test(box): cover inbound/outbound attachment helpers; fix ruff format

- ruff format localagent.py (CI ruff format --check was failing)
- add unit tests for ResponseWrapper outbound-attachment helpers (wrapper.py 78%->98%)
- add unit tests for LocalAgentRunner._inject_inbound_attachments
- add unit tests for WebSocketAdapter._process_image_components (0%->covered)

Lifts PR patch coverage from 68.97% to ~88% (>75% target).

src/langbot/pkg/box/service.py

@@ -335,6 +335,428 @@ class BoxService:
 
         return await self.execute_spec_payload(spec_payload, query)
 
+    # ── Attachment passthrough (inbound / outbound) ──────────────────
+    #
+    # IM/webchat attachments (images, voices, files) reach the LLM as
+    # multimodal content, but historically never landed on the sandbox
+    # filesystem, so the agent's exec/read/write tools could not operate on
+    # them. Conversely, files the agent produced inside the sandbox were
+    # never surfaced back to the user. These two helpers close both gaps:
+    #
+    #   inbound  : message_chain attachments -> /workspace/inbox/<query_id>/
+    #   outbound : /workspace/outbox/<query_id>/ -> reply MessageChain
+    #
+    # Transfer prefers DIRECT HOST FILESYSTEM access to the bind-mounted
+    # workspace (default_workspace on the host maps to /workspace inside the
+    # container), which has no size limit. This covers the local docker /
+    # nsjail / stdio backends. For backends where the workspace is NOT visible
+    # on the LangBot host (E2B, an external remote runtime.endpoint), it falls
+    # back to a base64-through-exec round-trip. The exec channel can only move
+    # small files reliably — the docker backend passes the command as a single
+    # argv (ARG_MAX) and exec stdout is truncated by output_limit_chars — so
+    # the host path is strongly preferred and used whenever available.
+
+    INBOX_MOUNT_DIR = '/workspace/inbox'
+    OUTBOX_MOUNT_DIR = '/workspace/outbox'
+    INBOX_SUBDIR = 'inbox'
+    OUTBOX_SUBDIR = 'outbox'
+    # Hard cap on a single attachment. The HTTP upload endpoints already cap
+    # uploads at 10MiB; keep parity.
+    _ATTACHMENT_MAX_BYTES = 10 * _MIB
+    # Conservative cap for the exec FALLBACK path only (ARG_MAX / stdout
+    # truncation). The host-filesystem path has no such limit.
+    _EXEC_FALLBACK_MAX_BYTES = 256 * 1024
+
+    def _host_query_dir(self, subdir: str, query_id) -> str | None:
+        """Host path for ``/workspace/<subdir>/<query_id>`` when LangBot can
+        access the bind-mounted workspace directly, else ``None``.
+
+        ``default_workspace`` is the host directory bind-mounted to
+        ``/workspace`` for the local docker/nsjail backends and shared
+        outright in stdio mode, so a file written there by LangBot is visible
+        to the sandbox (and vice-versa). It is ``None`` / not a local dir for
+        E2B and remote runtimes, where we must fall back to the exec channel.
+        """
+        root = self.default_workspace
+        if not root or not os.path.isdir(root):
+            return None
+        return os.path.join(root, subdir, str(query_id))
+
+    @staticmethod
+    def _sanitize_attachment_name(name: str, fallback: str) -> str:
+        """Reduce an arbitrary attachment name to a safe basename.
+
+        Strips directory separators and parent refs so a crafted file name
+        can never escape the inbox/outbox directory.
+        """
+        base = os.path.basename(str(name or '').replace('\\', '/').strip())
+        base = base.lstrip('.') or ''
+        # Drop anything that is not a conservative filename charset.
+        cleaned = ''.join(c for c in base if c.isalnum() or c in ('.', '_', '-', ' ')).strip()
+        cleaned = cleaned.replace(' ', '_')
+        return cleaned or fallback
+
+    @staticmethod
+    async def _component_to_bytes(component) -> tuple[bytes, str] | None:
+        """Best-effort extraction of (bytes, mime) from a platform component.
+
+        Handles base64, http(s) url and local path sources. Returns None when
+        no payload can be resolved.
+        """
+        import base64 as _b64
+
+        b64 = getattr(component, 'base64', None)
+        if b64:
+            data = b64
+            mime = 'application/octet-stream'
+            if isinstance(data, str) and data.startswith('data:'):
+                split_index = data.find(';base64,')
+                if split_index != -1:
+                    mime = data[5:split_index]
+                    data = data[split_index + 8 :]
+            try:
+                return _b64.b64decode(data), mime
+            except Exception:
+                return None
+
+        url = getattr(component, 'url', None)
+        if url:
+            try:
+                import httpx
+
+                async with httpx.AsyncClient(timeout=30) as client:
+                    resp = await client.get(url)
+                    resp.raise_for_status()
+                    return resp.content, resp.headers.get('Content-Type', 'application/octet-stream')
+            except Exception:
+                return None
+
+        path = getattr(component, 'path', None)
+        if path:
+            try:
+                import aiofiles
+
+                async with aiofiles.open(path, 'rb') as f:
+                    return await f.read(), 'application/octet-stream'
+            except Exception:
+                return None
+
+        return None
+
+    async def _write_files_into_sandbox(
+        self,
+        query: pipeline_query.Query,
+        subdir: str,
+        target_mount_dir: str,
+        files: list[tuple[str, bytes]],
+    ) -> list[str]:
+        """Write *files* (name, bytes) into the per-query directory.
+
+        Prefers a direct host-filesystem write to the bind-mounted workspace
+        (no size limit). Falls back to a base64-through-exec round-trip only
+        when the workspace is not visible on the LangBot host (E2B / remote).
+        Returns the list of in-sandbox paths actually written.
+        """
+        if not files:
+            return []
+
+        host_dir = self._host_query_dir(subdir, query.query_id)
+        if host_dir is not None:
+            return await asyncio.to_thread(self._write_files_host, host_dir, target_mount_dir, files)
+
+        return await self._write_files_via_exec(query, target_mount_dir, files)
+
+    def _write_files_host(
+        self,
+        host_dir: str,
+        target_mount_dir: str,
+        files: list[tuple[str, bytes]],
+    ) -> list[str]:
+        """Write attachments straight onto the bind-mounted host directory.
+
+        Recreates the per-query directory from scratch so a reused query_id
+        (the webchat session uses small sequential ids) never inherits stale
+        files from an earlier turn.
+        """
+        import shutil
+
+        shutil.rmtree(host_dir, ignore_errors=True)
+        os.makedirs(host_dir, exist_ok=True)
+        written: list[str] = []
+        for name, data in files:
+            with open(os.path.join(host_dir, name), 'wb') as fh:
+                fh.write(data)
+            written.append(f'{target_mount_dir}/{name}')
+        return written
+
+    async def _write_files_via_exec(
+        self,
+        query: pipeline_query.Query,
+        target_dir: str,
+        files: list[tuple[str, bytes]],
+    ) -> list[str]:
+        """Fallback: ship files into the sandbox over the exec channel.
+
+        Only used for backends without host-filesystem access (E2B / remote).
+        Each file is base64-decoded inside the sandbox. Files larger than the
+        conservative exec cap are skipped (ARG_MAX / stdout limits).
+        """
+        import base64 as _b64
+        import json as _json
+
+        manifest = []
+        for name, data in files:
+            if len(data) > self._EXEC_FALLBACK_MAX_BYTES:
+                self.ap.logger.warning(
+                    f'Attachment "{name}" ({len(data)} bytes) exceeds the exec-channel '
+                    f'fallback limit ({self._EXEC_FALLBACK_MAX_BYTES} bytes); skipping. '
+                    f'Configure a host-shared workspace to transfer large files.'
+                )
+                continue
+            manifest.append({'name': name, 'b64': _b64.b64encode(data).decode('ascii')})
+        if not manifest:
+            return []
+
+        manifest_b64 = _b64.b64encode(_json.dumps(manifest).encode('utf-8')).decode('ascii')
+        script = (
+            'import base64, json, os, shutil\n'
+            f'target = {target_dir!r}\n'
+            'shutil.rmtree(target, ignore_errors=True)\n'
+            'os.makedirs(target, exist_ok=True)\n'
+            f'manifest = json.loads(base64.b64decode({manifest_b64!r}))\n'
+            'written = []\n'
+            'for item in manifest:\n'
+            "    p = os.path.join(target, item['name'])\n"
+            "    with open(p, 'wb') as f:\n"
+            "        f.write(base64.b64decode(item['b64']))\n"
+            '    written.append(p)\n'
+            'print(json.dumps(written))\n'
+        )
+        result = await self.execute_tool(
+            {'command': f"python3 - <<'LBPY'\n{script}\nLBPY", 'timeout_sec': 120},
+            query,
+        )
+        if not result.get('ok'):
+            self.ap.logger.warning(
+                f'Failed to write inbound attachments into sandbox via exec: '
+                f'query_id={query.query_id} stderr={result.get("stderr", "")[:200]}'
+            )
+            return []
+        try:
+            return _json.loads(str(result.get('stdout') or '').strip().splitlines()[-1])
+        except Exception:
+            return []
+
+    async def materialize_inbound_attachments(self, query: pipeline_query.Query) -> list[dict]:
+        """Persist message-chain attachments into the sandbox inbox.
+
+        Returns a list of ``{path, name, type, size}`` describing what was
+        written, so the runner can tell the LLM the exact in-sandbox paths.
+        Returns ``[]`` when sandbox is unavailable or there are no attachments.
+        """
+        if not self._available:
+            return []
+
+        import langbot_plugin.api.entities.builtin.platform.message as platform_message
+
+        message_chain = getattr(query, 'message_chain', None)
+        if not message_chain:
+            return []
+
+        type_map = [
+            (platform_message.Image, 'Image', 'image', 'png'),
+            (platform_message.Voice, 'Voice', 'voice', 'wav'),
+            (platform_message.File, 'File', 'file', 'bin'),
+        ]
+
+        pending: list[tuple[str, bytes]] = []
+        descriptors: list[dict] = []
+        index = 0
+        for component in message_chain:
+            matched = None
+            for cls, kind, prefix, default_ext in type_map:
+                if isinstance(component, cls):
+                    matched = (kind, prefix, default_ext)
+                    break
+            if matched is None:
+                continue
+            kind, prefix, default_ext = matched
+
+            payload = await self._component_to_bytes(component)
+            if payload is None:
+                continue
+            data, _mime = payload
+            if not data or len(data) > self._ATTACHMENT_MAX_BYTES:
+                continue
+
+            index += 1
+            raw_name = getattr(component, 'name', None) or f'{prefix}_{index}.{default_ext}'
+            safe_name = self._sanitize_attachment_name(raw_name, f'{prefix}_{index}.{default_ext}')
+            pending.append((safe_name, data))
+            descriptors.append(
+                {
+                    'name': safe_name,
+                    'type': kind,
+                    'size': len(data),
+                }
+            )
+
+        if not pending:
+            return []
+
+        target_dir = f'{self.INBOX_MOUNT_DIR}/{query.query_id}'
+        written = await self._write_files_into_sandbox(query, self.INBOX_SUBDIR, target_dir, pending)
+        written_basenames = {os.path.basename(p) for p in written}
+
+        result: list[dict] = []
+        for desc in descriptors:
+            if desc['name'] in written_basenames:
+                desc['path'] = f'{target_dir}/{desc["name"]}'
+                result.append(desc)
+        if result:
+            self.ap.logger.info(
+                f'Materialized {len(result)} inbound attachment(s) into sandbox: '
+                f'query_id={query.query_id} dir={target_dir}'
+            )
+        return result
+
+    async def collect_outbound_attachments(self, query: pipeline_query.Query) -> list[dict]:
+        """Collect files the agent produced in the sandbox outbox.
+
+        Reads ``/workspace/outbox/<query_id>/`` (recursively) — directly from
+        the bind-mounted host directory when available (no size limit), else
+        via the exec channel — returns a list of ``{type, name, base64}``
+        ready to become platform message components, then clears the outbox so
+        a later turn in the same session does not re-send stale files. Returns
+        ``[]`` when nothing was produced.
+        """
+        if not self._available:
+            return []
+
+        host_dir = self._host_query_dir(self.OUTBOX_SUBDIR, query.query_id)
+        if host_dir is not None:
+            entries = await asyncio.to_thread(self._read_outbox_host, host_dir)
+        else:
+            entries = await self._read_outbox_via_exec(query)
+
+        attachments = self._classify_outbound_entries(entries)
+
+        if attachments:
+            await self._clear_outbox(query, host_dir)
+            self.ap.logger.info(
+                f'Collected {len(attachments)} outbound attachment(s) from sandbox: query_id={query.query_id}'
+            )
+        return attachments
+
+    def _read_outbox_host(self, host_dir: str) -> list[dict]:
+        """Read outbox files straight off the bind-mounted host directory."""
+        import base64 as _b64
+
+        entries: list[dict] = []
+        if not os.path.isdir(host_dir):
+            return entries
+        for root, _dirs, names in os.walk(host_dir):
+            for name in sorted(names):
+                path = os.path.join(root, name)
+                try:
+                    if os.path.getsize(path) > self._ATTACHMENT_MAX_BYTES:
+                        continue
+                    with open(path, 'rb') as fh:
+                        data = fh.read()
+                except OSError:
+                    continue
+                rel = os.path.relpath(path, host_dir)
+                entries.append({'name': rel, 'b64': _b64.b64encode(data).decode('ascii')})
+        return entries
+
+    async def _read_outbox_via_exec(self, query: pipeline_query.Query) -> list[dict]:
+        """Fallback: read the outbox over the exec channel (E2B / remote).
+
+        Note: exec stdout is truncated by ``output_limit_chars``, so this path
+        only reliably transfers small files. The host path is preferred.
+        """
+        import json as _json
+
+        target_dir = f'{self.OUTBOX_MOUNT_DIR}/{query.query_id}'
+        max_bytes = self._EXEC_FALLBACK_MAX_BYTES
+        script = (
+            'import base64, json, os\n'
+            f'target = {target_dir!r}\n'
+            f'max_bytes = {max_bytes}\n'
+            'out = []\n'
+            'if os.path.isdir(target):\n'
+            '    for root, _dirs, names in os.walk(target):\n'
+            '        for n in sorted(names):\n'
+            '            p = os.path.join(root, n)\n'
+            '            try:\n'
+            '                if os.path.getsize(p) > max_bytes:\n'
+            '                    continue\n'
+            "                with open(p, 'rb') as f:\n"
+            '                    data = f.read()\n'
+            '            except OSError:\n'
+            '                continue\n'
+            '            rel = os.path.relpath(p, target)\n'
+            "            out.append({'name': rel, 'b64': base64.b64encode(data).decode('ascii')})\n"
+            'print(json.dumps(out))\n'
+        )
+        result = await self.execute_tool(
+            {'command': f"python3 - <<'LBPY'\n{script}\nLBPY", 'timeout_sec': 120},
+            query,
+        )
+        if not result.get('ok'):
+            return []
+        try:
+            return _json.loads(str(result.get('stdout') or '').strip().splitlines()[-1])
+        except Exception:
+            return []
+
+    async def _clear_outbox(self, query: pipeline_query.Query, host_dir: str | None) -> None:
+        """Empty the per-query outbox after collection (host or exec)."""
+        if host_dir is not None:
+            import shutil
+
+            def _clear():
+                shutil.rmtree(host_dir, ignore_errors=True)
+                os.makedirs(host_dir, exist_ok=True)
+
+            await asyncio.to_thread(_clear)
+            return
+        target_dir = f'{self.OUTBOX_MOUNT_DIR}/{query.query_id}'
+        await self.execute_tool(
+            {'command': f'rm -rf {target_dir} && mkdir -p {target_dir}', 'timeout_sec': 30},
+            query,
+        )
+
+    @staticmethod
+    def _classify_outbound_entries(entries: list[dict]) -> list[dict]:
+        """Classify outbox files into Image/Voice/File component descriptors."""
+        image_exts = {'png', 'jpg', 'jpeg', 'gif', 'webp', 'bmp'}
+        voice_exts = {'wav', 'mp3', 'silk', 'amr', 'ogg', 'm4a', 'aac'}
+        mime_by_ext = {
+            'png': 'image/png',
+            'jpg': 'image/jpeg',
+            'jpeg': 'image/jpeg',
+            'gif': 'image/gif',
+            'webp': 'image/webp',
+            'bmp': 'image/bmp',
+        }
+        attachments: list[dict] = []
+        for entry in entries or []:
+            name = str(entry.get('name', '') or '')
+            b64 = entry.get('b64')
+            if not name or not b64:
+                continue
+            ext = name.rsplit('.', 1)[-1].lower() if '.' in name else ''
+            base_name = os.path.basename(name)
+            if ext in image_exts:
+                mime = mime_by_ext.get(ext, 'image/png')
+                attachments.append({'type': 'Image', 'name': base_name, 'base64': f'data:{mime};base64,{b64}'})
+            elif ext in voice_exts:
+                attachments.append({'type': 'Voice', 'name': base_name, 'base64': f'data:audio/{ext};base64,{b64}'})
+            else:
+                attachments.append({'type': 'File', 'name': base_name, 'base64': b64})
+        return attachments
+
     async def shutdown(self):
         await self.client.shutdown()
 

src/langbot/pkg/pipeline/wrapper/wrapper.py

@@ -7,6 +7,7 @@ from .. import stage
 
 import langbot_plugin.api.entities.builtin.platform.message as platform_message
 import langbot_plugin.api.entities.builtin.pipeline.query as pipeline_query
+import langbot_plugin.api.entities.builtin.provider.message as provider_message
 import langbot_plugin.api.entities.events as events
 
 
@@ -23,6 +24,50 @@ class ResponseWrapper(stage.PipelineStage):
     async def initialize(self, pipeline_config: dict):
         pass
 
+    def _is_final_assistant_message(self, result) -> bool:
+        """Whether *result* is the agent's final, tool-call-free answer.
+
+        Intermediate streaming chunks and tool-call rounds must NOT trigger
+        outbound attachment collection — only the terminal assistant message.
+        """
+        if getattr(result, 'role', None) != 'assistant':
+            return False
+        if result.tool_calls:
+            return False
+        if isinstance(result, provider_message.MessageChunk):
+            return bool(result.is_final)
+        return True
+
+    async def _append_outbound_attachments(
+        self,
+        query: pipeline_query.Query,
+        message_chain: platform_message.MessageChain,
+    ) -> None:
+        """Collect sandbox outbox files and append them to *message_chain*.
+
+        Runs at most once per query (guarded by a query variable) and never
+        raises into the pipeline — attachment delivery is best-effort.
+        """
+        if query.variables.get('_sandbox_outbound_collected'):
+            return
+        box_service = getattr(self.ap, 'box_service', None)
+        if box_service is None or not getattr(box_service, 'available', False):
+            return
+        query.variables['_sandbox_outbound_collected'] = True
+        try:
+            attachments = await box_service.collect_outbound_attachments(query)
+        except Exception as e:
+            self.ap.logger.warning(f'Outbound attachment collection failed: {e}')
+            return
+        for att in attachments:
+            att_type = att.get('type')
+            if att_type == 'Image':
+                message_chain.append(platform_message.Image(base64=att['base64']))
+            elif att_type == 'Voice':
+                message_chain.append(platform_message.Voice(base64=att['base64']))
+            else:
+                message_chain.append(platform_message.File(name=att.get('name', 'file'), base64=att['base64']))
+
     async def process(
         self,
         query: pipeline_query.Query,
@@ -83,10 +128,16 @@ class ResponseWrapper(stage.PipelineStage):
                             )
                         else:
                             if event_ctx.event.reply_message_chain is not None:
-                                query.resp_message_chain.append(event_ctx.event.reply_message_chain)
+                                reply_chain = event_ctx.event.reply_message_chain
-
                             else:
-                                query.resp_message_chain.append(result.get_content_platform_message_chain())
+                                reply_chain = result.get_content_platform_message_chain()
+
+                            # Attach files the agent produced in the sandbox
+                            # outbox, but only on the terminal assistant message.
+                            if self._is_final_assistant_message(result):
+                                await self._append_outbound_attachments(query, reply_chain)
+
+                            query.resp_message_chain.append(reply_chain)
 
                             yield entities.StageProcessResult(
                                 result_type=entities.ResultType.CONTINUE,

src/langbot/pkg/platform/sources/websocket_adapter.py

@@ -312,12 +312,18 @@ class WebSocketAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter)
 
     async def _process_image_components(self, message_chain_obj: list):
         """
-        处理消息链中的图片和文件组件，将path转换为base64
+        处理消息链中的图片、语音和文件组件，将 path 转换为 base64
+
+        Image / Voice / File components uploaded from the web client carry a
+        storage key in ``path``. Resolve it to a base64 data URI so downstream
+        stages (multimodal LLM input and the Box sandbox inbox) have a usable
+        payload, then drop the now-consumed storage object.
 
         Args:
             message_chain_obj: 消息链对象列表
         """
         import base64
+        import mimetypes
 
         storage_mgr = self.ap.storage_mgr
 
@@ -325,31 +331,33 @@ class WebSocketAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter)
             comp_type = component.get('type', '')
             comp_path = component.get('path', '')
 
-            if not comp_path:
+            if not comp_path or comp_type not in ('Image', 'Voice', 'File'):
                 continue
 
-            if comp_type == 'Image':
+            try:
-                try:
+                file_content = await storage_mgr.storage_provider.load(comp_path)
-                    file_content = await storage_mgr.storage_provider.load(comp_path)
+                base64_str = base64.b64encode(file_content).decode('utf-8')
-                    base64_str = base64.b64encode(file_content).decode('utf-8')
 
-                    file_key = comp_path
+                lowered = comp_path.lower()
-                    if file_key.lower().endswith(('.jpg', '.jpeg')):
+                if comp_type == 'Image':
+                    if lowered.endswith(('.jpg', '.jpeg')):
                         mime_type = 'image/jpeg'
-                    elif file_key.lower().endswith('.png'):
+                    elif lowered.endswith('.gif'):
-                        mime_type = 'image/png'
-                    elif file_key.lower().endswith('.gif'):
                         mime_type = 'image/gif'
-                    elif file_key.lower().endswith('.webp'):
+                    elif lowered.endswith('.webp'):
                         mime_type = 'image/webp'
                     else:
                         mime_type = 'image/png'
+                elif comp_type == 'Voice':
+                    mime_type = mimetypes.guess_type(comp_path)[0] or 'audio/wav'
+                else:  # File
+                    mime_type = mimetypes.guess_type(comp_path)[0] or 'application/octet-stream'
 
-                    component['base64'] = f'data:{mime_type};base64,{base64_str}'
+                component['base64'] = f'data:{mime_type};base64,{base64_str}'
-                    await storage_mgr.storage_provider.delete(comp_path)
+                await storage_mgr.storage_provider.delete(comp_path)
-                    component['path'] = ''
+                component['path'] = ''
-                except Exception as e:
+            except Exception as e:
-                    await self.logger.error(f'Failed to load image file {comp_path}: {e}')
+                await self.logger.error(f'Failed to load {comp_type} file {comp_path}: {e}')
 
     async def handle_websocket_message(
         self,

src/langbot/pkg/provider/modelmgr/requesters/litellmchat.py

@@ -216,11 +216,22 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
             content = msg_dict.get('content')
 
             if isinstance(content, list):
+                converted_parts = []
                 for part in content:
                     if isinstance(part, dict) and part.get('type') == 'image_base64':
                         part['image_url'] = {'url': part['image_base64']}
                         part['type'] = 'image_url'
                         del part['image_base64']
+                    # OpenAI-compatible chat models reject non-image file parts
+                    # (audio/document base64 or url). These originate from Voice /
+                    # File attachments — including ones replayed from conversation
+                    # history — and the agent already accesses their bytes via the
+                    # sandbox. Drop them from the model payload to avoid
+                    # "Invalid user message ... invalid content type=file_base64".
+                    if isinstance(part, dict) and part.get('type') in ('file_base64', 'file_url'):
+                        continue
+                    converted_parts.append(part)
+                msg_dict['content'] = converted_parts
 
             req_messages.append(msg_dict)
 

src/langbot/pkg/provider/runners/localagent.py

@@ -104,6 +104,68 @@ class _StreamAccumulator:
 class LocalAgentRunner(runner.RequestRunner):
     """Local agent request runner"""
 
+    async def _inject_inbound_attachments(
+        self,
+        query: pipeline_query.Query,
+        user_message: provider_message.Message,
+    ) -> None:
+        """Persist inbound attachments into the sandbox and tell the model.
+
+        No-op when the box service is unavailable or there are no attachments.
+        On success, appends an extra text ContentElement to the user message
+        listing the in-sandbox paths and the outbox convention, and stashes the
+        descriptors in ``query.variables['_sandbox_inbound_attachments']``.
+        """
+        box_service = getattr(self.ap, 'box_service', None)
+        if box_service is None or not getattr(box_service, 'available', False):
+            return
+        try:
+            attachments = await box_service.materialize_inbound_attachments(query)
+        except Exception as e:  # never break the chat turn over attachment IO
+            self.ap.logger.warning(f'Inbound attachment materialization failed: {e}')
+            return
+        if not attachments:
+            return
+
+        query.variables['_sandbox_inbound_attachments'] = attachments
+
+        lines = [
+            'The user sent attachments. They have been saved into the sandbox and are '
+            'available to the exec/read/write tools at these paths:'
+        ]
+        for att in attachments:
+            lines.append(f'- {att["type"]}: {att["path"]} ({att["size"]} bytes)')
+        outbox_dir = f'{box_service.OUTBOX_MOUNT_DIR}/{query.query_id}'
+        lines.append(
+            'If you produce any file (image, audio, document, etc.) that should be sent '
+            f'back to the user, write it into {outbox_dir}/ (create the directory if '
+            'needed). Every file placed there will be delivered to the user automatically.'
+        )
+        note = '\n'.join(lines)
+
+        # Voice/File attachments are now available to the agent via the sandbox
+        # (exec/read/write tools). Their raw bytes must NOT be forwarded to the
+        # chat model as multimodal content: providers reject non-image file
+        # parts ("Invalid user message ... ensure all user messages are valid
+        # OpenAI chat completion messages"). Strip those content elements and
+        # rely on the sandbox-path note instead. Images are kept so vision
+        # models can still see them.
+        _model_unsafe_types = {'file_base64', 'file_url'}
+        if isinstance(user_message.content, list):
+            user_message.content = [
+                ce for ce in user_message.content if getattr(ce, 'type', None) not in _model_unsafe_types
+            ]
+
+        if isinstance(user_message.content, str):
+            user_message.content = [
+                provider_message.ContentElement.from_text(user_message.content),
+                provider_message.ContentElement.from_text(note),
+            ]
+        elif isinstance(user_message.content, list):
+            user_message.content.append(provider_message.ContentElement.from_text(note))
+        else:
+            user_message.content = [provider_message.ContentElement.from_text(note)]
+
     def _build_request_messages(
         self,
         query: pipeline_query.Query,
@@ -232,6 +294,12 @@ class LocalAgentRunner(runner.RequestRunner):
 
         user_message = copy.deepcopy(query.user_message)
 
+        # Materialize inbound attachments (images / voices / files) into the
+        # sandbox so the agent's exec/read/write tools can operate on the real
+        # bytes — not just the multimodal copy the model sees. The exact
+        # in-sandbox paths are announced to the model as a system note.
+        await self._inject_inbound_attachments(query, user_message)
+
         user_message_text = ''
 
         if isinstance(user_message.content, str):

tests/unit_tests/box/test_box_service.py

@@ -1556,3 +1556,255 @@ class TestBuildSkillExtraMounts:
         service = BoxService(app, client=Mock(spec=BoxRuntimeClient))
 
         assert service.build_skill_extra_mounts(make_query()) == []
+
+
+# ── Attachment passthrough (inbound / outbound) ─────────────────────────────
+
+
+class TestAttachmentHelpers:
+    def test_sanitize_attachment_name_strips_traversal(self):
+        assert BoxService._sanitize_attachment_name('../../etc/passwd', 'fb') == 'passwd'
+        assert BoxService._sanitize_attachment_name('/a/b/c.png', 'fb') == 'c.png'
+        assert BoxService._sanitize_attachment_name('a b c.txt', 'fb') == 'a_b_c.txt'
+        assert BoxService._sanitize_attachment_name('', 'fallback.bin') == 'fallback.bin'
+        assert BoxService._sanitize_attachment_name('...', 'fb.bin') == 'fb.bin'
+        # weird unicode / shell chars dropped, but keeps a usable name
+        out = BoxService._sanitize_attachment_name('rm -rf $(x).png', 'fb')
+        assert '/' not in out and '$' not in out and out.endswith('.png')
+
+    def test_classify_outbound_entries_by_extension(self):
+        entries = [
+            {'name': 'chart.png', 'b64': 'AAA'},
+            {'name': 'clip.mp3', 'b64': 'BBB'},
+            {'name': 'report.pdf', 'b64': 'CCC'},
+            {'name': 'sub/dir/photo.JPG', 'b64': 'DDD'},
+            {'name': 'noext', 'b64': 'EEE'},
+            {'name': 'skip', 'b64': ''},  # dropped (no payload)
+        ]
+        out = BoxService._classify_outbound_entries(entries)
+        by_name = {a['name']: a for a in out}
+        assert by_name['chart.png']['type'] == 'Image'
+        assert by_name['chart.png']['base64'].startswith('data:image/png;base64,')
+        assert by_name['clip.mp3']['type'] == 'Voice'
+        assert by_name['clip.mp3']['base64'].startswith('data:audio/mp3;base64,')
+        assert by_name['report.pdf']['type'] == 'File'
+        assert by_name['report.pdf']['base64'] == 'CCC'  # raw b64, no data: prefix
+        # nested path collapses to basename, case-insensitive ext
+        assert by_name['photo.JPG']['type'] == 'Image'
+        assert by_name['noext']['type'] == 'File'
+        assert 'skip' not in by_name
+
+    @pytest.mark.asyncio
+    async def test_component_to_bytes_from_data_uri(self):
+        import base64
+
+        raw = b'hello-bytes'
+        data_uri = 'data:text/plain;base64,' + base64.b64encode(raw).decode()
+        component = SimpleNamespace(base64=data_uri, url=None, path=None)
+        result = await BoxService._component_to_bytes(component)
+        assert result is not None
+        data, mime = result
+        assert data == raw
+        assert mime == 'text/plain'
+
+    @pytest.mark.asyncio
+    async def test_component_to_bytes_returns_none_when_empty(self):
+        component = SimpleNamespace(base64=None, url=None, path=None)
+        assert await BoxService._component_to_bytes(component) is None
+
+
+class TestInboundOutboundRoundTrip:
+    def _service(self) -> BoxService:
+        service = BoxService(make_app(Mock()), client=Mock(spec=BoxRuntimeClient))
+        service._available = True
+        return service
+
+    @pytest.mark.asyncio
+    async def test_materialize_inbound_writes_and_describes(self):
+        import base64
+
+        import langbot_plugin.api.entities.builtin.platform.message as platform_message
+
+        service = self._service()
+
+        img_bytes = b'\x89PNG\r\n\x1a\n fake png'
+        img_b64 = 'data:image/png;base64,' + base64.b64encode(img_bytes).decode()
+
+        query = make_query()
+        query.message_chain = platform_message.MessageChain(
+            [
+                platform_message.Plain(text='please resize this'),
+                platform_message.Image(base64=img_b64),
+            ]
+        )
+
+        # Mock the sandbox write path: echo back the written paths.
+        async def fake_execute_tool(parameters, q):
+            assert '/workspace/inbox/' in parameters['command']
+            return {
+                'ok': True,
+                'stdout': '["/workspace/inbox/42/image_1.png"]',
+                'stderr': '',
+            }
+
+        service.execute_tool = AsyncMock(side_effect=fake_execute_tool)
+
+        descriptors = await service.materialize_inbound_attachments(query)
+        assert len(descriptors) == 1
+        d = descriptors[0]
+        assert d['type'] == 'Image'
+        assert d['path'] == '/workspace/inbox/42/image_1.png'
+        assert d['size'] == len(img_bytes)
+
+    @pytest.mark.asyncio
+    async def test_materialize_inbound_noop_without_attachments(self):
+        import langbot_plugin.api.entities.builtin.platform.message as platform_message
+
+        service = self._service()
+        query = make_query()
+        query.message_chain = platform_message.MessageChain([platform_message.Plain(text='just text')])
+        service.execute_tool = AsyncMock()
+        assert await service.materialize_inbound_attachments(query) == []
+        service.execute_tool.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_collect_outbound_reads_and_clears(self):
+        service = self._service()
+        query = make_query()
+
+        calls = []
+
+        async def fake_execute_tool(parameters, q):
+            calls.append(parameters['command'])
+            if 'os.walk' in parameters['command']:
+                return {
+                    'ok': True,
+                    'stdout': '[{"name": "out.png", "b64": "QUJD"}]',
+                    'stderr': '',
+                }
+            # the rm -rf cleanup call
+            return {'ok': True, 'stdout': '', 'stderr': ''}
+
+        service.execute_tool = AsyncMock(side_effect=fake_execute_tool)
+
+        attachments = await service.collect_outbound_attachments(query)
+        assert len(attachments) == 1
+        assert attachments[0]['type'] == 'Image'
+        assert attachments[0]['name'] == 'out.png'
+        # cleanup (rm -rf) must have been issued after a successful collection
+        assert any('rm -rf' in c for c in calls)
+
+    @pytest.mark.asyncio
+    async def test_collect_outbound_empty_no_cleanup(self):
+        service = self._service()
+        query = make_query()
+
+        calls = []
+
+        async def fake_execute_tool(parameters, q):
+            calls.append(parameters['command'])
+            return {'ok': True, 'stdout': '[]', 'stderr': ''}
+
+        service.execute_tool = AsyncMock(side_effect=fake_execute_tool)
+        assert await service.collect_outbound_attachments(query) == []
+        assert not any('rm -rf' in c for c in calls)
+
+    @pytest.mark.asyncio
+    async def test_passthrough_noop_when_unavailable(self):
+        service = BoxService(make_app(Mock()), client=Mock(spec=BoxRuntimeClient))
+        service._available = False
+        query = make_query()
+        assert await service.materialize_inbound_attachments(query) == []
+        assert await service.collect_outbound_attachments(query) == []
+
+
+class TestAttachmentHostPath:
+    """Direct host-filesystem transfer path (bind-mounted workspace).
+
+    When ``default_workspace`` is a real local dir, inbound/outbound bypass the
+    exec channel entirely (no ARG_MAX / stdout-truncation limits) and read/write
+    the bind-mounted host dir directly.
+    """
+
+    def _service_with_workspace(self, tmp_path):
+        ws = str(tmp_path / 'box' / 'default')
+        os.makedirs(ws, exist_ok=True)
+        app = make_app(Mock(), allowed_mount_roots=[str(tmp_path)], host_root=str(tmp_path / 'box'))
+        service = BoxService(app, client=Mock(spec=BoxRuntimeClient))
+        service._available = True
+        # Force the default_workspace to our tmp dir so _host_query_dir resolves.
+        service.default_workspace = ws
+        return service, ws
+
+    @pytest.mark.asyncio
+    async def test_inbound_writes_to_host_no_exec(self, tmp_path):
+        import base64
+
+        import langbot_plugin.api.entities.builtin.platform.message as platform_message
+
+        service, ws = self._service_with_workspace(tmp_path)
+        # Big payload that would blow ARG_MAX on the exec path:
+        big = b'\x89PNG\r\n\x1a\n' + b'x' * (300 * 1024)
+        b64 = 'data:image/png;base64,' + base64.b64encode(big).decode()
+        query = make_query()
+        query.message_chain = platform_message.MessageChain([platform_message.Image(base64=b64)])
+        # execute_tool must NOT be called on the host path.
+        service.execute_tool = AsyncMock(side_effect=AssertionError('exec must not be used on host path'))
+
+        descriptors = await service.materialize_inbound_attachments(query)
+        assert len(descriptors) == 1
+        d = descriptors[0]
+        assert d['type'] == 'Image'
+        assert d['size'] == len(big)
+        # File actually landed on the host workspace.
+        host_file = os.path.join(ws, 'inbox', str(query.query_id), d['name'])
+        assert os.path.isfile(host_file)
+        assert open(host_file, 'rb').read() == big
+
+    @pytest.mark.asyncio
+    async def test_inbound_host_clears_stale_query_dir(self, tmp_path):
+        import base64
+
+        import langbot_plugin.api.entities.builtin.platform.message as platform_message
+
+        service, ws = self._service_with_workspace(tmp_path)
+        # Seed a stale file under the same query_id (simulates webchat id reuse).
+        stale_dir = os.path.join(ws, 'inbox', '42')
+        os.makedirs(stale_dir, exist_ok=True)
+        open(os.path.join(stale_dir, 'image_1.png'), 'wb').write(b'STALE-OLD-IMAGE')
+
+        new = b'\x89PNG\r\n\x1a\n NEW'
+        b64 = 'data:image/png;base64,' + base64.b64encode(new).decode()
+        query = make_query(query_id=42)
+        query.message_chain = platform_message.MessageChain([platform_message.Image(base64=b64)])
+        service.execute_tool = AsyncMock()
+        descriptors = await service.materialize_inbound_attachments(query)
+        # The new write recreated the dir; the stale file is gone, new bytes present.
+        host_file = os.path.join(stale_dir, descriptors[0]['name'])
+        assert open(host_file, 'rb').read() == new
+        # No leftover content from the stale image.
+        assert b'STALE-OLD-IMAGE' not in open(host_file, 'rb').read()
+
+    @pytest.mark.asyncio
+    async def test_outbound_reads_host_and_clears(self, tmp_path):
+        service, ws = self._service_with_workspace(tmp_path)
+        query = make_query()
+        outbox = os.path.join(ws, 'outbox', str(query.query_id))
+        os.makedirs(outbox, exist_ok=True)
+        # A large file that would be truncated on the exec/stdout path:
+        big_png = b'\x89PNG\r\n\x1a\n' + b'y' * (400 * 1024)
+        open(os.path.join(outbox, 'result.png'), 'wb').write(big_png)
+        open(os.path.join(outbox, 'notes.txt'), 'wb').write(b'hello')
+
+        service.execute_tool = AsyncMock(side_effect=AssertionError('exec must not be used on host path'))
+        attachments = await service.collect_outbound_attachments(query)
+        by_name = {a['name']: a for a in attachments}
+        assert by_name['result.png']['type'] == 'Image'
+        assert by_name['notes.txt']['type'] == 'File'
+        # Full image survived (no truncation).
+        import base64
+
+        raw = base64.b64decode(by_name['result.png']['base64'].split(',', 1)[-1])
+        assert raw == big_png
+        # Outbox cleared after collection.
+        assert os.listdir(outbox) == []

tests/unit_tests/pipeline/test_wrapper_outbound_attachments.py

@@ -0,0 +1,146 @@
+"""Unit tests for ResponseWrapper outbound-attachment helpers.
+
+Covers the sandbox -> user attachment path added for the Box attachment
+round-trip:
+
+* ``_is_final_assistant_message`` — only the terminal, tool-call-free assistant
+  message (or a final MessageChunk) should trigger collection.
+* ``_append_outbound_attachments`` — collects sandbox outbox files exactly once
+  per query and maps each descriptor to the right platform component, swallowing
+  collection errors.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+import langbot_plugin.api.entities.builtin.platform.message as platform_message
+import langbot_plugin.api.entities.builtin.provider.message as provider_message
+
+from langbot.pkg.pipeline.wrapper.wrapper import ResponseWrapper
+
+
+def _make_wrapper(box_service) -> ResponseWrapper:
+    app = SimpleNamespace(logger=Mock())
+    wrapper = ResponseWrapper.__new__(ResponseWrapper)
+    wrapper.ap = app
+    return wrapper
+
+
+def _make_query():
+    return SimpleNamespace(variables={})
+
+
+def test_is_final_assistant_message_plain_assistant():
+    wrapper = _make_wrapper(box_service=None)
+    msg = provider_message.Message(role='assistant', content='done')
+    assert wrapper._is_final_assistant_message(msg) is True
+
+
+def test_is_final_assistant_message_rejects_non_assistant():
+    wrapper = _make_wrapper(box_service=None)
+    msg = provider_message.Message(role='tool', content='{}')
+    assert wrapper._is_final_assistant_message(msg) is False
+
+
+def test_is_final_assistant_message_rejects_tool_call_round():
+    wrapper = _make_wrapper(box_service=None)
+    msg = provider_message.Message(
+        role='assistant',
+        content='calling',
+        tool_calls=[
+            provider_message.ToolCall(
+                id='c1',
+                type='function',
+                function=provider_message.FunctionCall(name='exec', arguments='{}'),
+            )
+        ],
+    )
+    assert wrapper._is_final_assistant_message(msg) is False
+
+
+def test_is_final_assistant_message_non_final_chunk():
+    wrapper = _make_wrapper(box_service=None)
+    chunk = provider_message.MessageChunk(role='assistant', content='partial', is_final=False)
+    assert wrapper._is_final_assistant_message(chunk) is False
+
+    final_chunk = provider_message.MessageChunk(role='assistant', content='partial', is_final=True)
+    assert wrapper._is_final_assistant_message(final_chunk) is True
+
+
+@pytest.mark.asyncio
+async def test_append_outbound_attachments_maps_each_type():
+    box_service = SimpleNamespace(
+        available=True,
+        collect_outbound_attachments=AsyncMock(
+            return_value=[
+                {'type': 'Image', 'base64': 'data:image/png;base64,iVBORw0K'},
+                {'type': 'Voice', 'base64': 'data:audio/wav;base64,UklGRg=='},
+                {'type': 'File', 'name': 'report.xlsx', 'base64': 'data:app;base64,UEsDBA=='},
+            ]
+        ),
+    )
+    wrapper = _make_wrapper(box_service)
+    wrapper.ap.box_service = box_service
+    query = _make_query()
+    chain = platform_message.MessageChain([])
+
+    await wrapper._append_outbound_attachments(query, chain)
+
+    kinds = [type(c).__name__ for c in chain]
+    assert kinds == ['Image', 'Voice', 'File']
+    assert query.variables['_sandbox_outbound_collected'] is True
+    # File keeps its name
+    file_comp = chain[2]
+    assert getattr(file_comp, 'name', None) == 'report.xlsx'
+
+
+@pytest.mark.asyncio
+async def test_append_outbound_attachments_runs_once_per_query():
+    box_service = SimpleNamespace(
+        available=True,
+        collect_outbound_attachments=AsyncMock(return_value=[]),
+    )
+    wrapper = _make_wrapper(box_service)
+    wrapper.ap.box_service = box_service
+    query = _make_query()
+    query.variables['_sandbox_outbound_collected'] = True
+    chain = platform_message.MessageChain([])
+
+    await wrapper._append_outbound_attachments(query, chain)
+
+    box_service.collect_outbound_attachments.assert_not_awaited()
+    assert len(chain) == 0
+
+
+@pytest.mark.asyncio
+async def test_append_outbound_attachments_noop_without_box_service():
+    wrapper = _make_wrapper(box_service=None)
+    wrapper.ap.box_service = None
+    query = _make_query()
+    chain = platform_message.MessageChain([])
+
+    await wrapper._append_outbound_attachments(query, chain)
+    assert len(chain) == 0
+    # not marked collected, since service is unavailable
+    assert '_sandbox_outbound_collected' not in query.variables
+
+
+@pytest.mark.asyncio
+async def test_append_outbound_attachments_swallows_collection_error():
+    box_service = SimpleNamespace(
+        available=True,
+        collect_outbound_attachments=AsyncMock(side_effect=RuntimeError('boom')),
+    )
+    wrapper = _make_wrapper(box_service)
+    wrapper.ap.box_service = box_service
+    query = _make_query()
+    chain = platform_message.MessageChain([])
+
+    # must not raise
+    await wrapper._append_outbound_attachments(query, chain)
+    assert len(chain) == 0
+    wrapper.ap.logger.warning.assert_called_once()

tests/unit_tests/platform/test_websocket_adapter_attachments.py

@@ -0,0 +1,92 @@
+"""Unit tests for WebSocketAdapter._process_image_components.
+
+The web debug client uploads Image / Voice / File components carrying a storage
+key in ``path``. This helper resolves each to a base64 data URI (so multimodal
+LLM input and the Box sandbox inbox have usable bytes), then deletes the
+consumed storage object and clears ``path``. Covers mimetype selection per
+type and graceful error handling.
+"""
+
+from __future__ import annotations
+
+import base64
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+from langbot.pkg.platform.sources.websocket_adapter import WebSocketAdapter
+
+
+def _make_adapter(load_return=b'hello', load_side_effect=None):
+    provider = Mock()
+    provider.load = AsyncMock(return_value=load_return, side_effect=load_side_effect)
+    provider.delete = AsyncMock()
+    ap = Mock()
+    ap.storage_mgr.storage_provider = provider
+    logger = Mock()
+    logger.error = AsyncMock()
+    # WebSocketAdapter is a pydantic model; bypass full __init__/validation.
+    adapter = WebSocketAdapter.model_construct(ap=ap, logger=logger)
+    return adapter, provider
+
+
+@pytest.mark.asyncio
+async def test_image_jpeg_mimetype_and_cleanup():
+    adapter, provider = _make_adapter(load_return=b'\xff\xd8\xff')
+    chain = [{'type': 'Image', 'path': 'storage://abc/photo.jpg'}]
+
+    await adapter._process_image_components(chain)
+
+    expected_b64 = base64.b64encode(b'\xff\xd8\xff').decode('utf-8')
+    assert chain[0]['base64'] == f'data:image/jpeg;base64,{expected_b64}'
+    assert chain[0]['path'] == ''  # consumed
+    provider.delete.assert_awaited_once_with('storage://abc/photo.jpg')
+
+
+@pytest.mark.asyncio
+async def test_image_defaults_to_png():
+    adapter, _ = _make_adapter()
+    chain = [{'type': 'Image', 'path': 'storage://abc/blob'}]
+    await adapter._process_image_components(chain)
+    assert chain[0]['base64'].startswith('data:image/png;base64,')
+
+
+@pytest.mark.asyncio
+async def test_voice_uses_guessed_or_wav_mimetype():
+    adapter, _ = _make_adapter()
+    chain = [{'type': 'Voice', 'path': 'storage://abc/clip.wav'}]
+    await adapter._process_image_components(chain)
+    assert chain[0]['base64'].startswith('data:audio/')
+
+
+@pytest.mark.asyncio
+async def test_file_uses_octet_stream_fallback():
+    adapter, _ = _make_adapter()
+    chain = [{'type': 'File', 'path': 'storage://abc/unknownblob'}]
+    await adapter._process_image_components(chain)
+    assert chain[0]['base64'].startswith('data:application/octet-stream;base64,')
+
+
+@pytest.mark.asyncio
+async def test_skips_components_without_path_or_unknown_type():
+    adapter, provider = _make_adapter()
+    chain = [
+        {'type': 'Image', 'path': ''},  # no path
+        {'type': 'Plain', 'path': 'storage://abc/x'},  # not a file component
+        {'type': 'At', 'target': '123'},  # no path key at all
+    ]
+    await adapter._process_image_components(chain)
+    provider.load.assert_not_awaited()
+    assert 'base64' not in chain[0]
+    assert 'base64' not in chain[1]
+
+
+@pytest.mark.asyncio
+async def test_load_failure_is_logged_not_raised():
+    adapter, _ = _make_adapter(load_side_effect=RuntimeError('storage down'))
+    chain = [{'type': 'File', 'path': 'storage://abc/doc.pdf'}]
+
+    # must not raise
+    await adapter._process_image_components(chain)
+    assert 'base64' not in chain[0]
+    adapter.logger.error.assert_awaited_once()

tests/unit_tests/provider/test_litellm_convert_messages.py

@@ -0,0 +1,93 @@
+"""Unit tests for LiteLLMRequester._convert_messages.
+
+Focus: the content-part normalization that (a) converts image_base64 parts to
+the OpenAI image_url shape and (b) drops non-image file parts (file_base64 /
+file_url) which OpenAI-compatible chat models reject. The latter is essential
+for Voice/File attachments — including ones replayed from conversation history —
+since the agent consumes their bytes via the sandbox, not the model payload.
+"""
+
+import langbot_plugin.api.entities.builtin.provider.message as provider_message
+
+from langbot.pkg.provider.modelmgr.requesters.litellmchat import LiteLLMRequester
+
+
+def _make_requester() -> LiteLLMRequester:
+    # _convert_messages does not touch instance config, so bypass __init__.
+    return LiteLLMRequester.__new__(LiteLLMRequester)
+
+
+def test_convert_messages_drops_file_base64_part():
+    req = _make_requester()
+    msg = provider_message.Message(
+        role='user',
+        content=[
+            provider_message.ContentElement.from_text('analyze this audio'),
+            provider_message.ContentElement.from_file_base64('data:audio/wav;base64,AAAA', 'voice.wav'),
+        ],
+    )
+    out = req._convert_messages([msg])
+    parts = out[0]['content']
+    types = [p.get('type') for p in parts]
+    assert 'file_base64' not in types
+    assert types == ['text']
+    assert parts[0]['text'] == 'analyze this audio'
+
+
+def test_convert_messages_drops_file_url_part():
+    req = _make_requester()
+    msg = provider_message.Message(
+        role='user',
+        content=[
+            provider_message.ContentElement.from_text('here is a doc'),
+            provider_message.ContentElement.from_file_url('http://example.com/report.xlsx', 'report.xlsx'),
+        ],
+    )
+    out = req._convert_messages([msg])
+    types = [p.get('type') for p in out[0]['content']]
+    assert types == ['text']
+
+
+def test_convert_messages_keeps_image_and_converts_to_image_url():
+    req = _make_requester()
+    msg = provider_message.Message(
+        role='user',
+        content=[
+            provider_message.ContentElement.from_text('look'),
+            provider_message.ContentElement.from_image_base64('data:image/png;base64,AAAA'),
+        ],
+    )
+    out = req._convert_messages([msg])
+    parts = out[0]['content']
+    types = [p.get('type') for p in parts]
+    # image is preserved and reshaped to the OpenAI image_url form
+    assert types == ['text', 'image_url']
+    img_part = parts[1]
+    assert img_part['image_url'] == {'url': 'data:image/png;base64,AAAA'}
+    assert 'image_base64' not in img_part
+
+
+def test_convert_messages_mixed_history_strips_only_files():
+    req = _make_requester()
+    # Simulate replayed history: an old voice turn + a current text turn.
+    history_voice = provider_message.Message(
+        role='user',
+        content=[
+            provider_message.ContentElement.from_text('old audio turn'),
+            provider_message.ContentElement.from_file_base64('data:audio/wav;base64,BBBB', 'voice.wav'),
+        ],
+    )
+    current = provider_message.Message(
+        role='user',
+        content=[provider_message.ContentElement.from_text('now do the csv')],
+    )
+    out = req._convert_messages([history_voice, current])
+    assert [p.get('type') for p in out[0]['content']] == ['text']
+    assert [p.get('type') for p in out[1]['content']] == ['text']
+
+
+def test_convert_messages_plain_string_content_untouched():
+    req = _make_requester()
+    msg = provider_message.Message(role='user', content='just text')
+    out = req._convert_messages([msg])
+    assert out[0]['content'] == 'just text'

tests/unit_tests/provider/test_localagent_inbound_attachments.py

@@ -0,0 +1,146 @@
+"""Unit tests for LocalAgentRunner._inject_inbound_attachments.
+
+Covers the user -> sandbox attachment path added for the Box attachment
+round-trip:
+
+* materialized descriptors are stashed on the query and described to the model
+  via an appended text note (in-sandbox paths + outbox convention);
+* non-image file parts (file_base64 / file_url) are stripped from the user
+  message content because OpenAI-compatible chat models reject them, while
+  image and text parts are kept for vision models;
+* the helper is a no-op when the box service is unavailable or yields nothing,
+  and never raises into the chat turn on materialization failure.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+import langbot_plugin.api.entities.builtin.provider.message as provider_message
+
+from langbot.pkg.provider.runners.localagent import LocalAgentRunner
+
+
+def _make_runner(box_service) -> LocalAgentRunner:
+    runner = LocalAgentRunner.__new__(LocalAgentRunner)
+    runner.ap = SimpleNamespace(logger=Mock(), box_service=box_service)
+    return runner
+
+
+def _make_query():
+    return SimpleNamespace(variables={}, query_id='q-123')
+
+
+def _box_service(attachments):
+    svc = SimpleNamespace(
+        available=True,
+        OUTBOX_MOUNT_DIR='/outbox',
+        materialize_inbound_attachments=AsyncMock(return_value=attachments),
+    )
+    return svc
+
+
+@pytest.mark.asyncio
+async def test_inject_strips_file_parts_and_appends_note():
+    box = _box_service([{'type': 'Voice', 'path': '/inbox/q-123/voice.wav', 'size': 176000}])
+    runner = _make_runner(box)
+    query = _make_query()
+    user_message = provider_message.Message(
+        role='user',
+        content=[
+            provider_message.ContentElement.from_text('transcribe this'),
+            provider_message.ContentElement.from_file_base64('data:audio/wav;base64,AAAA', 'voice.wav'),
+        ],
+    )
+
+    await runner._inject_inbound_attachments(query, user_message)
+
+    types = [getattr(ce, 'type', None) for ce in user_message.content]
+    # file_base64 dropped; text kept; sandbox-path note appended as text
+    assert 'file_base64' not in types
+    assert types.count('text') == 2
+    note = user_message.content[-1].text
+    assert '/inbox/q-123/voice.wav' in note
+    assert '/outbox/q-123' in note
+    # descriptors stashed for downstream stages
+    assert query.variables['_sandbox_inbound_attachments'] == box.materialize_inbound_attachments.return_value
+
+
+@pytest.mark.asyncio
+async def test_inject_keeps_image_parts():
+    box = _box_service([{'type': 'Image', 'path': '/inbox/q-123/pic.png', 'size': 1234}])
+    runner = _make_runner(box)
+    query = _make_query()
+    user_message = provider_message.Message(
+        role='user',
+        content=[
+            provider_message.ContentElement.from_text('what is this'),
+            provider_message.ContentElement.from_image_base64('data:image/png;base64,iVBORw0K'),
+        ],
+    )
+
+    await runner._inject_inbound_attachments(query, user_message)
+
+    types = [getattr(ce, 'type', None) for ce in user_message.content]
+    assert 'image_base64' in types  # vision part preserved
+    assert types[-1] == 'text'  # note appended last
+
+
+@pytest.mark.asyncio
+async def test_inject_promotes_string_content_to_list_with_note():
+    box = _box_service([{'type': 'File', 'path': '/inbox/q-123/data.csv', 'size': 42}])
+    runner = _make_runner(box)
+    query = _make_query()
+    user_message = provider_message.Message(role='user', content='clean this csv')
+
+    await runner._inject_inbound_attachments(query, user_message)
+
+    assert isinstance(user_message.content, list)
+    assert [getattr(ce, 'type', None) for ce in user_message.content] == ['text', 'text']
+    assert user_message.content[0].text == 'clean this csv'
+    assert '/inbox/q-123/data.csv' in user_message.content[1].text
+
+
+@pytest.mark.asyncio
+async def test_inject_noop_without_box_service():
+    runner = _make_runner(box_service=None)
+    query = _make_query()
+    user_message = provider_message.Message(role='user', content='hello')
+
+    await runner._inject_inbound_attachments(query, user_message)
+
+    assert user_message.content == 'hello'
+    assert '_sandbox_inbound_attachments' not in query.variables
+
+
+@pytest.mark.asyncio
+async def test_inject_noop_when_no_attachments():
+    box = _box_service([])
+    runner = _make_runner(box)
+    query = _make_query()
+    user_message = provider_message.Message(role='user', content='hello')
+
+    await runner._inject_inbound_attachments(query, user_message)
+
+    assert user_message.content == 'hello'
+    assert '_sandbox_inbound_attachments' not in query.variables
+
+
+@pytest.mark.asyncio
+async def test_inject_swallows_materialization_error():
+    box = SimpleNamespace(
+        available=True,
+        OUTBOX_MOUNT_DIR='/outbox',
+        materialize_inbound_attachments=AsyncMock(side_effect=RuntimeError('disk full')),
+    )
+    runner = _make_runner(box)
+    query = _make_query()
+    user_message = provider_message.Message(role='user', content='hello')
+
+    # must not raise
+    await runner._inject_inbound_attachments(query, user_message)
+    assert user_message.content == 'hello'
+    runner.ap.logger.warning.assert_called_once()

web/src/app/home/bots/components/bot-form/RoutingRulesEditor.tsx

@@ -48,7 +48,6 @@ interface PipelineOption {
 }
 
 interface RoutingRulesEditorProps {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   form: UseFormReturn<any>;
   pipelineNameList: PipelineOption[];
 }

web/src/app/home/components/account-settings-dialog/AccountSettingsDialog.tsx

@@ -1,181 +0,0 @@
-import * as React from 'react';
-import { useState, useEffect } from 'react';
-import { toast } from 'sonner';
-import { useTranslation } from 'react-i18next';
-import {
-  Dialog,
-  DialogContent,
-  DialogHeader,
-  DialogTitle,
-  DialogDescription,
-} from '@/components/ui/dialog';
-import { Button } from '@/components/ui/button';
-import {
-  Item,
-  ItemMedia,
-  ItemContent,
-  ItemTitle,
-  ItemDescription,
-  ItemActions,
-} from '@/components/ui/item';
-import { httpClient } from '@/app/infra/http/HttpClient';
-import { systemInfo } from '@/app/infra/http';
-import { Loader2, ExternalLink, KeyRound, Layers } from 'lucide-react';
-import PasswordChangeDialog from '../password-change-dialog/PasswordChangeDialog';
-
-interface AccountSettingsDialogProps {
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-}
-
-export default function AccountSettingsDialog({
-  open,
-  onOpenChange,
-}: AccountSettingsDialogProps) {
-  const { t } = useTranslation();
-  const [accountType, setAccountType] = useState<'local' | 'space'>('local');
-  const [hasPassword, setHasPassword] = useState(false);
-  const [userEmail, setUserEmail] = useState('');
-  const [loading, setLoading] = useState(true);
-  const [spaceBindLoading, setSpaceBindLoading] = useState(false);
-  const [passwordDialogOpen, setPasswordDialogOpen] = useState(false);
-
-  useEffect(() => {
-    if (open) {
-      loadUserInfo();
-    }
-  }, [open]);
-
-  async function loadUserInfo() {
-    setLoading(true);
-    try {
-      const info = await httpClient.getUserInfo();
-      setAccountType(info.account_type);
-      setHasPassword(info.has_password);
-      setUserEmail(info.user);
-    } catch {
-      toast.error(t('common.error'));
-    } finally {
-      setLoading(false);
-    }
-  }
-
-  const handleBindSpace = async () => {
-    setSpaceBindLoading(true);
-    try {
-      const token = localStorage.getItem('token');
-      if (!token) {
-        toast.error(t('common.error'));
-        setSpaceBindLoading(false);
-        return;
-      }
-      const currentOrigin = window.location.origin;
-      const redirectUri = `${currentOrigin}/auth/space/callback?mode=bind`;
-      // Pass token as state for security verification
-      const response = await httpClient.getSpaceAuthorizeUrl(
-        redirectUri,
-        token,
-      );
-      window.location.href = response.authorize_url;
-    } catch {
-      toast.error(t('common.spaceLoginFailed'));
-      setSpaceBindLoading(false);
-    }
-  };
-
-  const handlePasswordDialogClose = (dialogOpen: boolean) => {
-    setPasswordDialogOpen(dialogOpen);
-    if (!dialogOpen) {
-      // Reload user info to update password status
-      loadUserInfo();
-    }
-  };
-
-  return (
-    <>
-      <Dialog open={open} onOpenChange={onOpenChange}>
-        <DialogContent className="sm:max-w-md">
-          <DialogHeader>
-            <DialogTitle>{t('account.settings')}</DialogTitle>
-            <DialogDescription>{userEmail}</DialogDescription>
-          </DialogHeader>
-
-          {loading ? (
-            <div className="flex justify-center py-8">
-              <Loader2 className="h-6 w-6 animate-spin" />
-            </div>
-          ) : (
-            <div className="space-y-2">
-              {/* Password Item */}
-              <Item size="sm" variant="muted" className="rounded-lg">
-                <ItemMedia variant="icon">
-                  <KeyRound className="h-4 w-4" />
-                </ItemMedia>
-                <ItemContent>
-                  <ItemTitle>{t('account.passwordStatus')}</ItemTitle>
-                  <ItemDescription>
-                    {hasPassword
-                      ? t('account.passwordSetDescription')
-                      : t('account.setPasswordHint')}
-                  </ItemDescription>
-                </ItemContent>
-                <ItemActions>
-                  <Button
-                    variant="outline"
-                    size="sm"
-                    onClick={() => setPasswordDialogOpen(true)}
-                    disabled={!systemInfo.allow_modify_login_info}
-                  >
-                    {hasPassword
-                      ? t('common.changePassword')
-                      : t('account.setPassword')}
-                  </Button>
-                </ItemActions>
-              </Item>
-
-              {/* Space Account Item */}
-              <Item size="sm" variant="muted" className="rounded-lg">
-                <ItemMedia variant="icon">
-                  <Layers className="h-4 w-4" />
-                </ItemMedia>
-                <ItemContent>
-                  <ItemTitle>{t('account.spaceStatus')}</ItemTitle>
-                  <ItemDescription>
-                    {accountType === 'space'
-                      ? t('account.spaceBoundDescription')
-                      : t('account.bindSpaceDescription')}
-                  </ItemDescription>
-                </ItemContent>
-                {accountType === 'local' && (
-                  <ItemActions>
-                    <Button
-                      variant="outline"
-                      size="sm"
-                      onClick={handleBindSpace}
-                      disabled={
-                        spaceBindLoading || !systemInfo.allow_modify_login_info
-                      }
-                    >
-                      {spaceBindLoading ? (
-                        <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-                      ) : (
-                        <ExternalLink className="mr-2 h-4 w-4" />
-                      )}
-                      {t('account.bindSpaceButton')}
-                    </Button>
-                  </ItemActions>
-                )}
-              </Item>
-            </div>
-          )}
-        </DialogContent>
-      </Dialog>
-
-      <PasswordChangeDialog
-        open={passwordDialogOpen}
-        onOpenChange={handlePasswordDialogClose}
-        hasPassword={hasPassword}
-      />
-    </>
-  );
-}

web/src/app/home/components/account-settings-dialog/AccountSettingsPanel.tsx

@@ -0,0 +1,171 @@
+import { useState, useEffect } from 'react';
+import { toast } from 'sonner';
+import { useTranslation } from 'react-i18next';
+import { Button } from '@/components/ui/button';
+import {
+  Item,
+  ItemMedia,
+  ItemContent,
+  ItemTitle,
+  ItemDescription,
+  ItemActions,
+} from '@/components/ui/item';
+import { httpClient } from '@/app/infra/http/HttpClient';
+import { systemInfo } from '@/app/infra/http';
+import { Loader2, ExternalLink, KeyRound, Layers } from 'lucide-react';
+import PasswordChangeDialog from '../password-change-dialog/PasswordChangeDialog';
+import { PanelBody } from '../settings-dialog/panel-layout';
+
+interface AccountSettingsPanelProps {
+  // True when this panel is the active section and the dialog is open.
+  active: boolean;
+  onEmailResolved?: (email: string) => void;
+}
+
+export default function AccountSettingsPanel({
+  active,
+  onEmailResolved,
+}: AccountSettingsPanelProps) {
+  const { t } = useTranslation();
+  const [accountType, setAccountType] = useState<'local' | 'space'>('local');
+  const [hasPassword, setHasPassword] = useState(false);
+  const [userEmail, setUserEmail] = useState('');
+  const [loading, setLoading] = useState(true);
+  const [spaceBindLoading, setSpaceBindLoading] = useState(false);
+  const [passwordDialogOpen, setPasswordDialogOpen] = useState(false);
+
+  useEffect(() => {
+    if (active) {
+      loadUserInfo();
+    }
+  }, [active]);
+
+  async function loadUserInfo() {
+    setLoading(true);
+    try {
+      const info = await httpClient.getUserInfo();
+      setAccountType(info.account_type);
+      setHasPassword(info.has_password);
+      setUserEmail(info.user);
+      onEmailResolved?.(info.user);
+    } catch {
+      toast.error(t('common.error'));
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  const handleBindSpace = async () => {
+    setSpaceBindLoading(true);
+    try {
+      const token = localStorage.getItem('token');
+      if (!token) {
+        toast.error(t('common.error'));
+        setSpaceBindLoading(false);
+        return;
+      }
+      const currentOrigin = window.location.origin;
+      const redirectUri = `${currentOrigin}/auth/space/callback?mode=bind`;
+      // Pass token as state for security verification
+      const response = await httpClient.getSpaceAuthorizeUrl(
+        redirectUri,
+        token,
+      );
+      window.location.href = response.authorize_url;
+    } catch {
+      toast.error(t('common.spaceLoginFailed'));
+      setSpaceBindLoading(false);
+    }
+  };
+
+  const handlePasswordDialogClose = (dialogOpen: boolean) => {
+    setPasswordDialogOpen(dialogOpen);
+    if (!dialogOpen) {
+      // Reload user info to update password status
+      loadUserInfo();
+    }
+  };
+
+  return (
+    <PanelBody>
+      {userEmail && (
+        <p className="mb-4 text-sm text-muted-foreground">{userEmail}</p>
+      )}
+
+      {loading ? (
+        <div className="flex justify-center py-8">
+          <Loader2 className="h-6 w-6 animate-spin" />
+        </div>
+      ) : (
+        <div className="space-y-2">
+          {/* Password Item */}
+          <Item size="sm" variant="muted" className="rounded-lg">
+            <ItemMedia variant="icon">
+              <KeyRound className="h-4 w-4" />
+            </ItemMedia>
+            <ItemContent>
+              <ItemTitle>{t('account.passwordStatus')}</ItemTitle>
+              <ItemDescription>
+                {hasPassword
+                  ? t('account.passwordSetDescription')
+                  : t('account.setPasswordHint')}
+              </ItemDescription>
+            </ItemContent>
+            <ItemActions>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={() => setPasswordDialogOpen(true)}
+                disabled={!systemInfo.allow_modify_login_info}
+              >
+                {hasPassword
+                  ? t('common.changePassword')
+                  : t('account.setPassword')}
+              </Button>
+            </ItemActions>
+          </Item>
+
+          {/* Space Account Item */}
+          <Item size="sm" variant="muted" className="rounded-lg">
+            <ItemMedia variant="icon">
+              <Layers className="h-4 w-4" />
+            </ItemMedia>
+            <ItemContent>
+              <ItemTitle>{t('account.spaceStatus')}</ItemTitle>
+              <ItemDescription>
+                {accountType === 'space'
+                  ? t('account.spaceBoundDescription')
+                  : t('account.bindSpaceDescription')}
+              </ItemDescription>
+            </ItemContent>
+            {accountType === 'local' && (
+              <ItemActions>
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={handleBindSpace}
+                  disabled={
+                    spaceBindLoading || !systemInfo.allow_modify_login_info
+                  }
+                >
+                  {spaceBindLoading ? (
+                    <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  ) : (
+                    <ExternalLink className="mr-2 h-4 w-4" />
+                  )}
+                  {t('account.bindSpaceButton')}
+                </Button>
+              </ItemActions>
+            )}
+          </Item>
+        </div>
+      )}
+
+      <PasswordChangeDialog
+        open={passwordDialogOpen}
+        onOpenChange={handlePasswordDialogClose}
+        hasPassword={hasPassword}
+      />
+    </PanelBody>
+  );
+}

web/src/app/home/components/api-integration-dialog/ApiIntegrationPanel.tsx

@@ -3,7 +3,6 @@ import { useState, useEffect, useRef } from 'react';
 import { useTranslation } from 'react-i18next';
 import { toast } from 'sonner';
 import { Copy, Check, Trash2, Plus } from 'lucide-react';
-import { useNavigate, useLocation, useSearchParams } from 'react-router-dom';
 import {
   Dialog,
   DialogContent,
@@ -37,6 +36,7 @@ import {
 } from '@/components/ui/alert-dialog';
 import * as AlertDialogPrimitive from '@radix-ui/react-alert-dialog';
 import { backendClient } from '@/app/infra/http';
+import { PanelToolbar } from '../settings-dialog/panel-layout';
 
 interface ApiKey {
   id: number;
@@ -55,20 +55,15 @@ interface Webhook {
   created_at: string;
 }
 
-interface ApiIntegrationDialogProps {
+interface ApiIntegrationPanelProps {
-  open: boolean;
+  // True when this panel is the active section and the dialog is open.
-  onOpenChange: (open: boolean) => void;
+  active: boolean;
 }
 
-export default function ApiIntegrationDialog({
+export default function ApiIntegrationPanel({
-  open,
+  active,
-  onOpenChange,
+}: ApiIntegrationPanelProps) {
-}: ApiIntegrationDialogProps) {
   const { t } = useTranslation();
-  const navigate = useNavigate();
-  const location = useLocation();
-  const pathname = location.pathname;
-  const [searchParams] = useSearchParams();
   const [activeTab, setActiveTab] = useState('apikeys');
   const [apiKeys, setApiKeys] = useState<ApiKey[]>([]);
   const [webhooks, setWebhooks] = useState<Webhook[]>([]);
@@ -91,33 +86,7 @@ export default function ApiIntegrationDialog({
   );
   const [copiedKey, setCopiedKey] = useState<string | null>(null);
 
-  // Sync URL with dialog state
+  // 清理 body 样式，防止嵌套对话框关闭后页面无法交互
-  useEffect(() => {
-    if (open) {
-      const params = new URLSearchParams(searchParams.toString());
-      params.set('action', 'showApiIntegrationSettings');
-      navigate(`${pathname}?${params.toString()}`, {
-        preventScrollReset: true,
-      });
-    }
-  }, [open]);
-
-  const handleOpenChange = (newOpen: boolean) => {
-    if (!newOpen && (deleteKeyId || deleteWebhookId)) {
-      return;
-    }
-    if (!newOpen) {
-      const params = new URLSearchParams(searchParams.toString());
-      params.delete('action');
-      const newUrl = params.toString()
-        ? `${pathname}?${params.toString()}`
-        : pathname;
-      navigate(newUrl, { preventScrollReset: true });
-    }
-    onOpenChange(newOpen);
-  };
-
-  // 清理 body 样式，防止对话框关闭后页面无法交互
   useEffect(() => {
     if (!deleteKeyId && !deleteWebhookId) {
       const cleanup = () => {
@@ -131,11 +100,11 @@ export default function ApiIntegrationDialog({
   }, [deleteKeyId, deleteWebhookId]);
 
   useEffect(() => {
-    if (open) {
+    if (active) {
       loadApiKeys();
       loadWebhooks();
     }
-  }, [open]);
+  }, [active]);
 
   const loadApiKeys = async () => {
     setLoading(true);
@@ -284,233 +253,209 @@ export default function ApiIntegrationDialog({
 
   return (
     <>
-      <Dialog open={open} onOpenChange={handleOpenChange}>
+      <Tabs
-        <DialogContent className="sm:max-w-[800px] h-[26rem] flex flex-col">
+        value={activeTab}
-          <DialogHeader>
+        onValueChange={setActiveTab}
-            <DialogTitle>{t('common.manageApiIntegration')}</DialogTitle>
+        className="flex h-full min-h-0 w-full flex-col overflow-hidden"
-          </DialogHeader>
+      >
-
+        <PanelToolbar>
-          <Tabs
+          <TabsList>
-            value={activeTab}
+            <TabsTrigger value="apikeys">{t('common.apiKeys')}</TabsTrigger>
-            onValueChange={setActiveTab}
+            <TabsTrigger value="webhooks">{t('common.webhooks')}</TabsTrigger>
-            className="w-full flex-1 flex flex-col overflow-hidden"
+          </TabsList>
-          >
+          {activeTab === 'apikeys' ? (
-            <TabsList className="shadow-md py-3 bg-[#f0f0f0] dark:bg-[#2a2a2e]">
+            <Button
-              <TabsTrigger className="px-5 py-4 cursor-pointer" value="apikeys">
+              onClick={() => setShowCreateDialog(true)}
-                {t('common.apiKeys')}
+              size="sm"
-              </TabsTrigger>
+              className="gap-2"
-              <TabsTrigger
-                className="px-5 py-4 cursor-pointer"
-                value="webhooks"
-              >
-                {t('common.webhooks')}
-              </TabsTrigger>
-            </TabsList>
-
-            {/* API Keys Tab */}
-            <TabsContent
-              value="apikeys"
-              className="space-y-4 flex-1 flex flex-col overflow-hidden"
             >
-              <div className="flex items-start gap-2 text-sm text-muted-foreground">
+              <Plus className="h-4 w-4" />
-                {t('common.apiKeyHint')}
+              {t('common.createApiKey')}
-              </div>
-
-              <div className="flex justify-end">
-                <Button
-                  onClick={() => setShowCreateDialog(true)}
-                  size="sm"
-                  className="gap-2"
-                >
-                  <Plus className="h-4 w-4" />
-                  {t('common.createApiKey')}
-                </Button>
-              </div>
-
-              {loading ? (
-                <div className="text-center py-8 text-muted-foreground">
-                  {t('common.loading')}
-                </div>
-              ) : apiKeys.length === 0 ? (
-                <div className="text-center py-8 text-muted-foreground">
-                  {t('common.noApiKeys')}
-                </div>
-              ) : (
-                <div className="border rounded-md overflow-auto flex-1">
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead className="min-w-[120px]">
-                          {t('common.name')}
-                        </TableHead>
-                        <TableHead className="min-w-[200px]">
-                          {t('common.apiKeyValue')}
-                        </TableHead>
-                        <TableHead className="w-[100px]">
-                          {t('common.actions')}
-                        </TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {apiKeys.map((item) => (
-                        <TableRow key={item.id}>
-                          <TableCell>
-                            <div>
-                              <div className="font-medium">{item.name}</div>
-                              {item.description && (
-                                <div className="text-sm text-muted-foreground">
-                                  {item.description}
-                                </div>
-                              )}
-                            </div>
-                          </TableCell>
-                          <TableCell>
-                            <code className="text-sm bg-muted px-2 py-1 rounded">
-                              {maskApiKey(item.key)}
-                            </code>
-                          </TableCell>
-                          <TableCell>
-                            <div className="flex gap-2">
-                              <Button
-                                variant="ghost"
-                                size="sm"
-                                type="button"
-                                onClick={() => handleCopyKey(item.key)}
-                                title={t('common.copyApiKey')}
-                              >
-                                {copiedKey === item.key ? (
-                                  <Check className="h-4 w-4 text-green-600" />
-                                ) : (
-                                  <Copy className="h-4 w-4" />
-                                )}
-                              </Button>
-                              <Button
-                                variant="ghost"
-                                size="sm"
-                                onClick={() => setDeleteKeyId(item.id)}
-                                title={t('common.delete')}
-                              >
-                                <Trash2 className="h-4 w-4" />
-                              </Button>
-                            </div>
-                          </TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
-                </div>
-              )}
-            </TabsContent>
-
-            {/* Webhooks Tab */}
-            <TabsContent
-              value="webhooks"
-              className="space-y-4 flex-1 flex flex-col overflow-hidden"
-            >
-              <div className="flex items-start gap-2 text-sm text-muted-foreground">
-                {t('common.webhookHint')}
-              </div>
-
-              <div className="flex justify-end">
-                <Button
-                  onClick={() => setShowCreateWebhookDialog(true)}
-                  size="sm"
-                  className="gap-2"
-                >
-                  <Plus className="h-4 w-4" />
-                  {t('common.createWebhook')}
-                </Button>
-              </div>
-
-              {loading ? (
-                <div className="text-center py-8 text-muted-foreground">
-                  {t('common.loading')}
-                </div>
-              ) : webhooks.length === 0 ? (
-                <div className="text-center py-8 text-muted-foreground">
-                  {t('common.noWebhooks')}
-                </div>
-              ) : (
-                <div className="border rounded-md overflow-auto flex-1 max-w-full">
-                  <Table className="table-fixed w-full">
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead className="w-[150px]">
-                          {t('common.name')}
-                        </TableHead>
-                        <TableHead className="w-[380px]">
-                          {t('common.webhookUrl')}
-                        </TableHead>
-                        <TableHead className="w-[80px]">
-                          {t('common.webhookEnabled')}
-                        </TableHead>
-                        <TableHead className="w-[80px]">
-                          {t('common.actions')}
-                        </TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {webhooks.map((webhook) => (
-                        <TableRow key={webhook.id}>
-                          <TableCell className="truncate">
-                            <div className="truncate">
-                              <div
-                                className="font-medium truncate"
-                                title={webhook.name}
-                              >
-                                {webhook.name}
-                              </div>
-                              {webhook.description && (
-                                <div
-                                  className="text-sm text-muted-foreground truncate"
-                                  title={webhook.description}
-                                >
-                                  {webhook.description}
-                                </div>
-                              )}
-                            </div>
-                          </TableCell>
-                          <TableCell>
-                            <div className="overflow-x-auto max-w-[380px]">
-                              <code className="text-sm bg-muted px-2 py-1 rounded whitespace-nowrap inline-block">
-                                {webhook.url}
-                              </code>
-                            </div>
-                          </TableCell>
-                          <TableCell>
-                            <Switch
-                              checked={webhook.enabled}
-                              onCheckedChange={() =>
-                                handleToggleWebhook(webhook)
-                              }
-                            />
-                          </TableCell>
-                          <TableCell>
-                            <Button
-                              variant="ghost"
-                              size="sm"
-                              onClick={() => setDeleteWebhookId(webhook.id)}
-                              title={t('common.delete')}
-                            >
-                              <Trash2 className="h-4 w-4" />
-                            </Button>
-                          </TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
-                </div>
-              )}
-            </TabsContent>
-          </Tabs>
-
-          <DialogFooter>
-            <Button variant="outline" onClick={() => onOpenChange(false)}>
-              {t('common.close')}
             </Button>
-          </DialogFooter>
+          ) : (
-        </DialogContent>
+            <Button
-      </Dialog>
+              onClick={() => setShowCreateWebhookDialog(true)}
+              size="sm"
+              className="gap-2"
+            >
+              <Plus className="h-4 w-4" />
+              {t('common.createWebhook')}
+            </Button>
+          )}
+        </PanelToolbar>
+
+        {/* API Keys Tab */}
+        <TabsContent
+          value="apikeys"
+          className="min-h-0 flex-1 space-y-4 overflow-auto px-6 py-5"
+        >
+          <p className="text-sm text-muted-foreground">
+            {t('common.apiKeyHint')}
+          </p>
+
+          {loading ? (
+            <div className="text-center py-8 text-muted-foreground">
+              {t('common.loading')}
+            </div>
+          ) : apiKeys.length === 0 ? (
+            <div className="text-center py-8 text-muted-foreground">
+              {t('common.noApiKeys')}
+            </div>
+          ) : (
+            <div className="flex-1 overflow-auto rounded-md border">
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="min-w-[120px]">
+                      {t('common.name')}
+                    </TableHead>
+                    <TableHead className="min-w-[200px]">
+                      {t('common.apiKeyValue')}
+                    </TableHead>
+                    <TableHead className="w-[100px]">
+                      {t('common.actions')}
+                    </TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  {apiKeys.map((item) => (
+                    <TableRow key={item.id}>
+                      <TableCell>
+                        <div>
+                          <div className="font-medium">{item.name}</div>
+                          {item.description && (
+                            <div className="text-sm text-muted-foreground">
+                              {item.description}
+                            </div>
+                          )}
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <code className="text-sm bg-muted px-2 py-1 rounded">
+                          {maskApiKey(item.key)}
+                        </code>
+                      </TableCell>
+                      <TableCell>
+                        <div className="flex gap-2">
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            type="button"
+                            onClick={() => handleCopyKey(item.key)}
+                            title={t('common.copyApiKey')}
+                          >
+                            {copiedKey === item.key ? (
+                              <Check className="h-4 w-4 text-green-600" />
+                            ) : (
+                              <Copy className="h-4 w-4" />
+                            )}
+                          </Button>
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            onClick={() => setDeleteKeyId(item.id)}
+                            title={t('common.delete')}
+                          >
+                            <Trash2 className="h-4 w-4" />
+                          </Button>
+                        </div>
+                      </TableCell>
+                    </TableRow>
+                  ))}
+                </TableBody>
+              </Table>
+            </div>
+          )}
+        </TabsContent>
+
+        {/* Webhooks Tab */}
+        <TabsContent
+          value="webhooks"
+          className="min-h-0 flex-1 space-y-4 overflow-auto px-6 py-5"
+        >
+          <p className="text-sm text-muted-foreground">
+            {t('common.webhookHint')}
+          </p>
+
+          {loading ? (
+            <div className="text-center py-8 text-muted-foreground">
+              {t('common.loading')}
+            </div>
+          ) : webhooks.length === 0 ? (
+            <div className="text-center py-8 text-muted-foreground">
+              {t('common.noWebhooks')}
+            </div>
+          ) : (
+            <div className="max-w-full flex-1 overflow-auto rounded-md border">
+              <Table className="table-fixed w-full">
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="w-[150px]">
+                      {t('common.name')}
+                    </TableHead>
+                    <TableHead className="w-[380px]">
+                      {t('common.webhookUrl')}
+                    </TableHead>
+                    <TableHead className="w-[80px]">
+                      {t('common.webhookEnabled')}
+                    </TableHead>
+                    <TableHead className="w-[80px]">
+                      {t('common.actions')}
+                    </TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  {webhooks.map((webhook) => (
+                    <TableRow key={webhook.id}>
+                      <TableCell className="truncate">
+                        <div className="truncate">
+                          <div
+                            className="font-medium truncate"
+                            title={webhook.name}
+                          >
+                            {webhook.name}
+                          </div>
+                          {webhook.description && (
+                            <div
+                              className="text-sm text-muted-foreground truncate"
+                              title={webhook.description}
+                            >
+                              {webhook.description}
+                            </div>
+                          )}
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <div className="overflow-x-auto max-w-[380px]">
+                          <code className="text-sm bg-muted px-2 py-1 rounded whitespace-nowrap inline-block">
+                            {webhook.url}
+                          </code>
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <Switch
+                          checked={webhook.enabled}
+                          onCheckedChange={() => handleToggleWebhook(webhook)}
+                        />
+                      </TableCell>
+                      <TableCell>
+                        <Button
+                          variant="ghost"
+                          size="sm"
+                          onClick={() => setDeleteWebhookId(webhook.id)}
+                          title={t('common.delete')}
+                        >
+                          <Trash2 className="h-4 w-4" />
+                        </Button>
+                      </TableCell>
+                    </TableRow>
+                  ))}
+                </TableBody>
+              </Table>
+            </div>
+          )}
+        </TabsContent>
+      </Tabs>
 
       {/* Create API Key Dialog */}
       <Dialog open={showCreateDialog} onOpenChange={setShowCreateDialog}>

web/src/app/home/components/dynamic-form/DynamicFormItemComponent.tsx

@@ -61,7 +61,9 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu';
-import ModelsDialog from '@/app/home/components/models-dialog/ModelsDialog';
+import SettingsDialog, {
+  SettingsSection,
+} from '@/app/home/components/settings-dialog/SettingsDialog';
 
 export default function DynamicFormItemComponent({
   config,
@@ -87,6 +89,8 @@ export default function DynamicFormItemComponent({
   );
   const { t } = useTranslation();
   const [modelsDialogOpen, setModelsDialogOpen] = useState(false);
+  const [settingsSection, setSettingsSection] =
+    useState<SettingsSection>('models');
 
   const fetchLlmModels = () => {
     httpClient
@@ -561,9 +565,11 @@ export default function DynamicFormItemComponent({
             </TooltipTrigger>
             <TooltipContent side="right">{t('models.title')}</TooltipContent>
           </Tooltip>
-          <ModelsDialog
+          <SettingsDialog
             open={modelsDialogOpen}
             onOpenChange={handleModelsDialogChange}
+            section={settingsSection}
+            onSectionChange={setSettingsSection}
           />
         </div>
       );
@@ -913,9 +919,11 @@ export default function DynamicFormItemComponent({
                   {t('models.title')}
                 </TooltipContent>
               </Tooltip>
-              <ModelsDialog
+              <SettingsDialog
                 open={modelsDialogOpen}
                 onOpenChange={handleModelsDialogChange}
+                section={settingsSection}
+                onSectionChange={setSettingsSection}
               />
             </div>
           </div>

web/src/app/home/components/dynamic-form/DynamicFormItemConfig.ts

@@ -47,7 +47,6 @@ export function parseDynamicFormItemType(value: string): DynamicFormItemType {
 
 export function getDefaultValues(
   itemConfigList: IDynamicFormItemSchema[],
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ): Record<string, any> {
   return itemConfigList.reduce(
     (acc, item) => {
@@ -59,7 +58,7 @@ export function getDefaultValues(
       acc[item.name] = item.default;
       return acc;
     },
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+
     {} as Record<string, any>,
   );
 }

web/src/app/home/components/home-sidebar/HomeSidebar.tsx

@@ -57,11 +57,12 @@ import { Avatar, AvatarFallback } from '@/components/ui/avatar';
 import { LanguageSelector } from '@/components/ui/language-selector';
 import { Badge } from '@/components/ui/badge';
 import { Button } from '@/components/ui/button';
-import AccountSettingsDialog from '@/app/home/components/account-settings-dialog/AccountSettingsDialog';
-import ApiIntegrationDialog from '@/app/home/components/api-integration-dialog/ApiIntegrationDialog';
 import NewVersionDialog from '@/app/home/components/new-version-dialog/NewVersionDialog';
-import ModelsDialog from '@/app/home/components/models-dialog/ModelsDialog';
+import SettingsDialog, {
-import StorageAnalysisDialog from '@/app/home/components/storage-analysis-dialog/StorageAnalysisDialog';
+  SettingsSection,
+  SETTINGS_ACTION_BY_SECTION,
+  SETTINGS_SECTION_BY_ACTION,
+} from '@/app/home/components/settings-dialog/SettingsDialog';
 import { GitHubRelease } from '@/app/infra/http/CloudServiceClient';
 import { useAsyncTask, AsyncTaskStatus } from '@/hooks/useAsyncTask';
 import { toast } from 'sonner';
@@ -1548,17 +1549,10 @@ export default function HomeSidebar({
   }, [pathname]);
 
   useEffect(() => {
-    if (searchParams.get('action') === 'showModelSettings') {
+    const action = searchParams.get('action');
-      setModelsDialogOpen(true);
+    if (action && SETTINGS_SECTION_BY_ACTION[action]) {
-    }
+      setSettingsSection(SETTINGS_SECTION_BY_ACTION[action]);
-    if (searchParams.get('action') === 'showAccountSettings') {
+      setSettingsOpen(true);
-      setAccountSettingsOpen(true);
-    }
-    if (searchParams.get('action') === 'showApiIntegrationSettings') {
-      setApiKeyDialogOpen(true);
-    }
-    if (searchParams.get('action') === 'showStorageAnalysis') {
-      setStorageAnalysisOpen(true);
     }
   }, [searchParams]);
 
@@ -1567,15 +1561,14 @@ export default function HomeSidebar({
     useState<Record<string, boolean>>(loadSectionState);
   const { theme, setTheme } = useTheme();
   const { t } = useTranslation();
-  const [accountSettingsOpen, setAccountSettingsOpen] = useState(false);
+  const [settingsOpen, setSettingsOpen] = useState(false);
-  const [apiKeyDialogOpen, setApiKeyDialogOpen] = useState(false);
+  const [settingsSection, setSettingsSection] =
+    useState<SettingsSection>('models');
   const [latestRelease, setLatestRelease] = useState<GitHubRelease | null>(
     null,
   );
   const [hasNewVersion, setHasNewVersion] = useState(false);
   const [versionDialogOpen, setVersionDialogOpen] = useState(false);
-  const [modelsDialogOpen, setModelsDialogOpen] = useState(false);
-  const [storageAnalysisOpen, setStorageAnalysisOpen] = useState(false);
   const [userEmail, setUserEmail] = useState<string>('');
   const [starCount, setStarCount] = useState<number | null>(null);
   const [userMenuOpen, setUserMenuOpen] = useState(false);
@@ -1600,51 +1593,28 @@ export default function HomeSidebar({
       setShowScrollHint(false);
     }, 250);
   }
-  function handleModelsDialogChange(open: boolean) {
+  function openSettings(section: SettingsSection) {
-    setModelsDialogOpen(open);
+    setSettingsSection(section);
-    if (open) {
+    setSettingsOpen(true);
-      const params = new URLSearchParams(searchParams.toString());
+    const params = new URLSearchParams(searchParams.toString());
-      params.set('action', 'showModelSettings');
+    params.set('action', SETTINGS_ACTION_BY_SECTION[section]);
-      navigate(`${pathname}?${params.toString()}`, {
+    navigate(`${pathname}?${params.toString()}`, {
-        preventScrollReset: true,
+      preventScrollReset: true,
-      });
+    });
-    } else {
-      const params = new URLSearchParams(searchParams.toString());
-      params.delete('action');
-      const newUrl = params.toString()
-        ? `${pathname}?${params.toString()}`
-        : pathname;
-      navigate(newUrl, { preventScrollReset: true });
-    }
   }
 
-  function handleAccountSettingsChange(open: boolean) {
+  function handleSettingsSectionChange(section: SettingsSection) {
-    setAccountSettingsOpen(open);
+    setSettingsSection(section);
-    if (open) {
+    const params = new URLSearchParams(searchParams.toString());
-      const params = new URLSearchParams(searchParams.toString());
+    params.set('action', SETTINGS_ACTION_BY_SECTION[section]);
-      params.set('action', 'showAccountSettings');
+    navigate(`${pathname}?${params.toString()}`, {
-      navigate(`${pathname}?${params.toString()}`, {
+      preventScrollReset: true,
-        preventScrollReset: true,
+    });
-      });
-    } else {
-      const params = new URLSearchParams(searchParams.toString());
-      params.delete('action');
-      const newUrl = params.toString()
-        ? `${pathname}?${params.toString()}`
-        : pathname;
-      navigate(newUrl, { preventScrollReset: true });
-    }
   }
 
-  function handleStorageAnalysisChange(open: boolean) {
+  function handleSettingsOpenChange(open: boolean) {
-    setStorageAnalysisOpen(open);
+    setSettingsOpen(open);
-    if (open) {
+    if (!open) {
-      const params = new URLSearchParams(searchParams.toString());
-      params.set('action', 'showStorageAnalysis');
-      navigate(`${pathname}?${params.toString()}`, {
-        preventScrollReset: true,
-      });
-    } else {
       const params = new URLSearchParams(searchParams.toString());
       params.delete('action');
       const newUrl = params.toString()
@@ -1913,24 +1883,11 @@ export default function HomeSidebar({
 
         {/* Footer */}
         <SidebarFooter>
-          {/* API Integration entry */}
-          <SidebarMenu>
-            <SidebarMenuItem>
-              <SidebarMenuButton
-                onClick={() => setApiKeyDialogOpen(true)}
-                tooltip={t('common.apiIntegration')}
-              >
-                <KeyRound className="size-4 text-blue-500" />
-                <span>{t('common.apiIntegration')}</span>
-              </SidebarMenuButton>
-            </SidebarMenuItem>
-          </SidebarMenu>
-
           {/* Models entry */}
           <SidebarMenu>
             <SidebarMenuItem>
               <SidebarMenuButton
-                onClick={() => handleModelsDialogChange(true)}
+                onClick={() => openSettings('models')}
                 tooltip={t('models.title')}
               >
                 <Sparkles className="text-blue-500" />
@@ -1939,6 +1896,19 @@ export default function HomeSidebar({
             </SidebarMenuItem>
           </SidebarMenu>
 
+          {/* API Integration entry */}
+          <SidebarMenu>
+            <SidebarMenuItem>
+              <SidebarMenuButton
+                onClick={() => openSettings('apiIntegration')}
+                tooltip={t('common.apiIntegration')}
+              >
+                <KeyRound className="size-4 text-blue-500" />
+                <span>{t('common.apiIntegration')}</span>
+              </SidebarMenuButton>
+            </SidebarMenuItem>
+          </SidebarMenu>
+
           {/* User menu using sidebar-07 nav-user DropdownMenu pattern */}
           <SidebarMenu>
             <SidebarMenuItem>
@@ -2018,7 +1988,10 @@ export default function HomeSidebar({
                   {/* Account actions */}
                   <DropdownMenuGroup>
                     <DropdownMenuItem
-                      onClick={() => handleAccountSettingsChange(true)}
+                      onClick={() => {
+                        setUserMenuOpen(false);
+                        openSettings('account');
+                      }}
                     >
                       <Settings />
                       {t('account.settings')}
@@ -2026,7 +1999,7 @@ export default function HomeSidebar({
                     <DropdownMenuItem
                       onClick={() => {
                         setUserMenuOpen(false);
-                        handleStorageAnalysisChange(true);
+                        openSettings('storageAnalysis');
                       }}
                     >
                       <HardDrive />
@@ -2123,27 +2096,17 @@ export default function HomeSidebar({
         </SidebarFooter>
       </Sidebar>
 
-      <AccountSettingsDialog
+      <SettingsDialog
-        open={accountSettingsOpen}
+        open={settingsOpen}
-        onOpenChange={handleAccountSettingsChange}
+        onOpenChange={handleSettingsOpenChange}
-      />
+        section={settingsSection}
-      <ApiIntegrationDialog
+        onSectionChange={handleSettingsSectionChange}
-        open={apiKeyDialogOpen}
-        onOpenChange={setApiKeyDialogOpen}
       />
       <NewVersionDialog
         open={versionDialogOpen}
         onOpenChange={setVersionDialogOpen}
         release={latestRelease}
       />
-      <ModelsDialog
-        open={modelsDialogOpen}
-        onOpenChange={handleModelsDialogChange}
-      />
-      <StorageAnalysisDialog
-        open={storageAnalysisOpen}
-        onOpenChange={handleStorageAnalysisChange}
-      />
     </>
   );
 }

web/src/app/home/components/models-dialog/ModelsPanel.tsx

@@ -23,10 +23,13 @@ import {
   LANGBOT_MODELS_PROVIDER_REQUESTER,
 } from './types';
 import { CustomApiError } from '@/app/infra/entities/common';
+import { PanelBody } from '../settings-dialog/panel-layout';
 
-interface ModelsDialogProps {
+interface ModelsPanelProps {
-  open: boolean;
+  // True when this panel is the active section and the dialog is open.
-  onOpenChange: (open: boolean) => void;
+  active: boolean;
+  // Notify parent when a nested modal (provider form) should block outer-close.
+  onBlockingChange?: (blocking: boolean) => void;
 }
 
 type ExtraArgValue = string | number | boolean | Record<string, unknown>;
@@ -75,10 +78,10 @@ function parseContextLength(
   return value;
 }
 
-export default function ModelsDialog({
+export default function ModelsPanel({
-  open,
+  active,
-  onOpenChange,
+  onBlockingChange,
-}: ModelsDialogProps) {
+}: ModelsPanelProps) {
   const { t } = useTranslation();
 
   const [providers, setProviders] = useState<ModelProvider[]>([]);
@@ -136,12 +139,17 @@ export default function ModelsDialog({
   );
 
   useEffect(() => {
-    if (open) {
+    if (active) {
       loadUserInfo();
       loadProviders();
       loadRequesterSupportTypes();
     }
-  }, [open]);
+  }, [active]);
+
+  // Notify parent of blocking state so it can guard outer-close.
+  useEffect(() => {
+    onBlockingChange?.(providerFormOpen);
+  }, [providerFormOpen, onBlockingChange]);
 
   // Auto-expand LangBot Models when no external providers exist
   useEffect(() => {
@@ -604,57 +612,38 @@ export default function ModelsDialog({
 
   return (
     <>
-      <Dialog
+      <PanelBody>
-        open={open}
+        {/* LangBot Models (Space) provider card is intentionally pinned to the
-        onOpenChange={(newOpen) => {
+            top, above the "add custom provider" action row. */}
-          if (!newOpen && providerFormOpen) return;
+        {langbotProvider && renderProviderCard(langbotProvider, true)}
-          onOpenChange(newOpen);
-        }}
-      >
-        <DialogContent className="overflow-hidden p-0 h-[80vh] flex flex-col !max-w-[37rem]">
-          <DialogHeader className="px-6 pt-6 pb-0 flex-shrink-0">
-            <DialogTitle>{t('models.title')}</DialogTitle>
-          </DialogHeader>
 
-          <div className="flex-1 overflow-auto px-6 pb-6 mt-0">
+        {/* Add-provider row: stays below the pinned card by design. */}
-            {/* LangBot Models Card */}
+        <div className="mb-3 flex items-center justify-between gap-3">
-            {langbotProvider && renderProviderCard(langbotProvider, true)}
+          <span className="text-sm text-muted-foreground">
+            {otherProviders.length === 0
+              ? t(
+                  systemInfo.disable_models_service
+                    ? 'models.addProviderHintSimple'
+                    : 'models.addProviderHint',
+                )
+              : t('models.providerCount', { count: otherProviders.length })}
+          </span>
+          <Button size="sm" variant="outline" onClick={handleCreateProvider}>
+            <Plus className="h-4 w-4 mr-1" />
+            {t('models.addProvider')}
+          </Button>
+        </div>
 
-            {/* Add Provider Button */}
+        {/* Provider List */}
-            <div className="mb-3 flex justify-between items-center sticky top-0 bg-background py-2 z-10">
+        {otherProviders.length === 0 ? (
-              <span className="text-sm text-muted-foreground">
+          <div className="flex flex-col items-center justify-center py-12 text-muted-foreground">
-                {otherProviders.length === 0
+            <Boxes className="h-12 w-12 mb-3 opacity-50" />
-                  ? t(
+            <p className="text-sm">{t('models.noProviders')}</p>
-                      systemInfo.disable_models_service
-                        ? 'models.addProviderHintSimple'
-                        : 'models.addProviderHint',
-                    )
-                  : t('models.providerCount', { count: otherProviders.length })}
-              </span>
-              <div className="flex gap-2">
-                <Button
-                  size="sm"
-                  variant="outline"
-                  onClick={handleCreateProvider}
-                >
-                  <Plus className="h-4 w-4 mr-1" />
-                  {t('models.addProvider')}
-                </Button>
-              </div>
-            </div>
-
-            {/* Provider List */}
-            {otherProviders.length === 0 ? (
-              <div className="flex flex-col items-center justify-center py-12 text-muted-foreground">
-                <Boxes className="h-12 w-12 mb-3 opacity-50" />
-                <p className="text-sm">{t('models.noProviders')}</p>
-              </div>
-            ) : (
-              otherProviders.map((p) => renderProviderCard(p))
-            )}
           </div>
-        </DialogContent>
+        ) : (
-      </Dialog>
+          otherProviders.map((p) => renderProviderCard(p))
+        )}
+      </PanelBody>
 
       <Dialog open={providerFormOpen} onOpenChange={setProviderFormOpen}>
         <DialogContent className="w-[600px] p-6">

web/src/app/home/components/settings-dialog/SettingsDialog.tsx

@@ -0,0 +1,229 @@
+import { useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { KeyRound, Sparkles, Settings, HardDrive } from 'lucide-react';
+import {
+  Dialog,
+  DialogContent,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog';
+import {
+  Sidebar,
+  SidebarContent,
+  SidebarGroup,
+  SidebarGroupContent,
+  SidebarMenu,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  SidebarProvider,
+} from '@/components/ui/sidebar';
+import { cn } from '@/lib/utils';
+import AccountSettingsPanel from '@/app/home/components/account-settings-dialog/AccountSettingsPanel';
+import ApiIntegrationPanel from '@/app/home/components/api-integration-dialog/ApiIntegrationPanel';
+import ModelsPanel from '@/app/home/components/models-dialog/ModelsPanel';
+import StorageAnalysisPanel from '@/app/home/components/storage-analysis-dialog/StorageAnalysisPanel';
+
+// The set of settings sections shown in the unified dialog. The string values
+// are also reused as the ?action= query param suffix so deep links keep working.
+export type SettingsSection =
+  | 'account'
+  | 'apiIntegration'
+  | 'models'
+  | 'storageAnalysis';
+
+// Map between a section id and its ?action= query value, so existing deep links
+// (showAccountSettings, showApiIntegrationSettings, showModelSettings,
+// showStorageAnalysis) continue to resolve to the right section.
+export const SETTINGS_ACTION_BY_SECTION: Record<SettingsSection, string> = {
+  account: 'showAccountSettings',
+  apiIntegration: 'showApiIntegrationSettings',
+  models: 'showModelSettings',
+  storageAnalysis: 'showStorageAnalysis',
+};
+
+export const SETTINGS_SECTION_BY_ACTION: Record<string, SettingsSection> =
+  Object.fromEntries(
+    Object.entries(SETTINGS_ACTION_BY_SECTION).map(([section, action]) => [
+      action,
+      section as SettingsSection,
+    ]),
+  );
+
+interface SettingsDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  section: SettingsSection;
+  onSectionChange: (section: SettingsSection) => void;
+}
+
+export default function SettingsDialog({
+  open,
+  onOpenChange,
+  section,
+  onSectionChange,
+}: SettingsDialogProps) {
+  const { t } = useTranslation();
+  // A nested modal (e.g. the provider form) can request that we ignore
+  // outer-close until it is dismissed.
+  const [blocking, setBlocking] = useState(false);
+
+  // Only the Models panel can raise a blocking nested modal. When we navigate
+  // away from it (or close the dialog) the panel unmounts without resetting,
+  // so clear the flag here to avoid getting stuck unable to close.
+  useEffect(() => {
+    if (section !== 'models' || !open) {
+      setBlocking(false);
+    }
+  }, [section, open]);
+
+  const navItems: {
+    id: SettingsSection;
+    label: string;
+    title: string;
+    description: string;
+    icon: React.ReactNode;
+  }[] = [
+    {
+      id: 'models',
+      label: t('settingsDialog.nav.models'),
+      title: t('models.title'),
+      description: t('models.description'),
+      icon: <Sparkles className="size-4" />,
+    },
+    {
+      id: 'apiIntegration',
+      label: t('settingsDialog.nav.api'),
+      title: t('common.apiIntegration'),
+      description: t('common.apiIntegrationDescription'),
+      icon: <KeyRound className="size-4" />,
+    },
+    {
+      id: 'storageAnalysis',
+      label: t('settingsDialog.nav.storage'),
+      title: t('storageAnalysis.title'),
+      description: t('storageAnalysis.description'),
+      icon: <HardDrive className="size-4" />,
+    },
+    {
+      id: 'account',
+      label: t('settingsDialog.nav.account'),
+      title: t('account.settings'),
+      description: t('account.settingsDescription'),
+      icon: <Settings className="size-4" />,
+    },
+  ];
+
+  const activeItem = navItems.find((item) => item.id === section);
+  const activeLabel = activeItem?.title ?? t('settingsDialog.title');
+
+  return (
+    <Dialog
+      open={open}
+      onOpenChange={(newOpen) => {
+        if (!newOpen && blocking) return;
+        onOpenChange(newOpen);
+      }}
+    >
+      <DialogContent
+        className="h-[80vh] max-h-[800px] overflow-hidden p-0 sm:max-w-[52rem] [&>button:last-child]:z-20"
+        // Fixed height so switching sections never resizes the dialog; each
+        // panel scrolls its own content internally.
+      >
+        <DialogTitle className="sr-only">
+          {t('settingsDialog.title')}
+        </DialogTitle>
+        <DialogDescription className="sr-only">{activeLabel}</DialogDescription>
+
+        {/* Override the SidebarProvider wrapper's default h-svh so the two
+            columns fill the dialog's fixed height instead of the viewport. */}
+        <SidebarProvider className="!min-h-0 h-full">
+          <Sidebar
+            collapsible="none"
+            className="hidden h-full w-44 shrink-0 border-r md:flex"
+          >
+            <SidebarContent>
+              <SidebarGroup>
+                <SidebarGroupContent>
+                  <div className="px-2 py-3 text-sm font-semibold">
+                    {t('settingsDialog.title')}
+                  </div>
+                  <SidebarMenu>
+                    {navItems.map((item) => (
+                      <SidebarMenuItem key={item.id}>
+                        <SidebarMenuButton
+                          isActive={section === item.id}
+                          onClick={() => onSectionChange(item.id)}
+                        >
+                          {item.icon}
+                          <span>{item.label}</span>
+                        </SidebarMenuButton>
+                      </SidebarMenuItem>
+                    ))}
+                  </SidebarMenu>
+                </SidebarGroupContent>
+              </SidebarGroup>
+            </SidebarContent>
+          </Sidebar>
+
+          <main className="flex h-full min-w-0 flex-1 flex-col overflow-hidden">
+            {/* Mobile section switcher (sidebar is hidden on small screens) */}
+            <div className="flex shrink-0 items-center gap-1 overflow-x-auto border-b px-3 py-2 md:hidden">
+              {navItems.map((item) => (
+                <button
+                  key={item.id}
+                  type="button"
+                  onClick={() => onSectionChange(item.id)}
+                  className={cn(
+                    'flex items-center gap-1.5 whitespace-nowrap rounded-md px-3 py-1.5 text-sm',
+                    section === item.id
+                      ? 'bg-sidebar-accent text-sidebar-accent-foreground'
+                      : 'text-muted-foreground',
+                  )}
+                >
+                  {item.icon}
+                  <span>{item.label}</span>
+                </button>
+              ))}
+            </div>
+
+            {/* Unified section header (shared across all tabs). The extra
+                right padding keeps the title clear of the dialog's close X. */}
+            <div className="flex shrink-0 flex-col gap-0.5 border-b px-6 py-4 pr-12">
+              <h2 className="flex items-center gap-2 text-base font-semibold">
+                {activeItem?.icon}
+                {activeItem?.title}
+              </h2>
+              {activeItem?.description && (
+                <p className="text-sm text-muted-foreground">
+                  {activeItem.description}
+                </p>
+              )}
+            </div>
+
+            <div className="flex min-h-0 flex-1 flex-col overflow-hidden">
+              {section === 'models' && (
+                <ModelsPanel
+                  active={open && section === 'models'}
+                  onBlockingChange={setBlocking}
+                />
+              )}
+              {section === 'apiIntegration' && (
+                <ApiIntegrationPanel
+                  active={open && section === 'apiIntegration'}
+                />
+              )}
+              {section === 'storageAnalysis' && (
+                <StorageAnalysisPanel
+                  active={open && section === 'storageAnalysis'}
+                />
+              )}
+              {section === 'account' && (
+                <AccountSettingsPanel active={open && section === 'account'} />
+              )}
+            </div>
+          </main>
+        </SidebarProvider>
+      </DialogContent>
+    </Dialog>
+  );
+}

web/src/app/home/components/settings-dialog/panel-layout.tsx

@@ -0,0 +1,45 @@
+import * as React from 'react';
+import { cn } from '@/lib/utils';
+
+/**
+ * Shared layout primitives for the settings-dialog panels.
+ *
+ * Every section renders under the dialog's unified header, so the panels
+ * themselves should share the same vertical rhythm: an optional top toolbar
+ * (meta on the left, primary action on the right) followed by a scrollable
+ * body with consistent padding. Keeping these in one place is what makes the
+ * tabs feel like one cohesive surface instead of four separately-styled views.
+ */
+
+export function PanelToolbar({
+  className,
+  children,
+}: {
+  className?: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div
+      className={cn(
+        'flex shrink-0 items-center justify-between gap-3 border-b px-6 py-3',
+        className,
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+export function PanelBody({
+  className,
+  children,
+}: {
+  className?: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div className={cn('min-h-0 flex-1 overflow-auto px-6 py-5', className)}>
+      {children}
+    </div>
+  );
+}

web/src/app/home/components/storage-analysis-dialog/StorageAnalysisDialog.tsx

@@ -1,410 +0,0 @@
-'use client';
-
-import {
-  type ReactNode,
-  useCallback,
-  useEffect,
-  useMemo,
-  useState,
-} from 'react';
-import { useTranslation } from 'react-i18next';
-import {
-  AlertCircle,
-  Archive,
-  Clock,
-  Database,
-  FileWarning,
-  HardDrive,
-  RefreshCw,
-} from 'lucide-react';
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogHeader,
-  DialogTitle,
-} from '@/components/ui/dialog';
-import { Button } from '@/components/ui/button';
-import { Badge } from '@/components/ui/badge';
-import { ScrollArea } from '@/components/ui/scroll-area';
-import { backendClient } from '@/app/infra/http';
-
-interface StorageSection {
-  key: string;
-  path: string;
-  exists: boolean;
-  size_bytes: number;
-  file_count: number;
-}
-
-interface CleanupCandidate {
-  key?: string;
-  name?: string;
-  size_bytes: number;
-  modified_at?: string;
-  date?: string;
-}
-
-interface StorageAnalysis {
-  generated_at: string;
-  cleanup_policy: {
-    uploaded_file_retention_days: number;
-    log_retention_days: number;
-  };
-  sections: StorageSection[];
-  database: {
-    type: string;
-    monitoring_counts: Record<string, number>;
-    binary_storage: {
-      count: number;
-      size_bytes: number | null;
-    };
-  };
-  cleanup_candidates: {
-    uploaded_files: CleanupCandidate[];
-    log_files: CleanupCandidate[];
-  };
-  tasks: Record<string, number | undefined>;
-}
-
-interface StorageAnalysisDialogProps {
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-}
-
-function formatBytes(bytes: number | null | undefined): string {
-  if (bytes === null || bytes === undefined) {
-    return '-';
-  }
-  if (bytes < 1024) {
-    return `${bytes} B`;
-  }
-  const units = ['KB', 'MB', 'GB', 'TB'];
-  let value = bytes / 1024;
-  let unitIndex = 0;
-  while (value >= 1024 && unitIndex < units.length - 1) {
-    value /= 1024;
-    unitIndex += 1;
-  }
-  return `${value.toFixed(value >= 10 ? 1 : 2)} ${units[unitIndex]}`;
-}
-
-export default function StorageAnalysisDialog({
-  open,
-  onOpenChange,
-}: StorageAnalysisDialogProps) {
-  const { t } = useTranslation();
-  const [analysis, setAnalysis] = useState<StorageAnalysis | null>(null);
-  const [loading, setLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const loadAnalysis = useCallback(async () => {
-    setLoading(true);
-    setError(null);
-    try {
-      const result = await backendClient.get<StorageAnalysis>(
-        '/api/v1/system/storage-analysis',
-      );
-      setAnalysis(result);
-    } catch (err) {
-      setError(err instanceof Error ? err.message : String(err));
-    } finally {
-      setLoading(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (open) {
-      loadAnalysis();
-    }
-  }, [loadAnalysis, open]);
-
-  const totalBytes = useMemo(() => {
-    return (
-      analysis?.sections.reduce((sum, item) => sum + item.size_bytes, 0) ?? 0
-    );
-  }, [analysis]);
-
-  const uploadedCandidateBytes = useMemo(() => {
-    return (
-      analysis?.cleanup_candidates.uploaded_files.reduce(
-        (sum, item) => sum + item.size_bytes,
-        0,
-      ) ?? 0
-    );
-  }, [analysis]);
-
-  const logCandidateBytes = useMemo(() => {
-    return (
-      analysis?.cleanup_candidates.log_files.reduce(
-        (sum, item) => sum + item.size_bytes,
-        0,
-      ) ?? 0
-    );
-  }, [analysis]);
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="!flex h-[86vh] max-h-[86vh] max-w-5xl flex-col gap-0 p-0">
-        <DialogHeader className="shrink-0 px-6 pt-6">
-          <DialogTitle className="flex items-center gap-2">
-            <HardDrive className="size-5 text-blue-500" />
-            {t('storageAnalysis.dialogTitle')}
-          </DialogTitle>
-          <DialogDescription>
-            {t('storageAnalysis.description')}
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="flex shrink-0 items-center justify-between gap-3 border-b px-6 pb-4">
-          <div className="text-sm text-muted-foreground">
-            {analysis
-              ? t('storageAnalysis.generatedAt', {
-                  time: new Date(analysis.generated_at).toLocaleString(),
-                })
-              : t('storageAnalysis.loading')}
-          </div>
-          <Button
-            onClick={loadAnalysis}
-            variant="outline"
-            size="sm"
-            disabled={loading}
-          >
-            <RefreshCw
-              className={`mr-2 size-4 ${loading ? 'animate-spin' : ''}`}
-            />
-            {t('storageAnalysis.refresh')}
-          </Button>
-        </div>
-
-        <ScrollArea className="min-h-0 flex-1 overflow-hidden">
-          <div className="space-y-5 px-6 py-5">
-            {error && (
-              <div className="flex items-start gap-2 rounded-md border border-destructive/30 bg-destructive/10 px-3 py-2 text-sm text-destructive">
-                <AlertCircle className="mt-0.5 size-4 shrink-0" />
-                <span>{error}</span>
-              </div>
-            )}
-
-            {analysis && (
-              <>
-                <div className="grid grid-cols-1 gap-3 md:grid-cols-4">
-                  <SummaryItem
-                    label={t('storageAnalysis.totalSize')}
-                    value={formatBytes(totalBytes)}
-                    icon={<HardDrive className="size-4" />}
-                  />
-                  <SummaryItem
-                    label={t('storageAnalysis.binaryStorage')}
-                    value={formatBytes(
-                      analysis.database.binary_storage.size_bytes,
-                    )}
-                    meta={`${analysis.database.binary_storage.count}`}
-                    icon={<Database className="size-4" />}
-                  />
-                  <SummaryItem
-                    label={t('storageAnalysis.uploadCleanup')}
-                    value={formatBytes(uploadedCandidateBytes)}
-                    meta={`${analysis.cleanup_candidates.uploaded_files.length}`}
-                    icon={<FileWarning className="size-4" />}
-                  />
-                  <SummaryItem
-                    label={t('storageAnalysis.logCleanup')}
-                    value={formatBytes(logCandidateBytes)}
-                    meta={`${analysis.cleanup_candidates.log_files.length}`}
-                    icon={<FileWarning className="size-4" />}
-                  />
-                </div>
-
-                <section className="rounded-md border px-3 py-3">
-                  <h2 className="mb-3 flex items-center gap-2 text-sm font-medium">
-                    <Clock className="size-4 text-muted-foreground" />
-                    {t('storageAnalysis.cleanupPolicy')}
-                  </h2>
-                  <div className="grid grid-cols-1 gap-2 text-sm md:grid-cols-3">
-                    <PolicyItem
-                      label={t('storageAnalysis.uploadRetention')}
-                      value={`${analysis.cleanup_policy.uploaded_file_retention_days} ${t('storageAnalysis.days')}`}
-                    />
-                    <PolicyItem
-                      label={t('storageAnalysis.logRetention')}
-                      value={`${analysis.cleanup_policy.log_retention_days} ${t('storageAnalysis.days')}`}
-                    />
-                    <PolicyItem
-                      label={t('storageAnalysis.databaseType')}
-                      value={analysis.database.type}
-                    />
-                  </div>
-                </section>
-
-                <section>
-                  <h2 className="mb-2 text-sm font-medium">
-                    {t('storageAnalysis.sections')}
-                  </h2>
-                  <div className="overflow-hidden rounded-md border">
-                    {analysis.sections.map((section) => (
-                      <div
-                        key={section.key}
-                        className="grid grid-cols-[1fr_auto_auto_auto] gap-3 border-b px-3 py-2 text-sm last:border-b-0"
-                      >
-                        <div className="min-w-0">
-                          <div className="font-medium">
-                            {t(`storageAnalysis.sectionNames.${section.key}`)}
-                          </div>
-                          <div className="break-all text-xs text-muted-foreground">
-                            {section.path || '-'}
-                          </div>
-                        </div>
-                        {section.exists ? (
-                          <span />
-                        ) : (
-                          <Badge variant="outline" className="self-center">
-                            {t('storageAnalysis.missing')}
-                          </Badge>
-                        )}
-                        <div className="self-center tabular-nums">
-                          {formatBytes(section.size_bytes)}
-                        </div>
-                        <div className="self-center text-muted-foreground tabular-nums">
-                          {section.file_count}
-                        </div>
-                      </div>
-                    ))}
-                  </div>
-                </section>
-
-                <section className="grid grid-cols-1 gap-4 md:grid-cols-2">
-                  <MetricPanel
-                    title={t('storageAnalysis.monitoringTables')}
-                    values={analysis.database.monitoring_counts}
-                  />
-                  <MetricPanel
-                    title={t('storageAnalysis.runtimeTasks')}
-                    values={analysis.tasks}
-                  />
-                </section>
-
-                <section className="grid grid-cols-1 gap-4 md:grid-cols-2">
-                  <CandidatePanel
-                    title={t('storageAnalysis.expiredUploads')}
-                    emptyText={t('storageAnalysis.noExpiredUploads')}
-                    candidates={analysis.cleanup_candidates.uploaded_files}
-                  />
-                  <CandidatePanel
-                    title={t('storageAnalysis.expiredLogs')}
-                    emptyText={t('storageAnalysis.noExpiredLogs')}
-                    candidates={analysis.cleanup_candidates.log_files}
-                  />
-                </section>
-              </>
-            )}
-          </div>
-        </ScrollArea>
-      </DialogContent>
-    </Dialog>
-  );
-}
-
-function SummaryItem({
-  label,
-  value,
-  icon,
-  meta,
-}: {
-  label: string;
-  value: string;
-  icon: ReactNode;
-  meta?: string;
-}) {
-  return (
-    <div className="rounded-md border px-3 py-3">
-      <div className="flex items-center gap-2 text-xs text-muted-foreground">
-        {icon}
-        {label}
-      </div>
-      <div className="mt-2 flex items-end justify-between gap-2">
-        <span className="text-xl font-semibold tabular-nums">{value}</span>
-        {meta && <span className="text-xs text-muted-foreground">{meta}</span>}
-      </div>
-    </div>
-  );
-}
-
-function PolicyItem({ label, value }: { label: string; value: string }) {
-  return (
-    <div className="rounded-md bg-muted/40 px-3 py-2">
-      <div className="text-xs text-muted-foreground">{label}</div>
-      <div className="mt-1 font-medium">{value}</div>
-    </div>
-  );
-}
-
-function MetricPanel({
-  title,
-  values,
-}: {
-  title: string;
-  values: Record<string, number | undefined>;
-}) {
-  return (
-    <div>
-      <h2 className="mb-2 text-sm font-medium">{title}</h2>
-      <div className="rounded-md border">
-        {Object.entries(values).map(([key, value]) => (
-          <div
-            key={key}
-            className="flex items-center justify-between border-b px-3 py-2 text-sm last:border-b-0"
-          >
-            <span className="text-muted-foreground">{key}</span>
-            <span className="font-medium tabular-nums">{value ?? '-'}</span>
-          </div>
-        ))}
-      </div>
-    </div>
-  );
-}
-
-function CandidatePanel({
-  title,
-  emptyText,
-  candidates,
-}: {
-  title: string;
-  emptyText: string;
-  candidates: CleanupCandidate[];
-}) {
-  return (
-    <div>
-      <h2 className="mb-2 flex items-center gap-2 text-sm font-medium">
-        <Archive className="size-4 text-muted-foreground" />
-        {title}
-      </h2>
-      <div className="rounded-md border">
-        {candidates.length === 0 ? (
-          <div className="px-3 py-6 text-center text-sm text-muted-foreground">
-            {emptyText}
-          </div>
-        ) : (
-          candidates.slice(0, 8).map((candidate, index) => (
-            <div
-              key={`${candidate.key ?? candidate.name}-${index}`}
-              className="grid grid-cols-[1fr_auto] gap-3 border-b px-3 py-2 text-sm last:border-b-0"
-            >
-              <div className="min-w-0">
-                <div className="truncate font-medium">
-                  {candidate.key ?? candidate.name}
-                </div>
-                <div className="text-xs text-muted-foreground">
-                  {candidate.modified_at ?? candidate.date ?? '-'}
-                </div>
-              </div>
-              <div className="self-center tabular-nums">
-                {formatBytes(candidate.size_bytes)}
-              </div>
-            </div>
-          ))
-        )}
-      </div>
-    </div>
-  );
-}

web/src/app/home/components/storage-analysis-dialog/StorageAnalysisPanel.tsx

@@ -0,0 +1,391 @@
+'use client';
+
+import {
+  type ReactNode,
+  useCallback,
+  useEffect,
+  useMemo,
+  useState,
+} from 'react';
+import { useTranslation } from 'react-i18next';
+import {
+  AlertCircle,
+  Archive,
+  Clock,
+  Database,
+  FileWarning,
+  HardDrive,
+  RefreshCw,
+} from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Badge } from '@/components/ui/badge';
+import { ScrollArea } from '@/components/ui/scroll-area';
+import { backendClient } from '@/app/infra/http';
+import { PanelToolbar } from '../settings-dialog/panel-layout';
+
+interface StorageSection {
+  key: string;
+  path: string;
+  exists: boolean;
+  size_bytes: number;
+  file_count: number;
+}
+
+interface CleanupCandidate {
+  key?: string;
+  name?: string;
+  size_bytes: number;
+  modified_at?: string;
+  date?: string;
+}
+
+interface StorageAnalysis {
+  generated_at: string;
+  cleanup_policy: {
+    uploaded_file_retention_days: number;
+    log_retention_days: number;
+  };
+  sections: StorageSection[];
+  database: {
+    type: string;
+    monitoring_counts: Record<string, number>;
+    binary_storage: {
+      count: number;
+      size_bytes: number | null;
+    };
+  };
+  cleanup_candidates: {
+    uploaded_files: CleanupCandidate[];
+    log_files: CleanupCandidate[];
+  };
+  tasks: Record<string, number | undefined>;
+}
+
+interface StorageAnalysisPanelProps {
+  // True when this panel is the active section and the dialog is open.
+  active: boolean;
+}
+
+function formatBytes(bytes: number | null | undefined): string {
+  if (bytes === null || bytes === undefined) {
+    return '-';
+  }
+  if (bytes < 1024) {
+    return `${bytes} B`;
+  }
+  const units = ['KB', 'MB', 'GB', 'TB'];
+  let value = bytes / 1024;
+  let unitIndex = 0;
+  while (value >= 1024 && unitIndex < units.length - 1) {
+    value /= 1024;
+    unitIndex += 1;
+  }
+  return `${value.toFixed(value >= 10 ? 1 : 2)} ${units[unitIndex]}`;
+}
+
+export default function StorageAnalysisPanel({
+  active,
+}: StorageAnalysisPanelProps) {
+  const { t } = useTranslation();
+  const [analysis, setAnalysis] = useState<StorageAnalysis | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const loadAnalysis = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const result = await backendClient.get<StorageAnalysis>(
+        '/api/v1/system/storage-analysis',
+      );
+      setAnalysis(result);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (active) {
+      loadAnalysis();
+    }
+  }, [loadAnalysis, active]);
+
+  const totalBytes = useMemo(() => {
+    return (
+      analysis?.sections.reduce((sum, item) => sum + item.size_bytes, 0) ?? 0
+    );
+  }, [analysis]);
+
+  const uploadedCandidateBytes = useMemo(() => {
+    return (
+      analysis?.cleanup_candidates.uploaded_files.reduce(
+        (sum, item) => sum + item.size_bytes,
+        0,
+      ) ?? 0
+    );
+  }, [analysis]);
+
+  const logCandidateBytes = useMemo(() => {
+    return (
+      analysis?.cleanup_candidates.log_files.reduce(
+        (sum, item) => sum + item.size_bytes,
+        0,
+      ) ?? 0
+    );
+  }, [analysis]);
+
+  return (
+    <div className="flex h-full min-h-0 flex-col">
+      <PanelToolbar>
+        <div className="text-sm text-muted-foreground">
+          {analysis
+            ? t('storageAnalysis.generatedAt', {
+                time: new Date(analysis.generated_at).toLocaleString(),
+              })
+            : t('storageAnalysis.loading')}
+        </div>
+        <Button
+          onClick={loadAnalysis}
+          variant="outline"
+          size="sm"
+          disabled={loading}
+        >
+          <RefreshCw
+            className={`mr-2 size-4 ${loading ? 'animate-spin' : ''}`}
+          />
+          {t('storageAnalysis.refresh')}
+        </Button>
+      </PanelToolbar>
+
+      <ScrollArea className="min-h-0 flex-1 overflow-hidden">
+        <div className="space-y-5 px-6 py-5">
+          {error && (
+            <div className="flex items-start gap-2 rounded-md border border-destructive/30 bg-destructive/10 px-3 py-2 text-sm text-destructive">
+              <AlertCircle className="mt-0.5 size-4 shrink-0" />
+              <span>{error}</span>
+            </div>
+          )}
+
+          {analysis && (
+            <>
+              <div className="grid grid-cols-1 gap-3 md:grid-cols-4">
+                <SummaryItem
+                  label={t('storageAnalysis.totalSize')}
+                  value={formatBytes(totalBytes)}
+                  icon={<HardDrive className="size-4" />}
+                />
+                <SummaryItem
+                  label={t('storageAnalysis.binaryStorage')}
+                  value={formatBytes(
+                    analysis.database.binary_storage.size_bytes,
+                  )}
+                  meta={`${analysis.database.binary_storage.count}`}
+                  icon={<Database className="size-4" />}
+                />
+                <SummaryItem
+                  label={t('storageAnalysis.uploadCleanup')}
+                  value={formatBytes(uploadedCandidateBytes)}
+                  meta={`${analysis.cleanup_candidates.uploaded_files.length}`}
+                  icon={<FileWarning className="size-4" />}
+                />
+                <SummaryItem
+                  label={t('storageAnalysis.logCleanup')}
+                  value={formatBytes(logCandidateBytes)}
+                  meta={`${analysis.cleanup_candidates.log_files.length}`}
+                  icon={<FileWarning className="size-4" />}
+                />
+              </div>
+
+              <section className="rounded-md border px-3 py-3">
+                <h2 className="mb-3 flex items-center gap-2 text-sm font-medium">
+                  <Clock className="size-4 text-muted-foreground" />
+                  {t('storageAnalysis.cleanupPolicy')}
+                </h2>
+                <div className="grid grid-cols-1 gap-2 text-sm md:grid-cols-3">
+                  <PolicyItem
+                    label={t('storageAnalysis.uploadRetention')}
+                    value={`${analysis.cleanup_policy.uploaded_file_retention_days} ${t('storageAnalysis.days')}`}
+                  />
+                  <PolicyItem
+                    label={t('storageAnalysis.logRetention')}
+                    value={`${analysis.cleanup_policy.log_retention_days} ${t('storageAnalysis.days')}`}
+                  />
+                  <PolicyItem
+                    label={t('storageAnalysis.databaseType')}
+                    value={analysis.database.type}
+                  />
+                </div>
+              </section>
+
+              <section>
+                <h2 className="mb-2 text-sm font-medium">
+                  {t('storageAnalysis.sections')}
+                </h2>
+                <div className="overflow-hidden rounded-md border">
+                  {analysis.sections.map((section) => (
+                    <div
+                      key={section.key}
+                      className="grid grid-cols-[1fr_auto_auto_auto] gap-3 border-b px-3 py-2 text-sm last:border-b-0"
+                    >
+                      <div className="min-w-0">
+                        <div className="font-medium">
+                          {t(`storageAnalysis.sectionNames.${section.key}`)}
+                        </div>
+                        <div className="break-all text-xs text-muted-foreground">
+                          {section.path || '-'}
+                        </div>
+                      </div>
+                      {section.exists ? (
+                        <span />
+                      ) : (
+                        <Badge variant="outline" className="self-center">
+                          {t('storageAnalysis.missing')}
+                        </Badge>
+                      )}
+                      <div className="self-center tabular-nums">
+                        {formatBytes(section.size_bytes)}
+                      </div>
+                      <div className="self-center text-muted-foreground tabular-nums">
+                        {section.file_count}
+                      </div>
+                    </div>
+                  ))}
+                </div>
+              </section>
+
+              <section className="grid grid-cols-1 gap-4 md:grid-cols-2">
+                <MetricPanel
+                  title={t('storageAnalysis.monitoringTables')}
+                  values={analysis.database.monitoring_counts}
+                />
+                <MetricPanel
+                  title={t('storageAnalysis.runtimeTasks')}
+                  values={analysis.tasks}
+                />
+              </section>
+
+              <section className="grid grid-cols-1 gap-4 md:grid-cols-2">
+                <CandidatePanel
+                  title={t('storageAnalysis.expiredUploads')}
+                  emptyText={t('storageAnalysis.noExpiredUploads')}
+                  candidates={analysis.cleanup_candidates.uploaded_files}
+                />
+                <CandidatePanel
+                  title={t('storageAnalysis.expiredLogs')}
+                  emptyText={t('storageAnalysis.noExpiredLogs')}
+                  candidates={analysis.cleanup_candidates.log_files}
+                />
+              </section>
+            </>
+          )}
+        </div>
+      </ScrollArea>
+    </div>
+  );
+}
+
+function SummaryItem({
+  label,
+  value,
+  icon,
+  meta,
+}: {
+  label: string;
+  value: string;
+  icon: ReactNode;
+  meta?: string;
+}) {
+  return (
+    <div className="rounded-md border px-3 py-3">
+      <div className="flex items-center gap-2 text-xs text-muted-foreground">
+        {icon}
+        {label}
+      </div>
+      <div className="mt-2 flex items-end justify-between gap-2">
+        <span className="text-xl font-semibold tabular-nums">{value}</span>
+        {meta && <span className="text-xs text-muted-foreground">{meta}</span>}
+      </div>
+    </div>
+  );
+}
+
+function PolicyItem({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="rounded-md bg-muted/40 px-3 py-2">
+      <div className="text-xs text-muted-foreground">{label}</div>
+      <div className="mt-1 font-medium">{value}</div>
+    </div>
+  );
+}
+
+function MetricPanel({
+  title,
+  values,
+}: {
+  title: string;
+  values: Record<string, number | undefined>;
+}) {
+  return (
+    <div>
+      <h2 className="mb-2 text-sm font-medium">{title}</h2>
+      <div className="rounded-md border">
+        {Object.entries(values).map(([key, value]) => (
+          <div
+            key={key}
+            className="flex items-center justify-between border-b px-3 py-2 text-sm last:border-b-0"
+          >
+            <span className="text-muted-foreground">{key}</span>
+            <span className="font-medium tabular-nums">{value ?? '-'}</span>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function CandidatePanel({
+  title,
+  emptyText,
+  candidates,
+}: {
+  title: string;
+  emptyText: string;
+  candidates: CleanupCandidate[];
+}) {
+  return (
+    <div>
+      <h2 className="mb-2 flex items-center gap-2 text-sm font-medium">
+        <Archive className="size-4 text-muted-foreground" />
+        {title}
+      </h2>
+      <div className="rounded-md border">
+        {candidates.length === 0 ? (
+          <div className="px-3 py-6 text-center text-sm text-muted-foreground">
+            {emptyText}
+          </div>
+        ) : (
+          candidates.slice(0, 8).map((candidate, index) => (
+            <div
+              key={`${candidate.key ?? candidate.name}-${index}`}
+              className="grid grid-cols-[1fr_auto] gap-3 border-b px-3 py-2 text-sm last:border-b-0"
+            >
+              <div className="min-w-0">
+                <div className="truncate font-medium">
+                  {candidate.key ?? candidate.name}
+                </div>
+                <div className="text-xs text-muted-foreground">
+                  {candidate.modified_at ?? candidate.date ?? '-'}
+                </div>
+              </div>
+              <div className="self-center tabular-nums">
+                {formatBytes(candidate.size_bytes)}
+              </div>
+            </div>
+          ))
+        )}
+      </div>
+    </div>
+  );
+}

web/src/app/home/monitoring/components/overview-cards/SystemStatusCards.tsx

@@ -82,7 +82,6 @@ export default function SystemStatusCard({
     fetchStatus();
     const interval = setInterval(fetchStatus, 30_000);
     return () => clearInterval(interval);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [fetchStatus, refreshKey]);
 
   const pluginOk = pluginStatus

web/src/app/home/pipelines/components/debug-dialog/DebugDialog.tsx

@@ -15,6 +15,7 @@ import {
   At,
   Quote,
   Voice,
+  File as FileComponent,
   Source,
 } from '@/app/infra/entities/message';
 import { toast } from 'sonner';
@@ -64,7 +65,12 @@ export default function DebugDialog({
   const [isHovering, setIsHovering] = useState(false);
   const [isConnected, setIsConnected] = useState(false);
   const [selectedImages, setSelectedImages] = useState<
-    Array<{ file: File; preview: string; fileKey?: string }>
+    Array<{
+      file: File;
+      preview: string;
+      fileKey?: string;
+      kind: 'image' | 'voice' | 'file';
+    }>
   >([]);
   const [isUploading, setIsUploading] = useState(false);
   const [previewImageUrl, setPreviewImageUrl] = useState<string>('');
@@ -292,23 +298,38 @@ export default function DebugDialog({
     const files = e.target.files;
     if (!files || files.length === 0) return;
 
-    const newImages: Array<{ file: File; preview: string }> = [];
+    const newImages: Array<{
+      file: File;
+      preview: string;
+      kind: 'image' | 'voice' | 'file';
+    }> = [];
 
     for (let i = 0; i < files.length; i++) {
       const file = files[i];
       if (file.type.startsWith('image/')) {
-        const preview = URL.createObjectURL(file);
+        newImages.push({
-        newImages.push({ file, preview });
+          file,
+          preview: URL.createObjectURL(file),
+          kind: 'image',
+        });
+      } else if (file.type.startsWith('audio/')) {
+        newImages.push({ file, preview: '', kind: 'voice' });
+      } else {
+        newImages.push({ file, preview: '', kind: 'file' });
       }
     }
 
     setSelectedImages((prev) => [...prev, ...newImages]);
+    // reset the input so selecting the same file again re-triggers onChange
+    e.target.value = '';
   };
 
   const handleRemoveImage = (index: number) => {
     setSelectedImages((prev) => {
       const newImages = [...prev];
-      URL.revokeObjectURL(newImages[index].preview);
+      if (newImages[index].preview) {
+        URL.revokeObjectURL(newImages[index].preview);
+      }
       newImages.splice(index, 1);
       return newImages;
     });
@@ -372,19 +393,33 @@ export default function DebugDialog({
         });
       }
 
-      // Upload images and add to message chain
+      // Upload attachments and add to message chain
-      for (const image of selectedImages) {
+      for (const attachment of selectedImages) {
         try {
-          const result = await httpClient.uploadWebSocketImage(
+          if (attachment.kind === 'image') {
-            selectedPipelineId,
+            const result = await httpClient.uploadWebSocketImage(
-            image.file,
+              selectedPipelineId,
-          );
+              attachment.file,
-          messageChain.push({
+            );
-            type: 'Image',
+            messageChain.push({
-            path: result.file_key,
+              type: 'Image',
-          });
+              path: result.file_key,
+            });
+          } else {
+            // Voice / File go through the generic document upload endpoint,
+            // which returns a storage key the backend resolves into the
+            // sandbox inbox just like images.
+            const result = await httpClient.uploadDocumentFile(attachment.file);
+            messageChain.push({
+              type: attachment.kind === 'voice' ? 'Voice' : 'File',
+              path: result.file_id,
+              ...(attachment.kind === 'file'
+                ? { name: attachment.file.name }
+                : {}),
+            });
+          }
         } catch (error) {
-          console.error('Image upload failed:', error);
+          console.error('Attachment upload failed:', error);
           toast.error(t('pipelines.debugDialog.imageUploadFailed'));
         }
       }
@@ -393,7 +428,9 @@ export default function DebugDialog({
       setInputValue('');
       setHasAt(false);
       setQuotedMessage(null);
-      selectedImages.forEach((img) => URL.revokeObjectURL(img.preview));
+      selectedImages.forEach((img) => {
+        if (img.preview) URL.revokeObjectURL(img.preview);
+      });
       setSelectedImages([]);
 
       // Send message via WebSocket
@@ -460,13 +497,29 @@ export default function DebugDialog({
       }
 
       case 'File': {
-        const file = component as MessageChainComponent & { name?: string };
+        const file = component as FileComponent;
+        const downloadHref = file.base64
+          ? file.base64.startsWith('data:')
+            ? file.base64
+            : `data:application/octet-stream;base64,${file.base64}`
+          : file.url || '';
+        const fileName = file.name || 'Unknown';
         return (
           <div key={index} className="my-2 flex items-center gap-2 text-sm">
             <Paperclip className="size-4" />
-            <span>
+            {downloadHref ? (
-              [{t('pipelines.debugDialog.file')}] {file.name || 'Unknown'}
+              <a
-            </span>
+                href={downloadHref}
+                download={fileName}
+                className="text-primary underline hover:opacity-80"
+              >
+                [{t('pipelines.debugDialog.file')}] {fileName}
+              </a>
+            ) : (
+              <span>
+                [{t('pipelines.debugDialog.file')}] {fileName}
+              </span>
+            )}
           </div>
         );
       }
@@ -844,17 +897,30 @@ export default function DebugDialog({
           </div>
         )}
 
-        {/* Image preview area */}
+        {/* Attachment preview area */}
         {selectedImages.length > 0 && (
           <div className="px-4 pb-2">
             <div className="flex gap-2 flex-wrap">
               {selectedImages.map((image, index) => (
                 <div key={index} className="relative group">
-                  <img
+                  {image.kind === 'image' ? (
-                    src={image.preview}
+                    <img
-                    alt={`preview-${index}`}
+                      src={image.preview}
-                    className="w-20 h-20 object-cover rounded-lg border"
+                      alt={`preview-${index}`}
-                  />
+                      className="w-20 h-20 object-cover rounded-lg border"
+                    />
+                  ) : (
+                    <div className="w-36 h-20 px-2 rounded-lg border bg-muted/40 flex items-center gap-2 overflow-hidden">
+                      {image.kind === 'voice' ? (
+                        <Music className="size-5 shrink-0 text-muted-foreground" />
+                      ) : (
+                        <Paperclip className="size-5 shrink-0 text-muted-foreground" />
+                      )}
+                      <span className="text-xs text-muted-foreground truncate">
+                        {image.file.name}
+                      </span>
+                    </div>
+                  )}
                   <button
                     type="button"
                     onClick={() => handleRemoveImage(index)}
@@ -883,7 +949,7 @@ export default function DebugDialog({
             <input
               ref={fileInputRef}
               type="file"
-              accept="image/*"
+              accept="image/*,audio/*,*/*"
               multiple
               onChange={handleImageSelect}
               className="hidden"

web/src/app/home/pipelines/components/pipeline-form/PipelineFormComponent.tsx

@@ -323,7 +323,6 @@ export default function PipelineFormComponent({
     const isFirstEmission = !initializedStagesRef.current.has(stageKey);
 
     const currentValues =
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       (form.getValues(formName) as Record<string, any>) || {};
     form.setValue(formName, {
       ...currentValues,
@@ -368,7 +367,6 @@ export default function PipelineFormComponent({
               <DynamicFormComponent
                 itemConfigList={stage.config}
                 initialValues={
-                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
                   (form.watch(formName) as Record<string, any>)?.[stage.name] ||
                   {}
                 }
@@ -402,7 +400,6 @@ export default function PipelineFormComponent({
               <N8nAuthFormComponent
                 itemConfigList={stage.config}
                 initialValues={
-                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
                   (form.watch(formName) as Record<string, any>)?.[stage.name] ||
                   {}
                 }
@@ -445,7 +442,7 @@ export default function PipelineFormComponent({
     // make the locked selector display a scope that is NOT the one actually in
     // effect. Coerce the displayed/saved value to the forced template so the UI
     // truthfully reflects runtime behavior.
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+
     const stageInitialValues: Record<string, any> =
       (form.watch(formName) as Record<string, any>)?.[stage.name] || {};
     const effectiveInitialValues =

web/src/app/home/plugins/components/plugin-installed/PluginCardVO.ts

@@ -9,7 +9,7 @@ export interface IPluginCardVO {
   enabled: boolean;
   priority: number;
   install_source: string;
-  install_info: Record<string, any>; // eslint-disable-line @typescript-eslint/no-explicit-any
+  install_info: Record<string, any>;
   status: string;
   components: PluginComponent[];
   debug: boolean;
@@ -27,7 +27,7 @@ export class PluginCardVO implements IPluginCardVO {
   priority: number;
   debug: boolean;
   install_source: string;
-  install_info: Record<string, any>; // eslint-disable-line @typescript-eslint/no-explicit-any
+  install_info: Record<string, any>;
   status: string;
   components: PluginComponent[];
   hasUpdate?: boolean;

web/src/app/infra/entities/common.ts

@@ -21,7 +21,7 @@ export interface ComponentManifest {
     version?: string;
     author?: string;
   };
-  spec: Record<string, any>; // eslint-disable-line @typescript-eslint/no-explicit-any
+  spec: Record<string, any>;
 }
 
 export interface CustomApiError {

web/src/app/infra/entities/form/dynamic.ts

@@ -8,7 +8,7 @@ export const SYSTEM_FIELD_PREFIX = '__system.';
 export interface IShowIfCondition {
   field: string;
   operator: 'eq' | 'neq' | 'in';
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+
   value: any;
 }
 

web/src/app/infra/entities/message/index.ts

@@ -64,6 +64,8 @@ export interface File extends MessageComponent {
   name?: string;
   size?: number;
   url?: string;
+  path?: string;
+  base64?: string;
 }
 
 // Unknown component

web/src/app/infra/entities/plugin/index.ts

@@ -10,7 +10,7 @@ export interface Plugin {
   debug: boolean;
   enabled: boolean;
   install_source: string;
-  install_info: Record<string, any>; // eslint-disable-line @typescript-eslint/no-explicit-any
+  install_info: Record<string, any>;
   components: PluginComponent[];
 }
 

web/src/app/wizard/page.tsx

@@ -86,7 +86,7 @@ export default function WizardPage() {
   const [selectedAdapter, setSelectedAdapter] = useState<string | null>(null);
   const [selectedRunner, setSelectedRunner] = useState<string | null>(null);
   const [botName, setBotName] = useState('');
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
   const [botDescription, _setBotDescription] = useState('');
   const [adapterConfig, setAdapterConfig] = useState<Record<string, unknown>>(
     {},

web/src/i18n/locales/en-US.ts

@@ -122,6 +122,8 @@ const enUS = {
     changePasswordFailed:
       'Failed to change password, please check your current password',
     apiIntegration: 'API Integration',
+    apiIntegrationDescription:
+      'Manage API keys and webhooks for external access',
     apiKeys: 'API Keys',
     manageApiIntegration: 'Manage API Integration',
     manageApiKeys: 'Manage API Keys',
@@ -1149,6 +1151,7 @@ const enUS = {
   },
   account: {
     settings: 'Account Settings',
+    settingsDescription: 'Manage your password and linked accounts',
     setPassword: 'Set Password',
     passwordSetSuccess: 'Password set successfully',
     passwordStatus: 'Local Password',
@@ -1386,6 +1389,15 @@ const enUS = {
     boxSessionCreated: 'Created',
     boxSessionLastUsed: 'Last used',
   },
+  settingsDialog: {
+    title: 'Settings',
+    nav: {
+      models: 'Models',
+      api: 'API',
+      storage: 'Storage',
+      account: 'Account',
+    },
+  },
   storageAnalysis: {
     title: 'Storage Analysis',
     description: 'Inspect storage usage and cleanup candidates',

web/src/i18n/locales/es-ES.ts

@@ -126,6 +126,8 @@ const esES = {
     changePasswordFailed:
       'Error al cambiar la contraseña, por favor verifica tu contraseña actual',
     apiIntegration: 'Integración API',
+    apiIntegrationDescription:
+      'Gestiona las claves API y los webhooks para el acceso externo',
     apiKeys: 'Claves API',
     manageApiIntegration: 'Gestionar integración API',
     manageApiKeys: 'Gestionar claves API',
@@ -844,7 +846,7 @@ const esES = {
       'Una vez eliminada, la configuración de este servidor MCP no se podrá recuperar.',
   },
   pipelines: {
-    title: 'Pipelines',
+    title: 'Flujos',
     description:
       'Los Pipelines definen el flujo de procesamiento de eventos de mensajes, se usan para vincular a los Bots',
     createPipeline: 'Crear Pipeline',
@@ -1178,6 +1180,7 @@ const esES = {
   },
   account: {
     settings: 'Configuración de la cuenta',
+    settingsDescription: 'Gestiona tu contraseña y las cuentas vinculadas',
     setPassword: 'Establecer contraseña',
     passwordSetSuccess: 'Contraseña establecida correctamente',
     passwordStatus: 'Contraseña local',
@@ -1419,6 +1422,15 @@ const esES = {
     boxSessionCreated: 'Creado',
     boxSessionLastUsed: 'Último uso',
   },
+  settingsDialog: {
+    title: 'Configuración',
+    nav: {
+      models: 'Modelos',
+      api: 'API',
+      storage: 'Almacenamiento',
+      account: 'Cuenta',
+    },
+  },
   storageAnalysis: {
     title: 'Análisis de almacenamiento',
     description:

web/src/i18n/locales/ja-JP.ts

@@ -124,6 +124,8 @@ const jaJP = {
     changePasswordFailed:
       'パスワードの変更に失敗しました。現在のパスワードを確認してください',
     apiIntegration: 'API統合',
+    apiIntegrationDescription:
+      '外部アクセス用の API キーと Webhook を管理します',
     apiKeys: 'API キー',
     manageApiIntegration: 'API統合の管理',
     manageApiKeys: 'API キーの管理',
@@ -1153,6 +1155,7 @@ const jaJP = {
   },
   account: {
     settings: 'アカウント設定',
+    settingsDescription: 'パスワードと連携アカウントを管理します',
     setPassword: 'パスワードを設定',
     passwordSetSuccess: 'パスワードの設定に成功しました',
     passwordStatus: 'ローカルパスワード',
@@ -1392,6 +1395,15 @@ const jaJP = {
     boxSessionCreated: '作成日時',
     boxSessionLastUsed: '最終使用',
   },
+  settingsDialog: {
+    title: '設定',
+    nav: {
+      models: 'モデル',
+      api: 'API',
+      storage: 'ストレージ',
+      account: 'アカウント',
+    },
+  },
   storageAnalysis: {
     title: 'ストレージ分析',
     description: 'ストレージ使用量とクリーンアップ候補を確認します',

web/src/i18n/locales/ru-RU.ts

@@ -122,6 +122,8 @@ const ruRU = {
     changePasswordFailed:
       'Не удалось изменить пароль, проверьте текущий пароль',
     apiIntegration: 'API-интеграция',
+    apiIntegrationDescription:
+      'Управление API-ключами и вебхуками для внешнего доступа',
     apiKeys: 'API-ключи',
     manageApiIntegration: 'Управление API-интеграцией',
     manageApiKeys: 'Управление API-ключами',
@@ -1156,6 +1158,7 @@ const ruRU = {
   },
   account: {
     settings: 'Настройки аккаунта',
+    settingsDescription: 'Управление паролем и связанными аккаунтами',
     setPassword: 'Установить пароль',
     passwordSetSuccess: 'Пароль успешно установлен',
     passwordStatus: 'Локальный пароль',
@@ -1395,6 +1398,15 @@ const ruRU = {
     boxSessionCreated: 'Создано',
     boxSessionLastUsed: 'Последнее использование',
   },
+  settingsDialog: {
+    title: 'Настройки',
+    nav: {
+      models: 'Модели',
+      api: 'API',
+      storage: 'Хранилище',
+      account: 'Аккаунт',
+    },
+  },
   storageAnalysis: {
     title: 'Анализ хранилища',
     description: 'Проверьте использование хранилища и кандидатов на очистку',

web/src/i18n/locales/th-TH.ts

@@ -120,6 +120,8 @@ const thTH = {
     changePasswordSuccess: 'เปลี่ยนรหัสผ่านสำเร็จ',
     changePasswordFailed: 'เปลี่ยนรหัสผ่านล้มเหลว กรุณาตรวจสอบรหัสผ่านปัจจุบัน',
     apiIntegration: 'การเชื่อมต่อ API',
+    apiIntegrationDescription:
+      'จัดการ API key และ webhook สำหรับการเข้าถึงจากภายนอก',
     apiKeys: 'คีย์ API',
     manageApiIntegration: 'จัดการการเชื่อมต่อ API',
     manageApiKeys: 'จัดการคีย์ API',
@@ -300,7 +302,7 @@ const thTH = {
     },
   },
   bots: {
-    title: 'Bot',
+    title: 'บอท',
     description:
       'สร้างและจัดการ Bot ซึ่งเป็นจุดเชื่อมต่อของ LangBot กับแพลตฟอร์มต่างๆ',
     createBot: 'สร้าง Bot',
@@ -819,7 +821,7 @@ const thTH = {
       'เมื่อลบแล้ว การกำหนดค่าเซิร์ฟเวอร์ MCP นี้จะไม่สามารถกู้คืนได้',
   },
   pipelines: {
-    title: 'Pipeline',
+    title: 'ไปป์ไลน์',
     description:
       'Pipeline กำหนดกระบวนการประมวลผลเหตุการณ์ข้อความ ใช้เพื่อผูกกับ Bot',
     createPipeline: 'สร้าง Pipeline',
@@ -1130,6 +1132,7 @@ const thTH = {
   },
   account: {
     settings: 'การตั้งค่าบัญชี',
+    settingsDescription: 'จัดการรหัสผ่านและบัญชีที่เชื่อมโยงของคุณ',
     setPassword: 'ตั้งรหัสผ่าน',
     passwordSetSuccess: 'ตั้งรหัสผ่านสำเร็จ',
     passwordStatus: 'รหัสผ่านท้องถิ่น',
@@ -1364,6 +1367,15 @@ const thTH = {
     boxSessionCreated: 'สร้างเมื่อ',
     boxSessionLastUsed: 'ใช้ล่าสุด',
   },
+  settingsDialog: {
+    title: 'การตั้งค่า',
+    nav: {
+      models: 'โมเดล',
+      api: 'API',
+      storage: 'พื้นที่จัดเก็บ',
+      account: 'บัญชี',
+    },
+  },
   storageAnalysis: {
     title: 'วิเคราะห์พื้นที่จัดเก็บ',
     description: 'ตรวจสอบการใช้พื้นที่จัดเก็บและรายการที่สามารถล้างได้',

web/src/i18n/locales/vi-VN.ts

@@ -123,6 +123,8 @@ const viVN = {
     changePasswordFailed:
       'Đổi mật khẩu thất bại, vui lòng kiểm tra mật khẩu hiện tại',
     apiIntegration: 'Tích hợp API',
+    apiIntegrationDescription:
+      'Quản lý API key và webhook cho truy cập từ bên ngoài',
     apiKeys: 'Khóa API',
     manageApiIntegration: 'Quản lý tích hợp API',
     manageApiKeys: 'Quản lý khóa API',
@@ -833,7 +835,7 @@ const viVN = {
     deleteMCPHint: 'Sau khi xóa, cấu hình máy chủ MCP này không thể khôi phục.',
   },
   pipelines: {
-    title: 'Pipeline',
+    title: 'Quy trình',
     description:
       'Pipeline xác định luồng xử lý sự kiện tin nhắn, dùng để liên kết với Bot',
     createPipeline: 'Tạo Pipeline',
@@ -1150,6 +1152,7 @@ const viVN = {
   },
   account: {
     settings: 'Cài đặt tài khoản',
+    settingsDescription: 'Quản lý mật khẩu và các tài khoản liên kết của bạn',
     setPassword: 'Đặt mật khẩu',
     passwordSetSuccess: 'Đặt mật khẩu thành công',
     passwordStatus: 'Mật khẩu cục bộ',
@@ -1388,6 +1391,15 @@ const viVN = {
     boxSessionCreated: 'Đã tạo',
     boxSessionLastUsed: 'Lần cuối sử dụng',
   },
+  settingsDialog: {
+    title: 'Cài đặt',
+    nav: {
+      models: 'Mô hình',
+      api: 'API',
+      storage: 'Lưu trữ',
+      account: 'Tài khoản',
+    },
+  },
   storageAnalysis: {
     title: 'Phân tích lưu trữ',
     description: 'Kiểm tra dung lượng lưu trữ và các mục có thể dọn dẹp',

web/src/i18n/locales/zh-Hans.ts

@@ -116,6 +116,7 @@ const zhHans = {
     changePasswordSuccess: '密码修改成功',
     changePasswordFailed: '密码修改失败，请检查当前密码是否正确',
     apiIntegration: 'API 集成',
+    apiIntegrationDescription: '管理用于外部访问的 API 密钥和 Webhook',
     apiKeys: 'API 密钥',
     manageApiIntegration: '管理 API 集成',
     manageApiKeys: '管理 API 密钥',
@@ -1096,6 +1097,7 @@ const zhHans = {
   },
   account: {
     settings: '账户设置',
+    settingsDescription: '管理你的密码和关联账户',
     setPassword: '设置密码',
     passwordSetSuccess: '密码设置成功',
     passwordStatus: '本地密码',
@@ -1328,6 +1330,15 @@ const zhHans = {
     boxSessionCreated: '创建时间',
     boxSessionLastUsed: '最后使用',
   },
+  settingsDialog: {
+    title: '设置',
+    nav: {
+      models: '模型',
+      api: 'API',
+      storage: '存储',
+      account: '账户',
+    },
+  },
   storageAnalysis: {
     title: '存储分析',
     description: '查看存储占用和可清理文件',

web/src/i18n/locales/zh-Hant.ts

@@ -116,6 +116,7 @@ const zhHant = {
     changePasswordSuccess: '密碼修改成功',
     changePasswordFailed: '密碼修改失敗，請檢查當前密碼是否正確',
     apiIntegration: 'API 整合',
+    apiIntegrationDescription: '管理用於外部存取的 API 金鑰和 Webhook',
     apiKeys: 'API 金鑰',
     manageApiIntegration: '管理 API 整合',
     manageApiKeys: '管理 API 金鑰',
@@ -1095,6 +1096,7 @@ const zhHant = {
   },
   account: {
     settings: '帳戶設定',
+    settingsDescription: '管理你的密碼和關聯帳戶',
     setPassword: '設定密碼',
     passwordSetSuccess: '密碼設定成功',
     passwordStatus: '本地密碼',
@@ -1327,6 +1329,15 @@ const zhHant = {
     boxSessionCreated: '建立時間',
     boxSessionLastUsed: '最後使用',
   },
+  settingsDialog: {
+    title: '設定',
+    nav: {
+      models: '模型',
+      api: 'API',
+      storage: '儲存',
+      account: '帳戶',
+    },
+  },
   storageAnalysis: {
     title: '儲存分析',
     description: '查看儲存占用和可清理檔案',

web/tests/e2e/crud-smoke.spec.ts

@@ -0,0 +1,455 @@
+import { expect, Page, test } from '@playwright/test';
+
+import { installLangBotApiMocks } from './fixtures/langbot-api';
+
+async function save(page: Page) {
+  const button = page.getByRole('button', { name: /^Save$/ });
+  await expect(button).toBeEnabled();
+  await button.click();
+}
+
+async function submit(page: Page) {
+  await page.getByRole('button', { name: /^Submit$/ }).click();
+}
+
+async function confirmDelete(page: Page) {
+  await page
+    .getByRole('dialog')
+    .getByRole('button', { name: /^Confirm Delete$/ })
+    .click();
+}
+
+test.describe('frontend CRUD smoke flows', () => {
+  test('creates, edits, and deletes a bot', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/bots?id=new');
+
+    await expect(page.locator('input[name="name"]')).toBeVisible();
+    await page.locator('input[name="name"]').fill('Support Bot');
+    await page
+      .locator('input[name="description"]')
+      .fill('Answers customer support questions.');
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+
+    await expect(page).toHaveURL(/\/home\/bots\?id=bot-1$/);
+    await page.reload();
+    await expect(page.locator('input[name="name"]')).toHaveValue('Support Bot');
+
+    await page
+      .locator('input[name="description"]')
+      .fill('Answers customer support questions with context.');
+    await save(page);
+    await expect(page.locator('input[name="description"]')).toHaveValue(
+      'Answers customer support questions with context.',
+    );
+
+    await page.getByRole('button', { name: /^Delete$/ }).click();
+    await confirmDelete(page);
+
+    await expect(page).toHaveURL(/\/home\/bots$/);
+    await expect(page.getByText('Select a bot from the sidebar')).toBeVisible();
+  });
+
+  test('creates, edits, and deletes a pipeline', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/pipelines?id=new');
+
+    await expect(page.locator('input[name="basic.name"]')).toBeVisible();
+    await page.locator('input[name="basic.name"]').fill('Escalation Pipeline');
+    await page
+      .locator('input[name="basic.description"]')
+      .fill('Routes urgent customer issues.');
+    await submit(page);
+
+    await expect(page).toHaveURL(/\/home\/pipelines\?id=pipeline-1$/);
+    await page.reload();
+    await expect(page.locator('input[name="basic.name"]')).toHaveValue(
+      'Escalation Pipeline',
+    );
+
+    await page
+      .locator('input[name="basic.description"]')
+      .fill('Routes urgent customer issues to operators.');
+    await save(page);
+    await expect(page.locator('input[name="basic.description"]')).toHaveValue(
+      'Routes urgent customer issues to operators.',
+    );
+
+    await page.getByRole('button', { name: /^Delete$/ }).click();
+    await confirmDelete(page);
+
+    await expect(page).toHaveURL(/\/home\/pipelines$/);
+    await expect(
+      page.getByText('Select a pipeline from the sidebar'),
+    ).toBeVisible();
+  });
+
+  test('creates, edits, and deletes a knowledge base', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/knowledge?id=new');
+
+    await expect(page.locator('input[name="name"]')).toBeVisible();
+    await page.locator('input[name="name"]').fill('Support Knowledge');
+    await page
+      .locator('input[name="description"]')
+      .fill('Source material for support answers.');
+    await submit(page);
+
+    await expect(page).toHaveURL(/\/home\/knowledge\?id=knowledge-1$/);
+    await page.reload();
+    await expect(page.locator('input[name="name"]')).toHaveValue(
+      'Support Knowledge',
+    );
+    await page.waitForTimeout(600);
+
+    await page
+      .locator('input[name="description"]')
+      .fill('Updated source material for support answers.');
+    await save(page);
+    await expect(page.locator('input[name="description"]')).toHaveValue(
+      'Updated source material for support answers.',
+    );
+
+    await page.getByRole('button', { name: /^Delete$/ }).click();
+    await confirmDelete(page);
+
+    await expect(page).toHaveURL(/\/home\/knowledge$/);
+    await expect(
+      page.getByText('Select a knowledge base from the sidebar'),
+    ).toBeVisible();
+  });
+
+  test('creates, edits, and deletes an MCP server', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/mcp?id=new');
+
+    await expect(page.locator('input[name="name"]')).toBeVisible();
+    await page.locator('input[name="name"]').fill('playwright-mcp');
+    await page
+      .locator('input[name="url"]')
+      .fill('https://mcp.example.test/sse');
+    await submit(page);
+
+    await expect(page).toHaveURL(/\/home\/mcp\?id=playwright-mcp$/);
+    await page.reload();
+    await expect(page.locator('input[name="name"]')).toHaveValue(
+      'playwright-mcp',
+    );
+
+    await page
+      .locator('input[name="url"]')
+      .fill('https://mcp.example.test/updated-sse');
+    await save(page);
+    await expect(page.locator('input[name="url"]')).toHaveValue(
+      'https://mcp.example.test/updated-sse',
+    );
+
+    await page.getByRole('button', { name: /^Delete$/ }).click();
+    await confirmDelete(page);
+
+    await expect(page).toHaveURL(/\/home\/mcp$/);
+    await expect(
+      page.getByText('Select an MCP server from the sidebar'),
+    ).toBeVisible();
+  });
+
+  test('updates and deletes a manually-created skill', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/skills?action=create');
+
+    await page.locator('#display_name').fill('Release Notes');
+    await page.locator('#name').fill('release_notes');
+    await page.locator('#description').fill('Drafts release notes.');
+    await page
+      .locator('#instructions')
+      .fill('Summarize merged changes for the next release.');
+    await save(page);
+
+    await expect(page).toHaveURL(/\/home\/skills\?id=release_notes$/);
+    await page.reload();
+    await expect(page.locator('#description')).toHaveValue(
+      'Drafts release notes.',
+    );
+
+    await page
+      .locator('#description')
+      .fill('Drafts concise release notes for maintainers.');
+    await expect(page.locator('#description')).toHaveValue(
+      'Drafts concise release notes for maintainers.',
+    );
+    await save(page);
+    await page.reload();
+    await expect(page.locator('#description')).toHaveValue(
+      'Drafts concise release notes for maintainers.',
+    );
+    await expect(page.locator('#instructions')).toHaveValue(
+      'Summarize merged changes for the next release.',
+    );
+
+    await page.getByRole('button', { name: /^Delete$/ }).click();
+    await confirmDelete(page);
+
+    await expect(page).toHaveURL(/\/home\/add-extension$/);
+  });
+});
+
+test.describe('bot advanced flows', () => {
+  test('toggles bot enable/disable state', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    // Create a bot first
+    await page.goto('/home/bots?id=new');
+    await page.locator('input[name="name"]').fill('Toggle Test Bot');
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+
+    await expect(page).toHaveURL(/\/home\/bots\?id=bot-1$/);
+
+    // Wait for the enable switch to load (it's fetched via getBot)
+    await expect(page.locator('#bot-enable-switch')).toBeVisible({
+      timeout: 5000,
+    });
+
+    // Verify initial state is enabled
+    await expect(page.locator('#bot-enable-switch')).toBeChecked();
+
+    // Toggle to disabled
+    await page.locator('#bot-enable-switch').click();
+    await expect(page.locator('#bot-enable-switch')).not.toBeChecked();
+
+    // Reload and verify state persisted
+    await page.reload();
+    await expect(page.locator('#bot-enable-switch')).not.toBeChecked();
+  });
+
+  test('switches between bot detail tabs', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    // Create a bot
+    await page.goto('/home/bots?id=new');
+    await page.locator('input[name="name"]').fill('Tab Test Bot');
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+
+    // Verify we're on the Configuration tab
+    await expect(
+      page.getByRole('tab', { name: /Configuration/ }),
+    ).toHaveAttribute('data-state', 'active');
+    await expect(page.locator('input[name="name"]')).toBeVisible();
+
+    // Switch to Logs tab
+    await page.getByRole('tab', { name: /Logs/ }).click();
+    await expect(page.getByRole('tab', { name: /Logs/ })).toHaveAttribute(
+      'data-state',
+      'active',
+    );
+
+    // Switch to Sessions tab
+    await page.getByRole('tab', { name: /Sessions/ }).click();
+    await expect(page.getByRole('tab', { name: /Sessions/ })).toHaveAttribute(
+      'data-state',
+      'active',
+    );
+
+    // Switch back to Configuration
+    await page.getByRole('tab', { name: /Configuration/ }).click();
+    await expect(page.locator('input[name="name"]')).toBeVisible();
+  });
+
+  test('save button is disabled when form is clean', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    // Create a bot
+    await page.goto('/home/bots?id=new');
+    await page.locator('input[name="name"]').fill('Clean Form Bot');
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+
+    // After creation, save button should be disabled (form is clean)
+    const saveButton = page.getByRole('button', { name: /^Save$/ });
+    await expect(saveButton).toBeDisabled();
+
+    // Edit the form
+    await page.locator('input[name="description"]').fill('New description');
+    await expect(saveButton).toBeEnabled();
+
+    // Save
+    await saveButton.click();
+    await expect(saveButton).toBeDisabled();
+  });
+
+  test('shows validation error when bot name is empty', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/bots?id=new');
+
+    // Select adapter but leave name empty
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+
+    // Should show validation error for name (zod validation)
+    await expect(page.getByText(/cannot be empty/i)).toBeVisible();
+    await expect(page).toHaveURL(/\/home\/bots\?id=new$/);
+  });
+});
+
+test.describe('pipeline advanced flows', () => {
+  test('switches to monitoring tab from pipeline detail', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    // Create a pipeline
+    await page.goto('/home/pipelines?id=new');
+    await page.locator('input[name="basic.name"]').fill('Tab Test Pipeline');
+    await submit(page);
+
+    // Verify we're on the Configuration tab
+    await expect(
+      page.getByRole('tab', { name: /Configuration/ }),
+    ).toHaveAttribute('data-state', 'active');
+
+    // Switch to Monitoring tab (labeled "Dashboard" in the pipeline context)
+    // Skip Debug tab as it requires WebSocket connection
+    await page.getByRole('tab', { name: /Dashboard/ }).click();
+    await expect(page.getByRole('tab', { name: /Dashboard/ })).toHaveAttribute(
+      'data-state',
+      'active',
+    );
+
+    // Switch back to Configuration
+    await page.getByRole('tab', { name: /Configuration/ }).click();
+    await expect(page.locator('input[name="basic.name"]')).toBeVisible();
+  });
+
+  test('save button reflects form dirty state', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    // Create a pipeline
+    await page.goto('/home/pipelines?id=new');
+    await page.locator('input[name="basic.name"]').fill('Dirty Form Pipeline');
+    await submit(page);
+
+    // Wait for the page to fully load and form to reset
+    await page.waitForTimeout(500);
+
+    // Edit the form - use the name field which definitely triggers dirty state
+    await page
+      .locator('input[name="basic.name"]')
+      .fill('Dirty Form Pipeline Updated');
+    const saveButton = page.getByRole('button', { name: /^Save$/ });
+    await expect(saveButton).toBeEnabled();
+
+    // Save
+    await saveButton.click();
+    // Wait for save to complete
+    await page.waitForTimeout(500);
+  });
+
+  test('shows validation error when pipeline name is empty', async ({
+    page,
+  }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/pipelines?id=new');
+
+    // Submit without filling name
+    await submit(page);
+
+    // Should show validation error for name (zod validation)
+    await expect(page.getByText(/cannot be empty/i)).toBeVisible();
+    await expect(page).toHaveURL(/\/home\/pipelines\?id=new$/);
+  });
+});
+
+test.describe('cross-resource flows', () => {
+  test('creates a pipeline then binds it to a bot', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    // Create a pipeline first
+    await page.goto('/home/pipelines?id=new');
+    await page.locator('input[name="basic.name"]').fill('Production Pipeline');
+    await submit(page);
+    await expect(page).toHaveURL(/\/home\/pipelines\?id=pipeline-1$/);
+
+    // Create a bot
+    await page.goto('/home/bots?id=new');
+    await page.locator('input[name="name"]').fill('Bound Bot');
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+    await expect(page).toHaveURL(/\/home\/bots\?id=bot-1$/);
+
+    // Wait for form to fully load
+    await expect(page.locator('input[name="name"]')).toHaveValue('Bound Bot');
+
+    // Find the pipeline select by its label "Bind Pipeline"
+    const pipelineCard = page.getByText('Bind Pipeline').locator('..');
+    await expect(pipelineCard).toBeVisible({ timeout: 5000 });
+
+    // Click on the select trigger within the pipeline binding card
+    // The select trigger shows "Select Pipeline" placeholder initially
+    const pipelineSelectTrigger = page.getByText('Select Pipeline').first();
+    await pipelineSelectTrigger.click();
+
+    // Select the pipeline option
+    await page.getByRole('option', { name: 'Production Pipeline' }).click();
+
+    // Save the bot
+    await save(page);
+
+    // Reload and verify binding persisted
+    await page.reload();
+    // The pipeline name should appear in the select trigger (not in sidebar or options)
+    await expect(
+      page
+        .locator('[data-slot="select-trigger"]')
+        .filter({ hasText: 'Production Pipeline' }),
+    ).toBeVisible();
+  });
+});
+
+test.describe('empty states', () => {
+  test('shows empty state when no bots exist', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/bots');
+    await expect(page.getByText('Select a bot from the sidebar')).toBeVisible();
+  });
+
+  test('shows empty state when no pipelines exist', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/pipelines');
+    await expect(
+      page.getByText('Select a pipeline from the sidebar'),
+    ).toBeVisible();
+  });
+
+  test('shows empty state when no knowledge bases exist', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/knowledge');
+    await expect(
+      page.getByText('Select a knowledge base from the sidebar'),
+    ).toBeVisible();
+  });
+
+  test('shows empty state when no MCP servers exist', async ({ page }) => {
+    await installLangBotApiMocks(page, { authenticated: true });
+
+    await page.goto('/home/mcp');
+    await expect(
+      page.getByText('Select an MCP server from the sidebar'),
+    ).toBeVisible();
+  });
+});

web/tests/e2e/fixtures/langbot-api.ts

@@ -11,7 +11,68 @@ interface SkillMock {
   updated_at: string;
 }
 
+interface PipelineMock {
+  uuid: string;
+  name: string;
+  description: string;
+  config: JsonRecord;
+  emoji: string;
+  is_default: boolean;
+  updated_at: string;
+}
+
+interface KnowledgeBaseMock {
+  uuid: string;
+  name: string;
+  description: string;
+  emoji: string;
+  knowledge_engine_plugin_id: string;
+  creation_settings: JsonRecord;
+  retrieval_settings: JsonRecord;
+  knowledge_engine: {
+    plugin_id: string;
+    name: {
+      en_US: string;
+      zh_Hans: string;
+    };
+    capabilities: string[];
+  };
+  updated_at: string;
+}
+
+interface MCPServerMock {
+  name: string;
+  mode: 'sse' | 'stdio' | 'http';
+  enable: boolean;
+  extra_args: JsonRecord;
+  runtime_info: {
+    status: 'connected';
+    tool_count: number;
+    tools: unknown[];
+  };
+  readme: string;
+  updated_at: string;
+}
+
+interface BotMock {
+  uuid: string;
+  name: string;
+  description: string;
+  enable: boolean;
+  adapter: string;
+  adapter_config: JsonRecord;
+  use_pipeline_uuid?: string;
+  pipeline_routing_rules: unknown[];
+  adapter_runtime_values: JsonRecord;
+  updated_at: string;
+}
+
 interface LangBotApiMockState {
+  bots: BotMock[];
+  counters: Record<string, number>;
+  knowledgeBases: KnowledgeBaseMock[];
+  mcpServers: MCPServerMock[];
+  pipelines: PipelineMock[];
   skills: SkillMock[];
 }
 
@@ -36,6 +97,19 @@ function routePath(route: Route) {
   return new URL(route.request().url()).pathname;
 }
 
+function parseJsonBody(route: Route): JsonRecord {
+  return JSON.parse(route.request().postData() || '{}') as JsonRecord;
+}
+
+function now() {
+  return new Date().toISOString();
+}
+
+function nextId(state: LangBotApiMockState, prefix: string) {
+  state.counters[prefix] = (state.counters[prefix] || 0) + 1;
+  return `${prefix}-${state.counters[prefix]}`;
+}
+
 function emptyMonitoringData() {
   return {
     overview: {
@@ -93,6 +167,131 @@ function makeSkill(data: JsonRecord): SkillMock {
   };
 }
 
+function makePipeline(
+  state: LangBotApiMockState,
+  data: JsonRecord,
+  uuid = nextId(state, 'pipeline'),
+): PipelineMock {
+  return {
+    uuid,
+    name: String(data.name || ''),
+    description: String(data.description || ''),
+    config: (data.config as JsonRecord | undefined) || {
+      ai: {},
+      trigger: {},
+      safety: {},
+      output: {},
+    },
+    emoji: String(data.emoji || '⚙️'),
+    is_default: false,
+    updated_at: now(),
+  };
+}
+
+function knowledgeEngine() {
+  return {
+    plugin_id: 'builtin/minimal-knowledge',
+    name: {
+      en_US: 'Minimal Knowledge Engine',
+      zh_Hans: '最小知识库引擎',
+    },
+    description: {
+      en_US: 'Minimal mocked engine for frontend smoke tests.',
+      zh_Hans: '用于前端冒烟测试的最小模拟引擎。',
+    },
+    capabilities: ['text_retrieval'],
+    creation_schema: [],
+    retrieval_schema: [],
+  };
+}
+
+function makeKnowledgeBase(
+  state: LangBotApiMockState,
+  data: JsonRecord,
+  uuid = nextId(state, 'knowledge'),
+): KnowledgeBaseMock {
+  const engine = knowledgeEngine();
+  return {
+    uuid,
+    name: String(data.name || ''),
+    description: String(data.description || ''),
+    emoji: String(data.emoji || '📚'),
+    knowledge_engine_plugin_id: String(
+      data.knowledge_engine_plugin_id || engine.plugin_id,
+    ),
+    creation_settings: (data.creation_settings as JsonRecord | undefined) || {},
+    retrieval_settings:
+      (data.retrieval_settings as JsonRecord | undefined) || {},
+    knowledge_engine: {
+      plugin_id: engine.plugin_id,
+      name: engine.name,
+      capabilities: engine.capabilities,
+    },
+    updated_at: now(),
+  };
+}
+
+function makeMCPServer(data: JsonRecord): MCPServerMock {
+  return {
+    name: String(data.name || ''),
+    mode: (data.mode as MCPServerMock['mode']) || 'sse',
+    enable: data.enable !== false,
+    extra_args: (data.extra_args as JsonRecord | undefined) || {},
+    runtime_info: {
+      status: 'connected',
+      tool_count: 0,
+      tools: [],
+    },
+    readme: '',
+    updated_at: now(),
+  };
+}
+
+function makeBot(
+  state: LangBotApiMockState,
+  data: JsonRecord,
+  uuid = nextId(state, 'bot'),
+): BotMock {
+  return {
+    uuid,
+    name: String(data.name || ''),
+    description: String(data.description || ''),
+    enable: data.enable !== false,
+    adapter: String(data.adapter || 'playwright-adapter'),
+    adapter_config: (data.adapter_config as JsonRecord | undefined) || {},
+    use_pipeline_uuid: data.use_pipeline_uuid
+      ? String(data.use_pipeline_uuid)
+      : undefined,
+    pipeline_routing_rules:
+      (data.pipeline_routing_rules as unknown[] | undefined) || [],
+    adapter_runtime_values: {
+      webhook_full_url: `https://playwright.test/bots/${uuid}/webhook`,
+      extra_webhook_full_url: '',
+    },
+    updated_at: now(),
+  };
+}
+
+function mockAdapters() {
+  return [
+    {
+      name: 'playwright-adapter',
+      label: {
+        en_US: 'Playwright Adapter',
+        zh_Hans: 'Playwright 适配器',
+      },
+      description: {
+        en_US: 'Minimal adapter for frontend E2E tests.',
+        zh_Hans: '用于前端 E2E 测试的最小适配器。',
+      },
+      spec: {
+        categories: ['testing'],
+        config: [],
+      },
+    },
+  ];
+}
+
 async function handleBackendApi(route: Route, state: LangBotApiMockState) {
   const request = route.request();
   const url = new URL(request.url());
@@ -147,16 +346,160 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
     return fulfillJson(route, { credits: null });
   }
 
+  if (path === '/api/v1/platform/adapters') {
+    return fulfillJson(route, { adapters: mockAdapters() });
+  }
+
   if (path === '/api/v1/platform/bots') {
-    return fulfillJson(route, { bots: [] });
+    if (method === 'POST') {
+      const bot = makeBot(state, parseJsonBody(route));
+      state.bots = [
+        ...state.bots.filter((item) => item.uuid !== bot.uuid),
+        bot,
+      ];
+      return fulfillJson(route, { uuid: bot.uuid });
+    }
+
+    return fulfillJson(route, { bots: state.bots });
+  }
+
+  const botLogsMatch = path.match(/^\/api\/v1\/platform\/bots\/([^/]+)\/logs$/);
+  if (botLogsMatch) {
+    return fulfillJson(route, { logs: [], total: 0 });
+  }
+
+  const botMatch = path.match(/^\/api\/v1\/platform\/bots\/([^/]+)$/);
+  if (botMatch) {
+    const botId = decodeURIComponent(botMatch[1]);
+
+    if (method === 'PUT') {
+      const bot = makeBot(state, parseJsonBody(route), botId);
+      state.bots = [...state.bots.filter((item) => item.uuid !== botId), bot];
+      return fulfillJson(route, {});
+    }
+
+    if (method === 'DELETE') {
+      state.bots = state.bots.filter((item) => item.uuid !== botId);
+      return fulfillJson(route, {});
+    }
+
+    const bot = state.bots.find((item) => item.uuid === botId);
+    return fulfillJson(route, {
+      bot: bot || makeBot(state, { name: botId }, botId),
+    });
+  }
+
+  if (path === '/api/v1/pipelines/_/metadata') {
+    return fulfillJson(route, { configs: [] });
   }
 
   if (path === '/api/v1/pipelines') {
-    return fulfillJson(route, { pipelines: [] });
+    if (method === 'POST') {
+      const pipeline = makePipeline(state, parseJsonBody(route));
+      state.pipelines = [
+        ...state.pipelines.filter((item) => item.uuid !== pipeline.uuid),
+        pipeline,
+      ];
+      return fulfillJson(route, { uuid: pipeline.uuid });
+    }
+
+    return fulfillJson(route, { pipelines: state.pipelines });
+  }
+
+  const pipelineMatch = path.match(/^\/api\/v1\/pipelines\/([^/]+)$/);
+  if (pipelineMatch) {
+    const pipelineId = decodeURIComponent(pipelineMatch[1]);
+
+    if (method === 'PUT') {
+      const pipeline = makePipeline(state, parseJsonBody(route), pipelineId);
+      state.pipelines = [
+        ...state.pipelines.filter((item) => item.uuid !== pipelineId),
+        pipeline,
+      ];
+      return fulfillJson(route, {});
+    }
+
+    if (method === 'DELETE') {
+      state.pipelines = state.pipelines.filter(
+        (item) => item.uuid !== pipelineId,
+      );
+      return fulfillJson(route, {});
+    }
+
+    const pipeline = state.pipelines.find((item) => item.uuid === pipelineId);
+    return fulfillJson(route, {
+      pipeline:
+        pipeline || makePipeline(state, { name: pipelineId }, pipelineId),
+    });
+  }
+
+  const pipelineExtensionsMatch = path.match(
+    /^\/api\/v1\/pipelines\/([^/]+)\/extensions$/,
+  );
+  if (pipelineExtensionsMatch) {
+    return fulfillJson(route, {
+      enable_all_plugins: true,
+      enable_all_mcp_servers: true,
+      enable_all_skills: true,
+      bound_plugins: [],
+      available_plugins: [],
+      bound_mcp_servers: [],
+      available_mcp_servers: state.mcpServers,
+      bound_skills: [],
+      available_skills: state.skills,
+    });
   }
 
   if (path === '/api/v1/knowledge/bases') {
-    return fulfillJson(route, { bases: [] });
+    if (method === 'POST') {
+      const base = makeKnowledgeBase(state, parseJsonBody(route));
+      state.knowledgeBases = [
+        ...state.knowledgeBases.filter((item) => item.uuid !== base.uuid),
+        base,
+      ];
+      return fulfillJson(route, { uuid: base.uuid });
+    }
+
+    return fulfillJson(route, { bases: state.knowledgeBases });
+  }
+
+  const knowledgeBaseFilesMatch = path.match(
+    /^\/api\/v1\/knowledge\/bases\/([^/]+)\/files$/,
+  );
+  if (knowledgeBaseFilesMatch) {
+    return fulfillJson(route, { files: [] });
+  }
+
+  const knowledgeBaseMatch = path.match(
+    /^\/api\/v1\/knowledge\/bases\/([^/]+)$/,
+  );
+  if (knowledgeBaseMatch) {
+    const baseId = decodeURIComponent(knowledgeBaseMatch[1]);
+
+    if (method === 'PUT') {
+      const base = makeKnowledgeBase(state, parseJsonBody(route), baseId);
+      state.knowledgeBases = [
+        ...state.knowledgeBases.filter((item) => item.uuid !== baseId),
+        base,
+      ];
+      return fulfillJson(route, { uuid: base.uuid });
+    }
+
+    if (method === 'DELETE') {
+      state.knowledgeBases = state.knowledgeBases.filter(
+        (item) => item.uuid !== baseId,
+      );
+      return fulfillJson(route, {});
+    }
+
+    const base = state.knowledgeBases.find((item) => item.uuid === baseId);
+    return fulfillJson(route, {
+      base: base || makeKnowledgeBase(state, { name: baseId }, baseId),
+    });
+  }
+
+  if (path === '/api/v1/knowledge/engines') {
+    return fulfillJson(route, { engines: [knowledgeEngine()] });
   }
 
   if (path === '/api/v1/knowledge/migration/status') {
@@ -176,7 +519,60 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
   }
 
   if (path === '/api/v1/mcp/servers') {
-    return fulfillJson(route, { servers: [] });
+    if (method === 'POST') {
+      const server = makeMCPServer(parseJsonBody(route));
+      state.mcpServers = [
+        ...state.mcpServers.filter((item) => item.name !== server.name),
+        server,
+      ];
+      return fulfillJson(route, { task_id: nextId(state, 'task') });
+    }
+
+    return fulfillJson(route, { servers: state.mcpServers });
+  }
+
+  const mcpTestMatch = path.match(/^\/api\/v1\/mcp\/servers\/([^/]+)\/test$/);
+  if (mcpTestMatch) {
+    return fulfillJson(route, {
+      runtime_info: {
+        status: 'connected',
+        tool_count: 0,
+        tools: [],
+      },
+    });
+  }
+
+  const mcpServerMatch = path.match(/^\/api\/v1\/mcp\/servers\/([^/]+)$/);
+  if (mcpServerMatch) {
+    const serverName = decodeURIComponent(mcpServerMatch[1]);
+
+    if (method === 'PUT') {
+      const existing = state.mcpServers.find(
+        (item) => item.name === serverName,
+      );
+      const server = makeMCPServer({
+        ...(existing || {}),
+        ...parseJsonBody(route),
+        name: serverName,
+      });
+      state.mcpServers = [
+        ...state.mcpServers.filter((item) => item.name !== serverName),
+        server,
+      ];
+      return fulfillJson(route, { task_id: nextId(state, 'task') });
+    }
+
+    if (method === 'DELETE') {
+      state.mcpServers = state.mcpServers.filter(
+        (item) => item.name !== serverName,
+      );
+      return fulfillJson(route, { task_id: nextId(state, 'task') });
+    }
+
+    const server = state.mcpServers.find((item) => item.name === serverName);
+    return fulfillJson(route, {
+      server: server || makeMCPServer({ name: serverName }),
+    });
   }
 
   if (path === '/api/v1/skills') {
@@ -229,6 +625,23 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
   const skillMatch = path.match(/^\/api\/v1\/skills\/([^/]+)$/);
   if (skillMatch) {
     const skillName = decodeURIComponent(skillMatch[1]);
+    if (method === 'PUT') {
+      const skill = makeSkill({
+        ...parseJsonBody(route),
+        name: skillName,
+      });
+      state.skills = [
+        ...state.skills.filter((item) => item.name !== skillName),
+        skill,
+      ];
+      return fulfillJson(route, { skill });
+    }
+
+    if (method === 'DELETE') {
+      state.skills = state.skills.filter((item) => item.name !== skillName);
+      return fulfillJson(route, {});
+    }
+
     const skill = state.skills.find((item) => item.name === skillName) || {
       name: skillName,
       display_name: '',
@@ -389,6 +802,11 @@ export async function installLangBotApiMocks(
 ) {
   const { authenticated = false, storage = {} } = options;
   const state: LangBotApiMockState = {
+    bots: [],
+    counters: {},
+    knowledgeBases: [],
+    mcpServers: [],
+    pipelines: [],
     skills: [],
   };