---
name: nexus-btpanel-review
description: Use when reviewing or changing Nexus BT/宝塔 panel integration, one-click login, API bootstrap, session keepalive fixes, or BT credential handling.
---

# Nexus BT Panel Review

Use for 宝塔/BT panel integration changes.

## Call chain to map

API one-click login -> btpanel_service -> BT API credential lookup/bootstrap -> SSH bootstrap if needed -> login URL/tmp_token -> panel session behavior.

## Required checks

- Do not log or return BT API keys, session cookies, temporary login tokens, SSH private keys, or passwords.
- One-click login should fail closed for real authentication errors, but best-effort environment repair must not block login unless required for correctness.
- Session keepalive/cleanup repair must be idempotent and throttled; do not restart or rewrite BT panel aggressively without explicit approval.
- Respect existing BT panel services and ports. Do not occupy panel, nginx, redis, or mysql ports.
- Old servers with existing BT API credentials must still receive the session-cleanup TTL check before login.
- Record bootstrap state without storing secrets.

## Regression tests

Cover:

- Existing credentials still trigger throttled TTL check.
- Missing SSH auth does not block login URL generation.
- Failed repair is throttled and retried later.
- Temporary login token TTL remains bounded.
- No secret values appear in returned bootstrap/status payloads.