ci: verify memind_adm release candidates

.adm-api.pid

@@ -1 +0,0 @@
-26747

.adm-preview.pid

@@ -1 +0,0 @@
-25645

.gitea/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: memind_adm CI
+
+on:
+  push:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: memind-adm-ci-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Test, build, and release script checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out exact commit
+        run: |
+          git init .
+          git remote add origin https://git.tkmind.cn/tkmind/memind_adm.git
+          git fetch --depth=2 origin "${{ gitea.sha }}"
+          git checkout --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "${{ gitea.sha }}"
+
+      - name: Install locked dependencies
+        run: npm ci --no-audit --no-fund
+
+      - name: Check patch formatting
+        run: git diff --check HEAD^ HEAD
+
+      - name: Run Admin API tests
+        run: npm test
+
+      - name: Build production frontend
+        run: VITE_BASE_PATH=/ops npm run build
+
+      - name: Check release scripts
+        run: |
+          bash -n scripts/release-prod.sh
+          bash -n scripts/check-gray-ready.sh
+          bash -n scripts/deploy-gray-103.sh
+
+      - name: Confirm build leaves the worktree clean
+        run: test -z "$(git status --porcelain=v1 --untracked-files=all)"

.gitignore

@@ -9,3 +9,8 @@ memind-lib/
 .vite/
 *.log
 logs/
+.adm-api.pid
+.adm-dev.pid
+.adm-preview.pid
+*.pid
+release-candidates/

.h5-server.pid

@@ -1 +0,0 @@
-41863

docs/DEPLOY.md

@@ -83,10 +83,42 @@ nginx 示例见 `scripts/gadm-nginx.conf.example`（`/ops/` → preview，`/auth
 ## 唯一入口
 
 ```bash
-bash scripts/release-prod.sh --dry-run
+# 只生成持久候选包；不连接、不修改 103
+TEST_MEMIND_ROOT=<clean-Memind-worktree> \
+IMAGE_MAKE_RELEASE_ID=20260720-standalone-rc1 \
+bash scripts/release-prod.sh --package-only
+
+# 候选包生成后，只读检查 103 灰度前置条件
+bash scripts/check-gray-ready.sh --candidate-dir release-candidates/<release-id>
+
+# 明确批准后，部署 103 loopback-only 灰度实例；不切换 live
+bash scripts/deploy-gray-103.sh \
+  --candidate-dir release-candidates/<release-id> \
+  --yes
+
+# 正式生产发布；必须在灰度通过并得到明确许可后执行
 bash scripts/release-prod.sh
 ```
 
+`--dry-run` 是 `--package-only` 的兼容别名。候选包默认保存在
+`release-candidates/<release-id>/`，包含 tar 包、manifest 和 SHA-256 校验文件。
+
+发包时 `Memind` 共享源码必须满足：
+
+1. 是 Git 工作区且完全干净。
+2. `HEAD` 精确匹配 `MEMIND_BASE_REF`（默认 `origin/main`）。
+3. 包含 `asset-gateway.mjs`、`image-make-admin-config.mjs`、`image-make-client.mjs`。
+4. manifest 明确记录 `IMAGE_MAKE_RELEASE_ID`，避免后台候选与错误的 image_make 版本配套。
+
+灰度分两层：
+
+1. `check-gray-ready.sh` 默认只做后台候选包、103 当前健康状态、灰度端口和 image_make 版本的只读预检。
+2. `--require-image-integration` 额外要求 Portal runtime-config 路由、image_make 配置 URL 和 worker 均已就绪。该条件涉及生产运行态，未经单独许可不得开启。
+3. `deploy-gray-103.sh` 只在 `127.0.0.1:15174/18085` 启动独立灰度实例，不替换 live，不重启 `5174/8085`，并设置 `ADM_READ_ONLY_MODE=1` 阻断管理后台与 Plaza API 写操作。
+4. 灰度页面默认只能通过 SSH 端口转发访问，不增加 105 nginx/Caddy 路由，也不产生公网入口。
+
+`release-prod.sh` 没有“灰度即生产”的隐式行为：不带 `--package-only` 时就是正式 live 原子切换，必须等灰度验收通过后再执行。
+
 ## 产物发布流程
 
 1. 本地生成 `memind-adm-<release-id>.tar.gz` 和发布清单。
@@ -94,7 +126,7 @@ bash scripts/release-prod.sh
 3. 103 备份当前 `/Users/john/Project/memind_adm` 为时间戳压缩包。
 4. 在 `/Users/john/Project/releases/` 下解包新版本。
 5. 从当前 live 目录继承运行态配置与日志文件。
-6. 在 release 目录安装依赖、构建。
+6. 在 release 目录安装锁定依赖；前端 `dist/` 已在本地构建完成，103 不执行前端构建。
 7. 原子切换 `memind_adm` live 目录。
 8. 调用 `scripts/remote_restart.sh` 重启 `8085` 和 `5174`。
 9. 检查 `127.0.0.1:8085/health` 与 `127.0.0.1:5174/`。

package.json

@@ -7,6 +7,8 @@
     "dev": "node scripts/dev.mjs",
     "dev:web": "vite",
     "dev:server": "node server/index.mjs",
+    "test": "node --test server/*.test.mjs",
+    "test:image-make-admin": "node --test server/app.image-make.test.mjs",
     "admin:init": "node scripts/init-admin.mjs",
     "release:prod": "bash scripts/release-prod.sh",
     "local_restart": "bash scripts/local_restart.sh",

scripts/.releaseignore-prod

@@ -1,4 +1,5 @@
 .git
+.gitea
 .gitignore
 .DS_Store
 .env
@@ -7,10 +8,12 @@
 .adm-api.pid
 .adm-dev.pid
 .adm-preview.pid
+*.pid
 .claude
 .mindops
 node_modules
 coverage
+release-candidates
 *.log
 adm-preview.log
 adm-api.log
@@ -33,6 +36,8 @@ scripts/local_restart.sh
 scripts/pro_restart.sh
 scripts/rsync_to_server.sh
 scripts/audit-103-state.sh
+scripts/check-gray-ready.sh
+scripts/deploy-gray-103.sh
 scripts/gadm-nginx-105.conf
 scripts/gadm-nginx.conf.example
 scripts/gadm-lb.Caddyfile

scripts/check-gray-ready.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+HOST="${STUDIO_HOST:-10.10.0.2}"
+GRAY_WEB_PORT="${GRAY_WEB_PORT:-15174}"
+GRAY_API_PORT="${GRAY_API_PORT:-18085}"
+REQUIRE_IMAGE_INTEGRATION=0
+CANDIDATE_DIR=""
+
+usage() {
+  cat <<'EOF'
+Usage:
+  bash scripts/check-gray-ready.sh --candidate-dir DIR [--require-image-integration]
+
+Read-only checks only. This script never uploads, restarts, or changes 103.
+
+Checks:
+  - candidate checksum and traceability manifest
+  - current memind_adm production health
+  - reserved gray ports are free on 103
+  - expected image_make release is healthy on 103
+  - optional end-to-end Portal/image_make runtime wiring readiness
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --candidate-dir)
+      shift
+      [[ $# -gt 0 ]] || { echo "--candidate-dir requires a directory" >&2; exit 2; }
+      CANDIDATE_DIR="$1"
+      ;;
+    --require-image-integration) REQUIRE_IMAGE_INTEGRATION=1 ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+[[ -n "${CANDIDATE_DIR}" ]] || { usage >&2; exit 2; }
+if [[ "${CANDIDATE_DIR}" != /* ]]; then
+  CANDIDATE_DIR="${ROOT}/${CANDIDATE_DIR}"
+fi
+[[ -d "${CANDIDATE_DIR}" ]] || { echo "Candidate directory not found: ${CANDIDATE_DIR}" >&2; exit 1; }
+
+manifest="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.manifest.txt' -print -quit)"
+sha_file="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.sha256' -print -quit)"
+bundle="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.tar.gz' -print -quit)"
+[[ -n "${manifest}" && -n "${sha_file}" && -n "${bundle}" ]] || {
+  echo "Candidate bundle, manifest, or checksum file missing in ${CANDIDATE_DIR}" >&2
+  exit 1
+}
+
+(
+  cd "${CANDIDATE_DIR}"
+  shasum -a 256 -c "$(basename "${sha_file}")"
+)
+
+if tar -tzf "${bundle}" | grep -Eq '(^|/)(\.env($|\.)|[^/]*\.pid$|src/|release-candidates/)'; then
+  echo "Candidate contains forbidden runtime or development assets" >&2
+  tar -tzf "${bundle}" | grep -E '(^|/)(\.env($|\.)|[^/]*\.pid$|src/|release-candidates/)' >&2 || true
+  exit 1
+fi
+
+manifest_value() {
+  local key="$1"
+  sed -n "s/^${key}=//p" "${manifest}" | head -n 1
+}
+
+release_id="$(manifest_value release_id)"
+git_head="$(manifest_value git_head)"
+memind_head="$(manifest_value memind_git_head)"
+memind_status="$(manifest_value memind_git_status)"
+image_make_release_id="$(manifest_value image_make_release_id)"
+
+[[ -n "${release_id}" && -n "${git_head}" && -n "${memind_head}" ]] || {
+  echo "Candidate manifest is missing release traceability fields" >&2
+  exit 1
+}
+[[ "${memind_status}" == "clean" ]] || {
+  echo "Candidate manifest does not prove a clean Memind shared source" >&2
+  exit 1
+}
+[[ "${image_make_release_id}" != "not-declared" && -n "${image_make_release_id}" ]] || {
+  echo "Candidate manifest must declare IMAGE_MAKE_RELEASE_ID" >&2
+  exit 1
+}
+
+echo "candidate_release=${release_id}"
+echo "candidate_git_head=${git_head}"
+echo "candidate_memind_head=${memind_head}"
+echo "candidate_image_make_release=${image_make_release_id}"
+
+set +e
+remote_result="$(ssh -o BatchMode=yes -o ConnectTimeout=15 "${HOST}" \
+  "GRAY_WEB_PORT='${GRAY_WEB_PORT}' GRAY_API_PORT='${GRAY_API_PORT}' IMAGE_MAKE_RELEASE_ID='${image_make_release_id}' REQUIRE_IMAGE_INTEGRATION='${REQUIRE_IMAGE_INTEGRATION}' /bin/bash" <<'REMOTE'
+set -euo pipefail
+
+api_code="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:8085/health || true)"
+web_code="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:5174/ops/ || true)"
+image_code="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:18083/health || true)"
+[[ "${api_code}" == "200" && "${web_code}" == "200" && "${image_code}" == "200" ]] || {
+  echo "health_failed admin_api=${api_code} admin_web=${web_code} image_make=${image_code}" >&2
+  exit 1
+}
+
+for port in "${GRAY_WEB_PORT}" "${GRAY_API_PORT}"; do
+  if lsof -nP -iTCP:"${port}" -sTCP:LISTEN -t | grep -q .; then
+    echo "gray_port_in_use=${port}" >&2
+    exit 1
+  fi
+done
+
+export DOCKER_HOST=unix:///Users/john/.colima/default/docker.sock
+docker_bin=/usr/local/bin/docker
+container="$(${docker_bin} ps --format '{{.Names}} {{.Ports}}' | awk '/18083/ {print $1; exit}')"
+[[ -n "${container}" ]] || { echo "image_make_container_missing" >&2; exit 1; }
+image="$(${docker_bin} inspect --format '{{.Config.Image}}' "${container}")"
+health="$(${docker_bin} inspect --format '{{.State.Health.Status}}' "${container}")"
+[[ "${image}" == *"${IMAGE_MAKE_RELEASE_ID}"* && "${health}" == "healthy" ]] || {
+  echo "image_make_release_mismatch image=${image} health=${health}" >&2
+  exit 1
+}
+
+worker_enabled="$(${docker_bin} inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "${container}" | sed -n 's/^WORKER_ENABLED=//p' | head -n 1)"
+config_url_present=0
+if ${docker_bin} inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "${container}" | grep -q '^IMAGE_MAKE_MEMIND_CONFIG_URL=.'; then
+  config_url_present=1
+fi
+portal_route_present=0
+if grep -q '/internal/image-make/runtime-config' /Users/john/Project/Memind/server.mjs 2>/dev/null; then
+  portal_route_present=1
+fi
+
+echo "admin_api=200 admin_web=200 image_make=200"
+echo "gray_ports_free=${GRAY_WEB_PORT},${GRAY_API_PORT}"
+echo "image_make_image=${image}"
+echo "image_make_worker_enabled=${worker_enabled:-unset}"
+echo "image_make_config_url_present=${config_url_present}"
+echo "portal_runtime_route_present=${portal_route_present}"
+
+if [[ "${REQUIRE_IMAGE_INTEGRATION}" == "1" ]]; then
+  [[ "${worker_enabled}" == "true" && "${config_url_present}" == "1" && "${portal_route_present}" == "1" ]] || {
+    echo "image_make_integration_not_ready" >&2
+    exit 1
+  }
+fi
+REMOTE
+)"
+remote_status=$?
+set -e
+
+printf '%s\n' "${remote_result}"
+if [[ "${remote_status}" -ne 0 ]]; then
+  echo "gray_preflight=failed" >&2
+  exit "${remote_status}"
+fi
+echo "gray_preflight=passed"

scripts/deploy-gray-103.sh

@@ -0,0 +1,210 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+HOST="${STUDIO_HOST:-10.10.0.2}"
+GRAY_WEB_PORT="${GRAY_WEB_PORT:-15174}"
+GRAY_API_PORT="${GRAY_API_PORT:-18085}"
+REMOTE_GRAY_ROOT="${REMOTE_GRAY_ROOT:-/Users/john/Project/gray/memind_adm}"
+CANDIDATE_DIR=""
+AUTO_YES=0
+
+usage() {
+  cat <<'EOF'
+Usage:
+  bash scripts/deploy-gray-103.sh --candidate-dir DIR [--yes]
+
+Deploys a loopback-only, read-only memind_adm gray instance on 103.
+It does not replace /Users/john/Project/memind_adm and does not restart live ports 5174/8085.
+
+Defaults:
+  gray web: 127.0.0.1:15174/ops/
+  gray API: 127.0.0.1:18085
+
+The --yes flag is mandatory because this writes a separate gray release to 103.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --candidate-dir)
+      shift
+      [[ $# -gt 0 ]] || { echo "--candidate-dir requires a directory" >&2; exit 2; }
+      CANDIDATE_DIR="$1"
+      ;;
+    --yes|-y) AUTO_YES=1 ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+[[ -n "${CANDIDATE_DIR}" ]] || { usage >&2; exit 2; }
+if [[ "${CANDIDATE_DIR}" != /* ]]; then
+  CANDIDATE_DIR="${ROOT}/${CANDIDATE_DIR}"
+fi
+[[ -d "${CANDIDATE_DIR}" ]] || { echo "Candidate directory not found: ${CANDIDATE_DIR}" >&2; exit 1; }
+
+manifest="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.manifest.txt' -print -quit)"
+sha_file="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.sha256' -print -quit)"
+bundle="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.tar.gz' -print -quit)"
+[[ -n "${manifest}" && -n "${sha_file}" && -n "${bundle}" ]] || {
+  echo "Candidate bundle, manifest, or checksum file missing" >&2
+  exit 1
+}
+
+release_id="$(sed -n 's/^release_id=//p' "${manifest}" | head -n 1)"
+[[ "${release_id}" =~ ^[A-Za-z0-9._-]+$ ]] || {
+  echo "Invalid release_id in manifest: ${release_id}" >&2
+  exit 1
+}
+
+bash "${ROOT}/scripts/check-gray-ready.sh" --candidate-dir "${CANDIDATE_DIR}"
+
+if [[ "${AUTO_YES}" -ne 1 ]]; then
+  echo
+  echo "Gray deployment is ready but was not started."
+  echo "Target: ${HOST} ${REMOTE_GRAY_ROOT}/releases/${release_id}"
+  echo "Ports: 127.0.0.1:${GRAY_WEB_PORT}, 127.0.0.1:${GRAY_API_PORT}"
+  echo "Re-run with --yes after explicit approval."
+  exit 2
+fi
+
+remote_incoming="${REMOTE_GRAY_ROOT}/incoming/${release_id}"
+ssh -o BatchMode=yes -o ConnectTimeout=15 "${HOST}" "mkdir -p '${remote_incoming}'"
+scp -q "${bundle}" "${manifest}" "${sha_file}" "${HOST}:${remote_incoming}/"
+
+ssh -o BatchMode=yes "${HOST}" \
+  "RELEASE_ID='${release_id}' GRAY_WEB_PORT='${GRAY_WEB_PORT}' GRAY_API_PORT='${GRAY_API_PORT}' REMOTE_GRAY_ROOT='${REMOTE_GRAY_ROOT}' /bin/bash" <<'REMOTE'
+set -euo pipefail
+
+LIVE_DIR=/Users/john/Project/memind_adm
+INCOMING_DIR="${REMOTE_GRAY_ROOT}/incoming/${RELEASE_ID}"
+RELEASE_DIR="${REMOTE_GRAY_ROOT}/releases/${RELEASE_ID}"
+BUNDLE="${INCOMING_DIR}/memind-adm-${RELEASE_ID}.tar.gz"
+MANIFEST="${INCOMING_DIR}/memind-adm-${RELEASE_ID}.manifest.txt"
+SHA_FILE="${INCOMING_DIR}/memind-adm-${RELEASE_ID}.sha256"
+
+stop_gray_ports() {
+  lsof -ti "TCP:${GRAY_WEB_PORT}" -sTCP:LISTEN 2>/dev/null | xargs kill 2>/dev/null || true
+  lsof -ti "TCP:${GRAY_API_PORT}" -sTCP:LISTEN 2>/dev/null | xargs kill 2>/dev/null || true
+}
+
+rollback_gray() {
+  stop_gray_ports
+  echo "Gray startup failed; live memind_adm was not changed." >&2
+}
+trap rollback_gray ERR
+
+live_api_before="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:8085/health || true)"
+live_web_before="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:5174/ops/ || true)"
+[[ "${live_api_before}" == "200" && "${live_web_before}" == "200" ]] || {
+  echo "Live memind_adm is not healthy before gray deployment" >&2
+  exit 1
+}
+
+for port in "${GRAY_WEB_PORT}" "${GRAY_API_PORT}"; do
+  if lsof -nP -iTCP:"${port}" -sTCP:LISTEN -t | grep -q .; then
+    echo "Gray port is already in use: ${port}" >&2
+    exit 1
+  fi
+done
+
+cd "${INCOMING_DIR}"
+shasum -a 256 -c "$(basename "${SHA_FILE}")"
+
+rm -rf "${RELEASE_DIR}"
+mkdir -p "${RELEASE_DIR}"
+tar -xzf "${BUNDLE}" -C "${RELEASE_DIR}"
+cp "${MANIFEST}" "${RELEASE_DIR}/.release-manifest.txt"
+
+[[ -f "${LIVE_DIR}/.env" ]] || { echo "Live .env is missing" >&2; exit 1; }
+cp "${LIVE_DIR}/.env" "${RELEASE_DIR}/.env"
+chmod 600 "${RELEASE_DIR}/.env"
+
+[[ -d "${RELEASE_DIR}/dist" ]] || { echo "Gray release missing dist/" >&2; exit 1; }
+[[ ! -d "${RELEASE_DIR}/src" ]] || { echo "Gray release contains src/" >&2; exit 1; }
+[[ -f "${RELEASE_DIR}/server/index.mjs" ]] || { echo "Gray release missing Admin API" >&2; exit 1; }
+
+export PATH="/opt/homebrew/bin:/opt/homebrew/opt/node@24/bin:/opt/homebrew/opt/node@22/bin:/usr/local/bin:/usr/bin:/bin:${PATH}"
+cd "${RELEASE_DIR}"
+if [[ -f package-lock.json ]]; then
+  npm ci --no-audit --no-fund
+else
+  npm install --no-audit --no-fund
+fi
+
+set -a
+# shellcheck disable=SC1091
+source "${RELEASE_DIR}/.env"
+set +a
+export ADM_API_PORT="${GRAY_API_PORT}"
+export ADM_PORT="${GRAY_WEB_PORT}"
+export ADM_API_HOST=127.0.0.1
+export ADM_WEB_HOST=127.0.0.1
+export ADM_DEV_BACKEND="http://127.0.0.1:${GRAY_API_PORT}"
+export VITE_BASE_PATH=/ops
+export ADM_READ_ONLY_MODE=1
+
+nohup node server/index.mjs >>"${RELEASE_DIR}/adm-gray-api.log" 2>&1 &
+echo $! >"${RELEASE_DIR}/.adm-gray-api.pid"
+
+api_ready=0
+for _ in $(seq 1 30); do
+  if curl -fsS "http://127.0.0.1:${GRAY_API_PORT}/health" >/dev/null; then
+    api_ready=1
+    break
+  fi
+  sleep 1
+done
+[[ "${api_ready}" == "1" ]] || { tail -n 80 "${RELEASE_DIR}/adm-gray-api.log" >&2 || true; exit 1; }
+
+nohup ./node_modules/.bin/vite preview --config scripts/vite-preview.config.mjs \
+  >>"${RELEASE_DIR}/adm-gray-web.log" 2>&1 &
+echo $! >"${RELEASE_DIR}/.adm-gray-web.pid"
+
+web_ready=0
+for _ in $(seq 1 30); do
+  if curl -fsS "http://127.0.0.1:${GRAY_WEB_PORT}/ops/" >/dev/null; then
+    web_ready=1
+    break
+  fi
+  sleep 1
+done
+[[ "${web_ready}" == "1" ]] || { tail -n 80 "${RELEASE_DIR}/adm-gray-web.log" >&2 || true; exit 1; }
+
+live_api_after="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:8085/health || true)"
+live_web_after="$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:5174/ops/ || true)"
+[[ "${live_api_after}" == "200" && "${live_web_after}" == "200" ]] || {
+  echo "Live memind_adm health changed during gray startup" >&2
+  exit 1
+}
+
+cat >"${RELEASE_DIR}/GRAY_DEPLOYMENT.txt" <<EOF
+release_id=${RELEASE_ID}
+deployed_at=$(date '+%Y-%m-%d %H:%M:%S %z')
+web=http://127.0.0.1:${GRAY_WEB_PORT}/ops/
+api=http://127.0.0.1:${GRAY_API_PORT}
+read_only=true
+live_switched=false
+EOF
+
+trap - ERR
+echo "gray_release_dir=${RELEASE_DIR}"
+echo "gray_web=http://127.0.0.1:${GRAY_WEB_PORT}/ops/"
+echo "gray_api=http://127.0.0.1:${GRAY_API_PORT}"
+echo "gray_read_only=true"
+echo "live_memind_adm_unchanged=true"
+REMOTE
+
+echo
+echo "Gray instance deployed without switching live."
+echo "Open through SSH forwarding:"
+echo "  ssh -L ${GRAY_WEB_PORT}:127.0.0.1:${GRAY_WEB_PORT} -L ${GRAY_API_PORT}:127.0.0.1:${GRAY_API_PORT} john@${HOST}"

scripts/release-prod.sh

@@ -22,7 +22,10 @@ MANIFEST_PATH="${TMP_DIR}/memind-adm-${RELEASE_ID}.manifest.txt"
 SHA_PATH="${TMP_DIR}/memind-adm-${RELEASE_ID}.sha256"
 MEMIND_SRC="${TEST_MEMIND_ROOT:-${ROOT}/../Memind}"
 MEMIND_LIB="${ROOT}/memind-lib"
-DRY_RUN=0
+MEMIND_BASE_REF="${MEMIND_BASE_REF:-origin/main}"
+IMAGE_MAKE_RELEASE_ID="${IMAGE_MAKE_RELEASE_ID:-not-declared}"
+PACKAGE_ONLY=0
+OUTPUT_DIR=""
 SKIP_BUILD=0
 AUTO_YES=0
 
@@ -34,15 +37,19 @@ trap cleanup EXIT
 usage() {
   cat <<'EOF'
 用法:
-  bash scripts/release-prod.sh [--dry-run] [--skip-build] [--yes]
+  bash scripts/release-prod.sh [--package-only|--dry-run] [--output-dir DIR] [--skip-build] [--yes]
 
 说明:
-  1. 本地构建 dist 并打包运行产物（不含 src/ 等开发源码）
+  1. 校验 memind_adm 与 Memind 共享源码均来自干净、可追溯的 commit
-  2. 上传到 103
+  2. 本地构建 dist 并打包运行产物（不含 src/ 等开发源码）
-  3. 103 全量备份当前 memind_adm
+  3. --package-only / --dry-run 只生成持久候选包，不连接或修改 103
-  4. 解包、安装依赖（不在 103 构建前端）
+  4. 正式模式上传到 103，完成全量备份、原子切换、重启和健康检查
-  5. 原子切换 live 目录并重启验证
+  5. 旧 live 目录移入 archives，103 不再保留可编辑源码树
-  6. 旧 live 目录移入 archives，103 不再保留可编辑源码树
+
+环境:
+  TEST_MEMIND_ROOT          干净的 Memind 共享源码目录，默认 ../Memind
+  MEMIND_BASE_REF           Memind 共享源码必须精确匹配的 ref，默认 origin/main
+  IMAGE_MAKE_RELEASE_ID     写入 manifest 的 image_make 依赖版本
 
 禁止:
   - 直接 rsync 到 103
@@ -53,7 +60,12 @@ EOF
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --dry-run) DRY_RUN=1 ;;
+    --dry-run|--package-only) PACKAGE_ONLY=1 ;;
+    --output-dir)
+      shift
+      [[ $# -gt 0 ]] || { echo "--output-dir 缺少目录参数" >&2; exit 2; }
+      OUTPUT_DIR="$1"
+      ;;
     --skip-build) SKIP_BUILD=1 ;;
     --yes|-y) AUTO_YES=1 ;;
     -h|--help)
@@ -93,14 +105,52 @@ else
   exit 1
 fi
 
+git -C "${MEMIND_SRC}" rev-parse --is-inside-work-tree >/dev/null 2>&1 || {
+  echo "Memind 共享源码不是可追溯 Git 工作区: ${MEMIND_SRC}" >&2
+  exit 1
+}
+
+if [[ -n "$(git -C "${MEMIND_SRC}" status --porcelain=v1 --untracked-files=all)" ]]; then
+  echo "Memind 共享源码工作区不干净，禁止打包: ${MEMIND_SRC}" >&2
+  git -C "${MEMIND_SRC}" status --short --untracked-files=all >&2
+  exit 1
+fi
+
+git -C "${MEMIND_SRC}" rev-parse --verify --quiet "${MEMIND_BASE_REF}" >/dev/null || {
+  echo "Memind 共享源码缺少基线 ref: ${MEMIND_BASE_REF}" >&2
+  exit 1
+}
+
+MEMIND_GIT_HEAD="$(git -C "${MEMIND_SRC}" rev-parse HEAD)"
+MEMIND_BASE_HEAD="$(git -C "${MEMIND_SRC}" rev-parse "${MEMIND_BASE_REF}")"
+if [[ "${MEMIND_GIT_HEAD}" != "${MEMIND_BASE_HEAD}" ]]; then
+  echo "Memind 共享源码必须精确匹配 ${MEMIND_BASE_REF}" >&2
+  echo "  HEAD=${MEMIND_GIT_HEAD}" >&2
+  echo "  ${MEMIND_BASE_REF}=${MEMIND_BASE_HEAD}" >&2
+  exit 1
+fi
+
+for required_shared_file in \
+  user-auth.mjs \
+  asset-gateway.mjs \
+  image-make-admin-config.mjs \
+  image-make-client.mjs; do
+  [[ -f "${MEMIND_SRC}/${required_shared_file}" ]] || {
+    echo "Memind 共享源码缺少发布依赖: ${required_shared_file}" >&2
+    exit 1
+  }
+done
+
 [[ -f "${IGNORE_FILE}" ]] || {
   echo "缺少忽略文件: ${IGNORE_FILE}" >&2
   exit 1
 }
 
-say "本地预检查"
+if [[ "${PACKAGE_ONLY}" -ne 1 ]]; then
-ssh -o BatchMode=yes -o ConnectTimeout=15 "${HOST}" "echo release-ssh-ok" >/dev/null
+  say "103 正式发布预检查"
-ssh -o BatchMode=yes "${HOST}" "test -d '${APP_DIR}' && test -f '${APP_DIR}/package.json'" >/dev/null
+  ssh -o BatchMode=yes -o ConnectTimeout=15 "${HOST}" "echo release-ssh-ok" >/dev/null
+  ssh -o BatchMode=yes "${HOST}" "test -d '${APP_DIR}' && test -f '${APP_DIR}/package.json'" >/dev/null
+fi
 
 if [[ "${SKIP_BUILD}" -ne 1 ]]; then
   say "本地构建 dist（103 不再执行前端构建）"
@@ -120,7 +170,6 @@ fi
   exit 1
 }
 
-MEMIND_GIT_HEAD="$(git -C "${MEMIND_SRC}" rev-parse HEAD 2>/dev/null || echo unknown)"
 MEMIND_GIT_BRANCH="$(git -C "${MEMIND_SRC}" branch --show-current 2>/dev/null || echo detached)"
 
 say "打包 Memind 共享模块到 memind-lib"
@@ -150,6 +199,14 @@ fi
   echo "memind-lib 缺少 user-auth.mjs" >&2
   exit 1
 }
+[[ -f "${MEMIND_LIB}/image-make-admin-config.mjs" ]] || {
+  echo "memind-lib 缺少 image_make 管理配置模块" >&2
+  exit 1
+}
+[[ -f "${MEMIND_LIB}/image-make-client.mjs" ]] || {
+  echo "memind-lib 缺少 image_make 客户端模块" >&2
+  exit 1
+}
 [[ -f "${MEMIND_LIB}/skills/excel-analyst/SKILL.md" ]] || {
   echo "memind-lib 缺少 Excel Analyst 技能" >&2
   exit 1
@@ -163,7 +220,7 @@ grep -q 'tkmind-excel' "${MEMIND_LIB}/capabilities.mjs" || {
   exit 1
 }
 
-if [[ "${AUTO_YES}" -ne 1 && "${DRY_RUN}" -ne 1 ]]; then
+if [[ "${AUTO_YES}" -ne 1 && "${PACKAGE_ONLY}" -ne 1 ]]; then
   say "发布确认"
   echo "目标主机: ${HOST}"
   echo "目标目录: ${APP_DIR}"
@@ -185,6 +242,10 @@ say "生成发布清单"
   echo "git_branch=$(git -C "${ROOT}" branch --show-current 2>/dev/null || echo detached)"
   echo "memind_git_head=${MEMIND_GIT_HEAD}"
   echo "memind_git_branch=${MEMIND_GIT_BRANCH}"
+  echo "memind_base_ref=${MEMIND_BASE_REF}"
+  echo "memind_base_head=${MEMIND_BASE_HEAD}"
+  echo "memind_git_status=clean"
+  echo "image_make_release_id=${IMAGE_MAKE_RELEASE_ID}"
   echo "git_status_begin"
   git -C "${ROOT}" status --short --branch || true
   echo "git_status_end"
@@ -199,9 +260,19 @@ tar \
 checksum="$(shasum -a 256 "${BUNDLE_PATH}" | awk '{print $1}')"
 printf '%s  %s\n' "${checksum}" "$(basename "${BUNDLE_PATH}")" > "${SHA_PATH}"
 
-if [[ "${DRY_RUN}" -eq 1 ]]; then
+if [[ "${PACKAGE_ONLY}" -eq 1 ]]; then
-  say "dry-run 完成"
+  if [[ -z "${OUTPUT_DIR}" ]]; then
-  ls -lh "${BUNDLE_PATH}" "${MANIFEST_PATH}" "${SHA_PATH}"
+    OUTPUT_DIR="${ROOT}/release-candidates/${RELEASE_ID}"
+  elif [[ "${OUTPUT_DIR}" != /* ]]; then
+    OUTPUT_DIR="${ROOT}/${OUTPUT_DIR}"
+  fi
+  mkdir -p "${OUTPUT_DIR}"
+  cp "${BUNDLE_PATH}" "${MANIFEST_PATH}" "${SHA_PATH}" "${OUTPUT_DIR}/"
+  say "候选包生成完成；未连接或修改 103"
+  echo "candidate_dir=${OUTPUT_DIR}"
+  ls -lh "${OUTPUT_DIR}/$(basename "${BUNDLE_PATH}")" \
+    "${OUTPUT_DIR}/$(basename "${MANIFEST_PATH}")" \
+    "${OUTPUT_DIR}/$(basename "${SHA_PATH}")"
   exit 0
 fi
 

server/app.image-make.test.mjs

@@ -0,0 +1,149 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createAdminApp } from './app.mjs';
+
+function createServices({ role = 'admin', imageMakeAdminConfigService } = {}) {
+  return {
+    ready: Promise.resolve(),
+    parseCookies: () => ({ adm_session: 'test-token' }),
+    USER_COOKIE: 'adm_session',
+    userLoginCookies: () => ['adm_session=test-token; Path=/; HttpOnly'],
+    clearUserSessionCookie: () => ['adm_session=; Path=/; Max-Age=0'],
+    resolveCookieDomainForRequest: () => null,
+    userAuth: {
+      getMe: async () => ({ id: 'admin-user-id', username: 'admin', role }),
+    },
+    imageMakeAdminConfigService,
+  };
+}
+
+async function withServer(services, callback) {
+  const app = createAdminApp(services);
+  const server = await new Promise((resolve) => {
+    const instance = app.listen(0, '127.0.0.1', () => resolve(instance));
+  });
+  const address = server.address();
+  const baseUrl = `http://127.0.0.1:${address.port}`;
+  try {
+    await callback(baseUrl);
+  } finally {
+    await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+  }
+}
+
+const adminHeaders = {
+  cookie: 'adm_session=test-token',
+  'content-type': 'application/json',
+};
+
+test('image_make admin routes read and update config with the admin identity', async () => {
+  let updateCall = null;
+  const service = {
+    getAdminConfig: async () => ({
+      source: 'default',
+      config: {
+        defaultProvider: 'mock',
+        jobDefaultTimeoutSeconds: 120,
+        providers: { mock: { enabled: true }, aliyun_bailian: { enabled: false }, comfyui: { enabled: false } },
+      },
+    }),
+    updateAdminConfig: async (patch, context) => {
+      updateCall = { patch, context };
+      return { ok: true, source: 'admin-db', config: patch };
+    },
+    getRuntimeConfig: async () => ({
+      ok: true,
+      fingerprint: '1234567890abcdef',
+      defaultProvider: 'aliyun_bailian',
+      jobDefaultTimeoutSeconds: 120,
+      providers: {
+        mock: { enabled: true },
+        aliyun_bailian: {
+          enabled: true,
+          model: 'qwen-image-plus',
+          apiBase: 'https://dashscope.aliyuncs.com/api/v1',
+          apiKey: 'must-not-leak',
+        },
+        comfyui: { enabled: false },
+      },
+    }),
+  };
+
+  await withServer(createServices({ imageMakeAdminConfigService: service }), async (baseUrl) => {
+    const configResponse = await fetch(`${baseUrl}/admin-api/image-make/config`, { headers: adminHeaders });
+    assert.equal(configResponse.status, 200);
+    assert.equal((await configResponse.json()).config.defaultProvider, 'mock');
+
+    const patch = { defaultProvider: 'mock', jobDefaultTimeoutSeconds: 180 };
+    const updateResponse = await fetch(`${baseUrl}/admin-api/image-make/config`, {
+      method: 'PATCH',
+      headers: adminHeaders,
+      body: JSON.stringify(patch),
+    });
+    assert.equal(updateResponse.status, 200);
+    assert.deepEqual(updateCall, { patch, context: { updatedBy: 'admin-user-id' } });
+
+    const runtimeResponse = await fetch(`${baseUrl}/admin-api/image-make/runtime`, { headers: adminHeaders });
+    assert.equal(runtimeResponse.status, 200);
+    const runtime = await runtimeResponse.json();
+    assert.equal(runtime.providers.aliyun_bailian.apiKeyConfigured, true);
+    assert.equal('apiKey' in runtime.providers.aliyun_bailian, false);
+    assert.equal(JSON.stringify(runtime).includes('must-not-leak'), false);
+  });
+});
+
+test('image_make admin config validation failures are returned as 400', async () => {
+  const service = {
+    updateAdminConfig: async () => ({ ok: false, message: '默认 Provider 必须处于启用状态' }),
+  };
+  await withServer(createServices({ imageMakeAdminConfigService: service }), async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/admin-api/image-make/config`, {
+      method: 'PATCH',
+      headers: adminHeaders,
+      body: JSON.stringify({ defaultProvider: 'comfyui' }),
+    });
+    assert.equal(response.status, 400);
+    assert.equal((await response.json()).message, '默认 Provider 必须处于启用状态');
+  });
+});
+
+test('image_make admin routes require an admin user and an enabled service', async () => {
+  await withServer(createServices({ role: 'user', imageMakeAdminConfigService: {} }), async (baseUrl) => {
+    const forbidden = await fetch(`${baseUrl}/admin-api/image-make/config`, { headers: adminHeaders });
+    assert.equal(forbidden.status, 403);
+  });
+
+  await withServer(createServices({ imageMakeAdminConfigService: {} }), async (baseUrl) => {
+    const unavailable = await fetch(`${baseUrl}/admin-api/image-make/config`, { headers: adminHeaders });
+    assert.equal(unavailable.status, 503);
+  });
+});
+
+test('gray read-only mode blocks admin writes while keeping reads available', async () => {
+  let updateCalled = false;
+  const service = {
+    getAdminConfig: async () => ({ config: { defaultProvider: 'mock', providers: {} } }),
+    updateAdminConfig: async () => {
+      updateCalled = true;
+      return { ok: true };
+    },
+  };
+  const services = {
+    ...createServices({ imageMakeAdminConfigService: service }),
+    readOnlyMode: true,
+  };
+
+  await withServer(services, async (baseUrl) => {
+    const readResponse = await fetch(`${baseUrl}/admin-api/image-make/config`, { headers: adminHeaders });
+    assert.equal(readResponse.status, 200);
+
+    const writeResponse = await fetch(`${baseUrl}/admin-api/image-make/config`, {
+      method: 'PATCH',
+      headers: adminHeaders,
+      body: JSON.stringify({ defaultProvider: 'mock' }),
+    });
+    assert.equal(writeResponse.status, 423);
+    assert.match((await writeResponse.json()).message, /灰度只读模式/);
+    assert.equal(updateCalled, false);
+  });
+});

server/app.mjs

@@ -93,6 +93,7 @@ export function createAdminApp(services) {
     userAuth,
     llmProviderService,
     assetGatewayConfigService,
+    imageMakeAdminConfigService,
     pool,
     ready,
     wechatAdmin,
@@ -112,6 +113,8 @@ export function createAdminApp(services) {
   } = services;
   const app = express();
   app.set('trust proxy', 1);
+  const readOnlyMode = services.readOnlyMode
+    ?? /^(1|true|yes|on)$/i.test(String(process.env.ADM_READ_ONLY_MODE ?? ''));
 
   const isSecureRequest = (req) =>
     req.secure || req.get('x-forwarded-proto')?.split(',')[0]?.trim() === 'https';
@@ -149,6 +152,13 @@ export function createAdminApp(services) {
     );
   }
 
+  const requireWritableMode = (req, res, next) => {
+    if (readOnlyMode && !['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
+      return res.status(423).json({ message: '当前为灰度只读模式，禁止修改生产数据' });
+    }
+    next();
+  };
+
   app.get('/health', (_req, res) => {
     res.json({ ok: true, service: 'memind_adm' });
   });
@@ -205,6 +215,8 @@ export function createAdminApp(services) {
     next();
   }));
 
+  adminApi.use(requireWritableMode);
+
   const requireAdmin = (req, res, next) => {
     if (!req.currentUser || req.currentUser.role !== 'admin') {
       res.status(403).json({ message: '需要管理员权限' });
@@ -369,6 +381,53 @@ export function createAdminApp(services) {
     res.json(result);
   });
 
+  adminApi.get('/image-make/config', requireAdmin, async (_req, res) => {
+    if (!imageMakeAdminConfigService?.getAdminConfig) {
+      return res.status(503).json({ message: 'image_make 配置服务未启用' });
+    }
+    res.json(await imageMakeAdminConfigService.getAdminConfig());
+  });
+
+  const updateImageMakeConfig = async (req, res) => {
+    if (!imageMakeAdminConfigService?.updateAdminConfig) {
+      return res.status(503).json({ message: 'image_make 配置服务未启用' });
+    }
+    const result = await imageMakeAdminConfigService.updateAdminConfig(req.body ?? {}, {
+      updatedBy: req.currentUser.id,
+    });
+    if (result.ok === false) return res.status(400).json({ message: result.message });
+    res.json(result);
+  };
+
+  adminApi.put('/image-make/config', requireAdmin, updateImageMakeConfig);
+  adminApi.patch('/image-make/config', requireAdmin, updateImageMakeConfig);
+
+  adminApi.get('/image-make/runtime', requireAdmin, async (_req, res) => {
+    if (!imageMakeAdminConfigService?.getRuntimeConfig) {
+      return res.status(503).json({ message: 'image_make 配置服务未启用' });
+    }
+    const runtime = await imageMakeAdminConfigService.getRuntimeConfig();
+    if (!runtime.ok) return res.status(503).json({ message: runtime.message ?? 'image_make 运行时配置无效' });
+    const { providers, ...rest } = runtime;
+    res.json({
+      ...rest,
+      providers: {
+        mock: { enabled: providers.mock.enabled },
+        aliyun_bailian: providers.aliyun_bailian.enabled
+          ? {
+              enabled: true,
+              model: providers.aliyun_bailian.model,
+              apiBase: providers.aliyun_bailian.apiBase,
+              apiKeyConfigured: Boolean(providers.aliyun_bailian.apiKey),
+            }
+          : { enabled: false },
+        comfyui: providers.comfyui.enabled
+          ? { enabled: true, ...providers.comfyui }
+          : { enabled: false },
+      },
+    });
+  });
+
   adminApi.get('/memory-v2/config', requireAdmin, async (_req, res) => {
     if (!memoryV2ConfigService) return res.status(503).json({ message: 'Memory V2 配置未启用' });
     res.json(await memoryV2ConfigService.getAdminConfig());
@@ -1075,6 +1134,7 @@ export function createAdminApp(services) {
       req.currentUser = me;
       next();
     }));
+    opsApi.use(requireWritableMode);
     opsApi.use(resolveSessionUser);
     opsApi.use('/ops/v1', services.createOpsApi({ jsonBody, plazaOps: services.plazaOps }));
     app.use('/api', opsApi);

server/bootstrap.mjs

@@ -33,6 +33,7 @@ export async function bootstrapAdminServices() {
   const { createPersonalMemoryCandidateStore } = await importMemind('memory-v2-personal-store.mjs');
   const { createSkillRuntimeAdminConfigService } = await importMemind('skill-runtime-admin-config.mjs');
   const { createAssetGatewayConfigService } = await importMemind('asset-gateway.mjs');
+  const { createImageMakeAdminConfigService } = await importMemind('image-make-admin-config.mjs');
   const { ensureAssetGatewaySchema } = await importMemind('db.mjs');
   const { createWechatScheduleLlmConfigService } = await importMemind('wechat-schedule-llm-config.mjs');
   const { createAdminSystemTestService } = await importMemind('admin-system-tests.mjs');
@@ -93,6 +94,11 @@ export async function bootstrapAdminServices() {
   });
   await ensureAssetGatewaySchema(pool);
   const assetGatewayConfigService = createAssetGatewayConfigService(pool, { llmProviderService });
+  const imageMakeAdminConfigService = createImageMakeAdminConfigService(pool, {
+    env: process.env,
+    llmProviderService,
+  });
+  await imageMakeAdminConfigService.ensureSchema();
   const memoryV2ConfigService = createMemoryV2AdminConfigService(pool, {
     env: process.env,
   });
@@ -148,6 +154,7 @@ export async function bootstrapAdminServices() {
     userAuth,
     llmProviderService,
     assetGatewayConfigService,
+    imageMakeAdminConfigService,
     plazaOps,
     createOpsApi,
     wechatAdmin,

server/index.mjs

@@ -99,6 +99,7 @@ ready
       userAuth,
       llmProviderService,
       assetGatewayConfigService,
+      imageMakeAdminConfigService,
       plazaOps,
       createOpsApi,
       wechatAdmin,
@@ -125,6 +126,7 @@ ready
       userAuth,
       llmProviderService,
       assetGatewayConfigService,
+      imageMakeAdminConfigService,
       plazaOps,
       createOpsApi,
       wechatAdmin,

src/admin/AdminNav.tsx

@@ -37,7 +37,7 @@ const NAV_SECTIONS: NavSection[] = [
       { to: '/skills', label: '技能' },
       { to: '/policies', label: '策略' },
       { to: '/providers', label: '统一模型中心' },
-      { to: '/asset-gateway', label: '资产能力' },
+      { to: '/asset-gateway', label: '图片生成' },
       { to: '/blocked-words', label: '违禁词管理' },
     ],
   },

src/admin/pages/AssetGatewayPage.tsx

@@ -1,11 +1,15 @@
 import { useCallback, useEffect, useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
 import {
   getAssetGatewayConfig,
-  listLlmProviderKeys,
+  getImageMakeAdminConfig,
+  getImageMakeRuntimeStatus,
+  getLlmVisionSettings,
   updateAssetGatewayConfig,
   updateAssetPluginConfig,
+  updateImageMakeAdminConfig,
 } from '../../api/client';
-import type { AssetGatewayConfig, AssetPluginConfig, LlmProviderKeyRow } from '../../types';
+import type { AssetGatewayConfig, AssetPluginConfig, ImageMakeAdminConfig, LlmVisionSettings } from '../../types';
 
 type PluginDraft = {
   enabled: boolean;
@@ -32,24 +36,91 @@ const pluginVisuals: Record<string, { icon: string; accent: string }> = {
   'asset-analyze': { icon: '◉', accent: 'green' },
 };
 
+const defaultImageMakeConfig: ImageMakeAdminConfig = {
+  defaultProvider: 'mock',
+  jobDefaultTimeoutSeconds: 120,
+  providers: {
+    mock: { enabled: true },
+    aliyun_bailian: {
+      enabled: false,
+      model: 'qwen-image-plus',
+      apiBase: 'https://dashscope.aliyuncs.com/api/v1',
+      apiKeyConfigured: false,
+      apiKeyMasked: '',
+    },
+    comfyui: {
+      enabled: false,
+      apiBase: 'http://127.0.0.1:8188',
+      checkpoint: '',
+      workflowPath: './config/comfyui/workflows/core_txt2img_v1.json',
+      outputNodeId: '9',
+      timeoutSeconds: 600,
+      steps: 20,
+      cfg: 7,
+      sampler: 'euler',
+      scheduler: 'normal',
+    },
+  },
+};
+
 export function AssetGatewayPage() {
   const [config, setConfig] = useState<AssetGatewayConfig | null>(null);
-  const [keys, setKeys] = useState<LlmProviderKeyRow[]>([]);
   const [drafts, setDrafts] = useState<Record<string, PluginDraft>>({});
   const [loading, setLoading] = useState(true);
   const [busy, setBusy] = useState<string | null>(null);
   const [message, setMessage] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
-  const activeKeys = useMemo(() => keys.filter((key) => key.status === 'active'), [keys]);
+  const [imageMakeConfig, setImageMakeConfig] = useState<ImageMakeAdminConfig>(defaultImageMakeConfig);
+  const [imageMakeMeta, setImageMakeMeta] = useState<{ source?: string; updatedAt?: number | null; updatedBy?: string | null }>({});
+  const [imageMakeRuntime, setImageMakeRuntime] = useState<string>('');
+  const [visionSettings, setVisionSettings] = useState<LlmVisionSettings | null>(null);
+  const orderedPlugins = useMemo(() => config?.plugins.slice().sort((left, right) => {
+    if (left.pluginId === 'asset-generate') return -1;
+    if (right.pluginId === 'asset-generate') return 1;
+    return left.pluginId.localeCompare(right.pluginId);
+  }) ?? [], [config]);
+  const imageGeneratePlugin = config?.plugins.find((plugin) => plugin.pluginId === 'asset-generate') ?? null;
+  const imageGenerateDraft = imageGeneratePlugin
+    ? drafts[imageGeneratePlugin.pluginId] ?? draftFromPlugin(imageGeneratePlugin)
+    : null;
+  const imageMakeControlsEnabled = Boolean(
+    imageGenerateDraft?.enabled && imageGenerateDraft.provider === 'image_make',
+  );
 
   const load = useCallback(async () => {
     setLoading(true);
     setError(null);
     try {
-      const [nextConfig, nextKeys] = await Promise.all([getAssetGatewayConfig(), listLlmProviderKeys()]);
+      const [nextConfig, nextVisionSettings, nextImageMakeConfig, nextImageMakeRuntime] = await Promise.all([
+        getAssetGatewayConfig(),
+        getLlmVisionSettings().catch(() => null),
+        getImageMakeAdminConfig(),
+        getImageMakeRuntimeStatus().catch(() => null),
+      ]);
       setConfig(nextConfig);
-      setKeys(nextKeys);
+      setVisionSettings(nextVisionSettings);
       setDrafts(Object.fromEntries(nextConfig.plugins.map((plugin) => [plugin.pluginId, draftFromPlugin(plugin)])));
+      setImageMakeConfig({
+        ...defaultImageMakeConfig,
+        ...nextImageMakeConfig.config,
+        providers: {
+          ...defaultImageMakeConfig.providers,
+          ...nextImageMakeConfig.config.providers,
+          mock: { ...defaultImageMakeConfig.providers.mock, ...nextImageMakeConfig.config.providers.mock },
+          aliyun_bailian: {
+            ...defaultImageMakeConfig.providers.aliyun_bailian,
+            ...nextImageMakeConfig.config.providers.aliyun_bailian,
+          },
+          comfyui: {
+            ...defaultImageMakeConfig.providers.comfyui,
+            ...nextImageMakeConfig.config.providers.comfyui,
+          },
+        },
+      });
+      setImageMakeMeta(nextImageMakeConfig);
+      setImageMakeRuntime(nextImageMakeRuntime?.ok
+        ? `默认 Provider：${nextImageMakeRuntime.defaultProvider} · 指纹 ${nextImageMakeRuntime.fingerprint?.slice(0, 12) ?? '—'}`
+        : nextImageMakeRuntime?.message ?? '运行时未就绪');
     } catch (err) {
       setError(err instanceof Error ? err.message : '加载资产能力配置失败');
     } finally {
@@ -91,8 +162,6 @@ export function AssetGatewayPage() {
       const result = await updateAssetPluginConfig(plugin.pluginId, {
         enabled: draft.enabled,
         provider: draft.provider || null,
-        llmProviderKeyId: draft.llmProviderKeyId || null,
-        llmModel: draft.llmModel || null,
         purposes: draft.purposes,
       });
       setConfig(result.config);
@@ -102,32 +171,532 @@ export function AssetGatewayPage() {
     finally { setBusy(null); }
   };
 
+  const saveImageMakeConfig = async () => {
+    setBusy('image-make-config'); setMessage(null); setError(null);
+    try {
+      const payload: Parameters<typeof updateImageMakeAdminConfig>[0] = {
+        defaultProvider: imageMakeConfig.defaultProvider,
+        jobDefaultTimeoutSeconds: imageMakeConfig.jobDefaultTimeoutSeconds,
+        providers: {
+          mock: { enabled: imageMakeConfig.providers.mock.enabled },
+          aliyun_bailian: {
+            enabled: imageMakeConfig.providers.aliyun_bailian.enabled,
+            model: imageMakeConfig.providers.aliyun_bailian.model,
+            apiBase: imageMakeConfig.providers.aliyun_bailian.apiBase,
+          },
+          comfyui: {
+            enabled: imageMakeConfig.providers.comfyui.enabled,
+            apiBase: imageMakeConfig.providers.comfyui.apiBase,
+            checkpoint: imageMakeConfig.providers.comfyui.checkpoint,
+            workflowPath: imageMakeConfig.providers.comfyui.workflowPath,
+            outputNodeId: imageMakeConfig.providers.comfyui.outputNodeId,
+            timeoutSeconds: imageMakeConfig.providers.comfyui.timeoutSeconds,
+            steps: imageMakeConfig.providers.comfyui.steps,
+            cfg: imageMakeConfig.providers.comfyui.cfg,
+            sampler: imageMakeConfig.providers.comfyui.sampler,
+            scheduler: imageMakeConfig.providers.comfyui.scheduler,
+          },
+        },
+      };
+      const result = await updateImageMakeAdminConfig(payload);
+      if (result.ok === false) throw new Error(result.message ?? '保存 image_make 配置失败');
+      setImageMakeConfig({
+        ...defaultImageMakeConfig,
+        ...result.config,
+        providers: {
+          ...defaultImageMakeConfig.providers,
+          ...result.config.providers,
+          mock: { ...defaultImageMakeConfig.providers.mock, ...result.config.providers.mock },
+          aliyun_bailian: {
+            ...defaultImageMakeConfig.providers.aliyun_bailian,
+            ...result.config.providers.aliyun_bailian,
+          },
+          comfyui: {
+            ...defaultImageMakeConfig.providers.comfyui,
+            ...result.config.providers.comfyui,
+          },
+        },
+      });
+      setImageMakeMeta(result);
+      const nextVisionSettings = await getLlmVisionSettings().catch(() => null);
+      if (nextVisionSettings) setVisionSettings(nextVisionSettings);
+      const runtime = await getImageMakeRuntimeStatus().catch(() => null);
+      setImageMakeRuntime(runtime?.ok
+        ? `默认 Provider：${runtime.defaultProvider} · 指纹 ${runtime.fingerprint?.slice(0, 12) ?? '—'}`
+        : runtime?.message ?? '运行时未就绪');
+      setMessage('image_make 生图模型配置已保存；服务会在数秒内自动拉取新配置。');
+    } catch (err) { setError(err instanceof Error ? err.message : '保存 image_make 配置失败'); }
+    finally { setBusy(null); }
+  };
+
   if (loading) return <div className="admin-page"><p className="muted">加载资产能力配置…</p></div>;
   if (!config) return <div className="admin-page"><p className="banner banner-error">{error ?? '无法加载配置'}</p></div>;
 
   return (
     <div className="admin-page">
       <div className="admin-page-head">
-        <h2>资产能力</h2>
+        <h2>图片生成</h2>
-        <p className="muted">可插拔图片、素材与处理能力。默认关闭，不会影响现有聊天或页面生成流程。</p>
+        <p className="muted">分别控制正文图片、页面头图、卡片封面和信息流缩略图；未勾选的 AI 图片项不会执行。</p>
       </div>
       {error && <p className="banner banner-error">{error}</p>}
       {message && <p className="banner banner-success">{message}</p>}
       <section className="asset-gateway-hero">
         <div>
           <div className="asset-kicker">OPTIONAL CAPABILITY</div>
-          <h3>资产能力 Gateway</h3>
+          <h3>图片与素材能力总开关</h3>
-          <p>关闭时所有调用自动降级为现有流程；配置保留，现有聊天和页面生成不受影响。</p>
+          <p>关闭时不调用图片模型；页面仍保留现有无图样式和基础缩略图流程。</p>
         </div>
         <label className="asset-toggle">
           <input type="checkbox" checked={config.enabled} disabled={busy === 'global'} onChange={(event) => void saveGlobal(event.target.checked)} />
           <span>{config.enabled ? '已启用' : '已关闭'}</span>
         </label>
       </section>
+      {imageGeneratePlugin && imageGenerateDraft ? (
+        <>
+          <div className="model-center-section-title">
+            <h3>图片生成范围</h3>
+            <p>控制 Memind 是否调用 image_make，以及各输出位置是否启用 AI 图片。</p>
+          </div>
+          <div className="asset-plugin-grid asset-plugin-grid--balanced">
+            <section className="asset-plugin-card asset-plugin-card--violet">
+              <div className="asset-plugin-card-head">
+                <div className="asset-plugin-icon" aria-hidden="true">✦</div>
+                <div>
+                  <h3>{imageGeneratePlugin.label}</h3>
+                  <p>勾选才会在对应位置使用 AI 图片；卡片和缩略图默认复用页面头图。</p>
+                </div>
+                <label className="asset-mini-toggle" title="启用图片生成">
+                  <input
+                    type="checkbox"
+                    checked={imageGenerateDraft.enabled}
+                    onChange={(event) => updateDraft(imageGeneratePlugin.pluginId, { enabled: event.target.checked })}
+                  />
+                  <span>{imageGenerateDraft.enabled ? '已开启' : '已关闭'}</span>
+                </label>
+              </div>
+              <div className="asset-plugin-fields">
+                <label>
+                  运行 Provider
+                  <select
+                    value={imageGenerateDraft.provider}
+                    disabled={!imageGenerateDraft.enabled}
+                    onChange={(event) => {
+                      const provider = event.target.value;
+                      updateDraft(imageGeneratePlugin.pluginId, {
+                        provider,
+                        ...(provider === 'image_make' ? { llmProviderKeyId: '', llmModel: '' } : {}),
+                      });
+                    }}
+                  >
+                    <option value="">选择 Provider</option>
+                    {imageGeneratePlugin.providers.map((provider) => (
+                      <option key={provider} value={provider}>{provider}</option>
+                    ))}
+                  </select>
+                </label>
+                <fieldset
+                  className="asset-purpose-fieldset"
+                  disabled={!imageGenerateDraft.enabled || imageGenerateDraft.provider !== 'image_make'}
+                >
+                  <legend>按输出位置独立控制</legend>
+                  <div className="asset-purpose-grid">
+                    {imageGeneratePlugin.purposeCatalog?.map((purpose) => {
+                      const descriptions: Record<string, string> = {
+                        inline_image: '正文确有需要时单独生成',
+                        hero: '页面主视觉，最多生成一次',
+                        card_cover: '从页面头图派生',
+                        feed_cover: '从页面头图派生',
+                      };
+                      return (
+                        <label key={purpose.id}>
+                          <input
+                            type="checkbox"
+                            checked={Boolean(imageGenerateDraft.purposes[purpose.id])}
+                            onChange={(event) => updatePurpose(
+                              imageGeneratePlugin.pluginId,
+                              purpose.id,
+                              event.target.checked,
+                            )}
+                          />
+                          <span>
+                            {purpose.label}
+                            <small>{descriptions[purpose.id] ?? purpose.presetId}</small>
+                          </span>
+                        </label>
+                      );
+                    })}
+                  </div>
+                </fieldset>
+              </div>
+              <div className="asset-plugin-footer">
+                <span className={`asset-status ${imageGenerateDraft.enabled ? 'is-on' : ''}`}>
+                  {imageGenerateDraft.enabled ? '待保存为启用' : '默认安全关闭'}
+                </span>
+                <button
+                  type="button"
+                  className="send-btn"
+                  disabled={busy === imageGeneratePlugin.pluginId}
+                  onClick={() => void savePlugin(imageGeneratePlugin)}
+                >
+                  {busy === imageGeneratePlugin.pluginId ? '保存中…' : '保存图片生成配置'}
+                </button>
+              </div>
+            </section>
+          </div>
+
+          <div className="model-center-section-title">
+            <h3>生图模型与 Provider</h3>
+            <p>image_make 生图后端参数；DashScope Key 与 Qwen VL 审图共用，在「统一模型中心 → 图片任务模型」配置。</p>
+          </div>
+          <div className="asset-plugin-grid">
+            <section className={`asset-plugin-card asset-plugin-card--blue${imageMakeControlsEnabled ? '' : ' is-disabled'}`}>
+              <div className="asset-plugin-card-head">
+                <div className="asset-plugin-icon asset-plugin-icon--blue" aria-hidden="true">⟡</div>
+                <div>
+                  <h3>运行时调度</h3>
+                  <p>默认 Provider 与任务超时；image_make 按此处配置选择生图后端。</p>
+                </div>
+              </div>
+              <div className="asset-plugin-fields">
+                {!imageMakeControlsEnabled ? (
+                  <div className="image-make-runtime-note">
+                    请先在左侧卡片启用图片生成，并将运行 Provider 设为 image_make。
+                  </div>
+                ) : null}
+                <label>
+                  默认生图 Provider
+                  <select
+                    value={imageMakeConfig.defaultProvider}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      defaultProvider: event.target.value as ImageMakeAdminConfig['defaultProvider'],
+                    }))}
+                  >
+                    <option value="aliyun_bailian">百炼 Qwen-Image</option>
+                    <option value="comfyui">本地 ComfyUI</option>
+                    <option value="mock">Mock（仅开发）</option>
+                  </select>
+                </label>
+                <label>
+                  任务超时（秒）
+                  <input
+                    type="number"
+                    min={5}
+                    max={1800}
+                    value={imageMakeConfig.jobDefaultTimeoutSeconds}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      jobDefaultTimeoutSeconds: Number(event.target.value),
+                    }))}
+                  />
+                </label>
+                <div className="image-make-runtime-note">
+                  {imageMakeRuntime || '运行时状态未知'}
+                  {' · '}
+                  配置来源：{imageMakeMeta.source === 'admin-db' ? '数据库' : '默认值'}
+                </div>
+              </div>
+              <div className="asset-plugin-footer">
+                <span className={`asset-status ${imageMakeControlsEnabled ? 'is-on' : ''}`}>
+                  {imageMakeConfig.defaultProvider}
+                </span>
+                <button
+                  type="button"
+                  className="send-btn"
+                  disabled={busy === 'image-make-config' || !imageMakeControlsEnabled}
+                  onClick={() => void saveImageMakeConfig()}
+                >
+                  {busy === 'image-make-config' ? '保存中…' : '保存生图模型配置'}
+                </button>
+              </div>
+            </section>
+
+            <section className={`asset-plugin-card asset-plugin-card--amber${imageMakeControlsEnabled ? '' : ' is-disabled'}`}>
+              <div className="asset-plugin-card-head">
+                <div className="asset-plugin-icon asset-plugin-icon--amber" aria-hidden="true">云</div>
+                <div>
+                  <h3>百炼 Qwen-Image</h3>
+                  <p>阿里云 DashScope 文生图；与 Qwen VL 审图共用同一 DashScope Key，模型名不同。</p>
+                </div>
+                <label className="asset-mini-toggle">
+                  <input
+                    type="checkbox"
+                    checked={imageMakeConfig.providers.aliyun_bailian.enabled}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        aliyun_bailian: { ...current.providers.aliyun_bailian, enabled: event.target.checked },
+                      },
+                    }))}
+                  />
+                  <span>{imageMakeConfig.providers.aliyun_bailian.enabled ? '已启用' : '未启用'}</span>
+                </label>
+              </div>
+              <div className="asset-plugin-fields">
+                <label>
+                  模型
+                  <select
+                    value={imageMakeConfig.providers.aliyun_bailian.model ?? 'qwen-image-plus'}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        aliyun_bailian: { ...current.providers.aliyun_bailian, model: event.target.value },
+                      },
+                    }))}
+                  >
+                    <option value="qwen-image-plus">qwen-image-plus</option>
+                    <option value="qwen-image">qwen-image</option>
+                  </select>
+                </label>
+                <label>
+                  API Base
+                  <input
+                    value={imageMakeConfig.providers.aliyun_bailian.apiBase ?? ''}
+                    placeholder="https://dashscope.aliyuncs.com/api/v1"
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        aliyun_bailian: { ...current.providers.aliyun_bailian, apiBase: event.target.value },
+                      },
+                    }))}
+                  />
+                </label>
+                <div className="image-make-runtime-note">
+                  DashScope API Key 与 Qwen VL 审图共用，请在
+                  {' '}
+                  <Link to="/providers">统一模型中心</Link>
+                  {' '}
+                  的「图片任务模型」配置 Qwen Provider。
+                  {imageMakeConfig.providers.aliyun_bailian.apiKeyConfigured ? (
+                    <>
+                      {' '}
+                      当前已绑定：
+                      {imageMakeConfig.providers.aliyun_bailian.dashScopeKeyName
+                        ?? visionSettings?.keyName
+                        ?? 'DashScope'}
+                      {' '}
+                      (
+                      {imageMakeConfig.providers.aliyun_bailian.apiKeyMasked
+                        ?? visionSettings?.apiKeyMasked
+                        ?? '已配置'}
+                      )
+                    </>
+                  ) : (
+                    <> 当前未检测到 DashScope Key。</>
+                  )}
+                </div>
+              </div>
+              <div className="asset-plugin-footer">
+                <span className={`asset-status ${imageMakeConfig.providers.aliyun_bailian.enabled ? 'is-on' : ''}`}>
+                  {imageMakeConfig.providers.aliyun_bailian.model ?? 'qwen-image-plus'}
+                </span>
+                <button
+                  type="button"
+                  className="send-btn"
+                  disabled={busy === 'image-make-config' || !imageMakeControlsEnabled}
+                  onClick={() => void saveImageMakeConfig()}
+                >
+                  {busy === 'image-make-config' ? '保存中…' : '保存配置'}
+                </button>
+              </div>
+            </section>
+
+            <section className={`asset-plugin-card asset-plugin-card--green${imageMakeControlsEnabled ? '' : ' is-disabled'}`}>
+              <div className="asset-plugin-card-head">
+                <div className="asset-plugin-icon asset-plugin-icon--green" aria-hidden="true">⌘</div>
+                <div>
+                  <h3>本地 ComfyUI</h3>
+                  <p>本地 SD / Flux 工作流；适合开发调试与离线降级。</p>
+                </div>
+                <label className="asset-mini-toggle">
+                  <input
+                    type="checkbox"
+                    checked={imageMakeConfig.providers.comfyui.enabled}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        comfyui: { ...current.providers.comfyui, enabled: event.target.checked },
+                      },
+                    }))}
+                  />
+                  <span>{imageMakeConfig.providers.comfyui.enabled ? '已启用' : '未启用'}</span>
+                </label>
+              </div>
+              <div className="asset-plugin-fields">
+                <label>
+                  ComfyUI 地址
+                  <input
+                    value={imageMakeConfig.providers.comfyui.apiBase ?? ''}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        comfyui: { ...current.providers.comfyui, apiBase: event.target.value },
+                      },
+                    }))}
+                  />
+                </label>
+                <label>
+                  Checkpoint 文件名
+                  <input
+                    value={imageMakeConfig.providers.comfyui.checkpoint ?? ''}
+                    placeholder="v1-5-pruned-emaonly-fp16.safetensors"
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        comfyui: { ...current.providers.comfyui, checkpoint: event.target.value },
+                      },
+                    }))}
+                  />
+                </label>
+                <label>
+                  Workflow 路径
+                  <input
+                    value={imageMakeConfig.providers.comfyui.workflowPath ?? ''}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        comfyui: { ...current.providers.comfyui, workflowPath: event.target.value },
+                      },
+                    }))}
+                  />
+                </label>
+                <label>
+                  输出节点 ID
+                  <input
+                    value={imageMakeConfig.providers.comfyui.outputNodeId ?? '9'}
+                    disabled={!imageMakeControlsEnabled}
+                    onChange={(event) => setImageMakeConfig((current) => ({
+                      ...current,
+                      providers: {
+                        ...current.providers,
+                        comfyui: { ...current.providers.comfyui, outputNodeId: event.target.value },
+                      },
+                    }))}
+                  />
+                </label>
+                <div className="image-generation-scope-grid">
+                  <label>
+                    Steps
+                    <input
+                      type="number"
+                      min={1}
+                      max={100}
+                      value={imageMakeConfig.providers.comfyui.steps ?? 20}
+                      disabled={!imageMakeControlsEnabled}
+                      onChange={(event) => setImageMakeConfig((current) => ({
+                        ...current,
+                        providers: {
+                          ...current.providers,
+                          comfyui: { ...current.providers.comfyui, steps: Number(event.target.value) },
+                        },
+                      }))}
+                    />
+                  </label>
+                  <label>
+                    CFG
+                    <input
+                      type="number"
+                      min={0}
+                      max={30}
+                      step={0.5}
+                      value={imageMakeConfig.providers.comfyui.cfg ?? 7}
+                      disabled={!imageMakeControlsEnabled}
+                      onChange={(event) => setImageMakeConfig((current) => ({
+                        ...current,
+                        providers: {
+                          ...current.providers,
+                          comfyui: { ...current.providers.comfyui, cfg: Number(event.target.value) },
+                        },
+                      }))}
+                    />
+                  </label>
+                  <label>
+                    Sampler
+                    <input
+                      value={imageMakeConfig.providers.comfyui.sampler ?? 'euler'}
+                      disabled={!imageMakeControlsEnabled}
+                      onChange={(event) => setImageMakeConfig((current) => ({
+                        ...current,
+                        providers: {
+                          ...current.providers,
+                          comfyui: { ...current.providers.comfyui, sampler: event.target.value },
+                        },
+                      }))}
+                    />
+                  </label>
+                  <label>
+                    Scheduler
+                    <input
+                      value={imageMakeConfig.providers.comfyui.scheduler ?? 'normal'}
+                      disabled={!imageMakeControlsEnabled}
+                      onChange={(event) => setImageMakeConfig((current) => ({
+                        ...current,
+                        providers: {
+                          ...current.providers,
+                          comfyui: { ...current.providers.comfyui, scheduler: event.target.value },
+                        },
+                      }))}
+                    />
+                  </label>
+                  <label>
+                    超时（秒）
+                    <input
+                      type="number"
+                      min={2}
+                      max={1800}
+                      value={imageMakeConfig.providers.comfyui.timeoutSeconds ?? 600}
+                      disabled={!imageMakeControlsEnabled}
+                      onChange={(event) => setImageMakeConfig((current) => ({
+                        ...current,
+                        providers: {
+                          ...current.providers,
+                          comfyui: { ...current.providers.comfyui, timeoutSeconds: Number(event.target.value) },
+                        },
+                      }))}
+                    />
+                  </label>
+                </div>
+              </div>
+              <div className="asset-plugin-footer">
+                <span className={`asset-status ${imageMakeConfig.providers.comfyui.enabled ? 'is-on' : ''}`}>
+                  {imageMakeConfig.providers.comfyui.checkpoint || '未配置 checkpoint'}
+                </span>
+                <button
+                  type="button"
+                  className="send-btn"
+                  disabled={busy === 'image-make-config' || !imageMakeControlsEnabled}
+                  onClick={() => void saveImageMakeConfig()}
+                >
+                  {busy === 'image-make-config' ? '保存中…' : '保存配置'}
+                </button>
+              </div>
+            </section>
+          </div>
+        </>
+      ) : null}
+      <div className="model-center-section-title">
+        <h3>其他资产能力</h3>
+        <p>素材检索、图片处理和图片理解仅配置运行 Provider；大模型统一在「统一模型中心」管理。</p>
+      </div>
       <div className="asset-plugin-grid asset-plugin-grid--balanced">
-      {config.plugins.map((plugin) => {
+      {orderedPlugins.filter((plugin) => plugin.pluginId !== 'asset-generate').map((plugin) => {
         const draft = drafts[plugin.pluginId] ?? draftFromPlugin(plugin);
-        const selectedKey = activeKeys.find((key) => key.id === draft.llmProviderKeyId);
         const visual = pluginVisuals[plugin.pluginId] ?? { icon: '✦', accent: 'blue' };
         return <section className={`asset-plugin-card asset-plugin-card--${visual.accent}`} key={plugin.pluginId}>
           <div className="asset-plugin-card-head">
@@ -140,32 +709,25 @@ export function AssetGatewayPage() {
           </div>
           <div className="asset-plugin-fields">
             <label>运行 Provider<select value={draft.provider} onChange={(event) => {
-              const provider = event.target.value;
+              updateDraft(plugin.pluginId, { provider: event.target.value });
-              updateDraft(plugin.pluginId, {
-                provider,
-                ...(provider === 'image_make' ? { llmProviderKeyId: '', llmModel: '' } : {}),
-              });
             }} disabled={!draft.enabled}>
               <option value="">选择 Provider</option>
               {plugin.providers.map((provider) => <option key={provider} value={provider}>{provider}</option>)}
             </select></label>
-            {plugin.pluginId === 'asset-generate' && draft.provider === 'image_make' ? (
+            {plugin.supportsLlm ? (
               <div className="asset-image-make-note">
-                image_make 独立管理本地模型，不读取统一模型中心密钥。
+                大模型不在此单独配置；请在
+                {' '}
+                <Link to="/providers">统一模型中心</Link>
+                {' '}
+                设置默认模型与图片任务模型（Qwen VL）。
               </div>
-            ) : plugin.supportsLlm ? <>
+            ) : (
-              <label>专属 LLM<select value={draft.llmProviderKeyId} onChange={(event) => updateDraft(plugin.pluginId, { llmProviderKeyId: event.target.value, llmModel: '' })} disabled={!draft.enabled}>
+              <div className="asset-no-llm">确定性处理 · 不调用 LLM</div>
-                <option value="">不使用 LLM</option>
+            )}
-                {activeKeys.map((key) => <option key={key.id} value={key.id}>{key.name}</option>)}
-              </select></label>
-              <label>模型<select value={draft.llmModel} onChange={(event) => updateDraft(plugin.pluginId, { llmModel: event.target.value })} disabled={!draft.enabled || !selectedKey}>
-                <option value="">选择模型</option>
-                {selectedKey?.models.map((model) => <option key={model} value={model}>{model}</option>)}
-              </select></label>
-            </> : <div className="asset-no-llm">确定性处理 · 不调用 LLM</div>}
             {plugin.pluginId === 'asset-generate' && plugin.purposeCatalog?.length ? (
               <fieldset className="asset-purpose-fieldset" disabled={!draft.enabled || draft.provider !== 'image_make'}>
-                <legend>image_make 生效范围</legend>
+                <legend>AI 图片输出项</legend>
                 <div className="asset-purpose-grid">
                   {plugin.purposeCatalog.map((purpose) => (
                     <label key={purpose.id}>
@@ -174,11 +736,14 @@ export function AssetGatewayPage() {
                         checked={Boolean(draft.purposes[purpose.id])}
                         onChange={(event) => updatePurpose(plugin.pluginId, purpose.id, event.target.checked)}
                       />
-                      <span>{purpose.label}<small>{purpose.presetId}</small></span>
+                      <span>
+                        {purpose.label}
+                        <small>{purpose.strategy === 'derive' ? '从页面头图派生 · 不重复生图' : purpose.presetId}</small>
+                      </span>
                     </label>
                   ))}
                 </div>
-                <p>信息流缩略图仍由 MindSpace 从封面源图派生，不会重复调用生图模型。</p>
+                <p>页面头图最多生成一次；卡片封面和信息流缩略图复用同一张主图裁剪。关闭某项后，该位置不使用 AI 图片；基础页面缩略图仍保留。</p>
               </fieldset>
             ) : null}
           </div>

src/admin/pages/DashboardPage.tsx

@@ -9,7 +9,7 @@ const QUICK_LINKS = [
   { to: '/users', label: '用户管理', desc: '创建账号、启用禁用' },
   { to: '/billing/recharge', label: '充值', desc: '为用户账户充值' },
   { to: '/providers', label: '统一模型中心', desc: 'Provider、执行器模型与启动控制' },
-  { to: '/asset-gateway', label: '资产能力', desc: '可插拔素材插件、Provider 与专属 LLM 选择' },
+  { to: '/asset-gateway', label: '图片生成', desc: '配置正文图、页面头图、卡片封面与信息流缩略图' },
   { to: '/mindspace', label: 'MindSpace 配置', desc: '公开页上限与空间发布参数' },
   { to: '/memory-v2', label: 'Memory V2', desc: '长期记忆 backend 与前置路由开关' },
   { to: '/skill-runtime', label: 'Skill Runtime', desc: 'H5 manifest 关键词路由开关' },

src/admin/pages/ProvidersPage.tsx

@@ -19,6 +19,7 @@ import {
   setLlmVisionKey,
   stopLlmExecutor,
   syncLlmProviderToGoosed,
+  testLlmProviderDraft,
   testLlmProviderKey,
   updateLlmProviderKey,
 } from '../../api/client';
@@ -34,6 +35,11 @@ import type {
 } from '../../types';
 
 const CUSTOM_PROVIDER_ID = '__custom__';
+const KIMI_DIRECT_PRESET = {
+  apiUrl: 'https://api.moonshot.cn/v1',
+  modelsText: 'kimi-k3\nkimi-k2.6',
+  defaultModel: 'kimi-k3',
+};
 
 const EXECUTOR_VISUALS: Record<string, { icon: string; accent: string }> = {
   goose: { icon: 'G', accent: 'blue' },
@@ -62,6 +68,14 @@ function parseModelsText(text: string) {
   return [...new Set(text.split(/[\n,]/).map((item) => item.trim()).filter(Boolean))];
 }
 
+function formatProviderConnectionError(message?: string) {
+  const detail = String(message ?? '未知错误').trim();
+  if (/not found the model|permission denied|resource_not_found_error/i.test(detail)) {
+    return `模型不存在或当前 API Key 没有该模型权限，请检查模型 ID。上游响应：${detail}`;
+  }
+  return detail;
+}
+
 function statusText(status?: LlmExecutorLaunchState | null) {
   if (!status) return '未启动';
   if (status.running) return `运行中${status.pid ? ` · pid ${status.pid}` : ''}`;
@@ -170,6 +184,24 @@ function ProviderDialog({
 
           {isCustom ? (
             <>
+              <div className="form-span-all provider-preset-row">
+                <button
+                  type="button"
+                  className="ghost-btn"
+                  disabled={busy}
+                  onClick={() => onChange({
+                    ...form,
+                    name: form.name || 'Kimi',
+                    apiUrl: KIMI_DIRECT_PRESET.apiUrl,
+                    modelsText: KIMI_DIRECT_PRESET.modelsText,
+                    defaultModel: KIMI_DIRECT_PRESET.defaultModel,
+                    relayProvider: '',
+                  })}
+                >
+                  使用 Kimi 直连预设
+                </button>
+                <span className="muted">自动填写官方 API 地址和模型 ID；直连 Moonshot 时 Relay Provider 必须留空。</span>
+              </div>
               <label>
                 <span>API 地址</span>
                 <input placeholder="https://api.example.com/v1/chat/completions" value={form.apiUrl} onChange={(event) => onChange({ ...form, apiUrl: event.target.value })} />
@@ -177,6 +209,7 @@ function ProviderDialog({
               <label>
                 <span>Relay Provider</span>
                 <input placeholder="可选，例如 ollama" value={form.relayProvider} onChange={(event) => onChange({ ...form, relayProvider: event.target.value })} />
+                <small className="muted">仅供中转/聚合接口路由使用；OpenAI、Moonshot、DeepSeek 等官方直连接口请留空。</small>
               </label>
               <label className="form-span-all">
                 <span>模型列表</span>
@@ -415,8 +448,8 @@ function VisionSection({
         <div className="asset-plugin-card-head">
           <div className="asset-plugin-icon" aria-hidden="true">◉</div>
           <div>
-            <h3>图片任务模型</h3>
+            <h3>图片任务模型（DashScope）</h3>
-            <p>发送含图片的消息时自动切换到此模型（需支持视觉能力，如 Qwen VL）</p>
+            <p>Qwen VL 审图、聊天识图与 Qwen-Image 生图共用同一 DashScope API Key；此处只需选择视觉模型。</p>
           </div>
           <span className={`asset-status ${settings?.keyId ? 'is-on' : ''}`}>
             {settings?.keyId ? `${settings.keyName} · ${settings.visionModel}` : '未配置'}
@@ -544,6 +577,21 @@ export function ProvidersPage() {
     setError(null);
     try {
       if (providerDialog.mode === 'create') {
+        if (isCustom) {
+          const connection = await testLlmProviderDraft({
+            providerId: CUSTOM_PROVIDER_ID,
+            name: form.name,
+            apiKey: form.apiKey,
+            apiUrl: form.apiUrl,
+            models: customModels,
+            defaultModel: form.defaultModel || customModels[0],
+            testModel: form.defaultModel || customModels[0],
+            relayProvider: form.relayProvider || undefined,
+          });
+          if (!connection.ok) {
+            throw new Error(`保存前联通校验失败：${formatProviderConnectionError(connection.message)}`);
+          }
+        }
         await createLlmProviderKey(
           isCustom
             ? {
@@ -581,7 +629,13 @@ export function ProvidersPage() {
               },
         );
       }
-      setMessage(providerDialog.mode === 'create' ? 'Provider 已添加' : 'Provider 已保存');
+      setMessage(
+        providerDialog.mode === 'create' && isCustom
+          ? 'Provider 已添加，保存前联通校验通过'
+          : providerDialog.mode === 'create'
+            ? 'Provider 已添加'
+            : 'Provider 已保存',
+      );
       setProviderDialog(null);
       await load();
     } catch (err) {
@@ -640,7 +694,7 @@ export function ProvidersPage() {
     try {
       const result = await testLlmProviderKey(row.id, row.defaultModel);
       if (result.ok) setMessage(`「${row.name}」联通成功`);
-      else setError(`「${row.name}」联通失败：${result.message ?? '未知错误'}`);
+      else setError(`「${row.name}」联通失败：${formatProviderConnectionError(result.message)}`);
     } catch (err) {
       setError(err instanceof Error ? err.message : '联通测试失败');
     } finally {
@@ -894,7 +948,7 @@ export function ProvidersPage() {
         })}
       </div>
 
-      <h3 className="model-center-section-title">图片任务模型</h3>
+      <h3 className="model-center-section-title">图片任务模型（DashScope）</h3>
       <VisionSection
         keys={activeKeys}
         settings={visionSettings}

src/api/client.ts

@@ -1,5 +1,8 @@
 import type {
   AssetGatewayConfig,
+  ImageMakeAdminConfig,
+  ImageMakeAdminConfigResponse,
+  ImageMakeRuntimeResponse,
   AdminDashboardSummary,
   AdminServiceRestartAction,
   AdminServiceRestartResult,
@@ -316,6 +319,27 @@ export async function updateAssetPluginConfig(
   });
 }
 
+export async function getImageMakeAdminConfig(): Promise<ImageMakeAdminConfigResponse> {
+  return portalFetch('/admin-api/image-make/config');
+}
+
+export async function updateImageMakeAdminConfig(
+  payload: Partial<ImageMakeAdminConfig> & {
+    providers?: Partial<ImageMakeAdminConfig['providers']> & {
+      aliyun_bailian?: Partial<ImageMakeAdminConfig['providers']['aliyun_bailian']> & { apiKey?: string };
+    };
+  },
+): Promise<ImageMakeAdminConfigResponse & { ok?: boolean; message?: string }> {
+  return portalFetch('/admin-api/image-make/config', {
+    method: 'PATCH',
+    body: JSON.stringify(payload),
+  });
+}
+
+export async function getImageMakeRuntimeStatus(): Promise<ImageMakeRuntimeResponse> {
+  return portalFetch('/admin-api/image-make/runtime');
+}
+
 export async function getMindSpaceAdminConfig(): Promise<MindSpaceAdminConfig> {
   const result = await portalFetch<{ config: MindSpaceAdminConfig }>('/admin-api/mindspace/config');
   return result.config;

src/index.css

@@ -620,6 +620,13 @@ body,
   padding: 20px;
 }
 
+.provider-preset-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+
 .modal-actions {
   grid-column: 1 / -1;
   display: flex;
@@ -1005,6 +1012,96 @@ body,
   margin-bottom: 18px;
 }
 
+.image-generation-settings {
+  display: grid;
+  gap: 16px;
+  margin-bottom: 22px;
+  padding: 20px;
+  border: 1px solid color-mix(in srgb, #9374ff 62%, var(--color-border));
+  border-radius: var(--radius-lg);
+  background: linear-gradient(145deg, rgba(106, 76, 196, .16), var(--color-bg-surface) 48%);
+  box-shadow: 0 12px 34px rgba(0, 0, 0, .14);
+}
+
+.image-generation-settings-head,
+.image-generation-settings-footer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 18px;
+}
+
+.image-generation-settings-head h3 {
+  margin: 5px 0 6px;
+  font-size: 18px;
+}
+
+.image-generation-settings-head p,
+.image-generation-settings-footer span {
+  margin: 0;
+  color: var(--color-text-muted);
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.image-generation-provider {
+  display: grid;
+  max-width: 360px;
+  gap: 6px;
+  color: var(--color-text-muted);
+  font-size: 11px;
+}
+
+.image-generation-scope-fieldset {
+  min-width: 0;
+  margin: 0;
+  padding: 14px;
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+}
+
+.image-generation-scope-fieldset legend {
+  padding: 0 6px;
+  color: var(--color-text-muted);
+  font-size: 11px;
+}
+
+.image-generation-scope-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 10px;
+}
+
+.image-generation-scope-item {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  padding: 12px;
+  border: 1px solid color-mix(in srgb, var(--color-border) 82%, transparent);
+  border-radius: var(--radius-sm);
+  background: rgba(255, 255, 255, .025);
+}
+
+.image-generation-scope-item input {
+  margin-top: 3px;
+}
+
+.image-generation-scope-item span {
+  display: grid;
+  gap: 4px;
+}
+
+.image-generation-scope-item strong {
+  color: var(--color-text);
+  font-size: 13px;
+}
+
+.image-generation-scope-item small {
+  color: var(--color-text-muted);
+  font-size: 11px;
+  line-height: 1.4;
+}
+
 .asset-plugin-card {
   display: flex;
   flex-direction: column;
@@ -1026,6 +1123,32 @@ body,
 .asset-plugin-card--amber { border-top: 3px solid #e8af55; }
 .asset-plugin-card--green { border-top: 3px solid #55c79b; }
 
+.asset-plugin-card.is-disabled {
+  opacity: 0.68;
+}
+
+.asset-plugin-card.is-disabled .asset-plugin-fields,
+.asset-plugin-card.is-disabled .asset-plugin-footer button {
+  pointer-events: none;
+}
+
+.asset-plugin-card.is-disabled .asset-plugin-card-head .asset-mini-toggle {
+  pointer-events: auto;
+}
+
+.asset-plugin-icon--blue { background: rgba(84, 168, 255, .17); color: #9fd0ff; }
+.asset-plugin-icon--amber { background: rgba(232, 175, 85, .17); color: #f0cc84; }
+.asset-plugin-icon--green { background: rgba(85, 199, 155, .17); color: #8fe0bc; }
+
+.image-make-runtime-note {
+  padding: 9px 10px;
+  border-radius: var(--radius-sm);
+  background: rgba(84, 168, 255, .1);
+  color: var(--color-text-muted);
+  font-size: 11px;
+  line-height: 1.5;
+}
+
 .asset-plugin-card-head {
   display: flex;
   gap: 10px;
@@ -1111,6 +1234,11 @@ body,
   line-height: 1.45;
 }
 
+.asset-purpose-grid small {
+  color: var(--color-text-muted);
+  line-height: 1.35;
+}
+
 .asset-purpose-grid {
   display: grid;
   grid-template-columns: repeat(2, minmax(0, 1fr));
@@ -1458,6 +1586,16 @@ body,
     grid-template-columns: 1fr;
   }
 
+  .image-generation-settings-head,
+  .image-generation-settings-footer {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .image-generation-scope-grid {
+    grid-template-columns: 1fr;
+  }
+
   .asset-plugin-footer {
     align-items: flex-start;
     flex-direction: column;

src/types.ts

@@ -120,6 +120,7 @@ export type LlmVisionSettings = {
   providerLabel: string | null;
   visionModel: string | null;
   availableModels: string[];
+  apiKeyMasked?: string | null;
 };
 
 export type LlmConnectionTestResult = {
@@ -213,6 +214,8 @@ export type AssetPluginConfig = {
     id: string;
     label: string;
     presetId: string;
+    strategy?: 'generate' | 'derive';
+    sourcePurpose?: string | null;
   }>;
 };
 
@@ -222,6 +225,52 @@ export type AssetGatewayConfig = {
   plugins: AssetPluginConfig[];
 };
 
+export type ImageMakeProviderConfig = {
+  enabled: boolean;
+  model?: string;
+  apiBase?: string;
+  apiKeyConfigured?: boolean;
+  apiKeyMasked?: string;
+  dashScopeSource?: 'vision' | 'global' | null;
+  dashScopeKeyName?: string | null;
+  checkpoint?: string;
+  workflowPath?: string;
+  outputNodeId?: string;
+  timeoutSeconds?: number;
+  steps?: number;
+  cfg?: number;
+  sampler?: string;
+  scheduler?: string;
+};
+
+export type ImageMakeAdminConfig = {
+  defaultProvider: 'mock' | 'aliyun_bailian' | 'comfyui';
+  jobDefaultTimeoutSeconds: number;
+  providers: {
+    mock: ImageMakeProviderConfig;
+    aliyun_bailian: ImageMakeProviderConfig;
+    comfyui: ImageMakeProviderConfig;
+  };
+};
+
+export type ImageMakeAdminConfigResponse = {
+  config: ImageMakeAdminConfig;
+  source?: string;
+  updatedAt?: number | null;
+  updatedBy?: string | null;
+};
+
+export type ImageMakeRuntimeResponse = {
+  ok: boolean;
+  fingerprint?: string;
+  source?: string;
+  updatedAt?: number | null;
+  defaultProvider?: string;
+  jobDefaultTimeoutSeconds?: number;
+  providers?: ImageMakeAdminConfig['providers'];
+  message?: string;
+};
+
 export type AdminServiceRestartAction = 'local_restart' | 'pro_restart';
 
 export type AdminServiceRestartResult = {