update

.env.example

@@ -43,12 +43,17 @@ RATE_LIMIT_MAX=5
 RATE_LIMIT_WINDOW_MIN=10
 
 # --- drivers ---
-# Priority (global): ollama -> mistral -> puppeteer-openai(stub) -> deepseek -> anthropic -> openai
+# Priority (global): ollama -> mistral -> glm -> puppeteer-openai(stub) -> deepseek -> anthropic -> openai
 OLLAMA_HOST=http://10.66.66.4:11434
 OLLAMA_ENABLED=true
 # Stubs below: leave empty to keep disabled. Implemented last per spec.
 MISTRAL_API_KEY=
 MISTRAL_ENABLED=false
+# GLM (Zhipu AI, OpenAI-compatible). Key from https://z.ai ; mainland China
+# users point GLM_BASE_URL at https://open.bigmodel.cn/api/paas/v4 instead.
+GLM_API_KEY=
+GLM_ENABLED=false
+# GLM_BASE_URL=https://api.z.ai/api/paas/v4
 DEEPSEEK_API_KEY=
 DEEPSEEK_ENABLED=false
 ANTHROPIC_API_KEY=

README.md

@@ -9,8 +9,8 @@ accounts, server-side chats and public shares. No cookies — Bearer keys in
 Driver priority:
 
 ```
-1. ollama → 2. mistral API → 3. puppeteer-openai (stub, not implemented)
-→ 4. deepseek → 5. anthropic → 6. openai
+1. ollama → 2. mistral API → 3. glm API → 4. puppeteer-openai (stub, not implemented)
+→ 5. deepseek → 6. anthropic → 7. openai
 ```
 
 Docs: [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) (backend, drivers, DB) ·
@@ -51,12 +51,14 @@ from the **Accounts** panel (each gets a one-time access key to hand over).
 | Method | Route | Auth | Notes |
 |---|---|---|---|
 | POST | `/api/auth/login` | rate-limited (5/10min/IP) | `{username, key}` → `{token, expiresAt, user}` |
+| POST | `/api/auth/register` | public, rate-limited | self-registration (403 when disabled by admin) → `{user, key}` |
 | GET | `/api/auth/verify` | Bearer | → `{ok, user}` |
 | POST | `/api/auth/logout` | Bearer | revokes token |
 | GET/PATCH | `/api/me` | Bearer | profile: displayName, avatarUrl, theme |
 | GET/POST | `/api/admin/users` | admin | create returns `{user, key}` (key shown once) |
 | PATCH/DELETE | `/api/admin/users/:id` | admin | edit profile / delete + cascade |
 | POST | `/api/admin/users/:id/regenerate` | admin | new key, old sessions revoked |
+| GET/PATCH | `/api/admin/settings` | admin | feature flags: registrationEnabled, ocrEnabled |
 | GET/POST | `/api/conversations` | Bearer | server-persisted chats (title, topic, model) |
 | GET/PATCH/DELETE | `/api/conversations/:id` | owner | incl. messages on GET |
 | POST/GET/DELETE | `/api/conversations/:id/share` | owner | public link `/share/:publicId` |
@@ -70,8 +72,9 @@ reply into that conversation (ownership enforced) and auto-titles new chats.
 ## Database (SQLite, Bun native)
 
 `$DATA_DIR/kisassistant.db` (WAL mode). Tables: `users` (id, username,
-display_name, avatar_url, theme, key_hash), `sessions` (hashed Bearer tokens),
-`conversations` (id, user, title, topic, model), `messages`, `shares`
+display_name, avatar_url, theme, email, key_hash), `sessions` (hashed Bearer tokens),
+`conversations` (id, user, title, topic, model), `messages`, `shares`,
+`resets` (recovery tokens), `settings` (feature flags)
 (conv ↔ public id). No migration system — schema is created idempotently at boot.
 
 ## Drivers (backend layout)

anoying_promt

@@ -9,3 +9,21 @@ or something original but in the actual theme and Adapative to phone
 make a better settings overview,with larger modal in screen . with categories, section for searching
 
 --- UPLOAD URL FOR PFP MUST BE A READ ONLY IN USER . NOW CAUSE OF THE OWN CDN. USER SHOULDNT SEE THAT VALUE /EDIT IT ANYMORe.
+
+--- UPDATE ABOUT REGISTRATION
+
+Another feature for rehistration.:
+A WishList. Like you reserv username, mail (needed)
+in AdminCenter, a specific category for wish access : accepting/refusing/review a request.
+Can refusing with a reason / accepting with reason / reviewing :
+    - make a /review page
+        the user want to being granted access can arguing about why him
+            - admin can see messages, responding, like a minimal ticket syste,
+            and so accepting reusing.
+    - the user is who want to earn access receive emails about the current status of the situation
+        Refusing -with reasons etc
+        Accepting - with/without reasons etc
+        mail or reviewing
+            each new message in the conversations makes a new mail forwarded by (like real ticket)
+                precise that theses mail arent the official way and need to be responded into the official site (chat.kisakay.com/review)
+        makes beautiful simple easy - by design HTML for each type of mail

docs/ARCHITECTURE.md

@@ -46,6 +46,7 @@ Created idempotently at boot in `getDb()` (no migration framework; keep it so).
 | `users` | `id, username UNIQUE, display_name, avatar_url, theme, email, key_hash, created_at`. The `admin` row is bootstrapped (its `key_hash` is unused — admin auth goes through `APP_PASSWORD`). |
 | `sessions` | `token_hash PK, user_id, created_at, expires_at`. Bearer tokens, 256-bit, hashed with sha256. Expired rows are purged lazily on access. |
 | `resets` | `token_hash PK, user_id, created_at, expires_at`. One-time key-recovery tokens (single use, consumed on POST). |
+| `settings` | `key PK, value, updated_at`. Admin-controlled feature flags (`registration_enabled` default off, `tools_ocr_enabled` default on). |
 | `conversations` | `id, user_id, title, topic, model, created_at, updated_at`. |
 | `messages` | `id AUTOINCREMENT, conv_id → conversations ON DELETE CASCADE, role, content, created_at`. |
 | `shares` | `conv_id PK → conversations ON DELETE CASCADE, public_id UNIQUE, created_at`. |
@@ -58,6 +59,10 @@ conversations → sessions → user) inside a transaction.
 - `POST /api/auth/login { username, key }`, sliding-window rate limit per IP
   (`RATE_LIMIT_MAX` / `RATE_LIMIT_WINDOW_MIN`, default 5 per 10 min) + 400 ms
   delay on failure. Success clears the IP counter and issues a fresh token.
+- `POST /api/auth/register { username, displayName?, email? }` — public
+  self-registration, guarded by the `registration_enabled` setting (403 when
+  off), same rate limit and validation as admin creation. Returns `{user, key}`
+  with the key shown once.
 - `admin` is authenticated against `APP_PASSWORD` (timing-safe); users against
   their `ka_…` access key (timing-safe against the stored hash).
 - Keys are generated with `crypto.randomBytes` (`ka_` + 24 bytes base64url) and
@@ -93,7 +98,7 @@ only ever sees reviewed text blocks, never raw files.
 
 ## Drivers`src/drivers/`: `LLMDriver` interface (`listModels`, `chat`, `chatStream`),
 `DriverRegistry` with global priority
-`ollama → mistral → puppeteer-openai (stub) → deepseek → anthropic → openai`.
+`ollama → mistral → glm → puppeteer-openai (stub) → deepseek → anthropic → openai`.
 Models are addressed as `"driver:model"` (split on the first `:`).
 
 - `OllamaDriver`: model discovery via `GET {OLLAMA_HOST}/api/tags`, chat via

docs/FRONTEND.md

@@ -43,7 +43,12 @@ read-only `SharePage` (no auth), everything else renders the authenticated app.
   copy, unshare), `SettingsModal` (display name, avatar upload box with
   drag & drop, avatar URL, theme).
 - `AdminPanel.tsx` — No-KYC account management: create (key shown once),
-  regenerate (revokes sessions), edit, delete with confirm.
+  regenerate (revokes sessions), edit, delete with confirm. Renders bare
+  (no modal shell) when embedded in the Admin Center page.
+- `AdminCenter.tsx` — `/admin` route (admin gate + locked screen otherwise):
+  tabbed hub (Accounts / Features / Mail) reusing `AdminPanel`, server
+  feature `Switch`es (`registrationEnabled`, `ocrEnabled` via
+  `/api/admin/settings`), SMTP status card. Follows the platform theme.
 - `SharePage.tsx` — public read-only view, fetches `/api/share/:id` unauthenticated.
 - `Markdown.tsx` — `react-markdown` + GFM; code blocks get a language label and
   a copy button.

docs/OPERATIONS.md

@@ -24,7 +24,8 @@ Copy `.env.example` to `.env`. Full list:
 | `RESET_TTL_MIN` | `60` | reset-link lifetime (single use) |
 | `RATE_LIMIT_MAX` / `RATE_LIMIT_WINDOW_MIN` | `5` / `10` | login rate limit per IP |
 | `OLLAMA_HOST` / `OLLAMA_ENABLED` | `http://10.66.66.4:11434` / `true` | local-model driver |
-| `MISTRAL_*`, `DEEPSEEK_*`, `ANTHROPIC_*`, `OPENAI_*` | disabled | API drivers: set `*_ENABLED=true` **and** `*_API_KEY` |
+| `MISTRAL_*`, `GLM_*`, `DEEPSEEK_*`, `ANTHROPIC_*`, `OPENAI_*` | disabled | API drivers: set `*_ENABLED=true` **and** `*_API_KEY` |
+| `GLM_BASE_URL` | `https://api.z.ai/api/paas/v4` | Zhipu platform override (mainland China: `https://open.bigmodel.cn/api/paas/v4`) |
 
 ## Local development
 
@@ -51,6 +52,21 @@ unshare. See `AGENTS.md`.
 5. Rotate a compromised key with the regenerate button (old sessions die);
    delete removes the account with all its chats and shares.
 
+## Admin Center (`/admin`) & self-registration
+
+The sidebar **Admin Center** button (admin only) opens the `/admin` page with
+three tabs: **Accounts** (same manager as before, incl. the Ollama model
+catalog), **Features** (server-side switches), **Mail** (SMTP status).
+
+- `registration_enabled` (default off): when on, the login page shows a
+  working **Register** button — anyone can create an account (key shown once)
+  via `POST /api/auth/register`. When off, the button is greyed with the
+  tooltip *"Registration currently disabled on this platform"* and the
+  endpoint answers 403. Flipped live, no restart.
+- `tools_ocr_enabled` (default on): admin kill-switch for the OCR tool.
+- Flags live in the `settings` SQLite table, edited via
+  `GET/PATCH /api/admin/settings` (admin Bearer only).
+
 ## Key recovery via email (optional)
 
 Set the `SMTP_*` vars (and the real public `APP_URL`) to enable it; otherwise

frontend/src/App.tsx

@@ -6,7 +6,7 @@ import { Login } from "./components/Login.tsx";
 import { Sidebar } from "./components/Sidebar.tsx";
 import { Chat } from "./components/Chat.tsx";
 import { ConvEditDialog, FilePreviewModal, SettingsModal, ShareModal } from "./components/dialogs.tsx";
-import { AdminPanel } from "./components/AdminPanel.tsx";
+import { AdminCenter } from "./components/AdminCenter.tsx";
 import { SharePage } from "./components/SharePage.tsx";
 import { ResetPage } from "./components/ResetPage.tsx";
 import { ConfirmDialog } from "./components/ui.tsx";
@@ -19,6 +19,7 @@ function shareIdFromPath(): string | null {
 // Module-level: the path never changes without a full reload, so hook order stays stable.
 const SHARE_ID = typeof window !== "undefined" ? shareIdFromPath() : null;
 const RESET_TOKEN = typeof window !== "undefined" ? resetTokenFromPath() : null;
+const IS_ADMIN_PAGE = typeof window !== "undefined" && /^\/admin\/?$/.test(window.location.pathname);
 
 function resetTokenFromPath(): string | null {
   const m = window.location.pathname.match(/^\/reset\/([A-Za-z0-9_-]{6,80})\/?$/);
@@ -35,7 +36,7 @@ function applyTheme(theme: string) {
 
 export function App() {
   const [user, setUser] = useState<User | null>(null);
-  const [checking, setChecking] = useState(!SHARE_ID && !RESET_TOKEN && !!getToken());
+  const [checking, setChecking] = useState(!SHARE_ID && !RESET_TOKEN && !IS_ADMIN_PAGE && !!getToken());
   const [models, setModels] = useState<DriverModel[]>([]);
   const [model, setModel] = useState("");
   const [convs, setConvs] = useState<Conversation[]>([]);
@@ -49,7 +50,6 @@ export function App() {
   const [shareConv, setShareConv] = useState<Conversation | null>(null);
   const [deleteConv, setDeleteConv] = useState<Conversation | null>(null);
   const [settingsOpen, setSettingsOpen] = useState(false);
-  const [adminOpen, setAdminOpen] = useState(false);
   const [attachments, setAttachments] = useState<Attachment[]>([]);
   const [attachError, setAttachError] = useState<string | null>(null);
   const [filePreview, setFilePreview] = useState<FilePreview | null>(null);
@@ -57,6 +57,9 @@ export function App() {
   const [ocrAvailable, setOcrAvailable] = useState(false);
 
   // Public routes: no auth needed. IDs are constant for the page lifetime.
+  if (IS_ADMIN_PAGE) {
+    return <AdminCenter />;
+  }
   if (RESET_TOKEN) {
     return <ResetPage token={RESET_TOKEN} />;
   }
@@ -277,7 +280,7 @@ export function App() {
         onShare={setShareConv}
         onDelete={setDeleteConv}
         onOpenSettings={() => { setSettingsOpen(true); setMobileNav(false); }}
-        onOpenAdmin={() => { setAdminOpen(true); setMobileNav(false); }}
+        onOpenAdmin={() => { window.location.href = "/admin"; }}
         onLogout={logout}
         mobileOpen={mobileNav}
         onCloseMobile={() => setMobileNav(false)}
@@ -332,7 +335,6 @@ export function App() {
           applyTheme(u.theme);
         }}
       />
-      <AdminPanel open={adminOpen} onClose={() => setAdminOpen(false)} />
     </div>
   );
 }

frontend/src/components/AdminCenter.tsx

@@ -0,0 +1,168 @@
+import { useEffect, useState } from "react";
+import { ArrowLeft, LayoutDashboard, Mail, ShieldAlert, SlidersHorizontal, Users } from "lucide-react";
+import { api } from "../lib/api.ts";
+import { AdminPanel } from "./AdminPanel.tsx";
+import { Logo, Spinner, Switch } from "./ui.tsx";
+import { cn } from "../lib/cn.ts";
+
+type Tab = "accounts" | "features" | "mail";
+
+function applyTheme(theme: string) {
+  const root = document.documentElement;
+  const dark = theme === "dark" || (theme !== "light" && window.matchMedia("(prefers-color-scheme: dark)").matches);
+  root.classList.toggle("dark", dark);
+  root.style.colorScheme = dark ? "dark" : "light";
+}
+
+const TABS: { id: Tab; label: string; icon: typeof Users }[] = [
+  { id: "accounts", label: "Accounts", icon: Users },
+  { id: "features", label: "Features", icon: SlidersHorizontal },
+  { id: "mail", label: "Mail", icon: Mail },
+];
+
+export function AdminCenter() {
+  const [allowed, setAllowed] = useState<boolean | null>(null);
+  const [tab, setTab] = useState<Tab>("accounts");
+  const [settings, setSettings] = useState<{ registrationEnabled: boolean; ocrEnabled: boolean } | null>(null);
+  const [mail, setMail] = useState<{ recovery: boolean; from?: string } | null>(null);
+  const [error, setError] = useState("");
+  const [saving, setSaving] = useState(false);
+
+  useEffect(() => {
+    api.verify()
+      .then((r) => {
+        if (!r.user.isAdmin) {
+          setAllowed(false);
+          return;
+        }
+        setAllowed(true);
+        applyTheme(r.user.theme);
+        api.adminGetSettings().then((s) => setSettings(s.settings)).catch((e) => setError(e instanceof Error ? e.message : "Load failed"));
+        api.methods().then((m) => setMail(m)).catch(() => {});
+      })
+      .catch(() => setAllowed(false));
+  }, []);
+
+  async function toggle(patch: { registrationEnabled?: boolean; ocrEnabled?: boolean }) {
+    setSaving(true);
+    setError("");
+    try {
+      const res = await api.adminPatchSettings(patch);
+      setSettings(res.settings);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "Save failed");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  if (allowed === null) {
+    return <div className="grid min-h-full place-items-center text-sm opacity-60"><Spinner /> Checking admin access…</div>;
+  }
+
+  if (!allowed) {
+    return (
+      <div className="grid min-h-full place-items-center p-6">
+        <div className="w-full max-w-sm rounded-[2rem] border border-stone-200 bg-white p-8 text-center shadow-xl dark:border-zinc-800 dark:bg-zinc-900">
+          <ShieldAlert size={28} className="mx-auto mb-3 text-red-500" />
+          <h1 className="text-lg font-bold">Admins only</h1>
+          <p className="mt-1 text-sm opacity-60">Log in with the admin account to open the Admin Center.</p>
+          <a href="/" className="mt-4 inline-block rounded-full bg-accent-600 px-5 py-2.5 text-sm font-medium text-white dark:bg-accent-500 dark:text-zinc-950">Back to login</a>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-full">
+      <header className="border-b border-stone-200/70 bg-white/70 backdrop-blur dark:border-zinc-800 dark:bg-zinc-900/70">
+        <div className="mx-auto flex w-full max-w-4xl items-center gap-3 px-4 py-3">
+          <a href="/" aria-label="Back to chat" className="rounded-full p-2 transition hover:bg-stone-200/60 dark:hover:bg-zinc-800">
+            <ArrowLeft size={18} />
+          </a>
+          <Logo size={32} className="rounded-xl" />
+          <h1 className="flex items-center gap-2 text-lg font-bold tracking-tight">
+            <LayoutDashboard size={18} className="text-accent-600 dark:text-accent-400" />
+            Admin Center
+          </h1>
+        </div>
+        <div className="mx-auto w-full max-w-4xl px-4 pb-3">
+          <div className="flex gap-1 overflow-x-auto rounded-full border border-stone-200/70 bg-stone-100/70 p-1 dark:border-zinc-800 dark:bg-zinc-900">
+            {TABS.map((t) => (
+              <button
+                key={t.id}
+                onClick={() => setTab(t.id)}
+                className={cn(
+                  "flex flex-1 items-center justify-center gap-2 whitespace-nowrap rounded-full px-4 py-2 text-sm font-medium transition",
+                  tab === t.id
+                    ? "bg-white text-stone-900 shadow dark:bg-zinc-800 dark:text-zinc-100"
+                    : "opacity-60 hover:opacity-100",
+                )}
+              >
+                <t.icon size={15} />
+                {t.label}
+              </button>
+            ))}
+          </div>
+        </div>
+      </header>
+
+      <main className="mx-auto w-full max-w-4xl space-y-4 px-4 py-6">
+        {error && <p className="rounded-2xl bg-red-500/10 px-4 py-2.5 text-sm text-red-600 dark:text-red-400" role="alert">{error}</p>}
+
+        {tab === "accounts" && (
+          <section className="rounded-3xl border border-stone-200/70 bg-white p-5 shadow-sm dark:border-zinc-800 dark:bg-zinc-900">
+            <AdminPanel open bare onClose={() => {}} />
+          </section>
+        )}
+
+        {tab === "features" && (
+          <section className="space-y-3">
+            <div className="flex items-center gap-4 rounded-3xl border border-stone-200/70 bg-white p-5 shadow-sm dark:border-zinc-800 dark:bg-zinc-900">
+              <div className="min-w-0 flex-1">
+                <p className="text-sm font-medium">Public registration</p>
+                <p className="text-sm opacity-60">Show the Register button on the login page. Off = admin-created accounts only.</p>
+              </div>
+              <Switch label="Public registration" checked={settings?.registrationEnabled ?? false} onChange={(v) => toggle({ registrationEnabled: v })} />
+            </div>
+            <div className="flex items-center gap-4 rounded-3xl border border-stone-200/70 bg-white p-5 shadow-sm dark:border-zinc-800 dark:bg-zinc-900">
+              <div className="min-w-0 flex-1">
+                <p className="text-sm font-medium">OCR tool</p>
+                <p className="text-sm opacity-60">Server-side image transcription for attachments. Requires the tesseract binary.</p>
+              </div>
+              <Switch label="OCR tool" checked={settings?.ocrEnabled ?? false} onChange={(v) => toggle({ ocrEnabled: v })} />
+            </div>
+            {saving && <p className="flex items-center gap-2 text-sm opacity-60"><Spinner size={14} /> Saving…</p>}
+            {!settings && !error && <p className="flex items-center gap-2 text-sm opacity-60"><Spinner size={14} /> Loading…</p>}
+          </section>
+        )}
+
+        {tab === "mail" && (
+          <section className="rounded-3xl border border-stone-200/70 bg-white p-5 shadow-sm dark:border-zinc-800 dark:bg-zinc-900">
+            <div className="flex items-center gap-3">
+              <span className="grid h-10 w-10 place-items-center rounded-full bg-accent-600/10 text-accent-600 dark:text-accent-400">
+                <Mail size={17} />
+              </span>
+              <div>
+                <p className="text-sm font-medium">Key recovery emails</p>
+                <p className="text-sm opacity-60">
+                  {mail == null ? "Checking…" : mail.recovery ? `Enabled — sent from ${mail.from ?? "the configured sender"}` : "Disabled — set SMTP_HOST on the server to enable"}
+                </p>
+              </div>
+              <span className={cn(
+                "ml-auto rounded-full px-3 py-1 text-xs font-medium",
+                mail?.recovery ? "bg-emerald-600/10 text-emerald-700 dark:text-emerald-400" : "bg-stone-200/70 dark:bg-zinc-800",
+              )}>
+                {mail?.recovery ? "On" : "Off"}
+              </span>
+            </div>
+            <p className="mt-3 text-sm opacity-60">
+              SMTP credentials live in the server environment (see <code>docs/OPERATIONS.md</code>), never in this UI.
+              Users set their recovery address in profile settings or at account creation.
+            </p>
+          </section>
+        )}
+      </main>
+    </div>
+  );
+}

frontend/src/components/AdminPanel.tsx

@@ -1,10 +1,184 @@
-import { useEffect, useState } from "react";
-import { KeyRound, Pencil, RefreshCw, Trash2, UserPlus, Users } from "lucide-react";
+import { useEffect, useState, type FC, type ReactNode } from "react";
+import { Bot, Download, HardDrive, KeyRound, Pencil, RefreshCw, Trash2, UserPlus, Users } from "lucide-react";
 import { api } from "../lib/api.ts";
-import type { User } from "../lib/types.ts";
+import type { DriverModel, User } from "../lib/types.ts";
 import { Avatar, Button, ConfirmDialog, CopyButton, Field, Input, Modal, Picker, Spinner } from "./ui.tsx";
 
-export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => void }) {
+/** Curated Ollama library catalog (admin downloads only). */
+const OLLAMA_CATALOG: { name: string; desc: string; sizes: string[] }[] = [
+  { name: "llama3.2", desc: "Meta's compact everyday model", sizes: ["1b", "3b"] },
+  { name: "llama3.1", desc: "Meta's general-purpose workhorse", sizes: ["8b", "70b"] },
+  { name: "qwen2.5", desc: "Alibaba's multilingual all-rounder", sizes: ["0.5b", "1.5b", "7b", "14b", "32b"] },
+  { name: "gemma2", desc: "Google's efficient open model", sizes: ["2b", "9b", "27b"] },
+  { name: "mistral", desc: "Mistral 7B — fast and capable", sizes: ["7b"] },
+  { name: "phi3", desc: "Microsoft's small research model", sizes: ["3.8b", "14b"] },
+  { name: "deepseek-r1", desc: "Reasoning model (chain-of-thought)", sizes: ["1.5b", "7b", "8b", "14b", "32b"] },
+  { name: "codellama", desc: "Code completion and chat", sizes: ["7b", "13b", "34b"] },
+  { name: "llava", desc: "Vision model (image understanding)", sizes: ["7b", "13b", "34b"] },
+  { name: "nomic-embed-text", desc: "Text embeddings", sizes: [] },
+];
+
+/* ---------- Ollama model catalog (admin) ---------- */
+
+export function OllamaModelsModal({ open, onClose }: { open: boolean; onClose: () => void }) {
+  const [installed, setInstalled] = useState<DriverModel[]>([]);
+  const [pullName, setPullName] = useState("");
+  const [pullStatus, setPullStatus] = useState("");
+  const [pullPct, setPullPct] = useState<number | null>(null);
+  const [pulling, setPulling] = useState(false);
+  const [error, setError] = useState("");
+  const [deleteModel, setDeleteModel] = useState<string | null>(null);
+  const [sizeOverrides, setSizeOverrides] = useState<Record<string, string>>({});
+
+  async function refreshInstalled() {
+    try {
+      const res = await api.models();
+      setInstalled(res.models.filter((m) => m.driver === "ollama"));
+    } catch { /* ignore */ }
+  }
+
+  useEffect(() => {
+    if (open) {
+      setError("");
+      setPullStatus("");
+      setPullPct(null);
+      setPulling(false);
+      refreshInstalled();
+    }
+  }, [open]);
+
+  async function pull(fullName: string) {
+    if (pulling || !fullName.trim()) return;
+    setPulling(true);
+    setError("");
+    setPullStatus("Contacting Ollama…");
+    setPullPct(null);
+    try {
+      await api.ollamaPull(fullName.trim(), (p) => {
+        if (p.error) { setError(p.error); return; }
+        setPullStatus(p.status || "Pulling…");
+        if (p.total && p.completed) setPullPct(Math.min(100, Math.round((p.completed / p.total) * 100)));
+        else setPullPct(null);
+      });
+      setPullStatus("Done");
+      setPullPct(100);
+      await refreshInstalled();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Pull failed");
+    } finally {
+      setPulling(false);
+    }
+  }
+
+  async function removeModel(name: string) {
+    try {
+      await api.ollamaDelete(name);
+      await refreshInstalled();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Delete failed");
+    }
+  }
+
+  return (
+    <>
+      <Modal open={open} onClose={pulling ? () => {} : onClose} title="Ollama models" icon={Bot}>
+        <p className="mb-4 text-sm opacity-70">
+          Download models from the Ollama library to your Ollama host, or remove local ones. Admin only.
+        </p>
+        {error && <p className="mb-3 rounded-2xl bg-red-50 px-4 py-2.5 text-sm text-red-600 dark:bg-red-950/40 dark:text-red-400" role="alert">{error}</p>}
+
+        {pulling && (
+          <div className="mb-4 rounded-2xl border border-accent-500/40 bg-accent-50 p-4 dark:bg-accent-950/30">
+            <p className="mb-2 flex items-center gap-2 text-sm font-medium">
+              <Download size={15} className="animate-bounce" />
+              Pulling {pullName}
+            </p>
+            <p className="mb-2 truncate text-xs opacity-70">{pullStatus}</p>
+            {pullPct !== null && (
+              <div className="h-2 overflow-hidden rounded-full bg-stone-200 dark:bg-zinc-800">
+                <div className="h-full rounded-full bg-accent-600 transition-all dark:bg-accent-500" style={{ width: `${pullPct}%` }} />
+              </div>
+            )}
+          </div>
+        )}
+
+        <div className="mb-4 flex flex-wrap items-end gap-2 rounded-2xl border border-stone-200 p-3 dark:border-zinc-700">
+          <div className="min-w-52 flex-1">
+            <Field label="Custom model tag" hint="e.g. llama3.2:3b, or a full library name">
+              <Input
+                value={pullName}
+                onChange={(e) => setPullName(e.target.value)}
+                placeholder="llama3.2:3b"
+                disabled={pulling}
+                onKeyDown={(e) => e.key === "Enter" && pull(pullName)}
+              />
+            </Field>
+          </div>
+          <Button size="sm" onClick={() => pull(pullName)} disabled={pulling || !pullName.trim()}>
+            {pulling ? <Spinner size={15} /> : <Download size={15} />} Pull
+          </Button>
+        </div>
+
+        <p className="mb-2 flex items-center gap-1.5 text-sm font-medium"><HardDrive size={14} /> Installed ({installed.length})</p>
+        <ul className="mb-5 space-y-1.5">
+          {installed.length === 0 && <li className="text-sm opacity-50">No local Ollama models yet.</li>}
+          {installed.map((m) => (
+            <li key={m.id} className="flex items-center gap-3 rounded-2xl border border-stone-200/70 px-3.5 py-2 dark:border-zinc-800">
+              <span className="min-w-0 flex-1 truncate text-sm font-medium">{m.label || m.id}</span>
+              <button
+                title={`Delete ${m.label || m.id}`}
+                onClick={() => setDeleteModel(m.label || m.id)}
+                className="rounded-full p-2 text-red-600 transition hover:bg-red-50 dark:text-red-400 dark:hover:bg-red-950/40"
+              >
+                <Trash2 size={15} />
+              </button>
+            </li>
+          ))}
+        </ul>
+
+        <p className="mb-2 flex items-center gap-1.5 text-sm font-medium"><Download size={14} /> Catalog</p>
+        <ul className="space-y-1.5">
+          {OLLAMA_CATALOG.map((m) => {
+            const size = sizeOverrides[m.name] ?? (m.sizes.length > 0 ? m.sizes[0]! : "");
+            const tag = size ? `${m.name}:${size}` : m.name;
+            return (
+              <li key={m.name} className="flex flex-wrap items-center gap-2 rounded-2xl border border-stone-200/70 px-3.5 py-2 dark:border-zinc-800">
+                <span className="min-w-0 flex-1">
+                  <span className="block truncate text-sm font-medium">{m.name}</span>
+                  <span className="block text-xs opacity-50">{m.desc}</span>
+                </span>
+                {m.sizes.length > 0 && (
+                  <span className="w-24 shrink-0">
+                    <Picker
+                      ariaLabel={`${m.name} size`}
+                      value={size}
+                      onChange={(v) => setSizeOverrides((prev) => ({ ...prev, [m.name]: v }))}
+                      align="right"
+                      options={m.sizes.map((s) => ({ value: s, label: s }))}
+                    />
+                  </span>
+                )}
+                <Button size="sm" variant="secondary" onClick={() => { setPullName(tag); pull(tag); }} disabled={pulling}>
+                  <Download size={14} /> Pull
+                </Button>
+              </li>
+            );
+          })}
+        </ul>
+      </Modal>
+
+      <ConfirmDialog
+        open={deleteModel !== null}
+        onClose={() => setDeleteModel(null)}
+        title={`Delete ${deleteModel}?`}
+        message="The model is removed from the Ollama host. Pull it again anytime."
+        onConfirm={() => deleteModel && removeModel(deleteModel)}
+      />
+    </>
+  );
+}
+
+export function AdminPanel({ open, onClose, bare }: { open: boolean; onClose: () => void; bare?: boolean }) {
   const [users, setUsers] = useState<User[]>([]);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
@@ -12,6 +186,7 @@ export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => vo
   const [freshKey, setFreshKey] = useState<{ username: string; key: string } | null>(null);
   const [deleteTarget, setDeleteTarget] = useState<User | null>(null);
   const [editTarget, setEditTarget] = useState<User | null>(null);
+  const [modelsOpen, setModelsOpen] = useState(false);
 
   // create form
   const [username, setUsername] = useState("");
@@ -32,13 +207,13 @@ export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => vo
   }
 
   useEffect(() => {
-    if (open) {
+    if (open || bare) {
       refresh();
       setShowCreate(false);
       setFreshKey(null);
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [open ]);
+  }, [open, bare ]);
 
   async function create(e: React.FormEvent) {
     e.preventDefault();
@@ -75,9 +250,15 @@ export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => vo
     }
   }
 
+  // Bare mode embeds the same manager in the /admin Center page instead
+  // of a modal — no logic duplicated.
+  const Shell: FC<{ children: ReactNode }> = bare
+    ? ({ children }) => <div className="min-w-0 flex-1 space-y-1">{children}</div>
+    : ({ children }) => <Modal open={open} onClose={onClose} title="Accounts" icon={Users} wide>{children}</Modal>;
+
   return (
     <>
-      <Modal open={open} onClose={onClose} title="Accounts" icon={Users} wide>
+      <Shell>
         <p className="mb-4 text-sm opacity-70">
           No-KYC accounts: you create a username, hand the access key to its owner once. Keys are stored hashed — regenerate to rotate.
         </p>
@@ -94,9 +275,14 @@ export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => vo
         )}
 
         {!showCreate ? (
-          <Button variant="secondary" size="sm" onClick={() => setShowCreate(true)} className="mb-3">
+          <div className="mb-3 flex flex-wrap gap-2">
+            <Button variant="secondary" size="sm" onClick={() => setShowCreate(true)}>
               <UserPlus size={15} /> New account
             </Button>
+            <Button variant="secondary" size="sm" onClick={() => setModelsOpen(true)}>
+              <Bot size={15} /> Ollama models
+            </Button>
+          </div>
         ) : (
           <form onSubmit={create} className="mb-4 flex flex-wrap items-end gap-2 rounded-2xl border border-stone-200 p-3 dark:border-zinc-700">
             <div className="min-w-40 flex-1">
@@ -135,7 +321,7 @@ export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => vo
             ))}
           </ul>
         )}
-      </Modal>
+      </Shell>
 
       <ConfirmDialog
         open={deleteTarget !== null}
@@ -146,6 +332,7 @@ export function AdminPanel({ open, onClose }: { open: boolean; onClose: () => vo
       />
 
       <EditUserDialog user={editTarget} onClose={() => setEditTarget(null)} onSaved={refresh} />
+      <OllamaModelsModal open={modelsOpen} onClose={() => setModelsOpen(false)} />
     </>
   );
 }

frontend/src/components/Login.tsx

@@ -1,9 +1,9 @@
 import { useEffect, useState } from "react";
-import { ArrowRight, KeyRound, ShieldCheck, User, Zap } from "lucide-react";
+import { ArrowRight, KeyRound, ShieldCheck, User, UserPlus, Zap } from "lucide-react";
 import { api, setToken } from "../lib/api.ts";
 import type { User as UserType } from "../lib/types.ts";
 import { Button, Input, Logo, Spinner } from "./ui.tsx";
-import { RecoverDialog } from "./dialogs.tsx";
+import { RecoverDialog, RegisterDialog } from "./dialogs.tsx";
 
 const PERKS = [
   { icon: ShieldCheck, text: "Private by design — no cookies, no tracking" },
@@ -18,11 +18,14 @@ export function Login({ onLogin }: { onLogin: (user: UserType) => void }) {
   const [recoverOpen, setRecoverOpen] = useState(false);
   const [recoveryOn, setRecoveryOn] = useState(false);
   const [recoveryFrom, setRecoveryFrom] = useState<string | undefined>(undefined);
+  const [registerOpen, setRegisterOpen] = useState(false);
+  const [registrationOn, setRegistrationOn] = useState(false);
 
   useEffect(() => {
     api.methods().then((m) => {
       setRecoveryOn(m.recovery);
       setRecoveryFrom(m.from);
+      setRegistrationOn(m.registration);
     }).catch(() => {});
   }, []);
 
@@ -89,6 +92,27 @@ export function Login({ onLogin }: { onLogin: (user: UserType) => void }) {
               {busy ? <Spinner /> : (<>Unlock <ArrowRight size={17} /></>)}
             </Button>
           </form>
+          <div className="mt-4 flex items-center gap-3 text-xs opacity-40">
+            <span className="h-px flex-1 bg-current" />
+            New here?
+            <span className="h-px flex-1 bg-current" />
+          </div>
+          <Button
+            variant="secondary"
+            size="lg"
+            className="mt-3 w-full"
+            disabled={!registrationOn}
+            title={registrationOn ? "Create an account" : "Registration currently disabled on this platform"}
+            onClick={() => setRegisterOpen(true)}
+          >
+            <UserPlus size={16} />
+            Register
+          </Button>
+          <RegisterDialog
+            open={registerOpen}
+            onClose={() => setRegisterOpen(false)}
+            onDone={(u, k) => { setUsername(u); setKey(k); }}
+          />
           {recoveryOn && (
             <button onClick={() => setRecoverOpen(true)} className="mt-3 w-full text-center text-sm opacity-60 transition hover:opacity-100 hover:underline">
               Forgot your access key?

frontend/src/components/Sidebar.tsx

@@ -1,5 +1,6 @@
 import { useRef, useState } from "react";
 import {
+  LayoutDashboard,
   MessageSquarePlus,
   MoreVertical,
   PanelLeftClose,
@@ -8,7 +9,6 @@ import {
   Share2,
   Tag,
   Trash2,
-  Users,
   X,
 } from "lucide-react";
 import type { Conversation, User } from "../lib/types.ts";
@@ -199,9 +199,9 @@ export function Sidebar({
         </button>
         <div className="flex gap-1.5">
           {user.isAdmin && (
-            <Button variant="secondary" size="sm" className="flex-1" onClick={onOpenAdmin} title="Manage accounts">
-              <Users size={15} />
-              Accounts
+            <Button variant="secondary" size="sm" className="flex-1" onClick={onOpenAdmin} title="Open the Admin Center">
+              <LayoutDashboard size={15} />
+              Admin Center
             </Button>
           )}
           <Button variant="ghost" size="sm" className={user.isAdmin ? "" : "flex-1"} onClick={onLogout}>

frontend/src/lib/api.ts

@@ -85,6 +85,44 @@ export const api = {
 
   models: () => req<{ models: DriverModel[] }>("/api/models"),
 
+  /** Admin: stream an Ollama /api/pull as NDJSON progress events. */
+  ollamaPull: async (
+    name: string,
+    onProgress: (p: { status?: string; digest?: string; total?: number; completed?: number; error?: string }) => void,
+  ): Promise<void> => {
+    const res = await fetch("/api/admin/ollama/pull", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${getToken()}` },
+      body: JSON.stringify({ name }),
+    });
+    if (res.status === 401) {
+      clearToken();
+      window.location.reload();
+      throw new ApiError(401, "Session expired.");
+    }
+    if (!res.ok || !res.body) {
+      const err = (await res.json().catch(() => ({}))) as { error?: string };
+      throw new ApiError(res.status, err.error || `Pull failed (${res.status})`);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buf += decoder.decode(value, { stream: true });
+      const lines = buf.split("\n");
+      buf = lines.pop() ?? "";
+      for (const line of lines) {
+        const t = line.trim();
+        if (t) onProgress(JSON.parse(t));
+      }
+    }
+  },
+
+  /** Admin: delete a local Ollama model (frees disk on the Ollama host). */
+  ollamaDelete: (name: string) => req<{ ok: boolean }>(`/api/admin/ollama/models/${encodeURIComponent(name)}`, { method: "DELETE" }),
+
   tools: () => req<{ tools: { name: string; description: string; available: boolean; reason: string | null }[] }>("/api/tools"),
 
   /** Send an image to the platform OCR tool. Returns editable text (never the raw image). */

src/config.ts

@@ -42,6 +42,12 @@ export const config = {
   openaiApiKey: env("OPENAI_API_KEY", ""),
   openaiEnabled: envBool("OPENAI_ENABLED", false),
 
+  glmApiKey: env("GLM_API_KEY", ""),
+  glmEnabled: envBool("GLM_ENABLED", false),
+  // Zhipu has two platforms: international (api.z.ai, default) and
+  // mainland China (open.bigmodel.cn) — override for the latter.
+  glmBaseUrl: env("GLM_BASE_URL", "https://api.z.ai/api/paas/v4"),
+
   // Public docs wiki (served by the hosted git forge, e.g. Gitea wiki pages).
   // The app redirects GET /wiki there (302) so the target stays configurable.
   wikiUrl: env("WIKI_URL", "https://git.kisakay.com/k/chat/wiki"),

src/drivers/apiBase.ts

@@ -4,7 +4,7 @@ import { driverLog, fmtBytes, fmtMs } from "./log.ts";
 
 /**
  * Base class for OpenAI-compatible HTTP API drivers
- * (mistral / deepseek / openai / anthropic adapter).
+ * (mistral / glm / deepseek / openai / anthropic adapter).
  * Only enabled when an API key is configured. Phase 1: disabled stubs.
  */
 export abstract class ApiDriverBase implements LLMDriver {

src/drivers/apis.ts

@@ -52,3 +52,20 @@ export class OpenAIDriver extends ApiDriverBase {
     });
   }
 }
+
+/**
+ * GLM driver (Zhipu AI, OpenAI-compatible endpoint). Priority: after Mistral.
+ * Docs: https://docs.z.ai — international base is api.z.ai, mainland China
+ * uses https://open.bigmodel.cn/api/paas/v4 (via GLM_BASE_URL).
+ */
+export class GlmDriver extends ApiDriverBase {
+  readonly name = "glm";
+  constructor() {
+    super({
+      baseUrl: config.glmBaseUrl,
+      apiKey: config.glmApiKey,
+      enabled: config.glmEnabled,
+      defaultModels: ["glm-4.7", "glm-4.6", "glm-4.5-air", "glm-4.5-flash"],
+    });
+  }
+}

src/drivers/ollama.ts

@@ -11,7 +11,7 @@ export class OllamaDriver implements LLMDriver {
   readonly name = "ollama";
   readonly enabled: boolean;
 
-  constructor(private host: string = config.ollamaHost, enabled = config.ollamaEnabled) {
+  constructor(public readonly host: string = config.ollamaHost, enabled = config.ollamaEnabled) {
     this.host = host.replace(/\/$/, "");
     this.enabled = enabled;
   }

src/drivers/registry.ts

@@ -1,14 +1,14 @@
-import { AnthropicDriver, DeepSeekDriver, MistralDriver, OpenAIDriver } from "./apis.ts";
+import { AnthropicDriver, DeepSeekDriver, GlmDriver, MistralDriver, OpenAIDriver } from "./apis.ts";
 import { OllamaDriver } from "./ollama.ts";
 import { PuppeteerOpenAIDriver } from "./puppeteer.ts";
 import type { DriverModel, LLMDriver } from "./types.ts";
 
 /**
  * Global driver priority (per spec):
- *   1. ollama (local) -> 2. mistral -> 3. puppeteer-openai (stub)
- *   -> 4. deepseek -> 5. anthropic -> 6. openai
+ *   1. ollama (local) -> 2. mistral -> 3. glm -> 4. puppeteer-openai (stub)
+ *   -> 5. deepseek -> 6. anthropic -> 7. openai
  */
-const PRIORITY = ["ollama", "mistral", "puppeteer-openai", "deepseek", "anthropic", "openai"];
+const PRIORITY = ["ollama", "mistral", "glm", "puppeteer-openai", "deepseek", "anthropic", "openai"];
 
 export class DriverRegistry {
   private drivers: Map<string, LLMDriver>;
@@ -17,6 +17,7 @@ export class DriverRegistry {
     const all: LLMDriver[] = [
       new OllamaDriver(),
       new MistralDriver(),
+      new GlmDriver(),
       new PuppeteerOpenAIDriver(),
       new DeepSeekDriver(),
       new AnthropicDriver(),

src/index.ts

@@ -42,6 +42,7 @@ import {
   updateUser,
 } from "./db.ts";
 import type { ChatMessage } from "./drivers/types.ts";
+import type { OllamaDriver } from "./drivers/ollama.ts";
 import { DriverRegistry } from "./drivers/registry.ts";
 import { createHash, randomBytes } from "node:crypto";
 import { statSync } from "node:fs";