完善分层 AGENTS.md，便于快速定位代码

AGENTS.md

@@ -1,43 +1,66 @@
 # PROJECT KNOWLEDGE BASE
 
-**Generated:** Sat Jan 24 2026
-**Context:** Monorepo for Flux Panel (Traffic Forwarding)
+**Generated:** Mon Feb 02 2026
+**Commit:** 7ca01ab
+**Branch:** beta
 
 ## OVERVIEW
-Flux Panel is a traffic forwarding management system based on [go-gost](https://github.com/go-gost/gost). It manages tunnels, port forwarding, and user quotas.
-**Stack:** Monorepo (Java/Spring Boot Backend + React/Vite Frontend + Go/GOST Service).
+Flux Panel is a traffic forwarding management system built on a forked GOST v3 stack. It ships as Dockerized Spring Boot (admin API) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
 
 ## STRUCTURE
 ```
-/root/flux-panel/
-├── springboot-backend/  # Java 21 + Spring Boot 2.7 Admin API
-├── vite-frontend/       # React 18 + Vite + HeroUI/NextUI
-├── go-gost/             # Go 1.23 + GOST Extensions (Core logic)
-├── docker-compose*.yml  # Deployment configs (v4/v6)
-└── *.sh                 # Install scripts (panel_install.sh, install.sh)
+./
+├── go-gost/               # Go forwarding agent (forked gost + local x/)
+│   └── x/                 # Local fork of github.com/go-gost/x (replace => ./x)
+├── springboot-backend/    # Java/Spring Boot admin API (SQLite/MyBatis)
+├── vite-frontend/         # React/Vite dashboard (HeroUI + Tailwind)
+├── android-app/           # Android WebView wrapper (optional)
+├── ios-app/               # iOS WebView wrapper (optional)
+├── docker-compose-v4.yml  # Panel deploy (IPv4-only bridge)
+├── docker-compose-v6.yml  # Panel deploy (IPv6-enabled bridge)
+├── panel_install.sh       # Panel installer/upgrader (downloads compose)
+├── install.sh             # Node installer/upgrader (downloads gost binary)
+└── .github/workflows/     # CI: build/push images + release artifacts
 ```
 
 ## WHERE TO LOOK
 | Task | Location | Notes |
 |------|----------|-------|
-| **Admin API** | `springboot-backend/` | Users, quotas, billing logic |
-| **UI/Dashboard** | `vite-frontend/` | Management console |
-| **Core Forwarding** | `go-gost/` | GOST implementation & extensions |
-| **Deploy** | `docker-compose-v4.yml` | Container orchestration |
+| **Deploy (Docker)** | `docker-compose-v4.yml` | Env: `JWT_SECRET`, `BACKEND_PORT`, `FRONTEND_PORT` |
+| **Deploy (IPv6)** | `docker-compose-v6.yml` | Same as v4 + IPv6-enabled bridge |
+| **Panel install** | `panel_install.sh` | Picks v4/v6, generates `JWT_SECRET`, downloads compose |
+| **Node install** | `install.sh` | Installs `/etc/flux_agent/flux_agent` + writes `config.json`/`gost.json` + systemd `flux_agent.service` |
+| **Admin API entry** | `springboot-backend/src/main/java/com/admin/AdminApplication.java` | Spring Boot app |
+| **Admin API routes** | `springboot-backend/src/main/java/com/admin/controller/` | Mostly `/api/v1/*` controllers |
+| **Admin auth** | `springboot-backend/src/main/java/com/admin/common/interceptor/JwtInterceptor.java` | Checks `Authorization` header |
+| **Web UI routing** | `vite-frontend/src/App.tsx` | React Router v6 + ProtectedRoute/H5 layouts |
+| **Web UI API client** | `vite-frontend/src/api/network.ts` | Axios `baseURL` + `Authorization` header |
+| **Go agent entry** | `go-gost/main.go` | Reads panel `config.json` + starts gost services |
+| **Go x fork** | `go-gost/x/` | Handlers/listeners/dialers + management API |
 
 ## CONVENTIONS
-- **Monorepo**: 3 distinct languages/stacks. Treat each subdir as a separate project.
-- **Docker**: Primary deployment method.
-- **Scripts**: `panel_install.sh` for panel, `install.sh` for nodes.
+- `Authorization` header carries the raw JWT token (no `Bearer` prefix) between `vite-frontend/` and `springboot-backend/`.
+- `go-gost/` uses `replace github.com/go-gost/x => ./x` and `go-gost/x/` is also its own Go module.
+
+## ANTI-PATTERNS (THIS PROJECT)
+- Do not edit generated protobuf output: `go-gost/x/internal/util/grpc/proto/*.pb.go`, `go-gost/x/internal/util/grpc/proto/*_grpc.pb.go`.
 
 ## COMMANDS
 ```bash
-# Quick Deploy (Panel)
-./panel_install.sh
+# Panel (Docker)
+docker compose -f docker-compose-v4.yml up -d
+docker compose -f docker-compose-v6.yml up -d
 
-# Quick Deploy (Node)
+# Release-based install scripts
+./panel_install.sh
 ./install.sh
 
-# Docker
-docker-compose -f docker-compose-v4.yml up -d
+# Local dev (per subproject)
+(cd springboot-backend && mvn clean package)
+(cd vite-frontend && npm run dev)
+(cd go-gost && go run .)
 ```
+
+## NOTES
+- LSP servers are not installed in this environment (gopls/jdtls/typescript-language-server); rely on grep-based navigation.
+- `vite-frontend/vite.config.ts` sets `minify: false` and disables treeshake; expect larger bundles.

go-gost/AGENTS.md

@@ -1,31 +1,37 @@
 # GO-GOST SERVICE KNOWLEDGE BASE
 
+**Generated:** Mon Feb 02 2026
+
 ## OVERVIEW
-Core forwarding service based on GOST v3.
-**Stack:** Go 1.23, GOST Core v0.3.1, GOST x (Extensions).
+Forwarding agent built on GOST v3 with a local fork of `github.com/go-gost/x` under `x/`.
+**Stack:** Go 1.23, github.com/go-gost/core v0.3.1, local `go-gost/x` module.
 
 ## STRUCTURE
 ```
 go-gost/
-├── main.go           # Entry point
-├── x/                # Local extensions (REPLACES github.com/go-gost/x)
-│   ├── api/          # Management API
-│   ├── registry/     # Service registry
-│   ├── handler/      # Protocol handlers (socks, tunnel, relay)
-│   └── listener/     # Network listeners (tcp, udp, tun/tap)
-└── go.mod            # Defines local replacement
+├── main.go           # Entry; reads panel config.json; starts svc.Run(program)
+├── config.go         # Panel config.json loader (addr/secret + ports)
+├── program.go        # GOST runtime: parse config, run/reload services
+├── x/                # Local fork of github.com/go-gost/x (has its own go.mod)
+└── go.mod            # replace github.com/go-gost/x => ./x
 ```
 
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Panel integration config | `go-gost/config.go` | Expects `config.json` in cwd by default |
+| Service lifecycle/reload | `go-gost/program.go` | Parses config; handles SIGHUP reload |
+| WebSocket reporting | `go-gost/main.go` | Starts reporter + sets HTTP report URL |
+| Protocol behaviors | `go-gost/x/` | Handlers/listeners/dialers live here |
+
 ## CONVENTIONS
-- **Local Replace**: `go.mod` uses `replace github.com/go-gost/x => ./x`.
-- **Extensions**: Custom logic lives in `x/`. This is the primary place for modifications.
-- **Handlers**: Implements SOCKS5, Tunnel, Relay, etc.
+- Two configs exist: panel integration uses `config.json`; forwarding services use GOST config (defaults to `gost.{json,yaml}` via viper search paths).
+- `go-gost/x/` is the primary extension surface; avoid editing vendored deps.
 
 ## COMMANDS
 ```bash
-# Run
+cd go-gost
 go run .
-
-# Build
+go test ./...
 go build .
 ```

go-gost/x/AGENTS.md

@@ -0,0 +1,42 @@
+# GO-GOST/X KNOWLEDGE BASE
+
+## OVERVIEW
+Local fork of `github.com/go-gost/x` used by `go-gost/` via `replace github.com/go-gost/x => ./x`. Most protocol/runtime behavior changes happen here.
+
+## STRUCTURE
+```
+go-gost/x/
+├── api/        # Gin management API + embedded swagger docs
+├── config/     # Config model + parsing/load/reload
+├── connector/  # Outbound connect implementations
+├── dialer/     # Outbound dialers (tcp/tls/ws/quic/...) 
+├── handler/    # Protocol handlers (socks/http/tunnel/relay/...)
+├── listener/   # Inbound listeners (tcp/udp/tun/tap/redirect/...)
+├── limiter/    # Traffic/rate/conn limiters
+├── registry/   # Registries for services/handlers/listeners/etc
+├── service/    # Service wrappers + reporting hooks
+├── socket/     # WebSocket reporter / panel integration
+└── internal/   # Shared internals (grpc proto, net utils, sniffing, tls, ...)
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Management API routes/auth | `go-gost/x/api/api.go` | `/docs`, `/config/*`; BasicAuth + interceptor |
+| Service config parsing | `go-gost/x/config/parsing/` | Converts config to running services |
+| Add a handler | `go-gost/x/handler/` | Per-protocol subdirs |
+| Add a listener/dialer | `go-gost/x/listener/`, `go-gost/x/dialer/` | Transport variants |
+| Panel reporting | `go-gost/x/socket/` | WebSocket + HTTP report URL hooks |
+
+## CONVENTIONS
+- `go-gost/x/` is a standalone Go module (`go-gost/x/go.mod`); run go tooling from this dir when debugging module resolution.
+- Generated gRPC/proto code lives under `go-gost/x/internal/util/grpc/proto/`.
+
+## ANTI-PATTERNS
+- Do not edit generated files in `go-gost/x/internal/util/grpc/proto/` (`*.pb.go`, `*_grpc.pb.go`).
+
+## COMMANDS
+```bash
+cd go-gost/x
+go test ./...
+```

go-gost/x/api/AGENTS.md

@@ -0,0 +1,23 @@
+# GO-GOST/X API KNOWLEDGE BASE
+
+## OVERVIEW
+Gin-based management API for reading/writing config and controlling services at runtime.
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Route registration | `go-gost/x/api/api.go` | `Register(*gin.Engine, *Options)` |
+| Auth gating | `go-gost/x/api/middleware.go` | Drops non-BasicAuth requests; optional auther check |
+| Service CRUD + pause/resume | `go-gost/x/api/config_service.go` | Uses registry + `config.OnUpdate(...)` |
+| Swagger spec | `go-gost/x/api/swagger.yaml` | Served at `/docs` via embedded FS |
+
+## CONVENTIONS
+- CORS is `AllowAllOrigins: true` (see `go-gost/x/api/api.go`).
+- Requests without a valid Basic `Authorization` header are silently dropped (connection hijack + close) by `GlobalInterceptor()`.
+- Many operations mutate the in-memory config via `config.OnUpdate(...)` after starting/stopping services.
+
+## COMMANDS
+```bash
+cd go-gost/x
+go test ./...
+```

go-gost/x/config/AGENTS.md

@@ -0,0 +1,23 @@
+# GO-GOST/X CONFIG KNOWLEDGE BASE
+
+## OVERVIEW
+Config model + parsing/loading pipeline for the `go-gost/x` runtime. This is the bridge between `gost.json`/`gost.yaml` and in-memory registries/services.
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Config structs + global state | `go-gost/x/config/config.go` | `Global()`, `Set()`, `OnUpdate()` |
+| Default config file search | `go-gost/x/config/config.go` | Viper `SetConfigName("gost")` + paths `/etc/gost/`, `$HOME/.gost/`, `.` |
+| Registry wiring | `go-gost/x/config/loader/loader.go` | Parses config sections and registers into registries |
+| Metadata keys | `go-gost/x/config/parsing/parse.go` | `MDKey*` constants used by parsers |
+| Config parser behavior | `go-gost/x/config/parsing/parser/parser.go` | CLI/env overrides; loads `gost.*` when empty |
+
+## CONVENTIONS
+- Default config file is named `gost` (e.g. `gost.json`) and is discovered via viper search paths.
+- Runtime config mutations should go through `config.OnUpdate(...)` so changes are applied under the global mutex.
+
+## COMMANDS
+```bash
+cd go-gost/x
+go test ./...
+```

go-gost/x/dialer/AGENTS.md

@@ -0,0 +1,35 @@
+# GO-GOST/X DIALERS KNOWLEDGE BASE
+
+## OVERVIEW
+Outbound dialers (client-side connection establishment) used by connectors/handlers.
+
+## STRUCTURE
+```
+go-gost/x/dialer/
+├── direct/   # Baseline dialer
+├── tcp/
+├── udp/
+├── tls/
+├── ws/
+├── quic/
+├── http2/
+├── http3/
+├── ssh/
+├── wg/       # WireGuard dialer
+└── ...
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Pick a dialer | `go-gost/x/dialer/` | One subdir per transport |
+| TCP baseline | `go-gost/x/dialer/tcp/dialer.go` | Reference implementation |
+
+## CONVENTIONS
+- Dialer implementations typically live in `dialer.go` with a paired `metadata.go` (e.g. `go-gost/x/dialer/tcp/`).
+
+## COMMANDS
+```bash
+cd go-gost/x
+go test ./...
+```

go-gost/x/handler/AGENTS.md

@@ -0,0 +1,32 @@
+# GO-GOST/X HANDLERS KNOWLEDGE BASE
+
+## OVERVIEW
+Protocol handlers (server-side request handling) used by services defined in the GOST config.
+
+## STRUCTURE
+```
+go-gost/x/handler/
+├── http/     # handler.go + metadata.go (+ udp.go)
+├── socks/    # SOCKS variants
+├── tunnel/   # Tunnel forwarding
+├── relay/    # Relay forwarding
+├── redirect/ # TCP/UDP redirect handlers
+├── router/   # Routing/association entrypoints
+└── ...
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Find a protocol handler | `go-gost/x/handler/` | Subdir per protocol (`http`, `socks`, `tunnel`, ...) |
+| HTTP specifics | `go-gost/x/handler/http/handler.go` | Implements HTTP proxy behavior |
+| SOCKS specifics | `go-gost/x/handler/socks/` | v4/v5 implementations |
+
+## CONVENTIONS
+- Handler implementations typically live in `handler.go` with a paired `metadata.go` (e.g. `go-gost/x/handler/http/`).
+
+## COMMANDS
+```bash
+cd go-gost/x
+go test ./...
+```

go-gost/x/listener/AGENTS.md

@@ -0,0 +1,35 @@
+# GO-GOST/X LISTENERS KNOWLEDGE BASE
+
+## OVERVIEW
+Inbound listeners (transport-level accept loops) used by services defined in the GOST config.
+
+## STRUCTURE
+```
+go-gost/x/listener/
+├── tcp/      # listener.go + metadata.go
+├── udp/
+├── tls/
+├── ws/
+├── quic/
+├── redirect/ # tcp/ + udp/
+├── tun/      # TUN device listener
+├── tap/      # TAP device listener
+└── ...
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Listener registry | `go-gost/x/listener/` | One subdir per transport |
+| TCP baseline | `go-gost/x/listener/tcp/listener.go` | Reference for other transports |
+| Redirect listeners | `go-gost/x/listener/redirect/` | Per-protocol accept + redirect |
+| TUN/TAP | `go-gost/x/listener/tun/`, `go-gost/x/listener/tap/` | Virtual interface listeners |
+
+## CONVENTIONS
+- Listener implementations typically live in `listener.go` with a paired `metadata.go` (e.g. `go-gost/x/listener/tcp/`).
+
+## COMMANDS
+```bash
+cd go-gost/x
+go test ./...
+```

springboot-backend/AGENTS.md

@@ -1,37 +1,39 @@
 # SPRINGBOOT BACKEND KNOWLEDGE BASE
 
+**Generated:** Mon Feb 02 2026
+
 ## OVERVIEW
-Admin API for Flux Panel. Manages users, licenses, and traffic rules.
-**Stack:** Java 21, Spring Boot 2.7.18, SQLite, MyBatis Plus.
+Admin API for Flux Panel. Manages users, tunnels, nodes, forwards, quotas, and speed limits.
+**Stack:** Java 21, Spring Boot 2.7.18, SQLite, MyBatis Plus (+ join), FastJSON2.
 
 ## STRUCTURE
 ```
 springboot-backend/
 ├── src/main/java/com/admin/
-│   ├── controller/      # API Endpoints
-│   ├── entity/          # DB Models (MyBatis Plus)
-│   ├── mapper/          # Data Access
-│   ├── service/         # Business Logic
-│   └── common/          # Utils, DTOs
+│   ├── controller/      # /api/v1/* endpoints
+│   ├── entity/          # DB models
+│   ├── mapper/          # MyBatis Plus mappers
+│   ├── service/         # Business logic
+│   ├── config/          # WebMvc/JWT/CORS/WebSocket config
+│   └── common/          # DTOs, auth, exception handling, utilities
 └── src/main/resources/
-    ├── application.yml  # Config
-    ├── mapper/          # XML Mappers
-    ├── data.sql         # Init data
-    └── bgimages/        # Static resources
+    ├── application.yml  # Config (DB_PATH/JWT_SECRET/LOG_DIR)
+    ├── mapper/          # XML mappers
+    ├── schema.sql       # Schema
+    └── data.sql         # Seed data
 ```
 
 ## CONVENTIONS
-- **DB**: SQLite used via `sqlite-jdbc`.
-- **ORM**: MyBatis Plus + MyBatis Plus Join.
-- **JSON**: FastJSON2 used for serialization.
-- **Utils**: Hutool used extensively.
-- **Auth**: Likely custom or token-based (see `controller` logic).
+- **DB**: SQLite URL is `jdbc:sqlite:${DB_PATH:/app/data/gost.db}` (`springboot-backend/src/main/resources/application.yml`).
+- **Auth**: JWT in `Authorization` header; enforced by `com.admin.common.interceptor.JwtInterceptor` for `/api/**` (with explicit excludes in `com.admin.config.WebMvcConfig`).
+- **Roles**: `@RequireRole` means admin-only (`role_id == 0`) via `com.admin.common.aop.RoleAspect`.
+- **Responses**: Controllers return `com.admin.common.lang.R` (`code == 0` success).
+- **CORS**: Allow-all origins; `Authorization` is exposed (`com.admin.config.WebMvcConfig`).
 
 ## COMMANDS
 ```bash
-# Build
+cd springboot-backend
 mvn clean package
-
-# Run
+mvn test
 java -jar target/admin-0.0.1-SNAPSHOT.jar
 ```

springboot-backend/src/main/java/com/admin/AGENTS.md

@@ -0,0 +1,32 @@
+# SPRINGBOOT BACKEND (com.admin) KNOWLEDGE BASE
+
+## OVERVIEW
+Primary Java code for the admin API. Controllers expose `/api/v1/*` endpoints and return `R` response envelopes.
+
+## STRUCTURE
+```
+springboot-backend/src/main/java/com/admin/
+├── controller/  # REST controllers (e.g., /api/v1/user)
+├── service/     # Business logic interfaces + impl/
+├── mapper/      # MyBatis Plus mappers
+├── entity/      # DB entities
+├── config/      # WebMvc/JWT/CORS/WebSocket config
+└── common/      # DTOs, auth, exception handling, utilities
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| User/login endpoints | `springboot-backend/src/main/java/com/admin/controller/UserController.java` | `/api/v1/user/*` |
+| Auth enforcement | `springboot-backend/src/main/java/com/admin/config/WebMvcConfig.java` | Intercepts `/api/**`, excludes login/config/captcha |
+| JWT validation | `springboot-backend/src/main/java/com/admin/common/interceptor/JwtInterceptor.java` | Requires `Authorization` header |
+| Admin-only ops | `springboot-backend/src/main/java/com/admin/common/annotation/RequireRole.java` | Enforced by `RoleAspect` |
+| Response envelope | `springboot-backend/src/main/java/com/admin/common/lang/R.java` | `code == 0` success |
+| Global error handling | `springboot-backend/src/main/java/com/admin/common/exception/GlobalExceptionHandler.java` | Maps exceptions -> `R.err(...)` |
+
+## CONVENTIONS
+- Controllers are mostly `@PostMapping` (even for list/get/delete) and use `/api/v1/*` prefixes.
+- JWT is custom (no 3p lib) and includes `role_id` in payload (`springboot-backend/src/main/java/com/admin/common/utils/JwtUtil.java`).
+
+## ANTI-PATTERNS
+- Do not change auth header format lightly: frontend expects `Authorization: <token>` (no `Bearer`).

vite-frontend/AGENTS.md

@@ -1,34 +1,36 @@
 # VITE FRONTEND KNOWLEDGE BASE
 
+**Generated:** Mon Feb 02 2026
+
 ## OVERVIEW
 Web management console for Flux Panel.
-**Stack:** React 18, Vite 5, TypeScript, TailwindCSS 4, HeroUI (NextUI).
+**Stack:** React 18, Vite 5, TypeScript, TailwindCSS 4, HeroUI.
 
 ## STRUCTURE
 ```
 vite-frontend/
 ├── src/
-│   ├── pages/        # Route views
+│   ├── pages/        # Route views (some very large single-file pages)
 │   ├── components/   # Reusable UI parts
-│   ├── layouts/      # Page wrappers
-│   ├── api/          # Axios wrappers
-│   ├── config/       # App settings
-│   └── utils/        # Helpers
-├── vite.config.ts    # Vite config (Base: '/')
+│   ├── layouts/      # Admin vs H5 layouts
+│   ├── api/          # API functions + axios wrapper
+│   ├── config/       # Site config (title, repo, version)
+│   └── utils/        # Auth/JWT + WebView helpers
+├── vite.config.ts    # base '/', host 0.0.0.0:3000; build minify/treeshake disabled
+├── eslint.config.mjs  # ESLint 9 flat config
 └── package.json
 ```
 
 ## CONVENTIONS
-- **UI Lib**: HeroUI (formerly NextUI) + Tailwind CSS 4.
-- **Routing**: React Router DOM 6.
-- **State**: Check `provider.tsx` or local state.
-- **Build**: Output to `dist/`.
+- **Routing**: React Router v6 routes in `vite-frontend/src/App.tsx`.
+- **Auth**: JWT stored as `localStorage.token`; sent as `Authorization` header (no prefix) in `vite-frontend/src/api/network.ts`.
+- **Base URL**: Defaults to `/api/v1/` (or `VITE_API_BASE`); WebView mode selects a panel address via `vite-frontend/src/utils/panel.ts`.
+- **UI**: HeroUI provider + theme + toast wired in `vite-frontend/src/provider.tsx`.
 
 ## COMMANDS
 ```bash
-# Dev
+cd vite-frontend
 npm run dev
-
-# Build
 npm run build
+npm run lint
 ```

vite-frontend/src/AGENTS.md

@@ -0,0 +1,38 @@
+# VITE FRONTEND (src) KNOWLEDGE BASE
+
+## OVERVIEW
+React app entry + routing + providers. This is where UI architecture decisions live.
+
+## STRUCTURE
+```
+vite-frontend/src/
+├── main.tsx        # ReactDOM + BrowserRouter + Provider
+├── provider.tsx    # HeroUI + theme + toaster + i18n wrapper
+├── App.tsx         # Routes + ProtectedRoute + H5 layout selection
+├── api/            # Axios wrapper + typed endpoint helpers
+├── pages/          # Route views (large)
+├── layouts/        # Admin/H5 page chrome
+├── components/     # Shared UI components
+├── utils/          # JWT parsing + auth helpers + WebView utilities
+└── styles/         # globals.css
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Route definitions | `vite-frontend/src/App.tsx` | React Router v6 |
+| API client baseURL | `vite-frontend/src/api/network.ts` | `/api/v1/` + token header |
+| Token decoding | `vite-frontend/src/utils/jwt.ts` | Checks `exp` vs now |
+| Role checks | `vite-frontend/src/utils/auth.ts` | `isAdmin()` is `role_id == 0` |
+| WebView integration | `vite-frontend/src/api/network.ts` | Panel address selection in WebView mode |
+
+## CONVENTIONS
+- Token is stored in `localStorage.token` and sent as `Authorization` header (raw token string).
+- H5 mode detection is in `vite-frontend/src/App.tsx` (screen/user-agent/query param `h5=true`).
+
+## COMMANDS
+```bash
+cd vite-frontend
+npm run dev
+npm run lint
+```

vite-frontend/src/api/AGENTS.md

@@ -0,0 +1,16 @@
+# VITE FRONTEND (src/api) KNOWLEDGE BASE
+
+## OVERVIEW
+API client layer. Wraps axios and normalizes backend responses (`{ code, msg, data }`).
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Axios wrapper | `vite-frontend/src/api/network.ts` | Sets `axios.defaults.baseURL`; adds `Authorization` header |
+| BaseURL init (WebView vs web) | `vite-frontend/src/api/network.ts` | WebView mode calls `getPanelAddresses()` |
+| Endpoint functions | `vite-frontend/src/api/index.ts` | Mostly `Network.post("/…")` |
+
+## CONVENTIONS
+- Default baseURL is `/api/v1/` (or `${VITE_API_BASE}/api/v1/`).
+- In WebView mode, baseURL is derived from the selected panel address; if unset, requests return `code: -1` with a “set panel address” message.
+- 401 responses clear localStorage and redirect to `/`.

vite-frontend/src/pages/AGENTS.md

@@ -0,0 +1,30 @@
+# VITE FRONTEND (pages) KNOWLEDGE BASE
+
+## OVERVIEW
+Route views rendered by `vite-frontend/src/App.tsx`. Several pages are large, single-file screens.
+
+## STRUCTURE
+```
+vite-frontend/src/pages/
+├── index.tsx            # Login + captcha flow
+├── dashboard.tsx
+├── forward.tsx          # Large
+├── tunnel.tsx           # Large
+├── node.tsx             # Large
+├── user.tsx             # Large
+├── config.tsx
+├── limit.tsx
+├── profile.tsx
+├── settings.tsx
+└── change-password.tsx
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Login flow | `vite-frontend/src/pages/index.tsx` | Calls `login()` and stores `localStorage.token` |
+| API calls | `vite-frontend/src/api/index.ts` | Thin wrappers around `Network.post` |
+| Token expiration behavior | `vite-frontend/src/api/network.ts` | Clears localStorage + redirects on 401 |
+
+## CONVENTIONS
+- Pages call API wrappers from `vite-frontend/src/api/index.ts` (most endpoints are POST).