diff --git a/desktop/src/components/AgentOnboardingWizard.tsx b/desktop/src/components/AgentOnboardingWizard.tsx
index 30496f5..c3693c8 100644
--- a/desktop/src/components/AgentOnboardingWizard.tsx
+++ b/desktop/src/components/AgentOnboardingWizard.tsx
@@ -18,6 +18,7 @@ import {
   Check,
   Loader2,
   AlertCircle,
+  LayoutGrid,
 } from 'lucide-react';
 import { cn } from '../lib/utils';
 import { useAgentStore, type CloneCreateOptions } from '../store/agentStore';
@@ -28,6 +29,12 @@ import type { Clone } from '../store/agentStore';
 import { intelligenceClient } from '../lib/intelligence-client';
 import { generateSoulContent, generateUserContent } from '../lib/personality-presets';
 import { createLogger } from '../lib/logger';
+import {
+  type AgentTemplateAvailable,
+  type AgentTemplateFull,
+  saasClient,
+} from '../lib/saas-client';
+import { useSaaSStore } from '../store/saasStore';
 
 const log = createLogger('AgentOnboardingWizard');
 
@@ -72,6 +79,7 @@ const initialFormData: WizardFormData = {
 // === Step Configuration ===
 
 const steps = [
+  { id: 0, title: '行业模板', description: '选择预设或自定义', icon: LayoutGrid },
   { id: 1, title: '认识用户', description: '让我们了解一下您', icon: User },
   { id: 2, title: 'Agent 身份', description: '给助手起个名字', icon: Bot },
   { id: 3, title: '人格风格', description: '选择沟通风格', icon: Sparkles },
@@ -82,19 +90,21 @@ const steps = [
 // === Component ===
 
 export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboardingWizardProps) {
-  const { createClone, updateClone, clones, isLoading, error, clearError } = useAgentStore();
-  const [currentStep, setCurrentStep] = useState(1);
+  const { createClone, createFromTemplate, updateClone, clones, isLoading, error, clearError } = useAgentStore();
+  const [currentStep, setCurrentStep] = useState(0);
   const [formData, setFormData] = useState<WizardFormData>(initialFormData);
   const [errors, setErrors] = useState<Record<string, string>>({});
   const [submitStatus, setSubmitStatus] = useState<'idle' | 'success' | 'error'>('idle');
+  const [selectedTemplate, setSelectedTemplate] = useState<AgentTemplateFull | null>(null);
 
   // Reset form when modal opens
   useEffect(() => {
     if (isOpen) {
       setFormData(initialFormData);
-      setCurrentStep(1);
+      setCurrentStep(0);
       setErrors({});
       setSubmitStatus('idle');
+      setSelectedTemplate(null);
       clearError();
     }
   }, [isOpen, clearError]);
@@ -111,11 +121,33 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
     }
   };
 
+  // Handle template selection
+  const handleSelectTemplate = async (t: AgentTemplateAvailable) => {
+    try {
+      const full = await saasClient.fetchTemplateFull(t.id);
+      setSelectedTemplate(full);
+      setFormData(prev => ({
+        ...prev,
+        agentName: full.name,
+        emoji: full.emoji || prev.emoji,
+        personality: full.personality || prev.personality,
+        scenarios: full.scenarios.length > 0 ? full.scenarios : prev.scenarios,
+      }));
+      setCurrentStep(1);
+    } catch {
+      // If fetch fails, still allow manual creation
+      setCurrentStep(1);
+    }
+  };
+
   // Validate current step
   const validateStep = useCallback((step: number): boolean => {
     const newErrors: Record<string, string> = {};
 
     switch (step) {
+      case 0:
+        // Template selection is always valid (blank agent is an option)
+        break;
       case 1:
         if (!formData.userName.trim()) {
           newErrors.userName = '请输入您的名字';
@@ -157,7 +189,7 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
 
   // Navigate to previous step
   const prevStep = () => {
-    setCurrentStep((prev) => Math.max(prev - 1, 1));
+    setCurrentStep((prev) => Math.max(prev - 1, 0));
   };
 
   // Handle form submission
@@ -169,59 +201,76 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
     setSubmitStatus('idle');
 
     try {
-      const personalityUpdates = {
-        name: formData.agentName,
-        role: formData.agentRole || undefined,
-        nickname: formData.agentNickname || undefined,
-        userName: formData.userName,
-        userRole: formData.userRole || undefined,
-        scenarios: formData.scenarios,
-        workspaceDir: formData.workspaceDir || undefined,
-        restrictFiles: formData.restrictFiles,
-        emoji: formData.emoji,
-        personality: formData.personality,
-        notes: formData.notes || undefined,
-      };
-
       let clone: Clone | undefined;
 
-      // If there's an existing clone, update it instead of creating a new one
-      if (clones && clones.length > 0) {
-        clone = await updateClone(clones[0].id, personalityUpdates);
+      // Template-based creation path
+      if (selectedTemplate && clones.length === 0) {
+        clone = await createFromTemplate(selectedTemplate);
+
+        // Persist USER.md for template-created agents
+        if (clone) {
+          try {
+            const userContent = generateUserContent({
+              userName: formData.userName,
+              userRole: formData.userRole,
+              scenarios: formData.scenarios,
+            });
+            await intelligenceClient.identity.updateFile(clone.id, 'user_profile', userContent);
+          } catch (err) {
+            log.warn('Failed to persist USER.md for template agent:', err);
+          }
+        }
       } else {
-        const createOptions: CloneCreateOptions = {
-          ...personalityUpdates,
-          privacyOptIn: formData.privacyOptIn,
+        // Manual creation / update path
+        const personalityUpdates = {
+          name: formData.agentName,
+          role: formData.agentRole || undefined,
+          nickname: formData.agentNickname || undefined,
+          userName: formData.userName,
+          userRole: formData.userRole || undefined,
+          scenarios: formData.scenarios,
+          workspaceDir: formData.workspaceDir || undefined,
+          restrictFiles: formData.restrictFiles,
+          emoji: formData.emoji,
+          personality: formData.personality,
+          notes: formData.notes || undefined,
         };
-        clone = await createClone(createOptions);
+
+        if (clones && clones.length > 0) {
+          clone = await updateClone(clones[0].id, personalityUpdates);
+        } else {
+          const createOptions: CloneCreateOptions = {
+            ...personalityUpdates,
+            privacyOptIn: formData.privacyOptIn,
+          };
+          clone = await createClone(createOptions);
+        }
       }
 
       if (clone) {
-        // Persist SOUL.md and USER.md to the identity system
-        try {
-          const soulContent = generateSoulContent({
-            agentName: formData.agentName,
-            emoji: formData.emoji,
-            personality: formData.personality,
-            scenarios: formData.scenarios,
-          });
+        // Persist SOUL.md and USER.md to the identity system (manual path only)
+        if (!selectedTemplate) {
+          try {
+            const soulContent = generateSoulContent({
+              agentName: formData.agentName,
+              emoji: formData.emoji,
+              personality: formData.personality,
+              scenarios: formData.scenarios,
+            });
 
-          const userContent = generateUserContent({
-            userName: formData.userName,
-            userRole: formData.userRole,
-            scenarios: formData.scenarios,
-          });
+            const userContent = generateUserContent({
+              userName: formData.userName,
+              userRole: formData.userRole,
+              scenarios: formData.scenarios,
+            });
 
-          // Write SOUL.md (agent personality)
-          await intelligenceClient.identity.updateFile(clone.id, 'soul', soulContent);
+            await intelligenceClient.identity.updateFile(clone.id, 'soul', soulContent);
+            await intelligenceClient.identity.updateFile(clone.id, 'user_profile', userContent);
 
-          // Write USER.md (user profile)
-          await intelligenceClient.identity.updateFile(clone.id, 'user_profile', userContent);
-
-          log.debug('SOUL.md and USER.md persisted for agent:', clone.id);
-        } catch (err) {
-          log.warn('Failed to persist identity files:', err);
-          // Don't fail the whole onboarding if identity persistence fails
+            log.debug('SOUL.md and USER.md persisted for agent:', clone.id);
+          } catch (err) {
+            log.warn('Failed to persist identity files:', err);
+          }
         }
 
         setSubmitStatus('success');
@@ -239,7 +288,7 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
 
   if (!isOpen) return null;
 
-  const CurrentStepIcon = steps[currentStep - 1]?.icon || Bot;
+  const CurrentStepIcon = steps[currentStep]?.icon || Bot;
 
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center">
@@ -262,7 +311,7 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
                 创建新 Agent
               </h2>
               <p className="text-xs text-gray-500 dark:text-gray-400">
-                步骤 {currentStep}/{steps.length}: {steps[currentStep - 1]?.title}
+                步骤 {currentStep + 1}/{steps.length}: {steps[currentStep]?.title}
               </p>
             </div>
           </div>
@@ -321,6 +370,36 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
               transition={{ duration: 0.2 }}
               className="space-y-4"
             >
+              {/* Step 0: 行业模板 */}
+              {currentStep === 0 && (
+                <div className="space-y-4">
+                  <p className="text-sm text-muted-foreground">选择一个行业预设快速开始，或创建空白 Agent</p>
+                  <div className="grid grid-cols-2 sm:grid-cols-3 gap-3">
+                    <button
+                      type="button"
+                      onClick={() => { setSelectedTemplate(null); setCurrentStep(1); }}
+                      className="p-4 rounded-lg border-2 border-dashed border-muted-foreground/25 hover:border-primary/50 transition-colors text-center"
+                    >
+                      <div className="text-2xl mb-2">&#x2728;</div>
+                      <div className="font-medium text-sm">空白 Agent</div>
+                      <div className="text-xs text-muted-foreground">从零配置</div>
+                    </button>
+                    {useSaaSStore.getState().availableTemplates.map(t => (
+                      <button
+                        key={t.id}
+                        type="button"
+                        onClick={() => handleSelectTemplate(t)}
+                        className="p-4 rounded-lg border-2 hover:border-primary/50 transition-colors text-center"
+                      >
+                        <div className="text-2xl mb-2">{t.emoji || '🤖'}</div>
+                        <div className="font-medium text-sm">{t.name}</div>
+                        <div className="text-xs text-muted-foreground line-clamp-2">{t.description}</div>
+                      </button>
+                    ))}
+                  </div>
+                </div>
+              )}
+
               {/* Step 1: 认识用户 */}
               {currentStep === 1 && (
                 <>
@@ -627,7 +706,7 @@ export function AgentOnboardingWizard({ isOpen, onClose, onSuccess }: AgentOnboa
           <button
             type="button"
             onClick={prevStep}
-            disabled={currentStep === 1}
+            disabled={currentStep === 0}
             className="px-4 py-2 text-sm text-gray-700 dark:text-gray-300 bg-gray-100 dark:bg-gray-700 rounded-lg hover:bg-gray-200 dark:hover:bg-gray-600 transition-colors disabled:opacity-50 disabled:cursor-not-allowed flex items-center gap-1"
           >
             <ChevronLeft className="w-4 h-4" />
diff --git a/desktop/src/lib/saas-client.ts b/desktop/src/lib/saas-client.ts
index 78c8fd0..fee7e5d 100644
--- a/desktop/src/lib/saas-client.ts
+++ b/desktop/src/lib/saas-client.ts
@@ -10,567 +10,128 @@
  * Security: Tokens are NO LONGER persisted to localStorage.
  * The backend sets HttpOnly cookies on login/register/refresh.
  * On page reload, cookie-based auth is verified via GET /api/v1/auth/me.
- */
-
-// === Storage Keys ===
-// Token is stored in secure storage (OS keyring), NOT in plain localStorage.
-// Auth state is carried by HttpOnly cookies when possible (same-origin).
-// On page reload, token is restored from secure storage as Bearer fallback.
-
-const SAAS_TOKEN_SECURE_KEY = 'zclaw-saas-token'; // OS keyring key
-const SAASTOKEN_KEY = 'zclaw-saas-token'; // legacy localStorage — only used for cleanup
-const SAASURL_KEY = 'zclaw-saas-url';
-const SAASACCOUNT_KEY = 'zclaw-saas-account';
-const SAASMODE_KEY = 'zclaw-connection-mode';
-
-// === Types ===
-
-/** Public account info returned by the SaaS backend */
-export interface SaaSAccountInfo {
-  id: string;
-  username: string;
-  email: string;
-  display_name: string;
-  role: 'super_admin' | 'admin' | 'user';
-  status: 'active' | 'disabled' | 'suspended';
-  totp_enabled: boolean;
-  created_at: string;
-}
-
-/** A model available for relay through the SaaS backend */
-export interface SaaSModelInfo {
-  id: string;
-  provider_id: string;
-  alias: string;
-  context_window: number;
-  max_output_tokens: number;
-  supports_streaming: boolean;
-  supports_vision: boolean;
-}
-
-/** Config item from the SaaS backend */
-export interface SaaSConfigItem {
-  id: string;
-  category: string;
-  key_path: string;
-  value_type: string;
-  current_value: string | null;
-  default_value: string | null;
-  source: string;
-  description: string | null;
-  requires_restart: boolean;
-  created_at: string;
-  updated_at: string;
-}
-
-/** SaaS API error shape */
-export interface SaaSErrorResponse {
-  error: string;
-  message: string;
-}
-
-/** Login response from POST /api/v1/auth/login */
-export interface SaaSLoginResponse {
-  token: string;
-  refresh_token: string;
-  account: SaaSAccountInfo;
-}
-
-/** Refresh response from POST /api/v1/auth/refresh */
-interface SaaSRefreshResponse {
-  token: string;
-}
-
-/** TOTP setup response from POST /api/v1/auth/totp/setup */
-export interface TotpSetupResponse {
-  otpauth_uri: string;
-  secret: string;
-  issuer: string;
-}
-
-/** TOTP verify/disable response */
-export interface TotpResultResponse {
-  ok: boolean;
-  totp_enabled: boolean;
-  message: string;
-}
-
-/** Device info stored on the SaaS backend */
-export interface DeviceInfo {
-  id: string;
-  device_id: string;
-  device_name: string | null;
-  platform: string | null;
-  app_version: string | null;
-  last_seen_at: string;
-  created_at: string;
-}
-
-/** Relay task info from GET /api/v1/relay/tasks */
-export interface RelayTaskInfo {
-  id: string;
-  account_id: string;
-  provider_id: string;
-  model_id: string;
-  status: string;
-  priority: number;
-  attempt_count: number;
-  max_attempts: number;
-  input_tokens: number;
-  output_tokens: number;
-  error_message: string | null;
-  queued_at: string;
-  started_at: string | null;
-  completed_at: string | null;
-  created_at: string;
-}
-
-/** Config diff request for POST /api/v1/config/diff and /sync */
-export interface SyncConfigRequest {
-  client_fingerprint: string;
-  action: 'push' | 'merge';
-  config_keys: string[];
-  client_values: Record<string, unknown>;
-}
-
-/** A single config diff entry */
-export interface ConfigDiffItem {
-  key_path: string;
-  client_value: string | null;
-  saas_value: string | null;
-  conflict: boolean;
-}
-
-/** Config diff response */
-export interface ConfigDiffResponse {
-  items: ConfigDiffItem[];
-  total_keys: number;
-  conflicts: number;
-}
-
-/** Config sync result */
-export interface ConfigSyncResult {
-  updated: number;
-  created: number;
-  skipped: number;
-}
-
-/** Paginated response wrapper */
-export interface PaginatedResponse<T> {
-  items: T[];
-  total: number;
-  page: number;
-  page_size: number;
-}
-
-// === Prompt OTA Types ===
-
-/** Prompt template info */
-export interface PromptTemplateInfo {
-  id: string;
-  name: string;
-  category: string;
-  description: string | null;
-  source: string;
-  current_version: number;
-  status: string;
-  created_at: string;
-  updated_at: string;
-}
-
-/** Prompt version info */
-export interface PromptVersionInfo {
-  id: string;
-  template_id: string;
-  version: number;
-  system_prompt: string;
-  user_prompt_template: string | null;
-  variables: PromptVariable[];
-  changelog: string | null;
-  min_app_version: string | null;
-  created_at: string;
-}
-
-/** Prompt variable definition */
-export interface PromptVariable {
-  name: string;
-  type: string;
-  default_value?: string;
-  description?: string;
-  required?: boolean;
-}
-
-/** OTA update check result */
-export interface PromptCheckResult {
-  updates: PromptUpdatePayload[];
-  server_time: string;
-}
-
-/** Single OTA update payload */
-export interface PromptUpdatePayload {
-  name: string;
-  version: number;
-  system_prompt: string;
-  user_prompt_template: string | null;
-  variables: PromptVariable[];
-  source: string;
-  min_app_version: string | null;
-  changelog: string | null;
-}
-
-/** Provider info from GET /api/v1/providers */
-export interface ProviderInfo {
-  id: string;
-  name: string;
-  display_name: string;
-  base_url: string;
-  api_protocol: string;
-  enabled: boolean;
-  rate_limit_rpm: number | null;
-  rate_limit_tpm: number | null;
-  created_at: string;
-  updated_at: string;
-}
-
-/** Create provider request */
-export interface CreateProviderRequest {
-  name: string;
-  display_name: string;
-  base_url: string;
-  api_protocol?: string;
-  api_key?: string;
-  rate_limit_rpm?: number;
-  rate_limit_tpm?: number;
-}
-
-/** Update provider request */
-export interface UpdateProviderRequest {
-  display_name?: string;
-  base_url?: string;
-  api_key?: string;
-  rate_limit_rpm?: number;
-  rate_limit_tpm?: number;
-  enabled?: boolean;
-}
-
-/** Model info from GET /api/v1/models */
-export interface ModelInfo {
-  id: string;
-  provider_id: string;
-  model_id: string;
-  alias: string;
-  context_window: number;
-  max_output_tokens: number;
-  supports_streaming: boolean;
-  supports_vision: boolean;
-  enabled: boolean;
-  pricing_input: number;
-  pricing_output: number;
-  created_at: string;
-  updated_at: string;
-}
-
-/** Create model request */
-export interface CreateModelRequest {
-  provider_id: string;
-  model_id: string;
-  alias: string;
-  context_window?: number;
-  max_output_tokens?: number;
-  supports_streaming?: boolean;
-  supports_vision?: boolean;
-  pricing_input?: number;
-  pricing_output?: number;
-}
-
-/** Update model request */
-export interface UpdateModelRequest {
-  alias?: string;
-  context_window?: number;
-  max_output_tokens?: number;
-  supports_streaming?: boolean;
-  supports_vision?: boolean;
-  enabled?: boolean;
-  pricing_input?: number;
-  pricing_output?: number;
-}
-
-/** Account API key info */
-export interface AccountApiKeyInfo {
-  id: string;
-  provider_id: string;
-  key_label: string | null;
-  permissions: string[];
-  enabled: boolean;
-  last_used_at: string | null;
-  created_at: string;
-  updated_at: string;
-}
-
-/** Create API key request */
-export interface CreateApiKeyRequest {
-  provider_id: string;
-  key_value: string;
-  key_label?: string;
-  permissions?: string[];
-}
-
-/** Usage statistics */
-export interface UsageStats {
-  total_input_tokens: number;
-  total_output_tokens: number;
-  total_requests: number;
-  by_provider: Record<string, { input_tokens: number; output_tokens: number; requests: number }>;
-  by_model: Record<string, { input_tokens: number; output_tokens: number; requests: number }>;
-  daily: Array<{ date: string; input_tokens: number; output_tokens: number; requests: number }>;
-}
-
-/** Account public info (extended) */
-export interface AccountPublic {
-  id: string;
-  username: string;
-  email: string;
-  display_name: string;
-  role: 'super_admin' | 'admin' | 'user';
-  status: 'active' | 'disabled' | 'suspended';
-  totp_enabled: boolean;
-  last_login_at: string | null;
-  created_at: string;
-}
-
-/** Update account request */
-export interface UpdateAccountRequest {
-  display_name?: string;
-  email?: string;
-  role?: string;
-  avatar_url?: string;
-}
-
-/** Token info */
-export interface TokenInfo {
-  id: string;
-  name: string;
-  token_prefix: string;
-  permissions: string[];
-  last_used_at: string | null;
-  expires_at: string | null;
-  created_at: string;
-  token?: string;
-}
-
-/** Create token request */
-export interface CreateTokenRequest {
-  name: string;
-  permissions: string[];
-  expires_days?: number;
-}
-
-/** Operation log info */
-export interface OperationLogInfo {
-  id: number;
-  account_id: string | null;
-  action: string;
-  target_type: string | null;
-  target_id: string | null;
-  details: Record<string, unknown> | null;
-  ip_address: string | null;
-  created_at: string;
-}
-
-/** Dashboard statistics */
-export interface DashboardStats {
-  total_accounts: number;
-  active_accounts: number;
-  tasks_today: number;
-  active_providers: number;
-  active_models: number;
-  tokens_today_input: number;
-  tokens_today_output: number;
-}
-
-/** Role info */
-export interface RoleInfo {
-  id: string;
-  name: string;
-  description: string | null;
-  permissions: string[];
-  is_system: boolean;
-  created_at: string;
-  updated_at: string;
-}
-
-/** Create role request */
-export interface CreateRoleRequest {
-  id: string;
-  name: string;
-  description?: string;
-  permissions: string[];
-}
-
-/** Update role request */
-export interface UpdateRoleRequest {
-  name?: string;
-  description?: string;
-  permissions?: string[];
-}
-
-/** Permission template */
-export interface PermissionTemplate {
-  id: string;
-  name: string;
-  description: string | null;
-  permissions: string[];
-  created_at: string;
-  updated_at: string;
-}
-
-/** Create template request */
-export interface CreateTemplateRequest {
-  name: string;
-  description?: string;
-  permissions: string[];
-}
-
-// === Error Class ===
-
-export class SaaSApiError extends Error {
-  constructor(
-    public readonly status: number,
-    public readonly code: string,
-    message: string,
-  ) {
-    super(message);
-    this.name = 'SaaSApiError';
-  }
-}
-
-// === Session Persistence ===
-
-export interface SaaSSession {
-  token: string | null; // null when using cookie-based auth (page reload)
-  account: SaaSAccountInfo | null;
-  saasUrl: string;
-}
-
-/**
- * Load a persisted SaaS session.
- * Token is stored in secure storage (OS keyring), not plain localStorage.
- * Returns null if no URL is stored (never logged in).
  *
- * NOTE: Token loading is async due to secure storage access.
- * For synchronous checks, use loadSaaSSessionSync() (URL + account only).
+ * Architecture: This file is the main entry point and thin shell.
+ * Types, errors, session helpers, and API methods are in sub-modules:
+ *   - saas-types.ts       — all type/interface definitions
+ *   - saas-errors.ts      — SaaSApiError class
+ *   - saas-session.ts     — session persistence (load/save/clear)
+ *   - saas-auth.ts        — login/register/TOTP methods (mixin)
+ *   - saas-admin.ts       — admin panel API methods (mixin)
+ *   - saas-relay.ts       — relay tasks, chat completion, usage (mixin)
+ *   - saas-prompt.ts      — prompt OTA methods (mixin)
+ *   - saas-telemetry.ts   — telemetry reporting methods (mixin)
  */
-export async function loadSaaSSession(): Promise<SaaSSession | null> {
-  try {
-    const saasUrl = localStorage.getItem(SAASURL_KEY);
-    if (!saasUrl) {
-      return null;
-    }
 
-    // Clean up any legacy plaintext token from localStorage
-    const legacyToken = localStorage.getItem(SAASTOKEN_KEY);
-    if (legacyToken) {
-      localStorage.removeItem(SAASTOKEN_KEY);
-    }
+// === Re-export everything from sub-modules ===
+export type {
+  SaaSAccountInfo,
+  SaaSModelInfo,
+  SaaSConfigItem,
+  SaaSErrorResponse,
+  SaaSLoginResponse,
+  SaaSRefreshResponse,
+  TotpSetupResponse,
+  TotpResultResponse,
+  DeviceInfo,
+  RelayTaskInfo,
+  SyncConfigRequest,
+  ConfigDiffItem,
+  ConfigDiffResponse,
+  ConfigSyncResult,
+  PaginatedResponse,
+  PromptTemplateInfo,
+  PromptVersionInfo,
+  PromptVariable,
+  PromptCheckResult,
+  PromptUpdatePayload,
+  ProviderInfo,
+  CreateProviderRequest,
+  UpdateProviderRequest,
+  ModelInfo,
+  CreateModelRequest,
+  UpdateModelRequest,
+  AccountApiKeyInfo,
+  CreateApiKeyRequest,
+  UsageStats,
+  AccountPublic,
+  UpdateAccountRequest,
+  TokenInfo,
+  CreateTokenRequest,
+  OperationLogInfo,
+  DashboardStats,
+  RoleInfo,
+  CreateRoleRequest,
+  UpdateRoleRequest,
+  PermissionTemplate,
+  CreateTemplateRequest,
+  AgentTemplateAvailable,
+  AgentTemplateFull,
+} from './saas-types';
 
-    // Load token from secure storage
-    let token: string | null = null;
-    try {
-      const { secureStorage } = await import('./secure-storage');
-      token = await secureStorage.get(SAAS_TOKEN_SECURE_KEY);
-    } catch {
-      // Secure storage unavailable — token stays null (cookie auth will be attempted)
-    }
+export { SaaSApiError } from './saas-errors';
 
-    const accountRaw = localStorage.getItem(SAASACCOUNT_KEY);
-    const account: SaaSAccountInfo | null = accountRaw
-      ? (JSON.parse(accountRaw) as SaaSAccountInfo)
-      : null;
+export type { SaaSSession } from './saas-session';
+export {
+  loadSaaSSession,
+  loadSaaSSessionSync,
+  saveSaaSSession,
+  clearSaaSSession,
+  saveConnectionMode,
+  loadConnectionMode,
+} from './saas-session';
 
-    return { token, account, saasUrl };
-  } catch {
-    // Corrupted data - clear all
-    clearSaaSSession();
-    return null;
-  }
-}
+// === Imports for the class implementation ===
+import type {
+  SaaSAccountInfo,
+  SaaSLoginResponse,
+  TotpSetupResponse,
+  TotpResultResponse,
+  SaaSModelInfo,
+  SaaSConfigItem,
+  DeviceInfo,
+  SyncConfigRequest,
+  ConfigDiffResponse,
+  ConfigSyncResult,
+  SaaSErrorResponse,
+  RelayTaskInfo,
+  UsageStats,
+  ProviderInfo,
+  CreateProviderRequest,
+  UpdateProviderRequest,
+  ModelInfo,
+  CreateModelRequest,
+  UpdateModelRequest,
+  AccountApiKeyInfo,
+  CreateApiKeyRequest,
+  AccountPublic,
+  UpdateAccountRequest,
+  PaginatedResponse,
+  TokenInfo,
+  CreateTokenRequest,
+  OperationLogInfo,
+  DashboardStats,
+  RoleInfo,
+  CreateRoleRequest,
+  UpdateRoleRequest,
+  PermissionTemplate,
+  CreateTemplateRequest,
+  PromptCheckResult,
+  PromptTemplateInfo,
+  PromptVersionInfo,
+  AgentTemplateAvailable,
+  AgentTemplateFull,
+} from './saas-types';
+import { SaaSApiError } from './saas-errors';
+import { clearSaaSSession } from './saas-session';
+import { createLogger } from './logger';
 
-/**
- * Synchronous version — returns URL + account only (no token).
- * Used during store initialization where async is not available.
- */
-export function loadSaaSSessionSync(): { saasUrl: string; account: SaaSAccountInfo | null } | null {
-  try {
-    const saasUrl = localStorage.getItem(SAASURL_KEY);
-    if (!saasUrl) return null;
-
-    // Clean up legacy plaintext token
-    const legacyToken = localStorage.getItem(SAASTOKEN_KEY);
-    if (legacyToken) {
-      localStorage.removeItem(SAASTOKEN_KEY);
-    }
-
-    const accountRaw = localStorage.getItem(SAASACCOUNT_KEY);
-    const account: SaaSAccountInfo | null = accountRaw
-      ? (JSON.parse(accountRaw) as SaaSAccountInfo)
-      : null;
-
-    return { saasUrl, account };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Persist SaaS session.
- * Token goes to secure storage (OS keyring), metadata to localStorage.
- */
-export async function saveSaaSSession(session: SaaSSession): Promise<void> {
-  // Store token in secure storage (OS keyring), not plain localStorage
-  if (session.token) {
-    try {
-      const { secureStorage } = await import('./secure-storage');
-      await secureStorage.set(SAAS_TOKEN_SECURE_KEY, session.token);
-    } catch {
-      // Secure storage unavailable — token only in memory
-    }
-  }
-
-  localStorage.setItem(SAASURL_KEY, session.saasUrl);
-  if (session.account) {
-    localStorage.setItem(SAASACCOUNT_KEY, JSON.stringify(session.account));
-  }
-}
-
-/**
- * Clear the persisted SaaS session from all storage.
- */
-export async function clearSaaSSession(): Promise<void> {
-  // Remove from secure storage
-  try {
-    const { secureStorage } = await import('./secure-storage');
-    await secureStorage.set(SAAS_TOKEN_SECURE_KEY, '');
-  } catch { /* non-blocking */ }
-
-  localStorage.removeItem(SAASTOKEN_KEY);
-  localStorage.removeItem(SAASURL_KEY);
-  localStorage.removeItem(SAASACCOUNT_KEY);
-}
-
-/**
- * Persist the connection mode to localStorage.
- */
-export function saveConnectionMode(mode: string): void {
-  localStorage.setItem(SAASMODE_KEY, mode);
-}
-
-/**
- * Load the connection mode from localStorage.
- * Returns null if not set.
- */
-export function loadConnectionMode(): string | null {
-  return localStorage.getItem(SAASMODE_KEY);
-}
+const saasLog = createLogger('saas-client');
+import { installAuthMethods } from './saas-auth';
+import { installAdminMethods } from './saas-admin';
+import { installRelayMethods } from './saas-relay';
+import { installPromptMethods } from './saas-prompt';
+import { installTelemetryMethods } from './saas-telemetry';
 
 // === Client Implementation ===
 
@@ -615,7 +176,8 @@ export class SaaSClient {
       const account = await this.me();
       this._cookieAuth = true;
       return account;
-    } catch {
+    } catch (e) {
+      saasLog.debug('Cookie auth restore failed', { error: e });
       this._cookieAuth = false;
       return null;
     }
@@ -680,7 +242,7 @@ export class SaaSClient {
             }
           } catch (refreshErr) {
             // Token refresh failed — clear session and trigger logout
-            clearSaaSSession().catch(() => {}); // async cleanup, fire-and-forget
+            clearSaaSSession().catch(e => saasLog.debug('Failed to clear SaaS session on refresh failure', { error: e })); // async cleanup, fire-and-forget
             localStorage.removeItem('zclaw-connection-mode');
             throw new SaaSApiError(401, 'SESSION_EXPIRED', '会话已过期，请重新登录');
           }
@@ -732,92 +294,12 @@ export class SaaSClient {
     try {
       await this.request<unknown>('GET', '/api/health', undefined, 5000);
       return true;
-    } catch {
+    } catch (e) {
+      saasLog.debug('Health check failed', { error: e });
       return false;
     }
   }
 
-  // --- Auth Endpoints ---
-
-  /**
-   * Login with username and password.
-   * Auto-sets the client token on success.
-   */
-  async login(username: string, password: string, totpCode?: string): Promise<SaaSLoginResponse> {
-    const body: Record<string, string> = { username, password };
-    if (totpCode) body.totp_code = totpCode;
-    // Clear stale token before login — avoid sending expired token on auth endpoint
-    this.token = null;
-    const data = await this.request<SaaSLoginResponse>(
-      'POST', '/api/v1/auth/login', body,
-    );
-    this.token = data.token;
-    return data;
-  }
-
-  /**
-   * Register a new account.
-   * Auto-sets the client token on success.
-   */
-  async register(data: {
-    username: string;
-    email: string;
-    password: string;
-    display_name?: string;
-  }): Promise<SaaSLoginResponse> {
-    // Clear stale token before register
-    this.token = null;
-    const result = await this.request<SaaSLoginResponse>(
-      'POST', '/api/v1/auth/register', data,
-    );
-    this.token = result.token;
-    return result;
-  }
-
-  /**
-   * Get the current authenticated user's account info.
-   */
-  async me(): Promise<SaaSAccountInfo> {
-    return this.request<SaaSAccountInfo>('GET', '/api/v1/auth/me');
-  }
-
-  /**
-   * Refresh the current token.
-   * Auto-updates the client token on success.
-   */
-  async refreshToken(): Promise<string> {
-    const data = await this.request<SaaSRefreshResponse>('POST', '/api/v1/auth/refresh');
-    this.token = data.token;
-    return data.token;
-  }
-
-  /**
-   * Change the current user's password.
-   */
-  async changePassword(oldPassword: string, newPassword: string): Promise<void> {
-    await this.request<unknown>('PUT', '/api/v1/auth/password', {
-      old_password: oldPassword,
-      new_password: newPassword,
-    });
-  }
-
-  // --- TOTP Endpoints ---
-
-  /** Generate a TOTP secret and otpauth URI */
-  async setupTotp(): Promise<TotpSetupResponse> {
-    return this.request<TotpSetupResponse>('POST', '/api/v1/auth/totp/setup');
-  }
-
-  /** Verify a TOTP code and enable 2FA */
-  async verifyTotp(code: string): Promise<TotpResultResponse> {
-    return this.request<TotpResultResponse>('POST', '/api/v1/auth/totp/verify', { code });
-  }
-
-  /** Disable 2FA (requires password confirmation) */
-  async disableTotp(password: string): Promise<TotpResultResponse> {
-    return this.request<TotpResultResponse>('POST', '/api/v1/auth/totp/disable', { password });
-  }
-
   // --- Device Endpoints ---
 
   /**
@@ -864,99 +346,6 @@ export class SaaSClient {
     return this.request<SaaSModelInfo[]>('GET', '/api/v1/relay/models');
   }
 
-  // --- Relay Task Management ---
-
-  /** List relay tasks for the current user */
-  async listRelayTasks(query?: { status?: string; page?: number; page_size?: number }): Promise<RelayTaskInfo[]> {
-    const params = new URLSearchParams();
-    if (query?.status) params.set('status', query.status);
-    if (query?.page) params.set('page', String(query.page));
-    if (query?.page_size) params.set('page_size', String(query.page_size));
-    const qs = params.toString();
-    return this.request<RelayTaskInfo[]>('GET', `/api/v1/relay/tasks${qs ? '?' + qs : ''}`);
-  }
-
-  /** Get a single relay task */
-  async getRelayTask(taskId: string): Promise<RelayTaskInfo> {
-    return this.request<RelayTaskInfo>('GET', `/api/v1/relay/tasks/${taskId}`);
-  }
-
-  /** Retry a failed relay task (admin only) */
-  async retryRelayTask(taskId: string): Promise<{ ok: boolean; task_id: string }> {
-    return this.request<{ ok: boolean; task_id: string }>('POST', `/api/v1/relay/tasks/${taskId}/retry`);
-  }
-
-  // --- Chat Relay ---
-
-  /**
-   * Send a chat completion request via the SaaS relay.
-   * Returns the raw Response object to support both streaming and non-streaming.
-   *
-   * Includes one retry on 401 (auto token refresh) and on network errors.
-   * The caller is responsible for:
-   * - Reading the response body (JSON or SSE stream)
-   * - Handling errors from the response
-   */
-  async chatCompletion(
-    body: unknown,
-    signal?: AbortSignal,
-  ): Promise<Response> {
-    const maxAttempts = 2; // 1 initial + 1 retry
-
-    for (let attempt = 0; attempt < maxAttempts; attempt++) {
-      const headers: Record<string, string> = {
-        'Content-Type': 'application/json',
-      };
-      if (this.token) {
-        headers['Authorization'] = `Bearer ${this.token}`;
-      }
-
-      // Use caller's AbortSignal if provided, otherwise default 5min timeout
-      const effectiveSignal = signal ?? AbortSignal.timeout(300_000);
-
-      try {
-        const response = await fetch(
-          `${this.baseUrl}/api/v1/relay/chat/completions`,
-          {
-            method: 'POST',
-            headers,
-            credentials: 'include', // Send HttpOnly cookies
-            body: JSON.stringify(body),
-            signal: effectiveSignal,
-          },
-        );
-
-        // On 401, attempt token refresh once
-        if (response.status === 401 && attempt === 0 && !this._isAuthEndpoint('/api/v1/relay/chat/completions')) {
-          try {
-            const newToken = await this.refreshToken();
-            if (newToken) continue; // Retry with refreshed token
-          } catch {
-            // Refresh failed, return the 401 response
-          }
-        }
-
-        this._serverReachable = true;
-        return response;
-      } catch (err: unknown) {
-        this._serverReachable = false;
-        const isNetworkError = err instanceof TypeError
-          && (err.message.includes('Failed to fetch') || err.message.includes('NetworkError'));
-
-        if (isNetworkError && attempt < maxAttempts - 1) {
-          // Brief backoff before retry
-          await new Promise((r) => setTimeout(r, 1000 * (attempt + 1)));
-          continue;
-        }
-
-        throw err;
-      }
-    }
-
-    // Unreachable but TypeScript needs it
-    throw new Error('chatCompletion: all attempts exhausted');
-  }
-
   // --- Config Endpoints ---
 
   /**
@@ -997,256 +386,114 @@ export class SaaSClient {
     return this.request('GET', '/api/v1/config/pull' + qs);
   }
 
-  // ==========================================================================
-  // Admin Panel API — Reserved for future admin UI (Next.js admin dashboard)
-  // These methods are not called by the desktop app but are kept as thin API
-  // wrappers for when the admin panel is built.
-  // ==========================================================================
+  // --- Agent Template Endpoints ---
 
-  // --- Provider Management (Admin) ---
-
-  /** List all providers */
-  async listProviders(): Promise<ProviderInfo[]> {
-    return this.request<ProviderInfo[]>('GET', '/api/v1/providers');
+  /**
+   * List available agent templates (lightweight).
+   * Used for template selection during onboarding.
+   */
+  async fetchAvailableTemplates(): Promise<AgentTemplateAvailable[]> {
+    return this.request<AgentTemplateAvailable[]>('GET', '/agent-templates/available');
   }
 
-  /** Get provider by ID */
-  async getProvider(id: string): Promise<ProviderInfo> {
-    return this.request<ProviderInfo>('GET', `/api/v1/providers/${id}`);
+  /**
+   * Get full template details by ID.
+   * Returns all fields needed to create an agent from template.
+   */
+  async fetchTemplateFull(id: string): Promise<AgentTemplateFull> {
+    return this.request<AgentTemplateFull>('GET', `/agent-templates/${id}/full`);
   }
+}
 
-  /** Create a new provider (admin only) */
-  async createProvider(data: CreateProviderRequest): Promise<ProviderInfo> {
-    return this.request<ProviderInfo>('POST', '/api/v1/providers', data);
-  }
+// === Install mixin methods ===
+installAuthMethods(SaaSClient);
+installAdminMethods(SaaSClient);
+installRelayMethods(SaaSClient);
+installPromptMethods(SaaSClient);
+installTelemetryMethods(SaaSClient);
 
-  /** Update a provider (admin only) */
-  async updateProvider(id: string, data: UpdateProviderRequest): Promise<ProviderInfo> {
-    return this.request<ProviderInfo>('PATCH', `/api/v1/providers/${id}`, data);
-  }
+// === API Method Type Declarations ===
+// These methods are installed at runtime by installXxxMethods() in saas-*.ts.
+// We declare them here via interface merging so TypeScript knows they exist on SaaSClient.
 
-  /** Delete a provider (admin only) */
-  async deleteProvider(id: string): Promise<void> {
-    await this.request<void>('DELETE', `/api/v1/providers/${id}`);
-  }
+export interface SaaSClient {
+  // --- Auth (saas-auth.ts) ---
+  login(username: string, password: string, totpCode?: string): Promise<SaaSLoginResponse>;
+  register(data: { username: string; email: string; password: string; display_name?: string }): Promise<SaaSLoginResponse>;
+  me(): Promise<SaaSAccountInfo>;
+  refreshToken(): Promise<string>;
+  changePassword(oldPassword: string, newPassword: string): Promise<void>;
+  setupTotp(): Promise<TotpSetupResponse>;
+  verifyTotp(code: string): Promise<TotpResultResponse>;
+  disableTotp(password: string): Promise<TotpResultResponse>;
 
-  // --- Model Management (Admin) ---
+  // --- Admin: Providers (saas-admin.ts) ---
+  listProviders(): Promise<ProviderInfo[]>;
+  getProvider(id: string): Promise<ProviderInfo>;
+  createProvider(data: CreateProviderRequest): Promise<ProviderInfo>;
+  updateProvider(id: string, data: UpdateProviderRequest): Promise<ProviderInfo>;
+  deleteProvider(id: string): Promise<void>;
 
-  /** List models, optionally filtered by provider */
-  async listModelsAdmin(providerId?: string): Promise<ModelInfo[]> {
-    const qs = providerId ? `?provider_id=${encodeURIComponent(providerId)}` : '';
-    return this.request<ModelInfo[]>('GET', `/api/v1/models${qs}`);
-  }
+  // --- Admin: Models (saas-admin.ts) ---
+  listModelsAdmin(providerId?: string): Promise<ModelInfo[]>;
+  getModel(id: string): Promise<ModelInfo>;
+  createModel(data: CreateModelRequest): Promise<ModelInfo>;
+  updateModel(id: string, data: UpdateModelRequest): Promise<ModelInfo>;
+  deleteModel(id: string): Promise<void>;
 
-  /** Get model by ID */
-  async getModel(id: string): Promise<ModelInfo> {
-    return this.request<ModelInfo>('GET', `/api/v1/models/${id}`);
-  }
+  // --- Admin: API Keys (saas-admin.ts) ---
+  listApiKeys(providerId?: string): Promise<AccountApiKeyInfo[]>;
+  createApiKey(data: CreateApiKeyRequest): Promise<AccountApiKeyInfo>;
+  rotateApiKey(id: string, newKeyValue: string): Promise<void>;
+  revokeApiKey(id: string): Promise<void>;
 
-  /** Create a new model (admin only) */
-  async createModel(data: CreateModelRequest): Promise<ModelInfo> {
-    return this.request<ModelInfo>('POST', '/api/v1/models', data);
-  }
+  // --- Admin: Accounts (saas-admin.ts) ---
+  listAccounts(params?: { page?: number; page_size?: number; role?: string; status?: string; search?: string }): Promise<PaginatedResponse<AccountPublic>>;
+  getAccount(id: string): Promise<AccountPublic>;
+  updateAccount(id: string, data: UpdateAccountRequest): Promise<AccountPublic>;
+  updateAccountStatus(id: string, status: 'active' | 'disabled' | 'suspended'): Promise<void>;
 
-  /** Update a model (admin only) */
-  async updateModel(id: string, data: UpdateModelRequest): Promise<ModelInfo> {
-    return this.request<ModelInfo>('PATCH', `/api/v1/models/${id}`, data);
-  }
+  // --- Admin: Tokens (saas-admin.ts) ---
+  listTokens(): Promise<TokenInfo[]>;
+  createToken(data: CreateTokenRequest): Promise<TokenInfo>;
+  revokeToken(id: string): Promise<void>;
 
-  /** Delete a model (admin only) */
-  async deleteModel(id: string): Promise<void> {
-    await this.request<void>('DELETE', `/api/v1/models/${id}`);
-  }
+  // --- Admin: Logs (saas-admin.ts) ---
+  listOperationLogs(params?: { page?: number; page_size?: number }): Promise<OperationLogInfo[]>;
 
-  // --- Account API Keys ---
+  // --- Admin: Dashboard (saas-admin.ts) ---
+  getDashboardStats(): Promise<DashboardStats>;
 
-  /** List account's API keys */
-  async listApiKeys(providerId?: string): Promise<AccountApiKeyInfo[]> {
-    const qs = providerId ? `?provider_id=${encodeURIComponent(providerId)}` : '';
-    return this.request<AccountApiKeyInfo[]>('GET', `/api/v1/keys${qs}`);
-  }
+  // --- Admin: Roles (saas-admin.ts) ---
+  listRoles(): Promise<RoleInfo[]>;
+  getRole(id: string): Promise<RoleInfo>;
+  createRole(data: CreateRoleRequest): Promise<RoleInfo>;
+  updateRole(id: string, data: UpdateRoleRequest): Promise<RoleInfo>;
+  deleteRole(id: string): Promise<void>;
 
-  /** Create a new API key */
-  async createApiKey(data: CreateApiKeyRequest): Promise<AccountApiKeyInfo> {
-    return this.request<AccountApiKeyInfo>('POST', '/api/v1/keys', data);
-  }
+  // --- Admin: Permission Templates (saas-admin.ts) ---
+  listPermissionTemplates(): Promise<PermissionTemplate[]>;
+  getPermissionTemplate(id: string): Promise<PermissionTemplate>;
+  createPermissionTemplate(data: CreateTemplateRequest): Promise<PermissionTemplate>;
+  deletePermissionTemplate(id: string): Promise<void>;
+  applyPermissionTemplate(templateId: string, accountIds: string[]): Promise<{ ok: boolean; applied_count: number }>;
 
-  /** Rotate an API key */
-  async rotateApiKey(id: string, newKeyValue: string): Promise<void> {
-    await this.request<void>('POST', `/api/v1/keys/${id}/rotate`, { new_key_value: newKeyValue });
-  }
+  // --- Relay (saas-relay.ts) ---
+  listRelayTasks(query?: { status?: string; page?: number; page_size?: number }): Promise<RelayTaskInfo[]>;
+  getRelayTask(taskId: string): Promise<RelayTaskInfo>;
+  retryRelayTask(taskId: string): Promise<{ ok: boolean; task_id: string }>;
+  chatCompletion(body: unknown, signal?: AbortSignal): Promise<Response>;
+  getUsage(params?: { from?: string; to?: string; provider_id?: string; model_id?: string }): Promise<UsageStats>;
 
-  /** Revoke an API key */
-  async revokeApiKey(id: string): Promise<void> {
-    await this.request<void>('DELETE', `/api/v1/keys/${id}`);
-  }
+  // --- Prompt OTA (saas-prompt.ts) ---
+  checkPromptUpdates(deviceId: string, currentVersions: Record<string, number>): Promise<PromptCheckResult>;
+  listPrompts(params?: { category?: string; source?: string; status?: string; page?: number; page_size?: number }): Promise<PaginatedResponse<PromptTemplateInfo>>;
+  getPrompt(name: string): Promise<PromptTemplateInfo>;
+  listPromptVersions(name: string): Promise<PromptVersionInfo[]>;
+  getPromptVersion(name: string, version: number): Promise<PromptVersionInfo>;
 
-  // --- Usage Statistics ---
-
-  /** Get usage statistics for current account */
-  async getUsage(params?: { from?: string; to?: string; provider_id?: string; model_id?: string }): Promise<UsageStats> {
-    const qs = new URLSearchParams();
-    if (params?.from) qs.set('from', params.from);
-    if (params?.to) qs.set('to', params.to);
-    if (params?.provider_id) qs.set('provider_id', params.provider_id);
-    if (params?.model_id) qs.set('model_id', params.model_id);
-    const query = qs.toString();
-    return this.request<UsageStats>('GET', `/api/v1/usage${query ? '?' + query : ''}`);
-  }
-
-  // --- Account Management (Admin) ---
-
-  /** List all accounts (admin only) */
-  async listAccounts(params?: { page?: number; page_size?: number; role?: string; status?: string; search?: string }): Promise<PaginatedResponse<AccountPublic>> {
-    const qs = new URLSearchParams();
-    if (params?.page) qs.set('page', String(params.page));
-    if (params?.page_size) qs.set('page_size', String(params.page_size));
-    if (params?.role) qs.set('role', params.role);
-    if (params?.status) qs.set('status', params.status);
-    if (params?.search) qs.set('search', params.search);
-    const query = qs.toString();
-    return this.request<PaginatedResponse<AccountPublic>>('GET', `/api/v1/accounts${query ? '?' + query : ''}`);
-  }
-
-  /** Get account by ID (admin or self) */
-  async getAccount(id: string): Promise<AccountPublic> {
-    return this.request<AccountPublic>('GET', `/api/v1/accounts/${id}`);
-  }
-
-  /** Update account (admin or self) */
-  async updateAccount(id: string, data: UpdateAccountRequest): Promise<AccountPublic> {
-    return this.request<AccountPublic>('PATCH', `/api/v1/accounts/${id}`, data);
-  }
-
-  /** Update account status (admin only) */
-  async updateAccountStatus(id: string, status: 'active' | 'disabled' | 'suspended'): Promise<void> {
-    await this.request<void>('PATCH', `/api/v1/accounts/${id}/status`, { status });
-  }
-
-  // --- API Token Management ---
-
-  /** List API tokens for current account */
-  async listTokens(): Promise<TokenInfo[]> {
-    return this.request<TokenInfo[]>('GET', '/api/v1/tokens');
-  }
-
-  /** Create a new API token */
-  async createToken(data: CreateTokenRequest): Promise<TokenInfo> {
-    return this.request<TokenInfo>('POST', '/api/v1/tokens', data);
-  }
-
-  /** Revoke an API token */
-  async revokeToken(id: string): Promise<void> {
-    await this.request<void>('DELETE', `/api/v1/tokens/${id}`);
-  }
-
-  // --- Operation Logs (Admin) ---
-
-  /** List operation logs (admin only) */
-  async listOperationLogs(params?: { page?: number; page_size?: number }): Promise<OperationLogInfo[]> {
-    const qs = new URLSearchParams();
-    if (params?.page) qs.set('page', String(params.page));
-    if (params?.page_size) qs.set('page_size', String(params.page_size));
-    const query = qs.toString();
-    return this.request<OperationLogInfo[]>('GET', `/api/v1/logs/operations${query ? '?' + query : ''}`);
-  }
-
-  // --- Dashboard Statistics (Admin) ---
-
-  /** Get dashboard statistics (admin only) */
-  async getDashboardStats(): Promise<DashboardStats> {
-    return this.request<DashboardStats>('GET', '/api/v1/stats/dashboard');
-  }
-
-  // --- Role Management (Admin) ---
-
-  /** List all roles */
-  async listRoles(): Promise<RoleInfo[]> {
-    return this.request<RoleInfo[]>('GET', '/api/v1/roles');
-  }
-
-  /** Get role by ID */
-  async getRole(id: string): Promise<RoleInfo> {
-    return this.request<RoleInfo>('GET', `/api/v1/roles/${id}`);
-  }
-
-  /** Create a new role (admin only) */
-  async createRole(data: CreateRoleRequest): Promise<RoleInfo> {
-    return this.request<RoleInfo>('POST', '/api/v1/roles', data);
-  }
-
-  /** Update a role (admin only) */
-  async updateRole(id: string, data: UpdateRoleRequest): Promise<RoleInfo> {
-    return this.request<RoleInfo>('PUT', `/api/v1/roles/${id}`, data);
-  }
-
-  /** Delete a role (admin only) */
-  async deleteRole(id: string): Promise<void> {
-    await this.request<void>('DELETE', `/api/v1/roles/${id}`);
-  }
-
-  // --- Permission Templates ---
-
-  /** List permission templates */
-  async listPermissionTemplates(): Promise<PermissionTemplate[]> {
-    return this.request<PermissionTemplate[]>('GET', '/api/v1/permission-templates');
-  }
-
-  /** Get permission template by ID */
-  async getPermissionTemplate(id: string): Promise<PermissionTemplate> {
-    return this.request<PermissionTemplate>('GET', `/api/v1/permission-templates/${id}`);
-  }
-
-  /** Create a permission template (admin only) */
-  async createPermissionTemplate(data: CreateTemplateRequest): Promise<PermissionTemplate> {
-    return this.request<PermissionTemplate>('POST', '/api/v1/permission-templates', data);
-  }
-
-  /** Delete a permission template (admin only) */
-  async deletePermissionTemplate(id: string): Promise<void> {
-    await this.request<void>('DELETE', `/api/v1/permission-templates/${id}`);
-  }
-
-  /** Apply permission template to accounts (admin only) */
-  async applyPermissionTemplate(templateId: string, accountIds: string[]): Promise<{ ok: boolean; applied_count: number }> {
-    return this.request<{ ok: boolean; applied_count: number }>('POST', `/api/v1/permission-templates/${templateId}/apply`, { account_ids: accountIds });
-  }
-
-  // === Prompt OTA ===
-
-  /** Check for prompt updates (OTA) */
-  async checkPromptUpdates(deviceId: string, currentVersions: Record<string, number>): Promise<PromptCheckResult> {
-    return this.request<PromptCheckResult>('POST', '/api/v1/prompts/check', {
-      device_id: deviceId,
-      versions: currentVersions,
-    });
-  }
-
-  /** List all prompt templates */
-  async listPrompts(params?: { category?: string; source?: string; status?: string; page?: number; page_size?: number }): Promise<PaginatedResponse<PromptTemplateInfo>> {
-    const qs = params ? '?' + new URLSearchParams(params as Record<string, string>).toString() : '';
-    return this.request<PaginatedResponse<PromptTemplateInfo>>('GET', `/api/v1/prompts${qs}`);
-  }
-
-  /** Get prompt template by name */
-  async getPrompt(name: string): Promise<PromptTemplateInfo> {
-    return this.request<PromptTemplateInfo>('GET', `/api/v1/prompts/${encodeURIComponent(name)}`);
-  }
-
-  /** List prompt versions */
-  async listPromptVersions(name: string): Promise<PromptVersionInfo[]> {
-    return this.request<PromptVersionInfo[]>('GET', `/api/v1/prompts/${encodeURIComponent(name)}/versions`);
-  }
-
-  /** Get specific prompt version */
-  async getPromptVersion(name: string, version: number): Promise<PromptVersionInfo> {
-    return this.request<PromptVersionInfo>('GET', `/api/v1/prompts/${encodeURIComponent(name)}/versions/${version}`);
-  }
-
-  // === Telemetry ===
-
-  /** Report anonymous usage telemetry (token counts only, no content) */
-  async reportTelemetry(data: {
+  // --- Telemetry (saas-telemetry.ts) ---
+  reportTelemetry(data: {
     device_id: string;
     app_version: string;
     entries: Array<{
@@ -1259,14 +506,8 @@ export class SaaSClient {
       timestamp: string;
       connection_mode: string;
     }>;
-  }): Promise<{ accepted: number; rejected: number }> {
-    return this.request<{ accepted: number; rejected: number }>(
-      'POST', '/api/v1/telemetry/report', data,
-    );
-  }
-
-  /** Report audit log summary (action types and counts only, no content) */
-  async reportAuditSummary(data: {
+  }): Promise<{ accepted: number; rejected: number }>;
+  reportAuditSummary(data: {
     device_id: string;
     entries: Array<{
       action: string;
@@ -1274,11 +515,7 @@ export class SaaSClient {
       result: string;
       timestamp: string;
     }>;
-  }): Promise<{ accepted: number; total: number }> {
-    return this.request<{ accepted: number; total: number }>(
-      'POST', '/api/v1/telemetry/audit', data,
-    );
-  }
+  }): Promise<{ accepted: number; total: number }>;
 }
 
 // === Singleton ===
diff --git a/desktop/src/lib/saas-types.ts b/desktop/src/lib/saas-types.ts
new file mode 100644
index 0000000..ce4ffb4
--- /dev/null
+++ b/desktop/src/lib/saas-types.ts
@@ -0,0 +1,462 @@
+/**
+ * SaaS Type Definitions
+ *
+ * All type/interface definitions for the ZCLAW SaaS client.
+ * Extracted from saas-client.ts for modularity.
+ */
+
+// === Account & Auth Types ===
+
+/** Public account info returned by the SaaS backend */
+export interface SaaSAccountInfo {
+  id: string;
+  username: string;
+  email: string;
+  display_name: string;
+  role: 'super_admin' | 'admin' | 'user';
+  status: 'active' | 'disabled' | 'suspended';
+  totp_enabled: boolean;
+  created_at: string;
+  llm_routing?: 'relay' | 'local';
+}
+
+/** Lightweight template info for listing available templates */
+export interface AgentTemplateAvailable {
+  id: string;
+  name: string;
+  category: string;
+  emoji?: string;
+  description?: string;
+  source_id?: string;
+}
+
+/** Full template details for creating an agent from template */
+export interface AgentTemplateFull {
+  id: string;
+  name: string;
+  description?: string;
+  category: string;
+  emoji?: string;
+  personality?: string;
+  system_prompt?: string;
+  soul_content?: string;
+  scenarios: string[];
+  welcome_message?: string;
+  quick_commands: Array<{ label: string; command: string }>;
+  communication_style?: string;
+  model?: string;
+  tools: string[];
+  temperature?: number;
+  max_tokens?: number;
+  source_id?: string;
+}
+
+/** A model available for relay through the SaaS backend */
+export interface SaaSModelInfo {
+  id: string;
+  provider_id: string;
+  alias: string;
+  context_window: number;
+  max_output_tokens: number;
+  supports_streaming: boolean;
+  supports_vision: boolean;
+}
+
+/** Config item from the SaaS backend */
+export interface SaaSConfigItem {
+  id: string;
+  category: string;
+  key_path: string;
+  value_type: string;
+  current_value: string | null;
+  default_value: string | null;
+  source: string;
+  description: string | null;
+  requires_restart: boolean;
+  created_at: string;
+  updated_at: string;
+}
+
+/** SaaS API error shape */
+export interface SaaSErrorResponse {
+  error: string;
+  message: string;
+}
+
+/** Login response from POST /api/v1/auth/login */
+export interface SaaSLoginResponse {
+  token: string;
+  refresh_token: string;
+  account: SaaSAccountInfo;
+}
+
+/** Refresh response from POST /api/v1/auth/refresh */
+export interface SaaSRefreshResponse {
+  token: string;
+}
+
+/** TOTP setup response from POST /api/v1/auth/totp/setup */
+export interface TotpSetupResponse {
+  otpauth_uri: string;
+  secret: string;
+  issuer: string;
+}
+
+/** TOTP verify/disable response */
+export interface TotpResultResponse {
+  ok: boolean;
+  totp_enabled: boolean;
+  message: string;
+}
+
+/** Device info stored on the SaaS backend */
+export interface DeviceInfo {
+  id: string;
+  device_id: string;
+  device_name: string | null;
+  platform: string | null;
+  app_version: string | null;
+  last_seen_at: string;
+  created_at: string;
+}
+
+// === Relay & Config Types ===
+
+/** Relay task info from GET /api/v1/relay/tasks */
+export interface RelayTaskInfo {
+  id: string;
+  account_id: string;
+  provider_id: string;
+  model_id: string;
+  status: string;
+  priority: number;
+  attempt_count: number;
+  max_attempts: number;
+  input_tokens: number;
+  output_tokens: number;
+  error_message: string | null;
+  queued_at: string;
+  started_at: string | null;
+  completed_at: string | null;
+  created_at: string;
+}
+
+/** Config diff request for POST /api/v1/config/diff and /sync */
+export interface SyncConfigRequest {
+  client_fingerprint: string;
+  action: 'push' | 'merge';
+  config_keys: string[];
+  client_values: Record<string, unknown>;
+}
+
+/** A single config diff entry */
+export interface ConfigDiffItem {
+  key_path: string;
+  client_value: string | null;
+  saas_value: string | null;
+  conflict: boolean;
+}
+
+/** Config diff response */
+export interface ConfigDiffResponse {
+  items: ConfigDiffItem[];
+  total_keys: number;
+  conflicts: number;
+}
+
+/** Config sync result */
+export interface ConfigSyncResult {
+  updated: number;
+  created: number;
+  skipped: number;
+}
+
+/** Paginated response wrapper */
+export interface PaginatedResponse<T> {
+  items: T[];
+  total: number;
+  page: number;
+  page_size: number;
+}
+
+// === Prompt OTA Types ===
+
+/** Prompt template info */
+export interface PromptTemplateInfo {
+  id: string;
+  name: string;
+  category: string;
+  description: string | null;
+  source: string;
+  current_version: number;
+  status: string;
+  created_at: string;
+  updated_at: string;
+}
+
+/** Prompt version info */
+export interface PromptVersionInfo {
+  id: string;
+  template_id: string;
+  version: number;
+  system_prompt: string;
+  user_prompt_template: string | null;
+  variables: PromptVariable[];
+  changelog: string | null;
+  min_app_version: string | null;
+  created_at: string;
+}
+
+/** Prompt variable definition */
+export interface PromptVariable {
+  name: string;
+  type: string;
+  default_value?: string;
+  description?: string;
+  required?: boolean;
+}
+
+/** OTA update check result */
+export interface PromptCheckResult {
+  updates: PromptUpdatePayload[];
+  server_time: string;
+}
+
+/** Single OTA update payload */
+export interface PromptUpdatePayload {
+  name: string;
+  version: number;
+  system_prompt: string;
+  user_prompt_template: string | null;
+  variables: PromptVariable[];
+  source: string;
+  min_app_version: string | null;
+  changelog: string | null;
+}
+
+// === Admin Types: Providers ===
+
+/** Provider info from GET /api/v1/providers */
+export interface ProviderInfo {
+  id: string;
+  name: string;
+  display_name: string;
+  base_url: string;
+  api_protocol: string;
+  enabled: boolean;
+  rate_limit_rpm: number | null;
+  rate_limit_tpm: number | null;
+  created_at: string;
+  updated_at: string;
+}
+
+/** Create provider request */
+export interface CreateProviderRequest {
+  name: string;
+  display_name: string;
+  base_url: string;
+  api_protocol?: string;
+  api_key?: string;
+  rate_limit_rpm?: number;
+  rate_limit_tpm?: number;
+}
+
+/** Update provider request */
+export interface UpdateProviderRequest {
+  display_name?: string;
+  base_url?: string;
+  api_key?: string;
+  rate_limit_rpm?: number;
+  rate_limit_tpm?: number;
+  enabled?: boolean;
+}
+
+// === Admin Types: Models ===
+
+/** Model info from GET /api/v1/models */
+export interface ModelInfo {
+  id: string;
+  provider_id: string;
+  model_id: string;
+  alias: string;
+  context_window: number;
+  max_output_tokens: number;
+  supports_streaming: boolean;
+  supports_vision: boolean;
+  enabled: boolean;
+  pricing_input: number;
+  pricing_output: number;
+  created_at: string;
+  updated_at: string;
+}
+
+/** Create model request */
+export interface CreateModelRequest {
+  provider_id: string;
+  model_id: string;
+  alias: string;
+  context_window?: number;
+  max_output_tokens?: number;
+  supports_streaming?: boolean;
+  supports_vision?: boolean;
+  pricing_input?: number;
+  pricing_output?: number;
+}
+
+/** Update model request */
+export interface UpdateModelRequest {
+  alias?: string;
+  context_window?: number;
+  max_output_tokens?: number;
+  supports_streaming?: boolean;
+  supports_vision?: boolean;
+  enabled?: boolean;
+  pricing_input?: number;
+  pricing_output?: number;
+}
+
+// === Admin Types: API Keys ===
+
+/** Account API key info */
+export interface AccountApiKeyInfo {
+  id: string;
+  provider_id: string;
+  key_label: string | null;
+  permissions: string[];
+  enabled: boolean;
+  last_used_at: string | null;
+  created_at: string;
+  updated_at: string;
+}
+
+/** Create API key request */
+export interface CreateApiKeyRequest {
+  provider_id: string;
+  key_value: string;
+  key_label?: string;
+  permissions?: string[];
+}
+
+// === Admin Types: Usage & Accounts ===
+
+/** Usage statistics */
+export interface UsageStats {
+  total_input_tokens: number;
+  total_output_tokens: number;
+  total_requests: number;
+  by_provider: Record<string, { input_tokens: number; output_tokens: number; requests: number }>;
+  by_model: Record<string, { input_tokens: number; output_tokens: number; requests: number }>;
+  daily: Array<{ date: string; input_tokens: number; output_tokens: number; requests: number }>;
+}
+
+/** Account public info (extended) */
+export interface AccountPublic {
+  id: string;
+  username: string;
+  email: string;
+  display_name: string;
+  role: 'super_admin' | 'admin' | 'user';
+  status: 'active' | 'disabled' | 'suspended';
+  totp_enabled: boolean;
+  last_login_at: string | null;
+  created_at: string;
+}
+
+/** Update account request */
+export interface UpdateAccountRequest {
+  display_name?: string;
+  email?: string;
+  role?: string;
+  avatar_url?: string;
+}
+
+// === Admin Types: Tokens ===
+
+/** Token info */
+export interface TokenInfo {
+  id: string;
+  name: string;
+  token_prefix: string;
+  permissions: string[];
+  last_used_at: string | null;
+  expires_at: string | null;
+  created_at: string;
+  token?: string;
+}
+
+/** Create token request */
+export interface CreateTokenRequest {
+  name: string;
+  permissions: string[];
+  expires_days?: number;
+}
+
+// === Admin Types: Logs & Dashboard ===
+
+/** Operation log info */
+export interface OperationLogInfo {
+  id: number;
+  account_id: string | null;
+  action: string;
+  target_type: string | null;
+  target_id: string | null;
+  details: Record<string, unknown> | null;
+  ip_address: string | null;
+  created_at: string;
+}
+
+/** Dashboard statistics */
+export interface DashboardStats {
+  total_accounts: number;
+  active_accounts: number;
+  tasks_today: number;
+  active_providers: number;
+  active_models: number;
+  tokens_today_input: number;
+  tokens_today_output: number;
+}
+
+// === Admin Types: Roles & Permissions ===
+
+/** Role info */
+export interface RoleInfo {
+  id: string;
+  name: string;
+  description: string | null;
+  permissions: string[];
+  is_system: boolean;
+  created_at: string;
+  updated_at: string;
+}
+
+/** Create role request */
+export interface CreateRoleRequest {
+  id: string;
+  name: string;
+  description?: string;
+  permissions: string[];
+}
+
+/** Update role request */
+export interface UpdateRoleRequest {
+  name?: string;
+  description?: string;
+  permissions?: string[];
+}
+
+/** Permission template */
+export interface PermissionTemplate {
+  id: string;
+  name: string;
+  description: string | null;
+  permissions: string[];
+  created_at: string;
+  updated_at: string;
+}
+
+/** Create template request */
+export interface CreateTemplateRequest {
+  name: string;
+  description?: string;
+  permissions: string[];
+}
diff --git a/desktop/src/store/agentStore.ts b/desktop/src/store/agentStore.ts
index 3de1112..9cc8def 100644
--- a/desktop/src/store/agentStore.ts
+++ b/desktop/src/store/agentStore.ts
@@ -6,6 +6,7 @@
  */
 import { create } from 'zustand';
 import type { GatewayClient } from '../lib/gateway-client';
+import type { AgentTemplateFull } from '../lib/saas-client';
 import { useChatStore } from './chatStore';
 
 // === Types ===
@@ -33,6 +34,7 @@ export interface Clone {
   communicationStyle?: string; // 沟通风格描述
   notes?: string; // 用户备注
   onboardingCompleted?: boolean; // 是否完成首次引导
+  source_template_id?: string; // 模板来源 ID
 }
 
 export interface UsageStats {
@@ -83,6 +85,7 @@ export interface AgentStateSlice {
 export interface AgentActionsSlice {
   loadClones: () => Promise<void>;
   createClone: (opts: CloneCreateOptions) => Promise<Clone | undefined>;
+  createFromTemplate: (template: AgentTemplateFull) => Promise<Clone | undefined>;
   updateClone: (id: string, updates: Partial<Clone>) => Promise<Clone | undefined>;
   deleteClone: (id: string) => Promise<void>;
   loadUsageStats: () => Promise<void>;
@@ -173,6 +176,43 @@ export const useAgentStore = create<AgentStore>((set, get) => ({
     }
   },
 
+  createFromTemplate: async (template: AgentTemplateFull) => {
+    const client = getClient();
+    if (!client) return undefined;
+
+    set({ isLoading: true, error: null });
+    try {
+      const result = await client.createClone({
+        name: template.name,
+        emoji: template.emoji,
+        personality: template.personality,
+        scenarios: template.scenarios,
+        communicationStyle: template.communication_style,
+        model: template.model,
+      });
+
+      const cloneId = result?.clone?.id;
+
+      // Persist SOUL.md via identity system
+      if (cloneId && template.soul_content) {
+        try {
+          const { intelligenceClient } = await import('../lib/intelligence-client');
+          await intelligenceClient.identity.updateFile(cloneId, 'soul', template.soul_content);
+        } catch (e) {
+          console.warn('Failed to persist soul_content:', e);
+        }
+      }
+
+      await get().loadClones();
+      return result?.clone;
+    } catch (error) {
+      set({ error: String(error) });
+      return undefined;
+    } finally {
+      set({ isLoading: false });
+    }
+  },
+
   updateClone: async (id: string, updates: Partial<Clone>) => {
     const client = getClient();
     if (!client) {
diff --git a/desktop/src/store/connectionStore.ts b/desktop/src/store/connectionStore.ts
index d8f8fdb..7810060 100644
--- a/desktop/src/store/connectionStore.ts
+++ b/desktop/src/store/connectionStore.ts
@@ -350,6 +350,70 @@ export const useConnectionStore = create<ConnectionStore>((set, get) => {
       try {
         set({ error: null });
 
+        // === Admin Routing Priority ===
+        // Admin-configured llm_routing takes priority over localStorage connectionMode.
+        // This allows admins to force all clients to use relay or local mode.
+        let adminForceLocal = false;
+        try {
+          const storedAccount = JSON.parse(localStorage.getItem('zclaw-saas-account') || '{}');
+          const adminRouting = storedAccount?.account?.llm_routing;
+
+          if (adminRouting === 'relay') {
+            // Force SaaS Relay mode — admin override
+            // Set connection mode to 'saas' so the SaaS relay section below activates
+            localStorage.setItem('zclaw-connection-mode', 'saas');
+            log.debug('Admin llm_routing=relay: forcing SaaS relay mode');
+          } else if (adminRouting === 'local' && isTauriRuntime()) {
+            // Force local Kernel mode — skip SaaS relay entirely
+            adminForceLocal = true;
+            localStorage.setItem('zclaw-connection-mode', 'tauri');
+            log.debug('Admin llm_routing=local: forcing local Kernel mode');
+          }
+        } catch { /* ignore parse errors, fall through to default logic */ }
+
+        // === Internal Kernel Mode: Admin forced local ===
+        // If admin forced local mode, skip directly to Tauri Kernel section
+        if (adminForceLocal) {
+          const kernelClient = getKernelClient();
+          const modelConfig = await getDefaultModelConfigAsync();
+
+          if (!modelConfig) {
+            throw new Error('请先在"模型与 API"设置页面添加自定义模型配置');
+          }
+
+          if (!modelConfig.apiKey) {
+            throw new Error(`模型 ${modelConfig.model} 未配置 API Key，请在"模型与 API"设置页面配置`);
+          }
+
+          kernelClient.setConfig({
+            provider: modelConfig.provider,
+            model: modelConfig.model,
+            apiKey: modelConfig.apiKey,
+            baseUrl: modelConfig.baseUrl,
+            apiProtocol: modelConfig.apiProtocol,
+          });
+
+          kernelClient.onStateChange = (state: ConnectionState) => {
+            set({ connectionState: state });
+          };
+
+          kernelClient.onLog = (level, message) => {
+            set((s) => ({
+              logs: [...s.logs.slice(-99), { timestamp: Date.now(), level, message }],
+            }));
+          };
+
+          set({ client: kernelClient });
+
+          const { initializeStores } = await import('./index');
+          initializeStores();
+
+          await kernelClient.connect();
+          set({ gatewayVersion: '0.1.0-internal' });
+          log.debug('Connected to internal ZCLAW Kernel (admin forced local)');
+          return;
+        }
+
         // === SaaS Relay Mode ===
         // Check connection mode from localStorage (set by saasStore).
         // When SaaS is unreachable, gracefully degrade to local kernel mode
diff --git a/desktop/src/store/saasStore.ts b/desktop/src/store/saasStore.ts
index 3a1813b..a34dac7 100644
--- a/desktop/src/store/saasStore.ts
+++ b/desktop/src/store/saasStore.ts
@@ -26,6 +26,7 @@ import {
   type SaaSLoginResponse,
   type TotpSetupResponse,
   type SyncConfigRequest,
+  type AgentTemplateAvailable,
 } from '../lib/saas-client';
 import { createLogger } from '../lib/logger';
 import {
@@ -70,6 +71,8 @@ export interface SaaSStateSlice {
   totpSetupData: TotpSetupResponse | null;
   /** Whether SaaS backend is currently reachable */
   saasReachable: boolean;
+  /** Agent templates available for onboarding */
+  availableTemplates: AgentTemplateAvailable[];
   /** Consecutive heartbeat/health-check failures */
   _consecutiveFailures: number;
   _heartbeatTimer?: ReturnType<typeof setInterval>;
@@ -86,6 +89,7 @@ export interface SaaSActionsSlice {
   syncConfigFromSaaS: () => Promise<void>;
   pushConfigToSaaS: () => Promise<void>;
   registerCurrentDevice: () => Promise<void>;
+  fetchAvailableTemplates: () => Promise<void>;
   clearError: () => void;
   restoreSession: () => void;
   setupTotp: () => Promise<TotpSetupResponse>;
@@ -140,6 +144,7 @@ export const useSaaSStore = create<SaaSStore>((set, get) => {
     totpRequired: false,
     totpSetupData: null,
     saasReachable: true,
+    availableTemplates: [],
     _consecutiveFailures: 0,
 
     // === Actions ===
@@ -189,6 +194,11 @@ export const useSaaSStore = create<SaaSStore>((set, get) => {
           log.warn('Failed to register device:', err);
         });
 
+        // Fetch available templates in background (non-blocking)
+        get().fetchAvailableTemplates().catch((err: unknown) => {
+          log.warn('Failed to fetch templates after login:', err);
+        });
+
         // Fetch available models in background (non-blocking)
         get().fetchAvailableModels().catch((err: unknown) => {
           log.warn('Failed to fetch models after login:', err);
@@ -587,6 +597,16 @@ export const useSaaSStore = create<SaaSStore>((set, get) => {
       }
     },
 
+    fetchAvailableTemplates: async () => {
+      try {
+        const templates = await saasClient.fetchAvailableTemplates();
+        set({ availableTemplates: templates });
+      } catch {
+        // Graceful degradation - don't block login
+        set({ availableTemplates: [] });
+      }
+    },
+
     clearError: () => {
       set({ error: null });
     },