ci: expand release notes

Add compactTxOptions to the dialect interface so the raw scan and raw
deletion in CompactMetric observe a consistent view. PostgreSQL and
MySQL escalate to SERIALIZABLE, ensuring a point inserted between the
scan and the deletion cannot be removed before it is rolled up; on
PostgreSQL this surfaces as a serialization failure that is retried,
while InnoDB blocks the conflicting insert via locking reads. SQLite
returns nil since its single write connection already serializes writes.

Add regression tests covering partial fine-row overwrites of coarse
rollups during compaction.

.github/workflows/auto-merge-dev-to-main.yml

@@ -0,0 +1,109 @@
+name: Auto Merge Dev to Main
+
+on:
+  pull_request:
+    types: [opened, synchronize] # No longer need 'closed' trigger
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+
+jobs:
+  # Job to enable Auto-Merge for the PR
+  auto-merge:
+    runs-on: ubuntu-latest
+    # Only run for open PRs from dev to main
+    if: github.head_ref == 'dev' && github.base_ref == 'main'
+
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+      statuses: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0 # Required for git history
+
+      - name: Configure Git
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+      - name: Get PR number
+        id: get-pr
+        run: |
+          echo "pr_number=${{ github.event.number }}" >> $GITHUB_OUTPUT
+
+      - name: Check for conflicts
+        id: check-conflicts
+        run: |
+          # Ensure local branches are up-to-date
+          git fetch origin main
+          git fetch origin dev
+          
+          # Use merge-base to find the common ancestor and check for conflicts
+          if git merge-tree $(git merge-base origin/main origin/dev) origin/main origin/dev | grep -q '<<<<<<<'; then
+            echo "has_conflicts=true" >> $GITHUB_OUTPUT
+            echo "❌ Merge conflicts detected"
+          else
+            echo "has_conflicts=false" >> $GITHUB_OUTPUT
+            echo "✅ No merge conflicts"
+          fi
+
+      - name: Add conflict comment
+        if: steps.check-conflicts.outputs.has_conflicts == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr comment ${{ steps.get-pr.outputs.pr_number }} \
+            --body "❌ **Merge Conflict Detection**
+
+            This PR has merge conflicts and cannot be automatically merged. Please resolve conflicts manually and push to the dev branch.
+
+            Steps to resolve conflicts:
+            1. \`git checkout dev\`
+            2. \`git merge main\`
+            3. Resolve conflicts
+            4. \`git commit\`
+            5. \`git push origin dev\`"
+          exit 1 # Exit to prevent further steps
+
+      - name: Enable auto-merge
+        if: steps.check-conflicts.outputs.has_conflicts == 'false'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Enable auto-merge using a merge commit
+          gh pr merge ${{ steps.get-pr.outputs.pr_number }} \
+            --auto \
+            --merge \
+            --delete-branch=false
+          
+          # Add success comment
+          gh pr comment ${{ steps.get-pr.outputs.pr_number }} \
+            --body "✅ **Auto-merge Enabled**
+
+            This PR has no merge conflicts and auto-merge has been enabled. It will be automatically merged to the main branch once all checks pass.
+
+            Merge method: Merge commit
+            Branch retention: dev branch will be preserved"
+
+      - name: Summary
+        run: |
+          echo "### 🤖 Auto-merge Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- 📝 Processing PR #${{ steps.get-pr.outputs.pr_number }} (dev → main)" >> $GITHUB_STEP_SUMMARY
+          
+          if [ "${{ steps.check-conflicts.outputs.has_conflicts }}" == "true" ]; then
+            echo "- ❌ Merge conflicts detected, manual resolution required" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- ✅ No merge conflicts, auto-merge enabled" >> $GITHUB_STEP_SUMMARY
+          fi
+          
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**PR Link**: https://github.com/${{ github.repository }}/pull/${{ steps.get-pr.outputs.pr_number }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/build.yml

@@ -0,0 +1,117 @@
+name: Build Binaries on Main Push and PR
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  build-binaries:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        goos: [windows, linux]
+        goarch: [amd64, arm64, 386, riscv64]
+        include:
+          # Windows
+          - goos: windows
+            goarch: amd64
+            zig_target_triple: x86_64-windows-gnu
+            binary_extension: .exe
+          - goos: windows
+            goarch: arm64
+            zig_target_triple: aarch64-windows-gnu
+            binary_extension: .exe
+          - goos: windows
+            goarch: 386
+            zig_target_triple: x86-windows-gnu
+            binary_extension: .exe
+
+          # Linux
+          - goos: linux
+            goarch: amd64
+            zig_target_triple: x86_64-linux-musl
+            binary_extension: ""
+          - goos: linux
+            goarch: arm64
+            zig_target_triple: aarch64-linux-musl
+            binary_extension: ""
+          - goos: linux
+            goarch: 386
+            zig_target_triple: x86-linux-musl
+            binary_extension: ""
+          - goos: linux
+            goarch: riscv64
+            zig_target_triple: riscv64-linux-musl
+            binary_extension: ""
+
+        exclude:
+          - goos: windows
+            goarch: riscv64
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "23"
+
+      - name: Clone and build frontend
+        run: |
+          git clone https://github.com/komari-monitor/komari-web komari-web
+          cd komari-web
+          npm install
+          npm run build
+          cd ..
+          mkdir -p web/public/defaultTheme/dist
+          rm -rf web/public/defaultTheme/dist/*
+          cp -r komari-web/dist/* web/public/defaultTheme/dist/
+          cp -f komari-web/komari-theme.json web/public/defaultTheme/
+          if [ -f komari-web/preview.png ]; then cp -f komari-web/preview.png web/public/defaultTheme/; fi
+          if [ -f komari-web/perview.png ]; then cp -f komari-web/perview.png web/public/defaultTheme/; fi
+          # Compatibility: ensure both filenames exist if only one is present
+          if [ -f web/public/defaultTheme/preview.png ] && [ ! -f web/public/defaultTheme/perview.png ]; then cp -f web/public/defaultTheme/preview.png web/public/defaultTheme/perview.png; fi
+          if [ -f web/public/defaultTheme/perview.png ] && [ ! -f web/public/defaultTheme/preview.png ]; then cp -f web/public/defaultTheme/perview.png web/public/defaultTheme/preview.png; fi
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+
+      - name: Install Zig cross-compiler toolchain
+        run: |
+          sudo apt-get update # Update apt package lists
+          sudo apt-get install -y build-essential curl
+          wget https://ziglang.org/download/0.14.1/zig-x86_64-linux-0.14.1.tar.xz
+          sudo tar -C /usr/local -Jxf zig-x86_64-linux-0.14.1.tar.xz
+          echo "PATH=$PATH:/usr/local/zig-x86_64-linux-0.14.1" >> $GITHUB_ENV
+
+      - name: Build binary
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: 1
+          CC: zig cc -target ${{ matrix.zig_target_triple }}
+          GIN_MODE: release
+        run: |
+          BINARY_NAME=komari-${{ matrix.goos }}-${{ matrix.goarch }}
+          # Append the appropriate executable extension based on the OS
+          if [ "${{ matrix.binary_extension }}" != "" ]; then
+            BINARY_NAME=${BINARY_NAME}${{ matrix.binary_extension }}
+          fi
+          VERSION="${{ github.sha }}"
+          VERSION_HASH="${{ github.sha }}"
+          go build -trimpath -ldflags="-s -w -X github.com/komari-monitor/komari/utils.CurrentVersion=${VERSION} -X github.com/komari-monitor/komari/utils.VersionHash=${VERSION_HASH}" -o $BINARY_NAME
+
+      - name: Upload binary as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: komari-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: komari-${{ matrix.goos }}-${{ matrix.goarch }}*

.github/workflows/cleanup-packages.yml

@@ -1,8 +1,9 @@
 name: Cleanup Old Packages
 
 on:
-  schedule:
-    - cron: '0 0 * * 0'  # Run every Sunday at midnight
+  #schedule:
+  #  - cron: '0 0 * * 0'  # Run every Sunday at midnight
+  # 会清理掉正常的镜像
   workflow_dispatch:      # Allow manual trigger
 
 jobs:
@@ -20,40 +21,41 @@ jobs:
         uses: actions/github-script@v7
         with:
           script: |
-            const { data: packages } = await github.rest.packages.getAllPackageVersionsForPackageOwnedByAuthenticatedUser({
-              package_type: 'container',
-              package_name: process.env.GITHUB_REPOSITORY.split('/')[1]
+            // 分页获取所有包版本
+            const allVersions = [];
+            let page = 1;
+            let fetched;
+            const packageName = process.env.GITHUB_REPOSITORY.split('/')[1];
+            do {
+              const { data: packages } = await github.rest.packages.getAllPackageVersionsForPackageOwnedByAuthenticatedUser({
+                package_type: 'container',
+                package_name: packageName,
+                page,
+                per_page: 100
+              });
+              fetched = packages.length;
+              allVersions.push(...packages);
+              page++;
+            } while (fetched === 100);
+
+            // 筛选仅有 SHA/sha256 标签或无标签的版本
+            const shaOrNoTagVersions = allVersions.filter(pkg => {
+              const tags = pkg.metadata.container.tags;
+              return (
+                (tags.length === 1 && (
+                  tags[0].match(/^sha-[0-9a-f]{7}$/) ||
+                  tags[0].match(/^sha256:[0-9a-f]{64}$/)
+                )) ||
+                tags.length === 0
+              );
             });
 
-            // Keep packages with 'dev' or 'latest' tags, plus the 10 most recent non-dev, non-latest versions
-            const keepVersions = [
-              // Keep packages with 'dev' tag
-              ...packages.filter(pkg => pkg.metadata.container.tags.includes('dev')),
-              // Keep packages with 'latest' tag, excluding those already included with 'dev'
-              ...packages.filter(
-                pkg =>
-                  pkg.metadata.container.tags.includes('latest') &&
-                  !pkg.metadata.container.tags.includes('dev')
-              ),
-              // Keep the 10 most recent non-dev, non-latest packages
-              ...packages
-                .filter(
-                  pkg =>
-                    !pkg.metadata.container.tags.includes('dev') &&
-                    !pkg.metadata.container.tags.includes('latest')
-                )
-                .slice(0, 10),
-            ];
-
-            // Identify versions to delete (not in keepVersions)
-            const deleteVersions = packages.filter(pkg => !keepVersions.includes(pkg));
-
-            // Delete the versions
-            for (const version of deleteVersions) {
+            // 删除这些版本
+            for (const version of shaOrNoTagVersions) {
               await github.rest.packages.deletePackageVersionForAuthenticatedUser({
                 package_type: 'container',
-                package_name: process.env.GITHUB_REPOSITORY.split('/')[1],
+                package_name: packageName,
                 package_version_id: version.id
               });
-              console.log(`Deleted package version ${version.id}`);
+              console.log(`Deleted package version ${version.id} with tags: ${version.metadata.container.tags.join(', ') || 'none'}`);
             }

.github/workflows/development.yml

@@ -12,22 +12,29 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4      
-      
+        uses: actions/checkout@v4
+
       #- name: Create dummy index.html
       #  run: |
-      #    mkdir -p public/dist
-      #    echo "<html><body><h1>This is komari development server.</h1></body></html>" > public/dist/index.html
-      
+      #    mkdir -p web/public/defaultTheme/dist
+      #    echo "<html><body><h1>This is komari development server.</h1></body></html>" > web/public/defaultTheme/dist/index.html
+
       - name: Clone and build frontend
         run: |
-          git clone https://github.com/komari-monitor/komari-web web
-          cd web
+          git clone https://github.com/komari-monitor/komari-web komari-web
+          cd komari-web
           npm install
           npm run build
           cd ..
-          mkdir -p public/dist
-          cp -r web/dist/* public/dist/
+          mkdir -p web/public/defaultTheme/dist
+          rm -rf web/public/defaultTheme/dist/*
+          cp -r komari-web/dist/* web/public/defaultTheme/dist/
+          cp -f komari-web/komari-theme.json web/public/defaultTheme/
+          if [ -f komari-web/preview.png ]; then cp -f komari-web/preview.png web/public/defaultTheme/; fi
+          if [ -f komari-web/perview.png ]; then cp -f komari-web/perview.png web/public/defaultTheme/; fi
+          # Compatibility: ensure both filenames exist if only one is present
+          if [ -f web/public/defaultTheme/preview.png ] && [ ! -f web/public/defaultTheme/perview.png ]; then cp -f web/public/defaultTheme/preview.png web/public/defaultTheme/perview.png; fi
+          if [ -f web/public/defaultTheme/perview.png ] && [ ! -f web/public/defaultTheme/preview.png ]; then cp -f web/public/defaultTheme/perview.png web/public/defaultTheme/preview.png; fi
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -69,7 +76,7 @@ jobs:
       - name: Add host to known hosts
         run: |
           mkdir -p ~/.ssh
-          ssh-keyscan -H ${{ env.PRODUCTION_SERVER }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ env.PRODUCTION_SERVER }} >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Deploy to production
         run: |

.github/workflows/docker-publish.yml

@@ -1,9 +1,9 @@
-name: Docker Build and Publish
+name: Publish Docker Image on Main
 
 on:
-  push:
-    branches:
-      - main
+  #push:
+  #  branches:
+  #    - main
   workflow_dispatch:
 
 env:
@@ -11,7 +11,7 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  build-and-push:
+  build-and-push-multi-arch:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -21,6 +21,61 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "23"
+
+      - name: Clone and build frontend
+        run: |
+          git clone https://github.com/komari-monitor/komari-web komari-web
+          cd komari-web
+          npm install
+          npm run build
+          cd ..
+          mkdir -p web/public/defaultTheme/dist
+          rm -rf web/public/defaultTheme/dist/*
+          cp -r komari-web/dist/* web/public/defaultTheme/dist/
+          cp -f komari-web/komari-theme.json web/public/defaultTheme/
+          if [ -f komari-web/preview.png ]; then cp -f komari-web/preview.png web/public/defaultTheme/; fi
+          if [ -f komari-web/perview.png ]; then cp -f komari-web/perview.png web/public/defaultTheme/; fi
+          # Compatibility: ensure both filenames exist if only one is present
+          if [ -f web/public/defaultTheme/preview.png ] && [ ! -f web/public/defaultTheme/perview.png ]; then cp -f web/public/defaultTheme/preview.png web/public/defaultTheme/perview.png; fi
+          if [ -f web/public/defaultTheme/perview.png ] && [ ! -f web/public/defaultTheme/preview.png ]; then cp -f web/public/defaultTheme/perview.png web/public/defaultTheme/preview.png; fi
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+
+      - name: Install Zig
+        run: |
+          wget https://ziglang.org/download/0.14.1/zig-x86_64-linux-0.14.1.tar.xz
+          sudo tar -C /usr/local -Jxf zig-x86_64-linux-0.14.1.tar.xz
+          echo "PATH=$PATH:/usr/local/zig-x86_64-linux-0.14.1" >> $GITHUB_ENV
+
+      - name: Build static binaries for multi-arch
+        env:
+          GOOS: linux
+          CGO_ENABLED: 1
+          GIN_MODE: release
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION_HASH="${{ github.sha }}"
+          LDFLAGS="-s -w -X github.com/komari-monitor/komari/utils.CurrentVersion=${VERSION} -X github.com/komari-monitor/komari/utils.VersionHash=${VERSION_HASH}"
+
+          echo "Building for linux/amd64..."
+          GOARCH=amd64 CC="zig cc -target x86_64-linux-musl" go build -trimpath -ldflags="$LDFLAGS" -o komari-linux-amd64
+
+          echo "Building for linux/arm64..."
+          GOARCH=arm64 CC="zig cc -target aarch64-linux-musl" go build -trimpath -ldflags="$LDFLAGS" -o komari-linux-arm64
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
@@ -42,8 +97,6 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            VERSION=${{ github.ref_name }}
-            VERSION_HASH=${{ github.sha }}

.github/workflows/generate-release-notes.yml

@@ -0,0 +1,208 @@
+name: Generate Release Notes
+
+on:
+  release:
+    types: [published]
+  repository_dispatch:
+    types:
+      - komari-web-release-published
+  schedule:
+    - cron: "41 * * * *"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to regenerate notes for. Leave empty to use the latest release."
+        required: false
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  update-release-notes:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Generate and apply release notes
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const webRepo = { owner: "komari-monitor", repo: "komari-web" };
+
+            const clean = (value) => (typeof value === "string" ? value.trim() : "");
+            const releaseTimestamp = (release) => Date.parse(release.published_at || release.created_at || "");
+
+            async function resolveRelease() {
+              const requestedTag = clean(context.payload.release?.tag_name)
+                || clean(context.payload.client_payload?.tag)
+                || clean(core.getInput("tag"));
+
+              if (requestedTag) {
+                const release = context.payload.release?.tag_name === requestedTag
+                  ? context.payload.release
+                  : (await github.rest.repos.getReleaseByTag({ owner, repo, tag: requestedTag })).data;
+                return { tag: requestedTag, release };
+              }
+
+              const release = (await github.rest.repos.getLatestRelease({ owner, repo })).data;
+              return { tag: release.tag_name, release };
+            }
+
+            async function getPreviousReleaseTag(tag, release) {
+              const releases = await github.paginate(github.rest.repos.listReleases, {
+                owner,
+                repo,
+                per_page: 100,
+              });
+
+              const currentTime = releaseTimestamp(release);
+              const candidates = releases
+                .filter((item) => !item.draft && item.tag_name !== tag)
+                .filter((item) => {
+                  if (!Number.isFinite(currentTime)) {
+                    return true;
+                  }
+
+                  const itemTime = releaseTimestamp(item);
+                  return Number.isFinite(itemTime) && itemTime < currentTime;
+                })
+                .sort((left, right) => releaseTimestamp(right) - releaseTimestamp(left));
+
+              return candidates[0]?.tag_name || "";
+            }
+
+            async function getGeneratedNotes(tag, release, previousTag) {
+              const params = {
+                owner,
+                repo,
+                tag_name: tag,
+                target_commitish: release.target_commitish || undefined,
+              };
+
+              if (previousTag) {
+                params.previous_tag_name = previousTag;
+              }
+
+              const generated = await github.request(
+                "POST /repos/{owner}/{repo}/releases/generate-notes",
+                params,
+              );
+
+              return clean(generated.data.body);
+            }
+
+            async function getComparedCommits(previousTag, tag) {
+              if (!previousTag) {
+                return [];
+              }
+
+              const commits = [];
+              for (let page = 1; page <= 20; page += 1) {
+                const response = await github.rest.repos.compareCommitsWithBasehead({
+                  owner,
+                  repo,
+                  basehead: `${previousTag}...${tag}`,
+                  per_page: 100,
+                  page,
+                });
+
+                commits.push(...response.data.commits);
+
+                if (!response.headers.link?.includes('rel="next"')) {
+                  break;
+                }
+              }
+
+              return commits;
+            }
+
+            function renderCommitLine(commit) {
+              const subject = clean(commit.commit.message.split("\n")[0]) || "(no subject)";
+              const shortSha = commit.sha.slice(0, 7);
+              const author = commit.author?.login
+                ? ` @${commit.author.login}`
+                : (commit.commit.author?.name ? ` ${commit.commit.author.name}` : "");
+
+              return `- ${subject} ([${shortSha}](${commit.html_url}))${author}`;
+            }
+
+            async function buildCommitSection(previousTag, tag) {
+              if (!previousTag) {
+                return "## Commits\n\nNo previous release tag was found; commit comparison is unavailable.";
+              }
+
+              const commits = await getComparedCommits(previousTag, tag);
+              if (commits.length === 0) {
+                return `## Commits\n\nNo commits found between \`${previousTag}\` and \`${tag}\`.`;
+              }
+
+              return ["## Commits", "", ...commits.map(renderCommitLine)].join("\n");
+            }
+
+            async function buildWebReleaseSection(tag) {
+              const demoteMarkdownHeadings = (markdown) => markdown.replace(/^(#{1,5})(\s+)/gm, "#$1$2");
+
+              try {
+                const webRelease = (await github.rest.repos.getReleaseByTag({
+                  owner: webRepo.owner,
+                  repo: webRepo.repo,
+                  tag,
+                })).data;
+
+                const webBody = clean(webRelease.body);
+                if (!webBody) {
+                  return `## Komari Web Release Notes\n\nKomari Web release [${tag}](${webRelease.html_url}) exists, but its release notes are empty.`;
+                }
+
+                return [
+                  "## Komari Web Release Notes",
+                  "",
+                  `Source: [komari-web ${tag}](${webRelease.html_url})`,
+                  "",
+                  demoteMarkdownHeadings(webBody),
+                ].join("\n");
+              } catch (error) {
+                if (error.status === 404) {
+                  core.info(`Komari Web release ${tag} does not exist yet. Skipping web release notes for now.`);
+                  return "";
+                }
+
+                throw error;
+              }
+            }
+
+            const { tag, release } = await resolveRelease();
+            if (!tag) {
+              core.setFailed("No release tag was provided or found.");
+              return;
+            }
+
+            const previousTag = await getPreviousReleaseTag(tag, release);
+            const generatedBody = await getGeneratedNotes(tag, release, previousTag);
+            if (!generatedBody) {
+              core.setFailed(`GitHub returned empty release notes for ${tag}.`);
+              return;
+            }
+
+            const body = [
+              generatedBody,
+              await buildCommitSection(previousTag, tag),
+              await buildWebReleaseSection(tag),
+            ].filter(Boolean).join("\n\n");
+
+            if (clean(release.body) === clean(body)) {
+              core.info(`Release notes for ${tag} are already up to date.`);
+            } else {
+              await github.rest.repos.updateRelease({
+                owner,
+                repo,
+                release_id: release.id,
+                body,
+              });
+            }
+
+            await core.summary
+              .addHeading("Release Notes")
+              .addRaw(`Updated release notes for ${tag}.`)
+              .write();

.github/workflows/release-docker.yml

@@ -0,0 +1,107 @@
+name: Publish Docker Image
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-multi-arch:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "23"
+
+      - name: Clone and build frontend
+        run: |
+          git clone https://github.com/komari-monitor/komari-web komari-web
+          cd komari-web
+          npm install
+          npm run build
+          cd ..
+          mkdir -p web/public/defaultTheme/dist
+          rm -rf web/public/defaultTheme/dist/*
+          cp -r komari-web/dist/* web/public/defaultTheme/dist/
+          cp -f komari-web/komari-theme.json web/public/defaultTheme/
+          if [ -f komari-web/preview.png ]; then cp -f komari-web/preview.png web/public/defaultTheme/; fi
+          if [ -f komari-web/perview.png ]; then cp -f komari-web/perview.png web/public/defaultTheme/; fi
+          # Compatibility: ensure both filenames exist if only one is present
+          if [ -f web/public/defaultTheme/preview.png ] && [ ! -f web/public/defaultTheme/perview.png ]; then cp -f web/public/defaultTheme/preview.png web/public/defaultTheme/perview.png; fi
+          if [ -f web/public/defaultTheme/perview.png ] && [ ! -f web/public/defaultTheme/preview.png ]; then cp -f web/public/defaultTheme/perview.png web/public/defaultTheme/preview.png; fi
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+
+      - name: Install Zig
+        run: |
+          wget https://ziglang.org/download/0.14.1/zig-x86_64-linux-0.14.1.tar.xz
+          sudo tar -C /usr/local -Jxf zig-x86_64-linux-0.14.1.tar.xz
+          echo "PATH=$PATH:/usr/local/zig-x86_64-linux-0.14.1" >> $GITHUB_ENV
+
+      - name: Build static binaries for multi-arch
+        env:
+          GOOS: linux
+          CGO_ENABLED: 1
+          GIN_MODE: release
+        run: |
+          VERSION="${{ github.event.release.tag_name }}"
+          VERSION_HASH="${{ github.sha }}"
+          LDFLAGS="-s -w -X github.com/komari-monitor/komari/utils.CurrentVersion=${VERSION} -X github.com/komari-monitor/komari/utils.VersionHash=${VERSION_HASH}"
+
+          echo "Building for linux/amd64..."
+          GOARCH=amd64 CC="zig cc -target x86_64-linux-musl" go build -trimpath -ldflags="$LDFLAGS" -o komari-linux-amd64
+
+          echo "Building for linux/arm64..."
+          GOARCH=arm64 CC="zig cc -target aarch64-linux-musl" go build -trimpath -ldflags="$LDFLAGS" -o komari-linux-arm64
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ github.event.release.tag_name }}
+            type=raw,value=latest
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          no-cache: true
+          provenance: false

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Build and Attach Binaries to Release
+name: Attach Release Binaries
 
 on:
   release:
@@ -19,26 +19,43 @@ jobs:
     strategy:
       matrix:
         goos: [windows, linux]
-        goarch: [amd64, arm64]
+        goarch: [amd64, arm64, 386, riscv64]
         include:
+          # Windows
           - goos: windows
             goarch: amd64
-            gcc: x86_64-w64-mingw32-gcc
-            CGO_CFLAGS: ''
-            CGO_LDFLAGS: ''
+            zig_target_triple: x86_64-windows-gnu
+            binary_extension: .exe
+          - goos: windows
+            goarch: arm64
+            zig_target_triple: aarch64-windows-gnu
+            binary_extension: .exe
+          - goos: windows
+            goarch: 386
+            zig_target_triple: x86-windows-gnu
+            binary_extension: .exe
+
+          # Linux
           - goos: linux
             goarch: amd64
-            gcc: gcc
-            CGO_CFLAGS: ''
-            CGO_LDFLAGS: ''
+            zig_target_triple: x86_64-linux-musl
+            binary_extension: ""
           - goos: linux
             goarch: arm64
-            gcc: aarch64-linux-gnu-gcc
-            CGO_CFLAGS: '-pthread'
-            CGO_LDFLAGS: '-pthread'
+            zig_target_triple: aarch64-linux-musl
+            binary_extension: ""
+          - goos: linux
+            goarch: 386
+            zig_target_triple: x86-linux-musl
+            binary_extension: ""
+          - goos: linux
+            goarch: riscv64
+            zig_target_triple: riscv64-linux-musl
+            binary_extension: ""
+
         exclude:
           - goos: windows
-            goarch: arm64
+            goarch: riscv64
 
     steps:
       - name: Checkout code
@@ -51,94 +68,59 @@ jobs:
 
       - name: Clone and build frontend
         run: |
-          git clone https://github.com/komari-monitor/komari-web web
-          cd web
+          git clone https://github.com/komari-monitor/komari-web komari-web
+          cd komari-web
           npm install
           npm run build
           cd ..
-          mkdir -p public/dist
-          cp -r web/dist/* public/dist/
+          mkdir -p web/public/defaultTheme/dist
+          rm -rf web/public/defaultTheme/dist/*
+          cp -r komari-web/dist/* web/public/defaultTheme/dist/
+          cp -f komari-web/komari-theme.json web/public/defaultTheme/
+          if [ -f komari-web/preview.png ]; then cp -f komari-web/preview.png web/public/defaultTheme/; fi
+          if [ -f komari-web/perview.png ]; then cp -f komari-web/perview.png web/public/defaultTheme/; fi
+          # Compatibility: ensure both filenames exist if only one is present
+          if [ -f web/public/defaultTheme/preview.png ] && [ ! -f web/public/defaultTheme/perview.png ]; then cp -f web/public/defaultTheme/preview.png web/public/defaultTheme/perview.png; fi
+          if [ -f web/public/defaultTheme/perview.png ] && [ ! -f web/public/defaultTheme/preview.png ]; then cp -f web/public/defaultTheme/perview.png web/public/defaultTheme/preview.png; fi
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version: "1.23"
 
-      - name: Install cross-compiler
+      - name: Install Zig cross-compiler toolchain
         run: |
-          sudo apt-get update
-          if [ "${{ matrix.goarch }}" = "arm64" ] && [ "${{ matrix.goos }}" = "linux" ]; then
-            sudo apt-get install gcc-aarch64-linux-gnu
-          fi
-          if [ "${{ matrix.goarch }}" = "amd64" ] && [ "${{ matrix.goos }}" = "windows" ]; then
-            sudo apt-get install mingw-w64
-          fi
-          if [ "${{ matrix.goarch }}" = "arm64" ] && [ "${{ matrix.goos }}" = "windows" ]; then
-            sudo apt-get install wget xz-utils
-            mkdir -p /tmp/mingw64
-            wget https://github.com/mstorsjo/llvm-mingw/releases/download/20250613/llvm-mingw-20250613-ucrt-ubuntu-22.04-aarch64.tar.xz -O /tmp/mingw64.tar.xz
-            tar -xf /tmp/mingw64.tar.xz -C /tmp/mingw64 --strip-components=1
-          fi
+          sudo apt-get update # Update apt package lists
+          sudo apt-get install -y build-essential curl
+          wget https://ziglang.org/download/0.14.1/zig-x86_64-linux-0.14.1.tar.xz
+          sudo tar -C /usr/local -Jxf zig-x86_64-linux-0.14.1.tar.xz
+          echo "PATH=$PATH:/usr/local/zig-x86_64-linux-0.14.1" >> $GITHUB_ENV
 
       - name: Build binary
         env:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
           CGO_ENABLED: 1
-          CC: ${{ matrix.gcc }}
-          CGO_CFLAGS: ${{ matrix.CGO_CFLAGS }}
-          CGO_LDFLAGS: ${{ matrix.CGO_LDFLAGS }}
+          CC: zig cc -target ${{ matrix.zig_target_triple }}
           GIN_MODE: release
         run: |
           BINARY_NAME=komari-${{ matrix.goos }}-${{ matrix.goarch }}
-          if [ "${{ matrix.goos }}" = "windows" ]; then
-            BINARY_NAME=${BINARY_NAME}.exe
+          if [ "${{ matrix.binary_extension }}" != "" ]; then
+            BINARY_NAME=${BINARY_NAME}${{ matrix.binary_extension }}
           fi
           VERSION="${{ github.event.release.tag_name }}"
-          VERSION_HASH="${{ github.sha }}"
+          VERSION_HASH="${{ github.sha }}" # Use commit SHA for hash
           go build -trimpath -ldflags="-s -w -X github.com/komari-monitor/komari/utils.CurrentVersion=${VERSION} -X github.com/komari-monitor/komari/utils.VersionHash=${VERSION_HASH}" -o $BINARY_NAME
 
       - name: Upload binary to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          # Define the binary name for upload
           BINARY_NAME=komari-${{ matrix.goos }}-${{ matrix.goarch }}
           if [ "${{ matrix.goos }}" = "windows" ]; then
             BINARY_NAME=${BINARY_NAME}.exe
           fi
+          # Upload the binary as a release asset using GitHub CLI
           gh release upload ${{ github.event.release.tag_name }} $BINARY_NAME --repo ${{ github.repository }}
         shell: bash
-
-  build-and-push-docker:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=raw,value=${{ github.event.release.tag_name }}
-            type=raw,value=latest
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            VERSION=${{ github.event.release.tag_name }}
-            VERSION_HASH=${{ github.sha }}

.gitignore

@@ -7,12 +7,14 @@
 *.dll
 *.so
 *.dylib
+__debug*
 
 # local development data
 komari.db
 /data
 /utils/geoip/data
 .vscode/
+/backup
 
 # Test binary, built with `go test -c`
 *.test
@@ -29,3 +31,7 @@ go.work.sum
 
 # env file
 .env
+
+# build
+komari
+.codex

Dockerfile

@@ -1,34 +1,29 @@
-FROM node:23-alpine AS frontend
-WORKDIR /web
-RUN apk add --no-cache git
-RUN git clone https://github.com/komari-monitor/komari-web .
-RUN npm install
-RUN npm run build
-
-FROM golang:1.24 AS builder
-WORKDIR /app
-# RUN apt-get update && apt-get install -y musl-tools
-
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-COPY --from=frontend /web/dist ./public/dist
-
-ENV CGO_ENABLED=1
-ARG VERSION=unknown
-ARG VERSION_HASH=unknown
-# RUN CC=musl-gcc go build -trimpath -ldflags="-s -w -linkmode external -extldflags -static" -o komari .
-RUN go build -trimpath -ldflags="-s -w -linkmode external -extldflags -static -X github.com/komari-monitor/komari/utils.CurrentVersion=${VERSION} -X github.com/komari-monitor/komari/utils.VersionHash=${VERSION_HASH}" -o komari .
-
-# FROM scratch
 FROM alpine:3.21
+
 WORKDIR /app
 
-COPY --from=builder /app/komari .
+# Docker buildx 会在构建时自动填充这些变量
+ARG TARGETOS
+ARG TARGETARCH
+
+RUN apk add --no-cache ca-certificates curl tzdata
+
+RUN set -eux; \
+    case "${TARGETARCH}" in \
+      amd64) cloudflared_arch="amd64" ;; \
+      386) cloudflared_arch="386" ;; \
+      arm64) cloudflared_arch="arm64" ;; \
+      arm) cloudflared_arch="arm" ;; \
+      *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${cloudflared_arch}" -o /usr/local/bin/cloudflared; \
+    chmod +x /usr/local/bin/cloudflared
+
+COPY komari-${TARGETOS}-${TARGETARCH} /app/komari
+
+RUN chmod +x /app/komari
 
 ENV GIN_MODE=release
-# 数据库配置环境变量（可以在运行时覆盖）
 ENV KOMARI_DB_TYPE=sqlite
 ENV KOMARI_DB_FILE=/app/data/komari.db
 ENV KOMARI_DB_HOST=localhost
@@ -40,5 +35,4 @@ ENV KOMARI_LISTEN=0.0.0.0:25774
 
 EXPOSE 25774
 
-# 使用环境变量启动服务
-CMD ["/app/komari","server"]
+CMD ["/app/komari", "server"]

NOTICE

@@ -0,0 +1,27 @@
+CoreOS Project
+Copyright 2014 CoreOS, Inc
+
+This product includes software developed at CoreOS, Inc.
+(http://www.coreos.com/).
+
+
+otp
+Copyright (c) 2014, Paul Querna
+
+This product includes software developed by 
+Paul Querna (http://paul.querna.org/).
+
+
+Copyright 2014 gRPC authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

README.md

@@ -1,27 +1,56 @@
-
 # Komari
 
-Komari 是一款轻量级的自托管服务器监控工具，旨在提供简单、高效的服务器性能监控解决方案。它支持通过 Web 界面查看服务器状态，并通过轻量级 Agent 收集数据。
+![Badge](https://hitscounter.dev/api/hit?url=https%3A%2F%2Fgithub.com%2Fkomari-monitor%2Fkomari&label=&icon=github&color=%23a370f7&message=&style=flat&tz=UTC)
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/komari-monitor/komari)
 
-[文档](https://komari-monitor.github.io/komari-document/)
+![komari](https://socialify.git.ci/komari-monitor/komari/image?description=1&font=Inter&forks=1&issues=1&language=1&logo=https%3A%2F%2Fraw.githubusercontent.com%2Fkomari-monitor%2Fkomari-web%2Fd54ce1288df41ead08aa19f8700186e68028a889%2Fpublic%2Ffavicon.png&name=1&owner=1&pattern=Plus&pulls=1&stargazers=1&theme=Auto)
 
-## 特性
-- **轻量高效**：低资源占用，适合各种规模的服务器。
-- **自托管**：完全掌控数据隐私，部署简单。
-- **Web 界面**：直观的监控仪表盘，易于使用。
+[简体中文](./docs/README_zh.md) | [繁體中文](./docs/README_zh-TW.md) | [日本語](./docs/README_ja.md)
 
-## 快速开始
+Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. It supports viewing server status through a web interface and collects data through a lightweight agent.
 
-### 依赖
-- Docker（快速部署）
-- 或者 Go 1.18+ 和 Node.js 20+（手工构建）
+> [!WARNING]
+> Komari is a self-hosted monitoring and control program intended only for systems you own or are authorized to administer. Do not weaponize Komari, deploy it without consent, or use it for unauthorized access, persistence, command execution, or other abusive activity. For context on real-world abuse risks, see Huntress' analysis: [Komari C2 agent abuse](https://www.huntress.com/blog/komari-c2-agent-abuse).
+> Users are solely responsible for how they deploy and operate Komari. The developers do not accept responsibility for unauthorized or abusive use, or for any resulting consequences.
+> On Windows, when remote control is enabled, the client displays a Windows notification at each user login to remind the user that Komari is remote control software.
 
-### Docker 部署
-1. 创建数据目录：
+[Documentation](https://komari-document.pages.dev/) | [文档(镜像站 By Geekertao)](https://www.komari.wiki) | [Telegram Group](https://t.me/komari_monitor)
+
+## Features
+
+- **Lightweight and Efficient**: Low resource consumption, suitable for servers of all sizes.
+- **Self-hosted**: Complete control over data privacy, easy to deploy.
+- **Web Interface**: Intuitive monitoring dashboard, easy to use.
+
+## Quick Start
+
+### 0. One-click Deployment with Cloud Hosting
+
+- Rainyun - CNY 4.5/month
+
+[![](https://rainyun-apps.cn-nb1.rains3.com/materials/deploy-on-rainyun-cn.svg)](https://app.rainyun.com/apps/rca/store/6780/NzYxNzAz_)
+
+- 1Panel App Store
+
+Available on 1Panel App Store. Install via **App Store > Utilities > Komari**.
+
+### 1. Use the One-click Install Script
+
+Suitable for distributions using systemd (Ubuntu, Debian...).
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh -o install-komari.sh
+chmod +x install-komari.sh
+sudo ./install-komari.sh
+```
+
+### 2. Docker Deployment
+
+1. Create a data directory:
    ```bash
    mkdir -p ./data
    ```
-2. 运行 Docker 容器：
+2. Run the Docker container:
    ```bash
    docker run -d \
      -p 25774:25774 \
@@ -29,104 +58,90 @@ Komari 是一款轻量级的自托管服务器监控工具，旨在提供简单
      --name komari \
      ghcr.io/komari-monitor/komari:latest
    ```
-3. 查看默认账号和密码：
+3. View the default username and password:
    ```bash
    docker logs komari
    ```
-4. 在浏览器中访问 `http://<your_server_ip>:25774`。
+4. Access `http://<your_server_ip>:25774` in your browser.
 
 > [!NOTE]
-> 你也可以通过环境变量 `ADMIN_USERNAME` 和 `ADMIN_PASSWORD` 自定义初始用户名和密码。
+> You can also customize the initial username and password through the environment variables `ADMIN_USERNAME` and `ADMIN_PASSWORD`.
 
-### 二进制文件部署
-1. 访问 Komari 的 [GitHub Release 页面](https://github.com/komari-monitor/komari/releases) 下载适用于你操作系统的最新二进制文件。
-2. 运行 Komari：
+### 3. Binary File Deployment
+
+1. Visit Komari's [GitHub Release page](https://github.com/komari-monitor/komari/releases) to download the latest binary for your operating system.
+2. Run Komari:
    ```bash
    ./komari server -l 0.0.0.0:25774
    ```
-3. 在浏览器中访问 `http://<your_server_ip>:25774`，默认监听 `25774` 端口。
-4. 默认账号和密码可在启动日志中查看，或通过环境变量 `ADMIN_USERNAME` 和 `ADMIN_PASSWORD` 设置。
+3. Access `http://<your_server_ip>:25774` in your browser. The default port is `25774`.
+4. The default username and password can be found in the startup logs or set via the environment variables `ADMIN_USERNAME` and `ADMIN_PASSWORD`.
 
 > [!NOTE]
-> 确保二进制文件具有可执行权限（`chmod +x komari`）。数据将保存在运行目录下的 `data` 文件夹中。
+> Ensure the binary has execute permissions (`chmod +x komari`). Data will be saved in the `data` folder in the running directory.
 
+### Manual Build
 
-### 手工构建
-1. 构建前端静态文件：
+#### Dependencies
+
+- Go 1.18+ and Node.js 20+ (for manual build)
+
+1. Build the frontend static files:
    ```bash
    git clone https://github.com/komari-monitor/komari-web
    cd komari-web
    npm install
    npm run build
    ```
-2. 构建后端：
+2. Build the backend:
    ```bash
    git clone https://github.com/komari-monitor/komari
    cd komari
    ```
-   将步骤1中生成的静态文件复制到 `komari` 项目根目录下的 `/public/dist` 文件夹。
-   ```bash 
+   Copy the static files generated in step 1 to the `/web/public/defaultTheme/dist` folder in the root of the `komari` project, and copy `komari-theme.json` + `preview.png`/`perview.png` to `/web/public/defaultTheme`.
+   ```bash
    go build -o komari
    ```
-4. 运行：
+3. Run:
    ```bash
    ./komari server -l 0.0.0.0:25774
    ```
-   默认监听 `25774` 端口，访问 `http://localhost:25774`。
+   The default listening port is `25774`. Access `http://localhost:25774`.
 
-## 前端开发指南
-这个坑晚点再填吧 ヽ(￣ω￣(￣ω￣〃)ゝ
+## Frontend Development Guide
 
-## 客户端 Agent 开发指南
-这个坑晚点再填吧 (o゜▽゜)o☆
+[Komari Theme Development Guide | Komari](https://komari-document.pages.dev/dev/theme.html)
 
-## 贡献
-欢迎提交 Issue 或 Pull Request！
+## Client Agent Development Guide
 
-## 鸣谢
- - 感谢我自己能这么闲
- - 广告位招租喵
+[Komari Agent Information Reporting and Event Handling Documentation](https://komari-document.pages.dev/dev/agent.html)
 
-## 引用
- - [gorm.io](https://gorm.io/)
- - [spf13/cobra](https://github.com/spf13/cobra)
- - [oschwald/maxminddb-golang](https://github.com/oschwald/maxminddb-golang)
- - [gorilla/websocket](https://github.com/gorilla/websocket)
- - [google/uuid](https://github.com/google/uuid)
- - [gin-gonic/gin](https://github.com/gin-gonic/gin)
- - [UserExistsError/conpty](https://github.com/UserExistsError/conpty)
- - [creack/pty](https://github.com/creack/pty)
- - [rhysd/go-github-selfupdate](https://github.com/rhysd/go-github-selfupdate)
- - [shirou/gopsutil](https://github.com/shirou/gopsutil)
+## Contributing
 
-## 许可证
-[MIT License](LICENSE)
+Issues and Pull Requests are welcome!
 
-## 截图
+## Acknowledgements
 
-![PixPin_2025-06-07_15-28-30](https://github.com/user-attachments/assets/edce5694-c6c8-4647-bc11-8b27105fd55c)
-![PixPin_2025-06-07_15-28-49](https://github.com/user-attachments/assets/23b58032-211a-4b59-b444-c8267606a0bb)
-![PixPin_2025-06-07_15-29-05](https://github.com/user-attachments/assets/f4325d4d-fa69-41c6-9251-19f530476e65)
-![PixPin_2025-06-07_15-30-05](https://github.com/user-attachments/assets/69be38f6-6681-4afb-9a04-965d39b7fcc2)
-![PixPin_2025-06-07_15-30-46](https://github.com/user-attachments/assets/01d84dd1-3c81-4424-a041-7dbc2ae5822e)
+### 破碎工坊云
 
+[破碎工坊云 - 专业云计算服务平台，提供高效、稳定、安全的高防服务器与CDN解决方案](https://www.crash.work/)
 
-## 碎碎念
+### DreamCloud
 
-### 我为什么做Komari？
+[DreamCloud - 极高性价比解锁直连亚太高防](https://as211392.com/)
 
-起因： [求推荐系统监控软件](https://www.nodeseek.com/post-133745-1)
+### 🚀 Sponsored by SharonNetworks
 
-> @古xx斯
-> 哪吒？
-> > 数据至少保存15天
+[![Sharon Networks](https://raw.githubusercontent.com/komari-monitor/public/refs/heads/main/images/sharon-networks.webp)](https://sharon.io)
 
-> @sxxu
-> 怕不是做梦的预算
+SharonNetworks 为您的业务起飞保驾护航！
 
-> @Vxxn
-> prometheus加grafana
-> > 部署太麻烦
+亚太数据中心提供顶级的中国优化网络接入 · 低延时&高带宽&提供Tbps级本地清洗高防服务, 为您的业务保驾护航, 为您的客户提供极致体验. 加入社区 [Telegram群组](https://t.me/SharonNetwork) 可参与公益募捐或群内抽奖免费使用
 
-没有合适的，最近刚好时间稍微多了一些，就搓了 komari.
+### The open source software community
 
+All the developers who submitted PRs and created themes
+
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=komari-monitor/komari&type=Date)](https://www.star-history.com/#komari-monitor/komari&Date)

api/AdminAuthMiddleware.go

@@ -1,35 +0,0 @@
-package api
-
-import (
-	"net/http"
-
-	"github.com/komari-monitor/komari/database/accounts"
-
-	"github.com/gin-gonic/gin"
-)
-
-func AdminAuthMiddleware() gin.HandlerFunc {
-	return func(c *gin.Context) {
-
-		session, err := c.Cookie("session_token")
-		if err != nil {
-			RespondError(c, http.StatusUnauthorized, "Unauthorized.")
-			c.Abort()
-			return
-		}
-
-		// Komari is a single user system
-		uuid, err := accounts.GetSession(session)
-		if err != nil {
-			RespondError(c, http.StatusUnauthorized, "Unauthorized.")
-			c.Abort()
-			return
-		}
-		accounts.UpdateLatest(session, c.Request.UserAgent(), c.ClientIP())
-		// 将 session 和 用户 UUID 传递到后续处理器
-		c.Set("session", session)
-		c.Set("uuid", uuid)
-
-		c.Next()
-	}
-}

api/Common.go

@@ -1,93 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"sync"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/gorilla/websocket"
-	"github.com/komari-monitor/komari/common"
-
-	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/models"
-	"github.com/komari-monitor/komari/utils"
-)
-
-var (
-	Records map[string][]common.Report = make(map[string][]common.Report)
-)
-
-type TerminalSession struct {
-	UUID     string
-	UserUUID string
-	Browser  *websocket.Conn
-	Agent    *websocket.Conn
-}
-
-var TerminalSessionsMutex = &sync.Mutex{}
-var TerminalSessions = make(map[string]*TerminalSession)
-
-func SaveClientReportToDB() error {
-	lastMinute := time.Now().Add(-time.Minute * 1).Unix()
-	record := []models.Record{}
-	// 遍历所有的客户端记录
-	for uuid, reports := range Records {
-		// 删除一分钟前的记录
-		filtered := reports[:0]
-		for _, r := range reports {
-			if r.UpdatedAt.Unix() >= lastMinute {
-				filtered = append(filtered, r)
-			}
-		}
-		Records[uuid] = filtered
-
-		if uuid == "" {
-			continue
-		}
-
-		r := utils.AverageReport(uuid, time.Now(), filtered)
-
-		record = append(record, r)
-
-		db := dbcore.GetDBInstance()
-		err := db.Model(&models.Record{}).Where("client = ?", uuid).Create(record).Error
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-type Response struct {
-	Status  string      `json:"status"`
-	Message string      `json:"message"`
-	Data    interface{} `json:"data,omitempty"`
-}
-
-// Respond sends a standardized JSON response.
-func Respond(c *gin.Context, httpStatus int, status string, message string, data interface{}) {
-	c.JSON(httpStatus, Response{Status: status, Message: message, Data: data})
-}
-
-// RespondSuccess sends a success response with data.
-func RespondSuccess(c *gin.Context, data interface{}) {
-	Respond(c, http.StatusOK, "success", "", data)
-}
-
-// RespondSuccessMessage sends a success response with message and data.
-func RespondSuccessMessage(c *gin.Context, message string, data interface{}) {
-	Respond(c, http.StatusOK, "success", message, data)
-}
-
-// RespondError sends an error response with message.
-func RespondError(c *gin.Context, httpStatus int, message string) {
-	Respond(c, httpStatus, "error", message, nil)
-}
-func GetVersion(c *gin.Context) {
-	RespondSuccess(c, gin.H{
-		"version": utils.CurrentVersion,
-		"hash":    utils.VersionHash,
-	})
-}

api/TokenAuthMiddleware.go

@@ -1,81 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"database/sql"
-	"encoding/json"
-	"io"
-	"net/http"
-
-	"github.com/komari-monitor/komari/database/clients"
-	"gorm.io/gorm"
-
-	"github.com/gin-gonic/gin"
-)
-
-// TokenAuthMiddleware creates a Gin middleware that validates a token from query parameters or request body.
-func TokenAuthMiddleware() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		var token string
-
-		// Step 1: Check query parameter for token
-		token = c.Query("token")
-
-		// Step 2: If no token in query, check request body for non-GET requests
-		if token == "" && c.Request.Method != http.MethodGet {
-			// Read the body
-			bodyBytes, err := io.ReadAll(c.Request.Body)
-			if err != nil {
-				c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"status": "error", "error": "failed to read request body"})
-				return
-			}
-
-			// Restore the body for downstream handlers
-			c.Request.Body = io.NopCloser(bytes.NewReader(bodyBytes))
-
-			// Try to extract token from JSON body
-			var bodyMap map[string]interface{}
-			if len(bodyBytes) > 0 {
-				if err := json.Unmarshal(bodyBytes, &bodyMap); err == nil {
-					if tokenVal, exists := bodyMap["token"]; exists {
-						if str, ok := tokenVal.(string); ok && str != "" {
-							token = str
-						}
-					}
-				}
-			}
-		}
-
-		if token == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"status": "error", "error": "token is required"})
-			return
-		}
-
-		exists, err := checkTokenExists(token)
-		if err != nil {
-			c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"status": "error", "error": "failed to validate token"})
-			return
-		}
-		if !exists {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"status": "error", "error": "invalid token"})
-			return
-		}
-
-		c.Next()
-	}
-}
-
-func checkTokenExists(token string) (bool, error) {
-	_, err := clients.GetClientUUIDByToken(token)
-
-	if err == sql.ErrNoRows {
-		return false, nil
-	}
-	if err == gorm.ErrRecordNotFound {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	return true, nil
-}

api/admin/client.go

@@ -1,134 +0,0 @@
-package admin
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/database/clients"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/database/records"
-)
-
-func AddClient(c *gin.Context) {
-	var req struct {
-		Name string `json:"name"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil || req.Name == "" {
-		uuid, token, err := clients.CreateClient()
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"status": "error", "message": err.Error()})
-			return
-		}
-		c.JSON(http.StatusOK, gin.H{"status": "success", "uuid": uuid, "token": token})
-		return
-	}
-	uuid, token, err := clients.CreateClientWithName(req.Name)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"status": "error", "message": err.Error()})
-		return
-	}
-	user_uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), user_uuid.(string), "create client:"+uuid, "info")
-	c.JSON(http.StatusOK, gin.H{"status": "success", "uuid": uuid, "token": token, "message": ""})
-}
-
-func EditClient(c *gin.Context) {
-	var req = make(map[string]interface{})
-	uuid := c.Param("uuid")
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"status": "error", "message": err.Error()})
-		return
-	}
-	if uuid == "" {
-		c.JSON(http.StatusBadRequest, gin.H{"status": "error", "message": "Invalid or missing UUID"})
-		return
-	}
-	req["uuid"] = uuid
-	err := clients.SaveClient(req)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"status": "error", "message": err.Error()})
-		return
-	}
-	user_uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), user_uuid.(string), "edit client:"+uuid, "info")
-	c.JSON(http.StatusOK, gin.H{"status": "success"})
-}
-
-func RemoveClient(c *gin.Context) {
-	uuid := c.Param("uuid")
-	err := clients.DeleteClient(uuid)
-	if err != nil {
-		c.JSON(500, gin.H{
-			"status": "error",
-			"error":  "Failed to delete client" + err.Error(),
-		})
-		return
-	}
-	user_uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), user_uuid.(string), "delete client:"+uuid, "warn")
-	c.JSON(200, gin.H{"status": "success"})
-}
-
-func ClearRecord(c *gin.Context) {
-	if err := records.DeleteAll(); err != nil {
-		c.JSON(500, gin.H{
-			"status":  "error",
-			"message": "Failed to delete Record" + err.Error(),
-		})
-		return
-	}
-	user_uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), user_uuid.(string), "clear records", "warn")
-	c.JSON(200, gin.H{"status": "success"})
-}
-
-func GetClient(c *gin.Context) {
-	uuid := c.Param("uuid")
-	if uuid == "" {
-		c.JSON(400, gin.H{
-			"status":  "error",
-			"message": "Invalid or missing UUID",
-		})
-		return
-	}
-
-	result, err := clients.GetClientByUUID(uuid)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{
-			"status":  "error",
-			"message": err.Error(),
-		})
-		return
-	}
-
-	c.JSON(http.StatusOK, result)
-}
-
-func ListClients(c *gin.Context) {
-	cls, err := clients.GetAllClientBasicInfo()
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"status": "error", "message": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, cls)
-}
-
-func GetClientToken(c *gin.Context) {
-	uuid := c.Param("uuid")
-	if uuid == "" {
-		c.JSON(400, gin.H{
-			"status":  "error",
-			"message": "Invalid or missing UUID",
-		})
-		return
-	}
-
-	token, err := clients.GetClientTokenByUUID(uuid)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"status": "error", "message": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{"status": "success", "token": token, "message:": ""})
-}

api/admin/client_weight.go

@@ -1,28 +0,0 @@
-package admin
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/database/models"
-)
-
-func OrderWeight(c *gin.Context) {
-	var req = make(map[string]int)
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, 400, "Invalid or missing request body: "+err.Error())
-		return
-	}
-	db := dbcore.GetDBInstance()
-	for uuid, weight := range req {
-		err := db.Model(&models.Client{}).Where("uuid = ?", uuid).Update("weight", weight).Error
-		if err != nil {
-			api.RespondError(c, 500, "Failed to update client weight: "+err.Error())
-			return
-		}
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "order clients", "info")
-	api.RespondSuccess(c, nil)
-}

api/admin/clipboard/clipboard.go

@@ -1,115 +0,0 @@
-package clipboard
-
-import (
-	"net/http"
-	"strconv"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	clipboardDB "github.com/komari-monitor/komari/database/clipboard"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/database/models"
-)
-
-// GetClipboard retrieves a clipboard entry by ID
-func GetClipboard(c *gin.Context) {
-	idStr := c.Param("id")
-	id, err := strconv.Atoi(idStr)
-	if err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid ID")
-		return
-	}
-	cb, err := clipboardDB.GetClipboardByID(id)
-	if err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to get clipboard: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, cb)
-}
-
-// ListClipboard lists all clipboard entries
-func ListClipboard(c *gin.Context) {
-	list, err := clipboardDB.ListClipboard()
-	if err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to list clipboard: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, list)
-}
-
-// CreateClipboard creates a new clipboard entry
-func CreateClipboard(c *gin.Context) {
-	var req models.Clipboard
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if err := clipboardDB.CreateClipboard(&req); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to create clipboard: "+err.Error())
-		return
-	}
-	userUUID, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), userUUID.(string), "create clipboard:"+strconv.Itoa(req.Id), "info")
-	api.RespondSuccess(c, req)
-}
-
-// UpdateClipboard updates an existing clipboard entry
-func UpdateClipboard(c *gin.Context) {
-	idStr := c.Param("id")
-	id, err := strconv.Atoi(idStr)
-	if err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid ID")
-		return
-	}
-	var fields map[string]interface{}
-	if err := c.ShouldBindJSON(&fields); err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if err := clipboardDB.UpdateClipboardFields(id, fields); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to update clipboard: "+err.Error())
-		return
-	}
-	userUUID, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), userUUID.(string), "update clipboard:"+strconv.Itoa(id), "info")
-	api.RespondSuccess(c, nil)
-}
-
-// DeleteClipboard deletes a clipboard entry
-func DeleteClipboard(c *gin.Context) {
-	idStr := c.Param("id")
-	id, err := strconv.Atoi(idStr)
-	if err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid ID")
-		return
-	}
-	if err := clipboardDB.DeleteClipboard(id); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to delete clipboard: "+err.Error())
-		return
-	}
-	userUUID, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), userUUID.(string), "delete clipboard:"+strconv.Itoa(id), "warn")
-	api.RespondSuccess(c, nil)
-}
-
-// BatchDeleteClipboard deletes multiple clipboard entries
-func BatchDeleteClipboard(c *gin.Context) {
-	var req struct {
-		IDs []int `json:"ids" binding:"required"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if len(req.IDs) == 0 {
-		api.RespondError(c, http.StatusBadRequest, "IDs cannot be empty")
-		return
-	}
-	if err := clipboardDB.DeleteClipboardBatch(req.IDs); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to batch delete clipboard: "+err.Error())
-		return
-	}
-	userUUID, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), userUUID.(string), "batch delete clipboard: "+strconv.Itoa(len(req.IDs))+" items", "warn")
-	api.RespondSuccess(c, nil)
-}

api/admin/exec.go

@@ -1,78 +0,0 @@
-package admin
-
-import (
-	"encoding/json"
-
-	"github.com/gin-gonic/gin"
-	"github.com/gorilla/websocket"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/database/tasks"
-	"github.com/komari-monitor/komari/utils"
-	"github.com/komari-monitor/komari/ws"
-)
-
-// 接受数据类型：
-// - command: string
-// - clients: []string (客户端 UUID 列表)
-func Exec(c *gin.Context) {
-	var req struct {
-		Command string   `json:"command" binding:"required"`
-		Clients []string `json:"clients" binding:"required"`
-	}
-	var onlineClients []string
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, 400, "Invalid or missing request body: "+err.Error())
-		return
-	}
-	for uuid := range ws.GetConnectedClients() {
-		if contain(req.Clients, uuid) {
-			onlineClients = append(onlineClients, uuid)
-		} else {
-			api.RespondError(c, 400, "Client not connected: "+uuid)
-			return
-		}
-	}
-	if len(onlineClients) == 0 {
-		api.RespondError(c, 400, "No clients connected")
-		return
-	}
-	taskId := utils.GenerateRandomString(16)
-	if err := tasks.CreateTask(taskId, onlineClients, req.Command); err != nil {
-		api.RespondError(c, 500, "Failed to create task: "+err.Error())
-		return
-	}
-	for _, uuid := range onlineClients {
-		var send struct {
-			Message string `json:"message"`
-			Command string `json:"command"`
-			TaskId  string `json:"task_id"`
-		}
-		send.Message = "exec"
-		send.Command = req.Command
-		send.TaskId = taskId
-
-		payload, _ := json.Marshal(send)
-		client := ws.GetConnectedClients()[uuid]
-		if client != nil {
-			client.WriteMessage(websocket.TextMessage, payload)
-		} else {
-			api.RespondError(c, 400, "Client connection is null: "+uuid)
-			return
-		}
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "REC, task id: "+taskId, "warn")
-	api.RespondSuccess(c, gin.H{
-		"task_id": taskId,
-		"clients": onlineClients,
-	})
-}
-func contain(clients []string, uuid string) bool {
-	for _, client := range clients {
-		if client == uuid {
-			return true
-		}
-	}
-	return false
-}

api/admin/log/log.go

@@ -1,49 +0,0 @@
-package log
-
-import (
-	"strconv"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/models"
-)
-
-func GetLogs(c *gin.Context) {
-	limit := c.Query("limit")
-	if limit == "" {
-		limit = "100" // Default to 100 logs if not specified
-	}
-	page := c.Query("page")
-	if page == "" {
-		page = "1" // Default to page 1 if not specified
-	}
-	// Convert limit and page to integers
-	// If conversion fails, return an error
-	limitInt, err := strconv.Atoi(limit)
-	if err != nil || limitInt <= 0 {
-		api.RespondError(c, 400, "Invalid limit: "+limit)
-		return
-	}
-	pageInt, err := strconv.Atoi(page)
-	if err != nil || pageInt <= 0 {
-		api.RespondError(c, 400, "Invalid page: "+page)
-		return
-	}
-	db := dbcore.GetDBInstance()
-	var logs []models.Log
-	// 添加分页：计算偏移量并限制数量
-	offset := (pageInt - 1) * limitInt
-
-	var total int64
-	if err := db.Model(&models.Log{}).Count(&total).Error; err != nil {
-		api.RespondError(c, 500, "Failed to count logs: "+err.Error())
-		return
-	}
-
-	if err := db.Order("time desc").Limit(limitInt).Offset(offset).Find(&logs).Error; err != nil {
-		api.RespondError(c, 500, "Failed to retrieve logs: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, gin.H{"logs": logs, "total": total})
-}

api/admin/notification/offline.go

@@ -1,109 +0,0 @@
-package notification
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/models"
-	"gorm.io/gorm/clause"
-)
-
-// POST body : []uuid
-func EnableOfflineNotification(c *gin.Context) {
-	var uuids []string
-	if err := c.ShouldBindJSON(&uuids); err != nil {
-		api.RespondError(c, 400, "Invalid request body: "+err.Error())
-		return
-	}
-	var notifications []models.OfflineNotification
-	for _, uuid := range uuids {
-		notifications = append(notifications, models.OfflineNotification{
-			Client: uuid,
-			Enable: true,
-		})
-	}
-	err := dbcore.GetDBInstance().Model(&models.OfflineNotification{}).
-		Clauses(clause.OnConflict{
-			Columns:   []clause.Column{{Name: "client"}},
-			DoUpdates: clause.AssignmentColumns([]string{"enable"}),
-		}).
-		Select("client", "enable").
-		Create(notifications).Error
-	if err != nil {
-		api.RespondError(c, 500, "Failed to enable offline notifications: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, nil)
-}
-
-// POST body : []uuid
-func DisableOfflineNotification(c *gin.Context) {
-	var uuids []string
-	if err := c.ShouldBindJSON(&uuids); err != nil {
-		api.RespondError(c, 400, "Invalid request body: "+err.Error())
-		return
-	}
-	var notifications []models.OfflineNotification
-	for _, uuid := range uuids {
-		notifications = append(notifications, models.OfflineNotification{
-			Client: uuid,
-			Enable: false,
-		})
-	}
-	err := dbcore.GetDBInstance().Model(&models.OfflineNotification{}).
-		Clauses(clause.OnConflict{
-			Columns:   []clause.Column{{Name: "client"}},
-			DoUpdates: clause.AssignmentColumns([]string{"enable"}),
-		}).
-		Select("client", "enable").
-		Create(notifications).Error
-	if err != nil {
-		api.RespondError(c, 500, "Failed to disable offline notifications: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, nil)
-}
-
-func EditOfflineNotification(c *gin.Context) {
-	var notifications []models.OfflineNotification
-	if err := c.ShouldBindJSON(&notifications); err != nil {
-		api.RespondError(c, 400, "Invalid request body: "+err.Error())
-		return
-	}
-	if len(notifications) == 0 {
-		api.RespondError(c, 400, "At least one notification is required")
-		return
-	}
-	for _, noti := range notifications {
-		if noti.Client == "" {
-			api.RespondError(c, 400, "Client UUID cannot be empty")
-			return
-		}
-		if noti.GracePeriod <= 0 {
-			api.RespondError(c, 400, "GracePeriod must be a positive integer")
-			return
-		}
-	}
-	err := dbcore.GetDBInstance().Model(&models.OfflineNotification{}).
-		Clauses(clause.OnConflict{
-			Columns:   []clause.Column{{Name: "client"}},
-			DoUpdates: clause.AssignmentColumns([]string{"enable", "grace_period"}),
-		}).
-		Select("*").
-		Create(notifications).Error
-	if err != nil {
-		api.RespondError(c, 500, "Failed to edit offline notifications: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, nil)
-}
-
-func ListOfflineNotifications(c *gin.Context) {
-	var notifications []models.OfflineNotification
-	err := dbcore.GetDBInstance().Model(&models.OfflineNotification{}).Find(&notifications).Error
-	if err != nil {
-		api.RespondError(c, 500, "Failed to list offline notifications: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, notifications)
-}

api/admin/ping.go

@@ -1,80 +0,0 @@
-package admin
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/models"
-	"github.com/komari-monitor/komari/database/tasks"
-)
-
-// POST body: clients []string, target, task_type string, interval int
-func AddPingTask(c *gin.Context) {
-	var req struct {
-		Clients  []string `json:"clients" binding:"required"`
-		Name     string   `json:"name" binding:"required"`
-		Target   string   `json:"target" binding:"required"`
-		TaskType string   `json:"type" binding:"required"`     // icmp, tcp, http
-		Interval int      `json:"interval" binding:"required"` // 间隔时间，单位秒
-	}
-
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	if taskID, err := tasks.AddPingTask(req.Clients, req.Name, req.Target, req.TaskType, req.Interval); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, err.Error())
-	} else {
-		api.RespondSuccess(c, gin.H{"task_id": taskID})
-	}
-}
-
-// POST body: id []uint
-func DeletePingTask(c *gin.Context) {
-	var req struct {
-		ID []uint `json:"id" binding:"required"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	if err := tasks.DeletePingTask(req.ID); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, err.Error())
-	} else {
-		api.RespondSuccess(c, nil)
-	}
-}
-
-// POST body: id []uint, updates map[string]interface{}
-func EditPingTask(c *gin.Context) {
-	var req struct {
-		Tasks []*models.PingTask `json:"tasks" binding:"required"`
-	}
-
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, http.StatusBadRequest, "Invalid request data")
-		return
-	}
-
-	if err := tasks.EditPingTask(req.Tasks); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, err.Error())
-	} else {
-		for _, task := range req.Tasks {
-			tasks.DeletePingRecords([]uint{task.Id})
-		}
-		api.RespondSuccess(c, nil)
-	}
-}
-
-func GetAllPingTasks(c *gin.Context) {
-	tasks, err := tasks.GetAllPingTasks()
-	if err != nil {
-		api.RespondError(c, http.StatusInternalServerError, err.Error())
-		return
-	}
-
-	api.RespondSuccess(c, tasks)
-}

api/admin/sessions.go

@@ -1,50 +0,0 @@
-package admin
-
-import (
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/accounts"
-	"github.com/komari-monitor/komari/database/logOperation"
-
-	"github.com/gin-gonic/gin"
-)
-
-func GetSessions(c *gin.Context) {
-
-	ss, err := accounts.GetAllSessions()
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve sessions: "+err.Error())
-		return
-	}
-	current, _ := c.Cookie("session_token")
-	c.JSON(200, gin.H{"status": "success", "current": current, "data": ss})
-}
-
-func DeleteSession(c *gin.Context) {
-	var req struct {
-		Session string `json:"session" binding:"required"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, 400, "Invalid request: "+err.Error())
-		return
-	}
-	err := accounts.DeleteSession(req.Session)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to delete session: "+err.Error())
-		return
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "delete session", "info")
-	api.RespondSuccess(c, nil)
-}
-
-func DeleteAllSession(c *gin.Context) {
-
-	err := accounts.DeleteAllSessions()
-	if err != nil {
-		api.RespondError(c, 500, "Failed to delete all sessions: "+err.Error())
-		return
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "delete all sessions", "warn")
-	api.RespondSuccess(c, nil)
-}

api/admin/settings.go

@@ -1,71 +0,0 @@
-package admin
-
-import (
-	"database/sql"
-
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/config"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/database/models"
-
-	"github.com/gin-gonic/gin"
-)
-
-// GetSettings 获取自定义配置
-func GetSettings(c *gin.Context) {
-	cst, err := config.Get()
-	if err != nil {
-		if err == sql.ErrNoRows {
-			//override
-			cst = models.Config{Sitename: "Komari"}
-			cst.ID = 1
-			config.Save(cst)
-			api.RespondSuccess(c, cst)
-			return
-		}
-		c.JSON(500, gin.H{
-			"status":  "error",
-			"message": "Internal Server Error: " + err.Error(),
-		})
-	}
-	api.RespondSuccess(c, cst)
-}
-
-// EditSettings 更新自定义配置
-func EditSettings(c *gin.Context) {
-	cfg := make(map[string]interface{})
-	if err := c.ShouldBindJSON(&cfg); err != nil {
-		api.RespondError(c, 400, "Invalid or missing request body: "+err.Error())
-		return
-	}
-
-	cfg["id"] = 1 // Only one record
-	if err := config.Update(cfg); err != nil {
-		api.RespondError(c, 500, "Failed to update settings: "+err.Error())
-		return
-	}
-
-	uuid, _ := c.Get("uuid")
-	message := "update settings: "
-	for key := range cfg {
-		ignoredKeys := []string{"id", "updated_at"}
-		if contains(ignoredKeys, key) {
-			continue
-		}
-		message += key + ", "
-	}
-	if len(message) > 2 {
-		message = message[:len(message)-2]
-	}
-	logOperation.Log(c.ClientIP(), uuid.(string), message, "info")
-	api.RespondSuccess(c, nil)
-}
-
-func contains(slice []string, item string) bool {
-	for _, v := range slice {
-		if v == item {
-			return true
-		}
-	}
-	return false
-}

api/admin/task.go

@@ -1,154 +0,0 @@
-package admin
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/tasks"
-)
-
-func GetTasks(c *gin.Context) {
-	dbTasks, err := tasks.GetAllTasks()
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve tasks: "+err.Error())
-		return
-	}
-	var responseTasks []gin.H
-	for _, t := range dbTasks {
-		results, err := tasks.GetTaskResultsByTaskId(t.TaskId)
-		if err != nil {
-			api.RespondError(c, 500, "Failed to retrieve task results: "+err.Error())
-			return
-		}
-
-		var filteredResults []gin.H
-		for _, r := range results {
-			filteredResults = append(filteredResults, gin.H{
-				"client":      r.Client,
-				"result":      r.Result,
-				"exit_code":   r.ExitCode,
-				"finished_at": r.FinishedAt,
-				"created_at":  r.CreatedAt,
-			})
-		}
-
-		responseTasks = append(responseTasks, gin.H{
-			"task_id": t.TaskId,
-			"clients": t.Clients,
-			"command": t.Command,
-			"results": filteredResults,
-		})
-	}
-	api.RespondSuccess(c, responseTasks)
-}
-
-func GetTaskById(c *gin.Context) {
-	taskId := c.Param("task_id")
-	if taskId == "" {
-		api.RespondError(c, 400, "Task ID is required")
-		return
-	}
-	task, err := tasks.GetTaskByTaskId(taskId)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve task: "+err.Error())
-		return
-	}
-	if task == nil {
-		api.RespondError(c, 404, "Task not found")
-		return
-	}
-	results, err := tasks.GetTaskResultsByTaskId(taskId)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve task results: "+err.Error())
-		return
-	}
-	var filteredResults []gin.H
-	for _, r := range results {
-		filteredResults = append(filteredResults, gin.H{
-			"client":      r.Client,
-			"result":      r.Result,
-			"exit_code":   r.ExitCode,
-			"finished_at": r.FinishedAt,
-			"created_at":  r.CreatedAt,
-		})
-	}
-	api.RespondSuccess(c, gin.H{
-		"task_id": task.TaskId,
-		"clients": task.Clients,
-		"command": task.Command,
-		"results": filteredResults,
-	})
-}
-
-func GetTasksByClientId(c *gin.Context) {
-	clientId := c.Param("uuid")
-	if clientId == "" {
-		api.RespondError(c, 400, "Client ID is required")
-		return
-	}
-	tasks, err := tasks.GetTasksByClientId(clientId)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve tasks: "+err.Error())
-		return
-	}
-	if len(tasks) == 0 {
-		api.RespondError(c, 404, "No tasks found for this client")
-		return
-	}
-	api.RespondSuccess(c, tasks)
-}
-
-func GetSpecificTaskResult(c *gin.Context) {
-	taskId := c.Param("task_id")
-	clientId := c.Param("uuid")
-	if taskId == "" || clientId == "" {
-		api.RespondError(c, 400, "Task ID and Client ID are required")
-		return
-	}
-	result, err := tasks.GetSpecificTaskResult(taskId, clientId)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve task result: "+err.Error())
-		return
-	}
-	if result == nil {
-		api.RespondError(c, 404, "No result found for this task and client")
-		return
-	}
-	api.RespondSuccess(c, result)
-}
-
-// Param: task_id
-func GetTaskResultsByTaskId(c *gin.Context) {
-	taskId := c.Param("task_id")
-	if taskId == "" {
-		api.RespondError(c, 400, "Task ID is required")
-		return
-	}
-	results, err := tasks.GetTaskResultsByTaskId(taskId)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve task results: "+err.Error())
-		return
-	}
-	if len(results) == 0 {
-		api.RespondError(c, 404, "No results found for this task")
-		return
-	}
-	api.RespondSuccess(c, results)
-}
-
-func GetAllTaskResultByUUID(c *gin.Context) {
-	clientId := c.Param("uuid")
-	if clientId == "" {
-		api.RespondError(c, 400, "Client ID is required")
-		return
-	}
-	results, err := tasks.GetAllTasksResultByUUID(clientId)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to retrieve tasks: "+err.Error())
-		return
-	}
-	if len(results) == 0 {
-		api.RespondError(c, 404, "No tasks found for this client")
-		return
-	}
-	api.RespondSuccess(c, results)
-}

api/admin/test/test.go

@@ -1,47 +0,0 @@
-package test
-
-import (
-	"net"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/config"
-	"github.com/komari-monitor/komari/utils/geoip"
-	"github.com/komari-monitor/komari/utils/messageSender"
-)
-
-func TestTelegram(c *gin.Context) {
-	message := "Komari test message."
-	err := messageSender.SendTextMessage(message)
-	if err != nil {
-		api.RespondError(c, 500, "Failed to send Telegram message: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, nil)
-}
-
-func TestGeoIp(c *gin.Context) {
-	ip := c.Query("ip")
-	if ip == "" {
-		if cfIP := c.GetHeader("CF-Connecting-IP"); cfIP != "" {
-			ip = cfIP
-		} else {
-			ip = c.ClientIP()
-		}
-	}
-	conf, err := config.Get()
-	if err != nil {
-		api.RespondError(c, 500, "Failed to get configuration: "+err.Error())
-		return
-	}
-	if !conf.GeoIpEnabled {
-		api.RespondError(c, 400, "GeoIP is not enabled in the configuration.")
-		return
-	}
-	GeoIpRecord, err := geoip.GetGeoIpInfo(net.ParseIP(ip))
-	if err != nil {
-		api.RespondError(c, 500, "Failed to get GeoIP record: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, GeoIpRecord)
-}

api/admin/update/favicon.go

@@ -1,46 +0,0 @@
-package update
-
-import (
-	"io"
-	"net/http"
-	"os"
-	"strings"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/logOperation"
-)
-
-func UploadFavicon(c *gin.Context) {
-	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 5<<20) // 5MB
-	data, err := io.ReadAll(c.Request.Body)
-	if err != nil {
-		if strings.Contains(err.Error(), "request body too large") {
-			api.RespondError(c, http.StatusRequestEntityTooLarge, "File too large. Maximum size is 5MB")
-		} else {
-			api.RespondError(c, http.StatusBadRequest, err.Error())
-		}
-		return
-	}
-	if err := os.WriteFile("./data/favicon.ico", data, 0644); err != nil {
-		api.RespondError(c, http.StatusInternalServerError, "Failed to save favicon: "+err.Error())
-		return
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "Favicon uploaded", "info")
-	api.RespondSuccess(c, nil)
-}
-
-func DeleteFavicon(c *gin.Context) {
-	if err := os.Remove("./data/favicon.ico"); err != nil {
-		if os.IsNotExist(err) {
-			api.RespondError(c, http.StatusNotFound, "Favicon not found")
-		} else {
-			api.RespondError(c, http.StatusInternalServerError, "Failed to delete favicon: "+err.Error())
-		}
-		return
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "Favicon deleted", "info")
-	api.RespondSuccess(c, nil)
-}

api/admin/update/geoip.go

@@ -1,18 +0,0 @@
-package update
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/utils/geoip"
-)
-
-func UpdateMmdbGeoIP(c *gin.Context) {
-	if err := geoip.UpdateGeoIpDatabase(); err != nil {
-		api.RespondError(c, 500, "Failed to update GeoIP database "+err.Error())
-		return
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "GeoIP database updated", "info")
-	api.RespondSuccess(c, nil)
-}

api/admin/update/user.go

@@ -1,40 +0,0 @@
-package update
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/database/accounts"
-	"github.com/komari-monitor/komari/database/logOperation"
-)
-
-func UpdateUser(c *gin.Context) {
-	var req struct {
-		Uuid     string  `json:"uuid" binding:"required"`
-		Name     *string `json:"username"`
-		Password *string `json:"password"`
-		SsoType  *string `json:"sso_type"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		api.RespondError(c, 400, "Invalid or missing request body: "+err.Error())
-		return
-	}
-	if req.Password == nil && req.Name == nil {
-		api.RespondError(c, 400, "At least one field (username or password) must be provided")
-		return
-	}
-	if req.Name != nil && len(*req.Name) < 3 {
-		api.RespondError(c, 400, "Username must be at least 3 characters long")
-		return
-	}
-	if req.Password != nil && len(*req.Password) < 6 {
-		api.RespondError(c, 400, "Password must be at least 6 characters long")
-		return
-	}
-	if err := accounts.UpdateUser(req.Uuid, req.Name, req.Password, req.SsoType); err != nil {
-		api.RespondError(c, 500, "Failed to update user: "+err.Error())
-		return
-	}
-	uuid, _ := c.Get("uuid")
-	logOperation.Log(c.ClientIP(), uuid.(string), "User updated", "warn")
-	api.RespondSuccess(c, gin.H{"uuid": req.Uuid})
-}

api/client/report.go

@@ -1,190 +0,0 @@
-package client
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"time"
-
-	"log"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/gorilla/websocket"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/common"
-	"github.com/komari-monitor/komari/database/clients"
-	"github.com/komari-monitor/komari/database/models"
-	"github.com/komari-monitor/komari/database/tasks"
-	"github.com/komari-monitor/komari/utils/notification"
-	"github.com/komari-monitor/komari/ws"
-)
-
-func UploadReport(c *gin.Context) {
-	bodyBytes, err := io.ReadAll(c.Request.Body)
-	if err != nil {
-		log.Println("Failed to read request body:", err)
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
-		return
-	}
-
-	var data map[string]interface{}
-	err = json.Unmarshal(bodyBytes, &data)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
-		return
-	}
-	// Save report to database
-	var report common.Report
-	err = json.Unmarshal(bodyBytes, &report)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
-		return
-	}
-	report.UpdatedAt = time.Now()
-	err = SaveClientReport(report.UUID, report)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("%v", err)})
-		return
-	}
-	// Update report with method and token
-
-	ws.GetLatestReport()[report.UUID] = &report
-
-	c.Request.Body = io.NopCloser(bytes.NewBuffer(bodyBytes)) // Restore the body for further use
-	c.JSON(200, gin.H{"status": "success"})
-}
-
-func WebSocketReport(c *gin.Context) {
-	// 升级ws
-	if !websocket.IsWebSocketUpgrade(c.Request) {
-		c.JSON(http.StatusBadRequest, gin.H{"status": "error", "error": "Require WebSocket upgrade"})
-		return
-	}
-	upgrader := websocket.Upgrader{
-		CheckOrigin: func(r *http.Request) bool {
-			return true
-		},
-	}
-	// Upgrade the HTTP connection to a WebSocket connection
-	unsafeConn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"status": "error", "error": "Failed to upgrade to WebSocket"})
-		return
-	}
-	conn := ws.NewSafeConn(unsafeConn)
-	defer conn.Close()
-
-	_, message, err := conn.ReadMessage()
-	if err != nil {
-		log.Println("Error reading message:", err)
-		return
-	}
-
-	// 第一次数据拿token
-	data := map[string]interface{}{}
-	err = json.Unmarshal(message, &data)
-	if err != nil {
-		conn.WriteJSON(gin.H{"status": "error", "error": "Invalid JSON"})
-		return
-	}
-	// it should ok,token was verfied in the middleware
-	token := ""
-	var errMsg string
-
-	// 优先检查查询参数中的 token
-	token = c.Query("token")
-
-	// 如果 token 为空，返回错误
-	if token == "" {
-		conn.WriteJSON(gin.H{"status": "error", "error": errMsg})
-		return
-	}
-
-	uuid, err := clients.GetClientUUIDByToken(token)
-	if err != nil {
-		conn.WriteJSON(gin.H{"status": "error", "error": errMsg})
-		return
-	}
-
-	// 只允许一个客户端的连接
-	if _, exists := ws.GetConnectedClients()[uuid]; exists {
-		conn.WriteJSON(gin.H{"status": "error", "error": "Token already in use"})
-		return
-	}
-	ws.SetConnectedClients(uuid, conn)
-	go notification.OnlineNotification(uuid)
-	defer func() {
-		ws.DeleteConnectedClients(uuid)
-		notification.OfflineNotification(uuid)
-	}()
-
-	for {
-		_, message, err := conn.ReadMessage()
-		if err != nil {
-			break
-		}
-
-		type MessageType struct {
-			Type string `json:"type"`
-		}
-		var msgType MessageType
-		err = json.Unmarshal(message, &msgType)
-		if err != nil {
-			conn.WriteJSON(gin.H{"status": "error", "error": "Invalid JSON"})
-			continue
-		}
-		switch msgType.Type {
-		case "", "report":
-			report := common.Report{}
-			err = json.Unmarshal(message, &report)
-			if err != nil {
-				conn.WriteJSON(gin.H{"status": "error", "error": "Invalid report format"})
-				continue
-			}
-			report.UpdatedAt = time.Now()
-			err = SaveClientReport(uuid, report)
-			if err != nil {
-				conn.WriteJSON(gin.H{"status": "error", "error": fmt.Sprintf("%v", err)})
-				continue
-			}
-			ws.SetLatestReport(uuid, &report)
-		case "ping_result":
-			var reqBody struct {
-				PingTaskID uint      `json:"task_id"`
-				PingResult int       `json:"value"`
-				PingType   string    `json:"ping_type"`
-				FinishedAt time.Time `json:"finished_at"`
-			}
-			err = json.Unmarshal(message, &reqBody)
-			if err != nil {
-				conn.WriteJSON(gin.H{"status": "error", "error": "Invalid ping result format"})
-				continue
-			}
-			pingResult := models.PingRecord{
-				Client: uuid,
-				TaskId: reqBody.PingTaskID,
-				Value:  reqBody.PingResult,
-				Time:   reqBody.FinishedAt,
-			}
-			tasks.SavePingRecord(pingResult)
-		default:
-			log.Printf("Unknown message type: %s", msgType.Type)
-			conn.WriteJSON(gin.H{"status": "error", "error": "Unknown message type"})
-		}
-
-	}
-}
-
-func SaveClientReport(uuid string, report common.Report) error {
-	if api.Records[uuid] == nil {
-		api.Records[uuid] = []common.Report{}
-	}
-	if report.CPU.Usage < 0.01 {
-		report.CPU.Usage = 0.01
-	}
-	api.Records[uuid] = append(api.Records[uuid], report)
-
-	return nil
-}

api/client/task.go

@@ -1,35 +0,0 @@
-package client
-
-import (
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/database/clients"
-	"github.com/komari-monitor/komari/database/tasks"
-)
-
-func TaskResult(c *gin.Context) {
-	token := c.Query("token")
-	clientId, _ := clients.GetClientUUIDByToken(token)
-	if clientId == "" {
-		c.JSON(400, gin.H{"status": "error", "message": "Invalid or missing token"})
-		return
-	}
-	var req struct {
-		TaskId     string    `json:"task_id" binding:"required"`
-		Result     string    `json:"result" binding:"required"`
-		ExitCode   int       `json:"exit_code"`
-		FinishedAt time.Time `json:"finished_at" binding:"required"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"status": "error", "message": "Invalid request"})
-		return
-	}
-
-	if err := tasks.SaveTaskResult(req.TaskId, clientId, req.Result, req.ExitCode, req.FinishedAt); err != nil {
-		c.JSON(500, gin.H{"status": "error", "message": "Failed to update task result: " + err.Error()})
-		return
-	}
-
-	c.JSON(200, gin.H{"status": "success", "message": "Task result updated successfully"})
-}

api/client/uploadBasicInfo.go

@@ -1,51 +0,0 @@
-package client
-
-import (
-	"net"
-
-	"github.com/komari-monitor/komari/database/clients"
-	"github.com/komari-monitor/komari/database/config"
-	"github.com/komari-monitor/komari/utils/geoip"
-
-	"github.com/gin-gonic/gin"
-)
-
-func UploadBasicInfo(c *gin.Context) {
-	var cbi = map[string]interface{}{}
-	if err := c.ShouldBindJSON(&cbi); err != nil {
-		c.JSON(400, gin.H{"status": "error", "error": "Invalid or missing data"})
-		return
-	}
-
-	token := c.Query("token")
-	uuid, err := clients.GetClientUUIDByToken(token)
-	if uuid == "" || err != nil {
-		c.JSON(400, gin.H{"status": "error", "error": "Invalid token"})
-		return
-	}
-
-	cbi["uuid"] = uuid
-
-	if cfg, err := config.Get(); err == nil && cfg.GeoIpEnabled {
-		if ipv4, ok := cbi["ipv4"].(string); ok && ipv4 != "" {
-			ip4 := net.ParseIP(ipv4)
-			ip4_record, _ := geoip.GetGeoIpInfo(ip4)
-			if ip4_record != nil {
-				cbi["region"] = geoip.GetRegionUnicodeEmoji(ip4_record.Country.ISOCode)
-			}
-		} else if ipv6, ok := cbi["ipv6"].(string); ok && ipv6 != "" {
-			ip6 := net.ParseIP(ipv6)
-			ip6_record, _ := geoip.GetGeoIpInfo(ip6)
-			if ip6_record != nil {
-				cbi["region"] = geoip.GetRegionUnicodeEmoji(ip6_record.Country.ISOCode)
-			}
-		}
-	}
-
-	if err := clients.SaveClientInfo(cbi); err != nil {
-		c.JSON(500, gin.H{"status": "error", "error": err})
-		return
-	}
-
-	c.JSON(200, gin.H{"status": "success"})
-}

api/latestRecord.go

@@ -1,14 +0,0 @@
-package api
-
-import (
-	"github.com/gin-gonic/gin"
-)
-
-func GetClientRecentRecords(c *gin.Context) {
-	uuid := c.Param("uuid")
-	if uuid == "" {
-		RespondError(c, 400, "UUID is required")
-		return
-	}
-	RespondSuccess(c, Records[uuid])
-}

api/login.go

@@ -1,75 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"io"
-	"net/http"
-
-	"github.com/komari-monitor/komari/database/accounts"
-	"github.com/komari-monitor/komari/database/config"
-	"github.com/komari-monitor/komari/database/logOperation"
-
-	"github.com/gin-gonic/gin"
-)
-
-type LoginRequest struct {
-	Username string `json:"username"`
-	Password string `json:"password"`
-	TwoFa    string `json:"2fa_code"`
-}
-
-func Login(c *gin.Context) {
-	conf, _ := config.Get()
-	if conf.DisablePasswordLogin {
-		RespondError(c, http.StatusForbidden, "Password login is disabled")
-		return
-	}
-
-	bodyBytes, err := io.ReadAll(c.Request.Body)
-	if err != nil {
-		RespondError(c, http.StatusBadRequest, "Invalid request body: "+err.Error())
-		return
-	}
-	var data LoginRequest
-	err = json.Unmarshal(bodyBytes, &data)
-	if err != nil {
-		RespondError(c, http.StatusBadRequest, "Invalid request body: "+err.Error())
-		return
-	}
-	if data.Username == "" || data.Password == "" {
-		RespondError(c, http.StatusBadRequest, "Invalid request body: Username and password are required")
-		return
-	}
-
-	uuid, success := accounts.CheckPassword(data.Username, data.Password)
-	if !success {
-		RespondError(c, http.StatusUnauthorized, "Invalid credentials")
-		return
-	}
-	// 2FA
-	user, _ := accounts.GetUserByUUID(uuid)
-	if user.TwoFactor != "" && data.TwoFa == "" {
-		RespondError(c, http.StatusUnauthorized, "2FA code is required")
-		return
-	}
-	if ok, err := accounts.Verify2Fa(uuid, data.TwoFa); err != nil && ok {
-		RespondError(c, http.StatusUnauthorized, "Invalid 2FA code")
-		return
-	}
-	// Create session
-	session, err := accounts.CreateSession(uuid, 2592000, c.Request.UserAgent(), c.ClientIP(), "password")
-	if err != nil {
-		RespondError(c, http.StatusInternalServerError, "Failed to create session: "+err.Error())
-		return
-	}
-	c.SetCookie("session_token", session, 2592000, "/", "", false, true)
-	logOperation.Log(c.ClientIP(), uuid, "logged in (password)", "login")
-	RespondSuccess(c, gin.H{"set-cookie": gin.H{"session_token": session}})
-}
-func Logout(c *gin.Context) {
-	session, _ := c.Cookie("session_token")
-	accounts.DeleteSession(session)
-	c.SetCookie("session_token", "", -1, "/", "", false, true)
-	logOperation.Log(c.ClientIP(), "", "logged out", "logout")
-	c.Redirect(302, "/")
-}

api/me.go

@@ -1,27 +0,0 @@
-package api
-
-import (
-	"github.com/komari-monitor/komari/database/accounts"
-
-	"github.com/gin-gonic/gin"
-)
-
-func GetMe(c *gin.Context) {
-	session, err := c.Cookie("session_token")
-	if err != nil {
-		c.JSON(200, gin.H{"username": "Guest", "logged_in": false})
-		return
-	}
-	uuid, err := accounts.GetSession(session)
-	if err != nil {
-		c.JSON(200, gin.H{"username": "Guest", "logged_in": false})
-		return
-	}
-	user, err := accounts.GetUserByUUID(uuid)
-	if err != nil {
-		c.JSON(200, gin.H{"username": "Guest", "logged_in": false})
-		return
-	}
-	c.JSON(200, gin.H{"username": user.Username, "logged_in": true, "uuid": user.UUID, "sso_type": user.SSOType, "sso_id": user.SSOID, "2fa_enabled": user.TwoFactor != ""})
-
-}

api/me_test.go

@@ -1,95 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/database/accounts"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetMe(t *testing.T) {
-	// 设置测试模式
-	gin.SetMode(gin.TestMode)
-
-	// 创建测试用户
-	user, err := accounts.CreateAccount("testuser", "password")
-	if err != nil {
-		t.Fatalf("Failed to create test user: %v", err)
-	}
-	uuid := user.UUID
-	sessionToken, _ := accounts.CreateSession(uuid, 2592000, "test_user_agent", "127.0.0.1", "oauth")
-
-	tests := []struct {
-		name           string
-		sessionToken   string
-		expectedStatus int
-		expectedBody   map[string]interface{}
-	}{
-		{
-			name:           "有效的会话",
-			sessionToken:   sessionToken,
-			expectedStatus: http.StatusOK,
-			expectedBody: map[string]interface{}{
-				"username": "testuser",
-			},
-		},
-		{
-			name:           "无效的会话",
-			sessionToken:   "invalid_token",
-			expectedStatus: http.StatusOK,
-			expectedBody: map[string]interface{}{
-				"username": "Guest",
-			},
-		},
-		{
-			name:           "无会话",
-			sessionToken:   "",
-			expectedStatus: http.StatusOK,
-			expectedBody: map[string]interface{}{
-				"username": "Guest",
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// 创建测试路由
-			router := gin.New()
-			router.GET("/me", GetMe)
-
-			// 创建测试请求
-			req, _ := http.NewRequest("GET", "/me", nil)
-			if tt.sessionToken != "" {
-				req.AddCookie(&http.Cookie{
-					Name:  "session_token",
-					Value: tt.sessionToken,
-				})
-			}
-
-			// 创建响应记录器
-			w := httptest.NewRecorder()
-
-			// 执行请求
-			router.ServeHTTP(w, req)
-
-			// 断言状态码
-			assert.Equal(t, tt.expectedStatus, w.Code)
-
-			// 解析响应体
-			var response map[string]interface{}
-			err := json.Unmarshal(w.Body.Bytes(), &response)
-			assert.NoError(t, err)
-
-			// 断言响应体
-			assert.Equal(t, tt.expectedBody, response)
-		})
-	}
-
-	// 清除测试数据
-	accounts.DeleteAccountByUsername("testuser")
-	accounts.DeleteAllSessions()
-}

api/nodes.go

@@ -1,26 +0,0 @@
-package api
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/database/clients"
-)
-
-func GetNodesInformation(c *gin.Context) {
-	clientList, err := clients.GetAllClientBasicInfo()
-	if err != nil {
-		RespondError(c, 500, "Failed to retrieve client information: "+err.Error())
-		return
-	}
-
-	count := len(clientList)
-	// 公开信息不展示IP地址,私有备注不展示
-	for i := 0; i < count; i++ {
-		clientList[i].IPv4 = ""
-		clientList[i].IPv6 = ""
-		clientList[i].Remark = ""
-		clientList[i].Version = ""
-		clientList[i].Token = ""
-	}
-
-	RespondSuccess(c, clientList)
-}

api/oauth.go

@@ -1,97 +0,0 @@
-package api
-
-import (
-	"fmt"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/database/accounts"
-	"github.com/komari-monitor/komari/database/config"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/utils/oauth"
-)
-
-// /api/oauth
-func OAuth(c *gin.Context) {
-	cfg, _ := config.Get()
-	if !cfg.OAuthEnabled {
-		c.JSON(403, gin.H{"status": "error", "error": "OAuth is not enabled"})
-		return
-	}
-
-	authURL, state := oauth.GetOAuthUrl()
-
-	c.SetCookie("oauth_state", state, 3600, "/", "", false, true)
-
-	c.Redirect(302, authURL)
-}
-
-// /api/oauth_callback
-func OAuthCallback(c *gin.Context) {
-	// 验证state防止CSRF攻击
-	state, _ := c.Cookie("oauth_state")
-	c.SetCookie("oauth_state", "", -1, "/", "", false, true)
-	if state == "" || state != c.Query("state") {
-		c.JSON(400, gin.H{"status": "error", "error": "Invalid state"})
-		return
-	}
-
-	// 获取code
-	code := c.Query("code")
-	if code == "" {
-		c.JSON(400, gin.H{"status": "error", "error": "No code provided"})
-		return
-	}
-
-	githubUser, err := oauth.OAuthCallback(code, state)
-	if err != nil {
-		c.JSON(500, gin.H{"status": "error", "error": "Failed to get user info: " + err.Error()})
-		return
-	}
-
-	// 使用GitHub ID作为SSO ID
-	sso_id := fmt.Sprintf("github_%d", githubUser.ID)
-
-	// 如果cookie中有binding_external_account，说明是绑定外部账号
-	// 否则是登录
-	uuid, _ := c.Cookie("binding_external_account")
-	c.SetCookie("binding_external_account", "", -1, "/", "", false, true)
-	if uuid != "" {
-		// 绑定外部账号
-		session, _ := c.Cookie("session_token")
-		user, err := accounts.GetUserBySession(session)
-		if err != nil || user.UUID != uuid {
-			c.JSON(500, gin.H{"status": "error", "message": "Binding failed"})
-			return
-		}
-		err = accounts.BindingExternalAccount(user.UUID, sso_id)
-		if err != nil {
-			c.JSON(500, gin.H{"status": "error", "message": "Binding failed"})
-			return
-		}
-		logOperation.Log(c.ClientIP(), user.UUID, "bound external account (OAuth)"+fmt.Sprintf(",sso_id: %s", sso_id), "login")
-		c.Redirect(302, "/manage")
-		return
-	}
-
-	// 尝试获取用户
-	user, err := accounts.GetUserBySSO(sso_id)
-	if err != nil {
-		c.JSON(401, gin.H{
-			"status":  "error",
-			"message": "please log in and bind your GitHub account first.",
-		})
-		return
-	}
-
-	// 创建会话
-	session, err := accounts.CreateSession(user.UUID, 2592000, c.Request.UserAgent(), c.ClientIP(), "oauth")
-	if err != nil {
-		c.JSON(500, gin.H{"status": "error", "message": err.Error()})
-		return
-	}
-
-	// 设置cookie并返回
-	c.SetCookie("session_token", session, 2592000, "/", "", false, true)
-	logOperation.Log(c.ClientIP(), user.UUID, "logged in (OAuth)", "login")
-	c.Redirect(302, "/manage")
-}

api/public.go

@@ -1,28 +0,0 @@
-package api
-
-import (
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/database/config"
-)
-
-func GetPublicSettings(c *gin.Context) {
-	cst, err := config.Get()
-	if err != nil {
-		RespondError(c, 500, err.Error())
-		return
-	}
-	// Return public settings including CORS
-	RespondSuccess(c, gin.H{
-		"sitename":                  cst.Sitename,
-		"description":               cst.Description,
-		"custom_head":               cst.CustomHead,
-		"custom_body":               cst.CustomBody,
-		"oauth_enable":              cst.OAuthEnabled,
-		"disable_password_login":    cst.DisablePasswordLogin,
-		"allow_cors":                cst.AllowCors,
-		"record_enabled":            cst.RecordEnabled,
-		"record_preserve_time":      cst.RecordPreserveTime,
-		"ping_record_preserve_time": cst.PingRecordPreserveTime,
-	})
-
-}

api/record/record.go

@@ -1,88 +0,0 @@
-package record
-
-import (
-	"strconv"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	records "github.com/komari-monitor/komari/database/records"
-	"github.com/komari-monitor/komari/database/tasks"
-)
-
-func GetRecordsByUUID(c *gin.Context) {
-	uuid := c.Query("uuid")
-	hours := c.Query("hours")
-	if uuid == "" {
-		api.RespondError(c, 400, "UUID is required")
-		return
-	}
-	if hours == "" {
-		hours = "4"
-	}
-
-	hoursInt, err := strconv.Atoi(hours)
-	if err != nil {
-		api.RespondError(c, 400, "Invalid hours parameter")
-		return
-	}
-
-	records, err := records.GetRecordsByClientAndTime(uuid, time.Now().Add(-time.Duration(hoursInt)*time.Hour), time.Now())
-	if err != nil {
-		api.RespondError(c, 500, "Failed to fetch records: "+err.Error())
-		return
-	}
-	api.RespondSuccess(c, gin.H{
-		"records": records,
-		"count":   len(records),
-	})
-}
-
-// GET query: uuid string, hours int
-func GetPingRecords(c *gin.Context) {
-	uuid := c.Query("uuid")
-	hours := c.Query("hours")
-
-	if uuid == "" {
-		api.RespondError(c, 400, "UUID is required")
-		return
-	}
-	if hours == "" {
-		hours = "4"
-	}
-
-	hoursInt, err := strconv.Atoi(hours)
-	if err != nil {
-		api.RespondError(c, 400, "Invalid hours parameter")
-		return
-	}
-
-	records, err := tasks.GetPingRecordsByClientAndTime(uuid, time.Now().Add(-time.Duration(hoursInt)*time.Hour), time.Now())
-	if err != nil {
-		api.RespondError(c, 500, "Failed to fetch records: "+err.Error())
-		return
-	}
-
-	response := gin.H{
-		"records": records,
-		"count":   len(records),
-	}
-
-	if len(records) > 0 {
-		pingTasks, err := tasks.GetAllPingTasks()
-		if err != nil {
-			api.RespondError(c, 500, "Failed to fetch ping tasks: "+err.Error())
-			return
-		}
-		tasksList := make([]gin.H, 0, len(pingTasks))
-		for _, t := range pingTasks {
-			tasksList = append(tasksList, gin.H{
-				"id":   t.Id,
-				"name": t.Name,
-			})
-		}
-		response["tasks"] = tasksList
-	}
-
-	api.RespondSuccess(c, response)
-}

api/terminal.go

@@ -1,168 +0,0 @@
-package api
-
-import (
-	"log"
-	"net/http"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/gorilla/websocket"
-	"github.com/komari-monitor/komari/database/clients"
-	"github.com/komari-monitor/komari/database/logOperation"
-	"github.com/komari-monitor/komari/utils"
-	"github.com/komari-monitor/komari/ws"
-)
-
-func RequestTerminal(c *gin.Context) {
-	uuid := c.Param("uuid")
-	user_uuid, _ := c.Get("uuid")
-	_, err := clients.GetClientByUUID(uuid)
-	if err != nil {
-		c.JSON(400, gin.H{
-			"status":  "error",
-			"message": "Client not found",
-		})
-		return
-	}
-	// 建立ws
-	if !websocket.IsWebSocketUpgrade(c.Request) {
-		c.JSON(http.StatusBadRequest, gin.H{"status": "error", "message": "Require WebSocket upgrade"})
-		return
-	}
-	upgrader := websocket.Upgrader{
-		CheckOrigin: func(r *http.Request) bool {
-			return true
-		},
-	}
-	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
-	if err != nil {
-		return
-	}
-	// 新建一个终端连接
-	id := utils.GenerateRandomString(32)
-	session := &TerminalSession{
-		UserUUID: user_uuid.(string),
-		UUID:     uuid,
-		Browser:  conn,
-		Agent:    nil,
-	}
-
-	TerminalSessionsMutex.Lock()
-	TerminalSessions[id] = session
-	TerminalSessionsMutex.Unlock()
-	conn.SetCloseHandler(func(code int, text string) error {
-		log.Println("Terminal connection closed:", code, text)
-		TerminalSessionsMutex.Lock()
-		delete(TerminalSessions, id)
-		TerminalSessionsMutex.Unlock()
-		// 通知 Agent 关闭终端连接
-		if session.Agent != nil {
-			session.Agent.Close()
-		}
-		return nil
-	})
-
-	if ws.GetConnectedClients()[uuid] == nil {
-		conn.WriteMessage(1, []byte("Client offline!\n被控端离线!"))
-		conn.Close()
-		TerminalSessionsMutex.Lock()
-		delete(TerminalSessions, id)
-		TerminalSessionsMutex.Unlock()
-		return
-	}
-	err = ws.GetConnectedClients()[uuid].WriteJSON(gin.H{
-		"message":    "terminal",
-		"request_id": id,
-	})
-	if err != nil {
-		conn.Close()
-		TerminalSessionsMutex.Lock()
-		delete(TerminalSessions, id)
-		TerminalSessionsMutex.Unlock()
-		return
-	}
-	conn.WriteMessage(1, []byte("等待被控端连接 waiting for agent..."))
-	// 如果没有连接上，则关闭连接
-	time.AfterFunc(30*time.Second, func() {
-		TerminalSessionsMutex.Lock()
-		if session.Agent == nil {
-			if session.Browser != nil {
-				session.Browser.WriteMessage(1, []byte("被控端连接超时 timeout"))
-				session.Browser.Close()
-			}
-			conn.Close()
-			delete(TerminalSessions, id)
-		}
-		TerminalSessionsMutex.Unlock()
-	})
-	logOperation.Log(c.ClientIP(), user_uuid.(string), "request, terminal id:"+id+",client:"+session.UUID, "terminal")
-}
-
-func ForwardTerminal(id string) {
-	session, exists := TerminalSessions[id]
-
-	if !exists || session == nil || session.Agent == nil || session.Browser == nil {
-		return
-	}
-	logOperation.Log("", session.UserUUID, "established, terminal id:"+id, "terminal")
-	established_time := time.Now()
-	errChan := make(chan error, 1)
-
-	go func() {
-		for {
-			messageType, data, err := session.Browser.ReadMessage()
-			if err != nil {
-				errChan <- err
-				return
-			}
-
-			if messageType == websocket.TextMessage {
-				if session.Agent != nil && string(data[0:1]) == "{" {
-					err = session.Agent.WriteMessage(websocket.TextMessage, data)
-				} else if session.Agent != nil {
-					err = session.Agent.WriteMessage(websocket.BinaryMessage, data)
-				}
-			} else if session.Agent != nil {
-				// 二进制消息，原样传递
-				err = session.Agent.WriteMessage(websocket.BinaryMessage, data)
-			}
-
-			if err != nil {
-				errChan <- err
-				return
-			}
-		}
-	}()
-
-	go func() {
-		for {
-			_, data, err := session.Agent.ReadMessage()
-			if err != nil {
-				errChan <- err
-				return
-			}
-			if session.Browser != nil {
-				err = session.Browser.WriteMessage(websocket.BinaryMessage, data)
-				if err != nil {
-					errChan <- err
-					return
-				}
-			}
-		}
-	}()
-
-	// 等待错误或主动关闭
-	<-errChan
-	// 关闭连接
-	if session.Agent != nil {
-		session.Agent.Close()
-	}
-	if session.Browser != nil {
-		session.Browser.Close()
-	}
-	disconnect_time := time.Now()
-	logOperation.Log("", session.UserUUID, "disconnected, terminal id:"+id+", duration:"+disconnect_time.Sub(established_time).String(), "terminal")
-	TerminalSessionsMutex.Lock()
-	delete(TerminalSessions, id)
-	TerminalSessionsMutex.Unlock()
-}

cmd/flags/config.go

@@ -1,14 +1,41 @@
 package flags
 
+import "strings"
+
+const (
+	DatabaseTypeSQLite = "sqlite"
+)
+
 var (
 	// 数据库配置
-	DatabaseType string // 数据库类型：sqlite, mysql
+	DatabaseType string // 数据库类型：sqlite
 	DatabaseFile string // SQLite数据库文件路径
-	DatabaseHost string // MySQL/其他数据库主机地址
-	DatabasePort string // MySQL/其他数据库端口
-	DatabaseUser string // MySQL/其他数据库用户名
-	DatabasePass string // MySQL/其他数据库密码
-	DatabaseName string // MySQL/其他数据库名称
+	DatabaseHost string // 保留的兼容参数，当前未使用
+	DatabasePort string // 保留的兼容参数，当前未使用
+	DatabaseUser string // 保留的兼容参数，当前未使用
+	DatabasePass string // 保留的兼容参数，当前未使用
+	DatabaseName string // 保留的兼容参数，当前未使用
 
 	Listen string
 )
+
+func NormalizeDatabaseType(databaseType string) string {
+	databaseType = strings.ToLower(strings.TrimSpace(databaseType))
+	if databaseType == "" {
+		return DatabaseTypeSQLite
+	}
+	return databaseType
+}
+
+func ApplyDatabaseTypeNormalization() string {
+	DatabaseType = NormalizeDatabaseType(DatabaseType)
+	return DatabaseType
+}
+
+func IsSQLite() bool {
+	return NormalizeDatabaseType(DatabaseType) == DatabaseTypeSQLite
+}
+
+func SupportedDatabaseTypes() string {
+	return DatabaseTypeSQLite
+}

cmd/flags/config_test.go

@@ -0,0 +1,20 @@
+package flags
+
+import "testing"
+
+func TestNormalizeDatabaseType(t *testing.T) {
+	tests := map[string]string{
+		"":          DatabaseTypeSQLite,
+		"sqlite":    DatabaseTypeSQLite,
+		" SQLite ":  DatabaseTypeSQLite,
+		"SQLITE":    DatabaseTypeSQLite,
+		"postgres":  "postgres",
+		" postgres": "postgres",
+	}
+
+	for input, want := range tests {
+		if got := NormalizeDatabaseType(input); got != want {
+			t.Fatalf("NormalizeDatabaseType(%q) = %q, want %q", input, got, want)
+		}
+	}
+}

cmd/permitPasswordLogin.go

@@ -4,9 +4,8 @@ import (
 	"os"
 
 	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/models"
+	"github.com/komari-monitor/komari/pkg/config"
 	"github.com/spf13/cobra"
-	"gorm.io/gorm"
 )
 
 var PermitPasswordLoginCmd = &cobra.Command{
@@ -14,12 +13,8 @@ var PermitPasswordLoginCmd = &cobra.Command{
 	Short: "Force permit password login",
 	Long:  `Force permit password login`,
 	Run: func(cmd *cobra.Command, args []string) {
-		db := dbcore.GetDBInstance()
-		err := db.Transaction(func(tx *gorm.DB) error {
-			return tx.Model(&models.Config{}).Where("id = ?", 1).
-				Update("disable_password_login", false).Error
-		})
-		if err != nil {
+		dbcore.GetDBInstance()
+		if err := config.Set(config.DisablePasswordLoginKey, false); err != nil {
 			cmd.Println("Error:", err)
 			os.Exit(1)
 		}

cmd/root.go

@@ -9,7 +9,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func getEnv(key, defaultValue string) string {
+func GetEnv(key, defaultValue string) string {
 	value := os.Getenv(key)
 	if value == "" {
 		return defaultValue
@@ -19,13 +19,13 @@ func getEnv(key, defaultValue string) string {
 
 // 从环境变量获取默认值
 var (
-	dbTypeEnv = getEnv("KOMARI_DB_TYPE", "sqlite")
-	dbFileEnv = getEnv("KOMARI_DB_FILE", "./data/komari.db")
-	dbHostEnv = getEnv("KOMARI_DB_HOST", "localhost")
-	dbPortEnv = getEnv("KOMARI_DB_PORT", "3306")
-	dbUserEnv = getEnv("KOMARI_DB_USER", "root")
-	dbPassEnv = getEnv("KOMARI_DB_PASS", "")
-	dbNameEnv = getEnv("KOMARI_DB_NAME", "komari")
+	dbTypeEnv = GetEnv("KOMARI_DB_TYPE", "sqlite")
+	dbFileEnv = GetEnv("KOMARI_DB_FILE", "./data/komari.db")
+	dbHostEnv = GetEnv("KOMARI_DB_HOST", "localhost")
+	dbPortEnv = GetEnv("KOMARI_DB_PORT", "3306")
+	dbUserEnv = GetEnv("KOMARI_DB_USER", "root")
+	dbPassEnv = GetEnv("KOMARI_DB_PASS", "")
+	dbNameEnv = GetEnv("KOMARI_DB_NAME", "komari")
 )
 
 var RootCmd = &cobra.Command{
@@ -48,11 +48,14 @@ func Execute() {
 
 func init() {
 	// 设置命令行参数，提供环境变量作为默认值
-	RootCmd.PersistentFlags().StringVarP(&flags.DatabaseType, "db-type", "t", dbTypeEnv, "Database type (sqlite, mysql) [env: KOMARI_DB_TYPE]")
+	RootCmd.PersistentFlags().StringVarP(&flags.DatabaseType, "db-type", "t", dbTypeEnv, "Database type (sqlite) [env: KOMARI_DB_TYPE]")
 	RootCmd.PersistentFlags().StringVarP(&flags.DatabaseFile, "database", "d", dbFileEnv, "SQLite database file path [env: KOMARI_DB_FILE]")
-	RootCmd.PersistentFlags().StringVar(&flags.DatabaseHost, "db-host", dbHostEnv, "MySQL/Other database host address [env: KOMARI_DB_HOST]")
-	RootCmd.PersistentFlags().StringVar(&flags.DatabasePort, "db-port", dbPortEnv, "MySQL/Other database port [env: KOMARI_DB_PORT]")
-	RootCmd.PersistentFlags().StringVar(&flags.DatabaseUser, "db-user", dbUserEnv, "MySQL/Other database username [env: KOMARI_DB_USER]")
-	RootCmd.PersistentFlags().StringVar(&flags.DatabasePass, "db-pass", dbPassEnv, "MySQL/Other database password [env: KOMARI_DB_PASS]")
-	RootCmd.PersistentFlags().StringVar(&flags.DatabaseName, "db-name", dbNameEnv, "MySQL/Other database name [env: KOMARI_DB_NAME]")
+	RootCmd.PersistentFlags().StringVar(&flags.DatabaseHost, "db-host", dbHostEnv, "Reserved database host parameter [env: KOMARI_DB_HOST]")
+	RootCmd.PersistentFlags().StringVar(&flags.DatabasePort, "db-port", dbPortEnv, "Reserved database port parameter [env: KOMARI_DB_PORT]")
+	RootCmd.PersistentFlags().StringVar(&flags.DatabaseUser, "db-user", dbUserEnv, "Reserved database username parameter [env: KOMARI_DB_USER]")
+	RootCmd.PersistentFlags().StringVar(&flags.DatabasePass, "db-pass", dbPassEnv, "Reserved database password parameter [env: KOMARI_DB_PASS]")
+	RootCmd.PersistentFlags().StringVar(&flags.DatabaseName, "db-name", dbNameEnv, "Reserved database name parameter [env: KOMARI_DB_NAME]")
+	for _, name := range []string{"db-host", "db-port", "db-user", "db-pass", "db-name"} {
+		_ = RootCmd.PersistentFlags().MarkHidden(name)
+	}
 }

cmd/server.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"fmt"
 	"log"
 	"net/http"
 	"os"
@@ -10,262 +11,167 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
-	"github.com/komari-monitor/komari/api"
-	"github.com/komari-monitor/komari/api/admin"
-	"github.com/komari-monitor/komari/api/admin/clipboard"
-	log_api "github.com/komari-monitor/komari/api/admin/log"
-	"github.com/komari-monitor/komari/api/admin/notification"
-	"github.com/komari-monitor/komari/api/admin/test"
-	"github.com/komari-monitor/komari/api/admin/update"
-	"github.com/komari-monitor/komari/api/client"
-	"github.com/komari-monitor/komari/api/record"
 	"github.com/komari-monitor/komari/cmd/flags"
+	"github.com/komari-monitor/komari/pkg/corn"
+	"github.com/komari-monitor/komari/web/api"
+
+	"github.com/komari-monitor/komari/database"
 	"github.com/komari-monitor/komari/database/accounts"
-	"github.com/komari-monitor/komari/database/config"
+	"github.com/komari-monitor/komari/database/auditlog"
 	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/logOperation"
 	"github.com/komari-monitor/komari/database/models"
+	d_notification "github.com/komari-monitor/komari/database/notification"
 	"github.com/komari-monitor/komari/database/records"
 	"github.com/komari-monitor/komari/database/tasks"
-	"github.com/komari-monitor/komari/public"
+	"github.com/komari-monitor/komari/pkg/config"
 	"github.com/komari-monitor/komari/utils"
+	"github.com/komari-monitor/komari/utils/cloudflared"
 	"github.com/komari-monitor/komari/utils/geoip"
-	"github.com/komari-monitor/komari/ws"
+	logutil "github.com/komari-monitor/komari/utils/log"
+	"github.com/komari-monitor/komari/utils/messageSender"
+	"github.com/komari-monitor/komari/utils/notifier"
+	"github.com/komari-monitor/komari/web/nezha"
+	"github.com/komari-monitor/komari/web/oauth"
+	report_cache "github.com/komari-monitor/komari/web/report"
+	"github.com/komari-monitor/komari/web/router"
+	"github.com/komari-monitor/komari/web/security"
 	"github.com/spf13/cobra"
 )
 
-var (
-	DynamicCorsEnabled bool = false
-)
-
 var ServerCmd = &cobra.Command{
 	Use:   "server",
 	Short: "Start the server",
 	Long:  `Start the server`,
 	Run: func(cmd *cobra.Command, args []string) {
-		// #region 初始化
-		if err := os.MkdirAll("./data", os.ModePerm); err != nil {
-			log.Fatalf("Failed to create data directory: %v", err)
-		}
-		InitDatabase()
-		if utils.VersionHash != "unknown" {
-			gin.SetMode(gin.ReleaseMode)
-		}
-		go geoip.InitGeoIp()
-		go DoScheduledWork()
-
-		r := gin.Default()
-
-		// 动态 CORS 中间件
-		conf, err := config.Get()
-		if err != nil {
-			log.Fatal(err)
-		}
-		DynamicCorsEnabled = conf.AllowCors
-		config.Subscribe(func(event config.ConfigEvent) {
-			DynamicCorsEnabled = event.New.AllowCors
-		})
-		r.Use(func(c *gin.Context) {
-			if DynamicCorsEnabled {
-				c.Header("Access-Control-Allow-Origin", "*")
-				c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS")
-				c.Header("Access-Control-Allow-Headers", "Origin, Content-Length, Content-Type, Authorization, Accept, X-CSRF-Token, X-Requested-With, Set-Cookie")
-				c.Header("Access-Control-Expose-Headers", "Content-Length, Authorization, Set-Cookie")
-				c.Header("Access-Control-Allow-Credentials", "true")
-				c.Header("Access-Control-Max-Age", "43200") // 12 hours
-				if c.Request.Method == "OPTIONS" {
-					c.AbortWithStatus(204)
-					return
-				}
-			}
-			c.Next()
-		})
-
-		r.Use(func(c *gin.Context) {
-			if len(c.Request.URL.Path) >= 4 && c.Request.URL.Path[:4] == "/api" {
-				c.Header("Cache-Control", "no-store")
-			}
-			c.Next()
-		})
-
-		r.Any("/ping", func(c *gin.Context) {
-			c.String(200, "pong")
-		})
-		// #region 公开路由
-		r.POST("/api/login", api.Login)
-		r.GET("/api/me", api.GetMe)
-		r.GET("/api/clients", ws.GetClients)
-		r.GET("/api/nodes", api.GetNodesInformation)
-		r.GET("/api/public", api.GetPublicSettings)
-		r.GET("/api/oauth", api.OAuth)
-		r.GET("/api/oauth_callback", api.OAuthCallback)
-		r.GET("/api/logout", api.Logout)
-		r.GET("/api/version", api.GetVersion)
-		r.GET("/api/recent/:uuid", api.GetClientRecentRecords)
-
-		r.GET("/api/records/load", record.GetRecordsByUUID)
-		r.GET("/api/records/ping", record.GetPingRecords)
-		// #region Agent
-		tokenAuthrized := r.Group("/api/clients", api.TokenAuthMiddleware())
-		{
-			tokenAuthrized.GET("/report", client.WebSocketReport) // websocket
-			tokenAuthrized.POST("/uploadBasicInfo", client.UploadBasicInfo)
-			tokenAuthrized.POST("/report", client.UploadReport)
-			tokenAuthrized.GET("/terminal", client.EstablishConnection)
-			tokenAuthrized.POST("/task/result", client.TaskResult)
-		}
-		// #region 管理员
-		adminAuthrized := r.Group("/api/admin", api.AdminAuthMiddleware())
-		{
-			// test
-			testGroup := adminAuthrized.Group("/test")
-			{
-				testGroup.GET("/telegram", test.TestTelegram)
-				testGroup.GET("/geoip", test.TestGeoIp)
-			}
-			// update
-			updateGroup := adminAuthrized.Group("/update")
-			{
-				updateGroup.POST("/mmdb", update.UpdateMmdbGeoIP)
-				updateGroup.POST("/user", update.UpdateUser)
-				updateGroup.PUT("/favicon", update.UploadFavicon)
-				updateGroup.POST("/favicon", update.DeleteFavicon)
-			}
-			// tasks
-			taskGroup := adminAuthrized.Group("/task")
-			{
-				taskGroup.GET("/all", admin.GetTasks)
-				taskGroup.POST("/exec", admin.Exec)
-				taskGroup.GET("/:task_id", admin.GetTaskById)
-				taskGroup.GET("/:task_id/result", admin.GetTaskResultsByTaskId)
-				taskGroup.GET("/:task_id/result/:uuid", admin.GetSpecificTaskResult)
-				taskGroup.GET("/client/:uuid", admin.GetTasksByClientId)
-			}
-			// settings
-			adminAuthrized.GET("/settings", admin.GetSettings)
-			adminAuthrized.POST("/settings", admin.EditSettings)
-			// clients
-			clientGroup := adminAuthrized.Group("/client")
-			{
-				clientGroup.POST("/add", admin.AddClient)
-				clientGroup.GET("/list", admin.ListClients)
-				clientGroup.GET("/:uuid", admin.GetClient)
-				clientGroup.POST("/:uuid/edit", admin.EditClient)
-				clientGroup.POST("/:uuid/remove", admin.RemoveClient)
-				clientGroup.GET("/:uuid/token", admin.GetClientToken)
-				clientGroup.POST("/order", admin.OrderWeight)
-				// client terminal
-				clientGroup.GET("/:uuid/terminal", api.RequestTerminal)
-			}
-
-			// records
-			recordGroup := adminAuthrized.Group("/record")
-			{
-				recordGroup.POST("/clear", admin.ClearRecord)
-			}
-			// oauth2
-			oauth2Group := adminAuthrized.Group("/oauth2")
-			{
-				oauth2Group.GET("/bind", admin.BindingExternalAccount)
-				oauth2Group.POST("/unbind", admin.UnbindExternalAccount)
-			}
-			sessionGroup := adminAuthrized.Group("/session")
-			{
-				sessionGroup.GET("/get", admin.GetSessions)
-				sessionGroup.POST("/remove", admin.DeleteSession)
-				sessionGroup.POST("/remove/all", admin.DeleteAllSession)
-			}
-			two_factorGroup := adminAuthrized.Group("/2fa")
-			{
-				two_factorGroup.GET("/generate", admin.Generate2FA)
-				two_factorGroup.POST("/enable", admin.Enable2FA)
-				two_factorGroup.POST("/disable", admin.Disable2FA)
-			}
-			adminAuthrized.GET("/logs", log_api.GetLogs)
-
-			// clipboard
-			clipboardGroup := adminAuthrized.Group("/clipboard")
-			{
-				clipboardGroup.GET("/:id", clipboard.GetClipboard)
-				clipboardGroup.GET("", clipboard.ListClipboard)
-				clipboardGroup.POST("", clipboard.CreateClipboard)
-				clipboardGroup.POST("/:id", clipboard.UpdateClipboard)
-				clipboardGroup.POST("/remove", clipboard.BatchDeleteClipboard)
-				clipboardGroup.POST("/:id/remove", clipboard.DeleteClipboard)
-			}
-
-			notificationGroup := adminAuthrized.Group("/notification")
-			{
-				// offline notifications
-				notificationGroup.GET("/offline", notification.ListOfflineNotifications)
-				notificationGroup.POST("/offline/edit", notification.EditOfflineNotification)
-				notificationGroup.POST("/offline/enable", notification.EnableOfflineNotification)
-				notificationGroup.POST("/offline/disable", notification.DisableOfflineNotification)
-			}
-
-			pingTaskGroup := adminAuthrized.Group("/ping")
-			{
-				pingTaskGroup.GET("/", admin.GetAllPingTasks)
-				pingTaskGroup.POST("/add", admin.AddPingTask)
-				pingTaskGroup.POST("/delete", admin.DeletePingTask)
-				pingTaskGroup.POST("/edit", admin.EditPingTask)
-
-			}
-
-		}
-
-		public.Static(r.Group("/"), func(handlers ...gin.HandlerFunc) {
-			r.NoRoute(handlers...)
-		})
-		// #region 静态文件服务
-		public.UpdateIndex(conf)
-		config.Subscribe(func(event config.ConfigEvent) {
-			public.UpdateIndex(event.New)
-		})
-
-		srv := &http.Server{
-			Addr:    flags.Listen,
-			Handler: r,
-		}
-		go func() {
-			if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-				OnFatal(err)
-				log.Fatalf("listen: %s\n", err)
-			}
-		}()
-		quit := make(chan os.Signal, 1)
-		signal.Notify(quit, os.Interrupt, syscall.SIGTERM)
-		<-quit
-		OnShutdown()
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if err := srv.Shutdown(ctx); err != nil {
-			log.Fatalf("Server forced to shutdown: %v", err)
-		}
-
+		RunServer()
 	},
 }
 
 func init() {
 	// 从环境变量获取监听地址
-	listenAddr := getEnv("KOMARI_LISTEN", "0.0.0.0:25774")
+	listenAddr := GetEnv("KOMARI_LISTEN", "0.0.0.0:25774")
 	ServerCmd.PersistentFlags().StringVarP(&flags.Listen, "listen", "l", listenAddr, "监听地址 [env: KOMARI_LISTEN]")
 	RootCmd.AddCommand(ServerCmd)
 }
 
+func RunServer() {
+	// #region 初始化
+	if err := os.MkdirAll("./data/theme", os.ModePerm); err != nil {
+		log.Fatalf("Failed to create theme directory: %v", err)
+	}
+	InitDatabase()
+	if utils.VersionHash != "unknown" {
+		gin.SetMode(gin.ReleaseMode)
+	}
+	conf, err := config.GetManyAs[config.Settings]()
+	if err != nil {
+		log.Fatal(err)
+	}
+	go geoip.InitGeoIp()
+	go DoScheduledWork()
+	go messageSender.Initialize()
+	// oidcInit
+	go oauth.Initialize()
+
+	if conf.NezhaCompatEnabled {
+		go func() {
+			if err := nezha.StartNezhaCompat(conf.NezhaCompatListen); err != nil {
+				log.Printf("Nezha compat server error: %v", err)
+				auditlog.EventLog("error", fmt.Sprintf("Nezha compat server error: %v", err))
+			}
+		}()
+	}
+
+	config.Subscribe(func(event config.ConfigEvent) {
+		if ok, t := config.IsChangedT[string](event, config.OAuthProviderKey); ok {
+			if t == "" || t == "none" {
+				t = "github"
+			}
+			oidcProvider, err := database.GetOidcConfigByName(t)
+			if err != nil {
+				log.Printf("Failed to get OIDC provider config: %v", err)
+			} else {
+				log.Printf("Using %s as OIDC provider", oidcProvider.Name)
+			}
+			err = oauth.LoadProvider(oidcProvider.Name, oidcProvider.Addition)
+			if err != nil {
+				auditlog.EventLog("error", fmt.Sprintf("Failed to load OIDC provider: %v", err))
+			}
+		}
+
+		if ok, t := config.IsChangedT[bool](event, config.NezhaCompatEnabledKey); ok {
+			if t {
+				l, _ := config.GetAs[string](config.NezhaCompatListenKey)
+				if err := nezha.StartNezhaCompat(l); err != nil {
+					log.Printf("start Nezha compat server error: %v", err)
+					auditlog.EventLog("error", fmt.Sprintf("start Nezha compat server error: %v", err))
+				}
+			} else {
+				if err := nezha.StopNezhaCompat(); err != nil {
+					log.Printf("stop Nezha compat server error: %v", err)
+					auditlog.EventLog("error", fmt.Sprintf("stop Nezha compat server error: %v", err))
+				}
+			}
+		}
+
+	})
+	// 初始化 cloudflared
+	if err := cloudflared.AutoStart(GetEnv("KOMARI_CLOUDFLARED_TOKEN", "")); err != nil {
+		log.Printf("failed to auto start cloudflared: %v", err)
+	}
+
+	r := gin.New()
+	r.Use(logutil.GinLogger())
+	r.Use(logutil.GinRecovery())
+
+	config.Subscribe(func(event config.ConfigEvent) {
+		if event.IsChanged(config.GeoIpProviderKey) {
+			go geoip.InitGeoIp()
+		}
+
+		if event.IsChanged(config.NotificationMethodKey) {
+			go messageSender.Initialize()
+		}
+
+	})
+	r.Use(security.CorsMiddleware(conf.CorsOriginCheckEnabled, conf.CorsAllowedOrigins))
+
+	r.Use(api.IdentityMiddleware())
+	r.Use(api.PrivateSiteMiddleware())
+
+	r.Use(func(c *gin.Context) {
+		if len(c.Request.URL.Path) >= 4 && c.Request.URL.Path[:4] == "/api" {
+			c.Header("Cache-Control", "no-store")
+		}
+		c.Next()
+	})
+
+	router.Register(r)
+
+	srv := &http.Server{
+		Addr:    flags.Listen,
+		Handler: r,
+	}
+	log.Printf("Starting server on %s ...", flags.Listen)
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			OnFatal(err)
+			log.Fatalf("listen: %s\n", err)
+		}
+	}()
+	quit := make(chan os.Signal, 1)
+	signal.Notify(quit, os.Interrupt, syscall.SIGTERM)
+	<-quit
+	OnShutdown()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := srv.Shutdown(ctx); err != nil {
+		log.Fatalf("Server forced to shutdown: %v", err)
+	}
+
+}
+
 func InitDatabase() {
-	// // 打印数据库类型和连接信息
-	// if flags.DatabaseType == "mysql" {
-	// 	log.Printf("使用 MySQL 数据库连接: %s@%s:%s/%s",
-	// 		flags.DatabaseUser, flags.DatabaseHost, flags.DatabasePort, flags.DatabaseName)
-	// 	log.Printf("环境变量配置: [KOMARI_DB_TYPE=%s] [KOMARI_DB_HOST=%s] [KOMARI_DB_PORT=%s] [KOMARI_DB_USER=%s] [KOMARI_DB_NAME=%s]",
-	// 		os.Getenv("KOMARI_DB_TYPE"), os.Getenv("KOMARI_DB_HOST"), os.Getenv("KOMARI_DB_PORT"),
-	// 		os.Getenv("KOMARI_DB_USER"), os.Getenv("KOMARI_DB_NAME"))
-	// } else {
-	// 	log.Printf("使用 SQLite 数据库文件: %s", flags.DatabaseFile)
-	// 	log.Printf("环境变量配置: [KOMARI_DB_TYPE=%s] [KOMARI_DB_FILE=%s]",
-	// 		os.Getenv("KOMARI_DB_TYPE"), os.Getenv("KOMARI_DB_FILE"))
-	// }
 	var count int64 = 0
 	if dbcore.GetDBInstance().Model(&models.User{}).Count(&count); count == 0 {
 		user, passwd, err := accounts.CreateDefaultAdminAccount()
@@ -278,31 +184,54 @@ func InitDatabase() {
 
 // #region 定时任务
 func DoScheduledWork() {
-	tasks.ReloadPingSchedule()
-	ticker := time.NewTicker(time.Minute * 30)
-	minute := time.NewTicker(60 * time.Second)
-	//records.DeleteRecordBefore(time.Now().Add(-time.Hour * 24 * 30))
-	records.CompactRecord()
-	cfg, _ := config.Get()
-	for {
-		select {
-		case <-ticker.C:
-			records.DeleteRecordBefore(time.Now().Add(-time.Hour * time.Duration(cfg.RecordPreserveTime)))
-			records.CompactRecord()
-			tasks.ClearTaskResultsByTimeBefore(time.Now().Add(-time.Hour * time.Duration(cfg.RecordPreserveTime)))
-			tasks.DeletePingRecordsBefore(time.Now().Add(-time.Hour * time.Duration(cfg.RecordPreserveTime)))
-			logOperation.RemoveOldLogs()
-		case <-minute.C:
-			api.SaveClientReportToDB()
-		}
+	if err := tasks.ReloadPingSchedule(); err != nil {
+		log.Println("Failed to reload ping schedule:", err)
 	}
+	if err := d_notification.ReloadLoadNotificationSchedule(); err != nil {
+		log.Println("Failed to reload load notification schedule:", err)
+	}
+	records.CompactRecord()
 
+	if err := corn.AddFunc("records:cleanup", "@every 30m", cleanupScheduledData); err != nil {
+		log.Println("Failed to add cleanup scheduled task:", err)
+	}
+	if err := corn.AddFunc("records:minute", "@every 1m", minuteScheduledWork); err != nil {
+		log.Println("Failed to add minute scheduled task:", err)
+	}
+	if err := corn.AddFunc("notifier:expire", "0 0 9 * * *", notifier.CheckExpireScheduledWork); err != nil {
+		log.Println("Failed to add expire notification scheduled task:", err)
+	}
+	notifier.InitTrafficReportSchedule()
+}
+
+func cleanupScheduledData() {
+	cfg, _ := config.GetManyAs[config.Settings]()
+	records.DeleteRecordBefore(time.Now().Add(-time.Hour * time.Duration(cfg.RecordPreserveTime)))
+	records.CompactRecord()
+	tasks.ClearTaskResultsByTimeBefore(time.Now().Add(-time.Hour * time.Duration(cfg.RecordPreserveTime)))
+	tasks.DeletePingRecordsBefore(time.Now().Add(-time.Hour * time.Duration(cfg.PingRecordPreserveTime)))
+	auditlog.RemoveOldLogs()
+	accounts.RemoveExpiredSessions()
+}
+
+func minuteScheduledWork() {
+	cfg, _ := config.GetManyAs[config.Settings]()
+	report_cache.SaveClientReportToDB()
+	if !cfg.RecordEnabled {
+		records.DeleteAll()
+		tasks.DeleteAllPingRecords()
+	}
+	// 每分钟检查一次流量提醒
+	notifier.CheckTraffic()
 }
 
 func OnShutdown() {
-	logOperation.Log("", "", "server is shutting down", "info")
+	auditlog.Log("", "", "server is shutting down", "info")
+	corn.StopAll()
+	cloudflared.Shutdown()
 }
 
 func OnFatal(err error) {
-	logOperation.Log("", "", "server encountered a fatal error: "+err.Error(), "error")
+	auditlog.Log("", "", "server encountered a fatal error: "+err.Error(), "error")
+	cloudflared.Shutdown()
 }

common/modules.go

@@ -1,117 +0,0 @@
-package common
-
-import "time"
-
-type Message struct {
-	Type      string `json:"type"`
-	Content   string `json:"content"`
-	Sender    string `json:"sender"`
-	Timestamp int64  `json:"timestamp"`
-}
-
-type ClientConfig struct {
-	ClientUUID  string    `json:"client_uuid" gorm:"type:uuid;primaryKey;foreignKey:ClientUUID;references:UUID;constraint:OnDelete:CASCADE"`
-	CPU         bool      `json:"cpu" gorm:"default:true"`
-	GPU         bool      `json:"gpu" gorm:"default:true"`
-	RAM         bool      `json:"ram" gorm:"default:true"`
-	SWAP        bool      `json:"swap" gorm:"default:true"`
-	LOAD        bool      `json:"load" gorm:"default:true"`
-	UPTIME      bool      `json:"uptime" gorm:"default:true"`
-	TEMP        bool      `json:"temp" gorm:"default:true"`
-	OS          bool      `json:"os" gorm:"default:true"`
-	DISK        bool      `json:"disk" gorm:"default:true"`
-	NET         bool      `json:"net" gorm:"default:true"`
-	PROCESS     bool      `json:"process" gorm:"default:true"`
-	Connections bool      `json:"connections" gorm:"default:true"`
-	Interval    int       `json:"interval" gorm:"default:3;check:Interval >= 1"`
-	CreatedAt   time.Time `json:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at"`
-}
-
-// ClientInfo stores static client information
-// Deprecated: Use models.Client instead.
-type ClientInfo struct {
-	UUID           string    `json:"uuid,omitempty" gorm:"type:varchar(36);primaryKey;foreignKey:ClientUUID;references:UUID;constraint:OnDelete:CASCADE"`
-	Name           string    `json:"name" gorm:"type:varchar(100);not null"`
-	CpuName        string    `json:"cpu_name" gorm:"type:varchar(100)"`
-	Virtualization string    `json:"virtualization" gorm:"type:varchar(50)"`
-	Arch           string    `json:"arch" gorm:"type:varchar(50)"`
-	CpuCores       int       `json:"cpu_cores" gorm:"type:int"`
-	OS             string    `json:"os" gorm:"type:varchar(100)"`
-	GpuName        string    `json:"gpu_name" gorm:"type:varchar(100)"`
-	IPv4           string    `json:"ipv4,omitempty" gorm:"type:varchar(100)"`
-	IPv6           string    `json:"ipv6,omitempty" gorm:"type:varchar(100)"`
-	Region         string    `json:"region" gorm:"type:varchar(100)"`
-	Remark         string    `json:"remark,omitempty" gorm:"type:longtext"`
-	PublicRemark   string    `json:"public_remark,omitempty" gorm:"type:longtext"`
-	MemTotal       int64     `json:"mem_total" gorm:"type:bigint"`
-	SwapTotal      int64     `json:"swap_total" gorm:"type:bigint"`
-	DiskTotal      int64     `json:"disk_total" gorm:"type:bigint"`
-	Version        string    `json:"version,omitempty" gorm:"type:varchar(100)"`
-	Weight         int       `json:"weight" gorm:"type:int"`
-	Price          float64   `json:"price"`
-	BillingCycle   int       `json:"billing_cycle"`
-	ExpiredAt      time.Time `json:"expired_at" gorm:"type:timestamp"`
-	CreatedAt      time.Time
-	UpdatedAt      time.Time
-}
-
-type IPAddress struct {
-	Ipv4 string `json:"ipv4"`
-	Ipv6 string `json:"ipv6"`
-}
-type Report struct {
-	UUID        string            `json:"uuid,omitempty"`
-	CPU         CPUReport         `json:"cpu"`
-	Ram         RamReport         `json:"ram"`
-	Swap        RamReport         `json:"swap"`
-	Load        LoadReport        `json:"load"`
-	Disk        DiskReport        `json:"disk"`
-	Network     NetworkReport     `json:"network"`
-	Connections ConnectionsReport `json:"connections"`
-	Uptime      int64             `json:"uptime"`
-	Process     int               `json:"process"`
-	Message     string            `json:"message"`
-	Method      string            `json:"method,omitempty"`
-	UpdatedAt   time.Time         `json:"updated_at"`
-}
-
-type CPUReport struct {
-	Name  string  `json:"name,omitempty"`
-	Cores int     `json:"cores,omitempty"`
-	Arch  string  `json:"arch,omitempty"`
-	Usage float64 `json:"usage,omitempty"`
-}
-
-type GPUReport struct {
-	Name  string  `json:"name,omitempty"`
-	Usage float64 `json:"usage,omitempty"`
-}
-
-type RamReport struct {
-	Total int64 `json:"total"`
-	Used  int64 `json:"used"`
-}
-
-type LoadReport struct {
-	Load1  float64 `json:"load1"`
-	Load5  float64 `json:"load5"`
-	Load15 float64 `json:"load15"`
-}
-
-type DiskReport struct {
-	Total int64 `json:"total"`
-	Used  int64 `json:"used"`
-}
-
-type NetworkReport struct {
-	Up        int64 `json:"up"`
-	Down      int64 `json:"down"`
-	TotalUp   int64 `json:"totalUp"`
-	TotalDown int64 `json:"totalDown"`
-}
-
-type ConnectionsReport struct {
-	TCP int `json:"tcp"`
-	UDP int `json:"udp"`
-}

database/accounts/accounts.go

@@ -100,8 +100,8 @@ func CreateDefaultAdminAccount() (username, passwd string, err error) {
 		Username:  username,
 		Passwd:    hashedPassword,
 		SSOID:     "",
-		CreatedAt: time.Now(),
-		UpdatedAt: time.Now(),
+		CreatedAt: models.FromTime(time.Now()),
+		UpdatedAt: models.FromTime(time.Now()),
 	}
 
 	err = db.Create(&user).Error

database/accounts/sessions.go

@@ -2,11 +2,17 @@ package accounts
 
 import (
 	"errors"
+	"fmt"
+	"net"
 	"time"
 
 	"github.com/komari-monitor/komari/database/dbcore"
 	"github.com/komari-monitor/komari/database/models"
+	messageevent "github.com/komari-monitor/komari/database/models/messageEvent"
+	"github.com/komari-monitor/komari/pkg/config"
 	"github.com/komari-monitor/komari/utils"
+	"github.com/komari-monitor/komari/utils/geoip"
+	"github.com/komari-monitor/komari/utils/messageSender"
 )
 
 // GetAllSessions 获取所有会话
@@ -27,12 +33,29 @@ func CreateSession(uuid string, expires int, userAgent, ip, login_method string)
 	sessionRecord := models.Session{
 		UUID:         uuid,
 		Session:      session,
-		Expires:      time.Now().Add(time.Duration(expires) * time.Second),
+		Expires:      models.FromTime(time.Now().Add(time.Duration(expires) * time.Second)),
 		UserAgent:    userAgent,
 		Ip:           ip,
 		LoginMethod:  login_method,
-		LatestOnline: time.Now(),
+		LatestOnline: models.FromTime(time.Now()),
 	}
+	go func() {
+		LoginNotification, _ := config.GetAs[bool](config.LoginNotificationKey, false)
+		if LoginNotification {
+			ipAddr := net.ParseIP(ip)
+			ipinfo, _ := geoip.GetGeoInfo(ipAddr)
+			loc := "unknown"
+			if ipinfo != nil && ipinfo.Name != "" {
+				loc = ipinfo.Name
+			}
+			messageSender.SendEvent(models.EventMessage{
+				Event:   messageevent.Login,
+				Time:    time.Now(),
+				Message: fmt.Sprintf("%s: %s (%s)\n%s", login_method, ip, loc, userAgent),
+				Emoji:   "🔑",
+			})
+		}
+	}()
 
 	err := db.Create(&sessionRecord).Error
 	if err != nil {
@@ -50,7 +73,7 @@ func GetSession(session string) (uuid string, err error) {
 		return "", err
 	}
 
-	if time.Now().After(sessionRecord.Expires) {
+	if time.Now().After(sessionRecord.Expires.ToTime()) {
 		// 会话已过期，删除它
 		_ = DeleteSession(session)
 		return "", errors.New("session expired")
@@ -110,3 +133,12 @@ func UpdateLatest(session, useragent, ip string) error {
 		"latest_ip":         ip,
 	}).Error
 }
+
+func RemoveExpiredSessions() error {
+	db := dbcore.GetDBInstance()
+	result := db.Where("expires < ?", time.Now()).Delete(&models.Session{})
+	if result.Error != nil {
+		return result.Error
+	}
+	return nil
+}

database/auditlog/log.go

@@ -1,4 +1,4 @@
-package logOperation
+package auditlog
 
 import (
 	"log"
@@ -16,11 +16,15 @@ func Log(ip, uuid, message, msgType string) {
 		UUID:    uuid,
 		Message: message,
 		MsgType: msgType,
-		Time:    now,
+		Time:    models.FromTime(now),
 	}
 	db.Create(logEntry)
 }
 
+func EventLog(eventType, message string) {
+	Log("", "", message, eventType)
+}
+
 // Delete logs older than 30 days
 func RemoveOldLogs() {
 	db := dbcore.GetDBInstance()

database/clients/client.go

@@ -1,29 +1,21 @@
 package clients
 
 import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"math"
 	"time"
 
-	"github.com/komari-monitor/komari/common"
 	"github.com/komari-monitor/komari/database/dbcore"
 	"github.com/komari-monitor/komari/database/models"
+	"github.com/komari-monitor/komari/database/tasks"
 	"github.com/komari-monitor/komari/utils"
 	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-
-	"fmt"
 
 	"github.com/google/uuid"
 )
 
-// Deprecated: DeleteClientConfig is deprecated and will be removed in a future release. Use DeleteClient instead.
-func DeleteClientConfig(clientUuid string) error {
-	db := dbcore.GetDBInstance()
-	err := db.Delete(&common.ClientConfig{ClientUUID: clientUuid}).Error
-	if err != nil {
-		return err
-	}
-	return nil
-}
 func DeleteClient(clientUuid string) error {
 	db := dbcore.GetDBInstance()
 	err := db.Delete(&models.Client{}, "uuid = ?", clientUuid).Error
@@ -33,79 +25,6 @@ func DeleteClient(clientUuid string) error {
 	return nil
 }
 
-// Deprecated: UpdateOrInsertBasicInfo is deprecated and will be removed in a future release. Use SaveClientInfo instead.
-func UpdateOrInsertBasicInfo(cbi common.ClientInfo) error {
-	db := dbcore.GetDBInstance()
-	updates := make(map[string]interface{})
-
-	if cbi.Name != "" {
-		updates["name"] = cbi.Name
-	}
-	if cbi.CpuName != "" {
-		updates["cpu_name"] = cbi.CpuName
-	}
-	if cbi.Arch != "" {
-		updates["arch"] = cbi.Arch
-	}
-	if cbi.CpuCores != 0 {
-		updates["cpu_cores"] = cbi.CpuCores
-	}
-	if cbi.OS != "" {
-		updates["os"] = cbi.OS
-	}
-	if cbi.GpuName != "" {
-		updates["gpu_name"] = cbi.GpuName
-	}
-	if cbi.IPv4 != "" {
-		updates["ipv4"] = cbi.IPv4
-	}
-	if cbi.IPv6 != "" {
-		updates["ipv6"] = cbi.IPv6
-	}
-	if cbi.Region != "" {
-		updates["region"] = cbi.Region
-	}
-	if cbi.Remark != "" {
-		updates["remark"] = cbi.Remark
-	}
-	updates["mem_total"] = cbi.MemTotal
-	updates["swap_total"] = cbi.SwapTotal
-	updates["disk_total"] = cbi.DiskTotal
-	updates["version"] = cbi.Version
-	updates["updated_at"] = time.Now()
-
-	// 转换为更新Client表
-	client := models.Client{
-		UUID: cbi.UUID,
-	}
-
-	err := db.Model(&client).Clauses(clause.OnConflict{
-		Columns:   []clause.Column{{Name: "uuid"}},
-		DoUpdates: clause.Assignments(updates),
-	}).Create(map[string]interface{}{
-		"uuid":       cbi.UUID,
-		"name":       cbi.Name,
-		"cpu_name":   cbi.CpuName,
-		"arch":       cbi.Arch,
-		"cpu_cores":  cbi.CpuCores,
-		"os":         cbi.OS,
-		"gpu_name":   cbi.GpuName,
-		"ipv4":       cbi.IPv4,
-		"ipv6":       cbi.IPv6,
-		"region":     cbi.Region,
-		"remark":     cbi.Remark,
-		"mem_total":  cbi.MemTotal,
-		"swap_total": cbi.SwapTotal,
-		"disk_total": cbi.DiskTotal,
-		"version":    cbi.Version,
-		"updated_at": time.Now(),
-	}).Error
-
-	if err != nil {
-		return err
-	}
-	return nil
-}
 func SaveClientInfo(update map[string]interface{}) error {
 	db := dbcore.GetDBInstance()
 	clientUUID, ok := update["uuid"].(string)
@@ -120,17 +39,83 @@ func SaveClientInfo(update map[string]interface{}) error {
 
 	update["updated_at"] = time.Now()
 
-	err := db.Model(&models.Client{}).Where("uuid = ?", clientUUID).Updates(update).Error
-	if err != nil {
+	toFloat64 := func(value interface{}) (float64, bool) {
+		switch typed := value.(type) {
+		case float64:
+			return typed, true
+		case float32:
+			return float64(typed), true
+		case int:
+			return float64(typed), true
+		case int8:
+			return float64(typed), true
+		case int16:
+			return float64(typed), true
+		case int32:
+			return float64(typed), true
+		case int64:
+			return float64(typed), true
+		case uint:
+			return float64(typed), true
+		case uint8:
+			return float64(typed), true
+		case uint16:
+			return float64(typed), true
+		case uint32:
+			return float64(typed), true
+		case uint64:
+			return float64(typed), true
+		case json.Number:
+			parsed, err := typed.Float64()
+			if err != nil {
+				return 0, false
+			}
+			return parsed, true
+		default:
+			return 0, false
+		}
+	}
+
+	checkOptionalInt := func(name, key string, maxValue float64) error {
+		value, exists := update[key]
+		if !exists || value == nil {
+			return nil
+		}
+
+		numericValue, ok := toFloat64(value)
+		if !ok {
+			return fmt.Errorf("%s must be a valid number", name)
+		}
+		if numericValue < 0 || numericValue > maxValue {
+			return fmt.Errorf("%s must be a valid non-negative number: %v", name, value)
+		}
+		return nil
+	}
+
+	verify := func(update map[string]interface{}) error {
+		if err := checkOptionalInt("Cpu.Cores", "cpu_cores", math.MaxInt-1); err != nil {
+			return err
+		}
+		if err := checkOptionalInt("Cpu.PhysicalCores", "cpu_physical_cores", math.MaxInt-1); err != nil {
+			return err
+		}
+		if err := checkOptionalInt("Ram.Total", "mem_total", math.MaxInt64-1); err != nil {
+			return err
+		}
+		if err := checkOptionalInt("Swap.Total", "swap_total", math.MaxInt64-1); err != nil {
+			return err
+		}
+		if err := checkOptionalInt("Disk.Total", "disk_total", math.MaxInt64-1); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	if err := verify(update); err != nil {
 		return err
 	}
-	return nil
-}
 
-// 更新客户端设置
-func UpdateClientConfig(config common.ClientConfig) error {
-	db := dbcore.GetDBInstance()
-	err := db.Save(&config).Error
+	err := db.Model(&models.Client{}).Where("uuid = ?", clientUUID).Updates(update).Error
 	if err != nil {
 		return err
 	}
@@ -146,21 +131,6 @@ func EditClientName(clientUUID, clientName string) error {
 	return nil
 }
 
-/*
-// UpdateClientByUUID 更新指定 UUID 的客户端配置
-
-	func UpdateClientByUUID(config common.ClientConfig) error {
-		db := dbcore.GetDBInstance()
-		result := db.Model(&common.ClientConfig{}).Where("client_uuid = ?", config.ClientUUID).Updates(config)
-		if result.Error != nil {
-			return result.Error
-		}
-		if result.RowsAffected == 0 {
-			return gorm.ErrRecordNotFound
-		}
-		return nil
-	}
-*/
 func EditClientToken(clientUUID, token string) error {
 	db := dbcore.GetDBInstance()
 	err := db.Model(&models.Client{}).Where("uuid = ?", clientUUID).Update("token", token).Error
@@ -180,14 +150,17 @@ func CreateClient() (clientUUID, token string, err error) {
 		UUID:      clientUUID,
 		Token:     token,
 		Name:      "client_" + clientUUID[0:8],
-		CreatedAt: time.Now(),
-		UpdatedAt: time.Now(),
+		CreatedAt: models.FromTime(time.Now()),
+		UpdatedAt: models.FromTime(time.Now()),
 	}
 
 	err = db.Create(&client).Error
 	if err != nil {
 		return "", "", err
 	}
+	if err := tasks.AddDefaultOnClientUUID(clientUUID); err != nil {
+		log.Println("Failed to apply default-on ping tasks to new client:", err)
+	}
 	return clientUUID, token, nil
 }
 
@@ -202,14 +175,17 @@ func CreateClientWithName(name string) (clientUUID, token string, err error) {
 		UUID:      clientUUID,
 		Token:     token,
 		Name:      name,
-		CreatedAt: time.Now(),
-		UpdatedAt: time.Now(),
+		CreatedAt: models.FromTime(time.Now()),
+		UpdatedAt: models.FromTime(time.Now()),
 	}
 
 	err = db.Create(&client).Error
 	if err != nil {
 		return "", "", err
 	}
+	if err := tasks.AddDefaultOnClientUUID(clientUUID); err != nil {
+		log.Println("Failed to apply default-on ping tasks to new client:", err)
+	}
 	return clientUUID, token, nil
 }
 
@@ -278,6 +254,14 @@ func SaveClient(updates map[string]interface{}) error {
 		return fmt.Errorf("no fields to update")
 	}
 
+	if v, exists := updates["traffic_limit"]; exists {
+		if val, ok := v.(float64); ok {
+			if val < 0 || val > math.MaxInt64-1 {
+				return fmt.Errorf("traffic_limit must be a valid non-negative int64 value, got %v", val)
+			}
+		}
+	}
+
 	updates["updated_at"] = time.Now()
 
 	err := db.Model(&models.Client{}).Where("uuid = ?", clientUUID).Updates(updates).Error

database/clients/report.go

@@ -2,16 +2,48 @@ package clients
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
+	"math"
+	"sync"
 	"time"
 
-	"github.com/komari-monitor/komari/common"
 	"github.com/komari-monitor/komari/database/dbcore"
 	"github.com/komari-monitor/komari/database/models"
+	v1 "github.com/komari-monitor/komari/protocol/v1"
+	"github.com/komari-monitor/komari/utils"
 
 	"gorm.io/gorm"
 )
 
+var reportSaveLocks sync.Map
+
+func getReportSaveLock(clientUUID string) *sync.Mutex {
+	lock, _ := reportSaveLocks.LoadOrStore(clientUUID, &sync.Mutex{})
+	return lock.(*sync.Mutex)
+}
+
+func getLatestTrafficRecord(tx *gorm.DB, clientUUID string) (*models.Record, error) {
+	var record models.Record
+	err := tx.Where("client = ?", clientUUID).Order("time DESC").First(&record).Error
+	if err == nil {
+		return &record, nil
+	}
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+
+	err = tx.Table("records_long_term").Where("client = ?", clientUUID).Order("time DESC").First(&record).Error
+	if err == nil {
+		return &record, nil
+	}
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
 // Report 表示客户端报告数据
 // SaveReport 保存报告数据
 func SaveReport(uuid string, data map[string]interface{}) (err error) {
@@ -39,27 +71,144 @@ func GetClientUUIDByToken(token string) (clientUUID string, err error) {
 	return client.UUID, nil
 }
 
-func ParseReport(data map[string]interface{}) (report common.Report, err error) {
+func ParseReport(data map[string]interface{}) (report v1.Report, err error) {
 	jsonData, err := json.Marshal(data)
 	if err != nil {
-		return common.Report{}, err
+		return v1.Report{}, err
 	}
 	err = json.Unmarshal(jsonData, &report)
 	if err != nil {
-		return common.Report{}, err
+		return v1.Report{}, err
 	}
 	return report, nil
 }
 
+// 检查数据防止异常数据导致数据库损坏
+func ReportVerify(report v1.Report) error {
+	// 防止输入不合理范围
+	if report.CPU.Usage < 0 || report.CPU.Usage > 100 {
+		return fmt.Errorf("CPU.Usage must be between 0 and 100")
+	}
+
+	if report.Load.Load1 < 0 || report.Load.Load1 > 1000 {
+		return fmt.Errorf("Load.Load1 must be non-negative, got %.2f", report.Load.Load1)
+	}
+
+	checkFloat64 := func(name string, val float64) error {
+		if val > math.MaxFloat64-1 || val < -math.MaxFloat64+1 {
+			return fmt.Errorf("%s value exceeds float64 range: %g", name, val)
+		}
+		return nil
+	}
+
+	// [float64] 防止数据溢出
+	if err := checkFloat64("CPU.Usage", report.CPU.Usage); err != nil {
+		return err
+	}
+	if err := checkFloat64("Load.Load1", report.Load.Load1); err != nil {
+		return err
+	}
+
+	checkInt64 := func(name string, val int64) error {
+		if val < 0 {
+			return fmt.Errorf("%s must be non-negative, got %d", name, val)
+		}
+		if val > math.MaxInt64-1 {
+			return fmt.Errorf("%s exceeds int64 max limit: %d", name, val)
+		}
+		return nil
+	}
+
+	// [int64] 防止数据溢出
+	// Ram 验证
+	if err := checkInt64("Ram.Used", report.Ram.Used); err != nil {
+		return err
+	}
+	if err := checkInt64("Ram.Total", report.Ram.Total); err != nil {
+		return err
+	}
+	// Swap 验证
+	if err := checkInt64("Swap.Used", report.Swap.Used); err != nil {
+		return err
+	}
+	if err := checkInt64("Swap.Total", report.Swap.Total); err != nil {
+		return err
+	}
+	// Disk 验证
+	if err := checkInt64("Disk.Used", report.Disk.Used); err != nil {
+		return err
+	}
+	if err := checkInt64("Disk.Total", report.Disk.Total); err != nil {
+		return err
+	}
+	// Network 验证
+	if err := checkInt64("Network.Up", report.Network.Up); err != nil {
+		return err
+	}
+	if err := checkInt64("Network.Down", report.Network.Down); err != nil {
+		return err
+	}
+	if err := checkInt64("Network.TotalUp", report.Network.TotalUp); err != nil {
+		return err
+	}
+	if err := checkInt64("Network.TotalDown", report.Network.TotalDown); err != nil {
+		return err
+	}
+	// 拒绝所有负数Int
+	if report.Process < 0 {
+		return fmt.Errorf("Process must be non-negative: %d", report.Process)
+	}
+	if report.Connections.TCP < 0 {
+		return fmt.Errorf("Connections.TCP must be non-negative: %d", report.Connections.TCP)
+	}
+	if report.Connections.UDP < 0 {
+		return fmt.Errorf("Connections.UDP must be non-negative: %d", report.Connections.UDP)
+	}
+	return nil
+}
+
 // SaveClientReport 保存客户端报告到 Record 表
-func SaveClientReport(clientUUID string, report common.Report) (err error) {
+func SaveClientReport(clientUUID string, report v1.Report) (err error) {
 	db := dbcore.GetDBInstance()
+	lock := getReportSaveLock(clientUUID)
+	lock.Lock()
+	defer lock.Unlock()
+
+	if err := ReportVerify(report); err != nil {
+		return fmt.Errorf("failed to save Record: %w", err)
+	}
+
+	// 保存GPU详细记录到独立表
+	currentTime := time.Now()
+	if report.GPU != nil && len(report.GPU.DetailedInfo) > 0 {
+		for idx, gpu := range report.GPU.DetailedInfo {
+			gpuRecord := models.GPURecord{
+				Client:      clientUUID,
+				Time:        models.FromTime(currentTime),
+				DeviceIndex: idx,
+				DeviceName:  gpu.Name,
+				MemTotal:    gpu.MemoryTotal,
+				MemUsed:     gpu.MemoryUsed,
+				Utilization: float32(gpu.Utilization),
+				Temperature: gpu.Temperature,
+			}
+			if err := db.Create(&gpuRecord).Error; err != nil {
+				return fmt.Errorf("failed to save GPU record: %w", err)
+			}
+		}
+	}
+
+	// 计算平均GPU使用率，用于向后兼容
+	averageGPUUsage := float32(0)
+	if report.GPU != nil && len(report.GPU.DetailedInfo) > 0 {
+		averageGPUUsage = float32(report.GPU.AverageUsage)
+	}
 
 	Record := models.Record{
 		Client:         clientUUID,
-		Time:           time.Now(),
+		Time:           models.FromTime(currentTime),
 		Cpu:            float32(report.CPU.Usage),
-		Gpu:            0, // Report 未提供 GPU Usage，设为 0（与原 nil 行为类似）
+		Gpu:            averageGPUUsage, // 使用平均GPU使用率
 		Ram:            report.Ram.Used,
 		RamTotal:       report.Ram.Total,
 		Swap:           report.Swap.Used,
@@ -72,16 +221,28 @@ func SaveClientReport(clientUUID string, report common.Report) (err error) {
 		NetOut:         report.Network.Up,
 		NetTotalUp:     report.Network.TotalUp,
 		NetTotalDown:   report.Network.TotalDown,
+		TrafficUp:      0,
+		TrafficDown:    0,
 		Process:        report.Process,
 		Connections:    report.Connections.TCP,
 		ConnectionsUdp: report.Connections.UDP,
+		//Uptime:         report.Uptime,
 	}
 
 	// 使用事务确保 Record 和 ClientsInfo 一致性
 	err = db.Transaction(func(tx *gorm.DB) error {
+		previous, err := getLatestTrafficRecord(tx, clientUUID)
+		if err != nil {
+			return fmt.Errorf("failed to load previous Record: %w", err)
+		}
+		if previous != nil {
+			Record.TrafficUp = utils.ComputeTrafficDelta(report.Network.TotalUp, previous.NetTotalUp)
+			Record.TrafficDown = utils.ComputeTrafficDelta(report.Network.TotalDown, previous.NetTotalDown)
+		}
+
 		// 保存 Record
 		if err := tx.Create(&Record).Error; err != nil {
-			return fmt.Errorf("failed to save Record: %v", err)
+			return fmt.Errorf("failed to save Record: %w", err)
 		}
 		return nil
 	})

database/clients/report_test.go

@@ -0,0 +1,83 @@
+package clients
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/komari-monitor/komari/utils"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestComputeTrafficDeltaHandlesZeroAndReset(t *testing.T) {
+	tests := []struct {
+		name     string
+		current  int64
+		previous int64
+		want     int64
+	}{
+		{name: "previous zero counts current delta", current: 120, previous: 0, want: 120},
+		{name: "monotonic counter uses difference", current: 250, previous: 200, want: 50},
+		{name: "counter reset uses current", current: 15, previous: 250, want: 15},
+		{name: "negative previous remains guarded", current: 15, previous: -1, want: 0},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.want, utils.ComputeTrafficDelta(test.current, test.previous))
+		})
+	}
+}
+
+func TestReportSaveLockSerializesSameClient(t *testing.T) {
+	clientUUID := "client-lock-same"
+	lock := getReportSaveLock(clientUUID)
+	lock.Lock()
+	defer lock.Unlock()
+
+	acquired := make(chan struct{})
+	go func() {
+		secondLock := getReportSaveLock(clientUUID)
+		secondLock.Lock()
+		defer secondLock.Unlock()
+		close(acquired)
+	}()
+
+	select {
+	case <-acquired:
+		t.Fatal("same-client report save lock was acquired while already held")
+	case <-time.After(20 * time.Millisecond):
+	}
+
+	lock.Unlock()
+	select {
+	case <-acquired:
+	case <-time.After(time.Second):
+		t.Fatal("same-client report save lock was not released")
+	}
+	lock.Lock()
+}
+
+func TestReportSaveLockAllowsDifferentClients(t *testing.T) {
+	firstLock := getReportSaveLock("client-lock-a")
+	firstLock.Lock()
+	defer firstLock.Unlock()
+
+	var waitGroup sync.WaitGroup
+	waitGroup.Add(1)
+	acquired := make(chan struct{})
+	go func() {
+		defer waitGroup.Done()
+		secondLock := getReportSaveLock("client-lock-b")
+		secondLock.Lock()
+		defer secondLock.Unlock()
+		close(acquired)
+	}()
+
+	select {
+	case <-acquired:
+	case <-time.After(time.Second):
+		t.Fatal("different-client report save lock should not block")
+	}
+	waitGroup.Wait()
+}

database/config/config.go

@@ -1,102 +0,0 @@
-package config
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	"github.com/komari-monitor/komari/database/dbcore"
-	"github.com/komari-monitor/komari/database/models"
-	"gorm.io/gorm"
-)
-
-func Get() (models.Config, error) {
-	db := dbcore.GetDBInstance()
-	var config models.Config
-	if err := db.First(&config).Error; err != nil {
-		if err == gorm.ErrRecordNotFound {
-			config = models.Config{
-				ID:            1,
-				Sitename:      "Komari",
-				Description:   "Komari Monitor, a simple server monitoring tool.",
-				AllowCors:     false,
-				OAuthEnabled:  false,
-				GeoIpEnabled:  true,
-				GeoIpProvider: "mmdb",
-				UpdatedAt:     time.Now(),
-				CreatedAt:     time.Now(),
-			}
-			if err := db.Create(&config).Error; err != nil {
-				log.Fatal("Failed to create default config:", err)
-			}
-			return config, nil
-		}
-		return config, err
-	}
-	return config, nil
-}
-
-func Save(cst models.Config) error {
-	db := dbcore.GetDBInstance()
-	oldConfig, _ := Get()
-	// Only one records
-	cst.ID = 1
-	cst.UpdatedAt = time.Now()
-	// Do not update CreatedAt
-	if err := db.Model(&models.Config{}).Where("id = ?", cst.ID).
-		Select("sitename",
-			"description",
-			"allow_cors",
-			"geo_ip_enabled",
-			"geo_ip_provider",
-			"o_auth_client_id",
-			"o_auth_client_secret",
-			"o_auth_enabled",
-			"custom_head",
-			"updated_at").
-		Updates(cst).Error; err != nil {
-		return err
-	}
-	newConfig, _ := Get()
-	publishEvent(oldConfig, newConfig)
-	return nil
-}
-
-func Update(cst map[string]interface{}) error {
-	db := dbcore.GetDBInstance()
-	oldConfig, _ := Get()
-	// Proceed with update
-	cst["id"] = 1
-	cst["updated_at"] = time.Now()
-	delete(cst, "created_at")
-	delete(cst, "CreatedAt")
-
-	// 至少有一种登录方式启用
-	newDisablePasswordLogin := oldConfig.DisablePasswordLogin
-	newOAuthEnabled := oldConfig.OAuthEnabled
-	if val, exists := cst["disable_password_login"]; exists {
-		newDisablePasswordLogin = val.(bool)
-	}
-	if val, exists := cst["o_auth_enabled"]; exists {
-		newOAuthEnabled = val.(bool)
-	}
-	if newDisablePasswordLogin && !newOAuthEnabled {
-		return errors.New("at least one login method must be enabled (password/oauth)")
-	}
-
-	err := db.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Model(&models.Config{}).Where("id = ?", oldConfig.ID).Updates(cst).Error; err != nil {
-			return errors.Join(err, errors.New("failed to update configuration"))
-		}
-		newConfig := &models.Config{}
-		if err := tx.Where("id = ?", oldConfig.ID).First(newConfig).Error; err != nil {
-			return errors.Join(err, errors.New("failed to retrieve updated configuration"))
-		}
-		publishEvent(oldConfig, *newConfig)
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-	return nil
-}

database/config/events.go

@@ -1,38 +0,0 @@
-package config
-
-import (
-	"sync"
-
-	"github.com/komari-monitor/komari/database/models"
-)
-
-// ConfigEvent represents a configuration change event
-type ConfigEvent struct {
-	Old models.Config
-	New models.Config
-}
-
-// ConfigSubscriber handles config events
-type ConfigSubscriber func(event ConfigEvent)
-
-var (
-	subscribersMu sync.RWMutex
-	subscribers   []ConfigSubscriber
-)
-
-// Subscribe registers a subscriber for all config events.
-func Subscribe(subscriber ConfigSubscriber) {
-	subscribersMu.Lock()
-	defer subscribersMu.Unlock()
-	subscribers = append(subscribers, subscriber)
-}
-
-// publishEvent notifies all subscribers of a config change.
-func publishEvent(oldVal, newVal models.Config) {
-	subscribersMu.RLock()
-	defer subscribersMu.RUnlock()
-	event := ConfigEvent{Old: oldVal, New: newVal}
-	for _, sub := range subscribers {
-		go sub(event)
-	}
-}

database/dbcore/dbcore.go

@@ -1,80 +1,168 @@
 package dbcore
 
 import (
+	"archive/zip"
 	"fmt"
+	"io"
 	"log"
+	"os"
+	"path/filepath"
+	"strings"
 	"sync"
+	"time"
 
 	"github.com/komari-monitor/komari/cmd/flags"
-	"github.com/komari-monitor/komari/common"
 	"github.com/komari-monitor/komari/database/models"
-	"github.com/komari-monitor/komari/utils"
-	"gorm.io/driver/mysql"
+	"github.com/komari-monitor/komari/pkg/config"
+	"github.com/komari-monitor/komari/pkg/migrations"
+	logutil "github.com/komari-monitor/komari/utils/log"
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
 )
 
-// mergeClientInfo 将旧版ClientInfo数据迁移到新版Client表
-func mergeClientInfo(db *gorm.DB) {
-	var clientInfos []common.ClientInfo
-	if err := db.Find(&clientInfos).Error; err != nil {
-		log.Printf("Failed to read ClientInfo table: %v", err)
-		return
+// zipDirectoryExcluding 将 srcDir 打包为 dstZip，exclude 是绝对路径集合需要排除
+func zipDirectoryExcluding(srcDir, dstZip string, exclude map[string]struct{}) error {
+	// 规范化排除路径为绝对路径
+	normExclude := make(map[string]struct{}, len(exclude))
+	for p := range exclude {
+		abs, _ := filepath.Abs(p)
+		normExclude[abs] = struct{}{}
 	}
 
-	for _, info := range clientInfos {
-		var client models.Client
-		if err := db.Where("uuid = ?", info.UUID).First(&client).Error; err != nil {
-			log.Printf("Could not find Client record with UUID %s: %v", info.UUID, err)
-			continue
+	out, err := os.Create(dstZip)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	zw := zip.NewWriter(out)
+	defer zw.Close()
+
+	absSrc, _ := filepath.Abs(srcDir)
+	walkErr := filepath.Walk(absSrc, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
 		}
-
-		// 更新Client记录
-		client.Name = info.Name
-		client.CpuName = info.CpuName
-		client.Virtualization = info.Virtualization
-		client.Arch = info.Arch
-		client.CpuCores = info.CpuCores
-		client.OS = info.OS
-		client.GpuName = info.GpuName
-		client.IPv4 = info.IPv4
-		client.IPv6 = info.IPv6
-		client.Region = info.Region
-		client.Remark = info.Remark
-		client.PublicRemark = info.PublicRemark
-		client.MemTotal = info.MemTotal
-		client.SwapTotal = info.SwapTotal
-		client.DiskTotal = info.DiskTotal
-		client.Version = info.Version
-		client.Weight = info.Weight
-		client.Price = info.Price
-		client.BillingCycle = info.BillingCycle
-		client.ExpiredAt = info.ExpiredAt
-		// Save updated Client record
-		if err := db.Save(&client).Error; err != nil {
-			log.Printf("Failed to update Client record: %v", err)
-			continue
+		// 排除 backup.zip 本身
+		if _, ok := normExclude[path]; ok {
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
 		}
-	}
+		// 计算 zip 内相对路径
+		rel, err := filepath.Rel(absSrc, path)
+		if err != nil {
+			return err
+		}
+		// 根目录跳过
+		if rel == "." {
+			return nil
+		}
+		// 替换为正斜杠
+		zipName := filepath.ToSlash(rel)
 
-	// Backup and rename old table after migration
-	if err := db.Migrator().RenameTable("client_infos", "client_infos_backup"); err != nil {
-		log.Printf("Failed to backup ClientInfo table: %v", err)
-		return
+		if info.IsDir() {
+			_, err := zw.Create(zipName + "/")
+			return err
+		}
+		// 普通文件
+		fh, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		w, err := zw.Create(zipName)
+		if err != nil {
+			fh.Close()
+			return err
+		}
+		if _, err := io.Copy(w, fh); err != nil {
+			fh.Close()
+			return err
+		}
+		fh.Close()
+		return nil
+	})
+	if walkErr != nil {
+		return walkErr
 	}
-	log.Println("Data migration completed, old table has been backed up as client_infos_backup")
+	return zw.Close()
 }
 
-func MergeDatabase(db *gorm.DB) {
-	if db.Migrator().HasTable("client_infos") {
-		log.Println("[>0.0.5] Legacy ClientInfo table detected, starting data migration...")
-		mergeClientInfo(db)
+// removeAllInDirExcept 删除 dir 下除 exclude 指定绝对路径外的所有文件和文件夹
+func removeAllInDirExcept(dir string, exclude map[string]struct{}) error {
+	absDir, err := filepath.Abs(dir)
+	if err != nil {
+		return err
 	}
-	if db.Migrator().HasColumn(&models.Config{}, "allow_cros") {
-		log.Println("[>0.0.5a] Renaming column 'allow_cros' to 'allow_cors' in config table...")
-		db.Migrator().RenameColumn(&models.Config{}, "allow_cros", "allow_cors")
+	normExclude := make(map[string]struct{}, len(exclude))
+	for p := range exclude {
+		abs, _ := filepath.Abs(p)
+		normExclude[abs] = struct{}{}
 	}
+	entries, err := os.ReadDir(absDir)
+	if err != nil {
+		return err
+	}
+	for _, e := range entries {
+		full := filepath.Join(absDir, e.Name())
+		if _, ok := normExclude[full]; ok {
+			continue
+		}
+		if err := os.RemoveAll(full); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// unzipToDir 将 zipPath 解压到 dstDir，包含路径遍历保护
+func unzipToDir(zipPath, dstDir string) error {
+	zr, err := zip.OpenReader(zipPath)
+	if err != nil {
+		return err
+	}
+	defer zr.Close()
+
+	if err := os.MkdirAll(dstDir, 0755); err != nil {
+		return err
+	}
+	absDst, _ := filepath.Abs(dstDir)
+
+	for _, f := range zr.File {
+		// 构造目标路径并做路径遍历保护
+		cleanName := filepath.Clean(f.Name)
+		targetPath := filepath.Join(absDst, cleanName)
+		if !strings.HasPrefix(targetPath, absDst+string(os.PathSeparator)) && targetPath != absDst {
+			return fmt.Errorf("illegal file path in zip: %s", f.Name)
+		}
+		if f.FileInfo().IsDir() {
+			if err := os.MkdirAll(targetPath, 0755); err != nil {
+				return err
+			}
+			continue
+		}
+		if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
+			return err
+		}
+		rc, err := f.Open()
+		if err != nil {
+			return err
+		}
+		out, err := os.Create(targetPath)
+		if err != nil {
+			rc.Close()
+			return err
+		}
+		if _, err := io.Copy(out, rc); err != nil {
+			out.Close()
+			rc.Close()
+			return err
+		}
+		out.Close()
+		rc.Close()
+	}
+	return nil
 }
 
 var (
@@ -84,58 +172,97 @@ var (
 
 func GetDBInstance() *gorm.DB {
 	once.Do(func() {
+
 		var err error
 
-		logConfig := &gorm.Config{
-			Logger: logger.Default.LogMode(logger.Silent),
-		}
+		// 在数据库初始化前执行：如果存在 ./data/backup.zip，则进行恢复逻辑
+		func() {
+			backupZipPath := filepath.Join(".", "data", "backup.zip")
+			if _, statErr := os.Stat(backupZipPath); statErr == nil {
+				// 4. 把除了 ./data/backup.zip 之外的所有文件压缩到 ./backup/{time}.zip
+				if err := os.MkdirAll("./backup", 0755); err != nil {
+					log.Printf("[restore] failed to create backup dir: %v", err)
+				} else {
+					tsName := time.Now().Format("20060102-150405")
+					bakPath := filepath.Join("./backup", fmt.Sprintf("%s.zip", tsName))
+					if zipErr := zipDirectoryExcluding("./data", bakPath, map[string]struct{}{backupZipPath: {}}); zipErr != nil {
+						log.Printf("[restore] failed to zip current data: %v", zipErr)
+					} else {
+						log.Printf("[restore] current data zipped to %s", bakPath)
+					}
+				}
 
-		if utils.VersionHash == "unknown" {
-			logConfig = &gorm.Config{
-				Logger: logger.Default.LogMode(logger.Info),
+				// 5. 删除除了 ./data/backup.zip 之外的所有文件
+				if delErr := removeAllInDirExcept("./data", map[string]struct{}{backupZipPath: {}}); delErr != nil {
+					log.Printf("[restore] failed to cleanup data dir: %v", delErr)
+				}
+
+				// 6. 解压 ./data/backup.zip 到 ./data
+				if unzipErr := unzipToDir(backupZipPath, "./data"); unzipErr != nil {
+					log.Printf("[restore] failed to unzip backup into data: %v", unzipErr)
+				} else {
+					log.Printf("[restore] backup.zip extracted to ./data")
+				}
+
+				// 7. 删除 ./data/backup.zip
+				if rmErr := os.Remove(backupZipPath); rmErr != nil {
+					log.Printf("[restore] failed to remove backup.zip: %v", rmErr)
+				} else {
+					log.Printf("[restore] backup.zip removed")
+				}
+				// 8. 删除标记
+				if rmErr := os.Remove("./data/komari-backup-markup"); rmErr != nil {
+					log.Printf("[restore] failed to remove komari-backup-markup: %v", rmErr)
+				} else {
+					log.Printf("[restore] komari-backup-markup removed")
+				}
 			}
+		}()
+
+		logConfig := &gorm.Config{
+			Logger: logutil.NewGormLogger(),
 		}
 
 		// 根据数据库类型选择不同的连接方式
-		switch flags.DatabaseType {
-		case "sqlite", "":
+		switch flags.ApplyDatabaseTypeNormalization() {
+		case flags.DatabaseTypeSQLite:
 			// SQLite 连接
 			instance, err = gorm.Open(sqlite.Open(flags.DatabaseFile), logConfig)
 			if err != nil {
 				log.Fatalf("Failed to connect to SQLite3 database: %v", err)
 			}
 			log.Printf("Using SQLite database file: %s", flags.DatabaseFile)
-
-		case "mysql":
-			// MySQL 连接
-			dsn := fmt.Sprintf("%s:%s@tcp(%s:%s)/%s?charset=utf8mb4&collation=utf8mb4_unicode_ci&parseTime=True&loc=Local",
-				flags.DatabaseUser,
-				flags.DatabasePass,
-				flags.DatabaseHost,
-				flags.DatabasePort,
-				flags.DatabaseName)
-			instance, err = gorm.Open(mysql.Open(dsn), logConfig)
-			if err != nil {
-				log.Fatalf("Failed to connect to MySQL database: %v", err)
+			instance.Exec("PRAGMA wal = ON;")
+			if err := instance.Exec("PRAGMA journal_mode = WAL;").Error; err != nil {
+				log.Printf("Failed to enable WAL mode for SQLite: %v", err)
 			}
-			log.Printf("Using MySQL database: %s@%s:%s/%s", flags.DatabaseUser, flags.DatabaseHost, flags.DatabasePort, flags.DatabaseName)
-
+			instance.Exec("PRAGMA synchronous = NORMAL;")
+			instance.Exec("PRAGMA cache_size = -65536;")
+			instance.Exec("PRAGMA temp_store = MEMORY;")
+			instance.Exec("PRAGMA wal_checkpoint(TRUNCATE);")
 		default:
-			log.Fatalf("Unsupported database type: %s", flags.DatabaseType)
+			log.Fatalf("Unsupported database type: %s (supported: %s)", flags.DatabaseType, flags.SupportedDatabaseTypes())
 		}
-		MergeDatabase(instance)
+		if err := migrations.Run(migrations.Context{DB: instance}); err != nil {
+			log.Fatalf("Failed to run startup migrations: %v", err)
+		}
+		config.SetDb(instance)
 		// 自动迁移模型
 		err = instance.AutoMigrate(
 			&models.User{},
 			&models.Client{},
 			&models.Record{},
-			&models.Config{},
+			&models.GPURecord{},
 			&models.Log{},
 			&models.Clipboard{},
 			&models.LoadNotification{},
 			&models.OfflineNotification{},
+			&models.TrafficReportNotification{},
 			&models.PingRecord{},
 			&models.PingTask{},
+			&models.OidcProvider{},
+			&models.MessageSenderProvider{},
+			&models.ThemeConfiguration{},
 		)
 		if err != nil {
 			log.Fatalf("Failed to create tables: %v", err)
@@ -146,6 +273,12 @@ func GetDBInstance() *gorm.DB {
 		if err != nil {
 			log.Printf("Failed to create records_long_term table, it may already exist: %v", err)
 		}
+		err = instance.Table("gpu_records_long_term").AutoMigrate(
+			&models.GPURecord{},
+		)
+		if err != nil {
+			log.Printf("Failed to create gpu_records_long_term table, it may already exist: %v", err)
+		}
 		err = instance.AutoMigrate(
 			&models.Session{},
 		)
@@ -160,6 +293,16 @@ func GetDBInstance() *gorm.DB {
 			log.Printf("Failed to create Task and TaskResult table, it may already exist: %v", err)
 		}
 
+		// Manually create composite indexes
+		if flags.IsSQLite() {
+			instance.Exec("CREATE INDEX IF NOT EXISTS idx_record_client_time ON records(client, time)")
+			instance.Exec("CREATE INDEX IF NOT EXISTS idx_record_lt_client_time ON records_long_term(client, time)")
+			instance.Exec("CREATE INDEX IF NOT EXISTS idx_gpu_record_client_time ON gpu_records(client, time)")
+			instance.Exec("CREATE INDEX IF NOT EXISTS idx_gpu_record_lt_client_time ON gpu_records_long_term(client, time)")
+			instance.Exec("CREATE INDEX IF NOT EXISTS idx_ping_record_client_time ON ping_records(client, time)")
+		}
+
 	})
+
 	return instance
 }

database/messageSender.go

@@ -0,0 +1,29 @@
+package database
+
+import (
+	"github.com/komari-monitor/komari/database/dbcore"
+	"github.com/komari-monitor/komari/database/models"
+)
+
+func GetAllMessageSenderConfigs() []models.MessageSenderProvider {
+	db := dbcore.GetDBInstance()
+	var result []models.MessageSenderProvider
+	if err := db.Find(&result).Error; err != nil {
+		return nil
+	}
+	return result
+}
+
+func GetMessageSenderConfigByName(name string) (*models.MessageSenderProvider, error) {
+	db := dbcore.GetDBInstance()
+	var config models.MessageSenderProvider
+	if err := db.Where("name = ?", name).First(&config).Error; err != nil {
+		return nil, err
+	}
+	return &config, nil
+}
+
+func SaveMessageSenderConfig(config *models.MessageSenderProvider) error {
+	db := dbcore.GetDBInstance()
+	return db.Save(config).Error
+}

database/models/UTCTime.go

@@ -0,0 +1,121 @@
+package models
+
+import (
+	"database/sql/driver"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+	"sync"
+	"time"
+)
+
+// LocalTime is a custom time type for GORM to handle time.Time correctly.
+// It ensures that all times are stored and retrieved based on the application's configured timezone.
+type LocalTime time.Time
+
+// Value implements the driver.Valuer interface.
+// It converts UTCTime to a TEXT format that the database understands.
+// The time is formatted as a string in the application's local timezone, without timezone information.
+func (t LocalTime) Value() (driver.Value, error) {
+	if time.Time(t).IsZero() {
+		return nil, nil
+	}
+	return time.Time(t).In(GetAppLocation()).Format("2006-01-02 15:04:05.0000000"), nil
+}
+
+// Scan implements the sql.Scanner interface.
+// It scans a value from the database into a UTCTime object.
+func (t *LocalTime) Scan(v interface{}) error {
+	if v == nil {
+		*t = LocalTime(time.Time{})
+		return nil
+	}
+
+	loc := GetAppLocation()
+
+	switch val := v.(type) {
+	case time.Time:
+		// CRITICAL FIX: When the driver reads a timezone-less string (e.g., "16:00:00"),
+		// it often incorrectly assumes it's UTC. We must correct this by re-interpreting
+		// the date and clock values in the application's actual timezone.
+		year, month, day := val.Date()
+		hour, min, sec := val.Clock()
+		nanosec := val.Nanosecond()
+		*t = LocalTime(time.Date(year, month, day, hour, min, sec, nanosec, loc))
+		return nil
+	case []byte:
+		return t.parseTime(string(val), loc)
+	case string:
+		return t.parseTime(val, loc)
+	default:
+		return fmt.Errorf("UTCTime scan source was not string, []byte or time.Time: %T (%v)", v, v)
+	}
+}
+
+// parseTime handles parsing a string into UTCTime.
+func (t *LocalTime) parseTime(timeStr string, loc *time.Location) error {
+	timeStr = strings.TrimSpace(timeStr)
+	if timeStr == "" {
+		*t = LocalTime(time.Time{})
+		return nil
+	}
+
+	layouts := []string{
+		time.RFC3339Nano, time.RFC3339,
+		"2006-01-02 15:04:05.0000000-07:00", "2006-01-02 15:04:05-07:00",
+		"2006-01-02 15:04:05.0000000", "2006-01-02 15:04:05", "2006-01-02",
+	}
+
+	for _, layout := range layouts {
+		if parsedTime, err := time.ParseInLocation(layout, timeStr, loc); err == nil {
+			*t = LocalTime(parsedTime)
+			return nil
+		}
+	}
+	return fmt.Errorf("unable to parse time string '%s' into UTCTime", timeStr)
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+// Serializes UTCTime to JSON in RFC3339 format with the correct timezone offset.
+func (t LocalTime) MarshalJSON() ([]byte, error) {
+	if time.Time(t).IsZero() {
+		return []byte("null"), nil
+	}
+	formattedTime := time.Time(t).In(GetAppLocation()).Format(time.RFC3339)
+	return []byte(fmt.Sprintf(`"%s"`, formattedTime)), nil
+}
+
+// ToTime converts UTCTime to Go's native time.Time type.
+func (t LocalTime) ToTime() time.Time { return time.Time(t) }
+
+// FromTime converts Go's native time.Time type to UTCTime.
+func FromTime(t time.Time) LocalTime { return LocalTime(t) }
+
+// Now returns the current time in the application's configured location.
+func Now() LocalTime { return LocalTime(time.Now().In(GetAppLocation())) }
+
+var (
+	appLocation  *time.Location
+	locationOnce sync.Once
+)
+
+// GetAppLocation retrieves the application's global timezone from the "TZ" environment variable.
+func GetAppLocation() *time.Location {
+	locationOnce.Do(func() {
+		tz := os.Getenv("TZ")
+		if tz == "" {
+			tz = "UTC"
+		}
+		loc, err := time.LoadLocation(tz)
+		if err != nil {
+			log.Printf("Warning: Failed to load timezone '%s', falling back to UTC. Error: %v", tz, err)
+			appLocation = time.UTC
+		} else {
+			appLocation = loc
+		}
+		time.Local = appLocation
+		log.Printf("Application timezone is set to '%s'.", appLocation.String())
+	})
+	return appLocation
+}

database/models/clipboard.go

@@ -1,13 +1,11 @@
 package models
 
-import "time"
-
 type Clipboard struct {
 	Id        int       `json:"id" gorm:"primaryKey;autoIncrement;unique"`
 	Text      string    `json:"text" gorm:"type:longtext"`
 	Name      string    `json:"name" gorm:"type:varchar(255)"`
 	Weight    int       `json:"weight" gorm:"type:int"`
 	Remark    string    `json:"remark" gorm:"type:text"`
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
+	CreatedAt LocalTime `json:"created_at"`
+	UpdatedAt LocalTime `json:"updated_at"`
 }

database/models/config.go

@@ -1,35 +0,0 @@
-package models
-
-import "time"
-
-type Config struct {
-	ID          uint   `json:"id,omitempty" gorm:"primaryKey;autoIncrement"` // 1
-	Sitename    string `json:"sitename" gorm:"type:varchar(100);not null"`
-	Description string `json:"description" gorm:"type:text"`
-	AllowCors   bool   `json:"allow_cors" gorm:"column:allow_cors;default:false"`
-	// GeoIP 配置
-	GeoIpEnabled  bool   `json:"geo_ip_enabled" gorm:"default:true"`
-	GeoIpProvider string `json:"geo_ip_provider" gorm:"type:varchar(20);default:'mmdb'"` // mmdb, bilibili, ip-api. 暂时只实现了mmdb
-	// OAuth 配置
-	OAuthClientID        string `json:"o_auth_client_id" gorm:"type:varchar(255)"`
-	OAuthClientSecret    string `json:"o_auth_client_secret" gorm:"type:varchar(255)"`
-	OAuthEnabled         bool   `json:"o_auth_enabled" gorm:"default:false"`
-	DisablePasswordLogin bool   `json:"disable_password_login" gorm:"default:false"`
-	// 自定义美化
-	CustomHead string `json:"custom_head" gorm:"type:longtext"`
-	CustomBody string `json:"custom_body" gorm:"type:longtext"`
-	// Telegram Bot 配置
-	// TelegramEnabled  bool   `json:"telegram_enabled" gorm:"default:false"`
-	TelegramEndpoint string `json:"telegram_endpoint" gorm:"type:varchar(255);default:'https://api.telegram.org/bot'"`
-	TelegramBotToken string `json:"telegram_bot_token" gorm:"type:varchar(255)"`
-	TelegramChatID   string `json:"telegram_chat_id" gorm:"type:varchar(255)"`
-	// 通知
-	NotificationEnabled bool   `json:"notification_enabled" gorm:"default:false"` // 通知总开关
-	NotificationMethod  string `json:"notification_method" gorm:"type:varchar(64);default:'none'"`
-	// Record
-	RecordEnabled          bool `json:"record_enabled" gorm:"default:true"`          // 是否启用记录功能
-	RecordPreserveTime     int  `json:"record_preserve_time" gorm:"default:720"`     // 记录保留时间，单位小时，默认30天
-	PingRecordPreserveTime int  `json:"ping_record_preserve_time" gorm:"default:72"` // Ping 记录保留时间，单位小时，默认3天
-	CreatedAt              time.Time
-	UpdatedAt              time.Time
-}

database/models/log.go

@@ -1,12 +1,10 @@
 package models
 
-import "time"
-
 type Log struct {
 	ID      uint      `json:"id,omitempty" gorm:"primaryKey;autoIncrement"`
 	IP      string    `json:"ip" gorm:"type:varchar(45);"` // IPv4 or IPv6
 	UUID    string    `json:"uuid" gorm:"type:varchar(36);"`
 	Message string    `json:"message" gorm:"type:text;not null"`
 	MsgType string    `json:"msg_type" gorm:"type:varchar(20);not null"`
-	Time    time.Time `json:"time" gorm:"autoCreateTime;not null"`
+	Time    LocalTime `json:"time" gorm:"autoCreateTime;not null"`
 }

database/models/messageEvent/MessageEvent.go

@@ -0,0 +1,14 @@
+package messageevent
+
+const (
+	Offline = "Offline"
+	Online  = "Online"
+	Expire  = "Expire"
+	Renew   = "Renew"
+	Login   = "Login"
+	Alert   = "Alert"
+	Traffic = "Traffic"
+	DReport = "DReport" // 日报
+	WReport = "WReport" // 周报
+	MReport = "MReport" // 月报
+)

database/models/messageSender.go

@@ -0,0 +1,16 @@
+package models
+
+import "time"
+
+type MessageSenderProvider struct {
+	Name     string `json:"name" gorm:"primaryKey;unique;not null"`
+	Addition string `json:"addition" gorm:"type:longtext" default:"{}"`
+}
+
+type EventMessage struct {
+	Event   string    `json:"event"`
+	Clients []Client  `json:"clients"`
+	Time    time.Time `json:"time"`
+	Message string    `json:"message"`
+	Emoji   string    `json:"emoji"`
+}

database/models/models.go

@@ -4,36 +4,43 @@ import (
 	"database/sql/driver"
 	"encoding/json"
 	"fmt"
-	"time"
 )
 
 // Client represents a registered client device
 type Client struct {
-	UUID           string    `json:"uuid,omitempty" gorm:"type:varchar(36);primaryKey"`
-	Token          string    `json:"token,omitempty" gorm:"type:varchar(255);unique;not null"`
-	Name           string    `json:"name" gorm:"type:varchar(100)"`
-	CpuName        string    `json:"cpu_name" gorm:"type:varchar(100)"`
-	Virtualization string    `json:"virtualization" gorm:"type:varchar(50)"`
-	Arch           string    `json:"arch" gorm:"type:varchar(50)"`
-	CpuCores       int       `json:"cpu_cores" gorm:"type:int"`
-	OS             string    `json:"os" gorm:"type:varchar(100)"`
-	GpuName        string    `json:"gpu_name" gorm:"type:varchar(100)"`
-	IPv4           string    `json:"ipv4,omitempty" gorm:"type:varchar(100)"`
-	IPv6           string    `json:"ipv6,omitempty" gorm:"type:varchar(100)"`
-	Region         string    `json:"region" gorm:"type:varchar(100)"`
-	Remark         string    `json:"remark,omitempty" gorm:"type:longtext"`
-	PublicRemark   string    `json:"public_remark,omitempty" gorm:"type:longtext"`
-	MemTotal       int64     `json:"mem_total" gorm:"type:bigint"`
-	SwapTotal      int64     `json:"swap_total" gorm:"type:bigint"`
-	DiskTotal      int64     `json:"disk_total" gorm:"type:bigint"`
-	Version        string    `json:"version,omitempty" gorm:"type:varchar(100)"`
-	Weight         int       `json:"weight" gorm:"type:int"`
-	Price          float64   `json:"price"`
-	BillingCycle   int       `json:"billing_cycle"`
-	Currency       string    `json:"currency" gorm:"type:varchar(20);default:'$'"`
-	ExpiredAt      time.Time `json:"expired_at" gorm:"type:timestamp"`
-	CreatedAt      time.Time `json:"created_at"`
-	UpdatedAt      time.Time `json:"updated_at"`
+	UUID             string    `json:"uuid,omitempty" gorm:"type:varchar(36);primaryKey"`
+	Token            string    `json:"token,omitempty" gorm:"type:varchar(255);unique;not null"`
+	Name             string    `json:"name" gorm:"type:varchar(100)"`
+	CpuName          string    `json:"cpu_name" gorm:"type:varchar(100)"`
+	Virtualization   string    `json:"virtualization" gorm:"type:varchar(50)"`
+	Arch             string    `json:"arch" gorm:"type:varchar(50)"`
+	CpuCores         int       `json:"cpu_cores" gorm:"type:int"`
+	CpuPhysicalCores int       `json:"cpu_physical_cores" gorm:"type:int"`
+	OS               string    `json:"os" gorm:"type:varchar(100)"`
+	KernelVersion    string    `json:"kernel_version" gorm:"type:varchar(100)"`
+	GpuName          string    `json:"gpu_name" gorm:"type:varchar(100)"`
+	IPv4             string    `json:"ipv4,omitempty" gorm:"type:varchar(100)"`
+	IPv6             string    `json:"ipv6,omitempty" gorm:"type:varchar(100)"`
+	Region           string    `json:"region" gorm:"type:varchar(100)"`
+	Remark           string    `json:"remark,omitempty" gorm:"type:longtext"`
+	PublicRemark     string    `json:"public_remark,omitempty" gorm:"type:longtext"`
+	MemTotal         int64     `json:"mem_total" gorm:"type:bigint"`
+	SwapTotal        int64     `json:"swap_total" gorm:"type:bigint"`
+	DiskTotal        int64     `json:"disk_total" gorm:"type:bigint"`
+	Version          string    `json:"version,omitempty" gorm:"type:varchar(100)"`
+	Weight           int       `json:"weight" gorm:"type:int"`
+	Price            float64   `json:"price"`
+	BillingCycle     int       `json:"billing_cycle"`
+	AutoRenewal      bool      `json:"auto_renewal" gorm:"default:false"` // 是否自动续费
+	Currency         string    `json:"currency" gorm:"type:varchar(20);default:'$'"`
+	ExpiredAt        LocalTime `json:"expired_at" gorm:"type:timestamp"`
+	Group            string    `json:"group" gorm:"type:varchar(100)"`
+	Tags             string    `json:"tags" gorm:"type:text"` // split by ';'
+	Hidden           bool      `json:"hidden" gorm:"default:false"`
+	TrafficLimit     int64     `json:"traffic_limit" gorm:"type:bigint"`
+	TrafficLimitType string    `json:"traffic_limit_type" gorm:"type:varchar(10);default:'max'"` // 流量阈值类型：sum max min up down
+	CreatedAt        LocalTime `json:"created_at"`
+	UpdatedAt        LocalTime `json:"updated_at"`
 }
 
 // User represents an authenticated user
@@ -44,28 +51,29 @@ type User struct {
 	SSOType   string    `json:"sso_type" gorm:"type:varchar(20)"`                   // e.g., "github", "google"
 	SSOID     string    `json:"sso_id" gorm:"type:varchar(100)"`                    // OAuth provider's user ID
 	TwoFactor string    `json:"two_factor,omitempty" gorm:"type:varchar(255)"`      // 2FA secret
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
+	Sessions  []Session `json:"sessions,omitempty" gorm:"foreignKey:UUID;references:UUID;constraint:OnDelete:CASCADE,OnUpdate:CASCADE"`
+	CreatedAt LocalTime `json:"created_at"`
+	UpdatedAt LocalTime `json:"updated_at"`
 }
 
 // Session manages user sessions
 type Session struct {
-	UUID            string    `json:"uuid" gorm:"type:varchar(36);foreignKey:UserUUID;references:UUID;constraint:OnDelete:CASCADE"`
-	Session         string    `json:"session" gorm:"type:varchar(255);uniqueIndex:idx_sessions_session;not null"`
+	UUID            string    `json:"uuid" gorm:"type:varchar(36)"`
+	Session         string    `json:"session" gorm:"type:varchar(255);primaryKey;uniqueIndex:idx_sessions_session;not null"`
 	UserAgent       string    `json:"user_agent" gorm:"type:text"`
 	Ip              string    `json:"ip" gorm:"type:varchar(100)"`
 	LoginMethod     string    `json:"login_method" gorm:"type:varchar(50)"`
-	LatestOnline    time.Time `json:"latest_online" gorm:"type:timestamp"`
+	LatestOnline    LocalTime `json:"latest_online" gorm:"type:timestamp"`
 	LatestUserAgent string    `json:"latest_user_agent" gorm:"type:text"`
 	LatestIp        string    `json:"latest_ip" gorm:"type:varchar(100)"`
-	Expires         time.Time `json:"expires" gorm:"not null"`
-	CreatedAt       time.Time `json:"created_at"`
+	Expires         LocalTime `json:"expires" gorm:"not null"`
+	CreatedAt       LocalTime `json:"created_at"`
 }
 
 // Record logs client metrics over time
 type Record struct {
-	Client         string    `json:"client" gorm:"type:varchar(36);index;foreignKey:ClientUUID;references:UUID;constraint:OnDelete:CASCADE"`
-	Time           time.Time `json:"time" gorm:"index"`
+	Client         string    `json:"client" gorm:"type:varchar(36);index"`
+	Time           LocalTime `json:"time" gorm:"index"`
 	Cpu            float32   `json:"cpu" gorm:"type:decimal(5,2)"` // e.g., 75.50%
 	Gpu            float32   `json:"gpu" gorm:"type:decimal(5,2)"`
 	Ram            int64     `json:"ram" gorm:"type:bigint"`
@@ -80,9 +88,24 @@ type Record struct {
 	NetOut         int64     `json:"net_out" gorm:"type:bigint"`
 	NetTotalUp     int64     `json:"net_total_up" gorm:"type:bigint"`
 	NetTotalDown   int64     `json:"net_total_down" gorm:"type:bigint"`
+	TrafficUp      int64     `json:"traffic_up" gorm:"type:bigint"`
+	TrafficDown    int64     `json:"traffic_down" gorm:"type:bigint"`
 	Process        int       `json:"process"`
 	Connections    int       `json:"connections"`
 	ConnectionsUdp int       `json:"connections_udp"`
+	//Uptime         int64     `json:"uptime" gorm:"type:bigint"`
+}
+
+// GPURecord logs individual GPU metrics over time
+type GPURecord struct {
+	Client      string    `json:"client" gorm:"type:varchar(36);index"` // 客户端UUID
+	Time        LocalTime `json:"time" gorm:"index"`                    // 记录时间
+	DeviceIndex int       `json:"device_index" gorm:"index"`            // GPU设备索引 (0,1,2...)
+	DeviceName  string    `json:"device_name" gorm:"type:varchar(100)"` // GPU型号
+	MemTotal    int64     `json:"mem_total" gorm:"type:bigint"`         // 显存总量(字节)
+	MemUsed     int64     `json:"mem_used" gorm:"type:bigint"`          // 显存使用(字节)
+	Utilization float32   `json:"utilization" gorm:"type:decimal(5,2)"` // GPU使用率(%)
+	Temperature int       `json:"temperature"`                          // GPU温度(°C)
 }
 
 // StringArray represents a slice of strings stored as JSON in the database
@@ -90,9 +113,21 @@ type Record struct {
 type StringArray []string
 
 func (sa *StringArray) Scan(value interface{}) error {
-	bytes, ok := value.([]byte)
-	if !ok {
-		return fmt.Errorf("failed to scan StringArray: value is not []byte")
+	var bytes []byte
+	switch v := value.(type) {
+	case nil:
+		*sa = StringArray{}
+		return nil
+	case []byte:
+		bytes = v
+	case string:
+		bytes = []byte(v)
+	default:
+		return fmt.Errorf("failed to scan StringArray: unsupported value type %T", value)
+	}
+	if len(bytes) == 0 {
+		*sa = StringArray{}
+		return nil
 	}
 	return json.Unmarshal(bytes, sa)
 }

database/models/models_test.go

@@ -0,0 +1,30 @@
+package models
+
+import "testing"
+
+func TestStringArrayScanAcceptsSQLiteTextShapes(t *testing.T) {
+	tests := map[string]interface{}{
+		"bytes": []byte(`["a","b"]`),
+		"text":  `["a","b"]`,
+		"empty": "",
+		"nil":   nil,
+	}
+
+	for name, input := range tests {
+		t.Run(name, func(t *testing.T) {
+			var got StringArray
+			if err := got.Scan(input); err != nil {
+				t.Fatalf("scan StringArray: %v", err)
+			}
+			if input == "" || input == nil {
+				if len(got) != 0 {
+					t.Fatalf("expected empty StringArray, got %v", got)
+				}
+				return
+			}
+			if len(got) != 2 || got[0] != "a" || got[1] != "b" {
+				t.Fatalf("unexpected StringArray: %v", got)
+			}
+		})
+	}
+}

database/models/notification.go

@@ -1,24 +1,33 @@
 package models
 
-import "time"
-
 // Notification 定义了通知相关的数据库模型
 type OfflineNotification struct {
-	Client string `json:"client" gorm:"type:varchar(36);not null;index;unique;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;foreignKey:client;references:UUID"`
-	Enable bool   `json:"enable" gorm:"type:boolean;default:false"`
+	Client     string `json:"client" gorm:"type:varchar(36);not null;index;unique;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;foreignKey:client;references:UUID"`
+	ClientInfo Client `json:"client_info,omitempty" gorm:"foreignKey:Client;references:UUID"`
+	Enable     bool   `json:"enable" gorm:"type:boolean;default:false"`
 	//Cooldown     int       `json:"cooldown" gorm:"type:int;not null;default:1800"`                // 冷却时间（秒），默认 30 分钟
 	GracePeriod  int       `json:"grace_period" gorm:"type:int;not null;default:180"` // 宽限期（秒），默认 3 分钟
-	LastNotified time.Time `json:"last_notified"`                                     // 上次通知时间
+	LastNotified LocalTime `json:"last_notified"`                                     // 上次通知时间
 }
 
 // LoadNotification 定义了基于资源占用达标时间比的负载通知规则
 type LoadNotification struct {
-	Client       string    `json:"client" gorm:"type:varchar(36);not null;index;unique;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;foreignKey:client;references:UUID"`
-	Enable       bool      `json:"enable" gorm:"type:boolean;default:false"`
-	Metric       string    `json:"metric" gorm:"type:varchar(50);not null;default:'cpu'"`     // 监控指标，如 cpu, ram, load
-	Threshold    float32   `json:"threshold" gorm:"type:decimal(5,2);not null;default:80.00"` // 阈值百分比
-	Window       int       `json:"window" gorm:"type:int;not null;default:300"`               // 观测窗口（秒）
-	Ratio        float32   `json:"ratio" gorm:"type:decimal(5,2);not null;default:0.80"`      // 达标时间比
-	Cooldown     int       `json:"cooldown" gorm:"type:int;not null;default:1800"`            // 冷却时间（秒）
-	LastNotified time.Time `json:"last_notified"`                                             // 上次通知时间
+	Id           uint        `json:"id,omitempty" gorm:"primaryKey;autoIncrement"`
+	Name         string      `json:"name" gorm:"type:varchar(255)"`
+	Clients      StringArray `json:"clients" gorm:"type:longtext"`
+	Metric       string      `json:"metric" gorm:"type:varchar(50);not null;default:'cpu'"`     // 监控指标，如 cpu, ram, load
+	Threshold    float32     `json:"threshold" gorm:"type:decimal(5,2);not null;default:80.00"` // 阈值百分比
+	Ratio        float32     `json:"ratio" gorm:"type:decimal(5,2);not null;default:0.80"`      // 达标时间比
+	Interval     int         `json:"interval" gorm:"type:int;not null;default:15"`              // 监测间隔（分钟）
+	LastNotified LocalTime   `json:"last_notified"`                                             // 上次通知时间
+}
+
+// TrafficReportNotification 定义了流量定时报告的数据库模型
+type TrafficReportNotification struct {
+	Client     string `json:"client" gorm:"type:varchar(36);not null;index;unique;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;foreignKey:client;references:UUID"`
+	ClientInfo Client `json:"client_info,omitempty" gorm:"foreignKey:Client;references:UUID"`
+	Enable     bool   `json:"enable" gorm:"type:boolean;default:false"`
+	Daily      bool   `json:"daily" gorm:"type:boolean;default:false"`  // 日报
+	Weekly     bool   `json:"weekly" gorm:"type:boolean;default:false"` // 周报
+	Monthly    bool   `json:"monthly" gorm:"type:boolean;default:false"` // 月报
 }

database/models/oauth.go

@@ -0,0 +1,6 @@
+package models
+
+type OidcProvider struct {
+	Name     string `json:"name" gorm:"primaryKey;unique;not null"`
+	Addition string `json:"addition" gorm:"type:longtext" default:"{}"`
+}

database/models/pingTask.go

@@ -1,19 +1,35 @@
 package models
 
-import "time"
-
 type PingRecord struct {
-	Client string    `json:"client" gorm:"type:varchar(36);not null;index;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;foreignKey:client;references:UUID"`
-	TaskId uint      `json:"task_id" gorm:"not null;index;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;foreignKey:TaskId;references:Id"`
-	Time   time.Time `json:"time" gorm:"index;not null"`
-	Value  int       `json:"value" gorm:"type:int;not null"` // Ping 值，单位毫秒
+	Client     string    `json:"client" gorm:"type:varchar(36);not null;index"`
+	ClientInfo Client    `json:"client_info" gorm:"foreignKey:Client;references:UUID;constraint:OnDelete:CASCADE,OnUpdate:CASCADE"`
+	TaskId     uint      `json:"task_id" gorm:"not null;index"`
+	Task       PingTask  `json:"task" gorm:"foreignKey:TaskId;references:Id;constraint:OnDelete:CASCADE,OnUpdate:CASCADE;"`
+	Time       LocalTime `json:"time" gorm:"index;not null"`
+	Value      int       `json:"value" gorm:"type:int;not null"` // Ping 值，单位毫秒
 }
 
+// PingTask 表示一次延迟监测任务配置。
 type PingTask struct {
-	Id       uint        `json:"id,omitempty" gorm:"primaryKey;autoIncrement"`
-	Name     string      `json:"name" gorm:"type:varchar(255);not null;index"`
-	Clients  StringArray `json:"clients" gorm:"type:longtext"`
-	Type     string      `json:"type" gorm:"type:varchar(12);not null;default:'icmp'"` // icmp tcp http
-	Target   string      `json:"target" gorm:"type:varchar(255);not null"`
-	Interval int         `json:"interval" gorm:"type:int;not null;default:60"` // 间隔时间
+	Id        uint        `json:"id,omitempty" gorm:"primaryKey;autoIncrement"`
+	Weight    int         `json:"weight" gorm:"type:int;not null;default:0;index"`
+	Name      string      `json:"name" gorm:"type:varchar(255);not null;index"`
+	Clients   StringArray `json:"clients" gorm:"type:longtext"`
+	DefaultOn bool        `json:"default_on" gorm:"column:all_clients;not null;default:false"` // 新加入的服务器是否自动开启此监测；现有服务器不受此字段影响
+	Type      string      `json:"type" gorm:"type:varchar(12);not null;default:'icmp'"`        // icmp tcp http
+	Target    string      `json:"target" gorm:"type:varchar(255);not null"`                    // Ping 目标地址
+	Interval  int         `json:"interval" gorm:"type:int;not null;default:60"`                // 间隔时间
+}
+
+// AppliesToClient 判断当前 PingTask 是否适用于指定服务器。
+func (task PingTask) AppliesToClient(uuid string) bool {
+	if uuid == "" {
+		return false
+	}
+	for _, client := range task.Clients {
+		if client == uuid {
+			return true
+		}
+	}
+	return false
 }

database/models/task.go

@@ -1,19 +1,18 @@
 package models
 
-import (
-	"time"
-)
-
 type Task struct {
-	TaskId  string      `json:"task_id" gorm:"type:varchar(36);primaryKey;unique"`
-	Clients StringArray `json:"clients" gorm:"type:longtext"`
-	Command string      `json:"command" gorm:"type:text"`
+	TaskId  string       `json:"task_id" gorm:"type:varchar(36);primaryKey;unique"`
+	Clients StringArray  `json:"clients" gorm:"type:longtext"`
+	Command string       `json:"command" gorm:"type:text"`
+	Results []TaskResult `gorm:"foreignKey:TaskId;references:TaskId;constraint:OnDelete:CASCADE,OnUpdate:CASCADE"`
 }
+
 type TaskResult struct {
-	TaskId     string     `json:"task_id" gorm:"type:varchar(36)"`
+	TaskId     string     `json:"task_id" gorm:"type:varchar(36);index"`
 	Client     string     `json:"client" gorm:"type:varchar(36)"`
+	ClientInfo Client     `json:"client_info" gorm:"foreignKey:Client;references:UUID;constraint:OnDelete:CASCADE,OnUpdate:CASCADE"`
 	Result     string     `json:"result" gorm:"type:longtext"`
 	ExitCode   *int       `json:"exit_code" gorm:"type:int"`
-	FinishedAt *time.Time `json:"finished_at" gorm:"type:timestamp"`
-	CreatedAt  time.Time  `json:"created_at" gorm:"type:timestamp"`
+	FinishedAt *LocalTime `json:"finished_at" gorm:"type:timestamp"`
+	CreatedAt  LocalTime  `json:"created_at" gorm:"type:timestamp"`
 }

database/models/theme.go

@@ -0,0 +1,146 @@
+package models
+
+import (
+	"fmt"
+	"net/url"
+	"path"
+	"strings"
+)
+
+const (
+	ThemeConfigurationManaged  = "managed"
+	ThemeConfigurationRaw      = "raw"
+	ThemeConfigurationRedirect = "redirect"
+)
+
+// Theme represents a komari theme information
+type Theme struct {
+	Name          string        `json:"name"`          // 主题名称
+	Short         string        `json:"short"`         // 短名称，用作文件夹名
+	Description   string        `json:"description"`   // 主题描述
+	Version       string        `json:"version"`       // 版本号
+	Author        string        `json:"author"`        // 作者
+	URL           string        `json:"url"`           // 主题URL
+	Preview       string        `json:"preview"`       // 预览图片相对路径
+	Configuration Configuration `json:"configuration"` // 声明配置项
+}
+
+type Configuration struct {
+	Type string `json:"type"` // managed raw redirect
+	Icon string `json:"icon"` // 图标
+	Name any    `json:"name"`
+	Data any    `json:"data"` // 配置数据
+}
+
+type ManagedThemeConfigurationItem struct {
+	Key      string `json:"key"`
+	Name     any    `json:"name"`
+	Required bool   `json:"required"`
+	Type     string `json:"type"` // string number select switch title
+	Options  string `json:"options"`
+	Default  any    `json:"default"`
+	Help     any    `json:"help"`
+}
+
+type ThemeConfiguration struct {
+	Short string `json:"short" gorm:"primaryKey;unique;not null"`
+	Data  string `json:"data" gorm:"type:longtext" default:"{}"`
+}
+
+func (t Theme) ConfigurationType() string {
+	typ := strings.ToLower(strings.TrimSpace(t.Configuration.Type))
+	if typ == "" {
+		return ThemeConfigurationManaged
+	}
+	return typ
+}
+
+func (t Theme) RawHTML() (string, bool) {
+	if t.ConfigurationType() != ThemeConfigurationRaw {
+		return "", false
+	}
+	return configurationDataString(t.Configuration.Data)
+}
+
+func (t Theme) RedirectTarget() (string, bool) {
+	if t.ConfigurationType() != ThemeConfigurationRedirect {
+		return "", false
+	}
+	return NormalizeThemeRedirectTarget(t.Configuration.Data)
+}
+
+func (t Theme) ValidateConfiguration() error {
+	switch t.ConfigurationType() {
+	case ThemeConfigurationManaged:
+		return nil
+	case ThemeConfigurationRaw:
+		html, ok := t.RawHTML()
+		if !ok || strings.TrimSpace(html) == "" {
+			return fmt.Errorf("raw 类型主题需要在 configuration.data 中提供 HTML 字符串")
+		}
+		return nil
+	case ThemeConfigurationRedirect:
+		if _, ok := t.RedirectTarget(); !ok {
+			return fmt.Errorf("redirect 类型主题需要在 configuration.data 中提供站内相对路径")
+		}
+		return nil
+	default:
+		return fmt.Errorf("不支持的主题类型: %s", t.Configuration.Type)
+	}
+}
+
+func NormalizeThemeRedirectTarget(data any) (string, bool) {
+	target, ok := configurationDataString(data)
+	if !ok {
+		return "", false
+	}
+
+	target = strings.TrimSpace(target)
+	if target == "" || strings.Contains(target, "\\") || strings.HasPrefix(target, "//") {
+		return "", false
+	}
+
+	parsed, err := url.Parse(target)
+	if err != nil || parsed.IsAbs() || parsed.Host != "" {
+		return "", false
+	}
+
+	cleanInputPath := parsed.Path
+	if strings.HasPrefix(cleanInputPath, "/") {
+		cleanInputPath = strings.TrimLeft(cleanInputPath, "/")
+	} else {
+		for strings.HasPrefix(cleanInputPath, "../") {
+			cleanInputPath = strings.TrimPrefix(cleanInputPath, "../")
+		}
+	}
+
+	for _, segment := range strings.Split(cleanInputPath, "/") {
+		if segment == ".." {
+			return "", false
+		}
+	}
+
+	cleanPath := cleanInputPath
+	if cleanPath == "" {
+		cleanPath = "/"
+	} else {
+		cleanPath = path.Clean(cleanPath)
+		if cleanPath == "." {
+			cleanPath = "/"
+		} else {
+			cleanPath = "/" + strings.TrimPrefix(cleanPath, "/")
+		}
+	}
+
+	normalized := url.URL{
+		Path:     cleanPath,
+		RawQuery: parsed.RawQuery,
+		Fragment: parsed.Fragment,
+	}
+	return normalized.String(), true
+}
+
+func configurationDataString(data any) (string, bool) {
+	value, ok := data.(string)
+	return value, ok
+}

database/models/theme_test.go

@@ -0,0 +1,141 @@
+package models
+
+import "testing"
+
+func TestThemeValidateConfiguration(t *testing.T) {
+	tests := map[string]struct {
+		theme   Theme
+		wantErr bool
+	}{
+		"managed empty data": {
+			theme: Theme{
+				Configuration: Configuration{Type: ThemeConfigurationManaged},
+			},
+		},
+		"missing type defaults to managed": {
+			theme: Theme{},
+		},
+		"raw html": {
+			theme: Theme{
+				Configuration: Configuration{
+					Type: ThemeConfigurationRaw,
+					Data: "<!doctype html><title>raw</title>",
+				},
+			},
+		},
+		"raw rejects empty html": {
+			theme: Theme{
+				Configuration: Configuration{
+					Type: ThemeConfigurationRaw,
+					Data: "  ",
+				},
+			},
+			wantErr: true,
+		},
+		"redirect relative path": {
+			theme: Theme{
+				Configuration: Configuration{
+					Type: ThemeConfigurationRedirect,
+					Data: "/dashboard?tab=nodes",
+				},
+			},
+		},
+		"redirect rejects absolute url": {
+			theme: Theme{
+				Configuration: Configuration{
+					Type: ThemeConfigurationRedirect,
+					Data: "https://example.com",
+				},
+			},
+			wantErr: true,
+		},
+		"redirect rejects parent traversal": {
+			theme: Theme{
+				Configuration: Configuration{
+					Type: ThemeConfigurationRedirect,
+					Data: "/../admin",
+				},
+			},
+			wantErr: true,
+		},
+		"unknown type": {
+			theme: Theme{
+				Configuration: Configuration{Type: "hosted"},
+			},
+			wantErr: true,
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			err := tt.theme.ValidateConfiguration()
+			if tt.wantErr && err == nil {
+				t.Fatal("expected error, got nil")
+			}
+			if !tt.wantErr && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+func TestNormalizeThemeRedirectTarget(t *testing.T) {
+	tests := map[string]struct {
+		input string
+		want  string
+		ok    bool
+	}{
+		"leading slash": {
+			input: "/nodes",
+			want:  "/nodes",
+			ok:    true,
+		},
+		"missing leading slash": {
+			input: "nodes",
+			want:  "/nodes",
+			ok:    true,
+		},
+		"parent prefix points to root path": {
+			input: "../settings",
+			want:  "/settings",
+			ok:    true,
+		},
+		"multiple parent prefixes point to root path": {
+			input: "../../settings/site",
+			want:  "/settings/site",
+			ok:    true,
+		},
+		"query and fragment": {
+			input: "nodes?id=1#cpu",
+			want:  "/nodes?id=1#cpu",
+			ok:    true,
+		},
+		"absolute parent traversal": {
+			input: "/../admin",
+		},
+		"nested parent traversal": {
+			input: "nodes/../admin",
+		},
+		"protocol relative": {
+			input: "//example.com",
+		},
+		"backslash": {
+			input: `\admin`,
+		},
+		"absolute url": {
+			input: "https://example.com",
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			got, ok := NormalizeThemeRedirectTarget(tt.input)
+			if ok != tt.ok {
+				t.Fatalf("ok = %v, want %v", ok, tt.ok)
+			}
+			if got != tt.want {
+				t.Fatalf("target = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}

database/notification/load.go

@@ -0,0 +1,68 @@
+package notification
+
+import (
+	"github.com/komari-monitor/komari/database/dbcore"
+	"github.com/komari-monitor/komari/database/models"
+	"github.com/komari-monitor/komari/utils/notifier"
+	"gorm.io/gorm"
+)
+
+func AddLoadNotification(clients []string, name string, metric string, threshold float32, ratio float32, interval int) (uint, error) {
+	db := dbcore.GetDBInstance()
+	notification := models.LoadNotification{
+		Clients:   clients,
+		Name:      name,
+		Metric:    metric,
+		Threshold: threshold,
+		Ratio:     ratio,
+		Interval:  interval,
+	}
+	if err := db.Create(&notification).Error; err != nil {
+		return 0, err
+	}
+
+	return notification.Id, ReloadLoadNotificationSchedule()
+}
+func DeleteLoadNotification(id []uint) error {
+	db := dbcore.GetDBInstance()
+	result := db.Where("id IN ?", id).Delete(&models.LoadNotification{})
+	if result.RowsAffected == 0 {
+		return gorm.ErrRecordNotFound
+	}
+	return ReloadLoadNotificationSchedule()
+}
+
+func EditLoadNotification(notifications []*models.LoadNotification) error {
+	db := dbcore.GetDBInstance()
+	for _, notification := range notifications {
+		result := db.Model(&models.LoadNotification{}).Where("id = ?", notification.Id).Updates(notification)
+		if result.RowsAffected == 0 {
+			return gorm.ErrRecordNotFound
+		}
+	}
+
+	return ReloadLoadNotificationSchedule()
+}
+
+func GetAllLoadNotifications() ([]models.LoadNotification, error) {
+	db := dbcore.GetDBInstance()
+	var notifications []models.LoadNotification
+	if err := db.Find(&notifications).Error; err != nil {
+		return nil, err
+	}
+	return notifications, nil
+}
+
+func SaveLoadNotification(record models.LoadNotification) error {
+	db := dbcore.GetDBInstance()
+	return db.Create(&record).Error
+}
+
+func ReloadLoadNotificationSchedule() error {
+	db := dbcore.GetDBInstance()
+	var loadNotifications []models.LoadNotification
+	if err := db.Find(&loadNotifications).Error; err != nil {
+		return err
+	}
+	return notifier.ReloadLoadNotificationSchedule(loadNotifications)
+}

database/notification/offline.go

@@ -1 +0,0 @@
-package notification

database/notification/traffic_report.go

@@ -0,0 +1,144 @@
+package notification
+
+import (
+	"fmt"
+
+	"github.com/komari-monitor/komari/database/dbcore"
+	"github.com/komari-monitor/komari/database/models"
+	"gorm.io/gorm/clause"
+)
+
+func validateTrafficReportNotification(notification models.TrafficReportNotification) error {
+	if notification.Client == "" {
+		return fmt.Errorf("client UUID cannot be empty")
+	}
+	if notification.Enable && !notification.Daily && !notification.Weekly && !notification.Monthly {
+		return fmt.Errorf("at least one cadence must be selected when enabling traffic reports")
+	}
+	return nil
+}
+
+func ValidateTrafficReportNotifications(notifications []models.TrafficReportNotification) error {
+	for _, notification := range notifications {
+		if err := validateTrafficReportNotification(notification); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func buildEnabledTrafficReportNotifications(uuids []string, existing []models.TrafficReportNotification) ([]models.TrafficReportNotification, error) {
+	if len(uuids) == 0 {
+		return nil, fmt.Errorf("at least one client UUID is required")
+	}
+
+	existingByClient := make(map[string]models.TrafficReportNotification, len(existing))
+	for _, notification := range existing {
+		existingByClient[notification.Client] = notification
+	}
+
+	notifications := make([]models.TrafficReportNotification, 0, len(uuids))
+	for _, uuid := range uuids {
+		if uuid == "" {
+			return nil, fmt.Errorf("client UUID cannot be empty")
+		}
+		existingNotification, ok := existingByClient[uuid]
+		if !ok || (!existingNotification.Daily && !existingNotification.Weekly && !existingNotification.Monthly) {
+			return nil, fmt.Errorf("at least one cadence must be selected when enabling traffic reports")
+		}
+		notifications = append(notifications, models.TrafficReportNotification{
+			Client: uuid,
+			Enable: true,
+		})
+	}
+
+	return notifications, nil
+}
+
+// ListTrafficReportNotifications 获取所有流量定时报告配置（关联客户端信息）
+func ListTrafficReportNotifications() ([]models.TrafficReportNotification, error) {
+	db := dbcore.GetDBInstance()
+	var notifications []models.TrafficReportNotification
+	err := db.Model(&models.TrafficReportNotification{}).Preload("ClientInfo").Find(&notifications).Error
+	return notifications, err
+}
+
+// EditTrafficReportNotifications 批量更新流量定时报告配置
+func EditTrafficReportNotifications(notifications []models.TrafficReportNotification) error {
+	if err := ValidateTrafficReportNotifications(notifications); err != nil {
+		return err
+	}
+	db := dbcore.GetDBInstance()
+	return db.Model(&models.TrafficReportNotification{}).
+		Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "client"}},
+			DoUpdates: clause.AssignmentColumns([]string{"enable", "daily", "weekly", "monthly"}),
+		}).
+		Select("client", "enable", "daily", "weekly", "monthly").
+		Create(notifications).Error
+}
+
+// EnableTrafficReportNotifications 批量启用（仅更新 enable 字段）
+func EnableTrafficReportNotifications(uuids []string) error {
+	if len(uuids) == 0 {
+		return fmt.Errorf("at least one client UUID is required")
+	}
+
+	db := dbcore.GetDBInstance()
+	var existing []models.TrafficReportNotification
+	if err := db.Where("client IN ?", uuids).Find(&existing).Error; err != nil {
+		return err
+	}
+	notifications, err := buildEnabledTrafficReportNotifications(uuids, existing)
+	if err != nil {
+		return err
+	}
+	return db.Model(&models.TrafficReportNotification{}).
+		Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "client"}},
+			DoUpdates: clause.AssignmentColumns([]string{"enable"}),
+		}).
+		Select("client", "enable").
+		Create(notifications).Error
+}
+
+// DisableTrafficReportNotifications 批量禁用
+func DisableTrafficReportNotifications(uuids []string) error {
+	if len(uuids) == 0 {
+		return fmt.Errorf("at least one client UUID is required")
+	}
+	db := dbcore.GetDBInstance()
+	var notifications []models.TrafficReportNotification
+	for _, uuid := range uuids {
+		if uuid == "" {
+			return fmt.Errorf("client UUID cannot be empty")
+		}
+		notifications = append(notifications, models.TrafficReportNotification{
+			Client: uuid,
+			Enable: false,
+		})
+	}
+	return db.Model(&models.TrafficReportNotification{}).
+		Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "client"}},
+			DoUpdates: clause.AssignmentColumns([]string{"enable"}),
+		}).
+		Select("client", "enable").
+		Create(notifications).Error
+}
+
+// GetEnabledTrafficReportByType 获取启用了指定类型报告的客户端配置
+func GetEnabledTrafficReportByType(daily, weekly, monthly bool) ([]models.TrafficReportNotification, error) {
+	db := dbcore.GetDBInstance()
+	var notifications []models.TrafficReportNotification
+	query := db.Model(&models.TrafficReportNotification{}).Where("enable = ?", true)
+	if daily {
+		query = query.Where("daily = ?", true)
+	} else if weekly {
+		query = query.Where("weekly = ?", true)
+	} else if monthly {
+		query = query.Where("monthly = ?", true)
+	}
+	err := query.Find(&notifications).Error
+	return notifications, err
+}

database/notification/traffic_report_test.go

@@ -0,0 +1,36 @@
+package notification
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/komari-monitor/komari/database/models"
+)
+
+func TestValidateTrafficReportNotificationsRejectsEnabledWithoutCadence(t *testing.T) {
+	err := ValidateTrafficReportNotifications([]models.TrafficReportNotification{{
+		Client: "client-a",
+		Enable: true,
+	}})
+
+	assert.Error(t, err)
+}
+
+func TestBuildEnabledTrafficReportNotificationsRequiresExistingCadence(t *testing.T) {
+	_, err := buildEnabledTrafficReportNotifications([]string{"client-a"}, nil)
+	assert.Error(t, err)
+
+	_, err = buildEnabledTrafficReportNotifications([]string{"client-a"}, []models.TrafficReportNotification{{Client: "client-a"}})
+	assert.Error(t, err)
+
+	notifications, err := buildEnabledTrafficReportNotifications([]string{"client-a"}, []models.TrafficReportNotification{{
+		Client: "client-a",
+		Daily:  true,
+	}})
+	require.NoError(t, err)
+	require.Len(t, notifications, 1)
+	assert.Equal(t, "client-a", notifications[0].Client)
+	assert.True(t, notifications[0].Enable)
+}

database/oauth.go

@@ -0,0 +1,32 @@
+package database
+
+import (
+	"github.com/komari-monitor/komari/database/dbcore"
+	"github.com/komari-monitor/komari/database/models"
+)
+
+func GetAllOidcConfigs() []models.OidcProvider {
+	db := dbcore.GetDBInstance()
+	var result []models.OidcProvider
+	if err := db.Find(&result).Error; err != nil {
+		return nil
+	}
+	return result
+}
+
+func GetOidcConfigByName(name string) (*models.OidcProvider, error) {
+	db := dbcore.GetDBInstance()
+	var config models.OidcProvider
+	if err := db.Where("name = ?", name).First(&config).Error; err != nil {
+		return nil, err
+	}
+	return &config, nil
+}
+
+func SaveOidcConfig(config *models.OidcProvider) error {
+	db := dbcore.GetDBInstance()
+	if err := db.Save(config).Error; err != nil {
+		return err
+	}
+	return nil
+}

database/records/records.go

@@ -1,6 +1,7 @@
 package records
 
 import (
+	"errors"
 	"log"
 	"sort"
 	"strings"
@@ -11,6 +12,7 @@ import (
 	"github.com/komari-monitor/komari/cmd/flags"
 	"github.com/komari-monitor/komari/database/dbcore"
 	"github.com/komari-monitor/komari/database/models"
+	"github.com/komari-monitor/komari/utils"
 )
 
 func RecordOne(rec models.Record) error {
@@ -18,14 +20,61 @@ func RecordOne(rec models.Record) error {
 	return db.Create(&rec).Error
 }
 
+func RecordGPU(rec models.GPURecord) error {
+	db := dbcore.GetDBInstance()
+	return db.Create(&rec).Error
+}
+
 func DeleteAll() error {
 	db := dbcore.GetDBInstance()
 	if err := db.Exec("DELETE FROM records_long_term").Error; err != nil {
 		return err
 	}
+	if err := db.Exec("DELETE FROM gpu_records_long_term").Error; err != nil {
+		return err
+	}
+	if err := db.Exec("DELETE FROM gpu_records").Error; err != nil {
+		return err
+	}
 	return db.Exec("DELETE FROM records").Error
 }
 
+// GetGPURecordsByClientAndTime 获取GPU记录数据
+func GetGPURecordsByClientAndTime(uuid string, start, end time.Time) ([]models.GPURecord, error) {
+	db := dbcore.GetDBInstance()
+	var records []models.GPURecord
+
+	fourHoursAgo := time.Now().Add(-4*time.Hour - time.Minute)
+
+	var recentRecords []models.GPURecord
+	recentStart := start
+	if end.After(fourHoursAgo) {
+		if recentStart.Before(fourHoursAgo) {
+			recentStart = fourHoursAgo
+		}
+		err := db.Where("client = ? AND time >= ? AND time <= ?", uuid, recentStart, end).
+			Order("time ASC, device_index ASC").Find(&recentRecords).Error
+		if err != nil {
+			log.Printf("Error fetching recent GPU records for client %s between %s and %s: %v", uuid, recentStart, end, err)
+			return nil, err
+		}
+	}
+
+	var longTermRecords []models.GPURecord
+	err := db.Table("gpu_records_long_term").Where("client = ? AND time >= ? AND time <= ?", uuid, start, end).
+		Order("time ASC, device_index ASC").Find(&longTermRecords).Error
+	if err != nil {
+		log.Printf("Error fetching long-term GPU records for client %s between %s and %s: %v", uuid, start, end, err)
+		return recentRecords, nil
+	}
+
+	// 合并结果 - 不再需要类型转换
+	records = append(records, recentRecords...)
+	records = append(records, longTermRecords...)
+
+	return records, nil
+}
+
 func GetLatestRecord(uuid string) (Record []models.Record, err error) {
 	db := dbcore.GetDBInstance()
 	err = db.Where("client = ?", uuid).Order("time DESC").Limit(1).Find(&Record).Error
@@ -35,6 +84,8 @@ func GetLatestRecord(uuid string) (Record []models.Record, err error) {
 func DeleteRecordBefore(before time.Time) error {
 	db := dbcore.GetDBInstance()
 	db.Table("records_long_term").Where("time < ?", before).Delete(&models.Record{})
+	db.Table("gpu_records_long_term").Where("time < ?", before).Delete(&models.GPURecord{})
+	db.Where("time < ?", before).Delete(&models.GPURecord{})
 	return db.Where("time < ?", before).Delete(&models.Record{}).Error
 }
 
@@ -42,49 +93,50 @@ func GetRecordsByClientAndTime(uuid string, start, end time.Time) ([]models.Reco
 	db := dbcore.GetDBInstance()
 	var records []models.Record
 
-	threeHoursAgo := time.Now().Add(-3 * time.Hour)
-	interval := end.Sub(start)
+	fourHoursAgo := time.Now().Add(-4*time.Hour - time.Minute)
 
-	if end.After(threeHoursAgo) {
-		var recentRecords []models.Record
-		recentStart := start
-		if recentStart.Before(threeHoursAgo) {
-			recentStart = threeHoursAgo
+	var recentRecords []models.Record
+	recentStart := start
+	if end.After(fourHoursAgo) {
+		if recentStart.Before(fourHoursAgo) {
+			recentStart = fourHoursAgo
 		}
 		err := db.Where("client = ? AND time >= ? AND time <= ?", uuid, recentStart, end).Order("time ASC").Find(&recentRecords).Error
 		if err != nil {
 			log.Printf("Error fetching recent records for client %s between %s and %s: %v", uuid, recentStart, end, err)
 			return nil, err
 		}
-		if interval > 4*time.Hour {
-			// 按15分钟分组，每组只保留一条（取最新一条）
-			grouped := make(map[string]models.Record)
-			for _, rec := range recentRecords {
-				key := rec.Time.Truncate(15 * time.Minute).Format(time.RFC3339)
-				if old, ok := grouped[key]; !ok || rec.Time.After(old.Time) {
-					grouped[key] = rec
-				}
-			}
-			var groupedList []models.Record
-			for _, rec := range grouped {
-				groupedList = append(groupedList, rec)
-			}
-			sort.Slice(groupedList, func(i, j int) bool {
-				return groupedList[i].Time.Before(groupedList[j].Time)
-			})
-			records = append(records, groupedList...)
-		} else {
-			// 查询区间不超过，直接返回全部recentRecords
-			records = append(records, recentRecords...)
-		}
 	}
 
 	var long_term []models.Record
 	err := db.Table("records_long_term").Where("client = ? AND time >= ? AND time <= ?", uuid, start, end).Order("time ASC").Find(&long_term).Error
 	if err != nil {
 		log.Printf("Error fetching long-term records for client %s between %s and %s: %v", uuid, start, end, err)
+		return recentRecords, nil
+	}
+
+	if len(long_term) == 0 {
+		// 没有查到long_term，返回全部recentRecords
+		records = append(records, recentRecords...)
 		return records, nil
 	}
+
+	// 查到了long_term，recentRecords按15分钟分组，每组只保留一条（取最新一条）
+	grouped := make(map[string]models.Record)
+	for _, rec := range recentRecords {
+		key := rec.Time.ToTime().Truncate(15 * time.Minute).Format(time.RFC3339)
+		if old, ok := grouped[key]; !ok || rec.Time.ToTime().After(old.Time.ToTime()) {
+			grouped[key] = rec
+		}
+	}
+	var groupedList []models.Record
+	for _, rec := range grouped {
+		groupedList = append(groupedList, rec)
+	}
+	sort.Slice(groupedList, func(i, j int) bool {
+		return groupedList[i].Time.ToTime().Before(groupedList[j].Time.ToTime())
+	})
+	records = append(records, groupedList...)
 	records = append(records, long_term...)
 	return records, nil
 }
@@ -116,53 +168,75 @@ func CompactRecord() error {
 		return err
 	}
 
-	if flags.DatabaseType == "sqlite" {
-		if err := db.Exec("VACUUM").Error; err != nil {
-			log.Printf("Error vacuuming database: %v", err)
-		}
+	err = migrateGPURecords(db)
+	if err != nil {
+		log.Printf("Error migrating GPU records: %v", err)
+		return err
 	}
-	log.Printf("Record compaction completed")
+
+	if flags.IsSQLite() {
+		db.Exec("PRAGMA wal_checkpoint(PASSIVE);")
+	}
+	//log.Printf("Record compaction completed")
 	return nil
 }
 
 func migrateOldRecords(db *gorm.DB) error {
-	// 计算 4 小时前的时间
-	fourHoursAgo := time.Now().Add(-4 * time.Hour)
+	return migrateOldRecordsAt(db, time.Now())
+}
+
+func compactRecordCutoff(now time.Time) time.Time {
+	return now.Add(-4 * time.Hour).Truncate(15 * time.Minute)
+}
+
+func migrateOldRecordsAt(db *gorm.DB, now time.Time) error {
+	cutoff := compactRecordCutoff(now)
 
 	// 查询 records 表中超过 4 小时的记录
 	var records []models.Record
-	if err := db.Table("records").Where("time < ?", fourHoursAgo).Find(&records).Error; err != nil {
+	if err := db.Table("records").Where("time < ?", cutoff).Find(&records).Error; err != nil {
 		return err
 	}
 
 	if len(records) == 0 {
 		return nil
 	}
+	previousByClient, err := getPreviousTrafficRecordsBefore(db, records)
+	if err != nil {
+		return err
+	}
+	repairZeroTrafficDeltas(records, previousByClient)
 
 	// 按 Client 和 15 分钟时间段分组，并存储所有记录以计算分位数
 	type groupData struct {
-		Cpu            []float32
-		Gpu            []float32
-		Load           []float32
-		Temp           []float32
-		Ram            []int64
-		RamTotal       []int64
-		Swap           []int64
-		SwapTotal      []int64
-		Disk           []int64
-		DiskTotal      []int64
-		NetIn          []int64
-		NetOut         []int64
-		NetTotalUp     []int64
-		NetTotalDown   []int64
-		Process        []int
-		Connections    []int
-		ConnectionsUdp []int
+		Cpu             []float32
+		Gpu             []float32
+		Load            []float32
+		Temp            []float32
+		Ram             []int64
+		RamTotal        []int64
+		Swap            []int64
+		SwapTotal       []int64
+		Disk            []int64
+		DiskTotal       []int64
+		NetIn           []int64
+		NetOut          []int64
+		NetTotalUp      []int64
+		NetTotalDown    []int64
+		TrafficUp       int64
+		TrafficDown     int64
+		LatestTime      time.Time
+		LatestTotalUp   int64
+		LatestTotalDown int64
+		Process         []int
+		Connections     []int
+		ConnectionsUdp  []int
+		Uptime          []int64
 	}
 
 	groupedRecords := make(map[string]*groupData)
 	for _, record := range records {
-		key := record.Client + "_" + record.Time.Truncate(15*time.Minute).Format(time.RFC3339)
+		key := record.Client + "_" + record.Time.ToTime().Truncate(15*time.Minute).Format(time.RFC3339)
 		if _, ok := groupedRecords[key]; !ok {
 			groupedRecords[key] = &groupData{}
 		}
@@ -181,9 +255,17 @@ func migrateOldRecords(db *gorm.DB) error {
 		data.NetOut = append(data.NetOut, record.NetOut)
 		data.NetTotalUp = append(data.NetTotalUp, record.NetTotalUp)
 		data.NetTotalDown = append(data.NetTotalDown, record.NetTotalDown)
+		data.TrafficUp += record.TrafficUp
+		data.TrafficDown += record.TrafficDown
+		if data.LatestTime.IsZero() || record.Time.ToTime().After(data.LatestTime) {
+			data.LatestTime = record.Time.ToTime()
+			data.LatestTotalUp = record.NetTotalUp
+			data.LatestTotalDown = record.NetTotalDown
+		}
 		data.Process = append(data.Process, record.Process)
 		data.Connections = append(data.Connections, record.Connections)
 		data.ConnectionsUdp = append(data.ConnectionsUdp, record.ConnectionsUdp)
+		//data.Uptime = append(data.Uptime, record.Uptime)
 	}
 
 	getPercentile := func(values []float64, percentile float64) float64 {
@@ -250,7 +332,8 @@ func migrateOldRecords(db *gorm.DB) error {
 			for i, v := range data.Temp {
 				tempFloats[i] = float64(v)
 			}
-			high_percentile := 0.8
+			// 取高位
+			high_percentile := 0.7
 			// 检查 records_long_term 表中是否已存在相同的记录
 			var existingCount int64
 			if err := tx.Table("records_long_term").Where("client = ? AND time = ?", clientUUID, timeSlot).Count(&existingCount).Error; err != nil {
@@ -259,7 +342,7 @@ func migrateOldRecords(db *gorm.DB) error {
 
 			newRec := models.Record{
 				Client:         clientUUID,
-				Time:           timeSlot,
+				Time:           models.FromTime(timeSlot),
 				Cpu:            float32(getPercentile(cpuFloats, high_percentile)),
 				Gpu:            float32(getPercentile(gpuFloats, high_percentile)),
 				Load:           float32(getPercentile(loadFloats, high_percentile)),
@@ -270,13 +353,16 @@ func migrateOldRecords(db *gorm.DB) error {
 				SwapTotal:      getIntPercentile(data.SwapTotal, high_percentile),
 				Disk:           getIntPercentile(data.Disk, high_percentile),
 				DiskTotal:      getIntPercentile(data.DiskTotal, high_percentile),
-				NetIn:          getIntPercentile(data.NetIn, high_percentile),
-				NetOut:         getIntPercentile(data.NetOut, high_percentile),
-				NetTotalUp:     getIntPercentile(data.NetTotalUp, high_percentile),
-				NetTotalDown:   getIntPercentile(data.NetTotalDown, high_percentile),
+				NetIn:          getIntPercentile(data.NetIn, 0.2),
+				NetOut:         getIntPercentile(data.NetOut, 0.2),
+				NetTotalUp:     data.LatestTotalUp,
+				NetTotalDown:   data.LatestTotalDown,
+				TrafficUp:      data.TrafficUp,
+				TrafficDown:    data.TrafficDown,
 				Process:        getInt32Percentile(data.Process, high_percentile),
 				Connections:    getInt32Percentile(data.Connections, high_percentile),
 				ConnectionsUdp: getInt32Percentile(data.ConnectionsUdp, high_percentile),
+				//Uptime:         getIntPercentile(data.Uptime, high_percentile),
 			}
 
 			// 如果记录已存在则更新，否则创建新记录
@@ -292,7 +378,229 @@ func migrateOldRecords(db *gorm.DB) error {
 		}
 
 		// 删除 records 表中的旧数据
-		if err := tx.Table("records").Where("time < ?", fourHoursAgo).Delete(&models.Record{}).Error; err != nil {
+		if err := tx.Table("records").Where("time < ?", cutoff.Add(-1*time.Hour)).Delete(&models.Record{}).Error; err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
+
+func getPreviousTrafficRecordsBefore(db *gorm.DB, records []models.Record) (map[string]*models.Record, error) {
+	firstTimeByClient := make(map[string]time.Time)
+	for _, record := range records {
+		recordTime := record.Time.ToTime()
+		firstTime, ok := firstTimeByClient[record.Client]
+		if !ok || recordTime.Before(firstTime) {
+			firstTimeByClient[record.Client] = recordTime
+		}
+	}
+
+	previousByClient := make(map[string]*models.Record, len(firstTimeByClient))
+	for clientUUID, firstTime := range firstTimeByClient {
+		previous, err := getPreviousTrafficRecordBefore(db, clientUUID, firstTime)
+		if err != nil {
+			return nil, err
+		}
+		if previous != nil {
+			previousByClient[clientUUID] = previous
+		}
+	}
+	return previousByClient, nil
+}
+
+func getPreviousTrafficRecordBefore(db *gorm.DB, clientUUID string, before time.Time) (*models.Record, error) {
+	var latest *models.Record
+	for _, table := range []string{"records", "records_long_term"} {
+		var record models.Record
+		queryBefore := before
+		if table == "records_long_term" {
+			queryBefore = before.Truncate(15 * time.Minute)
+		}
+		err := db.Table(table).
+			Where("client = ? AND time < ?", clientUUID, models.FromTime(queryBefore)).
+			Order("time DESC").
+			First(&record).Error
+		if err == nil {
+			if latest == nil || record.Time.ToTime().After(latest.Time.ToTime()) {
+				latest = &record
+			}
+			continue
+		}
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, err
+		}
+	}
+	return latest, nil
+}
+
+func repairZeroTrafficDeltas(records []models.Record, previousByClient map[string]*models.Record) {
+	recordsByClient := make(map[string][]*models.Record)
+	for i := range records {
+		recordsByClient[records[i].Client] = append(recordsByClient[records[i].Client], &records[i])
+	}
+
+	for _, clientRecords := range recordsByClient {
+		sort.Slice(clientRecords, func(i, j int) bool {
+			return clientRecords[i].Time.ToTime().Before(clientRecords[j].Time.ToTime())
+		})
+		var previous *models.Record
+		if previousByClient != nil {
+			previous = previousByClient[clientRecords[0].Client]
+		}
+		for _, current := range clientRecords {
+			if previous == nil {
+				previous = current
+				continue
+			}
+			if current.TrafficUp == 0 {
+				current.TrafficUp = utils.ComputeTrafficDelta(current.NetTotalUp, previous.NetTotalUp)
+			}
+			if current.TrafficDown == 0 {
+				current.TrafficDown = utils.ComputeTrafficDelta(current.NetTotalDown, previous.NetTotalDown)
+			}
+			previous = current
+		}
+	}
+}
+
+// migrateGPURecords 压缩GPU记录数据
+func migrateGPURecords(db *gorm.DB) error {
+	cutoff := compactRecordCutoff(time.Now())
+
+	// 查询超过4小时的GPU记录
+	var gpuRecords []models.GPURecord
+	if err := db.Where("time < ?", cutoff).Find(&gpuRecords).Error; err != nil {
+		return err
+	}
+
+	if len(gpuRecords) == 0 {
+		return nil
+	}
+
+	// 按Client + DeviceIndex + 15分钟时间窗口分组
+	type gpuGroupKey struct {
+		Client      string
+		DeviceIndex int
+		TimeSlot    time.Time
+		DeviceName  string
+	}
+
+	type gpuGroupData struct {
+		MemTotal    []int64
+		MemUsed     []int64
+		Utilization []float32
+		Temperature []int
+	}
+
+	groupedGPUs := make(map[gpuGroupKey]*gpuGroupData)
+
+	for _, record := range gpuRecords {
+		key := gpuGroupKey{
+			Client:      record.Client,
+			DeviceIndex: record.DeviceIndex,
+			TimeSlot:    record.Time.ToTime().Truncate(15 * time.Minute),
+			DeviceName:  record.DeviceName,
+		}
+
+		if _, ok := groupedGPUs[key]; !ok {
+			groupedGPUs[key] = &gpuGroupData{}
+		}
+
+		data := groupedGPUs[key]
+		data.MemTotal = append(data.MemTotal, record.MemTotal)
+		data.MemUsed = append(data.MemUsed, record.MemUsed)
+		data.Utilization = append(data.Utilization, record.Utilization)
+		data.Temperature = append(data.Temperature, record.Temperature)
+	}
+
+	// 百分位数计算函数 (复用传统Record压缩逻辑)
+	getPercentile := func(values []float64, percentile float64) float64 {
+		if len(values) == 0 {
+			return 0
+		}
+		sortedValues := make([]float64, len(values))
+		copy(sortedValues, values)
+		sort.Float64s(sortedValues)
+		index := float64(len(sortedValues)-1) * percentile
+		lowerIndex := int(index)
+		if lowerIndex >= len(sortedValues)-1 {
+			return sortedValues[len(sortedValues)-1]
+		}
+		frac := index - float64(lowerIndex)
+		return sortedValues[lowerIndex] + frac*(sortedValues[lowerIndex+1]-sortedValues[lowerIndex])
+	}
+
+	getIntPercentile := func(values []int64, percentile float64) int64 {
+		if len(values) == 0 {
+			return 0
+		}
+		floats := make([]float64, len(values))
+		for i, v := range values {
+			floats[i] = float64(v)
+		}
+		return int64(getPercentile(floats, percentile))
+	}
+
+	// 温度数据转换辅助函数
+	convertIntToInt64 := func(values []int) []int64 {
+		result := make([]int64, len(values))
+		for i, v := range values {
+			result[i] = int64(v)
+		}
+		return result
+	}
+
+	getFloat32Percentile := func(values []float32, percentile float64) float32 {
+		if len(values) == 0 {
+			return 0
+		}
+		floats := make([]float64, len(values))
+		for i, v := range values {
+			floats[i] = float64(v)
+		}
+		return float32(getPercentile(floats, percentile))
+	}
+
+	// 保持与传统Record压缩的一致性
+	high_percentile := 0.7
+
+	return db.Transaction(func(tx *gorm.DB) error {
+		for key, data := range groupedGPUs {
+			// 检查是否已存在记录
+			var existingCount int64
+			if err := tx.Table("gpu_records_long_term").Where("client = ? AND device_index = ? AND time = ?",
+				key.Client, key.DeviceIndex, key.TimeSlot).Count(&existingCount).Error; err != nil {
+				return err
+			}
+
+			compressedGPU := models.GPURecord{
+				Client:      key.Client,
+				DeviceIndex: key.DeviceIndex,
+				Time:        models.FromTime(key.TimeSlot),
+				DeviceName:  key.DeviceName,
+				MemTotal:    getIntPercentile(data.MemTotal, high_percentile),
+				MemUsed:     getIntPercentile(data.MemUsed, high_percentile),
+				Utilization: getFloat32Percentile(data.Utilization, high_percentile),
+				Temperature: int(getIntPercentile(convertIntToInt64(data.Temperature), high_percentile)),
+			}
+
+			if existingCount > 0 {
+				// 更新已存在记录
+				if err := tx.Table("gpu_records_long_term").Where("client = ? AND device_index = ? AND time = ?",
+					key.Client, key.DeviceIndex, key.TimeSlot).Updates(&compressedGPU).Error; err != nil {
+					return err
+				}
+			} else {
+				// 创建新记录
+				if err := tx.Table("gpu_records_long_term").Create(&compressedGPU).Error; err != nil {
+					return err
+				}
+			}
+		}
+
+		// 删除已压缩的原始GPU数据
+		if err := tx.Where("time < ?", cutoff.Add(-1*time.Hour)).Delete(&models.GPURecord{}).Error; err != nil {
 			return err
 		}
 

database/records/records_test.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 
@@ -25,8 +26,10 @@ var _ = func() bool {
 // then running migrateOldRecords and verifying the aggregation and cleanup.
 func TestCompactRecord(t *testing.T) {
 	const totalMinutes = 12*60 + 30
-	now := time.Now()
-	threshold := now.Add(-4 * time.Hour)
+	loc := models.GetAppLocation()
+	now := time.Date(2026, 6, 15, 14, 30, 0, 0, loc)
+	threshold := compactRecordCutoff(now)
+	overlapCutoff := threshold.Add(-1 * time.Hour)
 
 	// 使用 sqlite 内存数据库并迁移表结构
 	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
@@ -35,20 +38,21 @@ func TestCompactRecord(t *testing.T) {
 	assert.NoError(t, db.Table("records_long_term").AutoMigrate(&models.Record{}))
 
 	expectedGroups := make(map[time.Time]struct{})
-	expectedRemain := 0
+	expectedRawRemain := 0
 
 	// 插入数据
 	for i := 0; i < totalMinutes; i++ {
 		recTime := now.Add(-time.Duration(i) * time.Minute)
-		rec := models.Record{Client: uuid, Time: recTime, Cpu: float32(i), Gpu: float32(i), Load: float32(i), Temp: float32(i), Ram: int64(i)}
+		rec := models.Record{Client: uuid, Time: models.FromTime(recTime), Cpu: float32(i), Gpu: float32(i), Load: float32(i), Temp: float32(i), Ram: int64(i)}
 		err := db.Create(&rec).Error
 		assert.NoError(t, err)
 
 		if recTime.Before(threshold) {
-			slot := recTime.Truncate(time.Hour)
+			slot := recTime.Truncate(15 * time.Minute)
 			expectedGroups[slot] = struct{}{}
-		} else {
-			expectedRemain++
+		}
+		if !recTime.Before(overlapCutoff) {
+			expectedRawRemain++
 		}
 	}
 
@@ -65,7 +69,7 @@ func TestCompactRecord(t *testing.T) {
 	for _, r := range origRecs {
 		wOrig.Write([]string{
 			r.Client,
-			r.Time.Format(time.RFC3339),
+			r.Time.ToTime().Format(time.RFC3339),
 			strconv.FormatFloat(float64(r.Cpu), 'f', -1, 32),
 			strconv.FormatFloat(float64(r.Gpu), 'f', -1, 32),
 			strconv.FormatFloat(float64(r.Load), 'f', -1, 32),
@@ -75,7 +79,7 @@ func TestCompactRecord(t *testing.T) {
 	}
 
 	// 运行压缩（迁移）逻辑
-	err = migrateOldRecords(db)
+	err = migrateOldRecordsAt(db, now)
 	assert.NoError(t, err)
 
 	// 验证 long-term 表中的聚合记录数
@@ -86,7 +90,7 @@ func TestCompactRecord(t *testing.T) {
 	// 验证原始表中剩余记录数
 	var remainCount int64
 	assert.NoError(t, db.Table("records").Count(&remainCount).Error)
-	assert.Equal(t, int64(expectedRemain), remainCount+1)
+	assert.Equal(t, int64(expectedRawRemain), remainCount)
 
 	// 导出压缩后的数据到 CSV
 	var compRecs []models.Record
@@ -100,7 +104,7 @@ func TestCompactRecord(t *testing.T) {
 	for _, r := range compRecs {
 		wComp.Write([]string{
 			r.Client,
-			r.Time.Format(time.RFC3339),
+			r.Time.ToTime().Format(time.RFC3339),
 			strconv.FormatFloat(float64(r.Cpu), 'f', -1, 32),
 			strconv.FormatFloat(float64(r.Gpu), 'f', -1, 32),
 			strconv.FormatFloat(float64(r.Load), 'f', -1, 32),
@@ -119,7 +123,7 @@ func TestCompactRecord(t *testing.T) {
 	for _, r := range compRecs {
 		wComp.Write([]string{
 			r.Client,
-			r.Time.Format(time.RFC3339),
+			r.Time.ToTime().Format(time.RFC3339),
 			strconv.FormatFloat(float64(r.Cpu), 'f', -1, 32),
 			strconv.FormatFloat(float64(r.Gpu), 'f', -1, 32),
 			strconv.FormatFloat(float64(r.Load), 'f', -1, 32),
@@ -128,3 +132,190 @@ func TestCompactRecord(t *testing.T) {
 		})
 	}
 }
+
+func TestCompactRecordPreservesExactTrafficDelta(t *testing.T) {
+	loc := models.GetAppLocation()
+	currentTime := time.Date(2026, 6, 15, 14, 30, 0, 0, loc)
+	now := currentTime.Truncate(15 * time.Minute).Add(-5*time.Hour + time.Minute)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	assert.NoError(t, err)
+	assert.NoError(t, db.AutoMigrate(&models.Record{}))
+	assert.NoError(t, db.Table("records_long_term").AutoMigrate(&models.Record{}))
+
+	records := []models.Record{
+		{
+			Client:       uuid,
+			Time:         models.FromTime(now),
+			NetTotalUp:   100,
+			NetTotalDown: 200,
+			TrafficUp:    0,
+			TrafficDown:  0,
+		},
+		{
+			Client:       uuid,
+			Time:         models.FromTime(now.Add(5 * time.Minute)),
+			NetTotalUp:   150,
+			NetTotalDown: 260,
+			TrafficUp:    50,
+			TrafficDown:  60,
+		},
+		{
+			Client:       uuid,
+			Time:         models.FromTime(now.Add(10 * time.Minute)),
+			NetTotalUp:   10,
+			NetTotalDown: 30,
+			TrafficUp:    10,
+			TrafficDown:  30,
+		},
+	}
+
+	for _, rec := range records {
+		assert.NoError(t, db.Create(&rec).Error)
+	}
+
+	assert.NoError(t, migrateOldRecordsAt(db, currentTime))
+
+	var compacted []models.Record
+	assert.NoError(t, db.Table("records_long_term").Find(&compacted).Error)
+	require.Len(t, compacted, 1)
+	assert.Equal(t, int64(60), compacted[0].TrafficUp)
+	assert.Equal(t, int64(90), compacted[0].TrafficDown)
+	assert.Equal(t, int64(10), compacted[0].NetTotalUp)
+	assert.Equal(t, int64(30), compacted[0].NetTotalDown)
+	assert.True(t, compacted[0].Time.ToTime().Equal(records[2].Time.ToTime().Truncate(15*time.Minute)))
+}
+
+func TestRepairZeroTrafficDeltasPreservesRawResetDetailBeforeCompaction(t *testing.T) {
+	loc := models.GetAppLocation()
+	start := time.Date(2026, 6, 6, 0, 0, 0, 0, loc)
+	records := []models.Record{
+		{Client: uuid, Time: models.FromTime(start), NetTotalUp: 100, NetTotalDown: 200},
+		{Client: uuid, Time: models.FromTime(start.Add(5 * time.Minute)), NetTotalUp: 140, NetTotalDown: 260},
+		{Client: uuid, Time: models.FromTime(start.Add(10 * time.Minute)), NetTotalUp: 10, NetTotalDown: 20},
+		{Client: uuid, Time: models.FromTime(start.Add(15 * time.Minute)), NetTotalUp: 25, NetTotalDown: 35},
+	}
+
+	repairZeroTrafficDeltas(records, nil)
+
+	assert.Equal(t, int64(0), records[0].TrafficUp)
+	assert.Equal(t, int64(0), records[0].TrafficDown)
+	assert.Equal(t, int64(40), records[1].TrafficUp)
+	assert.Equal(t, int64(60), records[1].TrafficDown)
+	assert.Equal(t, int64(10), records[2].TrafficUp)
+	assert.Equal(t, int64(20), records[2].TrafficDown)
+	assert.Equal(t, int64(15), records[3].TrafficUp)
+	assert.Equal(t, int64(15), records[3].TrafficDown)
+}
+
+func TestRepairZeroTrafficDeltasUsesPreviousPersistedBaseline(t *testing.T) {
+	loc := models.GetAppLocation()
+	now := time.Date(2026, 6, 7, 12, 0, 0, 0, loc)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	assert.NoError(t, err)
+	assert.NoError(t, db.AutoMigrate(&models.Record{}))
+	assert.NoError(t, db.Table("records_long_term").AutoMigrate(&models.Record{}))
+
+	assert.NoError(t, db.Table("records_long_term").Create(&models.Record{
+		Client:       uuid,
+		Time:         models.FromTime(now.Add(-10 * time.Minute)),
+		NetTotalUp:   100,
+		NetTotalDown: 200,
+	}).Error)
+
+	rawRecords := []models.Record{
+		{Client: uuid, Time: models.FromTime(now), NetTotalUp: 150, NetTotalDown: 260},
+		{Client: uuid, Time: models.FromTime(now.Add(5 * time.Minute)), NetTotalUp: 175, NetTotalDown: 300},
+	}
+
+	previousByClient, err := getPreviousTrafficRecordsBefore(db, rawRecords)
+	assert.NoError(t, err)
+	repairZeroTrafficDeltas(rawRecords, previousByClient)
+
+	assert.Equal(t, int64(50), rawRecords[0].TrafficUp)
+	assert.Equal(t, int64(60), rawRecords[0].TrafficDown)
+	assert.Equal(t, int64(25), rawRecords[1].TrafficUp)
+	assert.Equal(t, int64(40), rawRecords[1].TrafficDown)
+}
+
+func TestRepairZeroTrafficDeltasIgnoresSameSlotLongTermBaseline(t *testing.T) {
+	loc := models.GetAppLocation()
+	now := time.Date(2026, 6, 7, 12, 0, 30, 0, loc)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	assert.NoError(t, err)
+	assert.NoError(t, db.AutoMigrate(&models.Record{}))
+	assert.NoError(t, db.Table("records_long_term").AutoMigrate(&models.Record{}))
+
+	assert.NoError(t, db.Table("records_long_term").Create(&models.Record{
+		Client:       uuid,
+		Time:         models.FromTime(now.Truncate(15 * time.Minute)),
+		NetTotalUp:   900,
+		NetTotalDown: 900,
+	}).Error)
+
+	rawRecords := []models.Record{
+		{Client: uuid, Time: models.FromTime(now), NetTotalUp: 150, NetTotalDown: 260},
+		{Client: uuid, Time: models.FromTime(now.Add(5 * time.Minute)), NetTotalUp: 175, NetTotalDown: 300},
+	}
+
+	previousByClient, err := getPreviousTrafficRecordsBefore(db, rawRecords)
+	assert.NoError(t, err)
+	repairZeroTrafficDeltas(rawRecords, previousByClient)
+
+	assert.Equal(t, int64(0), rawRecords[0].TrafficUp)
+	assert.Equal(t, int64(0), rawRecords[0].TrafficDown)
+	assert.Equal(t, int64(25), rawRecords[1].TrafficUp)
+	assert.Equal(t, int64(40), rawRecords[1].TrafficDown)
+}
+
+func TestCompactRecordRetainsOneHourOverlapWindow(t *testing.T) {
+	loc := models.GetAppLocation()
+	now := time.Date(2026, 6, 7, 12, 7, 0, 0, loc)
+	cutoff := compactRecordCutoff(now)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	assert.NoError(t, err)
+	assert.NoError(t, db.AutoMigrate(&models.Record{}))
+	assert.NoError(t, db.Table("records_long_term").AutoMigrate(&models.Record{}))
+
+	records := []models.Record{
+		{Client: uuid, Time: models.FromTime(cutoff.Add(-time.Hour - time.Minute)), TrafficUp: 5},
+		{Client: uuid, Time: models.FromTime(cutoff.Add(-30 * time.Minute)), TrafficUp: 7},
+		{Client: uuid, Time: models.FromTime(now.Add(-3 * time.Hour)), TrafficUp: 11},
+	}
+	for _, rec := range records {
+		assert.NoError(t, db.Create(&rec).Error)
+	}
+
+	assert.NoError(t, migrateOldRecordsAt(db, now))
+
+	var remainTimes []models.Record
+	assert.NoError(t, db.Table("records").Order("time ASC").Find(&remainTimes).Error)
+	require.Len(t, remainTimes, 2)
+	assert.True(t, remainTimes[0].Time.ToTime().Equal(records[1].Time.ToTime()))
+	assert.True(t, remainTimes[1].Time.ToTime().Equal(records[2].Time.ToTime()))
+}
+
+func TestCompactRecordOnlyMigratesCompleteFifteenMinuteBuckets(t *testing.T) {
+	loc := models.GetAppLocation()
+	now := time.Date(2026, 6, 7, 12, 7, 0, 0, loc)
+	cutoff := compactRecordCutoff(now)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	assert.NoError(t, err)
+	assert.NoError(t, db.AutoMigrate(&models.Record{}))
+	assert.NoError(t, db.Table("records_long_term").AutoMigrate(&models.Record{}))
+
+	compactable := models.Record{Client: uuid, Time: models.FromTime(cutoff.Add(-time.Minute)), TrafficUp: 5}
+	partialSlot := models.Record{Client: uuid, Time: models.FromTime(cutoff.Add(time.Minute)), TrafficUp: 7}
+	assert.NoError(t, db.Create(&compactable).Error)
+	assert.NoError(t, db.Create(&partialSlot).Error)
+
+	assert.NoError(t, migrateOldRecordsAt(db, now))
+
+	var compacted []models.Record
+	assert.NoError(t, db.Table("records_long_term").Order("time ASC").Find(&compacted).Error)
+	require.Len(t, compacted, 1)
+	assert.True(t, compacted[0].Time.ToTime().Equal(compactable.Time.ToTime().Truncate(15*time.Minute)))
+
+	var rawCount int64
+	assert.NoError(t, db.Table("records").Where("time = ?", partialSlot.Time).Count(&rawCount).Error)
+	assert.Equal(t, int64(1), rawCount)
+}

database/tasks/ping.go

@@ -9,16 +9,35 @@ import (
 	"gorm.io/gorm"
 )
 
-func AddPingTask(clients []string, name string, target, task_type string, interval int) (uint, error) {
+// AddPingTask 创建延迟监测任务。defaultOn 表示新加入的服务器是否自动开启此监测。
+func AddPingTask(clients []string, defaultOn bool, name string, target, task_type string, interval int) (uint, error) {
 	db := dbcore.GetDBInstance()
+	normalizedClients := normalizePingClients(models.StringArray(clients))
 	task := models.PingTask{
-		Clients:  clients,
-		Name:     name,
-		Type:     task_type,
-		Target:   target,
-		Interval: interval,
+		Clients:   normalizedClients,
+		DefaultOn: defaultOn,
+		Name:      name,
+		Type:      task_type,
+		Target:    target,
+		Interval:  interval,
 	}
-	if err := db.Create(&task).Error; err != nil {
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Create(&task).Error; err != nil {
+			return err
+		}
+
+		// Append by id to avoid races between concurrent create requests.
+		result := tx.Model(&models.PingTask{}).Where("id = ?", task.Id).Update("weight", int(task.Id))
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected == 0 {
+			return gorm.ErrRecordNotFound
+		}
+
+		return nil
+	})
+	if err != nil {
 		return 0, err
 	}
 	ReloadPingSchedule()
@@ -35,10 +54,21 @@ func DeletePingTask(id []uint) error {
 	return result.Error
 }
 
+// EditPingTask 批量更新延迟监测任务配置。
 func EditPingTask(tasks []*models.PingTask) error {
 	db := dbcore.GetDBInstance()
 	for _, task := range tasks {
-		result := db.Model(&models.PingTask{}).Where("id = ?", task.Id).Updates(task)
+		task.Clients = normalizePingClients(task.Clients)
+		// 使用 map 显式更新，避免 GORM struct Updates 跳过 false/0/空切片等零值。
+		updates := map[string]interface{}{
+			"name":        task.Name,
+			"clients":     task.Clients,
+			"all_clients": task.DefaultOn,
+			"type":        task.Type,
+			"target":      task.Target,
+			"interval":    task.Interval,
+		}
+		result := db.Model(&models.PingTask{}).Where("id = ?", task.Id).Updates(updates)
 		if result.RowsAffected == 0 {
 			return gorm.ErrRecordNotFound
 		}
@@ -47,29 +77,59 @@ func EditPingTask(tasks []*models.PingTask) error {
 	return nil
 }
 
+// normalizePingClients 保持 clients 字段序列化为 JSON 数组，避免空值变成 null。
+func normalizePingClients(clients models.StringArray) models.StringArray {
+	if clients == nil {
+		return models.StringArray{}
+	}
+	return clients
+}
+
 func GetAllPingTasks() ([]models.PingTask, error) {
 	db := dbcore.GetDBInstance()
 	var tasks []models.PingTask
-	if err := db.Find(&tasks).Error; err != nil {
+	if err := db.Order("weight ASC").Order("id ASC").Find(&tasks).Error; err != nil {
 		return nil, err
 	}
 	return tasks, nil
 }
 
+// GetPingTasksByClient 获取指定服务器需要执行的延迟监测任务。
+func GetPingTasksByClient(uuid string) []models.PingTask {
+	db := dbcore.GetDBInstance()
+	var tasks []models.PingTask
+	if err := db.Where("clients LIKE ?", `%"`+uuid+`"%`).Find(&tasks).Error; err != nil {
+		return nil
+	}
+	return tasks
+}
+
+func UpdatePingTaskOrder(order map[uint]int) error {
+	db := dbcore.GetDBInstance()
+	err := db.Transaction(func(tx *gorm.DB) error {
+		for id, weight := range order {
+			result := tx.Model(&models.PingTask{}).Where("id = ?", id).Update("weight", weight)
+			if result.Error != nil {
+				return result.Error
+			}
+			if result.RowsAffected == 0 {
+				return gorm.ErrRecordNotFound
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	ReloadPingSchedule()
+	return nil
+}
+
 func SavePingRecord(record models.PingRecord) error {
 	db := dbcore.GetDBInstance()
 	return db.Create(&record).Error
 }
 
-func GetPingRecords(client string) ([]models.PingRecord, error) {
-	db := dbcore.GetDBInstance()
-	var records []models.PingRecord
-	if err := db.Where("client = ?", client).Order("time DESC").Find(&records).Error; err != nil {
-		return nil, err
-	}
-	return records, nil
-}
-
 func DeletePingRecordsBefore(time time.Time) error {
 	db := dbcore.GetDBInstance()
 	err := db.Where("time < ?", time).Delete(&models.PingRecord{}).Error
@@ -85,6 +145,14 @@ func DeletePingRecords(id []uint) error {
 	return result.Error
 }
 
+func DeleteAllPingRecords() error {
+	db := dbcore.GetDBInstance()
+	result := db.Exec("DELETE FROM ping_records")
+	if result.RowsAffected == 0 {
+		return gorm.ErrRecordNotFound
+	}
+	return result.Error
+}
 func ReloadPingSchedule() error {
 	db := dbcore.GetDBInstance()
 	var pingTasks []models.PingTask
@@ -93,10 +161,56 @@ func ReloadPingSchedule() error {
 	}
 	return utils.ReloadPingSchedule(pingTasks)
 }
-func GetPingRecordsByClientAndTime(uuid string, start, end time.Time) ([]models.PingRecord, error) {
+
+// AddDefaultOnClientUUID 在新客户端注册后，把该 UUID 追加到所有 default_on=true 的任务的 clients 中（去重）。
+func AddDefaultOnClientUUID(uuid string) error {
+	if uuid == "" {
+		return nil
+	}
+	db := dbcore.GetDBInstance()
+	var tasks []models.PingTask
+	if err := db.Where("all_clients = ?", true).Find(&tasks).Error; err != nil {
+		return err
+	}
+	if len(tasks) == 0 {
+		return nil
+	}
+	changed := false
+	for _, task := range tasks {
+		exists := false
+		for _, c := range task.Clients {
+			if c == uuid {
+				exists = true
+				break
+			}
+		}
+		if exists {
+			continue
+		}
+		next := append(models.StringArray{}, task.Clients...)
+		next = append(next, uuid)
+		if err := db.Model(&models.PingTask{}).Where("id = ?", task.Id).Update("clients", next).Error; err != nil {
+			return err
+		}
+		changed = true
+	}
+	if changed {
+		return ReloadPingSchedule()
+	}
+	return nil
+}
+
+func GetPingRecords(uuid string, taskId int, start, end time.Time) ([]models.PingRecord, error) {
 	db := dbcore.GetDBInstance()
 	var records []models.PingRecord
-	if err := db.Where("client = ? AND time >= ? AND time <= ?", uuid, start, end).Order("time DESC").Find(&records).Error; err != nil {
+	dbQuery := db.Model(&models.PingRecord{})
+	if uuid != "" {
+		dbQuery = dbQuery.Where("client = ?", uuid)
+	}
+	if taskId >= 0 {
+		dbQuery = dbQuery.Where("task_id = ?", uint(taskId))
+	}
+	if err := dbQuery.Where("time >= ? AND time <= ?", start, end).Order("time DESC").Find(&records).Error; err != nil {
 		return nil, err
 	}
 	return records, nil

database/tasks/tasks.go

@@ -26,7 +26,7 @@ func CreateTask(taskId string, clients []string, command string) error {
 			Result:     "",
 			ExitCode:   nil,
 			FinishedAt: nil,
-			CreatedAt:  time.Now(),
+			CreatedAt:  models.FromTime(time.Now()),
 		})
 	}
 	if len(taskResults) > 0 {
@@ -83,7 +83,7 @@ func DeleteTaskByTaskId(taskId string) error {
 	return dbcore.GetDBInstance().Where("task_id = ?", taskId).Delete(&models.Task{}).Error
 }
 
-func SaveTaskResult(taskId, clientId, result string, exitCode int, timestamp time.Time) error {
+func SaveTaskResult(taskId, clientId, result string, exitCode int, timestamp models.LocalTime) error {
 	return dbcore.GetDBInstance().
 		Model(&models.TaskResult{}).
 		Where("task_id = ? AND client = ?", taskId, clientId).

database/utils.go

@@ -0,0 +1,145 @@
+package database
+
+import (
+	"encoding/json"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/komari-monitor/komari/database/dbcore"
+	"github.com/komari-monitor/komari/database/models"
+	"github.com/komari-monitor/komari/pkg/config"
+)
+
+func GetPublicInfo() (map[string]interface{}, error) {
+	cstPtr, err := config.GetManyAs[config.Settings]()
+	if err != nil {
+		return nil, err
+	}
+	cst := *cstPtr
+
+	all, allErr := config.GetAll()
+	hasKey := func(k string) bool {
+		if allErr != nil {
+			return false
+		}
+		_, ok := all[k]
+		return ok
+	}
+
+	// Apply defaults only when a key is missing.
+	if !hasKey("sitename") {
+		cst.Sitename = "Komari"
+	}
+	if !hasKey("description") {
+		cst.Description = "Komari Monitor, a simple server monitoring tool."
+	}
+	if !hasKey("theme") {
+		cst.Theme = "default"
+	}
+	if !hasKey("o_auth_provider") {
+		cst.OAuthProvider = "github"
+	}
+	if !hasKey("record_enabled") {
+		cst.RecordEnabled = true
+	}
+	if !hasKey("record_preserve_time") {
+		cst.RecordPreserveTime = 720
+	}
+	if !hasKey("ping_record_preserve_time") {
+		cst.PingRecordPreserveTime = 24
+	}
+
+	// Fallback defaults if we couldn't enumerate keys.
+	if allErr != nil {
+		if cst.Sitename == "" {
+			cst.Sitename = "Komari"
+		}
+		if cst.Description == "" {
+			cst.Description = "Komari Monitor, a simple server monitoring tool."
+		}
+	}
+
+	db := dbcore.GetDBInstance()
+	tc := models.ThemeConfiguration{}
+	err = db.Model(&models.ThemeConfiguration{}).Where("short = ?", cst.Theme).First(&tc).Error
+	if err != nil {
+		tc.Data = "{}"
+	}
+	tc_data := gin.H{}
+	err = json.Unmarshal([]byte(tc.Data), &tc_data)
+	if err != nil {
+		log.Printf("%v", err)
+	}
+	// Try to load theme declaration file and merge defaults for managed configuration
+	// Theme declarations live in ./data/theme/<short>/komari-theme.json
+	if cst.Theme != "" && cst.Theme != "default" {
+		themeConfigPath := filepath.Join("./data/theme", cst.Theme, "komari-theme.json")
+		if _, err := os.Stat(themeConfigPath); err == nil {
+			b, err := os.ReadFile(themeConfigPath)
+			if err == nil {
+				var themeDecl struct {
+					Configuration struct {
+						Type string                                 `json:"type"`
+						Data []models.ManagedThemeConfigurationItem `json:"data"`
+					} `json:"configuration"`
+				}
+				if err := json.Unmarshal(b, &themeDecl); err == nil {
+					if themeDecl.Configuration.Type == "managed" {
+						for _, item := range themeDecl.Configuration.Data {
+							if item.Key == "" {
+								continue
+							}
+							// missing
+							if _, exists := tc_data[item.Key]; !exists {
+								var def any = item.Default
+								// select
+								if item.Type == "select" {
+									if def == nil || def == "" {
+										if item.Options != "" {
+											opts := strings.Split(item.Options, ",")
+											if len(opts) > 0 {
+												def = strings.TrimSpace(opts[0])
+											}
+										}
+									}
+								}
+								// number->0, string->"", switch->false
+								if def == nil {
+									switch item.Type {
+									case "number":
+										def = 0
+									case "switch":
+										def = false
+									default:
+										def = ""
+									}
+								}
+								tc_data[item.Key] = def
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return gin.H{
+		"sitename":                  cst.Sitename,
+		"description":               cst.Description,
+		"custom_head":               cst.CustomHead,
+		"custom_body":               cst.CustomBody,
+		"oauth_enable":              cst.OAuthEnabled,
+		"oauth_provider":            cst.OAuthProvider,
+		"disable_password_login":    cst.DisablePasswordLogin,
+		"cors_origin_check_enabled": cst.CorsOriginCheckEnabled,
+		"record_enabled":            cst.RecordEnabled,
+		"record_preserve_time":      cst.RecordPreserveTime,
+		"ping_record_preserve_time": cst.PingRecordPreserveTime,
+		"private_site":              cst.PrivateSite,
+		"theme":                     cst.Theme,
+		"theme_settings":            tc_data,
+	}, nil
+}

docs/README_ja.md

@@ -0,0 +1,148 @@
+# Komari
+
+![Badge](https://hitscounter.dev/api/hit?url=https%3A%2F%2Fgithub.com%2Fkomari-monitor%2Fkomari&label=&icon=github&color=%23a370f7&message=&style=flat&tz=UTC)
+
+![komari](https://socialify.git.ci/komari-monitor/komari/image?description=1&font=Inter&forks=1&issues=1&language=1&logo=https%3A%2F%2Fraw.githubusercontent.com%2Fkomari-monitor%2Fkomari-web%2Fd54ce1288df41ead08aa19f8700186e68028a889%2Fpublic%2Ffavicon.png&name=1&owner=1&pattern=Plus&pulls=1&stargazers=1&theme=Auto)
+
+Komariは、サーバーのパフォーマンスを監視するためのシンプルで効率的なソリューションを提供することを目的とした、軽量の自己ホスト型サーバー監視ツールです。Webインターフェースを介してサーバーのステータスを表示し、軽量エージェントを介してデータを収集します。
+
+> [!WARNING]
+> Komariは、自己ホスト型の監視/制御プログラムであり、所有しているシステム、または管理権限を得ているシステムでのみ使用してください。Komariを武器化したり、許可なく展開、アクセス、永続化、コマンド実行、その他の不正利用に使用したりしないでください。実際の悪用リスクについては、Huntressの分析をご参照ください：[Komari C2 agent abuse](https://www.huntress.com/blog/komari-c2-agent-abuse)。
+> Komariの展開および運用方法については、利用者自身が責任を負います。開発者は、無許可または不正な利用、およびその結果について責任を負いません。
+> Windows端末でリモートコントロールを有効にした場合、クライアントはユーザーがログインするたびに、KomariがリモートコントロールソフトウェアであることをWindows通知で知らせます。
+
+[ドキュメント](https://komari-document.pages.dev/) | [Telegramグループ](https://t.me/komari_monitor)
+
+## 特徴
+
+- **軽量で効率的**: リソース消費が少なく、あらゆる規模のサーバーに適しています。
+- **自己ホスト型**: データプライバシーを完全に制御でき、展開も簡単です。
+- **Webインターフェース**: 直感的な監視ダッシュボードで、使いやすいです。
+
+## クイックスタート
+
+### 0. クラウドホスティングによるワンクリック展開
+
+- Rainyun - CNY 4.5/月
+
+[![](https://rainyun-apps.cn-nb1.rains3.com/materials/deploy-on-rainyun-cn.svg)](https://app.rainyun.com/apps/rca/store/6780/NzYxNzAz_)
+
+- 1Panel アプリストア
+
+1Panel アプリストアで利用可能です。「アプリストア」>「ユーティリティ」>「Komari」からインストールしてください。
+
+### 1. ワンクリックインストールスクリプトを使用する
+
+systemdを使用するディストリビューション（Ubuntu、Debianなど）に適しています。
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh -o install-komari.sh
+chmod +x install-komari.sh
+sudo ./install-komari.sh
+```
+
+### 2. Docker展開
+
+1. データディレクトリを作成します:
+   ```bash
+   mkdir -p ./data
+   ```
+2. Dockerコンテナを実行します:
+   ```bash
+   docker run -d \
+     -p 25774:25774 \
+     -v $(pwd)/data:/app/data \
+     --name komari \
+     ghcr.io/komari-monitor/komari:latest
+   ```
+3. デフォルトのユーザー名とパスワードを表示します:
+   ```bash
+   docker logs komari
+   ```
+4. ブラウザで `http://<your_server_ip>:25774` にアクセスします。
+
+> [!NOTE]
+> 環境変数 `ADMIN_USERNAME` と `ADMIN_PASSWORD` を使用して、初期のユーザー名とパスワードをカスタマイズすることもできます。
+
+### 3. バイナリファイル展開
+
+1. Komariの[GitHubリリース](https://github.com/komari-monitor/komari/releases)ページにアクセスして、お使いのオペレーティングシステム用の最新のバイナリをダウンロードします。
+2. Komariを実行します:
+   ```bash
+   ./komari server -l 0.0.0.0:25774
+   ```
+3. ブラウザで `http://<your_server_ip>:25774` にアクセスします。デフォルトのポートは `25774` です。
+4. デフォルトのユーザー名とパスワードは、起動ログで確認するか、環境変数 `ADMIN_USERNAME` と `ADMIN_PASSWORD` を介して設定できます。
+
+> [!NOTE]
+> バイナリに実行権限があることを確認してください（`chmod +x komari`）。データは実行ディレクトリの `data` フォルダに保存されます。
+
+### 手動ビルド
+
+#### 依存関係
+
+- Go 1.18+ および Node.js 20+（手動ビルド用）
+
+1. フロントエンドの静的ファイルをビルドします:
+   ```bash
+   git clone https://github.com/komari-monitor/komari-web
+   cd komari-web
+   npm install
+   npm run build
+   ```
+2. バックエンドをビルドします:
+   ```bash
+   git clone https://github.com/komari-monitor/komari
+   cd komari
+   ```
+   ステップ1で生成された静的ファイルを `komari` プロジェクトのルートにある `/web/public/defaultTheme/dist` フォルダにコピーし、`komari-theme.json` と `preview.png`/`perview.png` を `/web/public/defaultTheme` にコピーします。
+   ```bash
+   go build -o komari
+   ```
+3. 実行:
+   ```bash
+   ./komari server -l 0.0.0.0:25774
+   ```
+   デフォルトのリスニングポートは `25774` です。`http://localhost:25774` にアクセスします。
+
+## フロントエンド開発ガイド
+
+[Komariテーマ開発ガイド | Komari](https://komari-document.pages.dev/dev/theme.html)
+
+[CrowdinでKomariを翻訳する](https://crowdin.com/project/komari/invite?h=cd051bf172c9a9f7f1360e87ffb521692507706)
+
+## クライアントエージェント開発ガイド
+
+[Komariエージェント情報レポートおよびイベント処理ドキュメント](https://komari-document.pages.dev/dev/agent.html)
+
+## 貢献
+
+IssueやPull Requestを歓迎します！
+
+## 謝辞
+
+### 破碎工坊云 (Crash Work)
+
+[破碎工坊云 - 効率的で安定した、安全な高防御サーバーとCDNソリューションを提供する専門的なクラウドコンピューティングプラットフォーム](https://www.crash.work/)
+
+### DreamCloud
+
+[DreamCloud - コストパフォーマンスに優れたアジア太平洋向け高防御直通](https://as211392.com/)
+
+### 🚀 SharonNetworks スポンサー
+
+[![Sharon Networks](https://raw.githubusercontent.com/komari-monitor/public/refs/heads/main/images/sharon-networks.webp)](https://sharon.io)
+
+SharonNetworks は、あなたのビジネスの離陸を力強くサポートします！
+
+アジア太平洋のデータセンターから中国最適化ネットワーク接続を提供。低レイテンシー & 高帯域幅、Tbps 級のローカル洗浄 DDoS 防御で、ビジネスとお客様の体験を守ります。コミュニティ [Telegram グループ](https://t.me/SharonNetwork) に参加すると、チャリティまたはグループ内抽選で無料利用のチャンスがあります。
+
+### オープンソースコミュニティ
+
+PR を送ってくれた方、テーマを作成してくれた全ての開発者
+
+—— そして：こんなに暇でいられる自分に感謝
+
+## Star履歴
+
+[![Star History Chart](https://api.star-history.com/svg?repos=komari-monitor/komari&type=Date)](https://www.star-history.com/#komari-monitor/komari&Date)

docs/README_zh-TW.md

@@ -0,0 +1,148 @@
+# Komari
+
+![Badge](https://hitscounter.dev/api/hit?url=https%3A%2F%2Fgithub.com%2Fkomari-monitor%2Fkomari&label=&icon=github&color=%23a370f7&message=&style=flat&tz=UTC)
+
+![komari](https://socialify.git.ci/komari-monitor/komari/image?description=1&font=Inter&forks=1&issues=1&language=1&logo=https%3A%2F%2Fraw.githubusercontent.com%2Fkomari-monitor%2Fkomari-web%2Fd54ce1288df41ead08aa19f8700186e68028a889%2Fpublic%2Ffavicon.png&name=1&owner=1&pattern=Plus&pulls=1&stargazers=1&theme=Auto)
+
+Komari 是一款輕量級的自託管伺服器監控工具，旨在提供簡單、高效的伺服器性能監控解決方案。它支援透過 Web 介面查看伺服器狀態，並透過輕量級 Agent 收集數據。
+
+> [!WARNING]
+> Komari 是一款自託管的監控/控制程式，僅應部署在你擁有或已獲授權管理的系統上。請勿將 Komari 武器化，或在未獲授權的情況下部署、存取、持久化、執行命令及從事其他濫用行為。關於現實中的濫用風險，可參考 Huntress 的分析：[Komari C2 agent abuse](https://www.huntress.com/blog/komari-c2-agent-abuse)。
+> 使用者需要自行承擔部署和使用 Komari 的責任。開發者不對未經授權或濫用行為及其後果承擔責任。
+> 在 Windows 端啟用遠端控制後，客戶端會在每次使用者登入時透過 Windows 通知提醒使用者 Komari 是一款遠端控制軟體。
+
+[文檔](https://komari-document.pages.dev/) | [Telegram 群組](https://t.me/komari_monitor)
+
+## 特性
+
+- **輕量高效**：低資源佔用，適合各種規模的伺服器。
+- **自託管**：完全掌控數據隱私，部署簡單。
+- **Web 介面**：直觀的監控儀表盤，易於使用。
+
+## 快速開始
+
+### 0. 容器雲一鍵部署
+
+- 雨雲雲應用 - CNY 4.5/月
+
+[![](https://rainyun-apps.cn-nb1.rains3.com/materials/deploy-on-rainyun-cn.svg)](https://app.rainyun.com/apps/rca/store/6780/NzYxNzAz_)
+
+- 1Panel 應用商店
+
+已上架 1Panel 應用商店，應用商店-實用工具-Komari 即可安裝
+
+### 1. 使用一鍵安裝腳本
+
+適用於使用了 systemd 的發行版（Ubuntu、Debian...）。
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh -o install-komari.sh
+chmod +x install-komari.sh
+sudo ./install-komari.sh
+```
+
+### 2. Docker 部署
+
+1. 建立資料目錄：
+   ```bash
+   mkdir -p ./data
+   ```
+2. 執行 Docker 容器：
+   ```bash
+   docker run -d \
+     -p 25774:25774 \
+     -v $(pwd)/data:/app/data \
+     --name komari \
+     ghcr.io/komari-monitor/komari:latest
+   ```
+3. 查看預設帳號和密碼：
+   ```bash
+   docker logs komari
+   ```
+4. 在瀏覽器中存取 `http://<your_server_ip>:25774`。
+
+> [!NOTE]
+> 你也可以透過環境變數 `ADMIN_USERNAME` 和 `ADMIN_PASSWORD` 自訂初始使用者名稱和密碼。
+
+### 3. 二進位檔案部署
+
+1. 存取 Komari 的 [GitHub Release 頁面](https://github.com/komari-monitor/komari/releases) 下載適用於你作業系統的最新二進位檔案。
+2. 執行 Komari：
+   ```bash
+   ./komari server -l 0.0.0.0:25774
+   ```
+3. 在瀏覽器中存取 `http://<your_server_ip>:25774`，預設監聽 `25774` 連接埠。
+4. 預設帳號和密碼可在啟動日誌中查看，或透過環境變數 `ADMIN_USERNAME` 和 `ADMIN_PASSWORD` 設定。
+
+> [!NOTE]
+> 確保二進位檔案具有可執行權限（`chmod +x komari`）。資料將保存在執行目錄下的 `data` 資料夾中。
+
+### 手工建置
+
+#### 依賴
+
+- Go 1.18+ 和 Node.js 20+（手工建置）
+
+1. 建置前端靜態檔案：
+   ```bash
+   git clone https://github.com/komari-monitor/komari-web
+   cd komari-web
+   npm install
+   npm run build
+   ```
+2. 建置後端：
+   ```bash
+   git clone https://github.com/komari-monitor/komari
+   cd komari
+   ```
+   將步驟1中產生的靜態檔案複製到 `komari` 專案根目錄下的 `/web/public/defaultTheme/dist` 資料夾，並將 `komari-theme.json` 與 `preview.png`/`perview.png` 複製到 `/web/public/defaultTheme`。
+   ```bash
+   go build -o komari
+   ```
+3. 執行：
+   ```bash
+   ./komari server -l 0.0.0.0:25774
+   ```
+   預設監聽 `25774` 連接埠，存取 `http://localhost:25774`。
+
+## 前端開發指南
+
+[Komari 主題開發指南 | Komari](https://komari-document.pages.dev/dev/theme.html)
+
+[在 Crowdin 上翻譯 Komari](https://crowdin.com/project/komari/invite?h=cd051bf172c9a9f7f1360e87ffb521692507706)
+
+## 客戶端 Agent 開發指南
+
+[Komari Agent 資訊上報與事件處理文檔](https://komari-document.pages.dev/dev/agent.html)
+
+## 貢獻
+
+歡迎提交 Issue 或 Pull Request！
+
+## 鳴謝
+
+### 破碎工坊雲
+
+[破碎工坊雲 - 專業雲計算服務平台，提供高效、穩定、安全的高防伺服器與CDN解決方案](https://www.crash.work/)
+
+### DreamCloud
+
+[DreamCloud - 極高性價比解鎖直連亞太高防](https://as211392.com/)
+
+### 🚀 由 SharonNetworks 贊助
+
+[![Sharon Networks](https://raw.githubusercontent.com/komari-monitor/public/refs/heads/main/images/sharon-networks.webp)](https://sharon.io)
+
+SharonNetworks 為您的業務起飛保駕護航！
+
+亞太資料中心提供頂級的中國優化網路接入 · 低延遲 & 高頻寬 & 提供 Tbps 級本地清洗高防服務，為您的業務保駕護航，為您的客戶提供極致體驗。加入社群 [Telegram 群組](https://t.me/SharonNetwork) 可參與公益募捐或群內抽獎免費使用。
+
+### 開源社群
+
+提交 PR、製作主題的各位開發者
+
+—— 以及：感謝我自己能這麼閒
+
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=komari-monitor/komari&type=Date)](https://www.star-history.com/#komari-monitor/komari&Date)

docs/README_zh.md

@@ -0,0 +1,148 @@
+# Komari
+
+![Badge](https://hitscounter.dev/api/hit?url=https%3A%2F%2Fgithub.com%2Fkomari-monitor%2Fkomari&label=&icon=github&color=%23a370f7&message=&style=flat&tz=UTC)
+
+![komari](https://socialify.git.ci/komari-monitor/komari/image?description=1&font=Inter&forks=1&issues=1&language=1&logo=https%3A%2F%2Fraw.githubusercontent.com%2Fkomari-monitor%2Fkomari-web%2Fd54ce1288df41ead08aa19f8700186e68028a889%2Fpublic%2Ffavicon.png&name=1&owner=1&pattern=Plus&pulls=1&stargazers=1&theme=Auto)
+
+Komari 是一款轻量级的自托管服务器监控工具，旨在提供简单、高效的服务器性能监控解决方案。它支持通过 Web 界面查看服务器状态，并通过轻量级 Agent 收集数据。
+
+> [!WARNING]
+> Komari 是一款自托管的监控/控制程序，仅应部署在你拥有或已获得授权管理的系统上。请勿将 Komari 武器化，或在未获授权的情况下部署、访问、持久化、执行命令及从事其他滥用行为。关于现实中的滥用风险，可参考 Huntress 的分析：[Komari C2 agent abuse](https://www.huntress.com/blog/komari-c2-agent-abuse)。
+> 用户需要自行承担部署和使用 Komari 的责任。开发者不对未经授权或滥用行为及其后果承担责任。
+> 在 Windows 端开启远程控制后，客户端会在每次用户登录时通过 Windows 通知提醒用户 Komari 是一款远程控制软件。
+
+[文档](https://komari-document.pages.dev/) | [文档(镜像站 By Geekertao)](https://www.komari.wiki) | [Telegram 群组](https://t.me/komari_monitor)
+
+## 特性
+
+- **轻量高效**：低资源占用，适合各种规模的服务器。
+- **自托管**：完全掌控数据隐私，部署简单。
+- **Web 界面**：直观的监控仪表盘，易于使用。
+
+## 快速开始
+
+### 0. 容器云一键部署
+
+- 雨云云应用 - CNY 4.5/月
+
+[![](https://rainyun-apps.cn-nb1.rains3.com/materials/deploy-on-rainyun-cn.svg)](https://app.rainyun.com/apps/rca/store/6780/NzYxNzAz_)
+
+- 1Panel 应用商店
+
+已上架1Panel应用商店，应用商店-实用工具-Komari 即可安装
+
+### 1. 使用一键安装脚本
+
+适用于使用了 systemd 的发行版（Ubuntu、Debian...）。
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh -o install-komari.sh
+chmod +x install-komari.sh
+sudo ./install-komari.sh
+```
+
+### 2. Docker 部署
+
+1. 创建数据目录：
+   ```bash
+   mkdir -p ./data
+   ```
+2. 运行 Docker 容器：
+   ```bash
+   docker run -d \
+     -p 25774:25774 \
+     -v $(pwd)/data:/app/data \
+     --name komari \
+     ghcr.io/komari-monitor/komari:latest
+   ```
+3. 查看默认账号和密码：
+   ```bash
+   docker logs komari
+   ```
+4. 在浏览器中访问 `http://<your_server_ip>:25774`。
+
+> [!NOTE]
+> 你也可以通过环境变量 `ADMIN_USERNAME` 和 `ADMIN_PASSWORD` 自定义初始用户名和密码。
+
+### 3. 二进制文件部署
+
+1. 访问 Komari 的 [GitHub Release 页面](https://github.com/komari-monitor/komari/releases) 下载适用于你操作系统的最新二进制文件。
+2. 运行 Komari：
+   ```bash
+   ./komari server -l 0.0.0.0:25774
+   ```
+3. 在浏览器中访问 `http://<your_server_ip>:25774`，默认监听 `25774` 端口。
+4. 默认账号和密码可在启动日志中查看，或通过环境变量 `ADMIN_USERNAME` 和 `ADMIN_PASSWORD` 设置。
+
+> [!NOTE]
+> 确保二进制文件具有可执行权限（`chmod +x komari`）。数据将保存在运行目录下的 `data` 文件夹中。
+
+### 手工构建
+
+#### 依赖
+
+- Go 1.18+ 和 Node.js 20+（手工构建）
+
+1. 构建前端静态文件：
+   ```bash
+   git clone https://github.com/komari-monitor/komari-web
+   cd komari-web
+   npm install
+   npm run build
+   ```
+2. 构建后端：
+   ```bash
+   git clone https://github.com/komari-monitor/komari
+   cd komari
+   ```
+   将步骤1中生成的静态文件复制到 `komari` 项目根目录下的 `/web/public/defaultTheme/dist` 文件夹，并将 `komari-theme.json` 与 `preview.png`/`perview.png` 复制到 `/web/public/defaultTheme`。
+   ```bash
+   go build -o komari
+   ```
+3. 运行：
+   ```bash
+   ./komari server -l 0.0.0.0:25774
+   ```
+   默认监听 `25774` 端口，访问 `http://localhost:25774`。
+
+## 前端开发指南
+
+[Komari 主题开发指南 | Komari](https://komari-document.pages.dev/dev/theme.html)
+
+[在 Crowdin 上翻译 Komari](https://crowdin.com/project/komari/invite?h=cd051bf172c9a9f7f1360e87ffb521692507706)
+
+## 客户端 Agent 开发指南
+
+[Komari Agent 信息上报与事件处理文档](https://komari-document.pages.dev/dev/agent.html)
+
+## 贡献
+
+欢迎提交 Issue 或 Pull Request！
+
+## 鸣谢
+
+### 破碎工坊云
+
+[破碎工坊云 - 专业云计算服务平台，提供高效、稳定、安全的高防服务器与CDN解决方案](https://www.crash.work/)
+
+### DreamCloud
+
+[DreamCloud - 极高性价比解锁直连亚太高防](https://as211392.com/)
+
+### 🚀 由 SharonNetworks 赞助
+
+[![Sharon Networks](https://raw.githubusercontent.com/komari-monitor/public/refs/heads/main/images/sharon-networks.webp)](https://sharon.io)
+
+SharonNetworks 为您的业务起飞保驾护航！
+
+亚太数据中心提供顶级的中国优化网络接入 · 低延时 & 高带宽 & 提供 Tbps 级本地清洗高防服务，为您的业务保驾护航，为您的客户提供极致体验。加入社区 [Telegram 群组](https://t.me/SharonNetwork) 可参与公益募捐或群内抽奖免费使用。
+
+### 开源社区
+
+提交 PR、制作主题的各位开发者
+
+—— 以及：感谢我自己能这么闲
+
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=komari-monitor/komari&type=Date)](https://www.star-history.com/#komari-monitor/komari&Date)

go.mod

@@ -1,53 +1,65 @@
 module github.com/komari-monitor/komari
 
-go 1.23.2
+go 1.25.0
 
 require (
+	github.com/coreos/go-oidc/v3 v3.15.0
+	github.com/dop251/goja v0.0.0-20251008123653-cf18d89f3cf6
+	github.com/dop251/goja_nodejs v0.0.0-20251015164255-5e94316bedaf
 	github.com/gin-gonic/gin v1.10.0
+	github.com/go-sql-driver/mysql v1.10.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
+	github.com/jackc/pgx/v5 v5.10.0
+	github.com/mattn/go-sqlite3 v1.14.27
 	github.com/oschwald/maxminddb-golang v1.13.1
+	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pquerna/otp v1.5.0
 	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
-	gorm.io/driver/mysql v1.5.7
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/image v0.35.0
+	google.golang.org/grpc v1.75.0
+	google.golang.org/protobuf v1.36.6
 	gorm.io/driver/sqlite v1.5.7
 	gorm.io/gorm v1.26.1
-
 )
 
 // Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto #1
 // golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange #3
-require golang.org/x/crypto v0.37.0 // indirect
+require golang.org/x/crypto v0.39.0 // indirect
 
 // HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net #2
 // golang.org/x/net vulnerable to Cross-site Scripting #4
-require golang.org/x/net v0.39.0 // indirect
+require golang.org/x/net v0.41.0 // indirect
 
 require (
-	filippo.io/edwards25519 v1.1.0 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/bytedance/sonic v1.13.2 // indirect
 	github.com/bytedance/sonic/loader v0.2.4 // indirect
 	github.com/cloudwego/base64x v0.1.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dlclark/regexp2 v1.11.4 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/gin-contrib/sse v1.0.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.26.0 // indirect
-	github.com/go-sql-driver/mysql v1.9.2 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-sqlite3 v1.14.27 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
@@ -57,9 +69,10 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.15.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/text v0.33.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,5 +1,7 @@
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bytedance/sonic v1.13.2 h1:8/H1FempDZqC4VqjptGo14QQlJx8VdZJegxs6wwfqpQ=
@@ -10,17 +12,31 @@ github.com/bytedance/sonic/loader v0.2.4/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFos
 github.com/cloudwego/base64x v0.1.5 h1:XPciSp1xaq2VCSt6lF0phncD4koWyULpl5bUxbfCyP4=
 github.com/cloudwego/base64x v0.1.5/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
 github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/coreos/go-oidc/v3 v3.15.0 h1:R6Oz8Z4bqWR7VFQ+sPSvZPQv4x8M+sJkDO5ojgwlyAg=
+github.com/coreos/go-oidc/v3 v3.15.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
+github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dop251/goja v0.0.0-20251008123653-cf18d89f3cf6 h1:6dE1TmjqkY6tehR4A67gDNhvDtuZ54ocu7ab4K9o540=
+github.com/dop251/goja v0.0.0-20251008123653-cf18d89f3cf6/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
+github.com/dop251/goja_nodejs v0.0.0-20251015164255-5e94316bedaf h1:gbmvliZnCut4NjaPSNOQlfqBoZ9C5Dpf72mHMMYhgVE=
+github.com/dop251/goja_nodejs v0.0.0-20251015164255-5e94316bedaf/go.mod h1:Tb7Xxye4LX7cT3i8YLvmPMGCV92IOi4CDZvm/V8ylc0=
 github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
 github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
 github.com/gin-contrib/sse v1.0.0 h1:y3bT1mUWUxDpW4JLQg/HnTqV4rozuW4tC9eFKTxYI9E=
 github.com/gin-contrib/sse v1.0.0/go.mod h1:zNuFdwarAygJBht0NTKiSi3jRf6RbqeILZ9Sp6Slhe0=
 github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
 github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -29,20 +45,33 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k=
 github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
-github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
-github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU=
-github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
+github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
+github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
+github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
@@ -54,7 +83,6 @@ github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -74,6 +102,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
+github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
+github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -81,7 +111,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -99,23 +128,48 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 golang.org/x/arch v0.15.0 h1:QtOrQd0bTUnhNVNndMpLHNWrDmYzZ2KDqSrEymqInZw=
 golang.org/x/arch v0.15.0/go.mod h1:JmwW7aLIoRUKgaTzhkiEFxvcEiQGyOg9BMonBJUS7EE=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/image v0.35.0 h1:LKjiHdgMtO8z7Fh18nGY6KDcoEtVfsgLDPeLyguqb7I=
+golang.org/x/image v0.35.0/go.mod h1:MwPLTVgvxSASsxdLzKrl8BRFuyqMyGhLwmC+TO1Sybk=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
-golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -123,14 +177,13 @@ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/mysql v1.5.7 h1:MndhOPYOfEp2rHKgkZIhJ16eVUIRf2HmzgoPmh7FCWo=
-gorm.io/driver/mysql v1.5.7/go.mod h1:sEtPWMiqiN1N1cMXoXmBbd8C6/l+TESwriotuRRpkDM=
 gorm.io/driver/sqlite v1.5.7 h1:8NvsrhP0ifM7LX9G4zPB97NwovUakUxc+2V2uuf3Z1I=
 gorm.io/driver/sqlite v1.5.7/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
-gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
 gorm.io/gorm v1.26.1 h1:ghB2gUI9FkS46luZtn6DLZ0f6ooBJ5IbVej2ENFDjRw=
 gorm.io/gorm v1.26.1/go.mod h1:8Z33v652h4//uMA76KjeDH8mJXPm1QNCYrMeatR0DOE=
 nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=

install-komari.sh

@@ -0,0 +1,415 @@
+#!/bin/bash
+
+# Color definitions for terminal output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+NC='\033[0m' # No Color
+
+# Logging functions
+log_info() {
+    echo -e "$1"
+}
+
+log_success() {
+    echo -e "${GREEN}$1${NC}"
+}
+
+log_error() {
+    echo -e "${RED}$1${NC}"
+}
+
+log_step() {
+    echo -e "${YELLOW}$1${NC}"
+}
+
+
+# Global variables
+INSTALL_DIR="/opt/komari"
+DATA_DIR="/opt/komari"
+SERVICE_NAME="komari"
+BINARY_PATH="$INSTALL_DIR/komari"
+DEFAULT_PORT="25774"
+LISTEN_PORT=""
+
+# Show banner
+show_banner() {
+    clear
+    echo "=============================================================="
+    echo "            Komari Monitoring System Installer"
+    echo "       https://github.com/komari-monitor/komari"
+    echo "=============================================================="
+    echo
+}
+
+# Check if running as root
+check_root() {
+    if [ "$EUID" -ne 0 ]; then
+        log_error "请使用 root 权限运行此脚本"
+        exit 1
+    fi
+}
+
+# Check for systemd
+check_systemd() {
+    if ! command -v systemctl >/dev/null 2>&1; then
+        return 1
+    else
+        return 0
+    fi
+}
+
+# Detect system architecture
+detect_arch() {
+    local arch=$(uname -m)
+    case $arch in
+        x86_64)
+            echo "amd64"
+            ;;
+        aarch64)
+            echo "arm64"
+            ;;
+        i386|i686)
+            echo "386"
+            ;;
+        riscv64)
+            echo "riscv64"
+            ;;
+        *)
+            log_error "不支持的架构: $arch"
+            exit 1
+            ;;
+    esac
+}
+
+# Check if Komari is already installed
+is_installed() {
+    if [ -f "$BINARY_PATH" ]; then
+        return 0 # 0 means true in bash exit codes
+    else
+        return 1 # 1 means false
+    fi
+}
+
+# Install dependencies
+install_dependencies() {
+    log_step "检查并安装依赖..."
+
+    if ! command -v curl >/dev/null 2>&1; then
+        if command -v apt >/dev/null 2>&1; then
+            log_info "使用 apt 安装依赖..."
+            apt update
+            apt install -y curl
+        elif command -v yum >/dev/null 2>&1; then
+            log_info "使用 yum 安装依赖..."
+            yum install -y curl
+        elif command -v apk >/dev/null 2>&1; then
+            log_info "使用 apk 安装依赖..."
+            apk add curl
+        else
+            log_error "未找到支持的包管理器 (apt/yum/apk)"
+            exit 1
+        fi
+    fi
+}
+
+# Binary installation
+install_binary() {
+    log_step "开始二进制安装..."
+
+    if is_installed; then
+        log_info "Komari 已安装。要升级，请使用升级选项。"
+        return
+    fi
+
+
+    # 监听端口输入，校验范围 1-65535
+    while true; do
+        read -p "请输入监听端口 [默认: $DEFAULT_PORT]: " input_port
+        if [[ -z "$input_port" ]]; then
+            LISTEN_PORT="$DEFAULT_PORT"
+            break
+        elif [[ "$input_port" =~ ^[0-9]+$ ]] && (( input_port >= 1 && input_port <= 65535 )); then
+            LISTEN_PORT="$input_port"
+            break
+        else
+            log_error "端口号无效，请输入 1-65535 之间的数字。"
+        fi
+    done
+
+    install_dependencies
+
+    local arch=$(detect_arch)
+    log_info "检测到架构: $arch"
+
+    log_step "创建安装目录: $INSTALL_DIR"
+    mkdir -p "$INSTALL_DIR"
+
+    log_step "创建数据目录: $DATA_DIR"
+    mkdir -p "$DATA_DIR"
+
+    local file_name="komari-linux-${arch}"
+    local download_url="https://github.com/komari-monitor/komari/releases/latest/download/${file_name}"
+
+    log_step "下载 Komari 二进制文件..."
+    log_info "URL: $download_url"
+
+    if ! curl -L -o "$BINARY_PATH" "$download_url"; then
+        log_error "下载失败"
+        return 1
+    fi
+
+    chmod +x "$BINARY_PATH"
+    log_success "Komari 二进制文件安装完成: $BINARY_PATH"
+
+    if ! check_systemd; then
+        log_step "警告：未检测到 systemd，跳过服务创建。"
+        log_step "您可以从命令行手动运行 Komari："
+        log_step "    $BINARY_PATH server -l 0.0.0.0:$LISTEN_PORT"
+        echo
+        log_success "安装完成！"
+        return
+    fi
+
+    create_systemd_service "$LISTEN_PORT"
+
+    systemctl daemon-reload
+    systemctl enable ${SERVICE_NAME}.service
+    systemctl start ${SERVICE_NAME}.service
+
+    if systemctl is-active --quiet ${SERVICE_NAME}.service; then
+        log_success "Komari 服务启动成功"
+        
+        log_step "正在获取初始密码..."
+        sleep 5 
+        local password=$(journalctl -u ${SERVICE_NAME} --since "1 minute ago" | grep "admin account created." | tail -n 1 | sed -e 's/.*admin account created.//')
+        if [ -z "$password" ]; then
+            log_error "未能获取初始密码，请检查日志"
+        fi
+        show_access_info "$password" "$LISTEN_PORT"
+    else
+        log_error "Komari 服务启动失败"
+        log_info "查看日志: journalctl -u ${SERVICE_NAME} -f"
+        return 1
+    fi
+}
+
+# Create systemd service file
+create_systemd_service() {
+    local port="$1"
+    log_step "创建 systemd 服务..."
+
+    local service_file="/etc/systemd/system/${SERVICE_NAME}.service"
+    cat > "$service_file" << EOF
+[Unit]
+Description=Komari Monitor Service
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${BINARY_PATH} server -l 0.0.0.0:${port}
+WorkingDirectory=${DATA_DIR}
+Restart=always
+User=root
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    log_success "systemd 服务文件创建完成"
+}
+
+# Show access information
+show_access_info() {
+    local password=$1
+    local port=${2:-$DEFAULT_PORT}
+    echo
+    log_success "安装完成！"
+    echo
+    log_info "访问信息："
+    log_info "  URL: http://$(hostname -I | awk '{print $1}'):${port}"
+    if [ -n "$password" ]; then
+        log_info "初始登录信息（仅显示一次）: $password"
+    fi
+    echo
+    log_info "服务管理命令："
+    log_info "  状态:  systemctl status $SERVICE_NAME"
+    log_info "  启动:   systemctl start $SERVICE_NAME"
+    log_info "  停止:    systemctl stop $SERVICE_NAME"
+    log_info "  重启: systemctl restart $SERVICE_NAME"
+    log_info "  日志:    journalctl -u $SERVICE_NAME -f"
+}
+
+# Upgrade function
+upgrade_komari() {
+    log_step "升级 Komari..."
+
+    if ! is_installed; then
+        log_error "Komari 未安装。请先安装它。"
+        return 1
+    fi
+
+    if ! check_systemd; then
+        log_error "未检测到 systemd。无法管理服务。"
+        return 1
+    fi
+
+    log_step "停止 Komari 服务..."
+    systemctl stop ${SERVICE_NAME}.service
+
+    log_step "备份当前二进制文件..."
+    cp "$BINARY_PATH" "${BINARY_PATH}.backup.$(date +%Y%m%d_%H%M%S)"
+
+    local arch=$(detect_arch)
+    local file_name="komari-linux-${arch}"
+    local download_url="https://github.com/komari-monitor/komari/releases/latest/download/${file_name}"
+
+    log_step "下载最新版本..."
+    if ! curl -L -o "$BINARY_PATH" "$download_url"; then
+        log_error "下载失败，正在从备份恢复"
+        mv "${BINARY_PATH}.backup."* "$BINARY_PATH"
+        systemctl start ${SERVICE_NAME}.service
+        return 1
+    fi
+
+    chmod +x "$BINARY_PATH"
+
+    log_step "重启 Komari 服务..."
+    systemctl start ${SERVICE_NAME}.service
+
+    if systemctl is-active --quiet ${SERVICE_NAME}.service; then
+        log_success "Komari 升级成功"
+    else
+        log_error "服务在升级后未能启动"
+    fi
+}
+
+# Uninstall function
+uninstall_komari() {
+    log_step "卸载 Komari..."
+
+    if ! is_installed; then
+        log_info "Komari 未安装"
+        return 0
+    fi
+
+    read -p "这将删除 Komari。您确定吗？(Y/n): " confirm
+    if [[ $confirm =~ ^[Nn]$ ]]; then
+        log_info "卸载已取消"
+        return 0
+    fi
+
+    if check_systemd; then
+        log_step "停止并禁用服务..."
+        systemctl stop ${SERVICE_NAME}.service >/dev/null 2>&1
+        systemctl disable ${SERVICE_NAME}.service >/dev/null 2>&1
+        rm -f "/etc/systemd/system/${SERVICE_NAME}.service"
+        systemctl daemon-reload
+        log_success "systemd 服务已删除"
+    fi
+
+    log_step "删除二进制文件..."
+    rm -f "$BINARY_PATH"
+    # 尝试在目录为空时删除该目录
+    rmdir "$INSTALL_DIR" 2>/dev/null || log_info "数据目录 $INSTALL_DIR 不为空，未删除"
+    log_success "Komari 二进制文件已删除"
+
+    log_success "Komari 卸载完成"
+    log_info "数据文件保留在 $DATA_DIR"
+}
+
+# Show service status
+show_status() {
+    if ! is_installed; then
+        log_error "Komari 未安装"
+        return
+    fi
+    if ! check_systemd; then
+        log_error "未检测到 systemd。无法获取服务状态。"
+        return
+    fi
+    log_step "Komari 服务状态:"
+    systemctl status ${SERVICE_NAME}.service --no-pager -l
+}
+
+# Show service logs
+show_logs() {
+    if ! is_installed; then
+        log_error "Komari 未安装"
+        return
+    fi
+    if ! check_systemd; then
+        log_error "未检测到 systemd。无法获取服务日志。"
+        return
+    fi
+    log_step "查看 Komari 服务日志..."
+    journalctl -u ${SERVICE_NAME} -f --no-pager
+}
+
+# Restart service
+restart_service() {
+    if ! is_installed; then
+        log_error "Komari 未安装"
+        return
+    fi
+    if ! check_systemd; then
+        log_error "未检测到 systemd。无法重启服务。"
+        return
+    fi
+    log_step "重启 Komari 服务..."
+    systemctl restart ${SERVICE_NAME}.service
+    if systemctl is-active --quiet ${SERVICE_NAME}.service; then
+        log_success "服务重启成功"
+    else
+        log_error "服务重启失败"
+    fi
+}
+
+# Stop service
+stop_service() {
+    if ! is_installed; then
+        log_error "Komari 未安装"
+        return
+    fi
+    if ! check_systemd; then
+        log_error "未检测到 systemd。无法停止服务。"
+        return
+    fi
+    log_step "停止 Komari 服务..."
+    systemctl stop ${SERVICE_NAME}.service
+    log_success "服务已停止"
+}
+
+
+# Main menu
+main_menu() {
+    show_banner
+    echo "请选择操作："
+    echo "  1) 安装 Komari"
+    echo "  2) 升级 Komari"
+    echo "  3) 卸载 Komari"
+    echo "  4) 查看状态"
+    echo "  5) 查看日志"
+    echo "  6) 重启服务"
+    echo "  7) 停止服务"
+    echo "  8) 退出"
+    echo
+
+    read -p "输入选项 [1-8]: " choice
+
+    case $choice in
+        1) install_binary ;;
+        2) upgrade_komari ;;
+        3) uninstall_komari ;;
+        4) show_status ;;
+        5) show_logs ;;
+        6) restart_service ;;
+        7) stop_service ;;
+        8) exit 0 ;;
+        *) log_error "无效选项" ;;
+    esac
+}
+
+# Main execution
+check_root
+main_menu

main.go

@@ -2,12 +2,21 @@ package main
 
 import (
 	"log"
+	"log/slog"
 
 	"github.com/komari-monitor/komari/cmd"
 	"github.com/komari-monitor/komari/utils"
+	logutil "github.com/komari-monitor/komari/utils/log"
 )
 
 func main() {
+	if utils.VersionHash == "unknown" {
+		logutil.SetupGlobalLogger(slog.LevelDebug)
+	} else {
+		logutil.SetupGlobalLogger(slog.LevelInfo)
+	}
+
 	log.Printf("Komari Monitor %s (hash: %s)", utils.CurrentVersion, utils.VersionHash)
+
 	cmd.Execute()
 }

pkg/config/config.go

@@ -0,0 +1,635 @@
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"reflect"
+	"strings"
+	"sync"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type ConfigItem struct {
+	Key   string `gorm:"primaryKey;column:key;type:text"`
+	Value string `gorm:"column:value;type:text"` // 存 JSON 字符串
+}
+
+func (ConfigItem) TableName() string {
+	return "configs"
+}
+
+var (
+	db    *gorm.DB
+	SetDb = func(gdb *gorm.DB) {
+		db = gdb
+		if err := db.AutoMigrate(&ConfigItem{}); err != nil {
+			panic("failed to migrate config item table: " + err.Error())
+		}
+	}
+)
+
+// Get 获取原始值 (反序列化为 interface{})
+func Get(key string, defaul ...any) (any, error) {
+	var item ConfigItem
+	err := db.First(&item, "key = ?", key).Error
+	if err != nil {
+		if len(defaul) > 0 {
+			v := defaul[0]
+			err = Set(key, v)
+			return v, err
+		}
+		return nil, err
+	}
+
+	var val any
+	if err := json.Unmarshal([]byte(item.Value), &val); err != nil {
+		return nil, err
+	}
+	return val, nil
+}
+
+// GetAs 获取并转换为指定类型 (泛型)，支持数值类型自动转换
+func GetAs[T any](key string, defaul ...any) (T, error) {
+	var t T
+	var item ConfigItem
+
+	err := db.First(&item, "key = ?", key).Error
+	if err != nil {
+		if len(defaul) > 0 {
+			// 尝试直接类型断言
+			if v, ok := defaul[0].(T); ok {
+				err = Set(key, v)
+				return v, err
+			}
+			// 尝试类型转换
+			val := reflect.ValueOf(&t).Elem()
+			if err := convertAndSet(defaul[0], val); err != nil {
+				return t, fmt.Errorf("default value type mismatch: expected %T, got %T", t, defaul[0])
+			}
+			err = Set(key, t)
+			return t, err
+		}
+		return t, err
+	}
+
+	// 先尝试直接反序列化
+	if err = json.Unmarshal([]byte(item.Value), &t); err != nil {
+		// 尝试通用解析后转换
+		var generic any
+		if err := json.Unmarshal([]byte(item.Value), &generic); err != nil {
+			return t, err
+		}
+		val := reflect.ValueOf(&t).Elem()
+		if err := convertAndSet(generic, val); err != nil {
+			return t, err
+		}
+	}
+	return t, nil
+}
+
+// GetMany 获取多个配置项，keys 为 map[key]defaultValue
+// 如果 defaultValue 为 nil，则数据库不存在时不写入
+// 如果 defaultValue 不为 nil，则数据库不存在时写入默认值
+func GetMany(keys map[string]any) (map[string]any, error) {
+	var items []ConfigItem
+	result := make(map[string]any)
+	keyList := make([]string, 0, len(keys))
+	for k := range keys {
+		keyList = append(keyList, k)
+	}
+	if len(keyList) == 0 {
+		return result, nil
+	}
+	if err := db.Where("key IN ?", keyList).Find(&items).Error; err != nil {
+		return nil, err
+	}
+
+	foundKeys := make(map[string]bool)
+	for _, item := range items {
+		var parsed any
+		if err := json.Unmarshal([]byte(item.Value), &parsed); err == nil {
+			result[item.Key] = parsed
+			foundKeys[item.Key] = true
+		}
+	}
+
+	// 收集需要写入数据库的默认值
+	var toInsert []ConfigItem
+	for k, def := range keys {
+		if _, found := foundKeys[k]; !found {
+			if def != nil {
+				result[k] = def
+				// 序列化后加入待写入列表
+				jsonBytes, err := json.Marshal(def)
+				if err != nil {
+					slog.Warn("marshal default value failed", "key", k, "error", err)
+					continue
+				}
+				toInsert = append(toInsert, ConfigItem{
+					Key:   k,
+					Value: string(jsonBytes),
+				})
+			}
+		}
+	}
+
+	// 批量写入默认值到数据库
+	if len(toInsert) > 0 {
+		if err := db.Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "key"}},
+			DoUpdates: clause.AssignmentColumns([]string{"value"}),
+		}).Create(&toInsert).Error; err != nil {
+			slog.Warn("batch insert default config failed", "error", err)
+		}
+	}
+
+	return result, nil
+}
+
+// GetManyAs 将多个配置项映射到一个结构体中，json tag 作为 Key
+// 支持 default tag 作为默认值，如果数据库中不存在且有 default tag 则写入数据库
+// 没有 default tag 的字段使用零值，不写入数据库
+func GetManyAs[T any]() (*T, error) {
+	var t T
+	val := reflect.ValueOf(&t).Elem()
+	typ := val.Type()
+
+	type fieldInfo struct {
+		index      int
+		key        string
+		hasDefault bool
+		defaultVal string
+	}
+
+	fields := make([]fieldInfo, 0)
+	keys := make([]string, 0)
+
+	for i := 0; i < val.NumField(); i++ {
+		field := typ.Field(i)
+		jsonTag := field.Tag.Get("json")
+		if jsonTag == "" || jsonTag == "-" {
+			continue
+		}
+		// 解析 json tag，处理 "key,omitempty" 格式
+		key := strings.Split(jsonTag, ",")[0]
+		if key == "" || key == "-" {
+			continue
+		}
+
+		defaultTag := field.Tag.Get("default")
+		hasDefault := defaultTag != "" || field.Tag.Get("default") == ""
+		// 检查是否显式定义了 default tag (即使值为空)
+		_, hasDefault = field.Tag.Lookup("default")
+
+		fields = append(fields, fieldInfo{
+			index:      i,
+			key:        key,
+			hasDefault: hasDefault,
+			defaultVal: defaultTag,
+		})
+		keys = append(keys, key)
+	}
+
+	if len(keys) == 0 {
+		return &t, nil
+	}
+
+	var items []ConfigItem
+	if err := db.Where("key IN ?", keys).Find(&items).Error; err != nil {
+		return nil, err
+	}
+
+	// 建立数据库中存在的 key 映射
+	foundItems := make(map[string]string) // key -> value
+	for _, item := range items {
+		foundItems[item.Key] = item.Value
+	}
+
+	// 需要写入数据库的新配置项
+	var toInsert []ConfigItem
+
+	for _, fi := range fields {
+		fieldVal := val.Field(fi.index)
+		if !fieldVal.CanSet() {
+			continue
+		}
+
+		if dbValue, found := foundItems[fi.key]; found {
+			// 数据库中存在，使用数据库值
+			if err := unmarshalToField(dbValue, fieldVal); err != nil {
+				slog.Warn("unmarshal config failed", "key", fi.key, "error", err)
+			}
+		} else if fi.hasDefault {
+			// 数据库中不存在，但有 default tag，解析默认值并写入数据库
+			if err := parseDefaultToField(fi.defaultVal, fieldVal); err != nil {
+				slog.Warn("parse default value failed", "key", fi.key, "error", err)
+				continue
+			}
+			// 序列化后写入数据库
+			jsonBytes, err := json.Marshal(fieldVal.Interface())
+			if err != nil {
+				slog.Warn("marshal default value failed", "key", fi.key, "error", err)
+				continue
+			}
+			toInsert = append(toInsert, ConfigItem{
+				Key:   fi.key,
+				Value: string(jsonBytes),
+			})
+		}
+		// 没有 default tag 且数据库中不存在，保持零值，不写入数据库
+	}
+
+	// 批量写入默认值到数据库
+	if len(toInsert) > 0 {
+		if err := db.Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "key"}},
+			DoUpdates: clause.AssignmentColumns([]string{"value"}),
+		}).Create(&toInsert).Error; err != nil {
+			slog.Warn("batch insert default config failed", "error", err)
+		}
+	}
+
+	return &t, nil
+}
+
+// unmarshalToField 将 JSON 字符串反序列化到字段，支持数值类型转换
+func unmarshalToField(jsonStr string, fieldVal reflect.Value) error {
+	target := reflect.New(fieldVal.Type()).Interface()
+	if err := json.Unmarshal([]byte(jsonStr), target); err != nil {
+		// 尝试通用解析后转换
+		var generic any
+		if err := json.Unmarshal([]byte(jsonStr), &generic); err != nil {
+			return err
+		}
+		return convertAndSet(generic, fieldVal)
+	}
+	fieldVal.Set(reflect.ValueOf(target).Elem())
+	return nil
+}
+
+// parseDefaultToField 解析 default tag 值到字段
+func parseDefaultToField(defaultVal string, fieldVal reflect.Value) error {
+	kind := fieldVal.Kind()
+
+	switch kind {
+	case reflect.String:
+		fieldVal.SetString(defaultVal)
+	case reflect.Bool:
+		fieldVal.SetBool(defaultVal == "true" || defaultVal == "1")
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		var v int64
+		if defaultVal != "" {
+			if _, err := fmt.Sscanf(defaultVal, "%d", &v); err != nil {
+				// 尝试解析浮点数后转换
+				var f float64
+				if _, err := fmt.Sscanf(defaultVal, "%f", &f); err != nil {
+					return err
+				}
+				v = int64(f)
+			}
+		}
+		fieldVal.SetInt(v)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		var v uint64
+		if defaultVal != "" {
+			if _, err := fmt.Sscanf(defaultVal, "%d", &v); err != nil {
+				var f float64
+				if _, err := fmt.Sscanf(defaultVal, "%f", &f); err != nil {
+					return err
+				}
+				v = uint64(f)
+			}
+		}
+		fieldVal.SetUint(v)
+	case reflect.Float32, reflect.Float64:
+		var v float64
+		if defaultVal != "" {
+			if _, err := fmt.Sscanf(defaultVal, "%f", &v); err != nil {
+				return err
+			}
+		}
+		fieldVal.SetFloat(v)
+	default:
+		// 对于复杂类型，尝试 JSON 解析
+		if defaultVal == "" {
+			return nil // 保持零值
+		}
+		target := reflect.New(fieldVal.Type()).Interface()
+		if err := json.Unmarshal([]byte(defaultVal), target); err != nil {
+			return err
+		}
+		fieldVal.Set(reflect.ValueOf(target).Elem())
+	}
+	return nil
+}
+
+// convertAndSet 通用类型转换并设置字段值
+func convertAndSet(val any, fieldVal reflect.Value) error {
+	if val == nil {
+		return nil
+	}
+
+	targetType := fieldVal.Type()
+	v := reflect.ValueOf(val)
+
+	// 直接类型匹配
+	if v.Type().AssignableTo(targetType) {
+		fieldVal.Set(v)
+		return nil
+	}
+
+	// 类型可转换
+	if v.Type().ConvertibleTo(targetType) {
+		fieldVal.Set(v.Convert(targetType))
+		return nil
+	}
+
+	// 数值类型特殊处理 (JSON 数字默认解析为 float64)
+	if f, ok := val.(float64); ok {
+		switch fieldVal.Kind() {
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+			fieldVal.SetInt(int64(f))
+			return nil
+		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+			fieldVal.SetUint(uint64(f))
+			return nil
+		case reflect.Float32, reflect.Float64:
+			fieldVal.SetFloat(f)
+			return nil
+		}
+	}
+
+	// JSON 回环转换
+	b, err := json.Marshal(val)
+	if err != nil {
+		return err
+	}
+	target := reflect.New(targetType).Interface()
+	if err := json.Unmarshal(b, target); err != nil {
+		return err
+	}
+	fieldVal.Set(reflect.ValueOf(target).Elem())
+	return nil
+}
+
+func GetAll() (map[string]any, error) {
+	var items []ConfigItem
+	result := make(map[string]any)
+	if err := db.Find(&items).Error; err != nil {
+		return nil, err
+	}
+
+	for _, item := range items {
+		var parsed any
+		if err := json.Unmarshal([]byte(item.Value), &parsed); err == nil {
+			result[item.Key] = parsed
+		}
+	}
+	return result, nil
+}
+
+// Set 设置单个配置
+func Set(key string, value any) error {
+	oldVal := map[string]any{}
+	{
+		var oldItem ConfigItem
+		if err := db.First(&oldItem, "key = ?", key).Error; err == nil {
+			var parsed any
+			if err := json.Unmarshal([]byte(oldItem.Value), &parsed); err == nil {
+				oldVal[key] = parsed
+			}
+		}
+	}
+
+	bytes, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+
+	item := ConfigItem{
+		Key:   key,
+		Value: string(bytes),
+	}
+
+	err = db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "key"}},
+		DoUpdates: clause.AssignmentColumns([]string{"value"}),
+	}).Create(&item).Error
+	if err != nil {
+		return err
+	}
+
+	newVal := map[string]any{key: value}
+	publishEvent(oldVal, newVal)
+	return nil
+}
+
+// SetMany 将结构体保存为多个配置项
+func SetManyAs[T any](config T) error {
+	val := reflect.ValueOf(config)
+	if val.Kind() == reflect.Ptr {
+		val = val.Elem()
+	}
+
+	typ := val.Type()
+	var items []ConfigItem
+
+	for i := 0; i < val.NumField(); i++ {
+		fieldType := typ.Field(i)
+		tag := fieldType.Tag.Get("json")
+
+		if tag == "" || tag == "-" {
+			continue
+		}
+
+		fieldValue := val.Field(i).Interface()
+
+		bytes, err := json.Marshal(fieldValue)
+		if err != nil {
+			return fmt.Errorf("marshal field %s failed: %w", fieldType.Name, err)
+		}
+
+		items = append(items, ConfigItem{
+			Key:   tag,
+			Value: string(bytes),
+		})
+	}
+
+	if len(items) == 0 {
+		return nil
+	}
+
+	keys := make([]string, 0, len(items))
+	newVal := make(map[string]any, len(items))
+	for _, it := range items {
+		keys = append(keys, it.Key)
+		var parsed any
+		if err := json.Unmarshal([]byte(it.Value), &parsed); err == nil {
+			newVal[it.Key] = parsed
+		}
+	}
+
+	oldVal := map[string]any{}
+	if len(keys) > 0 {
+		var oldItems []ConfigItem
+		if err := db.Where("key IN ?", keys).Find(&oldItems).Error; err == nil {
+			for _, oi := range oldItems {
+				var parsed any
+				if err := json.Unmarshal([]byte(oi.Value), &parsed); err == nil {
+					oldVal[oi.Key] = parsed
+				}
+			}
+		}
+	}
+
+	err := db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "key"}},
+		DoUpdates: clause.AssignmentColumns([]string{"value"}),
+	}).Create(&items).Error
+	if err != nil {
+		return err
+	}
+
+	publishEvent(oldVal, newVal)
+	return nil
+}
+
+func SetMany(cst map[string]any) error {
+	var items []ConfigItem
+	for k, v := range cst {
+		bytes, err := json.Marshal(v)
+		if err != nil {
+			return fmt.Errorf("marshal key %s failed: %w", k, err)
+		}
+		items = append(items, ConfigItem{
+			Key:   k,
+			Value: string(bytes),
+		})
+	}
+	if len(items) == 0 {
+		return nil
+	}
+
+	keys := make([]string, 0, len(items))
+	newVal := make(map[string]any, len(items))
+	for _, it := range items {
+		keys = append(keys, it.Key)
+		var parsed any
+		if err := json.Unmarshal([]byte(it.Value), &parsed); err == nil {
+			newVal[it.Key] = parsed
+		}
+	}
+
+	oldVal := map[string]any{}
+	if len(keys) > 0 {
+		var oldItems []ConfigItem
+		if err := db.Where("key IN ?", keys).Find(&oldItems).Error; err == nil {
+			for _, oi := range oldItems {
+				var parsed any
+				if err := json.Unmarshal([]byte(oi.Value), &parsed); err == nil {
+					oldVal[oi.Key] = parsed
+				}
+			}
+		}
+	}
+
+	err := db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "key"}},
+		DoUpdates: clause.AssignmentColumns([]string{"value"}),
+	}).Create(&items).Error
+	if err != nil {
+		return err
+	}
+
+	publishEvent(oldVal, newVal)
+	return nil
+}
+
+type ConfigEvent struct {
+	Old map[string]any
+	New map[string]any
+}
+
+func (e ConfigEvent) IsChanged(key string) bool {
+	oldVal, oldOk := e.Old[key]
+	newVal, newOk := e.New[key]
+	if !oldOk && !newOk {
+		return false
+	}
+	if oldOk != newOk {
+		return true
+	}
+	return !reflect.DeepEqual(oldVal, newVal)
+}
+
+func IsChangedT[T any](e ConfigEvent, key string) (bool, T) {
+	changed := e.IsChanged(key)
+	var zero T
+
+	val, ok := e.New[key]
+	if !ok {
+		val, ok = e.Old[key]
+		if !ok {
+			return changed, zero
+		}
+	}
+	if val == nil {
+		return changed, zero
+	}
+
+	// Fast path: direct assertion.
+	if cast, ok := val.(T); ok {
+		return changed, cast
+	}
+
+	// Try reflection-based conversion (covers numeric conversions, etc.).
+	targetType := reflect.TypeOf((*T)(nil)).Elem()
+	v := reflect.ValueOf(val)
+	if v.IsValid() {
+		if v.Type().AssignableTo(targetType) {
+			return changed, v.Interface().(T)
+		}
+		if v.Type().ConvertibleTo(targetType) {
+			converted := v.Convert(targetType)
+			return changed, converted.Interface().(T)
+		}
+	}
+
+	// Fallback: JSON roundtrip for map/struct and other loosely typed values.
+	if b, err := json.Marshal(val); err == nil {
+		var out T
+		if err := json.Unmarshal(b, &out); err == nil {
+			return changed, out
+		}
+	}
+
+	return changed, zero
+}
+
+// ConfigSubscriber handles config events
+type ConfigSubscriber func(event ConfigEvent)
+
+var (
+	subscribersMu sync.RWMutex
+	subscribers   []ConfigSubscriber
+)
+
+// Subscribe registers a subscriber for all config events.
+func Subscribe(subscriber ConfigSubscriber) {
+	subscribersMu.Lock()
+	defer subscribersMu.Unlock()
+	subscribers = append(subscribers, subscriber)
+}
+
+// publishEvent notifies all subscribers of a config change.
+func publishEvent(oldVal, newVal map[string]any) {
+	subscribersMu.RLock()
+	defer subscribersMu.RUnlock()
+	for _, sub := range subscribers {
+		event := ConfigEvent{Old: oldVal, New: newVal}
+		go sub(event)
+	}
+}

pkg/config/settings.go

@@ -0,0 +1,87 @@
+package config
+
+import "time"
+
+type Settings struct {
+	ID                     uint   `json:"id,omitempty"`                                        // 1
+	Sitename               string `json:"sitename" default:"Komari"`                           // 站点名称，默认 "Komari"
+	Description            string `json:"description" default:"A simple server monitor tool."` // 站点描述
+	CorsOriginCheckEnabled bool   `json:"cors_origin_check_enabled" default:"true"`            // 是否启用 API CORS 跨域请求校验，默认 true
+	CorsAllowedOrigins     string `json:"cors_allowed_origins" default:""`                     // API 跨域允许列表
+	WsOriginCheckEnabled   bool   `json:"ws_origin_check_enabled" default:"true"`              // 是否校验 WebSocket Origin
+	WsAllowedOrigins       string `json:"ws_allowed_origins" default:""`                       // WebSocket Origin 允许列表
+	Theme                  string `json:"theme" default:"default"`                             // 主题名称，默认 'default'
+	PrivateSite            bool   `json:"private_site" default:"false"`                        // 是否为私有站点，默认 false
+	ApiKey                 string `json:"api_key" default:""`                                  // API 密钥，默认空字符串
+	AutoDiscoveryKey       string `json:"auto_discovery_key" default:""`                       // 自动发现密钥
+	ScriptDomain           string `json:"script_domain" default:""`                            // 自定义脚本域名
+	SendIpAddrToGuest      bool   `json:"send_ip_addr_to_guest" default:"false"`               // 是否向访客页面发送 IP 地址，默认 false
+	EulaAccepted           bool   `json:"eula_accepted" default:"false"`
+	BaseScriptsURLKey      string `json:"base_scripts_url" default:""`
+	// GeoIP 配置
+	GeoIpEnabled  bool   `json:"geo_ip_enabled" default:"true"`
+	GeoIpProvider string `json:"geo_ip_provider" default:"ipinfo"` // empty, mmdb, ip-api, geojs
+	// Nezha 兼容（Agent gRPC）
+	NezhaCompatEnabled bool   `json:"nezha_compat_enabled" default:"false"`
+	NezhaCompatListen  string `json:"nezha_compat_listen" default:""` // 例如 0.0.0.0:5555
+	// OAuth 配置
+	OAuthEnabled          bool   `json:"o_auth_enabled" default:"false"`
+	OAuthProvider         string `json:"o_auth_provider" default:"github"`
+	DisablePasswordLogin  bool   `json:"disable_password_login" default:"false"`
+	CloudflareTunnelToken string `json:"cloudflare_tunnel_token" default:""`
+	// 自定义美化
+	CustomHead string `json:"custom_head" default:""`
+	CustomBody string `json:"custom_body" default:""`
+	// 通知
+	NotificationEnabled        bool    `json:"notification_enabled" default:"true"` // 通知总开关
+	NotificationMethod         string  `json:"notification_method" default:"none"`
+	NotificationTemplate       string  `json:"notification_template" default:"{{emoji}}{{emoji}}{{emoji}}\nEvent: {{event}}\nClients: {{client}}\nMessage: {{message}}\nTime: {{time}}"`
+	ExpireNotificationEnabled  bool    `json:"expire_notification_enabled" default:"true"` // 是否启用过期通知
+	ExpireNotificationLeadDays int     `json:"expire_notification_lead_days" default:"7"`  // 过期前多少天通知，默认7天
+	LoginNotification          bool    `json:"login_notification" default:"true"`          // 登录通知
+	TrafficLimitPercentage     float64 `json:"traffic_limit_percentage" default:"80.00"`   // 流量限制百分比，默认80.00%
+	// Record
+	RecordEnabled          bool `json:"record_enabled" default:"true"`          // 是否启用记录功能
+	RecordPreserveTime     int  `json:"record_preserve_time" default:"720"`     // 记录保留时间，单位小时，默认30天
+	PingRecordPreserveTime int  `json:"ping_record_preserve_time" default:"24"` // Ping 记录保留时间，单位小时，默认1天
+	UpdatedAt              time.Time
+}
+
+const (
+	SitenameKey                   = "sitename"
+	DescriptionKey                = "description"
+	CorsOriginCheckEnabledKey     = "cors_origin_check_enabled"
+	CorsAllowedOriginsKey         = "cors_allowed_origins"
+	WsOriginCheckEnabledKey       = "ws_origin_check_enabled"
+	WsAllowedOriginsKey           = "ws_allowed_origins"
+	ThemeKey                      = "theme"
+	PrivateSiteKey                = "private_site"
+	ApiKeyKey                     = "api_key"
+	AutoDiscoveryKeyKey           = "auto_discovery_key"
+	ScriptDomainKey               = "script_domain"
+	SendIpAddrToGuestKey          = "send_ip_addr_to_guest"
+	EulaAcceptedKey               = "eula_accepted"
+	BaseScriptsURLKey             = "base_scripts_url"
+	GeoIpEnabledKey               = "geo_ip_enabled"
+	GeoIpProviderKey              = "geo_ip_provider"
+	NezhaCompatEnabledKey         = "nezha_compat_enabled"
+	NezhaCompatListenKey          = "nezha_compat_listen"
+	OAuthEnabledKey               = "o_auth_enabled"
+	OAuthProviderKey              = "o_auth_provider"
+	DisablePasswordLoginKey       = "disable_password_login"
+	CloudflareTunnelTokenKey      = "cloudflare_tunnel_token"
+	CustomHeadKey                 = "custom_head"
+	CustomBodyKey                 = "custom_body"
+	NotificationEnabledKey        = "notification_enabled"
+	NotificationMethodKey         = "notification_method"
+	NotificationTemplateKey       = "notification_template"
+	ExpireNotificationEnabledKey  = "expire_notification_enabled"
+	ExpireNotificationLeadDaysKey = "expire_notification_lead_days"
+	LoginNotificationKey          = "login_notification"
+	TrafficLimitPercentageKey     = "traffic_limit_percentage"
+	RecordEnabledKey              = "record_enabled"
+	RecordPreserveTimeKey         = "record_preserve_time"
+	PingRecordPreserveTimeKey     = "ping_record_preserve_time"
+	UpdatedAtKey                  = "updated_at"
+	XtermjsSettingsKey            = "xtermjs_settings"
+)

pkg/corn/corn.go

@@ -0,0 +1,345 @@
+package corn
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Func 是 corn 调度器执行的任务函数。
+// 调度器会为每次执行传入可取消的 context，便于任务在重载或关闭时尽快退出。
+type Func func(ctx context.Context)
+
+type job struct {
+	cancel context.CancelFunc
+}
+
+type schedule interface {
+	Next(time.Time) time.Time
+}
+
+type everySchedule struct {
+	interval time.Duration
+}
+
+func (s everySchedule) Next(t time.Time) time.Time {
+	return t.Add(s.interval)
+}
+
+type cronSchedule struct {
+	seconds map[int]struct{}
+	minutes map[int]struct{}
+	hours   map[int]struct{}
+	dom     map[int]struct{}
+	months  map[int]struct{}
+	dow     map[int]struct{}
+}
+
+func (s cronSchedule) Next(t time.Time) time.Time {
+	next := t.Truncate(time.Second).Add(time.Second)
+	limit := next.Add(366 * 24 * time.Hour)
+	for next.Before(limit) {
+		if s.match(next) {
+			return next
+		}
+		next = next.Add(time.Second)
+	}
+	return time.Time{}
+}
+
+func (s cronSchedule) match(t time.Time) bool {
+	_, okSecond := s.seconds[t.Second()]
+	_, okMinute := s.minutes[t.Minute()]
+	_, okHour := s.hours[t.Hour()]
+	_, okDay := s.dom[t.Day()]
+	_, okMonth := s.months[int(t.Month())]
+	_, okWeek := s.dow[int(t.Weekday())]
+	return okSecond && okMinute && okHour && okDay && okMonth && okWeek
+}
+
+type Manager struct {
+	mu   sync.Mutex
+	jobs map[string]job
+}
+
+var defaultManager = NewManager()
+
+func NewManager() *Manager {
+	return &Manager{jobs: make(map[string]job)}
+}
+
+// AddFunc 按 cron 表达式注册一个任务，fn 会在独立 goroutine 中执行。
+// 支持 5 字段、6 字段 cron 表达式，以及 @every 1m 这类固定间隔表达式。
+func AddFunc(name string, spec string, fn func()) error {
+	return AddContextFunc(name, spec, false, func(context.Context) { fn() })
+}
+
+// AddContextFunc 按 cron 表达式注册一个任务，支持传递带 context 的 func。
+func AddContextFunc(name string, spec string, runImmediately bool, fn Func) error {
+	return defaultManager.AddContextFunc(name, spec, runImmediately, fn)
+}
+
+func Every(duration time.Duration) string {
+	return "@every " + duration.String()
+}
+
+func Remove(name string) {
+	defaultManager.Remove(name)
+}
+
+func RemovePrefix(prefix string) {
+	defaultManager.RemovePrefix(prefix)
+}
+
+func StopAll() {
+	defaultManager.StopAll()
+}
+
+func (m *Manager) AddFunc(name string, spec string, fn func()) error {
+	return m.AddContextFunc(name, spec, false, func(context.Context) { fn() })
+}
+
+func (m *Manager) AddContextFunc(name string, spec string, runImmediately bool, fn Func) error {
+	if name == "" {
+		return fmt.Errorf("corn job name is empty")
+	}
+	s, err := Parse(spec)
+	if err != nil {
+		return fmt.Errorf("corn job %q spec is invalid: %w", name, err)
+	}
+	if fn == nil {
+		return fmt.Errorf("corn job %q func is nil", name)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	m.replace(name, cancel)
+
+	go m.run(ctx, name, s, runImmediately, fn)
+	return nil
+}
+
+func (m *Manager) Remove(name string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if old, ok := m.jobs[name]; ok {
+		old.cancel()
+		delete(m.jobs, name)
+	}
+}
+
+func (m *Manager) RemovePrefix(prefix string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	for name, old := range m.jobs {
+		if strings.HasPrefix(name, prefix) {
+			old.cancel()
+			delete(m.jobs, name)
+		}
+	}
+}
+
+func (m *Manager) StopAll() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	for name, old := range m.jobs {
+		old.cancel()
+		delete(m.jobs, name)
+	}
+}
+
+func (m *Manager) replace(name string, cancel context.CancelFunc) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if old, ok := m.jobs[name]; ok {
+		old.cancel()
+	}
+	m.jobs[name] = job{cancel: cancel}
+}
+
+func (m *Manager) run(ctx context.Context, name string, s schedule, runImmediately bool, fn Func) {
+	if runImmediately {
+		go safeRun(ctx, name, fn)
+	}
+
+	nextTick := s.Next(time.Now())
+	if nextTick.IsZero() {
+		log.Printf("corn job %s has no next run time", name)
+		return
+	}
+	timer := time.NewTimer(time.Until(nextTick))
+	defer timer.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-timer.C:
+			go safeRun(ctx, name, fn)
+			nextTick = s.Next(nextTick)
+			if nextTick.IsZero() {
+				return
+			}
+			resetTimer(timer, time.Until(nextTick))
+		}
+	}
+}
+
+func resetTimer(timer *time.Timer, duration time.Duration) {
+	if duration < 0 {
+		duration = 0
+	}
+	timer.Reset(duration)
+}
+
+func safeRun(ctx context.Context, name string, fn Func) {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Printf("corn job %s panic: %v", name, r)
+		}
+	}()
+
+	select {
+	case <-ctx.Done():
+		return
+	default:
+		fn(ctx)
+	}
+}
+
+// Parse 解析 corn 表达式。
+// 支持：
+//   - 5 字段：minute hour day-of-month month day-of-week
+//   - 6 字段：second minute hour day-of-month month day-of-week
+//   - @every 1m / @every 30s
+//
+// 字段支持 *、*/n、a-b、a-b/n、逗号列表和具体数字。
+func Parse(spec string) (schedule, error) {
+	spec = strings.TrimSpace(spec)
+	if spec == "" {
+		return nil, fmt.Errorf("empty spec")
+	}
+	if strings.HasPrefix(spec, "@every ") {
+		duration, err := time.ParseDuration(strings.TrimSpace(strings.TrimPrefix(spec, "@every ")))
+		if err != nil {
+			return nil, err
+		}
+		if duration <= 0 {
+			return nil, fmt.Errorf("@every duration must be positive")
+		}
+		return everySchedule{interval: duration}, nil
+	}
+
+	fields := strings.Fields(spec)
+	if len(fields) == 5 {
+		fields = append([]string{"0"}, fields...)
+	}
+	if len(fields) != 6 {
+		return nil, fmt.Errorf("expected 5 or 6 fields, got %d", len(fields))
+	}
+
+	seconds, err := parseField(fields[0], 0, 59)
+	if err != nil {
+		return nil, fmt.Errorf("second: %w", err)
+	}
+	minutes, err := parseField(fields[1], 0, 59)
+	if err != nil {
+		return nil, fmt.Errorf("minute: %w", err)
+	}
+	hours, err := parseField(fields[2], 0, 23)
+	if err != nil {
+		return nil, fmt.Errorf("hour: %w", err)
+	}
+	dom, err := parseField(fields[3], 1, 31)
+	if err != nil {
+		return nil, fmt.Errorf("day-of-month: %w", err)
+	}
+	months, err := parseField(fields[4], 1, 12)
+	if err != nil {
+		return nil, fmt.Errorf("month: %w", err)
+	}
+	dow, err := parseField(fields[5], 0, 7)
+	if err != nil {
+		return nil, fmt.Errorf("day-of-week: %w", err)
+	}
+	if _, ok := dow[7]; ok {
+		dow[0] = struct{}{}
+		delete(dow, 7)
+	}
+
+	return cronSchedule{seconds: seconds, minutes: minutes, hours: hours, dom: dom, months: months, dow: dow}, nil
+}
+
+func parseField(field string, min int, max int) (map[int]struct{}, error) {
+	values := make(map[int]struct{})
+	for _, part := range strings.Split(field, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			return nil, fmt.Errorf("empty part")
+		}
+
+		base := part
+		step := 1
+		if strings.Contains(part, "/") {
+			parts := strings.Split(part, "/")
+			if len(parts) != 2 {
+				return nil, fmt.Errorf("invalid step %q", part)
+			}
+			base = parts[0]
+			parsedStep, err := strconv.Atoi(parts[1])
+			if err != nil || parsedStep <= 0 {
+				return nil, fmt.Errorf("invalid step %q", parts[1])
+			}
+			step = parsedStep
+		}
+
+		start, end, err := parseRange(base, min, max)
+		if err != nil {
+			return nil, err
+		}
+		for i := start; i <= end; i += step {
+			values[i] = struct{}{}
+		}
+	}
+	return values, nil
+}
+
+func parseRange(base string, min int, max int) (int, int, error) {
+	if base == "*" || base == "" {
+		return min, max, nil
+	}
+	if strings.Contains(base, "-") {
+		parts := strings.Split(base, "-")
+		if len(parts) != 2 {
+			return 0, 0, fmt.Errorf("invalid range %q", base)
+		}
+		start, err := strconv.Atoi(parts[0])
+		if err != nil {
+			return 0, 0, fmt.Errorf("invalid range start %q", parts[0])
+		}
+		end, err := strconv.Atoi(parts[1])
+		if err != nil {
+			return 0, 0, fmt.Errorf("invalid range end %q", parts[1])
+		}
+		if start > end || start < min || end > max {
+			return 0, 0, fmt.Errorf("range %q out of bounds %d-%d", base, min, max)
+		}
+		return start, end, nil
+	}
+
+	value, err := strconv.Atoi(base)
+	if err != nil {
+		return 0, 0, fmt.Errorf("invalid value %q", base)
+	}
+	if value < min || value > max {
+		return 0, 0, fmt.Errorf("value %d out of bounds %d-%d", value, min, max)
+	}
+	return value, value, nil
+}

pkg/metric/aggregate.go

@@ -0,0 +1,270 @@
+package metric
+
+import (
+	"fmt"
+	"math"
+	"sort"
+	"time"
+)
+
+// AggregatePoints groups raw points into time buckets and computes aggregate values.
+//
+// AggregatePoints 在内存中按查询配置将原始点分桶并聚合。
+func AggregatePoints(points []Point, query AggregateQuery) ([]AggregatePoint, error) {
+	if err := query.Validate(); err != nil {
+		return nil, err
+	}
+	if len(points) == 0 {
+		if query.FillEmpty {
+			return emptyBuckets(query), nil
+		}
+		return []AggregatePoint{}, nil
+	}
+
+	points = sortedPoints(points)
+	groups := make(map[int64][]Point)
+	for _, point := range points {
+		bucket := alignTime(point.Timestamp, query.Interval).UnixNano()
+		groups[bucket] = append(groups[bucket], point)
+	}
+
+	var buckets []int64
+	if query.FillEmpty {
+		for t := alignTime(query.Start, query.Interval); !t.After(query.End); t = t.Add(query.Interval) {
+			buckets = append(buckets, t.UnixNano())
+		}
+	} else {
+		for bucket := range groups {
+			buckets = append(buckets, bucket)
+		}
+		sort.Slice(buckets, func(i, j int) bool { return buckets[i] < buckets[j] })
+	}
+
+	out := make([]AggregatePoint, 0, len(buckets))
+	for _, bucket := range buckets {
+		group := groups[bucket]
+		value, err := aggregateValue(group, query.Aggregation)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, AggregatePoint{
+			MetricName: query.MetricName,
+			EntityID:   query.EntityID,
+			Bucket:     time.Unix(0, bucket).UTC(),
+			Value:      value,
+			Count:      len(group),
+		})
+	}
+	return out, nil
+}
+
+// CalculateStats computes summary statistics for a point series.
+//
+// CalculateStats 基于一组点计算统计摘要，包括均值、百分位、首尾值和标准差。
+func CalculateStats(points []Point) (Stats, error) {
+	if len(points) == 0 {
+		// Distinguish "the metric/range yielded no samples" from "the metric
+		// definition does not exist" (which surfaces as ErrNotFound elsewhere).
+		return Stats{}, ErrNoData
+	}
+	points = sortedPoints(points)
+	avg, _ := aggregateValue(points, AggAvg)
+	min, _ := aggregateValue(points, AggMin)
+	max, _ := aggregateValue(points, AggMax)
+	sum, _ := aggregateValue(points, AggSum)
+	p50, _ := aggregateValue(points, AggP50)
+	p95, _ := aggregateValue(points, AggP95)
+	p99, _ := aggregateValue(points, AggP99)
+	first, _ := aggregateValue(points, AggFirst)
+	last, _ := aggregateValue(points, AggLast)
+	rate, _ := aggregateValue(points, AggRate)
+
+	var variance float64
+	for _, p := range points {
+		diff := p.Value - avg
+		variance += diff * diff
+	}
+
+	return Stats{
+		Count:  len(points),
+		Min:    min,
+		Max:    max,
+		Avg:    avg,
+		Sum:    sum,
+		P50:    p50,
+		P95:    p95,
+		P99:    p99,
+		First:  first,
+		Last:   last,
+		Rate:   rate,
+		Start:  points[0].Timestamp,
+		End:    points[len(points)-1].Timestamp,
+		StdDev: math.Sqrt(variance / float64(len(points))),
+	}, nil
+}
+
+// aggregateValue computes one aggregation over a point group.
+//
+// aggregateValue 对一组点执行单个聚合类型的计算。
+func aggregateValue(points []Point, agg Aggregation) (float64, error) {
+	if len(points) == 0 {
+		return 0, nil
+	}
+	switch agg {
+	case AggAvg:
+		sum, _ := aggregateValue(points, AggSum)
+		return sum / float64(len(points)), nil
+	case AggMin:
+		v := points[0].Value
+		for _, p := range points[1:] {
+			v = math.Min(v, p.Value)
+		}
+		return v, nil
+	case AggMax:
+		v := points[0].Value
+		for _, p := range points[1:] {
+			v = math.Max(v, p.Value)
+		}
+		return v, nil
+	case AggSum:
+		var sum float64
+		for _, p := range points {
+			sum += p.Value
+		}
+		return sum, nil
+	case AggCount:
+		return float64(len(points)), nil
+	case AggFirst:
+		// Callers (AggregatePoints, CalculateStats) pass time-ordered slices.
+		return points[0].Value, nil
+	case AggLast:
+		return points[len(points)-1].Value, nil
+	case AggRate:
+		return counterRate(points), nil
+	case AggStdDev:
+		return stdDevPop(points), nil
+	default:
+		// Any percentile (p50, p95, p99, and arbitrary pXX / pXX.X) is computed
+		// here via linear interpolation over the sorted values. The fixed
+		// AggP50/AggP95/AggP99 constants are just common cases of this.
+		if frac, ok := parsePercentile(agg); ok {
+			return percentile(points, frac), nil
+		}
+		return 0, fmt.Errorf("%w: unsupported aggregation %q", ErrInvalidArgument, agg)
+	}
+}
+
+// counterRate computes a per-second rate of change that is resilient to counter
+// resets. It walks the time-ordered series and sums only positive deltas; a
+// decrease is treated as a reset (the counter restarted) and contributes zero
+// rather than a negative spike. For a strictly increasing counter this equals
+// (last-first)/seconds. For a gauge it yields the total upward movement per
+// second, which is a stable definition for an otherwise ill-defined quantity.
+//
+// counterRate 计算能抵抗计数器重置的每秒变化率。它会遍历按时间排序的序列，
+// 并且只累加正向增量；当值下降时会被视为重置（计数器重新开始），该段贡献为零，
+// 而不是产生负向尖峰。对于严格递增的计数器，这等于 (last-first)/seconds。
+// 对于 gauge，它表示每秒总上升量，为这种本来定义不明确的量提供稳定定义。
+func counterRate(points []Point) float64 {
+	if len(points) < 2 {
+		return 0
+	}
+	// Input is time-ordered by the callers; avoid an extra sort here.
+	seconds := points[len(points)-1].Timestamp.Sub(points[0].Timestamp).Seconds()
+	if seconds <= 0 {
+		return 0
+	}
+	var increase float64
+	for i := 1; i < len(points); i++ {
+		delta := points[i].Value - points[i-1].Value
+		if delta > 0 {
+			increase += delta
+		}
+	}
+	return increase / seconds
+}
+
+// stdDevPop computes the population standard deviation (dividing by N), matching
+// SQL STDDEV_POP and the StdDev field produced by CalculateStats.
+//
+// stdDevPop 计算总体标准差（除以 N），与 SQL 的 STDDEV_POP 以及
+// CalculateStats 返回的 StdDev 语义保持一致。
+func stdDevPop(points []Point) float64 {
+	if len(points) == 0 {
+		return 0
+	}
+	var sum float64
+	for _, p := range points {
+		sum += p.Value
+	}
+	mean := sum / float64(len(points))
+	var variance float64
+	for _, p := range points {
+		d := p.Value - mean
+		variance += d * d
+	}
+	return math.Sqrt(variance / float64(len(points)))
+}
+
+// percentile computes a quantile from point values.
+//
+// percentile 提取点值、排序，并计算指定小数形式的百分位。
+func percentile(points []Point, p float64) float64 {
+	values := make([]float64, len(points))
+	for i, point := range points {
+		values[i] = point.Value
+	}
+	sort.Float64s(values)
+	return percentileSorted(values, p)
+}
+
+// percentileSorted returns the linear-interpolation percentile of an
+// already-sorted slice. Shared by percentile() and the raw-value paths so the
+// interpolation method stays identical everywhere.
+//
+// percentileSorted 基于已排序切片用线性插值计算百分位，供原始值路径和
+// percentile 共用，确保所有路径的插值方法一致。
+func percentileSorted(values []float64, p float64) float64 {
+	if len(values) == 0 {
+		return 0
+	}
+	if len(values) == 1 {
+		return values[0]
+	}
+	pos := p * float64(len(values)-1)
+	lower := int(math.Floor(pos))
+	upper := int(math.Ceil(pos))
+	if lower == upper {
+		return values[lower]
+	}
+	weight := pos - float64(lower)
+	return values[lower]*(1-weight) + values[upper]*weight
+}
+
+// alignTime floors a timestamp to the start of its interval bucket.
+//
+// alignTime 将时间向下对齐到指定间隔的桶起点。
+func alignTime(t time.Time, interval time.Duration) time.Time {
+	nano := t.UTC().UnixNano()
+	size := interval.Nanoseconds()
+	// Floor division toward negative infinity so timestamps before the Unix
+	// epoch (negative nanos) align to the bucket start rather than rounding up.
+	// Go's % returns a remainder with the dividend's sign, so normalize it.
+	rem := ((nano % size) + size) % size
+	return time.Unix(0, nano-rem).UTC()
+}
+
+// emptyBuckets builds zero-count aggregate buckets for an empty range.
+//
+// emptyBuckets 根据查询范围生成空聚合桶，用于 FillEmpty 场景。
+func emptyBuckets(query AggregateQuery) []AggregatePoint {
+	var out []AggregatePoint
+	for t := alignTime(query.Start, query.Interval); !t.After(query.End); t = t.Add(query.Interval) {
+		out = append(out, AggregatePoint{
+			MetricName: query.MetricName,
+			EntityID:   query.EntityID,
+			Bucket:     t,
+		})
+	}
+	return out
+}

pkg/metric/config.go

@@ -0,0 +1,485 @@
+package metric
+
+import (
+	"database/sql"
+	"fmt"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// Config describes database, pooling, migration, retention, and rollup settings.
+//
+// Config 描述 Store 的数据库后端、连接池、迁移、保留和 rollup 配置。
+type Config struct {
+	// Driver selects the database backend.
+	//
+	// Driver 选择数据库后端。
+	Driver Driver
+	// DSN is the database connection string when DB is not supplied.
+	//
+	// DSN 是未传入 DB 时使用的数据库连接字符串。
+	DSN string
+
+	// DB can be supplied by the host app when it owns the connection pool.
+	// When DB is set, DSN is ignored and Close leaves the supplied DB open.
+	//
+	// 当宿主程序自己管理连接池时可以传入 DB；设置 DB 后会忽略 DSN，
+	// Close 也不会关闭这个外部传入的连接池。
+	DB *sql.DB
+
+	// TablePrefix prefixes every table managed by the store.
+	//
+	// TablePrefix 是 Store 管理的所有表名前缀。
+	TablePrefix string
+	// DefaultRetentionDays is used when a metric definition omits retention.
+	//
+	// DefaultRetentionDays 在指标定义未设置保留时间时使用。
+	DefaultRetentionDays int
+	// AutoMigrate controls whether Open creates or updates the schema.
+	//
+	// AutoMigrate 控制 Open 是否创建或更新表结构。
+	AutoMigrate bool
+	// MaxOpenConns sets the primary pool's maximum open connections.
+	//
+	// MaxOpenConns 设置主连接池的最大打开连接数。
+	MaxOpenConns int
+	// MaxIdleConns sets the primary pool's maximum idle connections.
+	//
+	// MaxIdleConns 设置主连接池的最大空闲连接数。
+	MaxIdleConns int
+	// ConnMaxLifetime sets the maximum lifetime for pooled connections.
+	//
+	// ConnMaxLifetime 设置池化连接的最大生命周期。
+	ConnMaxLifetime time.Duration
+	// ConnectTimeout bounds the initial database ping in Open.
+	//
+	// ConnectTimeout 限制 Open 中首次 ping 数据库的时间。
+	ConnectTimeout time.Duration
+	// SQLite holds SQLite-specific options.
+	//
+	// SQLite 保存 SQLite 专用选项。
+	SQLite SQLiteOptions
+
+	// RollupPolicy configures downsampling tiers and tiered retention. When it
+	// defines tiers, Store.Compact materializes them and enforces every
+	// retention window. The zero value disables rollups (raw points only).
+	//
+	// RollupPolicy 配置降采样层级和分层保留时间；定义层级后，
+	// Store.Compact 会生成 rollup 并执行保留策略。零值表示禁用 rollup。
+	RollupPolicy RollupPolicy
+}
+
+// SQLiteOptions contains SQLite-specific performance and read-concurrency settings.
+//
+// SQLiteOptions 保存 SQLite 专用的性能和并发读取选项。
+type SQLiteOptions struct {
+	// PerformanceProfile selects the SQLite synchronous durability preset.
+	//
+	// PerformanceProfile 选择 SQLite synchronous 持久化预设。
+	PerformanceProfile SQLitePerformanceProfile
+	// BusyTimeout is applied to SQLite busy_timeout.
+	//
+	// BusyTimeout 会应用到 SQLite busy_timeout。
+	BusyTimeout time.Duration
+	// CacheSizeKB sets the SQLite page cache size in KB.
+	//
+	// CacheSizeKB 设置 SQLite 页缓存大小，单位为 KB。
+	CacheSizeKB int
+	// PageSize sets SQLite page_size when positive.
+	//
+	// PageSize 为正数时设置 SQLite page_size。
+	PageSize int
+	// TempStoreMemory enables memory-backed temporary storage.
+	//
+	// TempStoreMemory 启用基于内存的临时存储。
+	TempStoreMemory bool
+	// MMapSizeBytes sets SQLite mmap_size in bytes.
+	//
+	// MMapSizeBytes 设置 SQLite mmap_size，单位为字节。
+	MMapSizeBytes int64
+	// WALAutoCheckpoint sets the SQLite WAL auto-checkpoint page count.
+	//
+	// WALAutoCheckpoint 设置 SQLite WAL 自动 checkpoint 页数。
+	WALAutoCheckpoint int
+	// ReadPoolSize, when > 0, opens a second read-only connection pool with
+	// this many connections for SELECT-style calls. SQLite serializes writes,
+	// but WAL lets readers run concurrently, so a read pool lifts read
+	// throughput while keeping writes on the single primary connection.
+	// 0 (default) means all calls share the single primary pool, preserving
+	// the previous single-connection behavior.
+	//
+	// ReadPoolSize 大于 0 时会为 SELECT 类调用打开独立只读连接池。
+	// SQLite 写入会被串行化，但 WAL 允许读取并发执行，因此读池可以在写入仍走
+	// 单主连接的同时提升读取吞吐。0（默认值）表示所有调用共享单个主连接池，
+	// 保留之前的单连接行为。
+	ReadPoolSize int
+}
+
+// SQLitePerformanceProfile names SQLite durability and performance presets.
+//
+// SQLitePerformanceProfile 表示 SQLite synchronous 等持久化策略预设。
+type SQLitePerformanceProfile string
+
+const (
+	// SQLiteProfileDefault uses the package default SQLite profile.
+	//
+	// SQLiteProfileDefault 使用包默认的 SQLite 配置档。
+	SQLiteProfileDefault SQLitePerformanceProfile = ""
+	// SQLiteProfileBalanced uses NORMAL synchronous mode.
+	//
+	// SQLiteProfileBalanced 使用 NORMAL synchronous 模式。
+	SQLiteProfileBalanced SQLitePerformanceProfile = "balanced"
+	// SQLiteProfilePerformance favors throughput over durability.
+	//
+	// SQLiteProfilePerformance 优先吞吐而非持久性。
+	SQLiteProfilePerformance SQLitePerformanceProfile = "performance"
+	// SQLiteProfileDurable favors durability over write throughput.
+	//
+	// SQLiteProfileDurable 优先持久性而非写入吞吐。
+	SQLiteProfileDurable SQLitePerformanceProfile = "durable"
+)
+
+// Option mutates a Config value.
+//
+// Option 是用于修改 Config 的函数式选项。
+type Option func(*Config)
+
+// DefaultConfig returns the default configuration for a backend.
+//
+// DefaultConfig 返回指定后端的默认配置。
+func DefaultConfig(driver Driver, dsn string) Config {
+	return Config{
+		Driver:               driver,
+		DSN:                  dsn,
+		TablePrefix:          "metric_",
+		DefaultRetentionDays: 90,
+		AutoMigrate:          true,
+		MaxOpenConns:         25,
+		MaxIdleConns:         5,
+		ConnMaxLifetime:      time.Hour,
+		ConnectTimeout:       10 * time.Second,
+		SQLite: SQLiteOptions{
+			PerformanceProfile: SQLiteProfileBalanced,
+			BusyTimeout:        5 * time.Second,
+			CacheSizeKB:        64 * 1024,
+			TempStoreMemory:    true,
+			MMapSizeBytes:      256 * 1024 * 1024,
+			WALAutoCheckpoint:  1000,
+		},
+	}
+}
+
+// Backend builds a generic backend configuration and applies options.
+//
+// Backend 构造通用后端配置，并应用额外选项。
+func Backend(driver Driver, dsn string, opts ...Option) Config {
+	cfg := DefaultConfig(driver, dsn)
+	applyOptions(&cfg, opts...)
+	return cfg
+}
+
+// SQLite builds a SQLite backend configuration.
+//
+// SQLite 构造 SQLite 后端配置。
+func SQLite(dsn string, opts ...Option) Config {
+	cfg := SQLiteConfig(dsn)
+	applyOptions(&cfg, opts...)
+	return cfg
+}
+
+// SQLiteInDir builds a managed SQLite file configuration rooted at a directory.
+//
+// SQLiteInDir 构造由 package 管理目录的 SQLite 文件数据库配置。
+func SQLiteInDir(dir string, opts ...Option) Config {
+	cfg := SQLiteConfig(sqliteFileDSN(filepath.Join(dir, "metrics.db")))
+	cfg.MaxOpenConns = 1
+	cfg.MaxIdleConns = 1
+	applyOptions(&cfg, opts...)
+	return cfg
+}
+
+// MySQL builds a MySQL backend configuration.
+//
+// MySQL 构造 MySQL 后端配置。
+func MySQL(dsn string, opts ...Option) Config {
+	cfg := MySQLConfig(dsn)
+	applyOptions(&cfg, opts...)
+	return cfg
+}
+
+// PostgreSQL builds a PostgreSQL backend configuration.
+//
+// PostgreSQL 构造 PostgreSQL 后端配置。
+func PostgreSQL(dsn string, opts ...Option) Config {
+	cfg := PostgreSQLConfig(dsn)
+	applyOptions(&cfg, opts...)
+	return cfg
+}
+
+// SQLiteConfig returns the default SQLite configuration.
+//
+// SQLiteConfig 返回 SQLite 后端的默认配置。
+func SQLiteConfig(dsn string) Config {
+	cfg := DefaultConfig(DriverSQLite, dsn)
+	if cfg.DSN == "" {
+		cfg.DSN = "file:metric?mode=memory&cache=shared"
+	}
+	// SQLite serializes writes, so a single connection is the safe default and
+	// avoids "database is locked" contention. Callers can still override with
+	// WithMaxOpenConns/WithMaxIdleConns. Setting it here (rather than inferring
+	// it later from the 25/5 defaults) means an explicit WithMaxOpenConns(25)
+	// is honored instead of being mistaken for "unset".
+	cfg.MaxOpenConns = 1
+	cfg.MaxIdleConns = 1
+	return cfg
+}
+
+// MySQLConfig returns the default MySQL configuration.
+//
+// MySQLConfig 返回 MySQL 后端的默认配置。
+func MySQLConfig(dsn string) Config {
+	return DefaultConfig(DriverMySQL, dsn)
+}
+
+// PostgreSQLConfig returns the default PostgreSQL configuration.
+//
+// PostgreSQLConfig 返回 PostgreSQL 后端的默认配置。
+func PostgreSQLConfig(dsn string) Config {
+	return DefaultConfig(DriverPostgreSQL, dsn)
+}
+
+// WithDB sets a caller-owned database connection pool.
+//
+// WithDB 设置由调用方提供的数据库连接池。
+func WithDB(db *sql.DB) Option {
+	return func(c *Config) {
+		c.DB = db
+	}
+}
+
+// WithTablePrefix sets the table-name prefix used by metric tables.
+//
+// WithTablePrefix 设置 metric 私有表的表名前缀。
+func WithTablePrefix(prefix string) Option {
+	return func(c *Config) {
+		c.TablePrefix = prefix
+	}
+}
+
+// WithDefaultRetention sets the default metric retention in days.
+//
+// WithDefaultRetention 设置指标默认保留天数。
+func WithDefaultRetention(days int) Option {
+	return func(c *Config) {
+		c.DefaultRetentionDays = days
+	}
+}
+
+// WithAutoMigrate controls whether Open creates the schema automatically.
+//
+// WithAutoMigrate 控制 Open 时是否自动创建表结构。
+func WithAutoMigrate(enabled bool) Option {
+	return func(c *Config) {
+		c.AutoMigrate = enabled
+	}
+}
+
+// WithMaxOpenConns sets the maximum number of open database connections.
+//
+// WithMaxOpenConns 设置底层数据库连接池的最大打开连接数。
+func WithMaxOpenConns(n int) Option {
+	return func(c *Config) {
+		c.MaxOpenConns = n
+	}
+}
+
+// WithMaxIdleConns sets the maximum number of idle database connections.
+//
+// WithMaxIdleConns 设置底层数据库连接池的最大空闲连接数。
+func WithMaxIdleConns(n int) Option {
+	return func(c *Config) {
+		c.MaxIdleConns = n
+	}
+}
+
+// WithConnMaxLifetime sets the maximum lifetime for pooled connections.
+//
+// WithConnMaxLifetime 设置连接最大复用时间。
+func WithConnMaxLifetime(d time.Duration) Option {
+	return func(c *Config) {
+		c.ConnMaxLifetime = d
+	}
+}
+
+// WithConnectTimeout sets the timeout used while opening the store.
+//
+// WithConnectTimeout 设置打开 Store 时 ping 数据库的超时时间。
+func WithConnectTimeout(d time.Duration) Option {
+	return func(c *Config) {
+		c.ConnectTimeout = d
+	}
+}
+
+// WithSQLiteProfile sets the SQLite durability and performance profile.
+//
+// WithSQLiteProfile 设置 SQLite 持久化性能预设。
+func WithSQLiteProfile(profile SQLitePerformanceProfile) Option {
+	return func(c *Config) {
+		c.SQLite.PerformanceProfile = profile
+	}
+}
+
+// WithSQLiteBusyTimeout sets SQLite busy_timeout.
+//
+// WithSQLiteBusyTimeout 设置 SQLite busy_timeout。
+func WithSQLiteBusyTimeout(d time.Duration) Option {
+	return func(c *Config) {
+		c.SQLite.BusyTimeout = d
+	}
+}
+
+// WithSQLiteCacheSizeKB sets the SQLite page cache size in KB.
+//
+// WithSQLiteCacheSizeKB 设置 SQLite 页缓存大小，单位为 KB。
+func WithSQLiteCacheSizeKB(kb int) Option {
+	return func(c *Config) {
+		c.SQLite.CacheSizeKB = kb
+	}
+}
+
+// WithSQLiteMMapSize sets SQLite mmap_size.
+//
+// WithSQLiteMMapSize 设置 SQLite mmap_size。
+func WithSQLiteMMapSize(bytes int64) Option {
+	return func(c *Config) {
+		c.SQLite.MMapSizeBytes = bytes
+	}
+}
+
+// WithSQLitePageSize sets SQLite page_size.
+//
+// WithSQLitePageSize 设置 SQLite page_size。
+func WithSQLitePageSize(bytes int) Option {
+	return func(c *Config) {
+		c.SQLite.PageSize = bytes
+	}
+}
+
+// WithSQLiteTempStoreMemory controls whether SQLite uses memory for temporary storage.
+//
+// WithSQLiteTempStoreMemory 设置 SQLite 是否使用内存临时存储。
+func WithSQLiteTempStoreMemory(enabled bool) Option {
+	return func(c *Config) {
+		c.SQLite.TempStoreMemory = enabled
+	}
+}
+
+// WithSQLiteWALAutoCheckpoint sets the SQLite WAL auto-checkpoint page count.
+//
+// WithSQLiteWALAutoCheckpoint 设置 SQLite WAL 自动 checkpoint 页数。
+func WithSQLiteWALAutoCheckpoint(pages int) Option {
+	return func(c *Config) {
+		c.SQLite.WALAutoCheckpoint = pages
+	}
+}
+
+// WithSQLiteReadPool enables a dedicated read-only connection pool of n
+// connections for SQLite. Writes stay on the single primary connection
+// (SQLite serializes them); reads fan out across the pool, which WAL mode
+// allows to run concurrently. Pass n <= 1 to disable (the default).
+//
+// WithSQLiteReadPool 为 SQLite 启用包含 n 个连接的独立只读连接池。写入仍走
+// 单主连接（SQLite 会串行化写入）；读取会分散到该连接池中，WAL 模式允许它们
+// 并发执行。传入 n <= 1 会禁用该功能（默认行为）。
+func WithSQLiteReadPool(n int) Option {
+	return func(c *Config) {
+		c.SQLite.ReadPoolSize = n
+	}
+}
+
+// WithRollupPolicy sets the downsampling/retention ladder. Compact uses it to
+// build rollup tiers (each progressively coarser and longer-lived) and to age
+// out raw points and expired tiers.
+//
+// WithRollupPolicy 设置降采样与保留时间阶梯；Compact 会据此构建逐级
+// 更粗、保留更久的 rollup，并清理过期原始点和过期层级。
+func WithRollupPolicy(p RollupPolicy) Option {
+	return func(c *Config) {
+		c.RollupPolicy = p
+	}
+}
+
+// applyOptions applies configuration options in order.
+//
+// applyOptions 将一组选项依次应用到 Config。
+func applyOptions(cfg *Config, opts ...Option) {
+	for _, opt := range opts {
+		if opt != nil {
+			opt(cfg)
+		}
+	}
+}
+
+// Validate checks whether the value is well formed.
+//
+// Validate 检查 Config 的后端、表名前缀、保留时间和 rollup 策略是否合法。
+func (c Config) Validate() error {
+	switch c.Driver {
+	case DriverSQLite, DriverMySQL, DriverPostgreSQL:
+	default:
+		return fmt.Errorf("%w: unsupported driver %q", ErrInvalidArgument, c.Driver)
+	}
+	if c.DB == nil && strings.TrimSpace(c.DSN) == "" {
+		return fmt.Errorf("%w: dsn is required when db is not supplied", ErrInvalidArgument)
+	}
+	if c.TablePrefix == "" {
+		return fmt.Errorf("%w: table prefix cannot be empty", ErrInvalidArgument)
+	}
+	for _, r := range c.TablePrefix {
+		if !(r == '_' || r >= '0' && r <= '9' || r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z') {
+			return fmt.Errorf("%w: table prefix must contain only letters, digits, and underscores", ErrInvalidArgument)
+		}
+	}
+	if c.DefaultRetentionDays <= 0 {
+		return fmt.Errorf("%w: default retention days must be positive", ErrInvalidArgument)
+	}
+	if err := c.RollupPolicy.Validate(); err != nil {
+		return err
+	}
+	return nil
+}
+
+// driverName returns the database/sql driver name for the configured backend.
+//
+// driverName 返回 database/sql 注册使用的驱动名称。
+func (c Config) driverName() string {
+	switch c.Driver {
+	case DriverSQLite:
+		return "sqlite3"
+	case DriverMySQL:
+		return "mysql"
+	case DriverPostgreSQL:
+		return "pgx"
+	default:
+		return string(c.Driver)
+	}
+}
+
+// sqliteFileDSN converts a filesystem path into a SQLite file DSN.
+//
+// sqliteFileDSN 将文件路径转换为 SQLite file: DSN。
+func sqliteFileDSN(path string) string {
+	return "file:" + filepath.ToSlash(path) + "?cache=shared&mode=rwc"
+}
+
+// appendSQLiteDSNParam appends a query parameter to a SQLite DSN.
+//
+// appendSQLiteDSNParam 向 SQLite DSN 追加查询参数。
+func appendSQLiteDSNParam(dsn, key, value string) string {
+	if strings.Contains(dsn, "?") {
+		return dsn + "&" + url.QueryEscape(key) + "=" + url.QueryEscape(value)
+	}
+	return dsn + "?" + url.QueryEscape(key) + "=" + url.QueryEscape(value)
+}

pkg/metric/config_test.go

@@ -0,0 +1,68 @@
+package metric
+
+import (
+	"testing"
+	"time"
+)
+
+// TestBackendBuildersApplyOptions verifies backend builders apply options.
+//
+// TestBackendBuildersApplyOptions 验证各后端构造器会正确应用选项。
+func TestBackendBuildersApplyOptions(t *testing.T) {
+	cfg := SQLite(
+		"file:metrics.db?cache=shared",
+		WithTablePrefix("x_metric_"),
+		WithDefaultRetention(180),
+		WithAutoMigrate(false),
+		WithMaxOpenConns(10),
+		WithMaxIdleConns(2),
+		WithConnMaxLifetime(30*time.Minute),
+		WithConnectTimeout(2*time.Second),
+	)
+
+	if cfg.Driver != DriverSQLite {
+		t.Fatalf("expected sqlite driver, got %q", cfg.Driver)
+	}
+	if cfg.TablePrefix != "x_metric_" {
+		t.Fatalf("table prefix option was not applied: %q", cfg.TablePrefix)
+	}
+	if cfg.DefaultRetentionDays != 180 {
+		t.Fatalf("default retention option was not applied: %d", cfg.DefaultRetentionDays)
+	}
+	if cfg.AutoMigrate {
+		t.Fatalf("auto migrate option was not applied")
+	}
+	if cfg.MaxOpenConns != 10 || cfg.MaxIdleConns != 2 {
+		t.Fatalf("pool options were not applied: %#v", cfg)
+	}
+	if cfg.ConnMaxLifetime != 30*time.Minute || cfg.ConnectTimeout != 2*time.Second {
+		t.Fatalf("timeout options were not applied: %#v", cfg)
+	}
+}
+
+// TestSQLiteInDirBuildsFileConfig verifies SQLiteInDir file configuration.
+//
+// TestSQLiteInDirBuildsFileConfig 验证 SQLiteInDir 会生成预期的文件数据库配置。
+func TestSQLiteInDirBuildsFileConfig(t *testing.T) {
+	cfg := SQLiteInDir(
+		"data/metrics",
+		WithSQLiteProfile(SQLiteProfilePerformance),
+		WithSQLiteCacheSizeKB(128*1024),
+	)
+
+	if cfg.Driver != DriverSQLite {
+		t.Fatalf("expected sqlite driver, got %q", cfg.Driver)
+	}
+	if cfg.MaxOpenConns != 1 || cfg.MaxIdleConns != 1 {
+		t.Fatalf("sqlite directory config should default to a single connection: %#v", cfg)
+	}
+	if cfg.SQLite.PerformanceProfile != SQLiteProfilePerformance {
+		t.Fatalf("sqlite profile option was not applied: %q", cfg.SQLite.PerformanceProfile)
+	}
+	if cfg.SQLite.CacheSizeKB != 128*1024 {
+		t.Fatalf("sqlite cache option was not applied: %d", cfg.SQLite.CacheSizeKB)
+	}
+	if cfg.DSN != "file:data/metrics/metrics.db?cache=shared&mode=rwc" {
+		t.Fatalf("unexpected sqlite dir dsn: %q", cfg.DSN)
+	}
+}

pkg/metric/dialect.go

@@ -0,0 +1,444 @@
+package metric
+
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+)
+
+// dialect abstracts SQL differences between supported databases.
+//
+// dialect 抽象不同数据库后端的 SQL 差异。
+type dialect interface {
+	placeholder(n int) string
+	// jsonPlaceholder returns the bind placeholder for a JSON column value.
+	// PostgreSQL needs an explicit ::jsonb cast because the driver sends Go
+	// strings with a text OID, which the server refuses to assign to a jsonb
+	// column. SQLite and MySQL store JSON as text/native and need no cast.
+	//
+	// jsonPlaceholder 返回 JSON 列值的绑定占位符。PostgreSQL 需要显式的
+	// ::jsonb 转换，因为驱动会以 text OID 发送 Go 字符串，服务器拒绝把它赋给
+	// jsonb 列。SQLite 和 MySQL 将 JSON 存为文本或原生类型，不需要转换。
+	jsonPlaceholder(n int) string
+	jsonType() string
+	autoIncrementPrimaryKey() string
+	nowExpr() string
+	insertDefinitionSQL(t tables) string
+	upsertPointSQL(t tables, rowCount int) string
+	// jsonExtractEquals renders a boolean predicate comparing the text value at
+	// key inside a JSON column to a bind placeholder. The key is interpolated
+	// into the SQL (callers must restrict it to a safe charset); the compared
+	// value is always bound.
+	//
+	// jsonExtractEquals 渲染一个布尔谓词，用于比较 JSON 列内 key 对应的文本值和
+	// 绑定占位符。key 会插入 SQL 中（调用方必须限制到安全字符集）；被比较的值
+	// 始终通过绑定参数传入。
+	jsonExtractEquals(column, key, placeholder string) string
+	// blobType is the column type for the rollup t-digest sketch.
+	//
+	// blobType 是 rollup t-digest sketch 的列类型。
+	blobType() string
+	// upsertRollupSQL builds a single-row upsert for one rollup bucket cell.
+	//
+	// upsertRollupSQL 为单个 rollup 桶单元构造单行 upsert。
+	upsertRollupSQL(t tables) string
+	// compactTxOptions returns the transaction options used for the compaction
+	// transaction. PostgreSQL/MySQL escalate to SERIALIZABLE so the raw scan and
+	// the raw deletion share one snapshot and a point inserted between them
+	// cannot be deleted without first being rolled up. SQLite returns nil
+	// (its default) because a single connection already serializes writes.
+	//
+	// compactTxOptions 返回 compaction 事务使用的事务选项。PostgreSQL/MySQL 会
+	// 提升到 SERIALIZABLE，使 raw 扫描和 raw 删除共享同一个快照，让两者之间写入
+	// 的点不会在尚未进入 rollup 前被删除。SQLite 返回 nil（默认），因为单连接
+	// 已经串行化写入。
+	compactTxOptions() *sql.TxOptions
+}
+
+// tables stores the physical table names used by a Store.
+//
+// tables 保存 Store 使用的实际表名。
+type tables struct {
+	// definitions is the metric definitions table.
+	//
+	// definitions 是指标定义表。
+	definitions string
+	// points is the raw points table.
+	//
+	// points 是原始采样点表。
+	points string
+	// rollups is the downsampled rollups table.
+	//
+	// rollups 是降采样 rollup 表。
+	rollups string
+}
+
+// newDialect returns the SQL dialect implementation for a backend.
+//
+// newDialect 根据数据库后端创建对应 SQL 方言实现。
+func newDialect(driver Driver) dialect {
+	switch driver {
+	case DriverPostgreSQL:
+		return postgresDialect{}
+	case DriverMySQL:
+		return mysqlDialect{}
+	default:
+		return sqliteDialect{}
+	}
+}
+
+// sqliteDialect implements SQL rendering for SQLite.
+//
+// sqliteDialect 实现 SQLite 方言。
+type sqliteDialect struct{}
+
+// placeholder returns a bind placeholder for this SQL dialect.
+//
+// placeholder 返回 SQLite 的绑定参数占位符。
+func (sqliteDialect) placeholder(int) string { return "?" }
+
+// jsonPlaceholder returns a bind placeholder for JSON values.
+//
+// jsonPlaceholder 返回 SQLite JSON 值的绑定参数占位符。
+func (sqliteDialect) jsonPlaceholder(int) string { return "?" }
+
+// jsonType returns the SQL column type used for JSON values.
+//
+// jsonType 返回 SQLite 使用的 JSON 存储类型。
+func (sqliteDialect) jsonType() string { return "TEXT" }
+
+// autoIncrementPrimaryKey returns the SQL definition for an auto-incrementing primary key.
+//
+// autoIncrementPrimaryKey 返回 SQLite 自增主键定义。
+func (sqliteDialect) autoIncrementPrimaryKey() string { return "INTEGER PRIMARY KEY AUTOINCREMENT" }
+
+// nowExpr returns the SQL expression for the current time.
+//
+// nowExpr 返回 SQLite 当前时间表达式。
+func (sqliteDialect) nowExpr() string { return "CURRENT_TIMESTAMP" }
+
+// insertDefinitionSQL builds SQL for inserting or updating a metric definition.
+//
+// insertDefinitionSQL 构造 SQLite 指标定义 upsert SQL。
+func (sqliteDialect) insertDefinitionSQL(t tables) string {
+	return fmt.Sprintf(`INSERT INTO %s
+		(name, type, unit, description, retention_days, metadata, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		ON CONFLICT(name) DO UPDATE SET
+			type = excluded.type,
+			unit = excluded.unit,
+			description = excluded.description,
+			retention_days = excluded.retention_days,
+			metadata = excluded.metadata,
+			updated_at = excluded.updated_at`, t.definitions)
+}
+
+// upsertPointSQL builds SQL for inserting or updating metric points.
+//
+// upsertPointSQL 构造 SQLite 采样点批量 upsert SQL。
+func (sqliteDialect) upsertPointSQL(t tables, rowCount int) string {
+	return buildInsertPointsSQL(t.points, sqliteDialect{}, rowCount, `ON CONFLICT(metric_name, entity_id, tags_hash, ts_nano) DO UPDATE SET
+		value = excluded.value,
+		tags = excluded.tags,
+		labels = excluded.labels,
+		created_at = excluded.created_at`)
+}
+
+// mysqlDialect implements SQL rendering for MySQL.
+//
+// mysqlDialect 实现 MySQL 方言。
+type mysqlDialect struct{}
+
+// placeholder returns a bind placeholder for this SQL dialect.
+//
+// placeholder 返回 MySQL 的绑定参数占位符。
+func (mysqlDialect) placeholder(int) string { return "?" }
+
+// jsonPlaceholder returns a bind placeholder for JSON values.
+//
+// jsonPlaceholder 返回 MySQL JSON 值的绑定参数占位符。
+func (mysqlDialect) jsonPlaceholder(int) string { return "?" }
+
+// jsonType returns the SQL column type used for JSON values.
+//
+// jsonType 返回 MySQL 使用的 JSON 存储类型。
+func (mysqlDialect) jsonType() string { return "JSON" }
+
+// autoIncrementPrimaryKey returns the SQL definition for an auto-incrementing primary key.
+//
+// autoIncrementPrimaryKey 返回 MySQL 自增主键定义。
+func (mysqlDialect) autoIncrementPrimaryKey() string { return "BIGINT AUTO_INCREMENT PRIMARY KEY" }
+
+// nowExpr returns the SQL expression for the current time.
+//
+// nowExpr 返回 MySQL 当前时间表达式。
+func (mysqlDialect) nowExpr() string { return "CURRENT_TIMESTAMP" }
+
+// insertDefinitionSQL builds SQL for inserting or updating a metric definition.
+//
+// insertDefinitionSQL 构造 MySQL 指标定义 upsert SQL。
+func (mysqlDialect) insertDefinitionSQL(t tables) string {
+	return fmt.Sprintf(`INSERT INTO %s
+		(name, type, unit, description, retention_days, metadata, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		ON DUPLICATE KEY UPDATE
+			type = VALUES(type),
+			unit = VALUES(unit),
+			description = VALUES(description),
+			retention_days = VALUES(retention_days),
+			metadata = VALUES(metadata),
+			updated_at = VALUES(updated_at)`, t.definitions)
+}
+
+// upsertPointSQL builds SQL for inserting or updating metric points.
+//
+// upsertPointSQL 构造 MySQL 采样点批量 upsert SQL。
+func (mysqlDialect) upsertPointSQL(t tables, rowCount int) string {
+	return buildInsertPointsSQL(t.points, mysqlDialect{}, rowCount, `ON DUPLICATE KEY UPDATE
+		value = VALUES(value),
+		tags = VALUES(tags),
+		labels = VALUES(labels),
+		created_at = VALUES(created_at)`)
+}
+
+// postgresDialect implements SQL rendering for PostgreSQL.
+//
+// postgresDialect 实现 PostgreSQL 方言。
+type postgresDialect struct{}
+
+// placeholder returns a bind placeholder for this SQL dialect.
+//
+// placeholder 返回 PostgreSQL 的编号绑定参数占位符。
+func (postgresDialect) placeholder(n int) string { return fmt.Sprintf("$%d", n) }
+
+// jsonPlaceholder returns a bind placeholder for JSON values.
+//
+// jsonPlaceholder 返回 PostgreSQL JSONB 值的绑定参数占位符。
+func (postgresDialect) jsonPlaceholder(n int) string { return fmt.Sprintf("$%d::jsonb", n) }
+
+// jsonType returns the SQL column type used for JSON values.
+//
+// jsonType 返回 PostgreSQL 使用的 JSONB 存储类型。
+func (postgresDialect) jsonType() string { return "JSONB" }
+
+// autoIncrementPrimaryKey returns the SQL definition for an auto-incrementing primary key.
+//
+// autoIncrementPrimaryKey 返回 PostgreSQL 自增主键定义。
+func (postgresDialect) autoIncrementPrimaryKey() string { return "BIGSERIAL PRIMARY KEY" }
+
+// nowExpr returns the SQL expression for the current time.
+//
+// nowExpr 返回 PostgreSQL 当前时间表达式。
+func (postgresDialect) nowExpr() string { return "CURRENT_TIMESTAMP" }
+
+// insertDefinitionSQL builds SQL for inserting or updating a metric definition.
+//
+// insertDefinitionSQL 构造 PostgreSQL 指标定义 upsert SQL。
+func (postgresDialect) insertDefinitionSQL(t tables) string {
+	return fmt.Sprintf(`INSERT INTO %s
+		(name, type, unit, description, retention_days, metadata, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8)
+		ON CONFLICT(name) DO UPDATE SET
+			type = EXCLUDED.type,
+			unit = EXCLUDED.unit,
+			description = EXCLUDED.description,
+			retention_days = EXCLUDED.retention_days,
+			metadata = EXCLUDED.metadata,
+			updated_at = EXCLUDED.updated_at`, t.definitions)
+}
+
+// upsertPointSQL builds SQL for inserting or updating metric points.
+//
+// upsertPointSQL 构造 PostgreSQL 采样点批量 upsert SQL。
+func (postgresDialect) upsertPointSQL(t tables, rowCount int) string {
+	return buildInsertPointsSQL(t.points, postgresDialect{}, rowCount, `ON CONFLICT(metric_name, entity_id, tags_hash, ts_nano) DO UPDATE SET
+		value = EXCLUDED.value,
+		tags = EXCLUDED.tags,
+		labels = EXCLUDED.labels,
+		created_at = EXCLUDED.created_at`)
+}
+
+// buildInsertPointsSQL builds a multi-row insert statement for metric points.
+//
+// buildInsertPointsSQL 构造多行采样点 INSERT/UPSERT SQL。
+func buildInsertPointsSQL(table string, d dialect, rowCount int, suffix string) string {
+	var b strings.Builder
+	b.WriteString("INSERT INTO ")
+	b.WriteString(table)
+	b.WriteString(" (metric_name, entity_id, tags_hash, ts_nano, value, tags, labels, created_at) VALUES ")
+	arg := 1
+	rows := make([]string, rowCount)
+	for i := 0; i < rowCount; i++ {
+		parts := make([]string, 8)
+		for j := range parts {
+			// Columns are (metric_name, entity_id, tags_hash, ts_nano, value, tags,
+			// labels, created_at); positions 5 and 6 (0-indexed) are JSON values.
+			// tags_hash makes the tag set part of a point's identity, so points
+			// that share entity+timestamp but differ in tags no longer collide.
+			if j == 5 || j == 6 {
+				parts[j] = d.jsonPlaceholder(arg)
+			} else {
+				parts[j] = d.placeholder(arg)
+			}
+			arg++
+		}
+		rows[i] = "(" + strings.Join(parts, ", ") + ")"
+	}
+	b.WriteString(strings.Join(rows, ", "))
+	if suffix != "" {
+		b.WriteByte(' ')
+		b.WriteString(suffix)
+	}
+	return b.String()
+}
+
+// tableName combines a table prefix and logical table name.
+//
+// tableName 用表名前缀和逻辑表名生成实际表名。
+func tableName(prefix, name string) string {
+	return prefix + name
+}
+
+// insertDefinitionOnlySQL builds a plain INSERT (no upsert clause) for a metric
+// definition. CreateMetric uses it so a duplicate name surfaces as a unique
+// constraint violation instead of silently overwriting the existing row.
+//
+// insertDefinitionOnlySQL 构造普通 INSERT（不带 upsert），供
+// CreateMetric 保持“只创建”语义；重复名称会暴露为唯一约束错误。
+func insertDefinitionOnlySQL(d dialect, t tables) string {
+	cols := "(name, type, unit, description, retention_days, metadata, created_at, updated_at)"
+	ph := []string{
+		d.placeholder(1),
+		d.placeholder(2),
+		d.placeholder(3),
+		d.placeholder(4),
+		d.placeholder(5),
+		d.jsonPlaceholder(6),
+		d.placeholder(7),
+		d.placeholder(8),
+	}
+	return fmt.Sprintf("INSERT INTO %s %s VALUES (%s)", t.definitions, cols, strings.Join(ph, ", "))
+}
+
+// sqlSingleQuote escapes a string for safe inclusion inside a single-quoted SQL
+// string literal by doubling embedded single quotes.
+//
+// sqlSingleQuote 通过把单引号加倍，安全地转义可放入 SQL 单引号字符串
+// 字面量的内容。
+func sqlSingleQuote(s string) string {
+	return strings.ReplaceAll(s, "'", "''")
+}
+
+// sqlJSONPathQuoted builds a quoted JSON path member access ($."key") for the
+// given object key and returns it ready to embed inside a single-quoted SQL
+// string literal. Using the quoted form ($."key") rather than the bare form
+// ($.key) is required for keys that contain dots, hyphens, spaces or other
+// characters the JSON path grammar would otherwise interpret (e.g. a dot is a
+// member separator, so the bare path "$.region.zone" would look up nested
+// member "zone" of object "region" instead of the flat key "region.zone").
+//
+// Escaping is applied in two layers, innermost first:
+//  1. JSON path string escaping inside the double quotes: backslash and double
+//     quote are backslash-escaped.
+//  2. SQL string-literal escaping of the whole path: single quotes doubled.
+//
+// sqlJSONPathQuoted 为给定对象键构造带引号的 JSON path 成员访问（$."key"），
+// 并返回可嵌入 SQL 单引号字符串字面量的结果。必须使用带引号形式（$."key"），
+// 而不是裸形式（$.key），因为包含点号、连字符、空格或其他 JSON path 语法字符的
+// key 会被误解；例如点号是成员分隔符，所以裸路径 "$.region.zone" 会查找对象
+// "region" 的嵌套成员 "zone"，而不是平铺 key "region.zone"。
+//
+// 转义按从内到外两层应用：
+//  1. 双引号内的 JSON path 字符串转义：反斜杠和双引号使用反斜杠转义。
+//  2. 整个 path 的 SQL 字符串字面量转义：单引号加倍。
+func sqlJSONPathQuoted(key string) string {
+	escaped := strings.ReplaceAll(key, "\\", "\\\\")
+	escaped = strings.ReplaceAll(escaped, "\"", "\\\"")
+	return sqlSingleQuote("$.\"" + escaped + "\"")
+}
+
+// jsonExtractEquals renders a JSON equality predicate.
+//
+// jsonExtractEquals 构造 SQLite JSON 字段等值过滤表达式。
+func (sqliteDialect) jsonExtractEquals(column, key, placeholder string) string {
+	return fmt.Sprintf("json_extract(%s, '%s') = %s", column, sqlJSONPathQuoted(key), placeholder)
+}
+
+// jsonExtractEquals renders a JSON equality predicate.
+//
+// jsonExtractEquals 构造 MySQL JSON 字段等值过滤表达式。
+func (mysqlDialect) jsonExtractEquals(column, key, placeholder string) string {
+	return fmt.Sprintf("JSON_UNQUOTE(JSON_EXTRACT(%s, '%s')) = %s", column, sqlJSONPathQuoted(key), placeholder)
+}
+
+// jsonExtractEquals renders a JSON equality predicate.
+//
+// jsonExtractEquals 构造 PostgreSQL JSONB 字段等值过滤表达式。
+func (postgresDialect) jsonExtractEquals(column, key, placeholder string) string {
+	// PostgreSQL's ->> takes the key as a plain text literal (not a JSON path),
+	// so a dot or hyphen in the key is harmless; only single quotes need SQL
+	// escaping.
+	return fmt.Sprintf("%s->>'%s' = %s", column, sqlSingleQuote(key), placeholder)
+}
+
+// sqlAggValueExpr returns the SQL value expression that computes agg over the
+// "value" column for the given driver, and whether that aggregation can be
+// pushed down to this backend. Aggregations that need the ordered raw series
+// (first/last/rate) are never pushed down here. Percentiles and population
+// standard deviation are pushed down only where the backend has a portable,
+// semantics-matching function:
+//
+//   - STDDEV_POP: MySQL and PostgreSQL (matches the in-memory population stddev,
+//     which divides by N). SQLite has no built-in, so it falls back to memory.
+//   - percentile_cont(p) WITHIN GROUP (ORDER BY value): PostgreSQL only. This
+//     matches the in-memory linear-interpolation percentile for ANY p (p50,
+//     p95, p99, p99.9, ...). MySQL lacks a portable continuous-percentile
+//     function and SQLite has none, so both fall back to memory.
+//
+// The simple reductions (avg/min/max/sum/count) are portable everywhere.
+//
+// sqlAggValueExpr 返回给定驱动上对 "value" 列计算 agg 的 SQL 值表达式，
+// 以及该聚合是否能下推到该后端。需要有序原始序列的聚合（first/last/rate）
+// 永远不会在这里下推。百分位和总体标准差只会在后端提供可移植且语义匹配的函数时
+// 下推：
+//
+//   - STDDEV_POP：MySQL 和 PostgreSQL 支持（匹配内存中的总体标准差，
+//     即除以 N）。SQLite 没有内置函数，因此回退到内存计算。
+//   - percentile_cont(p) WITHIN GROUP (ORDER BY value)：仅 PostgreSQL 支持。
+//     它匹配内存中任意 p（p50、p95、p99、p99.9 等）的线性插值百分位。
+//     MySQL 没有可移植的连续百分位函数，SQLite 也没有，因此两者都回退到内存计算。
+//
+// 简单归约（avg/min/max/sum/count）在所有后端都可移植。
+func sqlAggValueExpr(driver Driver, agg Aggregation) (string, bool) {
+	switch agg {
+	case AggAvg:
+		return "AVG(value)", true
+	case AggMin:
+		return "MIN(value)", true
+	case AggMax:
+		return "MAX(value)", true
+	case AggSum:
+		return "SUM(value)", true
+	case AggCount:
+		return "COUNT(*)", true
+	case AggStdDev:
+		switch driver {
+		case DriverMySQL, DriverPostgreSQL:
+			return "STDDEV_POP(value)", true
+		default:
+			return "", false
+		}
+	default:
+		// Any percentile (fixed p50/p95/p99 and arbitrary pXX / pXX.X all land
+		// here). PostgreSQL has a portable continuous percentile that matches the
+		// in-memory linear-interpolation percentile; other backends fall back to
+		// the in-memory path.
+		if frac, ok := percentileFractionString(agg); ok {
+			if driver == DriverPostgreSQL {
+				return fmt.Sprintf("percentile_cont(%s) WITHIN GROUP (ORDER BY value)", frac), true
+			}
+			return "", false
+		}
+		return "", false
+	}
+}

pkg/metric/dialect_rollup.go

@@ -0,0 +1,160 @@
+package metric
+
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+)
+
+// rollupColumns is the fixed column list for the rollups table, shared by the
+// upsert builder and the row scanner so they cannot drift apart. tags_hash is a
+// stable fingerprint of the (canonical) tag set; tags carries the tag map itself
+// so reads can return it and tag filters can be pushed down. Including the tag
+// dimension in the key is what keeps each distinct tag combination (e.g. a GPU
+// device_index) as its own rollup series instead of being merged together.
+//
+// rollupColumns 是 rollups 表固定列清单，由 upsert 构造器和行扫描器共用，
+// 避免二者漂移。tags_hash 是（规范化）标签集合的稳定指纹；tags 携带标签 map
+// 本身，因此读取时可以返回它，也能下推标签过滤。把标签维度纳入 key，正是让
+// 每个不同标签组合（例如 GPU 的 device_index）保留为自己的 rollup 序列、
+// 而不是被合并在一起的原因。
+const rollupColumns = "metric_name, entity_id, tags_hash, tags, resolution_nano, bucket_nano, " +
+	"count, sum, sum_sq, min_val, max_val, first_val, first_ts, last_val, last_ts, digest, created_at"
+
+// rollupColumnCount is the number of columns in rollupColumns.
+//
+// rollupColumnCount 是 rollupColumns 中的列数量。
+const rollupColumnCount = 17
+
+// rollupTagsArgIndex is the 1-based position of the `tags` JSON column in
+// rollupColumns. PostgreSQL needs a ::jsonb cast on that bind placeholder.
+//
+// rollupTagsArgIndex 是 tags JSON 列在 rollupColumns 中的 1 基位置；
+// PostgreSQL 需要在对应占位符上追加 ::jsonb 转换。
+const rollupTagsArgIndex = 4
+
+// blobType returns the column type used to store the t-digest sketch.
+//
+// blobType 返回用于保存 t-digest 摘要的二进制列类型。
+func (sqliteDialect) blobType() string { return "BLOB" }
+
+// blobType returns the binary column type used for t-digest blobs.
+//
+// blobType 返回 MySQL 用于保存 t-digest 摘要的二进制列类型。
+func (mysqlDialect) blobType() string { return "LONGBLOB" }
+
+// blobType returns the binary column type used for t-digest blobs.
+//
+// blobType 返回 PostgreSQL 用于保存 t-digest 摘要的二进制列类型。
+func (postgresDialect) blobType() string { return "BYTEA" }
+
+// compactTxOptions returns nil so SQLite uses its default isolation. A single
+// write connection already serializes the compaction transaction against
+// concurrent writers, so the raw scan and the raw deletion observe a stable
+// view without escalating the isolation level.
+//
+// compactTxOptions 返回 nil，让 SQLite 使用默认隔离级别。单个写连接已经把
+// compaction 事务与并发写入串行化，因此 raw 扫描和 raw 删除无需提升隔离级别
+// 即可观察到稳定视图。
+func (sqliteDialect) compactTxOptions() *sql.TxOptions { return nil }
+
+// compactTxOptions escalates to SERIALIZABLE so a point inserted between the raw
+// scan and the raw deletion cannot be deleted without first being rolled up.
+// InnoDB's SERIALIZABLE turns the scan into a locking read that blocks such a
+// concurrent insert in the scanned range until the compaction commits.
+//
+// compactTxOptions 提升到 SERIALIZABLE，使在 raw 扫描和 raw 删除之间写入的点
+// 不会在尚未进入 rollup 前被删除。InnoDB 的 SERIALIZABLE 会把扫描变为加锁读，
+// 在 compaction 提交前阻塞扫描范围内的此类并发插入。
+func (mysqlDialect) compactTxOptions() *sql.TxOptions {
+	return &sql.TxOptions{Isolation: sql.LevelSerializable}
+}
+
+// compactTxOptions escalates to SERIALIZABLE so the raw scan and the raw
+// deletion share one snapshot. A concurrent insert into the scanned range that
+// would otherwise be deleted without a rollup instead triggers a serialization
+// failure that CompactMetric retries on a fresh snapshot.
+//
+// compactTxOptions 提升到 SERIALIZABLE，使 raw 扫描和 raw 删除共享同一个快照。
+// 对扫描范围内的并发插入（否则会被删除却没有进入 rollup）会触发序列化失败，
+// 由 CompactMetric 在新快照上重试。
+func (postgresDialect) compactTxOptions() *sql.TxOptions {
+	return &sql.TxOptions{Isolation: sql.LevelSerializable}
+}
+
+// upsertRollupSQL builds a single-row upsert for a rollup cell, keyed by
+// (metric_name, entity_id, tags_hash, resolution_nano, bucket_nano). Compact
+// recomputes a bucket wholesale from its inputs each run, so the conflict action
+// replaces every summary column rather than trying to merge in SQL.
+//
+// upsertRollupSQL 构造单个 rollup 单元的 upsert SQL，其 key 为
+// (metric_name, entity_id, tags_hash, resolution_nano, bucket_nano)。Compact
+// 每次都会从输入整体重新计算一个桶，因此冲突动作会替换每个摘要列，
+// 而不是尝试在 SQL 中合并。
+func (d sqliteDialect) upsertRollupSQL(t tables) string {
+	return buildUpsertRollupSQL(t.rollups, d, sqliteRollupConflict)
+}
+
+// upsertRollupSQL builds backend-specific SQL for upserting a rollup cell.
+//
+// upsertRollupSQL 构造 MySQL rollup 单元 upsert SQL。
+func (d mysqlDialect) upsertRollupSQL(t tables) string {
+	return buildUpsertRollupSQL(t.rollups, d, mysqlRollupConflict)
+}
+
+// upsertRollupSQL builds backend-specific SQL for upserting a rollup cell.
+//
+// upsertRollupSQL 构造 PostgreSQL rollup 单元 upsert SQL。
+func (d postgresDialect) upsertRollupSQL(t tables) string {
+	return buildUpsertRollupSQL(t.rollups, d, postgresRollupConflict)
+}
+
+// sqliteRollupConflict is the SQLite conflict clause for replacing rollup cells.
+//
+// sqliteRollupConflict 是 SQLite 用于替换 rollup 单元的冲突处理子句。
+const sqliteRollupConflict = `ON CONFLICT(metric_name, entity_id, tags_hash, resolution_nano, bucket_nano) DO UPDATE SET
+	tags = excluded.tags,
+	count = excluded.count, sum = excluded.sum, sum_sq = excluded.sum_sq,
+	min_val = excluded.min_val, max_val = excluded.max_val,
+	first_val = excluded.first_val, first_ts = excluded.first_ts,
+	last_val = excluded.last_val, last_ts = excluded.last_ts,
+	digest = excluded.digest, created_at = excluded.created_at`
+
+// postgresRollupConflict is the PostgreSQL conflict clause for replacing rollup cells.
+//
+// postgresRollupConflict 是 PostgreSQL 用于替换 rollup 单元的冲突处理子句。
+const postgresRollupConflict = `ON CONFLICT(metric_name, entity_id, tags_hash, resolution_nano, bucket_nano) DO UPDATE SET
+	tags = EXCLUDED.tags,
+	count = EXCLUDED.count, sum = EXCLUDED.sum, sum_sq = EXCLUDED.sum_sq,
+	min_val = EXCLUDED.min_val, max_val = EXCLUDED.max_val,
+	first_val = EXCLUDED.first_val, first_ts = EXCLUDED.first_ts,
+	last_val = EXCLUDED.last_val, last_ts = EXCLUDED.last_ts,
+	digest = EXCLUDED.digest, created_at = EXCLUDED.created_at`
+
+// mysqlRollupConflict is the MySQL conflict clause for replacing rollup cells.
+//
+// mysqlRollupConflict 是 MySQL 用于替换 rollup 单元的冲突处理子句。
+const mysqlRollupConflict = `ON DUPLICATE KEY UPDATE
+	tags = VALUES(tags),
+	count = VALUES(count), sum = VALUES(sum), sum_sq = VALUES(sum_sq),
+	min_val = VALUES(min_val), max_val = VALUES(max_val),
+	first_val = VALUES(first_val), first_ts = VALUES(first_ts),
+	last_val = VALUES(last_val), last_ts = VALUES(last_ts),
+	digest = VALUES(digest), created_at = VALUES(created_at)`
+
+// buildUpsertRollupSQL builds a single-row rollup upsert statement.
+//
+// buildUpsertRollupSQL 构造单行 rollup upsert SQL。
+func buildUpsertRollupSQL(table string, d dialect, conflict string) string {
+	ph := make([]string, rollupColumnCount)
+	for i := 0; i < rollupColumnCount; i++ {
+		if i+1 == rollupTagsArgIndex {
+			// The tags column is JSON; PostgreSQL requires an explicit ::jsonb cast.
+			ph[i] = d.jsonPlaceholder(i + 1)
+		} else {
+			ph[i] = d.placeholder(i + 1)
+		}
+	}
+	return fmt.Sprintf("INSERT INTO %s (%s) VALUES (%s) %s",
+		table, rollupColumns, strings.Join(ph, ", "), conflict)
+}

pkg/metric/dialect_test.go

@@ -0,0 +1,60 @@
+package metric
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestDialectsGenerateBackendSpecificSQL verifies backend-specific SQL rendering.
+//
+// TestDialectsGenerateBackendSpecificSQL 验证不同数据库后端生成各自的 SQL。
+func TestDialectsGenerateBackendSpecificSQL(t *testing.T) {
+	tests := []struct {
+		name        string
+		driver      Driver
+		placeholder string
+		upsert      string
+		jsonType    string
+	}{
+		{
+			name:        "sqlite",
+			driver:      DriverSQLite,
+			placeholder: "?",
+			upsert:      "ON CONFLICT(metric_name, entity_id, tags_hash, ts_nano)",
+			jsonType:    "TEXT",
+		},
+		{
+			name:        "mysql",
+			driver:      DriverMySQL,
+			placeholder: "?",
+			upsert:      "ON DUPLICATE KEY UPDATE",
+			jsonType:    "JSON",
+		},
+		{
+			name:        "postgresql",
+			driver:      DriverPostgreSQL,
+			placeholder: "$1",
+			upsert:      "ON CONFLICT(metric_name, entity_id, tags_hash, ts_nano)",
+			jsonType:    "JSONB",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			d := newDialect(tt.driver)
+			if got := d.placeholder(1); got != tt.placeholder {
+				t.Fatalf("placeholder: expected %q, got %q", tt.placeholder, got)
+			}
+			if got := d.jsonType(); got != tt.jsonType {
+				t.Fatalf("json type: expected %q, got %q", tt.jsonType, got)
+			}
+			sql := d.upsertPointSQL(tables{points: "metric_points"}, 2)
+			if !strings.Contains(sql, "metric_points") {
+				t.Fatalf("upsert sql should reference metric_points: %s", sql)
+			}
+			if !strings.Contains(sql, tt.upsert) {
+				t.Fatalf("upsert sql should contain %q: %s", tt.upsert, sql)
+			}
+		})
+	}
+}

pkg/metric/errors.go

@@ -0,0 +1,26 @@
+package metric
+
+import "errors"
+
+var (
+	// ErrInvalidArgument reports an invalid caller-supplied argument.
+	//
+	// ErrInvalidArgument 表示调用方传入了无效参数。
+	ErrInvalidArgument = errors.New("metric: invalid argument")
+	// ErrNotFound reports a missing metric or record.
+	//
+	// ErrNotFound 表示指标或记录不存在。
+	ErrNotFound = errors.New("metric: not found")
+	// ErrNoData reports that a valid query range contained no samples.
+	//
+	// ErrNoData 表示有效查询范围内没有采样。
+	ErrNoData = errors.New("metric: no data in range")
+	// ErrAlreadyExists reports that a create-only operation found an existing row.
+	//
+	// ErrAlreadyExists 表示只创建操作遇到了已存在的行。
+	ErrAlreadyExists = errors.New("metric: already exists")
+	// ErrClosed reports that the store has already been closed.
+	//
+	// ErrClosed 表示 Store 已经关闭。
+	ErrClosed = errors.New("metric: store is closed")
+)

pkg/metric/example_test.go

@@ -0,0 +1,347 @@
+package metric_test
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/komari-monitor/komari/pkg/metric"
+)
+
+// Example_rollupTags demonstrates tagged rollups with automatic series routing.
+//
+// Example_rollupTags 演示带标签的 rollup 以及 Series 自动路由读取。
+func Example_rollupTags() {
+	ctx := context.Background()
+	base := time.Date(2026, 6, 18, 10, 0, 0, 0, time.UTC)
+
+	store, err := metric.Open(ctx, metric.SQLite(
+		"file:metric-example?mode=memory&cache=shared",
+		metric.WithRollupPolicy(metric.RollupPolicy{
+			RawRetention: 2 * time.Minute,
+			Tiers: []metric.RollupTier{
+				{Interval: time.Minute, Retention: 24 * time.Hour},
+			},
+		}),
+	))
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer store.Close()
+
+	if err := store.CreateMetric(ctx, metric.Definition{
+		Name: "gpu.usage",
+		Type: metric.TypeGauge,
+		Unit: "%",
+	}); err != nil {
+		log.Fatal(err)
+	}
+
+	var points []metric.Point
+	for i := 0; i < 10; i++ {
+		ts := base.Add(time.Duration(i) * time.Second)
+		points = append(points,
+			metric.Point{
+				MetricName: "gpu.usage",
+				EntityID:   "host-1",
+				Timestamp:  ts,
+				Value:      float64(10 + i),
+				Tags:       map[string]string{"device_index": "0"},
+			},
+			metric.Point{
+				MetricName: "gpu.usage",
+				EntityID:   "host-1",
+				Timestamp:  ts,
+				Value:      float64(80 + i),
+				Tags:       map[string]string{"device_index": "1"},
+			},
+		)
+	}
+	if err := store.WriteBatch(ctx, points); err != nil {
+		log.Fatal(err)
+	}
+
+	// Compact builds one rollup series per tag set. Raw points older than the
+	// policy's RawRetention are deleted after their rollups are materialized.
+	now := base.Add(time.Hour)
+	if _, err := store.Compact(ctx, now); err != nil {
+		log.Fatal(err)
+	}
+
+	series, err := store.Series(ctx, metric.AggregateQuery{
+		Query: metric.Query{
+			MetricName: "gpu.usage",
+			EntityID:   "host-1",
+			Start:      base,
+			End:        base.Add(time.Minute),
+			Tags:       map[string]string{"device_index": "0"},
+		},
+		Aggregation: metric.AggAvg,
+		Interval:    time.Minute,
+	}, now)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Printf("device 0: count=%d avg=%.1f\n", series[0].Count, series[0].Value)
+
+	// Output:
+	// device 0: count=10 avg=14.5
+}
+
+// Example_agentFleetLifecycle demonstrates a realistic Komari-style fleet:
+// 50 agents report system metrics every second, ping tasks are represented as a
+// tagged ping metric, and lifecycle events clean up task and agent series.
+//
+// Example_agentFleetLifecycle 演示贴近 Komari 的实际场景：50 个 agent 每秒上报系统
+// 指标，ping task 用带标签的 ping 指标表示，并通过生命周期事件清理 task 和 agent 序列。
+func Example_agentFleetLifecycle() {
+	ctx := context.Background()
+	base := time.Date(2026, 6, 18, 10, 0, 0, 0, time.UTC)
+
+	store, err := metric.Open(ctx, metric.SQLite(
+		"file:metric-agent-fleet?mode=memory&cache=shared",
+		metric.WithRollupPolicy(metric.RollupPolicy{
+			RawRetention: 2 * time.Minute,
+			Tiers: []metric.RollupTier{
+				{Interval: time.Minute, Retention: 24 * time.Hour},
+				{Interval: 5 * time.Minute, Retention: 30 * 24 * time.Hour},
+			},
+		}),
+	))
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer store.Close()
+
+	for _, def := range []metric.Definition{
+		{Name: "cpu.usage", Type: metric.TypeGauge, Unit: "%"},
+		{Name: "mem.usage", Type: metric.TypeGauge, Unit: "%"},
+		{Name: "disk.usage", Type: metric.TypeGauge, Unit: "%"},
+		{Name: "swap.usage", Type: metric.TypeGauge, Unit: "%"},
+		{Name: "net.in.bytes", Type: metric.TypeCounter, Unit: "bytes"},
+		{Name: "net.out.bytes", Type: metric.TypeCounter, Unit: "bytes"},
+		{Name: "process.count", Type: metric.TypeGauge, Unit: "count"},
+		{Name: "gpu.usage", Type: metric.TypeGauge, Unit: "%"},
+		{Name: "ping.latency_ms", Type: metric.TypeGauge, Unit: "ms"},
+	} {
+		if err := store.UpsertMetric(ctx, def); err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	agents := makeAgents(50)
+	pingTasks := []string{"pingtask1", "pingtask2"}
+	for sec := 0; sec < 120; sec++ {
+		ts := base.Add(time.Duration(sec) * time.Second)
+
+		switch sec {
+		case 45:
+			// A ping task is deleted by the admin. Because task_id is a tag, one
+			// DeleteSeries removes that task's records for every agent, including
+			// already materialized rollups.
+			if _, err := store.DeleteSeries(ctx, metric.Query{
+				MetricName: "ping.latency_ms",
+				Tags:       map[string]string{"task_id": "pingtask2"},
+			}); err != nil {
+				log.Fatal(err)
+			}
+			pingTasks = []string{"pingtask1"}
+		case 70:
+			// The admin clears all ping task records while keeping the task
+			// definitions themselves. Deleting the metric data is the simplest
+			// reset; UpsertMetric recreates the definition before new samples land.
+			if err := store.DeleteMetric(ctx, "ping.latency_ms"); err != nil {
+				log.Fatal(err)
+			}
+			if err := store.UpsertMetric(ctx, metric.Definition{
+				Name: "ping.latency_ms", Type: metric.TypeGauge, Unit: "ms",
+			}); err != nil {
+				log.Fatal(err)
+			}
+		case 85:
+			// An agent is removed. DeleteEntity clears every metric series for
+			// that agent, raw and rollup, across the whole store.
+			if _, err := store.DeleteEntity(ctx, "agent-007"); err != nil {
+				log.Fatal(err)
+			}
+			agents = removeAgent(agents, "agent-007")
+		case 95:
+			// A new agent is added. No schema change is needed; the first write
+			// creates its series naturally.
+			agents = append(agents, "agent-051")
+		}
+
+		points := make([]metric.Point, 0, len(agents)*(7+2+len(pingTasks)))
+		for _, agentID := range agents {
+			points = append(points, systemPoints(agentID, ts, sec)...)
+			for _, gpu := range []string{"0", "1"} {
+				points = append(points, metric.Point{
+					MetricName: "gpu.usage",
+					EntityID:   agentID,
+					Timestamp:  ts,
+					Value:      gpuUsage(agentID, gpu, sec),
+					Tags:       map[string]string{"device_index": gpu},
+				})
+			}
+			for _, taskID := range pingTasks {
+				points = append(points, metric.Point{
+					MetricName: "ping.latency_ms",
+					EntityID:   agentID,
+					Timestamp:  ts,
+					Value:      pingLatency(agentID, taskID, sec),
+					Tags:       map[string]string{"task_id": taskID},
+				})
+			}
+		}
+		if err := store.WriteBatch(ctx, points); err != nil {
+			log.Fatal(err)
+		}
+		if sec%30 == 29 {
+			if _, err := store.Compact(ctx, ts); err != nil {
+				log.Fatal(err)
+			}
+		}
+	}
+
+	now := base.Add(2 * time.Hour)
+	if _, err := store.Compact(ctx, now); err != nil {
+		log.Fatal(err)
+	}
+
+	activeCPU, err := store.Series(ctx, metric.AggregateQuery{
+		Query: metric.Query{
+			MetricName: "cpu.usage",
+			Start:      base,
+			End:        base.Add(2 * time.Minute),
+		},
+		Aggregation: metric.AggAvg,
+		Interval:    time.Minute,
+	}, now)
+	if err != nil {
+		log.Fatal(err)
+	}
+	deletedAgentCPU, err := store.Series(ctx, metric.AggregateQuery{
+		Query: metric.Query{
+			MetricName: "cpu.usage",
+			EntityID:   "agent-007",
+			Start:      base,
+			End:        base.Add(2 * time.Minute),
+		},
+		Aggregation: metric.AggAvg,
+		Interval:    time.Minute,
+	}, now)
+	if err != nil {
+		log.Fatal(err)
+	}
+	task1, err := store.Series(ctx, metric.AggregateQuery{
+		Query: metric.Query{
+			MetricName: "ping.latency_ms",
+			Start:      base,
+			End:        base.Add(2 * time.Minute),
+			Tags:       map[string]string{"task_id": "pingtask1"},
+		},
+		Aggregation: metric.AggAvg,
+		Interval:    time.Minute,
+	}, now)
+	if err != nil {
+		log.Fatal(err)
+	}
+	task2, err := store.Series(ctx, metric.AggregateQuery{
+		Query: metric.Query{
+			MetricName: "ping.latency_ms",
+			Start:      base,
+			End:        base.Add(2 * time.Minute),
+			Tags:       map[string]string{"task_id": "pingtask2"},
+		},
+		Aggregation: metric.AggAvg,
+		Interval:    time.Minute,
+	}, now)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Printf("agents now=%d\n", len(agents))
+	fmt.Printf("fleet cpu buckets=%d\n", len(nonEmpty(activeCPU)))
+	fmt.Printf("deleted agent buckets=%d\n", len(nonEmpty(deletedAgentCPU)))
+	fmt.Printf("pingtask1 buckets=%d\n", len(nonEmpty(task1)))
+	fmt.Printf("pingtask2 buckets=%d\n", len(nonEmpty(task2)))
+
+	// Output:
+	// agents now=50
+	// fleet cpu buckets=2
+	// deleted agent buckets=0
+	// pingtask1 buckets=1
+	// pingtask2 buckets=0
+}
+
+func makeAgents(n int) []string {
+	out := make([]string, 0, n)
+	for i := 1; i <= n; i++ {
+		out = append(out, fmt.Sprintf("agent-%03d", i))
+	}
+	return out
+}
+
+func removeAgent(agents []string, deleted string) []string {
+	out := agents[:0]
+	for _, agentID := range agents {
+		if agentID != deleted {
+			out = append(out, agentID)
+		}
+	}
+	return out
+}
+
+func systemPoints(agentID string, ts time.Time, sec int) []metric.Point {
+	id := numericSuffix(agentID)
+	return []metric.Point{
+		{MetricName: "cpu.usage", EntityID: agentID, Timestamp: ts, Value: float64((id*3 + sec) % 100)},
+		{MetricName: "mem.usage", EntityID: agentID, Timestamp: ts, Value: 35 + float64((id+sec)%40)},
+		{MetricName: "disk.usage", EntityID: agentID, Timestamp: ts, Value: 50 + float64(id%20)/2},
+		{MetricName: "swap.usage", EntityID: agentID, Timestamp: ts, Value: float64((id + sec/10) % 12)},
+		{MetricName: "net.in.bytes", EntityID: agentID, Timestamp: ts, Value: float64(sec * (1000 + id))},
+		{MetricName: "net.out.bytes", EntityID: agentID, Timestamp: ts, Value: float64(sec * (700 + id))},
+		{MetricName: "process.count", EntityID: agentID, Timestamp: ts, Value: float64(90 + id%25)},
+	}
+}
+
+func gpuUsage(agentID, deviceIndex string, sec int) float64 {
+	id := numericSuffix(agentID)
+	device := 0
+	if deviceIndex == "1" {
+		device = 37
+	}
+	return float64((id*5 + device + sec*2) % 100)
+}
+
+func pingLatency(agentID, taskID string, sec int) float64 {
+	id := numericSuffix(agentID)
+	offset := 0
+	if strings.HasSuffix(taskID, "2") {
+		offset = 35
+	}
+	return float64(20 + (id+sec+offset)%80)
+}
+
+func numericSuffix(agentID string) int {
+	var n int
+	for _, r := range agentID {
+		if r >= '0' && r <= '9' {
+			n = n*10 + int(r-'0')
+		}
+	}
+	return n
+}
+
+func nonEmpty(points []metric.AggregatePoint) []metric.AggregatePoint {
+	out := points[:0]
+	for _, p := range points {
+		if p.Count > 0 {
+			out = append(out, p)
+		}
+	}
+	return out
+}

pkg/metric/improvements_test.go

@@ -0,0 +1,565 @@
+package metric
+
+import (
+	"context"
+	"errors"
+	"math"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// newMemStore opens an isolated in-memory store for tests.
+//
+// newMemStore 打开一个用于测试的隔离内存 Store。
+func newMemStore(t *testing.T) *Store {
+	t.Helper()
+	store, err := Open(context.Background(), SQLite("file:imp-test?mode=memory&cache=shared"))
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	return store
+}
+
+// TestCreateMetricRejectsDuplicate verifies create-only metric semantics.
+//
+// TestCreateMetricRejectsDuplicate 验证 CreateMetric 遇到重复指标时会拒绝。
+func TestCreateMetricRejectsDuplicate(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	def := Definition{Name: "dup.metric", Type: TypeGauge}
+	if err := s.CreateMetric(ctx, def); err != nil {
+		t.Fatalf("first create: %v", err)
+	}
+	err := s.CreateMetric(ctx, def)
+	if !errors.Is(err, ErrAlreadyExists) {
+		t.Fatalf("expected ErrAlreadyExists on duplicate, got %v", err)
+	}
+}
+
+// TestUpsertMetricOverwrites verifies upsert updates mutable definition fields.
+//
+// TestUpsertMetricOverwrites 验证 UpsertMetric 会更新指标定义的可变字段。
+func TestUpsertMetricOverwrites(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "m", Type: TypeGauge, Unit: "ms"}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	if err := s.UpsertMetric(ctx, Definition{Name: "m", Type: TypeCounter, Unit: "count"}); err != nil {
+		t.Fatalf("upsert: %v", err)
+	}
+	got, err := s.GetMetric(ctx, "m")
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if got.Type != TypeCounter || got.Unit != "count" {
+		t.Fatalf("upsert did not overwrite: %#v", got)
+	}
+}
+
+// TestTagFilterPushdownWithPaging verifies tag filtering happens before paging.
+//
+// TestTagFilterPushdownWithPaging 验证标签过滤会先于分页在 SQL 中执行。
+func TestTagFilterPushdownWithPaging(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "req", Type: TypeCounter}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	var batch []Point
+	for i := 0; i < 6; i++ {
+		env := "prod"
+		if i%2 == 1 {
+			env = "stage"
+		}
+		batch = append(batch, Point{
+			MetricName: "req", EntityID: "n1",
+			Timestamp: base.Add(time.Duration(i) * time.Minute),
+			Value:     float64(i),
+			Tags:      map[string]string{"env": env},
+		})
+	}
+	if err := s.WriteBatch(ctx, batch); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	// 3 prod points (i=0,2,4); with Limit=2 the SQL LIMIT must apply to the
+	// tag-filtered set, returning the first two prod points in time order.
+	got, err := s.Query(ctx, Query{
+		MetricName: "req", EntityID: "n1",
+		Start: base, End: base.Add(time.Hour),
+		Tags:  map[string]string{"env": "prod"},
+		Limit: 2,
+	})
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("expected 2 paged prod points, got %d", len(got))
+	}
+	if got[0].Value != 0 || got[1].Value != 2 {
+		t.Fatalf("unexpected paged values: %#v", got)
+	}
+}
+
+// TestSQLAggregateMatchesInMemory compares SQL and in-memory aggregation.
+//
+// TestSQLAggregateMatchesInMemory 对比 SQL 下推聚合和内存聚合结果。
+func TestSQLAggregateMatchesInMemory(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "g", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	var batch []Point
+	vals := []float64{5, 15, 25, 35, 100, 200}
+	for i, v := range vals {
+		batch = append(batch, Point{
+			MetricName: "g", EntityID: "n1",
+			Timestamp: base.Add(time.Duration(i) * time.Minute),
+			Value:     v,
+		})
+	}
+	if err := s.WriteBatch(ctx, batch); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	q := AggregateQuery{
+		Query:       Query{MetricName: "g", EntityID: "n1", Start: base, End: base.Add(time.Hour)},
+		Aggregation: AggAvg,
+		Interval:    3 * time.Minute,
+	}
+	// SQL pushdown path.
+	sqlRes, err := s.Aggregate(ctx, q)
+	if err != nil {
+		t.Fatalf("sql aggregate: %v", err)
+	}
+	// In-memory reference over the same raw points.
+	pts, err := s.Query(ctx, q.Query)
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	memRes, err := AggregatePoints(pts, q)
+	if err != nil {
+		t.Fatalf("mem aggregate: %v", err)
+	}
+	if len(sqlRes) != len(memRes) {
+		t.Fatalf("bucket count mismatch: sql=%d mem=%d", len(sqlRes), len(memRes))
+	}
+	for i := range sqlRes {
+		if !sqlRes[i].Bucket.Equal(memRes[i].Bucket) || sqlRes[i].Value != memRes[i].Value || sqlRes[i].Count != memRes[i].Count {
+			t.Fatalf("bucket %d mismatch: sql=%#v mem=%#v", i, sqlRes[i], memRes[i])
+		}
+	}
+}
+
+// TestCounterRateHandlesReset verifies reset-aware counter rate calculation.
+//
+// TestCounterRateHandlesReset 验证计数器重置时速率计算仍然稳定。
+func TestCounterRateHandlesReset(t *testing.T) {
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	// Counter goes 0 -> 10 -> reset -> 5; naive (last-first)/sec would give a
+	// positive-but-wrong 5/30s. Correct counter rate sums positive deltas:
+	// (10-0) + (5-0 after reset) = 15 over 30s = 0.5/s.
+	pts := []Point{
+		{Timestamp: base, Value: 0},
+		{Timestamp: base.Add(10 * time.Second), Value: 10},
+		{Timestamp: base.Add(20 * time.Second), Value: 0},
+		{Timestamp: base.Add(30 * time.Second), Value: 5},
+	}
+	rate := counterRate(pts)
+	if rate != 0.5 {
+		t.Fatalf("expected reset-aware rate 0.5/s, got %v", rate)
+	}
+}
+
+// TestAlignTimeNegativeTimestamp verifies pre-epoch bucket alignment.
+//
+// TestAlignTimeNegativeTimestamp 验证 Unix epoch 之前的时间也能正确对齐桶。
+func TestAlignTimeNegativeTimestamp(t *testing.T) {
+	interval := time.Minute
+	// 30s before the epoch should align down to -60s, not up to 0.
+	tm := time.Unix(-30, 0).UTC()
+	got := alignTime(tm, interval)
+	want := time.Unix(-60, 0).UTC()
+	if !got.Equal(want) {
+		t.Fatalf("alignTime negative: got %v want %v", got, want)
+	}
+}
+
+// TestLatestReturnsMostRecent verifies latest-point ordering.
+//
+// TestLatestReturnsMostRecent 验证 Latest 返回最新采样点。
+func TestLatestReturnsMostRecent(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "l", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	for i := 0; i < 5; i++ {
+		if err := s.Write(ctx, Point{MetricName: "l", EntityID: "n1", Timestamp: base.Add(time.Duration(i) * time.Minute), Value: float64(i)}); err != nil {
+			t.Fatalf("write: %v", err)
+		}
+	}
+	got, err := s.Latest(ctx, "l", "n1", 2)
+	if err != nil {
+		t.Fatalf("latest: %v", err)
+	}
+	if len(got) != 2 || got[0].Value != 4 || got[1].Value != 3 {
+		t.Fatalf("unexpected latest: %#v", got)
+	}
+}
+
+// TestStatsDistinguishesNoDataFromUnknownMetric verifies stats error semantics.
+//
+// TestStatsDistinguishesNoDataFromUnknownMetric 验证 Stats 能区分无数据和未知指标。
+func TestStatsDistinguishesNoDataFromUnknownMetric(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+
+	// Unknown metric -> ErrNotFound.
+	_, err := s.Stats(ctx, Query{MetricName: "nope", Start: base, End: base.Add(time.Hour)})
+	if !errors.Is(err, ErrNotFound) {
+		t.Fatalf("unknown metric: expected ErrNotFound, got %v", err)
+	}
+
+	// Known metric but empty window -> ErrNoData.
+	if err := s.CreateMetric(ctx, Definition{Name: "known", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	_, err = s.Stats(ctx, Query{MetricName: "known", Start: base, End: base.Add(time.Hour)})
+	if !errors.Is(err, ErrNoData) {
+		t.Fatalf("empty window: expected ErrNoData, got %v", err)
+	}
+}
+
+// TestStdDevPopMatchesCalculateStats verifies population standard deviation.
+//
+// TestStdDevPopMatchesCalculateStats 验证总体标准差与统计摘要一致。
+func TestStdDevPopMatchesCalculateStats(t *testing.T) {
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	var pts []Point
+	for i, v := range []float64{10, 20, 30, 40, 50} {
+		pts = append(pts, Point{Timestamp: base.Add(time.Duration(i) * time.Minute), Value: v})
+	}
+	st, err := CalculateStats(pts)
+	if err != nil {
+		t.Fatalf("stats: %v", err)
+	}
+	got, _ := aggregateValue(pts, AggStdDev)
+	if math.Abs(got-st.StdDev) > 1e-9 {
+		t.Fatalf("AggStdDev %v != Stats.StdDev %v", got, st.StdDev)
+	}
+	// Known value: population stddev of 10..50 step 10 is sqrt(200) ~= 14.142135.
+	if math.Abs(got-14.142135623730951) > 1e-9 {
+		t.Fatalf("unexpected population stddev: %v", got)
+	}
+}
+
+// TestAggregateStdDevSQLiteUsesMemoryPath verifies SQLite stddev fallback.
+//
+// TestAggregateStdDevSQLiteUsesMemoryPath 验证 SQLite 标准差聚合会回退到内存路径。
+func TestAggregateStdDevSQLiteUsesMemoryPath(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "sd", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	var batch []Point
+	for i, v := range []float64{10, 20, 30} {
+		batch = append(batch, Point{MetricName: "sd", EntityID: "n1", Timestamp: base.Add(time.Duration(i) * time.Minute), Value: v})
+	}
+	if err := s.WriteBatch(ctx, batch); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	res, err := s.Aggregate(ctx, AggregateQuery{
+		Query:       Query{MetricName: "sd", EntityID: "n1", Start: base, End: base.Add(time.Hour)},
+		Aggregation: AggStdDev,
+		Interval:    time.Hour,
+	})
+	if err != nil {
+		t.Fatalf("aggregate stddev: %v", err)
+	}
+	if len(res) != 1 {
+		t.Fatalf("expected 1 bucket, got %d", len(res))
+	}
+	// Population stddev of {10,20,30} = sqrt(200/3) ~= 8.16496.
+	if math.Abs(res[0].Value-8.16496580927726) > 1e-9 {
+		t.Fatalf("unexpected stddev bucket value: %v", res[0].Value)
+	}
+}
+
+// TestSQLAggValueExprPushdownMatrix verifies aggregation pushdown support.
+//
+// TestSQLAggValueExprPushdownMatrix 验证各后端支持的聚合下推矩阵。
+func TestSQLAggValueExprPushdownMatrix(t *testing.T) {
+	cases := []struct {
+		driver Driver
+		agg    Aggregation
+		ok     bool
+	}{
+		{DriverSQLite, AggAvg, true},
+		{DriverSQLite, AggStdDev, false}, // no STDDEV_POP in sqlite -> memory
+		{DriverSQLite, AggP95, false},    // no percentile in sqlite -> memory
+		{DriverMySQL, AggStdDev, true},   // STDDEV_POP
+		{DriverMySQL, AggP95, false},     // no portable continuous percentile
+		{DriverPostgreSQL, AggStdDev, true},
+		{DriverPostgreSQL, AggP50, true}, // percentile_cont
+		{DriverPostgreSQL, AggP99, true},
+		{DriverPostgreSQL, AggFirst, false}, // needs ordered raw series
+	}
+	for _, c := range cases {
+		expr, ok := sqlAggValueExpr(c.driver, c.agg)
+		if ok != c.ok {
+			t.Fatalf("%s/%s: pushdown=%v want %v (expr=%q)", c.driver, c.agg, ok, c.ok, expr)
+		}
+		if ok && expr == "" {
+			t.Fatalf("%s/%s: pushdown ok but empty expr", c.driver, c.agg)
+		}
+	}
+}
+
+// TestSQLiteReadPoolOpens verifies SQLite read-pool creation.
+//
+// TestSQLiteReadPoolOpens 验证 SQLite 只读连接池会按配置打开。
+func TestSQLiteReadPoolOpens(t *testing.T) {
+	ctx := context.Background()
+	dir := filepath.Join(t.TempDir(), "rp")
+	store, err := Open(ctx, SQLiteInDir(dir, WithSQLiteReadPool(4)))
+	if err != nil {
+		t.Fatalf("open with read pool: %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	if store.readDB == nil {
+		t.Fatalf("expected a dedicated read pool to be opened")
+	}
+	if store.reader() != store.readDB {
+		t.Fatalf("reader() should return the dedicated read pool")
+	}
+	// Round-trip a write (primary) and a read (read pool).
+	if err := store.CreateMetric(ctx, Definition{Name: "rp", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	if err := store.Write(ctx, Point{MetricName: "rp", EntityID: "n1", Timestamp: base, Value: 7}); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	got, err := store.Latest(ctx, "rp", "n1", 1)
+	if err != nil {
+		t.Fatalf("latest: %v", err)
+	}
+	if len(got) != 1 || got[0].Value != 7 {
+		t.Fatalf("read pool round-trip failed: %#v", got)
+	}
+}
+
+// TestMemoryDSNSkipsReadPool verifies memory SQLite skips read pools.
+//
+// TestMemoryDSNSkipsReadPool 验证内存 SQLite 不会打开独立读池。
+func TestMemoryDSNSkipsReadPool(t *testing.T) {
+	ctx := context.Background()
+	store, err := Open(ctx, SQLite("file:rp-mem?mode=memory&cache=shared", WithSQLiteReadPool(4)))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	if store.readDB != nil {
+		t.Fatalf("in-memory database must not open a second read pool")
+	}
+}
+
+// TestWriteBatchAtomicAcrossChunks verifies chunked writes are atomic.
+//
+// TestWriteBatchAtomicAcrossChunks 验证分块批量写入仍保持整体原子性。
+func TestWriteBatchAtomicAcrossChunks(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "atom", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	// 1500 valid points, then one invalid (missing entity) to force a mid-batch
+	// failure on the second chunk. The whole batch must roll back.
+	var batch []Point
+	for i := 0; i < 1500; i++ {
+		batch = append(batch, Point{MetricName: "atom", EntityID: "n1", Timestamp: base.Add(time.Duration(i) * time.Millisecond), Value: float64(i)})
+	}
+	batch = append(batch, Point{MetricName: "atom", EntityID: "", Timestamp: base.Add(2 * time.Second), Value: 1}) // invalid
+	if err := s.WriteBatch(ctx, batch); err == nil {
+		t.Fatalf("expected WriteBatch to fail on invalid point")
+	}
+	// Nothing should have been committed.
+	pts, err := s.Query(ctx, Query{MetricName: "atom", EntityID: "n1", Start: base, End: base.Add(time.Hour)})
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	if len(pts) != 0 {
+		t.Fatalf("expected 0 committed points after rolled-back batch, got %d", len(pts))
+	}
+}
+
+// TestAggregateBucketPagingSQLPath verifies bucket paging in SQL aggregation.
+//
+// TestAggregateBucketPagingSQLPath 验证 SQL 聚合路径按桶分页。
+func TestAggregateBucketPagingSQLPath(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "bp", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	// 6 points across 6 one-minute buckets, values 0..5.
+	var batch []Point
+	for i := 0; i < 6; i++ {
+		batch = append(batch, Point{MetricName: "bp", EntityID: "n1", Timestamp: base.Add(time.Duration(i) * time.Minute), Value: float64(i)})
+	}
+	if err := s.WriteBatch(ctx, batch); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	// AggAvg -> SQL pushdown path. One bucket per minute. Page: offset 1, limit 2.
+	res, err := s.Aggregate(ctx, AggregateQuery{
+		Query:        Query{MetricName: "bp", EntityID: "n1", Start: base, End: base.Add(time.Hour)},
+		Aggregation:  AggAvg,
+		Interval:     time.Minute,
+		BucketLimit:  2,
+		BucketOffset: 1,
+	})
+	if err != nil {
+		t.Fatalf("aggregate: %v", err)
+	}
+	if len(res) != 2 {
+		t.Fatalf("expected 2 paged buckets, got %d", len(res))
+	}
+	// Buckets are values 0..5; offset 1 skips the value-0 bucket, so we expect 1,2.
+	if res[0].Value != 1 || res[1].Value != 2 {
+		t.Fatalf("unexpected paged bucket values: %#v", res)
+	}
+}
+
+// TestAggregateBucketPagingMemoryPathMatchesSQL compares bucket paging paths.
+//
+// TestAggregateBucketPagingMemoryPathMatchesSQL 对比内存聚合和 SQL 聚合的桶分页语义。
+func TestAggregateBucketPagingMemoryPathMatchesSQL(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "bp2", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	var batch []Point
+	for i := 0; i < 6; i++ {
+		batch = append(batch, Point{MetricName: "bp2", EntityID: "n1", Timestamp: base.Add(time.Duration(i) * time.Minute), Value: float64(i * 10)})
+	}
+	if err := s.WriteBatch(ctx, batch); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	q := Query{MetricName: "bp2", EntityID: "n1", Start: base, End: base.Add(time.Hour)}
+	// AggMin (SQL pushdown) and AggP50 (memory fallback on sqlite) with identical
+	// bucket paging must select the same bucket window (the same timestamps).
+	sqlPaged, err := s.Aggregate(ctx, AggregateQuery{Query: q, Aggregation: AggMin, Interval: time.Minute, BucketLimit: 3, BucketOffset: 2})
+	if err != nil {
+		t.Fatalf("sql aggregate: %v", err)
+	}
+	memPaged, err := s.Aggregate(ctx, AggregateQuery{Query: q, Aggregation: AggP50, Interval: time.Minute, BucketLimit: 3, BucketOffset: 2})
+	if err != nil {
+		t.Fatalf("mem aggregate: %v", err)
+	}
+	if len(sqlPaged) != 3 || len(memPaged) != 3 {
+		t.Fatalf("expected 3 buckets each, got sql=%d mem=%d", len(sqlPaged), len(memPaged))
+	}
+	for i := range sqlPaged {
+		if !sqlPaged[i].Bucket.Equal(memPaged[i].Bucket) {
+			t.Fatalf("bucket window mismatch at %d: sql=%v mem=%v", i, sqlPaged[i].Bucket, memPaged[i].Bucket)
+		}
+	}
+	// Per-bucket single point, so min == p50 == the value.
+	for i := range sqlPaged {
+		if sqlPaged[i].Value != memPaged[i].Value {
+			t.Fatalf("value mismatch at %d: sql=%v mem=%v", i, sqlPaged[i].Value, memPaged[i].Value)
+		}
+	}
+}
+
+// TestAggregateIgnoresRawPointLimit verifies raw limits do not affect aggregation.
+//
+// TestAggregateIgnoresRawPointLimit 验证原始点分页参数不会影响聚合输入。
+func TestAggregateIgnoresRawPointLimit(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "ig", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	var batch []Point
+	for i := 0; i < 6; i++ {
+		batch = append(batch, Point{MetricName: "ig", EntityID: "n1", Timestamp: base.Add(time.Duration(i) * time.Minute), Value: float64(i)})
+	}
+	if err := s.WriteBatch(ctx, batch); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	// The embedded Query.Limit must be ignored for aggregation: a single 1-hour
+	// bucket should aggregate ALL 6 points (count 6), not just 2.
+	res, err := s.Aggregate(ctx, AggregateQuery{
+		Query:       Query{MetricName: "ig", EntityID: "n1", Start: base, End: base.Add(time.Hour), Limit: 2},
+		Aggregation: AggP95, // memory path, where the bug would have surfaced
+		Interval:    time.Hour,
+	})
+	if err != nil {
+		t.Fatalf("aggregate: %v", err)
+	}
+	if len(res) != 1 || res[0].Count != 6 {
+		t.Fatalf("embedded Limit leaked into aggregation: %#v", res)
+	}
+}
+
+// TestJSONTagKeyWithSpecialChars verifies JSON tag keys with special characters.
+//
+// TestJSONTagKeyWithSpecialChars 验证包含特殊字符的标签键可正确查询。
+func TestJSONTagKeyWithSpecialChars(t *testing.T) {
+	ctx := context.Background()
+	s := newMemStore(t)
+	if err := s.CreateMetric(ctx, Definition{Name: "tk", Type: TypeGauge}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	base := time.Date(2026, 6, 18, 0, 0, 0, 0, time.UTC)
+	// Keys containing a dot, a hyphen, a space, and a quote.
+	tags := map[string]string{
+		"region.zone": "ap-1",
+		"a-b":         "yes",
+		"with space":  "ok",
+	}
+	if err := s.Write(ctx, Point{MetricName: "tk", EntityID: "n1", Timestamp: base, Value: 1, Tags: tags}); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	// A second point that should NOT match the filter below.
+	if err := s.Write(ctx, Point{MetricName: "tk", EntityID: "n1", Timestamp: base.Add(time.Minute), Value: 2, Tags: map[string]string{"region.zone": "eu-1"}}); err != nil {
+		t.Fatalf("write 2: %v", err)
+	}
+
+	for _, tc := range []struct {
+		key, val string
+		want     int
+	}{
+		{"region.zone", "ap-1", 1}, // dotted key must match the flat key, not nested
+		{"a-b", "yes", 1},          // hyphen
+		{"with space", "ok", 1},    // space
+		{"region.zone", "eu-1", 1}, // the other point
+	} {
+		got, err := s.Query(ctx, Query{
+			MetricName: "tk", EntityID: "n1",
+			Start: base.Add(-time.Second), End: base.Add(time.Hour),
+			Tags: map[string]string{tc.key: tc.val},
+		})
+		if err != nil {
+			t.Fatalf("query %s=%s: %v", tc.key, tc.val, err)
+		}
+		if len(got) != tc.want {
+			t.Fatalf("tag %q=%q: expected %d points, got %d", tc.key, tc.val, tc.want, len(got))
+		}
+	}
+}