diff --git a/gateway/scripts/smoke-e2e.sh b/gateway/scripts/smoke-e2e.sh
new file mode 100755
index 0000000..52f461d
--- /dev/null
+++ b/gateway/scripts/smoke-e2e.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# End-to-end smoke test across LobeChat + Enterprise Gateway.
+# Exit 0 if all checks pass, non-zero otherwise.
+set -u
+
+LC=${LC:-http://localhost:3010}
+GW=${GW:-http://localhost:3001}
+pass=0; fail=0
+declare -a results
+
+check() {
+  local name="$1" ok="$2" detail="$3"
+  if [ "$ok" = "1" ]; then pass=$((pass+1)); results+=("PASS  $name"); echo "PASS  $name"
+  else fail=$((fail+1)); results+=("FAIL  $name -- $detail"); echo "FAIL  $name -- $detail"; fi
+}
+
+# 1. Health probes
+curl -sf "$LC/" -o /dev/null -w "" || true
+code=$(curl -s -o /dev/null -w "%{http_code}" "$GW/health")
+[ "$code" = "200" ] && check "gateway /health 200" 1 "" || check "gateway /health" 0 "got $code"
+
+# 2. Sign-in as admin + capture session
+curl -sL -X POST "$LC/api/auth/sign-in/email" \
+  -H "Content-Type: application/json" -c /tmp/e2e-admin.txt \
+  -d '{"email":"admin@eg.local","password":"Admin@12345"}' -o /tmp/e2e-signin.json -w "" >/dev/null
+token=$(python3 -c "import json;print(json.load(open('/tmp/e2e-signin.json')).get('token',''))" 2>/dev/null)
+[ -n "$token" ] && check "lobechat admin sign-in" 1 "" || check "lobechat admin sign-in" 0 "no token"
+
+# 3. enterprise/me returns is_admin=true
+me=$(curl -sL -b /tmp/e2e-admin.txt "$LC/webapi/enterprise/me")
+echo "$me" | grep -q '"is_admin":true' && check "enterprise/me admin is_admin=true" 1 "" || check "enterprise/me admin" 0 "$me"
+
+# 4. tRPC plugin list contains enterprise-gateway custom plugin
+plist=$(curl -sL -b /tmp/e2e-admin.txt "$LC/trpc/lambda/plugin.getPlugins?input=%7B%22json%22%3Anull%7D")
+echo "$plist" | grep -q 'enterprise-gateway' && check "lobechat plugin.getPlugins has enterprise-gateway" 1 "" || check "plugin.getPlugins" 0 "$plist"
+
+# 5. tRPC provider runtime state contains azure
+prov=$(curl -sL -b /tmp/e2e-admin.txt "$LC/trpc/lambda/aiProvider.getAiProviderRuntimeState?input=%7B%22json%22%3A%7B%7D%7D")
+echo "$prov" | grep -qi 'azure' && check "lobechat aiProvider.getAiProviderRuntimeState has azure" 1 "" || check "provider runtime" 0 "${prov:0:200}"
+
+# 6. Non-admin signup + check 403 on provider mutation
+curl -sL -X POST "$LC/api/auth/sign-up/email" \
+  -H "Content-Type: application/json" -c /tmp/e2e-normal.txt \
+  -d '{"email":"smoke-'$$'@eg.local","password":"Admin@12345","name":"Smoke"}' -o /tmp/e2e-normal.json -w "" >/dev/null || true
+code=$(curl -sL -o /tmp/e2e-mut.json -w "%{http_code}" -X POST -b /tmp/e2e-normal.txt \
+  "$LC/trpc/lambda/aiProvider.createAiProvider" \
+  -H "Content-Type: application/json" \
+  -d '{"json":{"id":"smoke'$$'","name":"Smoke","enabled":true,"source":"custom"}}')
+[ "$code" = "403" ] && check "non-admin aiProvider mutation -> 403" 1 "" || check "non-admin mutation block" 0 "got $code"
+
+# 7. Gateway capabilities (direct) for admin
+cap=$(curl -sL -H "X-Dev-User: sa" "$GW/api/capabilities")
+tools=$(echo "$cap" | python3 -c "import json,sys;print(len(json.load(sys.stdin).get('tools',[])))" 2>/dev/null || echo 0)
+[ "$tools" -ge 10 ] && check "gateway capabilities sa >=10 tools ($tools)" 1 "" || check "capabilities sa tools" 0 "got $tools"
+
+# 8. lobechat plugin manifest (called by LobeChat) is identity-aware
+mfs=$(curl -sL -H "X-Dev-User: sales1" "$GW/api/lobechat/manifest")
+count_sales=$(echo "$mfs" | python3 -c "import json,sys;print(len(json.load(sys.stdin).get('api',[])))" 2>/dev/null || echo 0)
+mfc=$(curl -sL -H "X-Dev-User: cust1" "$GW/api/lobechat/manifest")
+count_cust=$(echo "$mfc" | python3 -c "import json,sys;print(len(json.load(sys.stdin).get('api',[])))" 2>/dev/null || echo 0)
+[ "$count_sales" -gt "$count_cust" ] && check "manifest sales1 ($count_sales) > cust1 ($count_cust)" 1 "" || check "manifest shrink" 0 "sales=$count_sales cust=$count_cust"
+
+echo
+echo "=========================================="
+echo "Summary: pass=$pass fail=$fail"
+echo "=========================================="
+for r in "${results[@]}"; do echo "  $r"; done
+[ "$fail" = "0" ]