jishushell 0.4.30 → 0.5.15

package/dist/routes/system.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.js","sourceRoot":"","sources":["../../src/routes/system.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAErG,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAS,SAAS,CAAC,CAAC,CAAC,SAAS;AAEhE,SAAS,kBAAkB;IACzB,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAA2B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC,eAAe,IAAI,EAAE,CAGtD,CAAC;IACF,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,YAAY,CAAC;QAC3D,IAAI,GAAG;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;QACvC,sEAAsE;QACtE,gEAAgE;QAChE,+BAA+B;QAC9B,MAAc,CAAC,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;QACvD,MAAc,CAAC,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;QACvD,MAAc,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1D,MAAM,SAAS,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,CAAC,+CAA+C;QAC9D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,OAAO,eAAe,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,IAAI,CAAC;oBAChB,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,WAAW;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,OAAO,EAAE,qBAAqB;iBAC/B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,4BAA4B,EAAE,CAAC,CAAC;YAC5F,CAAC;YAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,OAAO,EAAE,mBAAmB,IAAI,CAAC,cAAc,OAAO,IAAI,CAAC,aAAa,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,mEAAmE;IACnE,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,EACJ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACnD,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QAErG,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAwE,EAAE,CAAC;QAExF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,EAAY,CAAC;YACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;gBAChD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;gBACnE,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC1C,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,SAAS;oBACxC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;oBACtE,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;wBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;wBACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AAEL,CAAC"}
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../src/routes/system.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAErG,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAS,SAAS,CAAC,CAAC,CAAC,SAAS;AAEhE,SAAS,kBAAkB;IACzB,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAA2B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC,eAAe,IAAI,EAAE,CAGtD,CAAC;IACF,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,YAAY,CAAC;QAC3D,IAAI,GAAG;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;QACvC,sEAAsE;QACtE,gEAAgE;QAChE,+BAA+B;QAC9B,MAAc,CAAC,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;QACvD,MAAc,CAAC,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;QACvD,MAAc,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1D,MAAM,SAAS,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,CAAC,+CAA+C;QAC9D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,OAAO,eAAe,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,IAAI,CAAC;oBAChB,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,WAAW;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,OAAO,EAAE,qBAAqB;iBAC/B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,4BAA4B,EAAE,CAAC,CAAC;YAC5F,CAAC;YAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,OAAO,EAAE,mBAAmB,IAAI,CAAC,cAAc,OAAO,IAAI,CAAC,aAAa,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,mEAAmE;IACnE,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,EACJ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACnD,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QAErG,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAwE,EAAE,CAAC;QAExF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,EAAY,CAAC;YACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;gBAChD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;gBACnE,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC1C,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,SAAS;oBACxC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;oBACtE,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;wBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;wBACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AAEL,CAAC"}

package/dist/routes/webdav.d.ts

@@ -0,0 +1,17 @@
+/**
+ * /webdav/* routes (M3 W4 PR-3).
+ *
+ * Mounted as a Fastify plugin so the route-scoped octet-stream parser
+ * does not leak. Authentication runs as an onRequest hook upstream of
+ * the handlers — every request must carry Basic Auth resolving to a
+ * non-revoked app password.
+ *
+ * The mount path is fixed at /webdav (no instance-specific suffix);
+ * the root maps to ~/.jishushell/files/.
+ */
+import type { FastifyInstance } from "fastify";
+import { FilesManager } from "../services/files-manager.js";
+export interface WebdavRoutesDeps {
+    filesManager: FilesManager;
+}
+export declare function webdavRoutes(app: FastifyInstance, deps: WebdavRoutesDeps): Promise<void>;

package/dist/routes/webdav.js

@@ -0,0 +1,114 @@
+import { parseBasicAuth, verifyAppPassword, } from "../services/app-passwords.js";
+import { handleOptions, handlePropfind, handleGet, handlePut, handleDelete, handleMkcol, handleMove, handleCopy, } from "../services/webdav/server.js";
+const MOUNT_PREFIX = "/webdav";
+export async function webdavRoutes(app, deps) {
+    // ── Register WebDAV-specific HTTP methods ──────
+    // Fastify 5 supports any method via addHttpMethod. PROPFIND has a
+    // body (XML); MKCOL/MOVE/COPY don't.
+    app.addHttpMethod("PROPFIND", { hasBody: true });
+    app.addHttpMethod("MKCOL", { hasBody: false });
+    app.addHttpMethod("MOVE", { hasBody: false });
+    app.addHttpMethod("COPY", { hasBody: false });
+    app.addHttpMethod("PROPPATCH", { hasBody: true });
+    app.addHttpMethod("LOCK", { hasBody: true });
+    app.addHttpMethod("UNLOCK", { hasBody: false });
+    app.addHttpMethod("REPORT", { hasBody: true });
+    // Pass-through parser for octet-stream PUT bodies (avoid bufferization)
+    app.addContentTypeParser("application/octet-stream", (_req, payload, done) => done(null, payload));
+    // PROPFIND clients send XML — accept it as a stream too; we don't
+    // actually parse the request XML (Depth header is enough for the
+    // properties we serve), so just consume and ignore.
+    app.addContentTypeParser(["application/xml", "text/xml"], (_req, payload, done) => done(null, payload));
+    // ── Authentication: Basic + app password ───────
+    app.addHook("onRequest", async (req, reply) => {
+        if (!req.url.startsWith(MOUNT_PREFIX))
+            return;
+        const auth = parseBasicAuth(req.headers.authorization);
+        if (!auth) {
+            reply
+                .code(401)
+                .header("WWW-Authenticate", 'Basic realm="JishuShell WebDAV"')
+                .send("authentication required");
+            return reply;
+        }
+        const [username, password] = auth;
+        const record = await verifyAppPassword(username, password);
+        if (!record) {
+            reply
+                .code(401)
+                .header("WWW-Authenticate", 'Basic realm="JishuShell WebDAV"')
+                .send("invalid credentials");
+            return reply;
+        }
+        req.appPassword = record;
+    });
+    // ── Method dispatcher ──────────────────────────
+    const dispatcher = async (req, reply) => {
+        const ctx = {
+            filesManager: deps.filesManager,
+            mountPrefix: MOUNT_PREFIX,
+            authedAs: req.appPassword,
+        };
+        const method = req.method.toUpperCase();
+        switch (method) {
+            case "OPTIONS":
+                return handleOptions(ctx, req, reply);
+            case "PROPFIND":
+                return handlePropfind(ctx, req, reply);
+            case "GET":
+                return handleGet(ctx, req, reply, false);
+            case "HEAD":
+                return handleGet(ctx, req, reply, true);
+            case "PUT":
+                return handlePut(ctx, req, reply);
+            case "DELETE":
+                return handleDelete(ctx, req, reply);
+            case "MKCOL":
+                return handleMkcol(ctx, req, reply);
+            case "MOVE":
+                return handleMove(ctx, req, reply);
+            case "COPY":
+                return handleCopy(ctx, req, reply);
+            case "PROPPATCH":
+            case "LOCK":
+            case "UNLOCK":
+            case "REPORT":
+                // Not implemented — return 501 so clients fall back gracefully
+                reply.code(501).send(`${method} not supported`);
+                return;
+            default:
+                reply.code(405).header("Allow", "OPTIONS, GET, HEAD, PUT, DELETE, PROPFIND, MKCOL, MOVE, COPY").send();
+                return;
+        }
+    };
+    const ALL_METHODS = [
+        "OPTIONS",
+        "GET",
+        "HEAD",
+        "PUT",
+        "DELETE",
+        "PROPFIND",
+        "MKCOL",
+        "MOVE",
+        "COPY",
+        "PROPPATCH",
+        "LOCK",
+        "UNLOCK",
+        "REPORT",
+    ];
+    // 50MB body limit matches /api/files. WebDAV PUT on bigger files
+    // requires a separate "chunked upload" extension we'll add later.
+    app.route({
+        method: ALL_METHODS,
+        url: MOUNT_PREFIX,
+        bodyLimit: 50 * 1024 * 1024,
+        handler: dispatcher,
+    });
+    app.route({
+        method: ALL_METHODS,
+        url: `${MOUNT_PREFIX}/*`,
+        bodyLimit: 50 * 1024 * 1024,
+        handler: dispatcher,
+    });
+}
+//# sourceMappingURL=webdav.js.map

package/dist/routes/webdav.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webdav.js","sourceRoot":"","sources":["../../src/routes/webdav.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,cAAc,EACd,iBAAiB,GAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,8BAA8B,CAAC;AAEtC,MAAM,YAAY,GAAG,SAAS,CAAC;AAM/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAoB,EACpB,IAAsB;IAEtB,kDAAkD;IAClD,kEAAkE;IAClE,qCAAqC;IACrC,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,wEAAwE;IACxE,GAAG,CAAC,oBAAoB,CACtB,0BAA0B,EAC1B,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAC7C,CAAC;IACF,kEAAkE;IAClE,iEAAiE;IACjE,oDAAoD;IACpD,GAAG,CAAC,oBAAoB,CACtB,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAC/B,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAC7C,CAAC;IAEF,kDAAkD;IAClD,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,aAAmC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK;iBACF,IAAI,CAAC,GAAG,CAAC;iBACT,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;iBAC7D,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK;iBACF,IAAI,CAAC,GAAG,CAAC;iBACT,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;iBAC7D,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACA,GAAW,CAAC,WAAW,GAAG,MAAM,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,MAAM,UAAU,GAAG,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QACpE,MAAM,GAAG,GAAG;YACV,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAG,GAAW,CAAC,WAA0B;SAClD,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACxC,KAAK,UAAU;gBACb,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,KAAK,KAAK;gBACR,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3C,KAAK,MAAM;gBACT,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,KAAK;gBACR,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,KAAK,OAAO;gBACV,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACtC,KAAK,MAAM;gBACT,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,MAAM;gBACT,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,WAAW,CAAC;YACjB,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,QAAQ;gBACX,+DAA+D;gBAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC;gBAChD,OAAO;YACT;gBACE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAC5B,8DAA8D,CAC/D,CAAC,IAAI,EAAE,CAAC;gBACT,OAAO;QACX,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG;QAClB,SAAS;QACT,KAAK;QACL,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,OAAO;QACP,MAAM;QACN,MAAM;QACN,WAAW;QACX,MAAM;QACN,QAAQ;QACR,QAAQ;KACT,CAAC;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,GAAG,CAAC,KAAK,CAAC;QACR,MAAM,EAAE,WAAkB;QAC1B,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC3B,OAAO,EAAE,UAAU;KACpB,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC;QACR,MAAM,EAAE,WAAkB;QAC1B,GAAG,EAAE,GAAG,YAAY,IAAI;QACxB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC3B,OAAO,EAAE,UAAU;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/server.js

@@ -8,7 +8,8 @@ import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-import { ensureDirs, ensurePanelConfig, getPanelConfig, migrateCatalogSchemaIfNeeded, migrateHermesShimOutIfNeeded, migrateOpenclawCatalogIfNeeded, migrateOpenclawImageTagIfNeeded, } from "./config.js";
+import { ensureDirs, ensurePanelConfig, getPanelConfig, migrateCatalogSchemaIfNeeded, migrateHermesShimOutIfNeeded, migrateOpenclawCatalogIfNeeded, migrateOpenclawImageTagIfNeeded, getInternalMcpToken, } from "./config.js";
+import { timingSafeEqual } from "node:crypto";
 import { runStartupMigrations } from "./services/runtime/index.js";
 import { verifyToken } from "./auth.js";
 import { authRoutes } from "./routes/auth.js";
@@ -19,6 +20,13 @@ import { runtimeCatalogRoutes } from "./routes/runtime.js";
 import { appRoutes } from "./routes/apps.js";
 import { agentAppRoutes } from "./routes/agent-apps.js";
 import { llmRoutes } from "./routes/llm.js";
+import { filesRoutes } from "./routes/files.js";
+import { internalRoutes } from "./routes/internal.js";
+import { organizeRoutes } from "./routes/files-organize.js";
+import { fileMountsRoutes } from "./routes/file-mounts.js";
+import { webdavRoutes } from "./routes/webdav.js";
+import { externalMountsRoutes } from "./routes/external-mounts.js";
+import { FilesManager } from "./services/files-manager.js";
 import * as appManager from "./services/app/app-manager.js";
 import * as capabilityRegistry from "./services/capability-registry.js";
 import backupRoutes from "./routes/backup.js";
@@ -31,6 +39,28 @@ import { checkUpdate } from "./services/panel-manager.js";
 import { PROXY_IDENTITY_HEADERS } from "./constants.js";
 import { supportsGatewayWebsocket } from "./services/runtime/instance.js";
 const PUBLIC_PATHS = new Set(["/api/auth/status", "/api/auth/init", "/api/auth/login", "/api/setup/status", "/api/apps/validate-sudo-password"]);
+/** Slug charset for /apps/:slug — same as instance ids. */
+const SLUG_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+/** Regex for top-level app WebSocket upgrades (AI-FS v1 W2.5 PR-8). */
+const APP_SLUG_WS_RE = /^\/apps\/([a-z0-9][a-z0-9-]{0,62})(\/.*)?$/;
+/**
+ * Resolve the upstream host/port for a top-level /apps/:slug request using
+ * the capability registry. Resolution order:
+ *   1. `<slug>-ui`   — canonical convention (e.g. filebrowser-ui)
+ *   2. `web-<slug>`  — web-* convention (e.g. web-filebrowser)
+ * Returns the first entry with status === "running", or null if none found.
+ */
+function resolveAppSlugUpstream(slug) {
+    const candidates = [`${slug}-ui`, `web-${slug}`];
+    for (const cap of candidates) {
+        const providers = capabilityRegistry.listProviders(cap);
+        const running = providers.find((p) => p.status === "running");
+        if (running) {
+            return { host: running.host, port: running.hostPort };
+        }
+    }
+    return null;
+}
 function hasValidPanelUpgradeToken(req) {
     const authHeader = req.headers.authorization || "";
     const match = authHeader.match(/^Bearer\s+(\S+)$/);
@@ -123,7 +153,7 @@ export async function createServer(options = {}) {
         bodyLimit: 1048576,
     });
     // Allow empty JSON body for POST requests
-    app.addContentTypeParser("application/json", { parseAs: "string" }, (req, body, done) => {
+    app.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
         if (!body || body.length === 0) {
             done(null, {});
         }
@@ -137,9 +167,49 @@ export async function createServer(options = {}) {
         }
     });
     // Parse text/plain and application/x-yaml as raw string (for app install endpoint)
-    app.addContentTypeParser(["text/plain", "application/x-yaml"], { parseAs: "string" }, (req, body, done) => {
+    app.addContentTypeParser(["text/plain", "application/x-yaml"], { parseAs: "string" }, (_req, body, done) => {
         done(null, body);
     });
+    // Fallback: pass any other content type through as the raw stream. Without
+    // this, /apps/:slug/* (W2.5 PR-8) would reject POST/PUT uploads with 415
+    // because Fastify's default behavior is to reject unparseable bodies.
+    // Specific routes that need typed bodies (octet-stream upload, etc.)
+    // register their own narrower parsers — those win over this catch-all.
+    app.addContentTypeParser("*", (_req, payload, done) => {
+        done(null, payload);
+    });
+    // Eager-init the internal MCP token so the file exists on disk before
+    // any agent container starts and tries to read it via env injection.
+    // Lazy-init would only fire on the first request that carries an
+    // X-Jishushell-Internal-Token header, which is too late for the
+    // adapter onBeforeStart that mounts the value into the container.
+    try {
+        getInternalMcpToken();
+    }
+    catch (e) {
+        console.warn(`[server] internal MCP token init skipped: ${e?.message ?? e}`);
+    }
+    // ── Auth middleware for /apps/* (AI-FS v1 W2.5 PR-8) ──────────────────
+    // Top-level reverse proxy for installed apps. Added in AI-FS v1 W2.5 PR-8.
+    // Pairs with `/api/instances/:id/provides/:cap/*` which is instance-scoped.
+    // This hook is scoped to /apps/* only so it does not double-fire with the
+    // existing /api/* hook below.
+    app.addHook("onRequest", async (request, reply) => {
+        const path = request.url.split("?")[0];
+        if (!path.startsWith("/apps/"))
+            return;
+        const authHeader = request.headers.authorization || "";
+        const match = authHeader.match(/^Bearer\s+(\S+)$/);
+        let token = match?.[1] || "";
+        if (!token) {
+            const cookie = request.headers.cookie || "";
+            const cookieMatch = cookie.match(/(?:^|;\s*)jishushell_session=([^;]*)/);
+            token = cookieMatch?.[1] || "";
+        }
+        if (!token || token.length > 4096 || !verifyToken(token)) {
+            return reply.status(401).send({ detail: "Unauthorized" });
+        }
+    });
     // Auth middleware
     app.addHook("onRequest", async (request, reply) => {
         const path = request.url.split("?")[0];
@@ -154,6 +224,35 @@ export async function createServer(options = {}) {
             }
             return;
         }
+        // Internal token path — used by:
+        //   (a) MCP shims spawned inside agent containers
+        //       (need BOTH X-Jishushell-Internal-Token + X-Jishushell-Instance)
+        //   (b) Panel app lifecycle scripts (post_start, etc.) calling back into
+        //       /api/internal/* on the same host
+        //       (need ONLY X-Jishushell-Internal-Token; no instance binding —
+        //        apps aren't instances)
+        // Combined with the standard JWT path below; we never require both.
+        const internalToken = request.headers["x-jishushell-internal-token"];
+        if (typeof internalToken === "string" && internalToken.length >= 32) {
+            const expected = getInternalMcpToken();
+            if (internalToken.length === expected.length &&
+                timingSafeEqual(Buffer.from(internalToken), Buffer.from(expected))) {
+                const instanceId = request.headers["x-jishushell-instance"];
+                if (typeof instanceId === "string" && instanceManager.getInstance(instanceId)) {
+                    request.internalCallerInstance = instanceId;
+                    return;
+                }
+                // Path (b): app-lifecycle / internal-only routes. Allowed without
+                // an instance header. The route is responsible for asserting the
+                // (request as any).internalCallerScope === "panel" tag before
+                // returning sensitive data.
+                if (path.startsWith("/api/internal/")) {
+                    request.internalCallerScope = "panel";
+                    return;
+                }
+            }
+            return reply.status(401).send({ detail: "Unauthorized" });
+        }
         // Check Authorization header first, then fall back to httpOnly cookie
         const authHeader = request.headers.authorization || "";
         const match = authHeader.match(/^Bearer\s+(\S+)$/);
@@ -201,6 +300,122 @@ export async function createServer(options = {}) {
     await app.register(agentAppRoutes);
     await app.register(llmRoutes);
     await app.register(backupRoutes);
+    await app.register(internalRoutes);
+    // Single FilesManager instance shared across /api/files, /webdav, and
+    // /api/files/external-mounts so a mutation on the mount list (PUT
+    // /external-mounts) is visible to every layer immediately.
+    const panelCfgForFiles = getPanelConfig();
+    const initialExternalMounts = Array.isArray(panelCfgForFiles.external_mounts)
+        ? panelCfgForFiles.external_mounts
+        : [];
+    const sharedFilesManager = new FilesManager({
+        externalMounts: initialExternalMounts,
+    });
+    await app.register(async (scope) => {
+        // Encapsulated registration so the route-scoped octet-stream parser
+        // does not leak to other routes (matches plan G6/D6 — Files is the
+        // only route that needs raw-stream uploads at W1).
+        await filesRoutes(scope, { filesManager: sharedFilesManager });
+        await organizeRoutes(scope, { filesManager: sharedFilesManager });
+        await fileMountsRoutes(scope);
+        await externalMountsRoutes(scope, { filesManager: sharedFilesManager });
+    });
+    // WebDAV runs in its own scope — it has independent auth (app password
+    // Basic Auth, NOT the panel JWT) and registers extra HTTP methods that
+    // we don't want leaking to other routes.
+    await app.register(async (scope) => {
+        await webdavRoutes(scope, { filesManager: sharedFilesManager });
+    });
+    // ── Top-level /apps/:slug/* reverse proxy (AI-FS v1 W2.5 PR-8) ───────────
+    // Reverse-proxies HTTP requests for installed apps to their capability
+    // upstream. Auth is handled by the onRequest hook above. The /apps/:slug
+    // prefix is NOT stripped — apps like Filebrowser are configured with
+    // --baseURL=/apps/filebrowser and expect the full path.
+    //
+    // Resolution order: `<slug>-ui` → `web-<slug>` (first running entry wins).
+    // 503 if no running provider found. 400 if slug is malformed.
+    //
+    // Registered BEFORE the SPA static fallback so explicit routes win.
+    const appsProxyHandler = async (req, reply) => {
+        const rawSlug = req.params.slug ?? "";
+        if (!SLUG_RE.test(rawSlug)) {
+            return reply.status(400).send({ detail: "Invalid app slug", slug: rawSlug });
+        }
+        const upstream = resolveAppSlugUpstream(rawSlug);
+        if (!upstream) {
+            return reply.status(503).send({ detail: "app not running", slug: rawSlug });
+        }
+        const { host: upstreamHost, port: upstreamPort } = upstream;
+        // Pass the full original path unchanged (including /apps/<slug> prefix).
+        const rawUrl = req.raw.url ?? "/";
+        const targetPath = rawUrl;
+        const hostHeader = `${upstreamHost}:${upstreamPort}`;
+        // Build forwarded headers: strip cookie and authorization to avoid
+        // leaking panel session credentials to third-party apps.
+        const forwardHeaders = {};
+        for (const [key, value] of Object.entries(req.headers)) {
+            if (value === undefined)
+                continue;
+            const lower = key.toLowerCase();
+            if (lower === "host")
+                continue;
+            if (lower === "cookie") {
+                const stripped = stripPanelSessionCookie(value);
+                if (stripped)
+                    forwardHeaders[key] = stripped;
+                continue;
+            }
+            if (lower === "authorization")
+                continue;
+            forwardHeaders[key] = value;
+        }
+        forwardHeaders["host"] = hostHeader;
+        // Hijack before writing to reply.raw so Fastify does not attempt its own
+        // lifecycle send after the handler returns.
+        reply.hijack();
+        await new Promise((resolve) => {
+            const proxyReq = httpRequest({
+                hostname: upstreamHost,
+                port: upstreamPort,
+                path: targetPath,
+                method: req.method,
+                headers: forwardHeaders,
+            }, (proxyRes) => {
+                // Stream the response back without buffering.
+                reply.raw.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+                proxyRes.pipe(reply.raw, { end: true });
+                proxyRes.on("end", resolve);
+                proxyRes.on("error", () => {
+                    try {
+                        reply.raw.end();
+                    }
+                    catch { }
+                    resolve();
+                });
+            });
+            proxyReq.on("error", (err) => {
+                console.error(`[apps-proxy] upstream error for slug=${rawSlug}:`, err.message);
+                if (!reply.raw.headersSent) {
+                    reply.raw.writeHead(502, { "content-type": "application/json" });
+                    reply.raw.end(JSON.stringify({ detail: "upstream error", slug: rawSlug }));
+                }
+                resolve();
+            });
+            // Forward request body if present (POST, PUT, PATCH, etc.)
+            if (req.rawBody) {
+                proxyReq.end(req.rawBody);
+            }
+            else if (req.raw.readable) {
+                req.raw.pipe(proxyReq, { end: true });
+                req.raw.on("end", () => { }); // ensure event fires
+            }
+            else {
+                proxyReq.end();
+            }
+        });
+    };
+    app.all("/apps/:slug", appsProxyHandler);
+    app.all("/apps/:slug/*", appsProxyHandler);
     // Serve frontend static files
     // Look for frontend dist in multiple locations
     const resolvedDir = existsSync(__dirname) ? realpathSync(__dirname) : __dirname;
@@ -408,6 +623,129 @@ export async function createServer(options = {}) {
         const path = url.split("?")[0];
         const gatewayMatch = path.match(GATEWAY_WS_RE);
         const capabilityMatch = path.match(CAPABILITY_WS_RE);
+        // ── /apps/:slug/* WebSocket upgrade (AI-FS v1 W2.5 PR-8) ──────────────
+        // Proxy WS upgrades for top-level installed apps. Same auth gate as HTTP.
+        const appSlugWsMatch = path.match(APP_SLUG_WS_RE);
+        if (appSlugWsMatch && !gatewayMatch && !capabilityMatch) {
+            const slug = appSlugWsMatch[1];
+            // Auth gate: same JWT cookie/bearer check as the HTTP handler above.
+            if (!hasValidPanelUpgradeToken(req)) {
+                socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            const upstream = resolveAppSlugUpstream(slug);
+            if (!upstream) {
+                socket.write("HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            const { host: upstreamHost, port: upstreamPort } = upstream;
+            const hostHeader = `${upstreamHost}:${upstreamPort}`;
+            const upstreamOrigin = `http://${hostHeader}`;
+            const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
+            const targetPath = `${path}${qs}`;
+            // Build upstream WS headers: strip cookie (panel session) and authorization.
+            const upstreamHeaders = buildCapabilityWebSocketHeaders(req.headers, upstreamOrigin);
+            socket.setTimeout?.(0);
+            socket.setNoDelay?.(true);
+            socket.setKeepAlive?.(true, 30000);
+            let proxyReq;
+            try {
+                proxyReq = httpRequest({
+                    hostname: upstreamHost,
+                    port: upstreamPort,
+                    path: targetPath,
+                    method: "GET",
+                    timeout: 10_000,
+                    headers: {
+                        ...upstreamHeaders,
+                        host: hostHeader,
+                    },
+                });
+            }
+            catch {
+                try {
+                    socket.destroy();
+                }
+                catch { }
+                activeWsSockets.delete(socket);
+                return;
+            }
+            proxyReq.on("timeout", () => {
+                proxyReq.destroy();
+                socket.destroy();
+            });
+            proxyReq.on("upgrade", (_res, proxySocket, proxyHead) => {
+                proxySocket.setTimeout(0);
+                proxySocket.setNoDelay(true);
+                proxySocket.setKeepAlive(true, 30000);
+                proxySocket.pause();
+                let handshake = "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n";
+                for (const [k, v] of Object.entries(_res.headers)) {
+                    if (v !== undefined && k.toLowerCase().startsWith("sec-websocket-")) {
+                        handshake += `${k}: ${v}\r\n`;
+                    }
+                }
+                handshake += "\r\n";
+                socket.write(handshake);
+                if (head.length > 0)
+                    proxySocket.write(head);
+                if (proxyHead.length > 0)
+                    socket.write(proxyHead);
+                proxySocket.pipe(socket);
+                socket.pipe(proxySocket);
+                proxySocket.resume();
+                activeWsSockets.add(socket);
+                activeWsSockets.add(proxySocket);
+                const release = (s) => { activeWsSockets.delete(s); };
+                const fail = () => {
+                    try {
+                        proxySocket.destroy();
+                    }
+                    catch { }
+                    try {
+                        socket.destroy();
+                    }
+                    catch { }
+                    release(socket);
+                    release(proxySocket);
+                };
+                proxySocket.on("close", () => {
+                    release(proxySocket);
+                    try {
+                        if (!socket.destroyed && !socket.writableEnded)
+                            socket.end();
+                    }
+                    catch { }
+                });
+                socket.on("close", () => {
+                    release(socket);
+                    try {
+                        if (!proxySocket.destroyed && !proxySocket.writableEnded)
+                            proxySocket.end();
+                    }
+                    catch { }
+                });
+                proxySocket.on("error", fail);
+                socket.on("error", fail);
+            });
+            proxyReq.on("response", (res) => {
+                forwardWebSocketRejection(socket, res);
+                activeWsSockets.delete(socket);
+            });
+            proxyReq.on("error", () => {
+                try {
+                    socket.write("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n");
+                }
+                catch { }
+                socket.destroy();
+                activeWsSockets.delete(socket);
+            });
+            proxyReq.end();
+            return;
+        }
+        // ── end /apps/:slug/* WS upgrade ───────────────────────────────────────
         // When an embedded page (e.g. Browserless debugger's puppeteer Worker)
         // opens a WS to the panel origin at a non-API path (e.g. /?launch=...),
         // resolve the target instance via the Referer header pointing at the