Feat/ai sre

en/ai-sre/agents.mdx

@@ -71,11 +71,47 @@ On the A2A Agents list page, click **Add A2A Agent** and fill in the form:
 | Name | string | — | A2A agent identifier (e.g., `metrics-analyzer`). Required |
 | Scope | Account / Team | — | Scope: **Account** (visible account-wide) or a specific **Team** (visible and editable only to members of that team). Required — see "Scope" below |
 | Description | string | — | A brief description of this A2A agent's capabilities. It appears in AI SRE's available-agent list as the selection signal — write it as a prescriptive imperative |
-| Card URL | string | — | The base URL of the remote A2A agent (e.g., `https://flashai.flashcat.cloud`). Required. The platform validates that it is a legitimate http/https address and rejects loopback, private, link-local, or cloud-metadata addresses |
+| Card URL | string | — | The Agent Card URL of the remote A2A agent, or just the service origin for agents that follow the default well-known location (for example, `https://agents.example.com`). If the URL includes a path, the platform reads that exact URL; if only an origin is provided, it resolves `/.well-known/agent-card.json` by A2A convention. Required. The platform validates that it is a legitimate http/https address and rejects loopback, private, link-local, or cloud-metadata addresses |
 | Auth Type | enum | `none` | Credential type attached to outbound requests: `none` / `bearer` (Bearer Token) / `api_key` (custom Header + Key) |
 | Streaming | bool | on | Whether to communicate with the remote agent in streaming mode |
 | User Auth Mode | enum | `shared` | See "Auth Modes" below |
 
+### Using the FlashAI Template
+
+**FlashAI** is the observability analysis product in the Flashcat family. It can also be connected as a remote A2A agent for AI SRE. On the A2A Agents page, expand the **Connect FlashAI observability analysis** panel to create an A2A agent from the FlashAI template.
+
+The FlashAI template configures the agent as an observability-analysis delegation target. When AI SRE needs metrics, logs, traces, flame graphs, topology, or Flashcat monitoring context, it can prefer delegating that analysis to FlashAI.
+
+Prepare FlashAI first:
+
+<Steps>
+  <Step title="Confirm the version">
+    FlashAI must be `release-24` or later.
+  </Step>
+  <Step title="Configure FlashAI /config">
+    Open `/config` in the FlashAI / Flashcat console (for example, `https://demo.flashcat.cloud/config`), add `a2a_server_base_url`, and set it to the current FlashAI access domain, for example `https://demo.flashcat.cloud`.
+  </Step>
+  <Step title="Confirm network reachability">
+    If FlashAI uses a private-network address, only a BYOC Runner deployed in that network can reach it. If cloud Sandbox also needs to call FlashAI, use a publicly reachable domain and configure an allowlist as needed. This is the same network-reachability rule used for MCP SSE endpoints in Sandbox.
+  </Step>
+</Steps>
+
+After FlashAI is prepared, enter the **FlashAI domain** in the panel (for example, `demo.flashcat.cloud`) and click **Use this template**. The page opens the **Add A2A Agent** form and prefills:
+
+- Name: generated from the domain, for example `flashai-demo`
+- Description: delegation guidance for AI SRE, explaining when to prefer FlashAI.
+- Card URL: generated from the domain:
+
+```text
+https://demo.flashcat.cloud/api/fc-model/a2a/.well-known/agent-card.json
+```
+
+The template only prefills common values. You still choose the **Scope** (Account or Team) and configure authentication in the form. A2A agents can be installed multiple times for different scopes, so the FlashAI panel does not disappear just because one FlashAI agent already exists. Agent names must still be unique within the account; if the same FlashAI domain needs to be installed more than once, adjust the name in the form.
+
+<Tip>
+  Do not remove the description generated by the FlashAI template unless you have a more precise one. Whether AI SRE proactively calls a remote A2A agent depends mainly on the selection signal provided by the name and description; when the description is too generic, AI SRE may keep reasoning locally instead of delegating the task to FlashAI.
+</Tip>
+
 ### Auth Modes
 
 A2A agents support three credential-supply modes that determine how credentials are provided when different users call the same remote agent:

en/ai-sre/environments.mdx

@@ -32,6 +32,10 @@ The selection logic is straightforward: **when your account has an online self-h
 Throughout this page, "Environment" and "Runner" refer to the same thing: the record you manage in the console is called an **Environment**, while the actual process running on your machine is called a **Runner**. One Environment record corresponds to one Runner process.
 </Note>
 
+<Note>
+Runner is distributed through Flashduty's official install script and prebuilt binaries. Use the command generated by the console onboarding guide; you do not need to clone a repository or build from source.
+</Note>
+
 ## Why self-hosted (BYOC)?
 
 ---
@@ -108,7 +112,7 @@ Go to **`Environments`** in the AI SRE left sidebar to create and connect a self
   </Tabs>
 
   <Note>
-  Both the `connect-url` and the install script URL are sourced dynamically from the server-side deployment configuration (`environment.runner.*` in `etc/srv.yml`) and returned by the backend when you create or retrieve an Environment — **nothing is hardcoded in the frontend bundle**. The onboarding guide already shows a complete, ready-to-copy command with the real values pre-filled.
+  Both the `connect-url` and `install_script_url` are returned dynamically by the backend — **nothing is hardcoded in the frontend bundle**. `install_script_url` defaults to Flashduty's official distribution source. Private or air-gapped deployments can point it to an internal mirror, but that mirror must serve `install.sh`, `releases/latest`, and `releases/download/<version>/...` release assets so first install and automatic upgrades resolve from the same source. The onboarding guide already shows a complete, ready-to-copy command with the real values pre-filled; you do not need to edit the URL manually.
   </Note>
 </Step>
 
@@ -123,7 +127,7 @@ Go to **`Environments`** in the AI SRE left sidebar to create and connect a self
 
   Once online, the list also backfills the machine's **machine info** (OS / architecture / hostname), the Runner **version**, and the **last heartbeat** time ("just now", "N minutes ago", "N hours ago", etc.).
 
-  Runner upgrades are **server-push advertised on every heartbeat**: the backend compares the version the Runner reports against the system-configured `latest_version` using semver. If the Runner is behind, the backend pushes an upgrade notification to the Runner containing the target version, download URL, and SHA256 checksum. The Runner then downloads, verifies, and replaces itself **without any manual intervention**. Runners built from source with a `dev` version string are intentionally excluded from the comparison. When a newer version is available, an **"Upgrade available"** badge appears in the version column. Clicking it reopens the onboarding guide if you need to reinstall or view the install commands manually.
+  Runner upgrades are **server-push advertised on every heartbeat**: the backend compares the version the Runner reports against the system-configured `latest_version` using semver. If the Runner is behind, the backend pushes an upgrade notification to the Runner containing the target version, download URL, and SHA256 checksum. The Runner then downloads, verifies, and replaces itself **without any manual intervention**. Internal development builds that report `dev` as their version are intentionally excluded from the comparison. When a newer version is available, an **"Upgrade available"** badge appears in the version column. Clicking it reopens the onboarding guide if you need to reinstall or view the install commands manually.
 </Step>
 </Steps>
 

zh/ai-sre/agents.mdx

@@ -71,11 +71,47 @@ A2A Agent 的列表与管理入口在 **插件 → Agents** 页面（菜单标
 | 名称 | string | — | A2A Agent 标识（如 `metrics-analyzer`）。必填 |
 | 范围 | 账户 / 团队 | — | 作用域：**账户**（账户内全局可见）或某个**团队**（仅该团队成员可见和可编辑）。必填，详见下文「作用域」 |
 | 描述 | string | — | 简要描述此 A2A Agent 的功能。它会进入 AI SRE 的「可用 Agent 清单」，是选择信号——建议写成有指导性的祈使句 |
-| Card URL | string | — | 远端 A2A Agent 的基础 URL（如 `https://flashai.flashcat.cloud`）。必填。平台会校验它是合法的 http/https 地址，并拒绝指向回环、内网、链路本地或云元数据等受限地址 |
+| Card URL | string | — | 远端 A2A Agent 的 Agent Card 地址，或仅填写遵循默认 well-known 规则的服务根地址（如 `https://agents.example.com`）。如果 URL 已带路径，平台会按该地址原样读取；如果只填服务根地址，平台按 A2A 约定查找 `/.well-known/agent-card.json`。必填。平台会校验它是合法的 http/https 地址，并拒绝指向回环、内网、链路本地或云元数据等受限地址 |
 | 认证类型 | enum | `none` | 出站请求附带的凭证类型：`none`（无）/ `bearer`（Bearer Token）/ `api_key`（自定义 Header + Key） |
 | 流式传输 | bool | 开 | 是否以流式方式与远端交互 |
 | 用户级认证模式 | enum | `shared` | 见下表「认证模式」 |
 
+### 使用 FlashAI 模板
+
+**FlashAI** 是 Flashcat 体系内的可观测分析产品，也可以作为远端 A2A Agent 供 AI SRE 调用。在 A2A Agents 页面展开 **连接 FlashAI 可观测分析** 折叠卡片，即可使用 FlashAI 模板创建 A2A Agent。
+
+FlashAI 模板会把该 Agent 配置为可观测分析委派目标：当 AI SRE 需要指标、日志、Trace、火焰图、拓扑或 Flashcat 监控上下文时，可以优先把分析任务委派给 FlashAI。
+
+FlashAI 侧需要先完成以下配置：
+
+<Steps>
+  <Step title="确认版本">
+    FlashAI 需为 `release-24` 或更新版本。
+  </Step>
+  <Step title="配置 FlashAI /config">
+    在 FlashAI / Flashcat 控制台打开 `/config` 页面（例如 `https://demo.flashcat.cloud/config`），添加 `a2a_server_base_url`，值填写当前 FlashAI 的访问域名，例如 `https://demo.flashcat.cloud`。
+  </Step>
+  <Step title="确认网络可达">
+    如果 FlashAI 使用内网地址，只有部署在该网络内的 BYOC Runner 可以访问；如果希望云 Sandbox 也能调用 FlashAI，请使用公网可达域名，并按需配置白名单。这个限制与 MCP SSE 地址在 Sandbox 中的网络可达性要求一致。
+  </Step>
+</Steps>
+
+完成 FlashAI 侧配置后，在折叠卡片中填写 **FlashAI 域名**（例如 `demo.flashcat.cloud`），点击 **使用此模板**。页面会打开 **添加 A2A Agent** 表单并预填：
+
+- 名称：根据域名生成，例如 `flashai-demo`
+- 描述：面向 AI SRE 的委派提示，说明何时优先调用 FlashAI。
+- Card URL：根据域名自动生成：
+
+```text
+https://demo.flashcat.cloud/api/fc-model/a2a/.well-known/agent-card.json
+```
+
+模板只负责预填通用信息；你仍需在表单中选择**范围**（账户或团队）并按需配置认证。A2A Agent 可以按不同范围安装多次，因此 FlashAI 折叠卡片不会因为已有某个 FlashAI Agent 就自动消失。Agent 名称在账户内仍需唯一；如果同一个 FlashAI 域名需要安装多次，请在表单里调整名称。
+
+<Tip>
+  不建议删除 FlashAI 模板生成的描述。AI SRE 是否会主动调用远端 A2A Agent，主要取决于名称与描述提供的选择信号；描述过于泛化时，AI SRE 可能继续在本地推理，而不会把任务委派给 FlashAI。
+</Tip>
+
 ### 认证模式
 
 A2A Agent 支持三种凭证供给方式，决定不同用户调用同一个远端 Agent 时如何提供凭证：

zh/ai-sre/environments.mdx

@@ -32,6 +32,10 @@ AI SRE 提供两类运行环境：
 本页中的「Environment」「Runner」指的是同一个东西：在控制台里管理的那条记录称为 **Environment**，而真正跑在您机器上的那个进程称为 **Runner**。一个 Environment 记录对应一个 Runner 进程。
 </Note>
 
+<Note>
+Runner 通过 Flashduty 官方安装脚本和预编译二进制分发。请以控制台接入指引生成的命令为准，无需克隆仓库或从源码构建。
+</Note>
+
 ## 为什么自托管（BYOC）
 
 ---
@@ -108,7 +112,7 @@ AI SRE 提供两类运行环境：
   </Tabs>
 
   <Note>
-  `connect-url` 与 `install_script_url` 均来自服务端的部署配置（`etc/srv.yml` 的 `environment.runner.*` 字段），在您调用创建或获取 Environment API 时由后端动态下发，**不在前端硬编码**。接入指引里展示的命令已是含真实地址的完整可复制形式，无需手填。
+  `connect-url` 与 `install_script_url` 均由后端动态下发，**不在前端硬编码**。`install_script_url` 默认指向 Flashduty 官方分发源；私有化或离线部署可改为内部镜像，但镜像需要同时提供 `install.sh`、`releases/latest` 与 `releases/download/<version>/...` release assets，确保首次安装和后续自动升级来自同一来源。接入指引里展示的命令已是含真实地址的完整可复制形式，无需手填或改写 URL。
   </Note>
 </Step>
 
@@ -123,7 +127,7 @@ AI SRE 提供两类运行环境：
 
   在线后，列表还会回填该机器的**机器信息**（操作系统 / 架构 / 主机名）、Runner **版本**，以及**最后心跳**时间（「刚刚」「N 分钟前」「N 小时前」等）。
 
-  Runner 版本由**服务端在每次心跳时自动比对**：后端将 Runner 上报的版本号与系统配置的 `latest_version` 做 semver 比较，若 Runner 落后，则向 Runner 推送一条含目标版本号、下载地址和 SHA256 校验值的升级通知；Runner 收到后自行完成下载、校验与替换，**无需人工干预**。版本号为 `dev`（本地构建）的 Runner 不参与自动升级对比。当存在更新版本时，版本列会出现**「可升级」**标记；若需手动重装或查看安装命令，点击该标记可重新打开接入指引。
+  Runner 版本由**服务端在每次心跳时自动比对**：后端将 Runner 上报的版本号与系统配置的 `latest_version` 做 semver 比较，若 Runner 落后，则向 Runner 推送一条含目标版本号、下载地址和 SHA256 校验值的升级通知；Runner 收到后自行完成下载、校验与替换，**无需人工干预**。版本号为 `dev` 的内部开发构建不参与自动升级对比。当存在更新版本时，版本列会出现**「可升级」**标记；若需手动重装或查看安装命令，点击该标记可重新打开接入指引。
 </Step>
 </Steps>