bytes,
            filename,
@@ -211,7 +182,7 @@ class SkillService:

    async def preview_install_from_github(self, context: TenantContext, data: dict) -> list[dict]:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Previewing a skill from GitHub')
+        repository = self._repository()
        owner = str(data['owner']).strip()
        repo = str(data['repo']).strip()
        release_tag = str(data.get('release_tag', '')).strip()
@@ -228,7 +199,7 @@ class SkillService:
        source_subdir = str(data.get('source_subdir', '') or '').strip()

        zip_bytes = await self._download_github_asset(asset_url)
-        return await box_service.preview_skill_zip(
+        return await repository.preview_skill_zip(
            execution_context,
            zip_bytes,
            f'{repo}-{release_tag.lstrip("v").replace("/", "-") or "source"}.zip',
@@ -245,8 +216,7 @@ class SkillService:
        source_path: str = '',
    ) -> list[dict]:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Installing a skill from upload')
-        installed = await box_service.install_skill_zip(
+        installed = await self._repository().install_skill_zip(
            execution_context,
            file_bytes,
            filename,
@@ -264,8 +234,7 @@ class SkillService:
        filename: str,
    ) -> list[dict]:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Previewing a skill upload')
-        return await box_service.preview_skill_zip(execution_context, file_bytes, filename)
+        return await self._repository().preview_skill_zip(execution_context, file_bytes, filename)

    async def _install_github_skill_md(
        self,
@@ -276,14 +245,14 @@ class SkillService:
        repo: str,
        data: dict,
    ) -> list[dict]:
-        box_service = self._require_box('Installing a skill from GitHub')
+        repository = self._repository()
        zip_bytes, filename, _package_name = await self._download_github_skill_directory_as_zip(
            asset_url,
            owner=owner,
            repo=repo,
        )

-        installed = await box_service.install_skill_zip(
+        installed = await repository.install_skill_zip(
            context,
            zip_bytes,
            filename,
@@ -302,13 +271,13 @@ class SkillService:
        owner: str,
        repo: str,
    ) -> list[dict]:
-        box_service = self._require_box('Previewing a skill from GitHub')
+        repository = self._repository()
        zip_bytes, _filename, package_name = await self._download_github_skill_directory_as_zip(
            asset_url,
            owner=owner,
            repo=repo,
        )
-        return await box_service.preview_skill_zip(context, zip_bytes, f'{package_name}.zip', target_suffix='')
+        return await repository.preview_skill_zip(context, zip_bytes, f'{package_name}.zip', target_suffix='')

    async def reload_skills(self, context: TenantContext) -> list[dict]:
        execution_context = await self._execution_context(context)
@@ -317,8 +286,7 @@ class SkillService:

    async def scan_directory_async(self, context: TenantContext, path: str) -> dict:
        execution_context = await self._execution_context(context)
-        box_service = self._require_box('Scanning a skill directory')
-        return await box_service.scan_skill_directory(execution_context, path)
+        return await self._repository().scan_skill_directory(execution_context, path)

    async def _reload_skills(self, context: TenantContext) -> None:
        skill_mgr = getattr(self.ap, 'skill_mgr', None)
@@ -11,6 +11,9 @@ import sqlalchemy
 from ....core import app
 from ....entity.persistence import user
 from ....entity.dto.space_model import SpaceModel
+from ....entity.dto.space_model import SpaceModelSelection
+from ....entity.persistence import model as persistence_model
+from ....cloud.model_catalog import LANGBOT_MODELS_PROVIDER_REQUESTER


 _CREDITS_CACHE_TTL_SECONDS = 60
@@ -116,7 +119,7 @@ class SpaceService:

        space_config = self._get_space_config()
        authorize_url = space_config['oauth_authorize_url']
-        params = {'redirect_uri': redirect_uri}
+        params = {'redirect_uri': redirect_uri, 'code_contract': 'redirect-v1'}
        if state:
            params['state'] = state
        return f'{authorize_url}?{urlencode(params)}'
@@ -126,6 +129,8 @@ class SpaceService:
        code: str,
        workspace_uuids: list[str] | None = None,
        workspace_created_ats: dict[str, int] | None = None,
+        *,
+        redirect_uri: str = '',
    ) -> typing.Dict:
        """Exchange OAuth authorization code for tokens"""
        from langbot.pkg.utils import constants
@@ -138,6 +143,7 @@ class SpaceService:
            f'{space_url}/api/v1/accounts/oauth/token',
            json={
                'code': code,
+                'redirect_uri': redirect_uri,
                'instance_id': constants.instance_id,
                # Sending an explicit empty list tells new Space servers not to
                # synthesize a legacy instance-derived Workspace binding.
@@ -238,3 +244,76 @@ class SpaceService:
                raise ValueError(f'Failed to get models: {data.get("msg")}')
            models_data = data.get('data', {}).get('models', [])
            return [SpaceModel.model_validate(model_dict) for model_dict in models_data]
+
+    async def get_model_selection(self, category: str) -> typing.List[SpaceModelSelection]:
+        """Return Space models in the availability-ranked selection order."""
+        space_url = self._get_space_config()['url']
+        session = httpclient.get_session()
+        async with session.get(
+            f'{space_url}/api/v1/models/selection',
+            params={'category': category},
+        ) as response:
+            if response.status != 200:
+                error = await httpclient.read_text_limited(response)
+                raise ValueError(f'Failed to get model selection: {error}')
+            payload = await httpclient.read_json_limited(response)
+            if payload.get('code') != 0:
+                raise ValueError(f'Failed to get model selection: {payload.get("msg")}')
+
+            data = payload.get('data', [])
+            if isinstance(data, dict):
+                data = data.get('models', data.get('items', []))
+            if not isinstance(data, list):
+                raise ValueError('Failed to get model selection: invalid response')
+
+            models = []
+            for selection in data:
+                if isinstance(selection, dict) and isinstance(selection.get('model'), dict):
+                    models.append(selection['model'])
+                else:
+                    models.append(selection)
+            return [SpaceModelSelection.model_validate(model) for model in models]
+
+    async def get_recommended_chat_model(self, context: typing.Any) -> dict:
+        """Resolve Space's first ranked chat model to a local Workspace model."""
+        selection = await self.get_model_selection('chat')
+        if not selection:
+            raise ValueError('No recommended chat model is available')
+        recommended = selection[0]
+
+        async def find_local_model():
+            result = await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.select(persistence_model.LLMModel)
+                .join(
+                    persistence_model.ModelProvider,
+                    sqlalchemy.and_(
+                        persistence_model.ModelProvider.workspace_uuid == persistence_model.LLMModel.workspace_uuid,
+                        persistence_model.ModelProvider.uuid == persistence_model.LLMModel.provider_uuid,
+                    ),
+                )
+                .where(
+                    persistence_model.LLMModel.workspace_uuid == context.workspace_uuid,
+                    persistence_model.ModelProvider.requester == LANGBOT_MODELS_PROVIDER_REQUESTER,
+                    sqlalchemy.or_(
+                        persistence_model.LLMModel.uuid == recommended.uuid,
+                        persistence_model.LLMModel.name == recommended.model_id,
+                    ),
+                )
+            )
+            return result.first()
+
+        local_model = await find_local_model()
+        if local_model is None:
+            # OSS synchronizes the public catalog locally. Refresh once in case
+            # the recommendation was published after this process started.
+            from ..context import ExecutionContext
+
+            try:
+                await self.ap.model_mgr.sync_new_models_from_space(ExecutionContext.from_request(context))
+            except Exception:
+                pass
+            local_model = await find_local_model()
+
+        if local_model is None:
+            raise ValueError('Recommended chat model is not available in this Workspace')
+        return {'uuid': local_model.uuid, 'name': local_model.name}
@@ -114,7 +114,7 @@ class UserService:
        if purpose == 'login' and account_uuid is not None:
            raise ValueError('Login state cannot be bound to an Account')
        if purpose != 'login' and launch_workspace_uuid is not None:
-            raise ValueError('Launch Workspace state is only valid for Space login')
+            raise ValueError('Launch Workspace state is only valid for LangBot Account login')
        if ttl_seconds <= 0:
            raise ValueError('OAuth state lifetime must be positive')

@@ -327,7 +327,7 @@ class UserService:
        normalized_email = normalize_email(user_email)
        if self._uses_control_plane_directory():
            raise ControlPlaneDirectoryRequiredError(
-                'Cloud invitation registration must use a Space account to preserve control-plane identity'
+                'Cloud invitation registration must use a LangBot Account to preserve control-plane identity'
            )
        invitation, _ = await self.ap.workspace_collaboration_service.inspect_invitation(invitation_token)
        if invitation.normalized_email != normalized_email:
@@ -394,7 +394,7 @@ class UserService:

        # Check if this user has a local password set
        if not user_obj.password:
-            raise ValueError('请使用 Space 账户登录')
+            raise ValueError('请使用 LangBot 账号登录')

        await self._verify_password(user_obj.password, password)

@@ -774,7 +774,7 @@ class UserService:
            f'email:{normalized_email}',
        )

-    async def bind_space_account(self, user_email: str, code: str) -> user.User:
+    async def bind_space_account(self, user_email: str, code: str, *, redirect_uri: str = '') -> user.User:
        """Bind Space account to existing local account"""
        local_account = await self.get_user_by_email(user_email)
        if local_account is None:
@@ -794,12 +794,13 @@ class UserService:
                code,
                [binding.workspace_uuid],
                {binding.workspace_uuid: created_ts},
+                redirect_uri=redirect_uri,
            )
        else:
            # Compatibility for early/bootstrap call sites that have not wired
            # WorkspaceService yet; old Space servers still derive the legacy
            # Workspace identity from instance_id when the field is omitted.
-            token_data = await self.ap.space_service.exchange_oauth_code(code)
+            token_data = await self.ap.space_service.exchange_oauth_code(code, redirect_uri=redirect_uri)
        access_token = token_data.get('access_token')
        refresh_token = token_data.get('refresh_token')
        expires_in = token_data.get('expires_in', 0)
@@ -825,7 +826,7 @@ class UserService:
        # Check if this Space account is already bound to another user
        existing_space_user = await self.get_user_by_space_account_uuid(space_account_uuid)
        if existing_space_user and existing_space_user.normalized_email != normalize_email(user_email):
-            raise ValueError('This Space account is already bound to another user')
+            raise ValueError('This LangBot Account is already bound to another user')

        # Update local account to Space account
        normalized_email = normalize_email(user_email)
@@ -147,7 +147,16 @@ class LangBotMCPServer:
        )
        async def create_pipeline(pipeline_data: dict) -> str:
            context = _authorized(Permission.RESOURCE_MANAGE)
-            return _dump({'uuid': await ap.pipeline_service.create_pipeline(context, pipeline_data)})
+            create_as_default = pipeline_data.get('is_default') is True
+            return _dump(
+                {
+                    'uuid': await ap.pipeline_service.create_pipeline(
+                        context,
+                        pipeline_data,
+                        default=create_as_default,
+                    )
+                }
+            )

        @mcp.tool(description='Update a pipeline by UUID. `pipeline_data` matches the PUT body.')
        async def update_pipeline(pipeline_uuid: str, pipeline_data: dict) -> str:
@@ -147,10 +147,9 @@ class BoxRuntimeConnector(ManagedRuntimeConnector):
          - An explicit ``runtime.endpoint`` was configured

        When this is True the Box runtime lives in a separate process with its
-        own filesystem view (container, pod sidecar, or remote host), so paths
-        it reports (e.g. skill ``package_root``) are NOT resolvable on the
-        LangBot side. When False, Box runs as a stdio child process that shares
-        LangBot's filesystem.
+        own filesystem view (container, pod sidecar, or remote host), so only
+        explicitly shared paths are usable on both sides. When False, Box runs
+        as a stdio child process that shares LangBot's filesystem.
        """
        return bool(
            self.configured_runtime_endpoint
@@ -367,6 +366,12 @@ class BoxRuntimeConnector(ManagedRuntimeConnector):
    def _ensure_control_token(self, *, allow_generate: bool) -> str:
        if not self._control_token and allow_generate:
            self._control_token = secrets.token_urlsafe(48)
+        if not self._control_token:
+            if getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud':
+                raise BoxRuntimeUnavailableError(
+                    f'{BOX_CONTROL_TOKEN_ENV} must be configured with a strong shared secret for a Cloud Box runtime'
+                )
+            return ''
        try:
            self._control_token = validate_control_token(self._control_token)
        except ValueError as exc:
@@ -376,19 +381,19 @@ class BoxRuntimeConnector(ManagedRuntimeConnector):
        return self._control_token

    def get_control_headers(self) -> dict[str, str]:
-        """Headers for the instance-authenticated RPC control handshake."""
+        """Return instance-scoped RPC headers and the optional shared secret."""

        self._ensure_control_token(allow_generate=False)
-        return {
-            BOX_CONTROL_TOKEN_HEADER: self._control_token,
-            BOX_INSTANCE_HEADER: self._trusted_instance_uuid,
-        }
+        headers = {BOX_INSTANCE_HEADER: self._trusted_instance_uuid}
+        if self._control_token:
+            headers[BOX_CONTROL_TOKEN_HEADER] = self._control_token
+        return headers

    def get_relay_headers(
        self,
        action_context: ActionContext,
    ) -> dict[str, str]:
-        """Return authenticated, placement-scoped relay handshake headers."""
+        """Return instance- and placement-scoped relay handshake headers."""

        context = ActionContext.model_validate(action_context).without_installation()
        if context.instance_uuid != self._trusted_instance_uuid:
@@ -28,8 +28,10 @@ from langbot_plugin.box.errors import BoxAdmissionError, BoxError, BoxValidation
 from langbot_plugin.box.models import (
    BUILTIN_PROFILES,
    BoxExecutionResult,
+    BoxHostMountMode,
    BoxManagedProcessInfo,
    BoxManagedProcessSpec,
+    BoxMountSpec,
    BoxProfile,
    BoxSpec,
 )
@@ -169,7 +171,7 @@ class BoxService:
            self._connector_error = 'Box runtime is disabled in config (box.enabled = false)'
            self.ap.logger.info(
                'Box runtime disabled by config; sandbox features (exec/read/write/edit, '
-                'skill add/edit, stdio MCP) will be unavailable.'
+                'stdio MCP, executable package scripts) will be unavailable.'
            )
            return
        try:
@@ -275,10 +277,6 @@ class BoxService:
                        await self._purge_attachment_dirs()
                    self._available = True
                    self._connector_error = ''
-                    skill_mgr = getattr(self.ap, 'skill_mgr', None)
-                    reload_skills = getattr(skill_mgr, 'reload_skills', None)
-                    if callable(reload_skills) and not self._cloud_managed:
-                        await reload_skills()
                    self.ap.logger.info('Box runtime reconnected, sandbox features restored.')
                    return
                except Exception as exc:
@@ -358,19 +356,17 @@ class BoxService:
        """Whether LangBot and the Box runtime share a filesystem view.

        This is True only when Box runs as a local stdio child process of
-        LangBot (same container/host). In that case paths the Box runtime
-        reports — notably skill ``package_root`` — resolve identically on the
-        LangBot side, so LangBot may validate them against its own filesystem.
+        LangBot (same container/host). In that case host paths resolve
+        identically on both sides and Core may perform local filesystem work.

        It is False for every separated deployment (Docker Compose, k8s
        sidecar, ``--standalone-box``, or an explicit ``runtime.endpoint``),
-        where the Box runtime owns its own filesystem and LangBot must trust
-        the paths it reports rather than checking them locally.
+        where only explicitly shared and identically mounted roots can cross
+        the process boundary.

        When Box is wired up with an injected client (tests, custom embeds)
-        there is no connector to introspect; we conservatively report False so
-        LangBot never wrongly drops Box-reported skills. An explicit override
-        can be set via ``_shares_filesystem_with_box`` (used by tests and any
+        there is no connector to introspect; we conservatively report False.
+        An explicit override can be set via ``_shares_filesystem_with_box`` (used by tests and any
        embedder that knows the real topology).
        """
        if self._shares_filesystem_with_box_override is not None:
@@ -455,7 +451,9 @@ class BoxService:

    async def _require_validated_workspace_sandbox(self, execution_context: ExecutionContext) -> None:
        if not self._available:
-            raise BoxError('Box runtime is not available. Install and start Docker to use sandbox features.')
+            raise BoxError(
+                'Box runtime is not available. Configure an available Box backend before using Box features.'
+            )
        if self._cloud_managed:
            if self._admission is None:
                raise BoxAdmissionError('Cloud Box sandbox admission is unavailable')
@@ -481,11 +479,18 @@ class BoxService:
        self,
        context: TenantContext,
        spec_payload: dict,
+        *,
+        trusted_read_only_mounts: list[dict] | None = None,
    ) -> dict:
        """Reject tenant-owned policy fields and apply the Cloud hard policy."""

        payload = dict(spec_payload)
+        trusted_mounts = self._normalize_trusted_read_only_mounts(trusted_read_only_mounts or [])
        if not self._cloud_managed:
+            if trusted_mounts:
+                if payload.get('extra_mounts'):
+                    raise BoxValidationError('extra_mounts and trusted_read_only_mounts cannot both be supplied')
+                payload['extra_mounts'] = trusted_mounts
            return payload
        policy = self._admission_policy
        if policy is None:
@@ -535,7 +540,7 @@ class BoxService:
                'network': 'off',
                'host_path': canonical_host_path,
                'mount_path': '/workspace',
-                'extra_mounts': [],
+                'extra_mounts': trusted_mounts,
                'persistent': True,
                'timeout_sec': min(timeout, policy.max_timeout_sec),
                'cpus': policy.cpus,
@@ -547,6 +552,22 @@ class BoxService:
        )
        return payload

+    def _normalize_trusted_read_only_mounts(self, mounts: list[dict]) -> list[dict]:
+        """Validate Core-composed artifacts before crossing into Box."""
+
+        normalized: list[dict] = []
+        for raw_mount in mounts:
+            mount = BoxMountSpec.model_validate(raw_mount)
+            if mount.mode != BoxHostMountMode.READ_ONLY:
+                raise BoxAdmissionError('Core-composed additional mounts must be read-only')
+            host_path = os.path.realpath(mount.host_path)
+            if not os.path.isdir(host_path):
+                raise BoxAdmissionError('Core-composed read-only mount source is unavailable')
+            if not any(_is_path_under(host_path, root) for root in self.allowed_mount_roots):
+                raise BoxAdmissionError('Core-composed read-only mount source is outside allowed_mount_roots')
+            normalized.append(mount.model_copy(update={'host_path': host_path}).model_dump(mode='json'))
+        return normalized
+
    def _reject_cloud_managed_process(self) -> None:
        if self._cloud_managed:
            raise BoxAdmissionError('Managed processes are disabled for Cloud sandboxes')
@@ -563,11 +584,18 @@ class BoxService:
        query: pipeline_query.Query,
        *,
        skip_host_mount_validation: bool = False,
+        trusted_read_only_mounts: list[dict] | None = None,
    ) -> dict:
        if not self._available:
-            raise BoxError('Box runtime is not available. Install and start Docker to use sandbox features.')
+            raise BoxError(
+                'Box runtime is not available. Configure an available Box backend before using Box features.'
+            )
        execution_context = await self._validated_execution_context(self._query_execution_context(query))
-        spec_payload = self._managed_policy_payload(execution_context, spec_payload)
+        spec_payload = self._managed_policy_payload(
+            execution_context,
+            spec_payload,
+            trusted_read_only_mounts=trusted_read_only_mounts,
+        )
        await self._require_validated_workspace_sandbox(execution_context)
        if spec_payload.get('host_path') in (None, ''):
            tenant_workspace = self._tenant_workspace(execution_context)
@@ -654,70 +682,12 @@ class BoxService:
        variables.setdefault('global', 'global')
        return template.format_map(collections.defaultdict(lambda: 'unknown', variables))

-    def build_skill_extra_mounts(self, query: pipeline_query.Query) -> list[dict]:
-        """Build extra_mounts entries for all pipeline-bound skills.
-
-        This ensures that when a container is first created it already has
-        all skill packages mounted, regardless of which skill is currently
-        activated.
-
-        Path validation is filesystem-topology dependent. When LangBot and the
-        Box runtime share a filesystem (local stdio mode), a skill whose
-        ``package_root`` is missing or no longer a directory is skipped with a
-        warning instead of being passed through to the backend. Without that
-        guard the three backends behave inconsistently on a stale mount: nsjail
-        refuses to start the sandbox (failing every exec in the session),
-        Docker silently auto-creates a root-owned empty directory on the host,
-        and E2B silently skips the upload — none of which surfaces an
-        actionable error.
-
-        When Box runs as a separate process (Docker Compose, k8s sidecar,
-        ``--standalone-box``, or a remote ``runtime.endpoint``), the
-        ``package_root`` reported by ``list_skills`` is the Box runtime's own
-        filesystem path and is NOT resolvable on the LangBot side. Validating
-        it locally would wrongly drop every skill, so LangBot trusts the path
-        and lets the Box runtime resolve it. The Box runtime only ever reports
-        skills it discovered on its own filesystem, so the path is valid there
-        by construction.
-        """
-        if self._cloud_managed:
-            return []
-        skill_mgr = getattr(self.ap, 'skill_mgr', None)
-        if skill_mgr is None:
-            return []
-
-        from ..provider.tools.loaders import skill as skill_loader
-
-        validate_locally = self.shares_filesystem_with_box
-
-        visible_skills = skill_loader.get_visible_skills(self.ap, query)
-        mounts: list[dict] = []
-        for skill_name, skill_data in visible_skills.items():
-            package_root = str(skill_data.get('package_root', '') or '').strip()
-            if not package_root:
-                continue
-            if validate_locally and not os.path.isdir(package_root):
-                self.ap.logger.warning(
-                    f'Skill "{skill_name}" package_root missing on filesystem '
-                    f'({package_root}); skipping mount to prevent sandbox failures. '
-                    f'The skill cache may be stale — consider reloading skills.'
-                )
-                continue
-            mounts.append(
-                {
-                    'host_path': package_root,
-                    'mount_path': f'/workspace/.skills/{skill_name}',
-                    'mode': 'rw',
-                }
-            )
-        return mounts
-
    async def execute_tool(
        self,
        parameters: dict,
        query: pipeline_query.Query,
        *,
-        skill_name: str | None = None,
+        read_only_mounts: list[dict] | None = None,
    ) -> dict:
        """Execute an agent-facing ``exec`` tool call.

@@ -725,8 +695,6 @@ class BoxService:
        ``BoxSpec.cmd`` field and injects the session id from the query.
        """
        spec_payload: dict = {'cmd': parameters['command']}
-        if skill_name is not None:
-            spec_payload['skill_name'] = skill_name

        # Pass through allowed agent-facing fields
        for key in ('workdir', 'timeout_sec', 'env'):
@@ -736,11 +704,11 @@ class BoxService:
        # Inject context the agent must not control
        spec_payload.setdefault('session_id', self.resolve_box_session_id(query))

-        # Mount all pipeline-bound skills so they are available in the container
-        if 'extra_mounts' not in spec_payload:
-            spec_payload['extra_mounts'] = self.build_skill_extra_mounts(query)
-
-        return await self.execute_spec_payload(spec_payload, query)
+        return await self.execute_spec_payload(
+            spec_payload,
+            query,
+            trusted_read_only_mounts=read_only_mounts,
+        )

    async def execute_in_context(
        self,
@@ -1210,8 +1178,9 @@ class BoxService:
    async def _read_outbox_via_exec(self, query: pipeline_query.Query) -> list[dict]:
        """Fallback: read the outbox over the exec channel (E2B / remote).

-        Note: exec stdout is truncated by ``output_limit_chars``, so this path
-        only reliably transfers small files. The host path is preferred.
+        Uses ``client.execute`` directly (bypassing ``_serialize_result``)
+        so stdout is NOT truncated by ``output_limit_chars`` - the raw
+        base64 payload can be far larger than the 4000-char display limit.
        """
        import json as _json

@@ -1265,14 +1234,20 @@ class BoxService:
            '                break\n'
            'print(json.dumps(out))\n'
        )
-        result = await self.execute_tool(
-            {'command': f"python3 - <<'LBPY'\n{script}\nLBPY", 'timeout_sec': 120},
-            query,
-        )
-        if not result.get('ok'):
+        spec_payload: dict = {
+            'cmd': f"python3 - <<'LBPY'\n{script}\nLBPY",
+            'timeout_sec': 120,
+            'session_id': self.resolve_box_session_id(query),
+        }
+        try:
+            spec = self.build_spec(spec_payload)
+            result = await self.client.execute(spec)
+        except Exception:
+            return []
+        if not result.ok:
            return []
        try:
-            return _json.loads(str(result.get('stdout') or '').strip().splitlines()[-1])
+            return _json.loads(str(result.stdout or '').strip().splitlines()[-1])
        except Exception:
            return []

@@ -1514,126 +1489,6 @@ class BoxService:
            self._runtime_connector.get_relay_headers(action_context),
        )

-    async def list_skills(self, context: TenantContext) -> list[dict]:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.list_skills(action_context=self._action_context(execution_context))
-
-    async def get_skill(self, context: TenantContext, name: str) -> dict | None:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.get_skill(name, action_context=self._action_context(execution_context))
-
-    async def create_skill(self, context: TenantContext, skill: dict) -> dict:
-        execution_context = await self._validated_skill_execution_context(context)
-        payload = dict(skill)
-        payload.pop('workspace_uuid', None)
-        if self._cloud_managed and str(payload.get('package_root', '') or '').strip():
-            raise BoxAdmissionError('Cloud skill package_root is runtime-owned')
-        if self._cloud_managed:
-            payload.pop('package_root', None)
-        return await self.client.create_skill(payload, action_context=self._action_context(execution_context))
-
-    async def update_skill(self, context: TenantContext, name: str, skill: dict) -> dict:
-        execution_context = await self._validated_skill_execution_context(context)
-        payload = dict(skill)
-        payload.pop('workspace_uuid', None)
-        if self._cloud_managed:
-            # The runtime already owns the package path for an existing skill.
-            # A serialized read response may contain it, but it is never an
-            # authority-bearing update field in shared Cloud mode.
-            payload.pop('package_root', None)
-        return await self.client.update_skill(
-            name,
-            payload,
-            action_context=self._action_context(execution_context),
-        )
-
-    async def delete_skill(self, context: TenantContext, name: str) -> None:
-        execution_context = await self._validated_skill_execution_context(context)
-        await self.client.delete_skill(name, action_context=self._action_context(execution_context))
-
-    async def scan_skill_directory(self, context: TenantContext, path: str) -> dict:
-        execution_context = await self._validated_skill_execution_context(context)
-        if self._cloud_managed:
-            raise BoxAdmissionError('Scanning arbitrary host skill directories is disabled in Cloud')
-        return await self.client.scan_skill_directory(path, action_context=self._action_context(execution_context))
-
-    async def _validated_skill_execution_context(self, context: TenantContext) -> ExecutionContext:
-        execution_context = await self._validated_execution_context(context)
-        await self._require_validated_workspace_sandbox(execution_context)
-        return execution_context
-
-    async def list_skill_files(
-        self,
-        context: TenantContext,
-        name: str,
-        path: str = '.',
-        include_hidden: bool = False,
-        max_entries: int = 200,
-    ) -> dict:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.list_skill_files(
-            name,
-            path,
-            include_hidden,
-            max_entries,
-            action_context=self._action_context(execution_context),
-        )
-
-    async def read_skill_file(self, context: TenantContext, name: str, path: str) -> dict:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.read_skill_file(
-            name,
-            path,
-            action_context=self._action_context(execution_context),
-        )
-
-    async def write_skill_file(self, context: TenantContext, name: str, path: str, content: str) -> dict:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.write_skill_file(
-            name,
-            path,
-            content,
-            action_context=self._action_context(execution_context),
-        )
-
-    async def preview_skill_zip(
-        self,
-        context: TenantContext,
-        file_bytes: bytes,
-        filename: str,
-        source_subdir: str = '',
-        target_suffix: str = 'upload',
-    ) -> list[dict]:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.preview_skill_zip(
-            file_bytes,
-            filename,
-            source_subdir,
-            target_suffix,
-            action_context=self._action_context(execution_context),
-        )
-
-    async def install_skill_zip(
-        self,
-        context: TenantContext,
-        file_bytes: bytes,
-        filename: str,
-        source_paths: list[str] | None = None,
-        source_path: str = '',
-        source_subdir: str = '',
-        target_suffix: str = 'upload',
-    ) -> list[dict]:
-        execution_context = await self._validated_skill_execution_context(context)
-        return await self.client.install_skill_zip(
-            file_bytes,
-            filename,
-            source_paths,
-            source_path,
-            source_subdir,
-            target_suffix,
-            action_context=self._action_context(execution_context),
-        )
-
    def _serialize_result(self, result: BoxExecutionResult) -> dict:
        stdout, stdout_truncated = self._truncate(result.stdout)
        stderr, stderr_truncated = self._truncate(result.stderr)
@@ -1770,14 +1625,6 @@ class BoxService:
            default_workspace = os.path.join(self.host_root, default_workspace)
        return os.path.realpath(os.path.abspath(default_workspace))

-    def get_skills_root(self) -> str | None:
-        skills_root = str(self._local_config().get('skills_root', '') or 'skills').strip()
-        if not skills_root:
-            skills_root = 'skills'
-        if not os.path.isabs(skills_root) and self.host_root is not None:
-            skills_root = os.path.join(self.host_root, skills_root)
-        return os.path.realpath(os.path.abspath(skills_root))
-
    def _load_enabled(self) -> bool:
        """Read ``box.enabled`` (top-level, not ``box.local.*``). Default True
        — disabling is opt-in. Accepts bool, ``'true'``/``'false'`` strings,
@@ -2133,5 +1980,8 @@ class BoxService:
            if backend_name:
                payload['connector_error'] = f'Configured sandbox backend "{backend_name}" is unavailable'
            else:
-                payload['connector_error'] = 'No supported sandbox backend (Docker / nsjail / E2B) is available'
+                payload['connector_error'] = (
+                    'No supported sandbox backend (Docker / nsjail / E2B) is available. '
+                    'Trusted local development may explicitly select the unsafe host backend.'
+                )
        return payload
@@ -1,43 +1,28 @@
 """Reusable workspace/session helpers built on top of Box.

-This module is the middle layer between the raw Box runtime primitives and
-application-specific flows such as skills or MCP stdio.
+This module is the middle layer between raw Box runtime primitives and
+application-specific consumers.

 It intentionally stays generic:
 - path and virtualenv rewriting are workspace concerns
 - Python project detection/bootstrap are workspace concerns
 - session exec / managed-process helpers are workspace concerns

-Higher layers add their own semantics on top, for example:
- skills choose a stable per-skill session id and use repeated exec
- MCP stdio chooses how to prepare dependencies and attaches to a managed process
+Higher layers add their own semantics on top; BoxWorkspaceSession retains only
+workspace, execution, and managed-process concepts.
 """

 from __future__ import annotations

 import os
-import textwrap
 from typing import Any

-PYTHON_MANIFEST_FILES = (
-    'requirements.txt',
-    'pyproject.toml',
-    'setup.py',
-    'setup.cfg',
-)
+from ..utils.python_workspace import list_python_manifest_files
+
 _VENV_DIRS = frozenset({'.venv', 'venv', 'env', '.env'})
 _VENV_BIN_DIRS = frozenset({'bin', 'Scripts'})


-def normalize_host_path(path: str | None) -> str:
-    if path is None:
-        return ''
-    stripped = str(path).strip()
-    if not stripped:
-        return ''
-    return os.path.realpath(os.path.abspath(stripped))
-
-
 def rewrite_mounted_path(path: str, host_path: str | None, *, mount_path: str = '/workspace') -> str:
    """Translate a host path into the path visible inside the sandbox mount."""
    if not host_path or not path:
@@ -98,13 +83,6 @@ def rewrite_venv_command(command: str, host_path: str | None, *, mount_path: str
    return rewrite_mounted_path(normalized_command, host_path, mount_path=mount_path)


-def list_python_manifest_files(host_path: str | None) -> list[str]:
-    normalized_root = normalize_host_path(host_path)
-    if not normalized_root:
-        return []
-    return [filename for filename in PYTHON_MANIFEST_FILES if os.path.isfile(os.path.join(normalized_root, filename))]
-
-
 def classify_python_workspace(host_path: str | None) -> str | None:
    """Return the generic Python workspace shape, without app-specific policy."""
    manifest_files = set(list_python_manifest_files(host_path))
@@ -117,163 +95,6 @@ def classify_python_workspace(host_path: str | None) -> str | None:
    return None


-def should_prepare_python_env(host_path: str | None) -> bool:
-    normalized_root = normalize_host_path(host_path)
-    if not normalized_root:
-        return False
-    if os.path.isdir(os.path.join(normalized_root, '.venv')):
-        return True
-    return bool(list_python_manifest_files(normalized_root))
-
-
-def wrap_python_command_with_env(
-    command: str,
-    *,
-    mount_path: str = '/workspace',
-    state_path: str | None = None,
-) -> str:
-    """Wrap a command with a reusable sandbox-local Python env bootstrap.
-
-    ``mount_path`` is always the source tree used for manifest hashing and
-    installation. ``state_path`` may point at a separate writable directory
-    for read-only source mounts; when omitted, legacy mutable-workspace behavior
-    stores the environment beside the source.
-    """
-    writable_state_path = state_path or mount_path
-    bootstrap = textwrap.dedent(
-        f"""
-        set -e
-
-        _LB_VENV_DIR="{writable_state_path}/.venv"
-        _LB_META_DIR="{writable_state_path}/.langbot"
-        _LB_META_FILE="$_LB_META_DIR/python-env.json"
-        _LB_LOCK_DIR="$_LB_META_DIR/python-env.lock"
-        _LB_TMP_DIR="{writable_state_path}/.tmp"
-        _LB_PIP_CACHE_DIR="{writable_state_path}/.cache/pip"
-
-        mkdir -p "$_LB_META_DIR" "$_LB_TMP_DIR" "$_LB_PIP_CACHE_DIR"
-        _LB_SYSTEM_PYTHON="$(command -v python3 || command -v python || true)"
-        if [ -z "$_LB_SYSTEM_PYTHON" ]; then
-          echo "python3 or python is required to prepare the workspace Python environment" >&2
-          exit 127
-        fi
-
-        export TMPDIR="$_LB_TMP_DIR"
-        export TEMP="$_LB_TMP_DIR"
-        export TMP="$_LB_TMP_DIR"
-        export PIP_CACHE_DIR="$_LB_PIP_CACHE_DIR"
-
-        _lb_python_meta() {{
-          "$_LB_SYSTEM_PYTHON" - <<'PY'
-        import hashlib
-        import json
-        import os
-        import sys
-
-        root = "{mount_path}"
-        max_manifest_bytes = 10 * 1024 * 1024
-        digest = hashlib.sha256()
-        manifest_files = []
-        for rel in ("requirements.txt", "pyproject.toml", "setup.py", "setup.cfg"):
-            path = os.path.join(root, rel)
-            if not os.path.isfile(path):
-                continue
-            if os.path.getsize(path) > max_manifest_bytes:
-                raise RuntimeError(
-                    f"Python project manifest exceeds {{max_manifest_bytes}} bytes: {{rel}}"
-                )
-            manifest_files.append(rel)
-            with open(path, "rb") as handle:
-                digest.update(rel.encode("utf-8"))
-                digest.update(b"\\0")
-                while chunk := handle.read(1024 * 1024):
-                    digest.update(chunk)
-                digest.update(b"\\0")
-
-        print(
-            json.dumps(
-                {{
-                    "python_executable": sys.executable,
-                    "python_version": list(sys.version_info[:3]),
-                    "manifest_files": manifest_files,
-                    "manifest_sha256": digest.hexdigest(),
-                }},
-                sort_keys=True,
-            )
-        )
-        PY
-        }}
-
-        _LB_CURRENT_META="$(_lb_python_meta)"
-        _LB_NEEDS_BOOTSTRAP=0
-
-        if [ ! -x "$_LB_VENV_DIR/bin/python" ]; then
-          _LB_NEEDS_BOOTSTRAP=1
-        elif [ ! -f "$_LB_META_FILE" ]; then
-          _LB_NEEDS_BOOTSTRAP=1
-        elif [ "$(cat "$_LB_META_FILE")" != "$_LB_CURRENT_META" ]; then
-          _LB_NEEDS_BOOTSTRAP=1
-        fi
-
-        if [ "$_LB_NEEDS_BOOTSTRAP" -eq 1 ]; then
-          _LB_LOCK_WAIT=0
-          while ! mkdir "$_LB_LOCK_DIR" 2>/dev/null; do
-            if [ "$_LB_LOCK_WAIT" -ge 120 ]; then
-              _LB_LOCK_OWNER="$(cat "$_LB_LOCK_DIR/pid" 2>/dev/null || true)"
-              if [ -n "$_LB_LOCK_OWNER" ] && kill -0 "$_LB_LOCK_OWNER" 2>/dev/null; then
-                echo "Timed out waiting for active Python environment lock: $_LB_LOCK_DIR" >&2
-                exit 1
-              fi
-              echo "Timed out waiting for Python environment lock, clearing stale lock: $_LB_LOCK_DIR" >&2
-              rm -rf "$_LB_LOCK_DIR" 2>/dev/null || true
-              if mkdir "$_LB_LOCK_DIR" 2>/dev/null; then
-                break
-              fi
-              echo "Timed out waiting for Python environment lock: $_LB_LOCK_DIR" >&2
-              exit 1
-            fi
-            sleep 1
-            _LB_LOCK_WAIT=$((_LB_LOCK_WAIT + 1))
-          done
-          printf '%s\\n' "$$" > "$_LB_LOCK_DIR/pid" 2>/dev/null || true
-
-          _lb_cleanup_lock() {{
-            rm -rf "$_LB_LOCK_DIR" >/dev/null 2>&1 || true
-          }}
-          trap _lb_cleanup_lock EXIT INT TERM
-
-          _LB_CURRENT_META="$(_lb_python_meta)"
-          _LB_NEEDS_BOOTSTRAP=0
-          if [ ! -x "$_LB_VENV_DIR/bin/python" ]; then
-            _LB_NEEDS_BOOTSTRAP=1
-          elif [ ! -f "$_LB_META_FILE" ]; then
-            _LB_NEEDS_BOOTSTRAP=1
-          elif [ "$(cat "$_LB_META_FILE")" != "$_LB_CURRENT_META" ]; then
-            _LB_NEEDS_BOOTSTRAP=1
-          fi
-
-          if [ "$_LB_NEEDS_BOOTSTRAP" -eq 1 ]; then
-            rm -rf "$_LB_VENV_DIR"
-            "$_LB_SYSTEM_PYTHON" -m venv "$_LB_VENV_DIR"
-            . "$_LB_VENV_DIR/bin/activate"
-            python -m pip install --upgrade pip setuptools wheel
-            if [ -f "{mount_path}/requirements.txt" ]; then
-              python -m pip install -r "{mount_path}/requirements.txt"
-            elif [ -f "{mount_path}/pyproject.toml" ] || [ -f "{mount_path}/setup.py" ] || [ -f "{mount_path}/setup.cfg" ]; then
-              python -m pip install "{mount_path}"
-            fi
-            printf '%s' "$_LB_CURRENT_META" > "$_LB_META_FILE"
-          fi
-        fi
-
-        export VIRTUAL_ENV="$_LB_VENV_DIR"
-        export PATH="$_LB_VENV_DIR/bin:$PATH"
-        {command}
-        """
-    ).strip()
-    return bootstrap + '\n'
-
-
 class BoxWorkspaceSession:
    """High-level handle for one reusable workspace-backed Box session.

@@ -125,10 +125,21 @@ class DirectoryProjectionService:
        # The database cursor remains the shared projection high-water mark,
        # while this cursor tracks what this process has actually observed.
        self._consumer_cursor: int | None = None
+        self._sync_lock = asyncio.Lock()

    async def initialize(self) -> None:
        """Block Cloud startup until one full signed snapshot is committed."""

+        async with self._sync_lock:
+            await self._refresh_snapshot()
+
+    async def refresh_snapshot(self) -> None:
+        """Refresh from one full signed snapshot within the sync single-flight."""
+
+        async with self._sync_lock:
+            await self._refresh_snapshot()
+
+    async def _refresh_snapshot(self) -> None:
        last_superseded: _DirectorySnapshotSuperseded | None = None
        for _attempt in range(5):
            snapshot = await self.provider.fetch_snapshot(self.instance_uuid)
@@ -159,9 +170,84 @@ class DirectoryProjectionService:
                delay = min(max(delay * 2, self.sync_interval_seconds), self.max_staleness_seconds / 2)

    async def sync_once(self) -> None:
+        async with self._sync_lock:
+            await self._sync_once()
+
+    async def reconcile_workspaces(self, workspace_uuids: Iterable[str]) -> None:
+        """Synchronously project an exact Workspace set without moving the event cursor."""
+
+        requested = tuple(sorted({str(value).strip() for value in workspace_uuids if str(value).strip()}))
+        if not requested:
+            raise DirectoryProjectionUnavailableError('Targeted directory reconciliation requires a Workspace')
+        if len(requested) > self.event_limit:
+            raise DirectoryProjectionUnavailableError('Targeted directory reconciliation exceeds the batch limit')
+        async with self._sync_lock:
+            delta = await self.provider.fetch_workspaces(self.instance_uuid, requested)
+            await self._apply_targeted_delta(delta, requested)
+
+    async def _apply_targeted_delta(
+        self,
+        delta: DirectoryDelta,
+        requested_workspace_uuids: tuple[str, ...],
+    ) -> None:
+        if not isinstance(delta, DirectoryDelta):
+            raise DirectoryProjectionUnavailableError('Directory provider returned an invalid delta')
+        workspace_count, membership_count = self._validate_batch_capacity(
+            delta.workspaces,
+            full_snapshot=False,
+        )
+        delta = DirectoryDelta.model_validate(delta.model_dump())
+        if delta.instance_uuid != self.instance_uuid:
+            raise DirectoryProjectionUnavailableError('Directory delta targets another LangBot instance')
+        requested = set(requested_workspace_uuids)
+        if set(delta.requested_workspace_uuids) != requested:
+            raise DirectoryProjectionUnavailableError('Directory delta does not match the requested Workspaces')
+        if {workspace.uuid for workspace in delta.workspaces} != requested:
+            raise DirectoryProjectionUnavailableError('Directory delta omitted a requested Workspace')
+
+        directory_uow = getattr(self.ap.persistence_mgr, 'directory_projection_uow', None)
+        if not callable(directory_uow):
+            raise DirectoryProjectionUnavailableError('Directory projection persistence scope is unavailable')
+
+        async with directory_uow(self.instance_uuid) as uow:
+            session = uow.session
+            state = await session.scalar(
+                sqlalchemy.select(DirectoryProjectionState)
+                .where(DirectoryProjectionState.instance_uuid == self.instance_uuid)
+                .with_for_update()
+            )
+            if state is None:
+                raise DirectoryProjectionUnavailableError('Directory projection is not initialized')
+            snapshot = DirectorySnapshot(
+                instance_uuid=self.instance_uuid,
+                cursor=state.cursor,
+                generated_at=delta.generated_at,
+                workspaces=delta.workspaces,
+            )
+            accounts_by_uuid = await self._apply_accounts(session, snapshot, preserve_existing=True)
+            await self._apply_workspaces(session, snapshot, accounts_by_uuid=accounts_by_uuid)
+            active_workspace_count = await self._enforce_active_workspace_capacity(session)
+            await session.flush()
+
+        await self._update_entitlement_workspace_activity(
+            snapshot.workspaces,
+            requested_workspace_uuids=requested,
+        )
+        self._publish_runtime_execution_projection(
+            snapshot.workspaces,
+            affected_workspace_uuids=requested,
+        )
+        self._request_model_catalog_sync()
+        self._record_batch_cardinality(
+            active_workspaces=active_workspace_count,
+            workspaces=workspace_count,
+            memberships=membership_count,
+        )
+
+    async def _sync_once(self) -> None:
        cursor = self._consumer_cursor
        if cursor is None:
-            await self.initialize()
+            await self._refresh_snapshot()
            return
        batch = await self.provider.fetch_events(
            self.instance_uuid,
@@ -708,7 +794,13 @@ class DirectoryProjectionService:
        for row in inbox_rows:
            row.applied_at = now

-    async def _apply_accounts(self, session: Any, snapshot: DirectorySnapshot) -> dict[str, User]:
+    async def _apply_accounts(
+        self,
+        session: Any,
+        snapshot: DirectorySnapshot,
+        *,
+        preserve_existing: bool = False,
+    ) -> dict[str, User]:
        selected: dict[str, DirectoryMember] = {}
        emails: dict[str, str] = {}
        for workspace in snapshot.workspaces:
@@ -773,6 +865,12 @@ class DirectoryProjectionService:
                continue
            if account.source != AccountSource.CLOUD_PROJECTION.value:
                raise DirectoryProjectionUnavailableError('Directory account UUID collides with a local Core account')
+            if preserve_existing:
+                # A targeted Workspace fetch has no independently monotonic
+                # Account revision. It may create a missing runtime shadow, but
+                # ordered event/snapshot projection remains the only updater of
+                # existing Account identity and status fields.
+                continue
            if account.projection_revision > snapshot.cursor:
                raise DirectoryProjectionUnavailableError('Directory account revision rolled back')
            projected_account = self._account_projection(member)
@@ -3,6 +3,7 @@ from __future__ import annotations
 import typing
 import inspect

+from ..api.http.context import ExecutionContext
 from ..core import app
 from . import operator
 from ..utils import importutil
@@ -66,7 +67,14 @@ class CommandManager:

        require_context = getattr(self.ap.plugin_connector, 'require_workspace_context', None)
        if require_context is not None:
-            result = require_context(context)
+            result = require_context(
+                ExecutionContext(
+                    instance_uuid=context.instance_uuid,
+                    workspace_uuid=context.workspace_uuid,
+                    placement_generation=context.placement_generation,
+                    query_uuid=context.query_uuid,
+                )
+            )
            if inspect.isawaitable(result):
                await result

@@ -43,6 +43,7 @@ from . import entities as core_entities
 from ..rag.knowledge import kbmgr as rag_mgr
 from ..rag.service import RAGRuntimeService
 from ..vector import mgr as vectordb_mgr
+from ..skill import repository as skill_repository
 from ..telemetry import telemetry as telemetry_module
 from ..survey import manager as survey_module
 from ..skill import manager as skill_mgr
@@ -84,6 +85,7 @@ class Application:
    # TODO move to pipeline
    tool_mgr: llm_tool_mgr.ToolManager = None
    box_service: box_service_module.BoxService = None
+    skill_repository: skill_repository.SkillRepository = None

    # ======= Config manager =======

@@ -249,6 +251,10 @@ class Application:
                    {},
                )
            ),
+            'plugin_runtime_connected': bool(
+                self.plugin_connector is not None
+                and getattr(self.plugin_connector, '_runtime_available', lambda: False)()
+            ),
        }
        mcp_loader = getattr(self.tool_mgr, 'mcp_tool_loader', None)
        runtime_stats.update(
@@ -297,11 +303,36 @@ class Application:
    async def initialize(self):
        pass

+    async def _initialize_plugin_runtime(self) -> None:
+        try:
+            await self.plugin_connector.initialize()
+        except asyncio.CancelledError:
+            raise
+        except Exception as exc:
+            self.logger.warning(f'Plugin runtime unavailable during startup; reconnecting in background: {exc}')
+            self.plugin_connector.schedule_reconnect()
+
+    def _start_plugin_runtime_initialization(self) -> asyncio.Task | None:
+        task = getattr(self, '_plugin_runtime_initialization_task', None)
+        if task is not None and not task.done():
+            return task
+        # This is application lifecycle work, not a request side effect. It must
+        # not wait on PersistenceManager's after-commit gate at boot.
+        task = asyncio.create_task(
+            self._initialize_plugin_runtime(),
+            name='plugin-runtime-initialization',
+        )
+        self._plugin_runtime_initialization_task = task
+        return task
+
    async def run(self):
        self.event_loop_monitor.start()
        try:
-            if self.directory_projection_service is not None:
-                self.task_mgr.create_task(
+            if (
+                self.directory_projection_service is not None
+                and getattr(self, 'directory_projection_task', None) is None
+            ):
+                self.directory_projection_task = self.task_mgr.create_task(
                    self.directory_projection_service.run(),
                    name='cloud-directory-projection',
                    scopes=[core_entities.LifecycleControlScope.APPLICATION],
@@ -318,7 +349,6 @@ class Application:
                    name='cloud-manifest-refresh',
                    scopes=[core_entities.LifecycleControlScope.APPLICATION],
                )
-            await self.plugin_connector.initialize_plugins()

            # 后续可能会允许动态重启其他任务
            # 故为了防止程序在非 Ctrl-C 情况下退出，这里创建一个不会结束的协程
@@ -344,6 +374,7 @@ class Application:
                name='http-api-controller',
                scopes=[core_entities.LifecycleControlScope.APPLICATION],
            )
+            self._start_plugin_runtime_initialization()

            # Telemetry instance heartbeat (startup + daily); respects
            # space.disable_telemetry via TelemetryManager.send().
@@ -525,6 +556,11 @@ class Application:

            if self.task_mgr is not None:
                self.task_mgr.cancel_by_scope(core_entities.LifecycleControlScope.APPLICATION)
+            plugin_runtime_task = getattr(self, '_plugin_runtime_initialization_task', None)
+            if plugin_runtime_task is not None and not plugin_runtime_task.done():
+                plugin_runtime_task.cancel()
+                with contextlib.suppress(asyncio.CancelledError):
+                    await plugin_runtime_task
            with contextlib.suppress(Exception):
                await self.event_loop_monitor.stop()
            mcp_mount = getattr(self.http_ctrl, 'mcp_mount', None)
@@ -601,9 +637,9 @@ class Application:
        frontend_path = paths.get_frontend_path()

        if not os.path.exists(frontend_path):
-            self.logger.warning('WebUI 文件缺失，请根据文档部署：https://docs.langbot.app/zh')
+            self.logger.warning('WebUI 文件缺失，请根据文档部署：https://langbot.app/docs/zh')
            self.logger.warning(
-                'WebUI files are missing, please deploy according to the documentation: https://docs.langbot.app/en'
+                'WebUI files are missing, please deploy according to the documentation: https://langbot.app/docs/en'
            )
            return

@@ -1,6 +1,6 @@
 from __future__ import annotations

-from .. import stage, app
+from .. import stage, app, entities as core_entities
 from ...utils import version, proxy, constants
 from ...pipeline import pool, controller, pipelinemgr
 from ...pipeline import aggregator as message_aggregator
@@ -26,6 +26,7 @@ from ...api.http.service import knowledge as knowledge_service
 from ...api.http.service import mcp as mcp_service
 from ...api.http.service import apikey as apikey_service
 from ...api.http.service import webhook as webhook_service
+from ...skill import repository as skill_repository
 from ...api.http.service import monitoring as monitoring_service
 from ...api.http.service import skill as skill_service
 from ...skill import manager as skill_mgr
@@ -127,6 +128,7 @@ class BuildAppStage(stage.BootingStage):
        webhook_service_inst = webhook_service.WebhookService(ap)
        ap.webhook_service = webhook_service_inst

+        ap.skill_repository = skill_repository.SkillRepository(ap)
        skill_service_inst = skill_service.SkillService(ap)
        ap.skill_service = skill_service_inst

@@ -292,14 +294,17 @@ class BuildAppStage(stage.BootingStage):
        async def runtime_disconnect_callback(connector: plugin_connector.PluginRuntimeConnector) -> None:
            connector.schedule_reconnect()

+        if ap.directory_projection_service is not None:
+            # Keep the projection fresh while shared Runtime cold restore runs.
+            # BuildApp initializes the connector before Application.run() starts
+            # its long-lived tasks, so start the single refresh task here.
+            ap.directory_projection_task = ap.task_mgr.create_task(
+                ap.directory_projection_service.run(),
+                name='cloud-directory-projection',
+                scopes=[core_entities.LifecycleControlScope.APPLICATION],
+            )
+
        plugin_connector_inst = plugin_connector.PluginRuntimeConnector(ap, runtime_disconnect_callback)
-        try:
-            await plugin_connector_inst.initialize()
-        except Exception as exc:
-            # Keep the API/UI available while an external or managed runtime is
-            # starting, then recover in the background with bounded backoff.
-            ap.logger.warning(f'Plugin runtime unavailable during startup; reconnecting in background: {exc}')
-            plugin_connector_inst.schedule_reconnect()
        ap.plugin_connector = plugin_connector_inst
        workspace_service_inst.release_startup_execution_bindings()

@@ -47,3 +47,10 @@ class SpaceModel(pydantic.BaseModel):
    status: str
    created_at: str | None = None
    updated_at: str | None = None
+
+
+class SpaceModelSelection(pydantic.BaseModel):
+    """Minimal model identity returned by the ranked selection endpoint."""
+
+    uuid: str
+    model_id: str
@@ -17,4 +17,4 @@ class SpaceAccountBindingRequiredError(AccountEmailMismatchError):
    code = 'space_account_binding_required'

    def __str__(self) -> str:
-        return 'This local Account must bind Space from Account settings before Space login'
+        return 'This local account must bind a LangBot Account from Account settings before LangBot Account login'
@@ -177,7 +177,6 @@ class PersistenceManager:
            await self._validate_cloud_runtime()
            return

-        self._enable_sqlite_foreign_keys()
        if self.mode == PersistenceMode.RELEASE_MIGRATION:
            async with self._release_migration_lock():
                await self._initialize_managed_schema()
@@ -185,6 +184,7 @@ class PersistenceManager:
            return

        await self._initialize_managed_schema()
+        await self._enable_sqlite_foreign_keys_after_migration()

        if self.mode == PersistenceMode.OSS_COMPAT:
            await self.write_space_model_providers()
@@ -373,6 +373,17 @@ class PersistenceManager:
        sqlalchemy.event.listen(self.get_db_engine().sync_engine, 'begin', set_oss_tenant_scope)
        self._oss_tenant_scope_listener_installed = True

+    async def _enable_sqlite_foreign_keys_after_migration(self) -> None:
+        """Enable SQLite FK enforcement only after table-rebuilding migrations."""
+        engine = self.get_db_engine()
+        if engine.dialect.name != 'sqlite':
+            return
+        await engine.dispose()
+        self._enable_sqlite_foreign_keys()
+        # Dispose again so every runtime connection is opened through the new
+        # listener instead of reusing a pre-migration pooled connection.
+        await engine.dispose()
+
    def _enable_sqlite_foreign_keys(self) -> None:
        """Enable SQLite FK enforcement for every pooled runtime connection."""
        engine = self.get_db_engine()
@@ -3,6 +3,7 @@
 from __future__ import annotations

 import asyncio
+import contextlib
 import dataclasses
 import datetime
 import json
@@ -12,6 +13,7 @@ import re
 import secrets
 import sqlite3
 import tempfile
+import time
 import typing

 from sqlalchemy.ext.asyncio import AsyncEngine
@@ -81,7 +83,7 @@ def _verify_connection(connection: sqlite3.Connection, expected_revision: str) -


 def _verify_file(path: pathlib.Path, expected_revision: str) -> None:
-    with _open_read_only(path) as connection:
+    with contextlib.closing(_open_read_only(path)) as connection:
        _verify_connection(connection, expected_revision)


@@ -117,8 +119,23 @@ def _write_manifest(backup: SQLiteMigrationBackup, status: str, **extra: typing.
        temporary_path.unlink(missing_ok=True)


-def _fsync_file(path: pathlib.Path) -> None:
-    descriptor = os.open(path, os.O_RDONLY)
+def _fsync_file(path: pathlib.Path, *, reopen_attempts: int = 20) -> None:
+    """Sync a file, tolerating delayed visibility after replace on bind mounts.
+
+    Uses O_RDWR so os.fsync works on Windows (where _commit requires write
+    access to the file descriptor).
+    """
+
+    descriptor: int | None = None
+    for attempt in range(reopen_attempts):
+        try:
+            descriptor = os.open(path, os.O_RDWR)
+            break
+        except FileNotFoundError:
+            if attempt + 1 >= reopen_attempts:
+                raise
+            time.sleep(0.05)
+    assert descriptor is not None
    try:
        os.fsync(descriptor)
    finally:
@@ -126,13 +143,37 @@ def _fsync_file(path: pathlib.Path) -> None:


 def _fsync_directory(path: pathlib.Path) -> None:
-    descriptor = os.open(path, os.O_RDONLY)
+    if os.name == 'nt':
+        # Windows cannot fsync directory handles opened through os.open.
+        return
+    descriptor = os.open(path, os.O_RDONLY | getattr(os, 'O_DIRECTORY', 0))
    try:
        os.fsync(descriptor)
    finally:
        os.close(descriptor)


+def _remove_stale_temporary_files(
+    directory: pathlib.Path,
+    *,
+    prefix: str,
+    suffix: str,
+) -> None:
+    """Remove temporary files left by an interrupted backup or restore."""
+
+    for candidate in directory.iterdir():
+        if candidate.is_dir() or not candidate.name.startswith(prefix) or not candidate.name.endswith(suffix):
+            continue
+        try:
+            candidate.unlink()
+        except FileNotFoundError:
+            continue
+        except PermissionError:
+            # Another process may still own this file. Do not turn harmless
+            # cleanup into a migration failure; its unique name cannot collide.
+            continue
+
+
 def _create_backup(
    database_path: pathlib.Path,
    source_revision: str,
@@ -141,6 +182,11 @@ def _create_backup(
    backup_directory = database_path.parent / 'migration-backups'
    backup_directory.mkdir(mode=0o700, parents=True, exist_ok=True)
    os.chmod(backup_directory, 0o700)
+    _remove_stale_temporary_files(
+        backup_directory,
+        prefix=f'.{database_path.stem}-pre-',
+        suffix='.creating',
+    )
    created_at = datetime.datetime.now(datetime.UTC).strftime('%Y-%m-%dT%H-%M-%S.%fZ')
    stem = (
        f'{database_path.stem}-pre-{_safe_label(target_revision)}-'
@@ -157,11 +203,8 @@ def _create_backup(
    temporary_path = pathlib.Path(temporary_name)
    try:
        with (
-            _open_read_only(database_path) as source,
-            sqlite3.connect(
-                temporary_path,
-                timeout=30,
-            ) as destination,
+            contextlib.closing(_open_read_only(database_path)) as source,
+            contextlib.closing(sqlite3.connect(temporary_path, timeout=30)) as destination,
        ):
            source.execute('PRAGMA busy_timeout = 30000')
            source.backup(destination)
@@ -209,6 +252,11 @@ async def create_verified_backup(

 def _restore_backup(backup: SQLiteMigrationBackup) -> None:
    _verify_file(backup.backup_path, backup.source_revision)
+    _remove_stale_temporary_files(
+        backup.database_path.parent,
+        prefix=f'.{backup.database_path.name}.',
+        suffix='.restoring',
+    )
    descriptor, temporary_name = tempfile.mkstemp(
        prefix=f'.{backup.database_path.name}.',
        suffix='.restoring',
@@ -218,11 +266,8 @@ def _restore_backup(backup: SQLiteMigrationBackup) -> None:
    temporary_path = pathlib.Path(temporary_name)
    try:
        with (
-            _open_read_only(backup.backup_path) as source,
-            sqlite3.connect(
-                temporary_path,
-                timeout=30,
-            ) as destination,
+            contextlib.closing(_open_read_only(backup.backup_path)) as source,
+            contextlib.closing(sqlite3.connect(temporary_path, timeout=30)) as destination,
        ):
            source.backup(destination)
            destination.commit()
@@ -209,7 +209,7 @@ _ALLOWED_SCOPED_BUILTIN_FUNCTION_TYPES = {
    'now': sqlalchemy.sql.functions.now,
    'sum': sqlalchemy.sql.functions.sum,
 }
-_ALLOWED_SCOPED_GENERIC_FUNCTIONS = frozenset({'date_trunc', 'length', 'nullif'})
+_ALLOWED_SCOPED_GENERIC_FUNCTIONS = frozenset({'date_trunc', 'length', 'nullif', 'strftime'})
 _ALLOWED_SCOPED_CUSTOM_OPERATORS = frozenset({'<=>'})
 _ALLOWED_SCOPED_STATEMENT_TYPES = (
    sqlalchemy.sql.dml.UpdateBase,
@@ -5,6 +5,11 @@ from .. import entities
 import langbot_plugin.api.entities.builtin.pipeline.query as pipeline_query
 from ....utils.safe_regex import SafeRegexError, mask_patterns

+# Legacy sensitive-words.json files shipped ~70 rules, which exceeds the
+# default safe_regex per-call cap of 64 and used to fail-close every message.
+# Keep one 50ms CPU budget for the whole list; only raise the pattern cap.
+_MAX_SENSITIVE_WORD_PATTERNS = 256
+

@filter_model.filter_class('ban-word-filter')
 class BanWordFilter(filter_model.ContentFilter):
@@ -14,12 +19,17 @@ class BanWordFilter(filter_model.ContentFilter):
        pass

    async def process(self, query: pipeline_query.Query, message: str) -> entities.FilterResult:
+        words = self.ap.sensitive_meta.data.get('words') or []
+        mask = self.ap.sensitive_meta.data['mask']
+        mask_word = self.ap.sensitive_meta.data['mask_word']
+
        try:
-            found, message = await mask_patterns(
-                self.ap.sensitive_meta.data['words'],
+            found, current = await mask_patterns(
+                words,
                message,
-                mask=self.ap.sensitive_meta.data['mask'],
-                mask_word=self.ap.sensitive_meta.data['mask_word'],
+                mask=mask,
+                mask_word=mask_word,
+                max_pattern_count=_MAX_SENSITIVE_WORD_PATTERNS,
            )
        except SafeRegexError as exc:
            return entities.FilterResult(
@@ -31,7 +41,7 @@ class BanWordFilter(filter_model.ContentFilter):

        return entities.FilterResult(
            level=entities.ResultLevel.MASKED if found else entities.ResultLevel.PASS,
-            replacement=message,
+            replacement=current,
            user_notice='消息中存在不合适的内容, 请修改' if found else '',
            console_notice='',
        )
@@ -328,6 +328,8 @@ class PreProcessor(stage.PipelineStage):
        #      relied on this injection; without it the LLM never discovers
        #      the skills are there and just calls native tools instead.
        if selected_runner == 'local-agent' and self.ap.skill_mgr:
+            available_tool_names = {tool.name for tool in query.use_funcs}
+            query.variables['_skill_execution_available'] = 'exec' in available_tool_names
            skill_execution_context = get_query_execution_context(query)
            await self.ap.skill_mgr.ensure_loaded(skill_execution_context)
            pipeline_data = await self.ap.pipeline_service.get_pipeline(
@@ -349,7 +351,7 @@ class PreProcessor(stage.PipelineStage):
                skill_execution_context,
                bound_skills=bound_skills,
            )
-            if skill_addition:
+            if skill_addition and 'activate' in available_tool_names:
                self._append_to_system_prompt(query.prompt.messages, skill_addition)
                self.ap.logger.debug(
                    f'Skill index injected into system prompt: '
@@ -357,7 +359,7 @@ class PreProcessor(stage.PipelineStage):
                    f'bound_skills={bound_skills or "all"} '
                    f'loaded_skills={len(self.ap.skill_mgr.get_skills(skill_execution_context))}'
                )
-            else:
+            elif 'activate' in available_tool_names:
                self.ap.logger.debug(
                    f'No skills available for prompt injection: '
                    f'pipeline={query.pipeline_uuid} '
@@ -158,6 +158,18 @@ class ResponseWrapper(stage.PipelineStage):
                                result_type=entities.ResultType.CONTINUE,
                                new_query=query,
                            )
+                    elif (
+                        isinstance(result, provider_message.MessageChunk) and result.is_final and not result.tool_calls
+                    ):
+                        # Final streaming chunk with no text content but
+                        # possibly carrying sandbox outbox attachments.
+                        reply_chain = platform_message.MessageChain([])
+                        await self._append_outbound_attachments(query, reply_chain)
+                        query.resp_message_chain.append(reply_chain)
+                        yield entities.StageProcessResult(
+                            result_type=entities.ResultType.CONTINUE,
+                            new_query=query,
+                        )

                    if result.tool_calls is not None and len(result.tool_calls) > 0:  # 有函数调用
                        function_names = [tc.function.name for tc in result.tool_calls]
@@ -15,9 +15,9 @@ spec:
  categories:
    - protocol
  help_links:
-    zh: https://link.langbot.app/zh/platforms/aiocqhttp
-    en: https://link.langbot.app/en/platforms/aiocqhttp
-    ja: https://link.langbot.app/ja/platforms/aiocqhttp
+    zh: https://langbot.app/docs/zh/usage/platforms/qq/aiocqhttp/napcat
+    en: https://langbot.app/docs/en/usage/platforms/qq/aiocqhttp/napcat
+    ja: https://langbot.app/docs/ja/usage/platforms/qq/aiocqhttp/napcat
  config:
    - name: host
      label:
@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/dingtalk
-    en: https://link.langbot.app/en/platforms/dingtalk
-    ja: https://link.langbot.app/ja/platforms/dingtalk
+    zh: https://langbot.app/docs/zh/usage/platforms/dingtalk
+    en: https://langbot.app/docs/en/usage/platforms/dingtalk
+    ja: https://langbot.app/docs/ja/usage/platforms/dingtalk
  config:
    - name: one-click-create
      label:
@@ -24,9 +24,9 @@ spec:
    - popular
    - global
  help_links:
-    zh: https://link.langbot.app/zh/platforms/discord
-    en: https://link.langbot.app/en/platforms/discord
-    ja: https://link.langbot.app/ja/platforms/discord
+    zh: https://langbot.app/docs/zh/usage/platforms/discord
+    en: https://langbot.app/docs/en/usage/platforms/discord
+    ja: https://langbot.app/docs/ja/usage/platforms/discord
  config:
    - name: client_id
      label:
@@ -18,9 +18,9 @@ spec:
    - popular
    - global
  help_links:
-    zh: https://docs.langbot.app/zh/platforms/http-bot
-    en: https://docs.langbot.app/en/platforms/http-bot
-    ja: https://docs.langbot.app/ja/platforms/http-bot
+    zh: https://langbot.app/docs/zh/platforms/http-bot
+    en: https://langbot.app/docs/en/platforms/http-bot
+    ja: https://langbot.app/docs/ja/platforms/http-bot
  config:
    - name: webhook_url
      label:
@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/kook
-    en: https://link.langbot.app/en/platforms/kook
-    ja: https://link.langbot.app/ja/platforms/kook
+    zh: https://langbot.app/docs/zh/usage/platforms/kook
+    en: https://langbot.app/docs/en/usage/platforms/kook
+    ja: https://langbot.app/docs/ja/usage/platforms/kook
  config:
    - name: token
      label:
@@ -160,6 +160,29 @@ def _lark_should_update_stream_element(
    return not resume_from and not form_data and (msg_seq % 8 == 0 or is_final)


+def _lark_final_layout_texts(
+    *,
+    resume_from: bool,
+    text_message: str,
+    pre_pause_cached: str | None,
+    resume_cached: str,
+) -> tuple[str, str]:
+    """Return (main_text, resume_placeholder_text) for the final card update.
+
+    Non-resume round: the full reply belongs in the main streaming element
+    only — also rendering the resume placeholder duplicates the reply, since
+    both hold the same accumulated text. Resume round (Dify HITL): keep the
+    pre-pause text in the main element and the resumed text in the
+    placeholder, as they are distinct segments.
+    """
+    if resume_from:
+        # An empty pre-pause cache is valid (Dify paused before emitting any
+        # text); only a missing entry (None) falls back to the full text.
+        main_text = text_message if pre_pause_cached is None else pre_pause_cached
+        return main_text, resume_cached
+    return text_message, ''
+
+
 def _lark_display_input_value(field: dict, value: typing.Any) -> str:
    field_type = _dify_field_type(field)
    if field_type == 'file':
@@ -2358,16 +2381,21 @@ class LarkAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
                    self.card_form_input_defs[card_id] = _lark_form_input_defs(form_data)
                    self.card_form_inputs[card_id] = dict(form_data.get('inputs') or {})
            else:
-                # Normal finish: keep pre-pause + resume content visible,
-                # remove buttons/notice, drop the resume placeholder.
+                # Normal finish: remove buttons/notice and finalize the card.
+                main_text, resume_text = _lark_final_layout_texts(
+                    resume_from=resume_from,
+                    text_message=text_message,
+                    pre_pause_cached=self.card_pre_pause_text.get(card_id),
+                    resume_cached=resume_cached,
+                )
                await self._update_card_layout(
                    card_id=card_id,
                    message_source=message_source,
-                    text_message=pre_pause,
+                    text_message=main_text,
                    sequence=final_seq,
                    form_data=None,
                    notice_text=selected_notice if resume_from else '',
-                    resume_placeholder_text=resume_cached,
+                    resume_placeholder_text=resume_text,
                )
                self._drop_card_state(card_id)
            self.card_id_dict.pop(message_id, None)
@@ -19,9 +19,9 @@ spec:
    - china
    - global
  help_links:
-    zh: https://link.langbot.app/zh/platforms/lark
-    en: https://link.langbot.app/en/platforms/lark
-    ja: https://link.langbot.app/ja/platforms/lark
+    zh: https://langbot.app/docs/zh/usage/platforms/lark
+    en: https://langbot.app/docs/en/usage/platforms/lark
+    ja: https://langbot.app/docs/ja/usage/platforms/lark
  config:
    - name: domain
      label:
@@ -25,6 +25,7 @@ from linebot.v3.webhooks import (
    ImageMessageContent,
    VideoMessageContent,
    AudioMessageContent,
+    UserMentionee,
 )

 # from linebot import WebhookParser
@@ -58,15 +59,19 @@ class LINEMessageConverter(abstract_platform_adapter.AbstractMessageConverter):

        return content_list

-    @staticmethod
-    async def target2yiri(message, bot_client) -> platform_message.MessageChain:
+    def __init__(self, bot_account_id: str = ''):
+        self.bot_account_id = bot_account_id
+
+    async def target2yiri(self, message, bot_client) -> platform_message.MessageChain:
        lb_msg_list = []
        msg_create_time = datetime.datetime.fromtimestamp(int(message.timestamp) / 1000)

        lb_msg_list.append(platform_message.Source(id=message.webhook_event_id, time=msg_create_time))

        if isinstance(message.message, TextMessageContent):
-            lb_msg_list.append(platform_message.Plain(text=message.message.text))
+            lb_msg_list.extend(
+                self._build_text_components(message.message.text, getattr(message.message, 'mention', None))
+            )
        elif isinstance(message.message, AudioMessageContent):
            pass
        elif isinstance(message.message, VideoMessageContent):
@@ -86,22 +91,60 @@ class LINEMessageConverter(abstract_platform_adapter.AbstractMessageConverter):
            lb_msg_list.append(platform_message.Image(base64=data_uri))
        return platform_message.MessageChain(lb_msg_list)

+    def _build_text_components(self, text: str, mention) -> list:
+        """Build message components from text, inserting At components for mentions.
+
+        LINE provides mention positions (index/length) and is_self per mentionee in the
+        webhook payload. Mapping the bot mention to At(target=bot_account_id) makes the
+        'at-bot' group respond rule work for LINE, consistent with other adapters.
+        """
+        components: list = []
+        if not mention or not mention.mentionees:
+            if text:
+                components.append(platform_message.Plain(text=text))
+            return components
+        segments: list[tuple[int, int, object]] = sorted((m.index, m.index + m.length, m) for m in mention.mentionees)
+        cursor = 0
+        for start, end, mentionee in segments:
+            if start < cursor:
+                start, end = cursor, min(end, len(text))
+            if start < cursor or end <= start or end > len(text):
+                continue
+            if start > cursor:
+                components.append(platform_message.Plain(text=text[cursor:start]))
+            if isinstance(mentionee, UserMentionee):
+                target = self.bot_account_id if mentionee.is_self else mentionee.user_id
+                if not target:
+                    target = text[start:end]
+            else:
+                target = text[start:end]
+            # At.__str__ already prepends '@', so strip one from the LINE text token.
+            display = text[start:end].lstrip('@')
+            components.append(platform_message.At(target=str(target), display=display))
+            cursor = end
+        if cursor < len(text):
+            components.append(platform_message.Plain(text=text[cursor:]))
+        return components
+

 class LINEEventConverter(abstract_platform_adapter.AbstractEventConverter):
+    def __init__(self, bot_account_id: str = ''):
+        self.bot_account_id = bot_account_id
+        self.message_converter = LINEMessageConverter(bot_account_id)
+
    @staticmethod
    async def yiri2target(
        event: platform_events.MessageEvent,
    ) -> MessageEvent:
        pass

-    @staticmethod
-    async def target2yiri(event, bot_client) -> platform_events.Event:
-        message_chain = await LINEMessageConverter.target2yiri(event, bot_client)
+    async def target2yiri(self, event, bot_client) -> platform_events.Event:
+        message_chain = await self.message_converter.target2yiri(event, bot_client)

        if event.source.type == 'user':
            return platform_events.FriendMessage(
                sender=platform_entities.Friend(
-                    id=event.message.id,
+                    id=event.source.user_id,
                    nickname=event.source.user_id,
                    remark='',
                ),
@@ -110,13 +153,19 @@ class LINEEventConverter(abstract_platform_adapter.AbstractEventConverter):
                source_platform_object=event,
            )
        else:
+            # 'group' and 'room' sources carry the stable chat id under different
+            # field names; user_id may be absent for some members, so fall back
+            # to the group/room id rather than the per-message id.
+            group_id = event.source.group_id if event.source.type == 'group' else event.source.room_id
+            member_id = event.source.user_id or group_id
+
            return platform_events.GroupMessage(
                sender=platform_entities.GroupMember(
-                    id=event.event.sender.sender_id.open_id,
-                    member_name=event.event.sender.sender_id.union_id,
+                    id=member_id,
+                    member_name=member_id,
                    permission=platform_entities.Permission.Member,
                    group=platform_entities.Group(
-                        id=event.message.id,
+                        id=group_id,
                        name='',
                        permission=platform_entities.Permission.Member,
                    ),
@@ -163,8 +212,8 @@ class LINEAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
            listeners={},
            card_id_dict={},
            seq=1,
-            event_converter=LINEEventConverter(),
-            message_converter=LINEMessageConverter(),
+            event_converter=LINEEventConverter(bot_account_id),
+            message_converter=LINEMessageConverter(bot_account_id),
            line_webhook=line_webhook,
            parser=parser,
            configuration=configuration,
@@ -22,9 +22,9 @@ spec:
  categories:
    - global
  help_links:
-    zh: https://link.langbot.app/zh/platforms/line
-    en: https://link.langbot.app/en/platforms/line
-    ja: https://link.langbot.app/ja/platforms/line
+    zh: https://langbot.app/docs/zh/usage/platforms/line
+    en: https://langbot.app/docs/en/usage/platforms/line
+    ja: https://langbot.app/docs/ja/usage/platforms/line
  config:
    - name: webhook_url
      label:
@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/officialaccount
-    en: https://link.langbot.app/en/platforms/officialaccount
-    ja: https://link.langbot.app/ja/platforms/officialaccount
+    zh: https://langbot.app/docs/zh/usage/platforms/wxoa
+    en: https://langbot.app/docs/en/usage/platforms/wxoa
+    ja: https://langbot.app/docs/ja/usage/platforms/wxoa
  config:
    - name: webhook_url
      label:
@@ -16,9 +16,9 @@ spec:
    - popular
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/openclaw_weixin
-    en: https://link.langbot.app/en/platforms/openclaw_weixin
-    ja: https://link.langbot.app/ja/platforms/openclaw_weixin
+    zh: https://langbot.app/docs/zh/usage/platforms/wechat/weixin
+    en: https://langbot.app/docs/en/usage/platforms/readme
+    ja: https://langbot.app/docs/ja/usage/platforms/readme
  config:
    - name: base_url
      label:
@@ -205,7 +205,7 @@ class QQOfficialAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter
        bot = QQOfficialClient(
            app_id=config['appid'],
            secret=config['secret'],
-            token=config['token'],
+            token=config.get('token', ''),
            logger=logger,
            unified_mode=enable_webhook,
        )
@@ -329,17 +329,12 @@ class QQOfficialAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter
            content_type = content.get('type', 'text')

            if content_type == 'text':
-                if target_type == 'c2c':
-                    await self.bot.send_private_text_msg(
+                if target_type in {'c2c', 'group'}:
+                    await self._send_c2c_or_group_text_reply(
+                        target_type,
                        target_id,
                        content['content'],
-                        qq_official_event.d_id,
-                    )
-                elif target_type == 'group':
-                    await self.bot.send_group_text_msg(
-                        target_id,
-                        content['content'],
-                        qq_official_event.d_id,
+                        msg_id=qq_official_event.d_id,
                    )

            elif content_type == 'image':
@@ -383,6 +378,39 @@ class QQOfficialAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter
    async def send_message(self, target_type: str, target_id: str, message: platform_message.MessageChain):
        pass

+    async def _send_c2c_or_group_text_reply(
+        self,
+        target_type: str,
+        target_id: str,
+        content: str,
+        *,
+        msg_id: typing.Optional[str] = None,
+        event_id: typing.Optional[str] = None,
+        msg_seq: int = 1,
+    ) -> None:
+        """Send a text reply using the configured C2C/group render mode."""
+        use_markdown = self.config.get('enable-markdown-rendering', False)
+        if target_type == 'c2c':
+            send = self.bot.send_private_markdown_msg if use_markdown else self.bot.send_private_text_msg
+            await send(
+                user_openid=target_id,
+                content=content,
+                msg_id=msg_id,
+                event_id=event_id,
+                msg_seq=msg_seq,
+            )
+        elif target_type == 'group':
+            send = self.bot.send_group_markdown_msg if use_markdown else self.bot.send_group_text_msg
+            await send(
+                group_openid=target_id,
+                content=content,
+                msg_id=msg_id,
+                event_id=event_id,
+                msg_seq=msg_seq,
+            )
+        else:
+            raise ValueError(f'Unsupported QQ Official text reply target: {target_type}')
+
    def register_listener(
        self,
        event_type: typing.Type[platform_events.Event],
@@ -650,13 +678,13 @@ class QQOfficialAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter
            # 用第一个 chunk 的文本建立会话（不发 "..." 避免污染前缀）
            ctx['session_started'] = True

-        # 发送内容 = 全量累积文本
-        # QQ API 的 replace 模式不允许修改已下发前缀，所以：
-        # - 首次：发送全部文本，建立会话
-        # - 后续：只能发送新增部分（append 行为）
-        content_to_send = ctx['accumulated_text'][ctx['sent_length'] :]
-        if not content_to_send and not is_final:
+        # `replace` mode requires every update to contain the previously
+        # delivered content as its prefix. `sent_length` only tells us whether
+        # a non-final snapshot has new content; it must not truncate the
+        # content sent to QQ.
+        if len(ctx['accumulated_text']) <= ctx['sent_length'] and not is_final:
            return
+        content_to_send = ctx['accumulated_text']

        input_state = 10 if is_final else 1

@@ -778,20 +806,13 @@ class QQOfficialAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter
            return

        try:
-            if target_type == 'c2c':
-                await self.bot.send_private_text_msg(
-                    user_openid=target_id,
-                    content=text,
-                    event_id=event_id,
-                    msg_seq=msg_seq,
-                )
-            elif target_type == 'group':
-                await self.bot.send_group_text_msg(
-                    group_openid=target_id,
-                    content=text,
-                    event_id=event_id,
-                    msg_seq=msg_seq,
-                )
+            await self._send_c2c_or_group_text_reply(
+                target_type,
+                target_id,
+                text,
+                event_id=event_id,
+                msg_seq=msg_seq,
+            )
        except Exception:
            await self.logger.error(f'QQ Official: synthetic reply delivery failed: {traceback.format_exc()}')

@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/qqofficial
-    en: https://link.langbot.app/en/platforms/qqofficial
-    ja: https://link.langbot.app/ja/platforms/qqofficial
+    zh: https://langbot.app/docs/zh/usage/platforms/qq/official_webhook
+    en: https://langbot.app/docs/en/usage/platforms/qq/official_webhook
+    ja: https://langbot.app/docs/ja/usage/platforms/qq/official_webhook
  config:
    - name: __system.outbound_ips
      label:
@@ -95,6 +95,18 @@ spec:
      type: boolean
      required: true
      default: false
+    - name: enable-markdown-rendering
+      label:
+        en_US: Enable Markdown Rendering
+        zh_Hans: 启用 Markdown 渲染
+        zh_Hant: 啟用 Markdown 渲染
+      description:
+        en_US: Render non-stream C2C and QQ group text replies as Markdown. Channel messages always use plain text and are not affected by this setting.
+        zh_Hans: 将非流式 C2C 私聊和 QQ 群聊文本回复渲染为 Markdown。频道消息始终以纯文本发送，不受此设置影响。
+        zh_Hant: 將非串流 C2C 私聊與 QQ 群聊文字回覆渲染為 Markdown。頻道訊息一律以純文字傳送，不受此設定影響。
+      type: boolean
+      required: true
+      default: false
    - name: webhook_url
      label:
        en_US: Webhook Callback URL
@@ -21,9 +21,9 @@ spec:
  categories:
    - protocol
  help_links:
-    zh: https://link.langbot.app/zh/platforms/satori
-    en: https://link.langbot.app/en/platforms/satori
-    ja: https://link.langbot.app/ja/platforms/satori
+    zh: https://langbot.app/docs/zh/usage/platforms/readme
+    en: https://langbot.app/docs/en/usage/platforms/readme
+    ja: https://langbot.app/docs/ja/usage/platforms/readme
  config:
    - name: platform
      label:
@@ -24,9 +24,9 @@ spec:
    - popular
    - global
  help_links:
-    zh: https://link.langbot.app/zh/platforms/slack
-    en: https://link.langbot.app/en/platforms/slack
-    ja: https://link.langbot.app/ja/platforms/slack
+    zh: https://langbot.app/docs/zh/usage/platforms/slack
+    en: https://langbot.app/docs/en/usage/platforms/slack
+    ja: https://langbot.app/docs/ja/usage/platforms/slack
  config:
    - name: webhook_url
      label:
@@ -24,9 +24,9 @@ spec:
    - popular
    - global
  help_links:
-    zh: https://link.langbot.app/zh/platforms/telegram
-    en: https://link.langbot.app/en/platforms/telegram
-    ja: https://link.langbot.app/ja/platforms/telegram
+    zh: https://langbot.app/docs/zh/usage/platforms/telegram
+    en: https://langbot.app/docs/en/usage/platforms/telegram
+    ja: https://langbot.app/docs/ja/usage/platforms/telegram
  config:
    - name: token
      label:
@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/wechatpad
-    en: https://link.langbot.app/en/platforms/wechatpad
-    ja: https://link.langbot.app/ja/platforms/wechatpad
+    zh: https://langbot.app/docs/zh/usage/platforms/wechat/wechatpad
+    en: https://langbot.app/docs/en/usage/platforms/readme
+    ja: https://langbot.app/docs/ja/usage/platforms/readme
  config:
    - name: wechatpad_url
      label:
@@ -274,11 +274,11 @@ class WecomAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
                if content['type'] == 'text':
                    await self.bot.send_private_msg(user_id, agent_id, content['content'])
                if content['type'] == 'image':
-                    await self.bot.send_image(user_id, agent_id, content['media'])
+                    await self.bot.send_image(user_id, agent_id, content['media_id'])
                if content['type'] == 'voice':
-                    await self.bot.send_voice(user_id, agent_id, content['media'])
+                    await self.bot.send_voice(user_id, agent_id, content['media_id'])
                if content['type'] == 'file':
-                    await self.bot.send_file(user_id, agent_id, content['media'])
+                    await self.bot.send_file(user_id, agent_id, content['media_id'])

    def register_listener(
        self,
@@ -16,9 +16,9 @@ spec:
    - popular
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/wecom
-    en: https://link.langbot.app/en/platforms/wecom
-    ja: https://link.langbot.app/ja/platforms/wecom
+    zh: https://langbot.app/docs/zh/usage/platforms/wecom/wecom
+    en: https://langbot.app/docs/en/usage/platforms/wecom/wecom
+    ja: https://langbot.app/docs/ja/usage/platforms/wecom/wecom
  config:
    - name: webhook_url
      label:
@@ -3,8 +3,10 @@ import typing
 import asyncio
 import time
 import traceback
+import base64

 import datetime
+
 import langbot_plugin.api.definition.abstract.platform.adapter as abstract_platform_adapter
 import langbot_plugin.api.entities.builtin.platform.message as platform_message
 import langbot_plugin.api.entities.builtin.platform.events as platform_events
@@ -24,11 +26,24 @@ from langbot.libs.wecom_ai_bot_api.ws_client import WecomBotWsClient
 class WecomBotMessageConverter(abstract_platform_adapter.AbstractMessageConverter):
    @staticmethod
    async def yiri2target(message_chain: platform_message.MessageChain):
-        content = ''
+        """Convert a MessageChain into a list of component dicts.
+
+        Each dict has a ``type`` key (``'text'``, ``'image'``,
+        ``'voice'``, ``'file'``). Text items carry ``text``; media
+        items carry ``base64`` (may include a ``data:...;base64,``
+        prefix) and optionally ``name``.
+        """
+        items: list[dict] = []
        for msg in message_chain:
            if type(msg) is platform_message.Plain:
-                content += msg.text
-        return content
+                items.append({'type': 'text', 'text': msg.text})
+            elif type(msg) is platform_message.Image:
+                items.append({'type': 'image', 'base64': msg.base64 or ''})
+            elif type(msg) is platform_message.Voice:
+                items.append({'type': 'voice', 'base64': msg.base64 or ''})
+            elif type(msg) is platform_message.File:
+                items.append({'type': 'file', 'base64': msg.base64 or '', 'name': msg.name or ''})
+        return items

    @staticmethod
    async def target2yiri(event: WecomBotEvent, bot_name: str = ''):
@@ -362,13 +377,76 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
                }
            )

+    @staticmethod
+    def _join_text_components(items: list[dict]) -> str:
+        """Concatenate ``text`` items in order, leaving media items alone."""
+        return ''.join(item['text'] for item in items if item.get('type') == 'text')
+
+    @staticmethod
+    def _iter_media_components(items: list[dict]):
+        """Yield non-text items in order."""
+        for item in items:
+            if item.get('type') in {'image', 'voice', 'file'}:
+                yield item
+
+    @staticmethod
+    async def _send_media(
+        bot,
+        req_id: str,
+        item: dict,
+    ) -> bool:
+        """Upload *item* to the WeCom AI Bot CDN and send it as a media reply.
+
+        Returns True on success. Falls back to a no-op (with a warning log)
+        if the SDK does not yet implement ``upload_media`` /
+        ``reply_image`` / ``reply_file`` / ``reply_voice`` — the framework
+        will keep working, just without image delivery.
+        """
+        kind = item.get('type')
+        upload = getattr(bot, 'upload_media', None)
+        if upload is None:
+            return False
+        b64_text = item.get('base64') or ''
+        if not b64_text:
+            return False
+        if b64_text.startswith('data:') and ',' in b64_text:
+            b64_text = b64_text.split(',', 1)[1]
+        try:
+            data = base64.b64decode(b64_text, validate=False)
+        except Exception:
+            return False
+        if not data:
+            return False
+        try:
+            upload_result = await upload(data, item.get('name') or f'attachment.{kind}', media_type=kind)
+        except Exception:
+            return False
+        media_id = getattr(upload_result, 'media_id', None) or (
+            isinstance(upload_result, dict) and upload_result.get('media_id')
+        )
+        if not media_id:
+            return False
+        reply_fn = {
+            'image': getattr(bot, 'reply_image', None),
+            'file': getattr(bot, 'reply_file', None),
+            'voice': getattr(bot, 'reply_voice', None),
+        }.get(kind)
+        if reply_fn is None:
+            return False
+        try:
+            await reply_fn(req_id, media_id)
+            return True
+        except Exception:
+            return False
+
    async def reply_message(
        self,
        message_source: platform_events.MessageEvent,
        message: platform_message.MessageChain,
        quote_origin: bool = False,
    ):
-        content = await self.message_converter.yiri2target(message)
+        items = await self.message_converter.yiri2target(message)
+        text = self._join_text_components(items)
        _ws_mode = not self.config.get('enable-webhook', False)

        event = message_source.source_platform_object
@@ -382,7 +460,7 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
                else:
                    chat_id = str(message_source.sender.id)
                try:
-                    await self.bot.send_message(chat_id, content)
+                    await self.bot.send_message(chat_id, text)
                except Exception:
                    await self.logger.error(
                        f'WeComBot: proactive reply for synthetic event failed: {traceback.format_exc()}'
@@ -396,12 +474,15 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):

        if _ws_mode:
            req_id = event.get('req_id', '') if isinstance(event, dict) else getattr(event, 'req_id', '')
-            if req_id:
-                await self.bot.reply_text(req_id, content)
-            else:
-                await self.bot.set_message(event.message_id, content)
+            if text:
+                if req_id:
+                    await self.bot.reply_text(req_id, text)
+                else:
+                    await self.bot.set_message(event.message_id, text)
+            for item in self._iter_media_components(items):
+                await self._send_media(self.bot, req_id, item)
        else:
-            await self.bot.set_message(event.message_id, content)
+            await self.bot.set_message(event.message_id, text)

    async def reply_message_chunk(
        self,
@@ -411,7 +492,8 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
        quote_origin: bool = False,
        is_final: bool = False,
    ):
-        content = await self.message_converter.yiri2target(message)
+        items = await self.message_converter.yiri2target(message)
+        text = self._join_text_components(items)
        _ws_mode = not self.config.get('enable-webhook', False)

        # Synthetic events (e.g. button-click triggered form resume) have
@@ -420,7 +502,7 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
        # of the stream/reply path.
        spo = message_source.source_platform_object
        if spo is None:
-            return await self._handle_synthetic_chunk(message_source, bot_message, content, is_final, _ws_mode)
+            return await self._handle_synthetic_chunk(message_source, bot_message, text, is_final, _ws_mode)

        msg_id = spo.message_id

@@ -452,7 +534,7 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
                    form_data.get('actions', []) or [],
                )
            except Exception:
-                fallback = content or '（人工输入）'
+                fallback = text or '（人工输入）'
            if _ws_mode:
                event = message_source.source_platform_object
                req_id = event.get('req_id', '') if isinstance(event, dict) else getattr(event, 'req_id', '')
@@ -463,17 +545,22 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
            return {'stream': False, 'form': True, 'fallback': True}

        if _ws_mode:
-            success = await self.bot.push_stream_chunk(msg_id, content, is_final=is_final)
+            success = await self.bot.push_stream_chunk(msg_id, text, is_final=is_final)
            if not success and is_final:
                event = message_source.source_platform_object
                req_id = event.get('req_id', '')
                if req_id:
-                    await self.bot.reply_text(req_id, content)
+                    await self.bot.reply_text(req_id, text)
+            if is_final:
+                event = message_source.source_platform_object
+                req_id = event.get('req_id', '')
+                for item in self._iter_media_components(items):
+                    await self._send_media(self.bot, req_id, item)
            return {'stream': success}
        else:
-            success = await self.bot.push_stream_chunk(msg_id, content, is_final=is_final)
+            success = await self.bot.push_stream_chunk(msg_id, text, is_final=is_final)
            if not success and is_final:
-                await self.bot.set_message(msg_id, content)
+                await self.bot.set_message(msg_id, text)
            return {'stream': success}

    async def is_stream_output_supported(self) -> bool:
@@ -627,8 +714,9 @@ class WecomBotAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
    async def send_message(self, target_type, target_id, message):
        _ws_mode = not self.config.get('enable-webhook', False)
        if _ws_mode:
-            content = await self.message_converter.yiri2target(message)
-            await self.bot.send_message(target_id, content)
+            items = await self.message_converter.yiri2target(message)
+            text = self._join_text_components(items)
+            await self.bot.send_message(target_id, text)
        else:
            pass

@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/wecombot
-    en: https://link.langbot.app/en/platforms/wecombot
-    ja: https://link.langbot.app/ja/platforms/wecombot
+    zh: https://langbot.app/docs/zh/usage/platforms/wecom/wecombot
+    en: https://langbot.app/docs/en/usage/platforms/wecom/wecombot
+    ja: https://langbot.app/docs/ja/usage/platforms/wecom/wecombot
  config:
    - name: one-click-create
      label:
@@ -107,7 +107,7 @@ class WecomEventConverter(abstract_platform_adapter.AbstractEventConverter):
        if event.type == 'text':
            yiri_chain = await WecomMessageConverter.target2yiri(event.message, event.message_id)
            friend = platform_entities.Friend(
-                id=f'u{event.user_id}',
+                id=f'{event.receiver_id}|u{event.user_id}',
                nickname=nickname,
                remark='',
            )
@@ -117,7 +117,7 @@ class WecomEventConverter(abstract_platform_adapter.AbstractEventConverter):
            )
        elif event.type == 'image':
            friend = platform_entities.Friend(
-                id=f'u{event.user_id}',
+                id=f'{event.receiver_id}|u{event.user_id}',
                nickname=nickname,
                remark='',
            )
@@ -197,7 +197,7 @@ class WecomCSAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):

        content_list = await WecomMessageConverter.yiri2target(message, self.bot)
        for content in content_list:
-            msgid = f'langbot_{uuid.uuid4().hex}'
+            msgid = f'{uuid.uuid4().hex}'
            if content['type'] == 'text':
                await self.bot.send_text_msg(
                    open_kfid=open_kfid,
@@ -205,6 +205,13 @@ class WecomCSAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter):
                    msgid=msgid,
                    content=content['content'],
                )
+            elif content['type'] == 'image':
+                await self.bot.send_image_msg(
+                    open_kfid=open_kfid,
+                    external_userid=external_userid,
+                    msgid=msgid,
+                    media_id=content['media_id'],
+                )

    def set_bot_uuid(self, bot_uuid: str):
        """设置 bot UUID（用于生成 webhook URL）"""
@@ -15,9 +15,9 @@ spec:
  categories:
    - china
  help_links:
-    zh: https://link.langbot.app/zh/platforms/wecomcs
-    en: https://link.langbot.app/en/platforms/wecomcs
-    ja: https://link.langbot.app/ja/platforms/wecomcs
+    zh: https://langbot.app/docs/zh/usage/platforms/wecom/wecomcs
+    en: https://langbot.app/docs/en/usage/platforms/wecom/wecomcs
+    ja: https://langbot.app/docs/ja/usage/platforms/wecom/wecomcs
  config:
    - name: webhook_url
      label:
@@ -264,6 +264,11 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
        if not self._control_token and allow_generate:
            self._control_token = secrets.token_urlsafe(48)
        if not self._control_token:
+            if self.runtime_profile == 'shared':
+                raise PluginRuntimeNotConnectedError(
+                    f'{PLUGIN_RUNTIME_CONTROL_TOKEN_ENV} must be configured with a strong shared secret '
+                    'for a Cloud Plugin Runtime'
+                )
            return {}
        try:
            self._control_token = validate_runtime_secret(
@@ -696,7 +701,13 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
            }
            self._known_desired_states.update({state.binding.installation_uuid: state for state in desired_states})

-        result = await runtime_handler.reconcile_plugin_installations(tuple(self._known_desired_states.values()))
+        reconcile_timeout_seconds = max(
+            300.0, self._runtime_connect_timeout(self.ap.instance_config.data.get('plugin', {}))
+        )
+        result = await runtime_handler.reconcile_plugin_installations(
+            tuple(self._known_desired_states.values()),
+            timeout=reconcile_timeout_seconds,
+        )
        await self._repair_reconcile_missing_artifacts(self._known_desired_states, result)
        self._record_reconcile_failures(self._known_desired_states, result)

@@ -731,7 +742,13 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
                    if state.binding.installation_uuid in all_states:
                        raise ValueError('Duplicate plugin installation UUID across projected Workspaces')
                    all_states[state.binding.installation_uuid] = state
-            result = await runtime_handler.reconcile_plugin_installations(tuple(all_states.values()))
+            reconcile_timeout_seconds = max(
+                300.0, self._runtime_connect_timeout(self.ap.instance_config.data.get('plugin', {}))
+            )
+            result = await runtime_handler.reconcile_plugin_installations(
+                tuple(all_states.values()),
+                timeout=reconcile_timeout_seconds,
+            )
            await self._repair_reconcile_missing_artifacts(all_states, result)
            self._record_reconcile_failures(all_states, result)
            for installation_uuid, previous in tuple(self._known_desired_states.items()):
@@ -1896,9 +1913,14 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):

        return plugins

-    async def get_plugin_info(self, author: str, plugin_name: str) -> dict[str, Any]:
+    async def get_plugin_info(self, author: str, plugin_name: str) -> dict[str, Any] | None:
        runtime_handler = self._runtime_handler()
-        binding = await self._target_binding(author, plugin_name)
+        try:
+            binding = await self._target_binding(author, plugin_name)
+        except ValueError as exc:
+            if str(exc) == f'Plugin {author}/{plugin_name} is not installed in this Workspace':
+                return None
+            raise
        with runtime_handler.installation_scope(binding):
            return await runtime_handler.get_plugin_info(author, plugin_name)

@@ -11,6 +11,8 @@ import traceback
 from dataclasses import dataclass

 import sqlalchemy
+import sqlalchemy.dialects.postgresql
+import sqlalchemy.dialects.sqlite

 from langbot_plugin.runtime.io import handler
 from langbot_plugin.runtime.io.connection import Connection
@@ -431,6 +433,19 @@ class RuntimeConnectionHandler(handler.Handler):
            return f'{identity.plugin_author}/{identity.plugin_name}'
        raise ValueError(f'Unsupported binary storage owner_type {owner_type!r}')

+    @staticmethod
+    def _legacy_binary_storage_key(
+        action_context: ActionContext,
+        *,
+        owner_type: str,
+        owner: str,
+        key: str,
+    ) -> str:
+        """Return the pre-tenancy key shape for a row already scoped to this Workspace."""
+
+        legacy_owner = action_context.workspace_uuid if owner_type == 'workspace' else owner
+        return f'{owner_type}:{legacy_owner}:{key}'
+
    @classmethod
    def _binary_storage_key(
        cls,
@@ -896,25 +911,82 @@ class RuntimeConnectionHandler(handler.Handler):
                .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
                .where(persistence_bstorage.BinaryStorage.unique_key == unique_key)
            )
+            storage = result.first()
+            if storage is None:
+                legacy_key = self._legacy_binary_storage_key(
+                    action_context,
+                    owner_type=owner_type,
+                    owner=owner,
+                    key=key,
+                )
+                result = await self.ap.persistence_mgr.execute_async(
+                    sqlalchemy.select(persistence_bstorage.BinaryStorage)
+                    .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
+                    .where(persistence_bstorage.BinaryStorage.unique_key == legacy_key)
+                    .where(persistence_bstorage.BinaryStorage.key == key)
+                    .where(persistence_bstorage.BinaryStorage.owner_type == owner_type)
+                    .where(persistence_bstorage.BinaryStorage.owner == owner)
+                )
+                storage = result.first()
+                if storage is not None:
+                    update_result = await self.ap.persistence_mgr.execute_async(
+                        sqlalchemy.update(persistence_bstorage.BinaryStorage)
+                        .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
+                        .where(persistence_bstorage.BinaryStorage.unique_key == legacy_key)
+                        .where(persistence_bstorage.BinaryStorage.key == key)
+                        .where(persistence_bstorage.BinaryStorage.owner_type == owner_type)
+                        .where(persistence_bstorage.BinaryStorage.owner == owner)
+                        .values(unique_key=unique_key, value=value)
+                    )
+                    if update_result.rowcount:
+                        return handler.ActionResponse.success(data={})
+                    canonical_update = await self.ap.persistence_mgr.execute_async(
+                        sqlalchemy.update(persistence_bstorage.BinaryStorage)
+                        .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
+                        .where(persistence_bstorage.BinaryStorage.unique_key == unique_key)
+                        .where(persistence_bstorage.BinaryStorage.key == key)
+                        .where(persistence_bstorage.BinaryStorage.owner_type == owner_type)
+                        .where(persistence_bstorage.BinaryStorage.owner == owner)
+                        .values(value=value)
+                    )
+                    if canonical_update.rowcount:
+                        return handler.ActionResponse.success(data={})
+                    storage = None

-            if result.first() is not None:
+            if storage is not None:
                await self.ap.persistence_mgr.execute_async(
                    sqlalchemy.update(persistence_bstorage.BinaryStorage)
                    .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
                    .where(persistence_bstorage.BinaryStorage.unique_key == unique_key)
+                    .where(persistence_bstorage.BinaryStorage.key == key)
+                    .where(persistence_bstorage.BinaryStorage.owner_type == owner_type)
+                    .where(persistence_bstorage.BinaryStorage.owner == owner)
                    .values(value=value)
                )
-            else:
-                await self.ap.persistence_mgr.execute_async(
-                    sqlalchemy.insert(persistence_bstorage.BinaryStorage).values(
-                        workspace_uuid=action_context.workspace_uuid,
-                        unique_key=unique_key,
-                        key=key,
-                        owner_type=owner_type,
-                        owner=owner,
-                        value=value,
-                    )
+                return handler.ActionResponse.success(data={})
+
+            dialect_name = self.ap.persistence_mgr.get_db_engine().dialect.name
+            insert = {
+                'postgresql': sqlalchemy.dialects.postgresql.insert,
+                'sqlite': sqlalchemy.dialects.sqlite.insert,
+            }.get(dialect_name)
+            if insert is None:
+                return handler.ActionResponse.error(message=f'Unsupported storage database dialect: {dialect_name}')
+            await self.ap.persistence_mgr.execute_async(
+                insert(persistence_bstorage.BinaryStorage)
+                .values(
+                    workspace_uuid=action_context.workspace_uuid,
+                    unique_key=unique_key,
+                    key=key,
+                    owner_type=owner_type,
+                    owner=owner,
+                    value=value,
                )
+                .on_conflict_do_update(
+                    index_elements=['workspace_uuid', 'unique_key'],
+                    set_={'value': value},
+                )
+            )

            return handler.ActionResponse.success(
                data={},
@@ -946,6 +1018,29 @@ class RuntimeConnectionHandler(handler.Handler):
            )

            storage = result.first()
+            if storage is None:
+                legacy_key = self._legacy_binary_storage_key(
+                    action_context,
+                    owner_type=owner_type,
+                    owner=owner,
+                    key=key,
+                )
+                result = await self.ap.persistence_mgr.execute_async(
+                    sqlalchemy.select(persistence_bstorage.BinaryStorage)
+                    .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
+                    .where(persistence_bstorage.BinaryStorage.unique_key == legacy_key)
+                    .where(persistence_bstorage.BinaryStorage.key == key)
+                    .where(persistence_bstorage.BinaryStorage.owner_type == owner_type)
+                    .where(persistence_bstorage.BinaryStorage.owner == owner)
+                )
+                storage = result.first()
+                if storage is None:
+                    retry_result = await self.ap.persistence_mgr.execute_async(
+                        sqlalchemy.select(persistence_bstorage.BinaryStorage)
+                        .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
+                        .where(persistence_bstorage.BinaryStorage.unique_key == unique_key)
+                    )
+                    storage = retry_result.first()
            if storage is None:
                return handler.ActionResponse.error(
                    message=f'Storage with key {key} not found',
@@ -981,10 +1076,19 @@ class RuntimeConnectionHandler(handler.Handler):
                    message=str(e),
                )

+            legacy_key = self._legacy_binary_storage_key(
+                action_context,
+                owner_type=owner_type,
+                owner=owner,
+                key=key,
+            )
            await self.ap.persistence_mgr.execute_async(
                sqlalchemy.delete(persistence_bstorage.BinaryStorage)
                .where(persistence_bstorage.BinaryStorage.workspace_uuid == action_context.workspace_uuid)
-                .where(persistence_bstorage.BinaryStorage.unique_key == unique_key)
+                .where(persistence_bstorage.BinaryStorage.unique_key.in_((unique_key, legacy_key)))
+                .where(persistence_bstorage.BinaryStorage.key == key)
+                .where(persistence_bstorage.BinaryStorage.owner_type == owner_type)
+                .where(persistence_bstorage.BinaryStorage.owner == owner)
            )

            return handler.ActionResponse.success(
@@ -1012,7 +1116,7 @@ class RuntimeConnectionHandler(handler.Handler):

            return handler.ActionResponse.success(
                data={
-                    'keys': result.scalars().all(),
+                    'keys': list(dict.fromkeys(result.scalars().all())),
                },
            )

@@ -1573,13 +1677,15 @@ class RuntimeConnectionHandler(handler.Handler):
    async def reconcile_plugin_installations(
        self,
        installations: tuple[PluginInstallationDesiredState, ...],
+        *,
+        timeout: float = 300,
    ) -> dict[str, Any]:
        request = ReconcilePluginInstallationsRequest(installations=installations)
        with self.installation_scope(None):
            return await self.call_action(
                LangBotToRuntimeAction.RECONCILE_PLUGIN_INSTALLATIONS,
                request.model_dump(),
-                timeout=120,
+                timeout=timeout,
            )

    async def apply_plugin_installation(
@@ -1962,11 +2068,16 @@ class RuntimeConnectionHandler(handler.Handler):

    async def get_debug_info(self, execution_context: ExecutionContext) -> dict[str, Any]:
        """Get debug information including debug key and WS URL"""
+        action_context = ActionContext(
+            instance_uuid=execution_context.instance_uuid,
+            workspace_uuid=execution_context.workspace_uuid,
+            placement_generation=execution_context.placement_generation,
+        )
        result = await self.call_action(
            LangBotToRuntimeAction.GET_DEBUG_INFO,
            {},
            timeout=10,
-            action_context=execution_context,
+            action_context=action_context,
        )
        return result

@@ -573,7 +573,7 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
            levels = ['provider_default', 'disabled', 'enabled']
        elif family == 'doubao':
            levels = ['provider_default', 'disabled', 'low', 'medium', 'high']
-        elif family == 'ollama':
+        elif family in ('ollama', 'ollama_chat'):
            levels = ['provider_default']
            levels.append('disabled')
            if normalized_name.startswith('gpt-oss') or '/gpt-oss' in normalized_name:
@@ -747,9 +747,24 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
                converted_parts = []
                for part in content:
                    if isinstance(part, dict) and part.get('type') == 'image_base64':
-                        part['image_url'] = {'url': part['image_base64']}
-                        part['type'] = 'image_url'
-                        del part['image_base64']
+                        # History trimming (SessionManager) clears image_base64
+                        # on past turns and exclude_none serialization drops
+                        # the key entirely, so the replayed part may carry no
+                        # payload. Prefer the base64 payload; fall back to an
+                        # image_url that survived on the same element; drop
+                        # hollow parts instead of raising KeyError (#2469).
+                        image_b64 = part.get('image_base64')
+                        fallback_url = None
+                        if not image_b64:
+                            raw_image_url = part.get('image_url')
+                            if isinstance(raw_image_url, dict):
+                                fallback_url = raw_image_url.get('url')
+                        if image_b64 or fallback_url:
+                            part['image_url'] = {'url': image_b64 or fallback_url}
+                            part['type'] = 'image_url'
+                            part.pop('image_base64', None)
+                        else:
+                            continue
                    # OpenAI-compatible chat models reject non-image file parts
                    # (audio/document base64 or url). These originate from Voice /
                    # File attachments — including ones replayed from conversation
@@ -1330,7 +1345,14 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
        extra_args: dict[str, typing.Any] = {},
    ) -> tuple[list[list[float]], dict]:
        """Invoke embedding and return vectors with usage info."""
-        model_name = self._build_litellm_model_name(model.model_entity.name)
+        # litellm's embedding routing has no "ollama_chat" branch (that provider
+        # exists only for /api/chat completions) — embeddings still go through
+        # the plain "ollama" provider. Requesters configured for ollama_chat
+        # (to get native tool-calling on the chat path) must fall back to
+        # "ollama" here specifically, or embedding calls raise "Unmapped LLM
+        # provider for this endpoint".
+        embedding_provider = 'ollama' if self._get_custom_llm_provider() == 'ollama_chat' else None
+        model_name = self._build_litellm_model_name(model.model_entity.name, embedding_provider)
        api_key = model.provider.token_mgr.get_token()

        args = {
@@ -1526,6 +1548,12 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
                event_hooks=httpclient.httpx_response_limit_hooks(),
            ) as client:
                response = await client.get(models_url, headers=headers)
+                if response.status_code == 404 and not base_url.rstrip('/').endswith('/v1'):
+                    # Some OpenAI-compatible servers (notably a bare Ollama host,
+                    # e.g. http://host:11434) expose the model list under /v1/models
+                    # rather than /models. Providers whose configured base_url
+                    # already ends in /v1 keep their original (working) URL.
+                    response = await client.get(f'{base_url}/v1/models', headers=headers)
                response.raise_for_status()
                payload = await httpclient.parse_json_response(response)

--- a/Show More
+++ b/Show More