Initial commit: CarrotAssistant admin console (React + Vite + TS)

2026-07-06 16:10:53 +08:00
commit 08355d3a98
31 changed files with 3439 additions and 0 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+node_modules
+dist
+dist-ssr
+.git
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["react", "typescript", "oxc"],
+  "rules": {
+    "react/rules-of-hooks": "error",
+    "react/only-export-components": ["warn", { "allowConstantExport": true }]
+  }
+}
--- a/15
+++ b/15
@@ -0,0 +1,15 @@
+# Build the admin SPA, then serve it with nginx. nginx also reverse-proxies
+# /admin and /api to the backend container so the whole stack is reachable
+# through a single origin (no CORS hassle in production).
+
+FROM node:22-bookworm-slim AS builder
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM nginx:1.27-bookworm
+COPY --from=builder /src/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80
--- a/README.md
+++ b/README.md
@@ -0,0 +1,32 @@
+# React + TypeScript + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some Oxlint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Oxc](https://oxc.rs)
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/)
+
+## React Compiler
+
+The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
+
+## Expanding the Oxlint configuration
+
+If you are developing a production application, we recommend enabling type-aware lint rules by installing `oxlint-tsgolint` and editing `.oxlintrc.json`:
+
+```json
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["react", "typescript", "oxc"],
+  "options": {
+    "typeAware": true
+  },
+  "rules": {
+    "react/rules-of-hooks": "error",
+    "react/only-export-components": ["warn", { "allowConstantExport": true }]
+  }
+}
+```
+
+See the [Oxlint rules documentation](https://oxc.rs/docs/guide/usage/linter/rules) for the full list of rules and categories.
--- a/index.html
+++ b/index.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>CarrotAssistant 控制台</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
--- a/nginx.conf
+++ b/nginx.conf
@@ -0,0 +1,16 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Proxy API calls to the backend container.
+    location /admin/  { proxy_pass http://backend:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
+    location /api/    { proxy_pass http://backend:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
+    location /healthz { proxy_pass http://backend:8080; }
+
+    # SPA fallback: serve index.html for client-side routes.
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -0,0 +1,27 @@
+{
+  "name": "admin",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "lint": "oxlint",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "axios": "^1.18.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "react-router-dom": "^7.18.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.2",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.3",
+    "oxlint": "^1.71.0",
+    "typescript": "~6.0.2",
+    "vite": "^8.1.1"
+  }
+}
--- a/public/favicon.svg
+++ b/public/favicon.svg
--- a/public/icons.svg
+++ b/public/icons.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <symbol id="bluesky-icon" viewBox="0 0 16 17">
+    <g clip-path="url(#bluesky-clip)"><path fill="#08060d" d="M7.75 7.735c-.693-1.348-2.58-3.86-4.334-5.097-1.68-1.187-2.32-.981-2.74-.79C.188 2.065.1 2.812.1 3.251s.241 3.602.398 4.13c.52 1.744 2.367 2.333 4.07 2.145-2.495.37-4.71 1.278-1.805 4.512 3.196 3.309 4.38-.71 4.987-2.746.608 2.036 1.307 5.91 4.93 2.746 2.72-2.746.747-4.143-1.747-4.512 1.702.189 3.55-.4 4.07-2.145.156-.528.397-3.691.397-4.13s-.088-1.186-.575-1.406c-.42-.19-1.06-.395-2.741.79-1.755 1.24-3.64 3.752-4.334 5.099"/></g>
+    <defs><clipPath id="bluesky-clip"><path fill="#fff" d="M.1.85h15.3v15.3H.1z"/></clipPath></defs>
+  </symbol>
+  <symbol id="discord-icon" viewBox="0 0 20 19">
+    <path fill="#08060d" d="M16.224 3.768a14.5 14.5 0 0 0-3.67-1.153c-.158.286-.343.67-.47.976a13.5 13.5 0 0 0-4.067 0c-.128-.306-.317-.69-.476-.976A14.4 14.4 0 0 0 3.868 3.77C1.546 7.28.916 10.703 1.231 14.077a14.7 14.7 0 0 0 4.5 2.306q.545-.748.965-1.587a9.5 9.5 0 0 1-1.518-.74q.191-.14.372-.293c2.927 1.369 6.107 1.369 8.999 0q.183.152.372.294-.723.437-1.52.74.418.838.963 1.588a14.6 14.6 0 0 0 4.504-2.308c.37-3.911-.63-7.302-2.644-10.309m-9.13 8.234c-.878 0-1.599-.82-1.599-1.82 0-.998.705-1.82 1.6-1.82.894 0 1.614.82 1.599 1.82.001 1-.705 1.82-1.6 1.82m5.91 0c-.878 0-1.599-.82-1.599-1.82 0-.998.705-1.82 1.6-1.82.893 0 1.614.82 1.599 1.82 0 1-.706 1.82-1.6 1.82"/>
+  </symbol>
+  <symbol id="documentation-icon" viewBox="0 0 21 20">
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="m15.5 13.333 1.533 1.322c.645.555.967.833.967 1.178s-.322.623-.967 1.179L15.5 18.333m-3.333-5-1.534 1.322c-.644.555-.966.833-.966 1.178s.322.623.966 1.179l1.534 1.321"/>
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M17.167 10.836v-4.32c0-1.41 0-2.117-.224-2.68-.359-.906-1.118-1.621-2.08-1.96-.599-.21-1.349-.21-2.848-.21-2.623 0-3.935 0-4.983.369-1.684.591-3.013 1.842-3.641 3.428C3 6.449 3 7.684 3 10.154v2.122c0 2.558 0 3.838.706 4.726q.306.383.713.671c.76.536 1.79.64 3.581.66"/>
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M3 10a2.78 2.78 0 0 1 2.778-2.778c.555 0 1.209.097 1.748-.047.48-.129.854-.503.982-.982.145-.54.048-1.194.048-1.749a2.78 2.78 0 0 1 2.777-2.777"/>
+  </symbol>
+  <symbol id="github-icon" viewBox="0 0 19 19">
+    <path fill="#08060d" fill-rule="evenodd" d="M9.356 1.85C5.05 1.85 1.57 5.356 1.57 9.694a7.84 7.84 0 0 0 5.324 7.44c.387.079.528-.168.528-.376 0-.182-.013-.805-.013-1.454-2.165.467-2.616-.935-2.616-.935-.349-.91-.864-1.143-.864-1.143-.71-.48.051-.48.051-.48.787.051 1.2.805 1.2.805.695 1.194 1.817.857 2.268.649.064-.507.27-.857.49-1.052-1.728-.182-3.545-.857-3.545-3.87 0-.857.31-1.558.8-2.104-.078-.195-.349-1 .077-2.078 0 0 .657-.208 2.14.805a7.5 7.5 0 0 1 1.946-.26c.657 0 1.328.092 1.946.26 1.483-1.013 2.14-.805 2.14-.805.426 1.078.155 1.883.078 2.078.502.546.799 1.247.799 2.104 0 3.013-1.818 3.675-3.558 3.87.284.247.528.714.528 1.454 0 1.052-.012 1.896-.012 2.156 0 .208.142.455.528.377a7.84 7.84 0 0 0 5.324-7.441c.013-4.338-3.48-7.844-7.773-7.844" clip-rule="evenodd"/>
+  </symbol>
+  <symbol id="social-icon" viewBox="0 0 20 20">
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M12.5 6.667a4.167 4.167 0 1 0-8.334 0 4.167 4.167 0 0 0 8.334 0"/>
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M2.5 16.667a5.833 5.833 0 0 1 8.75-5.053m3.837.474.513 1.035c.07.144.257.282.414.309l.93.155c.596.1.736.536.307.965l-.723.73a.64.64 0 0 0-.152.531l.207.903c.164.715-.213.991-.84.618l-.872-.52a.63.63 0 0 0-.577 0l-.872.52c-.624.373-1.003.094-.84-.618l.207-.903a.64.64 0 0 0-.152-.532l-.723-.729c-.426-.43-.289-.864.306-.964l.93-.156a.64.64 0 0 0 .412-.31l.513-1.034c.28-.562.735-.562 1.012 0"/>
+  </symbol>
+  <symbol id="x-icon" viewBox="0 0 19 19">
+    <path fill="#08060d" fill-rule="evenodd" d="M1.893 1.98c.052.072 1.245 1.769 2.653 3.77l2.892 4.114c.183.261.333.48.333.486s-.068.089-.152.183l-.522.593-.765.867-3.597 4.087c-.375.426-.734.834-.798.905a1 1 0 0 0-.118.148c0 .01.236.017.664.017h.663l.729-.83c.4-.457.796-.906.879-.999a692 692 0 0 0 1.794-2.038c.034-.037.301-.34.594-.675l.551-.624.345-.392a7 7 0 0 1 .34-.374c.006 0 .93 1.306 2.052 2.903l2.084 2.965.045.063h2.275c1.87 0 2.273-.003 2.266-.021-.008-.02-1.098-1.572-3.894-5.547-2.013-2.862-2.28-3.246-2.273-3.266.008-.019.282-.332 2.085-2.38l2-2.274 1.567-1.782c.022-.028-.016-.03-.65-.03h-.674l-.3.342a871 871 0 0 1-1.782 2.025c-.067.075-.405.458-.75.852a100 100 0 0 1-.803.91c-.148.172-.299.344-.99 1.127-.304.343-.32.358-.345.327-.015-.019-.904-1.282-1.976-2.808L6.365 1.85H1.8zm1.782.91 8.078 11.294c.772 1.08 1.413 1.973 1.425 1.984.016.017.241.02 1.05.017l1.03-.004-2.694-3.766L7.796 5.75 5.722 2.852l-1.039-.004-1.039-.004z" clip-rule="evenodd"/>
+  </symbol>
+</svg>
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -0,0 +1,41 @@
+import { Routes, Route, Navigate } from 'react-router-dom'
+import Login from './pages/Login.tsx'
+import Layout from './components/Layout.tsx'
+import Dashboard from './pages/Dashboard.tsx'
+import Apps from './pages/Apps.tsx'
+import ModelConfigs from './pages/ModelConfigs.tsx'
+import Skills from './pages/Skills.tsx'
+import AuditLogs from './pages/AuditLogs.tsx'
+import { TOKEN_KEY } from './api/client.ts'
+
+// Routes that require a logged-in admin. Child routes render inside Layout,
+// which provides the sidebar + top bar. We redirect to /login when no token
+// is present so each page can assume an authenticated session.
+function Protected({ children }: { children: React.ReactNode }) {
+  const token = localStorage.getItem(TOKEN_KEY)
+  if (!token) return <Navigate to="/login" replace />
+  return <>{children}</>
+}
+
+export default function App() {
+  return (
+    <Routes>
+      <Route path="/login" element={<Login />} />
+      <Route
+        path="/"
+        element={
+          <Protected>
+            <Layout />
+          </Protected>
+        }
+      >
+        <Route index element={<Dashboard />} />
+        <Route path="apps" element={<Apps />} />
+        <Route path="apps/:appId/skills" element={<Skills />} />
+        <Route path="models" element={<ModelConfigs />} />
+        <Route path="audit" element={<AuditLogs />} />
+      </Route>
+      <Route path="*" element={<Navigate to="/" replace />} />
+    </Routes>
+  )
+}
--- a/src/api/apps.ts
+++ b/src/api/apps.ts
@@ -0,0 +1,52 @@
+import client from './client.ts'
+import type { App, AppCreateResponse, ModelConfig } from '../types/index.ts'
+
+// --- Apps ---
+
+export const listApps = () => client.get<App[]>('/apps').then((r) => r.data)
+
+export const getApp = (id: number) =>
+  client.get<App>(`/apps/${id}`).then((r) => r.data)
+
+export interface AppInput {
+  name: string
+  slug?: string
+  description?: string
+  model_config_id?: number | null
+  status?: string
+}
+
+export const createApp = (input: AppInput) =>
+  client.post<AppCreateResponse>('/apps', input).then((r) => r.data)
+
+export const updateApp = (id: number, input: AppInput) =>
+  client.put<App>(`/apps/${id}`, input).then((r) => r.data)
+
+export const deleteApp = (id: number) =>
+  client.delete(`/apps/${id}`).then((r) => r.data)
+
+export const rotateToken = (id: number) =>
+  client.post<{ token: string }>(`/apps/${id}/token/rotate`).then((r) => r.data)
+
+// --- Model configs ---
+
+export const listModelConfigs = () =>
+  client.get<ModelConfig[]>('/model-configs').then((r) => r.data)
+
+export interface ModelConfigInput {
+  name: string
+  base_url: string
+  api_key?: string
+  default_model: string
+  supports_tools?: boolean
+  max_tokens?: number
+}
+
+export const createModelConfig = (input: ModelConfigInput) =>
+  client.post<ModelConfig>('/model-configs', input).then((r) => r.data)
+
+export const updateModelConfig = (id: number, input: ModelConfigInput) =>
+  client.put<ModelConfig>(`/model-configs/${id}`, input).then((r) => r.data)
+
+export const deleteModelConfig = (id: number) =>
+  client.delete(`/model-configs/${id}`).then((r) => r.data)
--- a/src/api/client.ts
+++ b/src/api/client.ts
@@ -0,0 +1,32 @@
+// Centralised axios client for the admin API.
+//
+// All requests carry the admin JWT (when present) from localStorage. A 401
+// response clears the token and bounces to /login so the rest of the app can
+// assume an authenticated session.
+import axios from 'axios'
+
+export const TOKEN_KEY = 'ca_admin_token'
+
+const client = axios.create({
+  baseURL: import.meta.env.VITE_API_BASE || '/admin',
+  timeout: 30000,
+})
+
+client.interceptors.request.use((config) => {
+  const token = localStorage.getItem(TOKEN_KEY)
+  if (token) config.headers.Authorization = `Bearer ${token}`
+  return config
+})
+
+client.interceptors.response.use(
+  (res) => res,
+  (err) => {
+    if (err?.response?.status === 401) {
+      localStorage.removeItem(TOKEN_KEY)
+      if (location.pathname !== '/login') location.href = '/login'
+    }
+    return Promise.reject(err)
+  },
+)
+
+export default client
--- a/src/api/skills.ts
+++ b/src/api/skills.ts
@@ -0,0 +1,56 @@
+import client from './client.ts'
+import type { SkillMeta, SkillContent } from '../types/index.ts'
+
+// GET /admin/apps/:id/skills
+export const listSkills = (appId: number) =>
+  client.get<SkillMeta[]>(`/apps/${appId}/skills`).then((r) => r.data)
+
+// GET /admin/skills/:id  (returns meta + parsed content)
+export interface SkillDetail extends SkillMeta {
+  content: SkillContent
+}
+export const getSkill = (id: number) =>
+  client.get<SkillDetail>(`/skills/${id}`).then((r) => r.data)
+
+// PUT /admin/skills/:id
+export const updateSkill = (id: number, content: SkillContent) =>
+  client.put<SkillMeta>(`/skills/${id}`, { content }).then((r) => r.data)
+
+// POST /admin/skills/:id/publish
+export const publishSkill = (id: number) =>
+  client.post<SkillMeta>(`/skills/${id}/publish`).then((r) => r.data)
+
+// DELETE /admin/skills/:id
+export const deleteSkill = (id: number) =>
+  client.delete(`/skills/${id}`).then((r) => r.data)
+
+// POST /admin/apps/:id/skills/generate
+export interface GenerateInput {
+  source_type: 'openapi' | 'manual' | 'markdown' | 'source'
+  openapi?: string
+  base_url?: string
+  manual?: {
+    name: string
+    description?: string
+    method?: string
+    url: string
+    query_params?: Record<string, string>
+    path_params?: string[]
+    headers?: Record<string, string>
+    param_schema?: string
+  }
+}
+export const generateSkill = (appId: number, input: GenerateInput) =>
+  client.post<SkillDetail>(`/apps/${appId}/skills/generate`, input).then((r) => r.data)
+
+// POST /admin/skills/:id/test
+export interface TestEvent {
+  kind: string
+  text?: string
+  tool?: string
+  args?: Record<string, unknown>
+  result?: string
+  message?: string
+}
+export const testSkill = (id: number, message: string) =>
+  client.post<{ events: TestEvent[] }>(`/skills/${id}/test`, { message }).then((r) => r.data)
--- a/src/components/Layout.tsx
+++ b/src/components/Layout.tsx
@@ -0,0 +1,65 @@
+import { NavLink, Outlet, useNavigate } from 'react-router-dom'
+import { TOKEN_KEY } from '../api/client.ts'
+
+// App shell: fixed sidebar with primary navigation, a slim top bar, and a
+// content area where routed pages render. The sign-out button clears the
+// token and returns to /login.
+export default function Layout() {
+  const nav = useNavigate()
+
+  const links = [
+    { to: '/', label: '概览', end: true },
+    { to: '/apps', label: '应用', end: false },
+    { to: '/models', label: '模型配置', end: false },
+    { to: '/audit', label: '审计日志', end: false },
+  ]
+
+  const signOut = () => {
+    localStorage.removeItem(TOKEN_KEY)
+    nav('/login', { replace: true })
+  }
+
+  return (
+    <div style={{ display: 'flex', height: '100%' }}>
+      <aside
+        style={{
+          width: 220,
+          borderRight: '1px solid var(--border)',
+          background: 'var(--panel)',
+          padding: '18px 12px',
+          display: 'flex',
+          flexDirection: 'column',
+        }}
+      >
+        <div style={{ fontWeight: 700, fontSize: 16, padding: '4px 10px 22px' }}>
+          🥕 CarrotAssistant
+        </div>
+        <nav style={{ display: 'flex', flexDirection: 'column', gap: 2 }}>
+          {links.map((l) => (
+            <NavLink
+              key={l.to}
+              to={l.to}
+              end={l.end}
+              style={({ isActive }) => ({
+                padding: '8px 10px',
+                borderRadius: 6,
+                color: isActive ? 'var(--accent)' : 'var(--text-dim)',
+                background: isActive ? 'var(--panel-2)' : 'transparent',
+              })}
+            >
+              {l.label}
+            </NavLink>
+          ))}
+        </nav>
+        <div style={{ marginTop: 'auto' }}>
+          <button onClick={signOut} style={{ width: '100%' }}>
+            退出登录
+          </button>
+        </div>
+      </aside>
+      <main style={{ flex: 1, overflow: 'auto', padding: 24 }}>
+        <Outlet />
+      </main>
+    </div>
+  )
+}
--- a/src/components/Modal.tsx
+++ b/src/components/Modal.tsx
@@ -0,0 +1,51 @@
+// A minimal modal dialog used across pages for create/edit forms and for
+// one-off disclosures (tokens, confirmations). Click on the backdrop or press
+// Esc to dismiss.
+import { useEffect } from 'react'
+
+export default function Modal({
+  title,
+  onClose,
+  children,
+  width = 480,
+}: {
+  title: string
+  onClose: () => void
+  children: React.ReactNode
+  width?: number
+}) {
+  useEffect(() => {
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') onClose()
+    }
+    window.addEventListener('keydown', onKey)
+    return () => window.removeEventListener('keydown', onKey)
+  }, [onClose])
+
+  return (
+    <div
+      onClick={onClose}
+      style={{
+        position: 'fixed',
+        inset: 0,
+        background: 'rgba(0,0,0,0.55)',
+        display: 'flex',
+        alignItems: 'center',
+        justifyContent: 'center',
+        zIndex: 100,
+      }}
+    >
+      <div
+        className="card"
+        onClick={(e) => e.stopPropagation()}
+        style={{ width, maxHeight: '85vh', overflow: 'auto' }}
+      >
+        <div className="between" style={{ marginBottom: 16 }}>
+          <h2 style={{ margin: 0 }}>{title}</h2>
+          <button onClick={onClose}>✕</button>
+        </div>
+        {children}
+      </div>
+    </div>
+  )
+}
--- a/src/components/SkillEditor.tsx
+++ b/src/components/SkillEditor.tsx
@@ -0,0 +1,137 @@
+import { useEffect, useState } from 'react'
+import { getSkill, updateSkill, testSkill, type SkillDetail } from '../api/skills.ts'
+import Modal from './Modal.tsx'
+
+// SkillEditor loads a skill, lets the admin edit the raw markdown body (system
+// prompt) and the structured fields, save changes, and run a test message
+// against the current (unpublished) content.
+export default function SkillEditor({ skillId, onClose }: { skillId: number; onClose: () => void }) {
+  const [detail, setDetail] = useState<SkillDetail | null>(null)
+  const [loadErr, setLoadErr] = useState('')
+  const [systemPrompt, setSystemPrompt] = useState('')
+  const [saving, setSaving] = useState(false)
+  const [saveMsg, setSaveMsg] = useState('')
+
+  // test panel state
+  const [testMsg, setTestMsg] = useState('')
+  const [testing, setTesting] = useState(false)
+  const [testEvents, setTestEvents] = useState<string[]>([])
+
+  useEffect(() => {
+    ;(async () => {
+      try {
+        const d = await getSkill(skillId)
+        setDetail(d)
+        setSystemPrompt(d.content.system_prompt || '')
+      } catch (e: any) {
+        setLoadErr(e?.response?.data?.error || '加载失败')
+      }
+    })()
+  }, [skillId])
+
+  const save = async () => {
+    if (!detail) return
+    setSaving(true)
+    setSaveMsg('')
+    try {
+      const content = { ...detail.content, system_prompt: systemPrompt }
+      await updateSkill(skillId, content)
+      setSaveMsg('已保存')
+    } catch (e: any) {
+      setSaveMsg(e?.response?.data?.error || '保存失败')
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const runTest = async () => {
+    if (!testMsg.trim()) return
+    setTesting(true)
+    setTestEvents([])
+    try {
+      const { events } = await testSkill(skillId, testMsg)
+      const lines: string[] = []
+      for (const ev of events) {
+        if (ev.kind === 'token') lines.push(ev.text || '')
+        else if (ev.kind === 'tool_call') lines.push(`🔧 调用工具 ${ev.tool}(${JSON.stringify(ev.args)})`)
+        else if (ev.kind === 'tool_result') lines.push(`↩️ 结果: ${ev.result}`)
+        else if (ev.kind === 'final') lines.push(`\n📝 最终回复: ${ev.text}`)
+        else if (ev.kind === 'confirmation') lines.push(`⚠️ 需确认: ${ev.tool} - ${ev.result}`)
+        else if (ev.kind === 'error') lines.push(`❌ ${ev.message}`)
+      }
+      setTestEvents(lines)
+    } catch (e: any) {
+      setTestEvents([`❌ ${e?.response?.data?.error || '测试失败'}`])
+    } finally {
+      setTesting(false)
+    }
+  }
+
+  if (loadErr) return <Modal title="错误" onClose={onClose}><p style={{ color: 'var(--danger)' }}>{loadErr}</p></Modal>
+  if (!detail) return <Modal title="加载中…" onClose={onClose}><p className="muted">加载中…</p></Modal>
+
+  return (
+    <Modal title={`Skill: ${detail.name} (#${detail.id})`} onClose={onClose} width={780}>
+      <div className="row" style={{ gap: 8, marginBottom: 12 }}>
+        <span className={`tag ${detail.status === 'published' ? 'ok' : 'warn'}`}>{detail.status}</span>
+        <span className="tag">v{detail.version}</span>
+        <span className="tag">{detail.source}</span>
+        <span className="muted">{detail.content.tools.length} 个工具</span>
+      </div>
+
+      <div className="field">
+        <label>系统提示词(可直接编辑)</label>
+        <textarea rows={10} value={systemPrompt} onChange={(e) => setSystemPrompt(e.target.value)} />
+      </div>
+
+      <div className="field">
+        <label>工具定义(只读预览)</label>
+        <div className="card" style={{ maxHeight: 200, overflow: 'auto', background: 'var(--bg)' }}>
+          {detail.content.tools.map((t) => (
+            <div key={t.name} style={{ marginBottom: 8 }}>
+              <strong>{t.endpoint.method}</strong>{' '}
+              <span style={{ fontFamily: 'monospace' }}>{t.endpoint.url}</span>
+              <div className="muted" style={{ fontSize: 12 }}>
+                {t.name}: {t.description}
+              </div>
+            </div>
+          ))}
+        </div>
+      </div>
+
+      <div className="row" style={{ justifyContent: 'space-between', marginBottom: 16 }}>
+        <span className="muted" style={{ fontSize: 12 }}>
+          {saveMsg}
+        </span>
+        <div className="row">
+          <button onClick={onClose}>关闭</button>
+          <button className="primary" onClick={save} disabled={saving}>
+            {saving ? '保存中…' : '保存'}
+          </button>
+        </div>
+      </div>
+
+      <hr style={{ border: 'none', borderTop: '1px solid var(--border)', margin: '16px 0' }} />
+      <h3 style={{ marginTop: 0 }}>测试</h3>
+      <p className="muted" style={{ fontSize: 12, marginTop: 0 }}>
+        用当前(未发布的)skill 内容跑一轮对话。需要该应用已配置模型。
+      </p>
+      <div className="row" style={{ alignItems: 'flex-start' }}>
+        <textarea
+          rows={2}
+          value={testMsg}
+          onChange={(e) => setTestMsg(e.target.value)}
+          placeholder="输入测试问题…"
+        />
+        <button className="primary" onClick={runTest} disabled={testing} style={{ marginLeft: 8 }}>
+          {testing ? '运行中…' : '运行'}
+        </button>
+      </div>
+      {testEvents.length > 0 && (
+        <div className="card" style={{ marginTop: 12, background: 'var(--bg)', whiteSpace: 'pre-wrap' }}>
+          {testEvents.join('\n')}
+        </div>
+      )}
+    </Modal>
+  )
+}
--- a/src/index.css
+++ b/src/index.css
@@ -0,0 +1,84 @@
+:root {
+  --bg: #0f1115;
+  --panel: #171a21;
+  --panel-2: #1f2430;
+  --border: #2a2f3a;
+  --text: #e6e9ef;
+  --text-dim: #9aa3b2;
+  --accent: #f97316;
+  --accent-dim: #fb923c;
+  --danger: #ef4444;
+  --ok: #22c55e;
+  --radius: 8px;
+  font-family: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue",
+    Arial, "PingFang SC", "Microsoft YaHei", sans-serif;
+  color: var(--text);
+  background: var(--bg);
+}
+
+* { box-sizing: border-box; }
+
+html, body, #root { height: 100%; margin: 0; }
+
+body { font-size: 14px; line-height: 1.5; }
+
+a { color: var(--accent-dim); text-decoration: none; }
+a:hover { color: var(--accent); }
+
+button {
+  font: inherit;
+  cursor: pointer;
+  padding: 6px 14px;
+  border-radius: var(--radius);
+  border: 1px solid var(--border);
+  background: var(--panel-2);
+  color: var(--text);
+  transition: border-color 0.15s, background 0.15s;
+}
+button:hover { border-color: var(--accent); }
+button.primary { background: var(--accent); border-color: var(--accent); color: #1a1205; font-weight: 600; }
+button.primary:hover { background: var(--accent-dim); }
+button.danger { color: var(--danger); border-color: var(--danger); }
+button:disabled { opacity: 0.5; cursor: not-allowed; }
+
+input, textarea, select {
+  font: inherit;
+  width: 100%;
+  padding: 8px 10px;
+  border-radius: var(--radius);
+  border: 1px solid var(--border);
+  background: var(--bg);
+  color: var(--text);
+}
+input:focus, textarea:focus, select:focus { outline: none; border-color: var(--accent); }
+textarea { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; resize: vertical; }
+
+label { display: block; margin-bottom: 4px; color: var(--text-dim); font-size: 13px; }
+.field { margin-bottom: 14px; }
+
+.card {
+  background: var(--panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 18px;
+}
+
+.row { display: flex; gap: 10px; align-items: center; }
+.between { display: flex; justify-content: space-between; align-items: center; }
+.muted { color: var(--text-dim); }
+.tag {
+  display: inline-block;
+  padding: 1px 8px;
+  border-radius: 999px;
+  font-size: 12px;
+  background: var(--panel-2);
+  border: 1px solid var(--border);
+  color: var(--text-dim);
+}
+.tag.ok { color: var(--ok); border-color: var(--ok); }
+.tag.warn { color: var(--accent); border-color: var(--accent); }
+.tag.danger { color: var(--danger); border-color: var(--danger); }
+
+table { width: 100%; border-collapse: collapse; }
+th, td { text-align: left; padding: 10px 12px; border-bottom: 1px solid var(--border); }
+th { color: var(--text-dim); font-weight: 500; font-size: 13px; }
--- a/src/main.tsx
+++ b/src/main.tsx
@@ -0,0 +1,13 @@
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import { BrowserRouter } from 'react-router-dom'
+import './index.css'
+import App from './App.tsx'
+
+createRoot(document.getElementById('root')!).render(
+  <StrictMode>
+    <BrowserRouter>
+      <App />
+    </BrowserRouter>
+  </StrictMode>,
+)
--- a/src/pages/Apps.tsx
+++ b/src/pages/Apps.tsx
@@ -0,0 +1,186 @@
+import { useEffect, useState } from 'react'
+import { useNavigate } from 'react-router-dom'
+import {
+  listApps,
+  createApp,
+  rotateToken,
+  deleteApp,
+  type AppInput,
+} from '../api/apps.ts'
+import type { App } from '../types/index.ts'
+import Modal from '../components/Modal.tsx'
+
+export default function Apps() {
+  const nav = useNavigate()
+  const [apps, setApps] = useState<App[]>([])
+  const [loading, setLoading] = useState(true)
+  const [err, setErr] = useState('')
+  const [showCreate, setShowCreate] = useState(false)
+  const [revealedToken, setRevealedToken] = useState<string | null>(null)
+
+  const load = async () => {
+    setLoading(true)
+    try {
+      setApps(await listApps())
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '加载失败')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    load()
+  }, [])
+
+  const onCreate = async (input: AppInput) => {
+    const { app, token } = await createApp(input)
+    setShowCreate(false)
+    setRevealedToken(token)
+    await load()
+    return app
+  }
+
+  const onRotate = async (id: number) => {
+    if (!confirm('轮换后旧 token 立即失效,确定?')) return
+    const { token } = await rotateToken(id)
+    setRevealedToken(token)
+  }
+
+  const onDelete = async (id: number, name: string) => {
+    if (!confirm(`删除应用「${name}」?其下所有 skill、会话将一并删除,且不可恢复。`)) return
+    await deleteApp(id)
+    await load()
+  }
+
+  return (
+    <div>
+      <div className="between" style={{ marginBottom: 16 }}>
+        <h1 style={{ margin: 0 }}>应用</h1>
+        <button className="primary" onClick={() => setShowCreate(true)}>
+          + 新建应用
+        </button>
+      </div>
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 12 }}>{err}</div>}
+      {loading ? (
+        <p className="muted">加载中…</p>
+      ) : apps.length === 0 ? (
+        <p className="muted">还没有应用。点击右上角新建。</p>
+      ) : (
+        <table>
+          <thead>
+            <tr>
+              <th>ID</th>
+              <th>名称</th>
+              <th>Slug</th>
+              <th>状态</th>
+              <th>创建时间</th>
+              <th style={{ width: 1 }}></th>
+            </tr>
+          </thead>
+          <tbody>
+            {apps.map((a) => (
+              <tr key={a.id}>
+                <td>{a.id}</td>
+                <td>
+                  <a onClick={() => nav(`/apps/${a.id}/skills`)} style={{ cursor: 'pointer' }}>
+                    {a.name}
+                  </a>
+                </td>
+                <td className="muted">{a.slug}</td>
+                <td>
+                  <span className={`tag ${a.status === 'active' ? 'ok' : 'danger'}`}>{a.status}</span>
+                </td>
+                <td className="muted">{new Date(a.created_at).toLocaleString()}</td>
+                <td>
+                  <div className="row" style={{ gap: 6 }}>
+                    <button onClick={() => nav(`/apps/${a.id}/skills`)}>技能</button>
+                    <button onClick={() => onRotate(a.id)}>轮换 Token</button>
+                    <button className="danger" onClick={() => onDelete(a.id, a.name)}>
+                      删除
+                    </button>
+                  </div>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+
+      {showCreate && <CreateAppModal onClose={() => setShowCreate(false)} onCreate={onCreate} />}
+
+      {revealedToken && (
+        <Modal title="App 访问 Token(仅此一次)" onClose={() => setRevealedToken(null)}>
+          <p className="muted" style={{ marginTop: 0 }}>
+            请立即保存。关闭后将无法再次查看,只能轮换生成新的。
+          </p>
+          <textarea rows={3} readOnly value={revealedToken} onFocus={(e) => e.currentTarget.select()} />
+          <div className="row" style={{ marginTop: 12 }}>
+            <button
+              onClick={() => {
+                navigator.clipboard.writeText(revealedToken)
+              }}
+            >
+              复制
+            </button>
+            <button className="primary" onClick={() => setRevealedToken(null)}>
+              我已保存
+            </button>
+          </div>
+        </Modal>
+      )}
+    </div>
+  )
+}
+
+function CreateAppModal({
+  onClose,
+  onCreate,
+}: {
+  onClose: () => void
+  onCreate: (input: AppInput) => Promise<App>
+}) {
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [err, setErr] = useState('')
+  const [saving, setSaving] = useState(false)
+
+  const submit = async () => {
+    if (!name.trim()) {
+      setErr('名称必填')
+      return
+    }
+    setSaving(true)
+    setErr('')
+    try {
+      await onCreate({ name, description })
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '创建失败')
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Modal title="新建应用" onClose={onClose}>
+      <div className="field">
+        <label>名称 *</label>
+        <input value={name} onChange={(e) => setName(e.target.value)} autoFocus />
+        <div className="muted" style={{ fontSize: 12, marginTop: 4 }}>
+          slug 将由名称自动生成(中文/特殊字符会回退为随机 slug)
+        </div>
+      </div>
+      <div className="field">
+        <label>描述</label>
+        <textarea rows={2} value={description} onChange={(e) => setDescription(e.target.value)} />
+      </div>
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 10 }}>{err}</div>}
+      <div className="row" style={{ justifyContent: 'flex-end' }}>
+        <button onClick={onClose}>取消</button>
+        <button className="primary" onClick={submit} disabled={saving}>
+          {saving ? '创建中…' : '创建'}
+        </button>
+      </div>
+    </Modal>
+  )
+}
--- a/src/pages/AuditLogs.tsx
+++ b/src/pages/AuditLogs.tsx
@@ -0,0 +1,62 @@
+import { useEffect, useState } from 'react'
+import client from '../api/client.ts'
+import type { AuditLog } from '../types/index.ts'
+
+export default function AuditLogs() {
+  const [logs, setLogs] = useState<AuditLog[]>([])
+  const [loading, setLoading] = useState(true)
+  const [err, setErr] = useState('')
+
+  useEffect(() => {
+    ;(async () => {
+      setLoading(true)
+      try {
+        const { data } = await client.get('/audit-logs?limit=200')
+        setLogs(data)
+      } catch (e: any) {
+        setErr(e?.response?.data?.error || '加载失败')
+      } finally {
+        setLoading(false)
+      }
+    })()
+  }, [])
+
+  return (
+    <div>
+      <h1 style={{ marginTop: 0 }}>审计日志</h1>
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 12 }}>{err}</div>}
+      {loading ? (
+        <p className="muted">加载中…</p>
+      ) : logs.length === 0 ? (
+        <p className="muted">暂无记录。</p>
+      ) : (
+        <table>
+          <thead>
+            <tr>
+              <th>时间</th>
+              <th>操作者</th>
+              <th>动作</th>
+              <th>应用</th>
+              <th>详情</th>
+            </tr>
+          </thead>
+          <tbody>
+            {logs.map((l) => (
+              <tr key={l.id}>
+                <td className="muted">{new Date(l.created_at).toLocaleString()}</td>
+                <td>{l.actor}</td>
+                <td>
+                  <span className="tag">{l.action}</span>
+                </td>
+                <td className="muted">{l.app_id ?? '-'}</td>
+                <td className="muted" style={{ fontFamily: 'monospace', fontSize: 12 }}>
+                  {l.detail ? JSON.stringify(l.detail) : '-'}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </div>
+  )
+}
--- a/src/pages/Dashboard.tsx
+++ b/src/pages/Dashboard.tsx
@@ -0,0 +1,44 @@
+import { useEffect, useState } from 'react'
+import client from '../api/client.ts'
+
+// Overview page: counts of each entity. The admin API has no dedicated
+// /stats endpoint, so we fetch the lists directly (cheap on SQLite).
+export default function Dashboard() {
+  const [stats, setStats] = useState<{ apps: number; models: number; logs: number } | null>(null)
+
+  useEffect(() => {
+    ;(async () => {
+      try {
+        const [apps, models, logs] = await Promise.all([
+          client.get('/apps').then((r) => r.data.length),
+          client.get('/model-configs').then((r) => r.data.length),
+          client.get('/audit-logs?limit=5').then((r) => r.data.length),
+        ])
+        setStats({ apps, models, logs })
+      } catch {
+        setStats(null)
+      }
+    })()
+  }, [])
+
+  const cards = [
+    { label: '应用', value: stats?.apps ?? '—' },
+    { label: '模型配置', value: stats?.models ?? '—' },
+    { label: '近期审计', value: stats?.logs ?? '—' },
+  ]
+  return (
+    <div>
+      <h1 style={{ marginTop: 0 }}>概览</h1>
+      <div style={{ display: 'flex', gap: 16, flexWrap: 'wrap' }}>
+        {cards.map((c) => (
+          <div key={c.label} className="card" style={{ minWidth: 160 }}>
+            <div className="muted" style={{ fontSize: 13 }}>
+              {c.label}
+            </div>
+            <div style={{ fontSize: 32, fontWeight: 700 }}>{c.value}</div>
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}
--- a/src/pages/Login.tsx
+++ b/src/pages/Login.tsx
@@ -0,0 +1,57 @@
+import { useState } from 'react'
+import { useNavigate } from 'react-router-dom'
+import client, { TOKEN_KEY } from '../api/client.ts'
+
+export default function Login() {
+  const nav = useNavigate()
+  const [username, setUsername] = useState('admin')
+  const [password, setPassword] = useState('')
+  const [err, setErr] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  const submit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setErr('')
+    setLoading(true)
+    try {
+      const { data } = await client.post('/login', { username, password })
+      localStorage.setItem(TOKEN_KEY, data.token)
+      nav('/', { replace: true })
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '登录失败')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <div
+      style={{
+        height: '100%',
+        display: 'flex',
+        alignItems: 'center',
+        justifyContent: 'center',
+      }}
+    >
+      <form className="card" style={{ width: 340 }} onSubmit={submit}>
+        <h2 style={{ marginTop: 0 }}>🥕 CarrotAssistant</h2>
+        <div className="field">
+          <label>用户名</label>
+          <input value={username} onChange={(e) => setUsername(e.target.value)} autoFocus />
+        </div>
+        <div className="field">
+          <label>密码</label>
+          <input
+            type="password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </div>
+        {err && <div style={{ color: 'var(--danger)', marginBottom: 10 }}>{err}</div>}
+        <button className="primary" style={{ width: '100%' }} disabled={loading}>
+          {loading ? '登录中…' : '登录'}
+        </button>
+      </form>
+    </div>
+  )
+}
--- a/src/pages/ModelConfigs.tsx
+++ b/src/pages/ModelConfigs.tsx
@@ -0,0 +1,217 @@
+import { useEffect, useState } from 'react'
+import {
+  listModelConfigs,
+  createModelConfig,
+  updateModelConfig,
+  deleteModelConfig,
+  type ModelConfigInput,
+} from '../api/apps.ts'
+import type { ModelConfig } from '../types/index.ts'
+import Modal from '../components/Modal.tsx'
+
+export default function ModelConfigs() {
+  const [list, setList] = useState<ModelConfig[]>([])
+  const [loading, setLoading] = useState(true)
+  const [err, setErr] = useState('')
+  const [editing, setEditing] = useState<ModelConfig | null>(null)
+  const [showForm, setShowForm] = useState(false)
+
+  const load = async () => {
+    setLoading(true)
+    try {
+      setList(await listModelConfigs())
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '加载失败')
+    } finally {
+      setLoading(false)
+    }
+  }
+  useEffect(() => {
+    load()
+  }, [])
+
+  const onDelete = async (id: number, name: string) => {
+    if (!confirm(`删除模型配置「${name}」?`)) return
+    try {
+      await deleteModelConfig(id)
+      await load()
+    } catch (e: any) {
+      alert(e?.response?.data?.error || '删除失败')
+    }
+  }
+
+  return (
+    <div>
+      <div className="between" style={{ marginBottom: 16 }}>
+        <h1 style={{ margin: 0 }}>模型配置</h1>
+        <button
+          className="primary"
+          onClick={() => {
+            setEditing(null)
+            setShowForm(true)
+          }}
+        >
+          + 新建
+        </button>
+      </div>
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 12 }}>{err}</div>}
+      {loading ? (
+        <p className="muted">加载中…</p>
+      ) : list.length === 0 ? (
+        <p className="muted">
+          还没有模型配置。任一 OpenAI 兼容端点(OpenAI / DeepSeek / Moonshot / 本地 vLLM 等)都可添加。
+        </p>
+      ) : (
+        <table>
+          <thead>
+            <tr>
+              <th>名称</th>
+              <th>Base URL</th>
+              <th>默认模型</th>
+              <th>API Key</th>
+              <th>工具调用</th>
+              <th style={{ width: 1 }}></th>
+            </tr>
+          </thead>
+          <tbody>
+            {list.map((m) => (
+              <tr key={m.id}>
+                <td>{m.name}</td>
+                <td className="muted" style={{ fontFamily: 'monospace' }}>
+                  {m.base_url}
+                </td>
+                <td>{m.default_model}</td>
+                <td className="muted">…{m.api_key_preview}</td>
+                <td>
+                  <span className={`tag ${m.supports_tools ? 'ok' : ''}`}>
+                    {m.supports_tools ? '支持' : '不支持'}
+                  </span>
+                </td>
+                <td>
+                  <div className="row" style={{ gap: 6 }}>
+                    <button
+                      onClick={() => {
+                        setEditing(m)
+                        setShowForm(true)
+                      }}
+                    >
+                      编辑
+                    </button>
+                    <button className="danger" onClick={() => onDelete(m.id, m.name)}>
+                      删除
+                    </button>
+                  </div>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+
+      {showForm && (
+        <ModelForm
+          initial={editing}
+          onClose={() => setShowForm(false)}
+          onSaved={async () => {
+            setShowForm(false)
+            await load()
+          }}
+        />
+      )}
+    </div>
+  )
+}
+
+function ModelForm({
+  initial,
+  onClose,
+  onSaved,
+}: {
+  initial: ModelConfig | null
+  onClose: () => void
+  onSaved: () => void
+}) {
+  const [name, setName] = useState(initial?.name || '')
+  const [baseUrl, setBaseUrl] = useState(initial?.base_url || 'https://api.openai.com/v1')
+  const [apiKey, setApiKey] = useState('')
+  const [defaultModel, setDefaultModel] = useState(initial?.default_model || 'gpt-4o')
+  const [supportsTools, setSupportsTools] = useState(initial?.supports_tools ?? true)
+  const [err, setErr] = useState('')
+  const [saving, setSaving] = useState(false)
+
+  const submit = async () => {
+    if (!name.trim() || !baseUrl.trim() || !defaultModel.trim()) {
+      setErr('名称 / Base URL / 默认模型 必填')
+      return
+    }
+    const input: ModelConfigInput = {
+      name,
+      base_url: baseUrl,
+      default_model: defaultModel,
+      supports_tools: supportsTools,
+    }
+    // Only send api_key when the operator typed one. Empty preserves the
+    // existing key on update (backend handles this).
+    if (apiKey.trim() || !initial) {
+      input.api_key = apiKey
+    }
+    setSaving(true)
+    setErr('')
+    try {
+      if (initial) await updateModelConfig(initial.id, input)
+      else await createModelConfig(input)
+      onSaved()
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '保存失败')
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Modal title={initial ? '编辑模型配置' : '新建模型配置'} onClose={onClose}>
+      <div className="field">
+        <label>名称 *</label>
+        <input value={name} onChange={(e) => setName(e.target.value)} autoFocus />
+      </div>
+      <div className="field">
+        <label>Base URL *</label>
+        <input value={baseUrl} onChange={(e) => setBaseUrl(e.target.value)} />
+        <div className="muted" style={{ fontSize: 12, marginTop: 4 }}>
+          OpenAI 兼容端点,如 https://api.openai.com/v1 、https://api.deepseek.com
+        </div>
+      </div>
+      <div className="field">
+        <label>API Key {initial && <span className="muted">(留空则保持不变)</span>}</label>
+        <input
+          type="password"
+          value={apiKey}
+          onChange={(e) => setApiKey(e.target.value)}
+          placeholder={initial ? '••••••' : 'sk-...'}
+        />
+      </div>
+      <div className="field">
+        <label>默认模型 *</label>
+        <input value={defaultModel} onChange={(e) => setDefaultModel(e.target.value)} />
+      </div>
+      <div className="field">
+        <label style={{ display: 'inline' }}>
+          <input
+            type="checkbox"
+            style={{ width: 'auto', marginRight: 8 }}
+            checked={supportsTools}
+            onChange={(e) => setSupportsTools(e.target.checked)}
+          />
+          支持 Function Calling / Tool Use
+        </label>
+      </div>
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 10 }}>{err}</div>}
+      <div className="row" style={{ justifyContent: 'flex-end' }}>
+        <button onClick={onClose}>取消</button>
+        <button className="primary" onClick={submit} disabled={saving}>
+          {saving ? '保存中…' : '保存'}
+        </button>
+      </div>
+    </Modal>
+  )
+}
--- a/src/pages/Skills.tsx
+++ b/src/pages/Skills.tsx
@@ -0,0 +1,265 @@
+import { useEffect, useState } from 'react'
+import { useParams } from 'react-router-dom'
+import {
+  listSkills,
+  generateSkill,
+  deleteSkill,
+  publishSkill,
+  type GenerateInput,
+} from '../api/skills.ts'
+import type { SkillMeta } from '../types/index.ts'
+import Modal from '../components/Modal.tsx'
+import SkillEditor from '../components/SkillEditor.tsx'
+
+export default function Skills() {
+  const { appId } = useParams()
+  const appIdNum = Number(appId)
+  const [skills, setSkills] = useState<SkillMeta[]>([])
+  const [loading, setLoading] = useState(true)
+  const [err, setErr] = useState('')
+  const [showGen, setShowGen] = useState(false)
+  const [editingId, setEditingId] = useState<number | null>(null)
+
+  const load = async () => {
+    setLoading(true)
+    try {
+      setSkills(await listSkills(appIdNum))
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '加载失败')
+    } finally {
+      setLoading(false)
+    }
+  }
+  useEffect(() => {
+    load()
+  }, [appId])
+
+  const onDelete = async (id: number, name: string) => {
+    if (!confirm(`删除 skill「${name}」?`)) return
+    await deleteSkill(id)
+    await load()
+  }
+  const onPublish = async (id: number) => {
+    if (!confirm('发布后将成为该应用当前生效的 skill,旧版本将归档。继续?')) return
+    await publishSkill(id)
+    await load()
+  }
+
+  if (Number.isNaN(appIdNum)) return <p className="muted">无效的应用 ID</p>
+
+  return (
+    <div>
+      <div className="between" style={{ marginBottom: 16 }}>
+        <h1 style={{ margin: 0 }}>技能(Skill) - 应用 #{appId}</h1>
+        <button className="primary" onClick={() => setShowGen(true)}>
+          + 生成 Skill
+        </button>
+      </div>
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 12 }}>{err}</div>}
+      {loading ? (
+        <p className="muted">加载中…</p>
+      ) : skills.length === 0 ? (
+        <p className="muted">还没有 skill。点击右上角导入接口文档或手动创建。</p>
+      ) : (
+        <table>
+          <thead>
+            <tr>
+              <th>ID</th>
+              <th>名称</th>
+              <th>Slug</th>
+              <th>状态</th>
+              <th>来源</th>
+              <th>版本</th>
+              <th>更新时间</th>
+              <th style={{ width: 1 }}></th>
+            </tr>
+          </thead>
+          <tbody>
+            {skills.map((s) => (
+              <tr key={s.id}>
+                <td>{s.id}</td>
+                <td>{s.name}</td>
+                <td className="muted">{s.slug}</td>
+                <td>
+                  <span className={`tag ${statusClass(s.status)}`}>{s.status}</span>
+                </td>
+                <td className="muted">{s.source || '-'}</td>
+                <td>v{s.version}</td>
+                <td className="muted">{new Date(s.updated_at).toLocaleString()}</td>
+                <td>
+                  <div className="row" style={{ gap: 6 }}>
+                    <button onClick={() => setEditingId(s.id)}>编辑/测试</button>
+                    {s.status !== 'published' && (
+                      <button onClick={() => onPublish(s.id)}>发布</button>
+                    )}
+                    <button className="danger" onClick={() => onDelete(s.id, s.name)}>
+                      删除
+                    </button>
+                  </div>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+
+      {showGen && (
+        <GenerateModal
+          appId={appIdNum}
+          onClose={() => setShowGen(false)}
+          onCreated={async (id) => {
+            setShowGen(false)
+            await load()
+            setEditingId(id)
+          }}
+        />
+      )}
+
+      {editingId && <SkillEditor skillId={editingId} onClose={() => setEditingId(null)} />}
+    </div>
+  )
+}
+
+function statusClass(s: string) {
+  if (s === 'published') return 'ok'
+  if (s === 'draft') return 'warn'
+  return ''
+}
+
+function GenerateModal({
+  appId,
+  onClose,
+  onCreated,
+}: {
+  appId: number
+  onClose: () => void
+  onCreated: (id: number) => void
+}) {
+  const [source, setSource] = useState<'openapi' | 'manual'>('openapi')
+  const [openapi, setOpenapi] = useState('')
+  const [baseUrl, setBaseUrl] = useState('')
+  // manual fields
+  const [mName, setMName] = useState('')
+  const [mDesc, setMDesc] = useState('')
+  const [mMethod, setMMethod] = useState('GET')
+  const [mUrl, setMUrl] = useState('')
+  const [mQuery, setMQuery] = useState('keyword')
+  const [err, setErr] = useState('')
+  const [saving, setSaving] = useState(false)
+
+  const submit = async () => {
+    setSaving(true)
+    setErr('')
+    try {
+      const input: GenerateInput = { source_type: source }
+      if (source === 'openapi') {
+        if (!openapi.trim()) throw { response: { data: { error: '请粘贴 OpenAPI 内容' } } }
+        input.openapi = openapi
+        input.base_url = baseUrl
+      } else {
+        if (!mName.trim() || !mUrl.trim())
+          throw { response: { data: { error: '名称和 URL 必填' } } }
+        const queryParams: Record<string, string> = {}
+        mQuery
+          .split(',')
+          .map((s) => s.trim())
+          .filter(Boolean)
+          .forEach((p) => (queryParams[p] = ''))
+        input.manual = {
+          name: mName,
+          description: mDesc,
+          method: mMethod,
+          url: mUrl,
+          query_params: queryParams,
+        }
+      }
+      const d = await generateSkill(appId, input)
+      onCreated(d.id)
+    } catch (e: any) {
+      setErr(e?.response?.data?.error || '生成失败')
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Modal title="生成 Skill" onClose={onClose} width={640}>
+      <div className="field">
+        <label>来源</label>
+        <div className="row" style={{ gap: 16 }}>
+          <label style={{ display: 'inline', margin: 0 }}>
+            <input
+              type="radio"
+              style={{ width: 'auto', marginRight: 6 }}
+              checked={source === 'openapi'}
+              onChange={() => setSource('openapi')}
+            />
+            OpenAPI / Swagger
+          </label>
+          <label style={{ display: 'inline', margin: 0 }}>
+            <input
+              type="radio"
+              style={{ width: 'auto', marginRight: 6 }}
+              checked={source === 'manual'}
+              onChange={() => setSource('manual')}
+            />
+            手动填写单个接口
+          </label>
+        </div>
+      </div>
+
+      {source === 'openapi' ? (
+        <>
+          <div className="field">
+            <label>Base URL(可选,留空则用文档内 servers)</label>
+            <input value={baseUrl} onChange={(e) => setBaseUrl(e.target.value)} placeholder="https://api.example.com" />
+          </div>
+          <div className="field">
+            <label>OpenAPI 文档(JSON 或 YAML)</label>
+            <textarea
+              rows={10}
+              value={openapi}
+              onChange={(e) => setOpenapi(e.target.value)}
+              placeholder={'{\n  "openapi": "3.0.0",\n  "paths": { ... }\n}'}
+            />
+          </div>
+        </>
+      ) : (
+        <>
+          <div className="field">
+            <label>工具名称 *</label>
+            <input value={mName} onChange={(e) => setMName(e.target.value)} placeholder="search_posts" />
+          </div>
+          <div className="field">
+            <label>描述</label>
+            <input value={mDesc} onChange={(e) => setMDesc(e.target.value)} placeholder="按关键词搜索帖子" />
+          </div>
+          <div className="field">
+            <label>HTTP 方法</label>
+            <select value={mMethod} onChange={(e) => setMMethod(e.target.value)}>
+              {['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].map((m) => (
+                <option key={m}>{m}</option>
+              ))}
+            </select>
+          </div>
+          <div className="field">
+            <label>URL *</label>
+            <input value={mUrl} onChange={(e) => setMUrl(e.target.value)} placeholder="https://api.example.com/posts/search" />
+          </div>
+          <div className="field">
+            <label>Query 参数(逗号分隔)</label>
+            <input value={mQuery} onChange={(e) => setMQuery(e.target.value)} placeholder="keyword,limit" />
+          </div>
+        </>
+      )}
+
+      {err && <div style={{ color: 'var(--danger)', marginBottom: 10 }}>{err}</div>}
+      <div className="row" style={{ justifyContent: 'flex-end' }}>
+        <button onClick={onClose}>取消</button>
+        <button className="primary" onClick={submit} disabled={saving}>
+          {saving ? '生成中…' : '生成'}
+        </button>
+      </div>
+    </Modal>
+  )
+}
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -0,0 +1,83 @@
+// Shared API response types. These mirror the GORM model JSON tags on the
+// backend; only fields the UI actually consumes are listed.
+
+export interface App {
+  id: number
+  slug: string
+  name: string
+  description: string
+  model_config_id?: number | null
+  status: string
+  created_at: string
+  updated_at: string
+}
+
+export interface AppCreateResponse {
+  app: App
+  token: string // plaintext, returned once
+}
+
+export interface ModelConfig {
+  id: number
+  name: string
+  base_url: string
+  api_key_preview: string
+  default_model: string
+  supports_tools: boolean
+  max_tokens: number
+  created_at: string
+  updated_at: string
+}
+
+export interface SkillMeta {
+  id: number
+  app_id: number
+  slug: string
+  name: string
+  description: string
+  version: number
+  status: 'draft' | 'published' | 'archived'
+  source: string
+  published_at?: string | null
+  created_at: string
+  updated_at: string
+}
+
+export interface SkillContent {
+  name: string
+  description: string
+  version: number
+  app_slug: string
+  model_config?: string
+  permissions: {
+    default_mode: string
+    require_confirmation: string[]
+    allow_write: string[]
+  }
+  tools: ToolDef[]
+  system_prompt: string
+}
+
+export interface ToolDef {
+  name: string
+  description: string
+  parameters: Record<string, unknown> // JSON Schema
+  endpoint: {
+    method: string
+    url: string
+    path?: Record<string, string>
+    query?: Record<string, string>
+    header?: Record<string, string>
+    body?: string
+  }
+}
+
+export interface AuditLog {
+  id: number
+  app_id?: number | null
+  session_id?: string | null
+  actor: string
+  action: string
+  detail?: Record<string, unknown> | null
+  created_at: string
+}
--- a/tsconfig.app.json
+++ b/tsconfig.app.json
@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "es2023",
+    "lib": ["ES2023", "DOM"],
+    "module": "esnext",
+    "types": ["vite/client"],
+    "allowArbitraryExtensions": true,
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src"]
+}
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ]
+}
--- a/tsconfig.node.json
+++ b/tsconfig.node.json
@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "es2023",
+    "lib": ["ES2023"],
+    "types": ["node"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "module": "nodenext",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    /* Linting */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["vite.config.ts"]
+}
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -0,0 +1,20 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+// The admin SPA talks to two backend route groups:
+//   /admin/*  — operator console APIs (login, apps, skills, ...)
+//   /api/*    — end-user Chat API (used by the skill test panel)
+// During local dev both are proxied to the Go server on :8080. In the
+// docker-compose deployment nginx serves the built assets and proxies the
+// same prefixes to the backend container.
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    port: 5173,
+    proxy: {
+      '/admin': { target: 'http://localhost:8080', changeOrigin: true },
+      '/api': { target: 'http://localhost:8080', changeOrigin: true },
+      '/healthz': { target: 'http://localhost:8080', changeOrigin: true },
+    },
+  },
+})