diff --git a/ngnix.conf b/ngnix.conf
index 9630316..876fac8 100644
--- a/ngnix.conf
+++ b/ngnix.conf
@@ -6,6 +6,12 @@ map $http_user_agent $badbot {
     ~*(GPTBot|ChatGPT-User|Claude-Web|ClaudeBot|Bytespider|CCBot|Google-Extended) 1;
 }
 
+# WebSocket 升级头透传：客户端带 Upgrade 头（WS 握手）时 Connection 置 upgrade，普通 REST 请求保持 close
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
 # 主站 HTTP（SSL 已在外层 nginx 终结，此处只需 serve 内容）
 server {
     root /usr/share/nginx/html;
@@ -59,6 +65,9 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket 升级头透传（首页会话长连接 /ai-agent/session/wsExecute 依赖握手成功）
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
         proxy_connect_timeout 75s;
         proxy_send_timeout 86400s;
         proxy_read_timeout 86400s;
@@ -203,6 +212,9 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket 升级头透传（首页会话长连接 /ai-agent/session/wsExecute 依赖握手成功）
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
         proxy_connect_timeout 75s;
         proxy_send_timeout 86400s;
         proxy_read_timeout 86400s;