feat(diagnosis): add streaming progress support and tunnel-grouped forward list

- Add SSE streaming endpoints for tunnel/forward diagnosis with real-time progress
- Increase diagnosis timeout to 2 minutes with context propagation
- Group forwards by tunnel within user groups in UI
- Add nginx SSE proxy configuration for streaming endpoints

go-backend/internal/http/handler/control_plane.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net"
@@ -42,8 +43,29 @@ type diagnosisWorkItem struct {
 	ipPreference string
 }
 
+type diagnosisExecOptions struct {
+	commandTimeout time.Duration
+	pingTimeoutMS  int
+	timeoutMessage string
+}
+
+type diagnosisProgress struct {
+	Total     int `json:"total"`
+	Completed int `json:"completed"`
+	Success   int `json:"success"`
+	Failed    int `json:"failed"`
+}
+
+type diagnosisItemEmitter func(index int, item map[string]interface{}, progress diagnosisProgress)
+
 const diagnosisMaxConcurrency = 8
 
+const (
+	defaultNodeCommandTimeout = 6 * time.Second
+	diagnosisCommandTimeout   = 2 * time.Minute
+	diagnosisRequestTimeout   = 2 * time.Minute
+)
+
 func (h *Handler) resolveForwardAccess(r *http.Request, forwardID int64) (*forwardRecord, int64, int, error) {
 	userID, roleID, err := userRoleFromRequest(r)
 	if err != nil {
@@ -309,16 +331,23 @@ func (h *Handler) applyNodeProtocolChange(nodeID int64, httpVal, tlsVal, socksVa
 }
 
 func (h *Handler) sendNodeCommand(nodeID int64, commandType string, data interface{}, tolerateExists bool, tolerateNotFound bool) (ws.CommandResult, error) {
+	return h.sendNodeCommandWithTimeout(nodeID, commandType, data, defaultNodeCommandTimeout, tolerateExists, tolerateNotFound)
+}
+
+func (h *Handler) sendNodeCommandWithTimeout(nodeID int64, commandType string, data interface{}, timeout time.Duration, tolerateExists bool, tolerateNotFound bool) (ws.CommandResult, error) {
 	var (
 		result ws.CommandResult
 		err    error
 	)
+	if timeout <= 0 {
+		timeout = defaultNodeCommandTimeout
+	}
 
 	node, nodeErr := h.getNodeRecord(nodeID)
 	if nodeErr == nil && node != nil && node.IsRemote == 1 {
-		result, err = h.sendRemoteNodeCommand(node, commandType, data)
+		result, err = h.sendRemoteNodeCommandWithTimeout(node, commandType, data, timeout)
 	} else {
-		result, err = h.wsServer.SendCommand(nodeID, commandType, data, 6*time.Second)
+		result, err = h.wsServer.SendCommand(nodeID, commandType, data, timeout)
 	}
 	if err == nil {
 		return result, nil
@@ -338,6 +367,10 @@ func (h *Handler) sendNodeCommand(nodeID int64, commandType string, data interfa
 }
 
 func (h *Handler) sendRemoteNodeCommand(node *nodeRecord, commandType string, data interface{}) (ws.CommandResult, error) {
+	return h.sendRemoteNodeCommandWithTimeout(node, commandType, data, 0)
+}
+
+func (h *Handler) sendRemoteNodeCommandWithTimeout(node *nodeRecord, commandType string, data interface{}, timeout time.Duration) (ws.CommandResult, error) {
 	if node == nil {
 		return ws.CommandResult{}, errors.New("节点不存在")
 	}
@@ -348,6 +381,9 @@ func (h *Handler) sendRemoteNodeCommand(node *nodeRecord, commandType string, da
 	}
 
 	fc := client.NewFederationClient()
+	if timeout > 0 {
+		fc = client.NewFederationClientWithTimeout(timeout)
+	}
 	res, err := fc.Command(remoteURL, remoteToken, h.federationLocalDomain(), client.RuntimeNodeCommandRequest{
 		CommandType: commandType,
 		Data:        data,
@@ -375,26 +411,45 @@ func (h *Handler) sendRemoteNodeCommand(node *nodeRecord, commandType string, da
 	return result, nil
 }
 
-func (h *Handler) diagnoseForwardRuntime(forward *forwardRecord) (map[string]interface{}, error) {
+func (h *Handler) diagnoseForwardRuntime(ctx context.Context, forward *forwardRecord) (map[string]interface{}, error) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	forwardName, workItems, err := h.prepareForwardDiagnosis(forward)
+	if err != nil {
+		return nil, err
+	}
+
+	results := h.runDiagnosisWorkItems(ctx, workItems, nil)
+
+	payload := map[string]interface{}{
+		"forwardName": forwardName,
+		"timestamp":   time.Now().UnixMilli(),
+		"results":     results,
+	}
+	return payload, nil
+}
+
+func (h *Handler) prepareForwardDiagnosis(forward *forwardRecord) (string, []diagnosisWorkItem, error) {
 	if forward == nil {
-		return nil, errForwardNotFound
+		return "", nil, errForwardNotFound
 	}
 	targets, err := resolveDiagnosisTargets(forward.RemoteAddr)
 	if err != nil {
-		return nil, err
+		return "", nil, err
 	}
 
 	tunnel, err := h.getTunnelRecord(forward.TunnelID)
 	if err != nil {
-		return nil, err
+		return "", nil, err
 	}
 
 	chainRows, err := h.listChainNodesForTunnel(forward.TunnelID)
 	if err != nil {
-		return nil, err
+		return "", nil, err
 	}
 	if len(chainRows) == 0 {
-		return nil, errors.New("隧道配置不完整")
+		return "", nil, errors.New("隧道配置不完整")
 	}
 
 	ipPreference := h.repo.GetTunnelIPPreference(forward.TunnelID)
@@ -524,36 +579,49 @@ func (h *Handler) diagnoseForwardRuntime(forward *forwardRecord) (map[string]int
 		}
 	}
 
-	results := h.runDiagnosisWorkItems(workItems)
+	return forward.Name, workItems, nil
+}
+
+func (h *Handler) diagnoseTunnelRuntime(ctx context.Context, tunnelID int64) (map[string]interface{}, error) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	tunnelName, tunnelType, workItems, err := h.prepareTunnelDiagnosis(tunnelID)
+	if err != nil {
+		return nil, err
+	}
+
+	results := h.runDiagnosisWorkItems(ctx, workItems, nil)
 
 	payload := map[string]interface{}{
-		"forwardName": forward.Name,
-		"timestamp":   time.Now().UnixMilli(),
-		"results":     results,
+		"tunnelName": tunnelName,
+		"tunnelType": tunnelType,
+		"timestamp":  time.Now().UnixMilli(),
+		"results":    results,
 	}
 	return payload, nil
 }
 
-func (h *Handler) diagnoseTunnelRuntime(tunnelID int64) (map[string]interface{}, error) {
+func (h *Handler) prepareTunnelDiagnosis(tunnelID int64) (string, string, []diagnosisWorkItem, error) {
 	tunnel, err := h.getTunnelRecord(tunnelID)
 	if err != nil {
-		return nil, err
+		return "", "", nil, err
 	}
 
 	tunnelName, err := h.repo.GetTunnelName(tunnelID)
 	if err != nil {
-		return nil, err
+		return "", "", nil, err
 	}
 	if tunnelName == "" {
-		return nil, errors.New("隧道不存在")
+		return "", "", nil, errors.New("隧道不存在")
 	}
 
 	chainRows, err := h.listChainNodesForTunnel(tunnelID)
 	if err != nil {
-		return nil, err
+		return "", "", nil, err
 	}
 	if len(chainRows) == 0 {
-		return nil, errors.New("隧道配置不完整")
+		return "", "", nil, errors.New("隧道配置不完整")
 	}
 
 	ipPreference := h.repo.GetTunnelIPPreference(tunnelID)
@@ -676,15 +744,8 @@ func (h *Handler) diagnoseTunnelRuntime(tunnelID int64) (map[string]interface{},
 		}
 	}
 
-	results := h.runDiagnosisWorkItems(workItems)
-
-	payload := map[string]interface{}{
-		"tunnelName": tunnelName,
-		"tunnelType": map[bool]string{true: "端口转发", false: "隧道转发"}[tunnel.Type == 1],
-		"timestamp":  time.Now().UnixMilli(),
-		"results":    results,
-	}
-	return payload, nil
+	tunnelType := map[bool]string{true: "端口转发", false: "隧道转发"}[tunnel.Type == 1]
+	return tunnelName, tunnelType, workItems, nil
 }
 
 func splitChainNodeGroups(rows []chainNodeRecord) ([]chainNodeRecord, [][]chainNodeRecord, []chainNodeRecord) {
@@ -736,11 +797,85 @@ func resolveDiagnosisTargets(remoteAddr string) ([]diagnosisTarget, error) {
 	return targets, nil
 }
 
-func (h *Handler) runDiagnosisWorkItems(workItems []diagnosisWorkItem) []map[string]interface{} {
+func diagnosisContextMessage(ctx context.Context) string {
+	if ctx == nil {
+		return "诊断超时（2分钟）"
+	}
+	switch ctx.Err() {
+	case context.DeadlineExceeded:
+		return "诊断超时（2分钟）"
+	case context.Canceled:
+		return "诊断已取消"
+	default:
+		return "诊断超时（2分钟）"
+	}
+}
+
+func diagnosisExecOptionsFromContext(ctx context.Context) diagnosisExecOptions {
+	timeout := diagnosisCommandTimeout
+	if ctx != nil {
+		if deadline, ok := ctx.Deadline(); ok {
+			remaining := time.Until(deadline)
+			if remaining <= 0 {
+				remaining = 100 * time.Millisecond
+			}
+			if remaining < timeout {
+				timeout = remaining
+			}
+		}
+	}
+	if timeout <= 0 {
+		timeout = 100 * time.Millisecond
+	}
+	pingTimeoutMS := int(timeout / time.Millisecond)
+	if pingTimeoutMS <= 0 {
+		pingTimeoutMS = 100
+	}
+	return diagnosisExecOptions{
+		commandTimeout: timeout,
+		pingTimeoutMS:  pingTimeoutMS,
+		timeoutMessage: diagnosisContextMessage(ctx),
+	}
+}
+
+func newDiagnosisTimeoutItem(workItem diagnosisWorkItem, message string) map[string]interface{} {
+	targetPort := workItem.targetPort
+	if targetPort <= 0 {
+		targetPort = workItem.toNode.Port
+	}
+	item := newDiagnosisResultItem(workItem.fromNodeID, workItem.targetIP, targetPort, workItem.description, workItem.metadata)
+	item["success"] = false
+	if strings.TrimSpace(message) == "" {
+		message = "诊断超时（2分钟）"
+	}
+	item["message"] = message
+	return item
+}
+
+func (h *Handler) executeDiagnosisWorkItem(workItem diagnosisWorkItem, options diagnosisExecOptions) map[string]interface{} {
+	single := make([]map[string]interface{}, 0, 1)
+	nodeCache := map[int64]*nodeRecord{}
+	if workItem.hasChainHop {
+		h.appendChainHopDiagnosis(&single, nodeCache, workItem.fromNodeID, workItem.toNode, workItem.description, workItem.metadata, workItem.ipPreference, options)
+	} else {
+		h.appendPathDiagnosis(&single, nodeCache, workItem.fromNodeID, workItem.targetIP, workItem.targetPort, workItem.description, workItem.metadata, options)
+	}
+
+	if len(single) == 0 {
+		return newDiagnosisTimeoutItem(workItem, "诊断任务未返回结果")
+	}
+	return single[0]
+}
+
+func (h *Handler) runDiagnosisWorkItems(ctx context.Context, workItems []diagnosisWorkItem, emitter diagnosisItemEmitter) []map[string]interface{} {
+	if ctx == nil {
+		ctx = context.Background()
+	}
 	results := make([]map[string]interface{}, len(workItems))
 	if len(workItems) == 0 {
 		return results
 	}
+
 	workerLimit := diagnosisMaxConcurrency
 	if workerLimit < 1 {
 		workerLimit = 1
@@ -748,35 +883,68 @@ func (h *Handler) runDiagnosisWorkItems(workItems []diagnosisWorkItem) []map[str
 	if workerLimit > len(workItems) {
 		workerLimit = len(workItems)
 	}
-	semaphore := make(chan struct{}, workerLimit)
+
+	type diagnosisWorkResult struct {
+		index int
+		item  map[string]interface{}
+	}
+
+	jobs := make(chan int)
+	resultCh := make(chan diagnosisWorkResult, len(workItems))
 
 	var wg sync.WaitGroup
-	for i := range workItems {
+	for i := 0; i < workerLimit; i++ {
 		wg.Add(1)
-		semaphore <- struct{}{}
-		go func(index int) {
+		go func() {
 			defer wg.Done()
-			defer func() { <-semaphore }()
-
-			workItem := workItems[index]
-			single := make([]map[string]interface{}, 0, 1)
-			nodeCache := map[int64]*nodeRecord{}
-			if workItem.hasChainHop {
-				h.appendChainHopDiagnosis(&single, nodeCache, workItem.fromNodeID, workItem.toNode, workItem.description, workItem.metadata, workItem.ipPreference)
-			} else {
-				h.appendPathDiagnosis(&single, nodeCache, workItem.fromNodeID, workItem.targetIP, workItem.targetPort, workItem.description, workItem.metadata)
+			for index := range jobs {
+				select {
+				case <-ctx.Done():
+					resultCh <- diagnosisWorkResult{index: index, item: newDiagnosisTimeoutItem(workItems[index], diagnosisContextMessage(ctx))}
+					continue
+				default:
+				}
+				options := diagnosisExecOptionsFromContext(ctx)
+				resultCh <- diagnosisWorkResult{index: index, item: h.executeDiagnosisWorkItem(workItems[index], options)}
 			}
-
-			if len(single) == 0 {
-				results[index] = newDiagnosisResultItem(workItem.fromNodeID, workItem.targetIP, workItem.targetPort, workItem.description, workItem.metadata)
-				results[index]["success"] = false
-				results[index]["message"] = "诊断任务未返回结果"
-				return
-			}
-			results[index] = single[0]
-		}(i)
+		}()
 	}
+
+enqueueLoop:
+	for i := 0; i < len(workItems); i++ {
+		select {
+		case <-ctx.Done():
+			message := diagnosisContextMessage(ctx)
+			for j := i; j < len(workItems); j++ {
+				resultCh <- diagnosisWorkResult{index: j, item: newDiagnosisTimeoutItem(workItems[j], message)}
+			}
+			break enqueueLoop
+		case jobs <- i:
+		}
+	}
+	close(jobs)
 	wg.Wait()
+	close(resultCh)
+
+	progress := diagnosisProgress{Total: len(workItems)}
+	for result := range resultCh {
+		results[result.index] = result.item
+		progress.Completed++
+		if asBool(result.item["success"], false) {
+			progress.Success++
+		} else {
+			progress.Failed++
+		}
+		if emitter != nil {
+			emitter(result.index, result.item, progress)
+		}
+	}
+
+	for i := range results {
+		if results[i] == nil {
+			results[i] = newDiagnosisTimeoutItem(workItems[i], "诊断超时（2分钟）")
+		}
+	}
 	return results
 }
 
@@ -821,7 +989,7 @@ func (h *Handler) appendFailedDiagnosis(results *[]map[string]interface{}, nodeC
 	*results = append(*results, item)
 }
 
-func (h *Handler) appendPathDiagnosis(results *[]map[string]interface{}, nodeCache map[int64]*nodeRecord, fromNodeID int64, targetIP string, targetPort int, description string, metadata map[string]interface{}) {
+func (h *Handler) appendPathDiagnosis(results *[]map[string]interface{}, nodeCache map[int64]*nodeRecord, fromNodeID int64, targetIP string, targetPort int, description string, metadata map[string]interface{}, options diagnosisExecOptions) {
 	item := newDiagnosisResultItem(fromNodeID, targetIP, targetPort, description, metadata)
 
 	fromNode, err := h.cachedNode(nodeCache, fromNodeID)
@@ -838,9 +1006,9 @@ func (h *Handler) appendPathDiagnosis(results *[]map[string]interface{}, nodeCac
 		pingErr  error
 	)
 	if fromNode.IsRemote == 1 {
-		pingData, pingErr = h.tcpPingViaRemoteNode(fromNode, targetIP, targetPort)
+		pingData, pingErr = h.tcpPingViaRemoteNode(fromNode, targetIP, targetPort, options)
 	} else {
-		pingData, pingErr = h.tcpPingViaNode(fromNodeID, targetIP, targetPort)
+		pingData, pingErr = h.tcpPingViaNode(fromNodeID, targetIP, targetPort, options)
 	}
 	if pingErr != nil {
 		item["success"] = false
@@ -871,7 +1039,7 @@ func (h *Handler) appendPathDiagnosis(results *[]map[string]interface{}, nodeCac
 	*results = append(*results, item)
 }
 
-func (h *Handler) appendChainHopDiagnosis(results *[]map[string]interface{}, nodeCache map[int64]*nodeRecord, fromNodeID int64, toNode chainNodeRecord, description string, metadata map[string]interface{}, ipPreference string) {
+func (h *Handler) appendChainHopDiagnosis(results *[]map[string]interface{}, nodeCache map[int64]*nodeRecord, fromNodeID int64, toNode chainNodeRecord, description string, metadata map[string]interface{}, ipPreference string, options diagnosisExecOptions) {
 	fromNode, _ := h.cachedNode(nodeCache, fromNodeID)
 	targetNode, err := h.cachedNode(nodeCache, toNode.NodeID)
 	if err != nil {
@@ -883,7 +1051,7 @@ func (h *Handler) appendChainHopDiagnosis(results *[]map[string]interface{}, nod
 		h.appendFailedDiagnosis(results, nodeCache, fromNodeID, strings.Trim(strings.TrimSpace(targetNode.ServerIP), "[]"), toNode.Port, description, metadata, err.Error())
 		return
 	}
-	h.appendPathDiagnosis(results, nodeCache, fromNodeID, targetIP, targetPort, description, metadata)
+	h.appendPathDiagnosis(results, nodeCache, fromNodeID, targetIP, targetPort, description, metadata, options)
 }
 
 func resolveChainProbeTarget(fromNode, targetNode *nodeRecord, preferredPort int, ipPreference string) (string, int, error) {
@@ -936,13 +1104,19 @@ func (h *Handler) listChainNodesForTunnel(tunnelID int64) ([]chainNodeRecord, er
 	return h.repo.ListChainNodesForTunnel(tunnelID)
 }
 
-func (h *Handler) tcpPingViaNode(nodeID int64, ip string, port int) (map[string]interface{}, error) {
-	res, err := h.sendNodeCommand(nodeID, "TcpPing", map[string]interface{}{
+func (h *Handler) tcpPingViaNode(nodeID int64, ip string, port int, options diagnosisExecOptions) (map[string]interface{}, error) {
+	if options.commandTimeout <= 0 {
+		options.commandTimeout = diagnosisCommandTimeout
+	}
+	if options.pingTimeoutMS <= 0 {
+		options.pingTimeoutMS = int(diagnosisCommandTimeout / time.Millisecond)
+	}
+	res, err := h.sendNodeCommandWithTimeout(nodeID, "TcpPing", map[string]interface{}{
 		"ip":      ip,
 		"port":    port,
 		"count":   4,
-		"timeout": 5000,
-	}, false, false)
+		"timeout": options.pingTimeoutMS,
+	}, options.commandTimeout, false, false)
 	if err != nil {
 		return nil, err
 	}
@@ -952,7 +1126,7 @@ func (h *Handler) tcpPingViaNode(nodeID int64, ip string, port int) (map[string]
 	return res.Data, nil
 }
 
-func (h *Handler) tcpPingViaRemoteNode(node *nodeRecord, ip string, port int) (map[string]interface{}, error) {
+func (h *Handler) tcpPingViaRemoteNode(node *nodeRecord, ip string, port int, options diagnosisExecOptions) (map[string]interface{}, error) {
 	if node == nil {
 		return nil, errors.New("节点不存在")
 	}
@@ -961,13 +1135,19 @@ func (h *Handler) tcpPingViaRemoteNode(node *nodeRecord, ip string, port int) (m
 	if remoteURL == "" || remoteToken == "" {
 		return nil, errors.New("远程节点缺少共享配置")
 	}
+	if options.commandTimeout <= 0 {
+		options.commandTimeout = diagnosisCommandTimeout
+	}
+	if options.pingTimeoutMS <= 0 {
+		options.pingTimeoutMS = int(diagnosisCommandTimeout / time.Millisecond)
+	}
 
-	fc := client.NewFederationClient()
+	fc := client.NewFederationClientWithTimeout(options.commandTimeout)
 	return fc.Diagnose(remoteURL, remoteToken, h.federationLocalDomain(), client.RuntimeDiagnoseRequest{
 		IP:      strings.TrimSpace(ip),
 		Port:    port,
 		Count:   4,
-		Timeout: 5000,
+		Timeout: options.pingTimeoutMS,
 	})
 }
 

go-backend/internal/http/handler/diagnosis_stream.go

@@ -0,0 +1,208 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"go-backend/internal/http/response"
+)
+
+type diagnosisStreamEvent struct {
+	Type string      `json:"type"`
+	Data interface{} `json:"data,omitempty"`
+	TS   int64       `json:"ts"`
+}
+
+func prepareDiagnosisStreamResponse(w http.ResponseWriter) (http.Flusher, error) {
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		return nil, errors.New("当前服务不支持流式响应")
+	}
+	w.Header().Set("Content-Type", "application/x-ndjson; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no")
+	return flusher, nil
+}
+
+func writeDiagnosisStreamEvent(encoder *json.Encoder, flusher http.Flusher, eventType string, data interface{}) error {
+	if encoder == nil || flusher == nil {
+		return errors.New("流式响应写入器未初始化")
+	}
+	event := diagnosisStreamEvent{Type: eventType, Data: data, TS: time.Now().UnixMilli()}
+	if err := encoder.Encode(event); err != nil {
+		return err
+	}
+	flusher.Flush()
+	return nil
+}
+
+func summarizeDiagnosisProgress(results []map[string]interface{}) diagnosisProgress {
+	progress := diagnosisProgress{Total: len(results)}
+	for _, item := range results {
+		progress.Completed++
+		if asBool(item["success"], false) {
+			progress.Success++
+		} else {
+			progress.Failed++
+		}
+	}
+	return progress
+}
+
+func shouldIgnoreDiagnosisStreamError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, context.Canceled) {
+		return true
+	}
+	msg := strings.ToLower(strings.TrimSpace(err.Error()))
+	if strings.Contains(msg, "broken pipe") || strings.Contains(msg, "connection reset by peer") {
+		return true
+	}
+	if strings.Contains(msg, "stream already closed") {
+		return true
+	}
+	return false
+}
+
+func (h *Handler) streamDiagnosisRuntime(ctx context.Context, cancel context.CancelFunc, w http.ResponseWriter, startPayload map[string]interface{}, workItems []diagnosisWorkItem) error {
+	flusher, err := prepareDiagnosisStreamResponse(w)
+	if err != nil {
+		return err
+	}
+	encoder := json.NewEncoder(w)
+
+	payload := map[string]interface{}{
+		"total":     len(workItems),
+		"timestamp": time.Now().UnixMilli(),
+	}
+	for key, value := range startPayload {
+		payload[key] = value
+	}
+	if err := writeDiagnosisStreamEvent(encoder, flusher, "start", payload); err != nil {
+		return err
+	}
+
+	streamBroken := false
+	emitter := func(index int, item map[string]interface{}, progress diagnosisProgress) {
+		if streamBroken {
+			return
+		}
+		itemPayload := map[string]interface{}{
+			"index":    index,
+			"result":   item,
+			"progress": progress,
+		}
+		if err := writeDiagnosisStreamEvent(encoder, flusher, "item", itemPayload); err != nil {
+			streamBroken = true
+			if cancel != nil {
+				cancel()
+			}
+		}
+	}
+
+	results := h.runDiagnosisWorkItems(ctx, workItems, emitter)
+	if streamBroken {
+		return context.Canceled
+	}
+
+	progress := summarizeDiagnosisProgress(results)
+	donePayload := map[string]interface{}{
+		"progress": progress,
+		"timedOut": errors.Is(ctx.Err(), context.DeadlineExceeded),
+	}
+	return writeDiagnosisStreamEvent(encoder, flusher, "done", donePayload)
+}
+
+func (h *Handler) tunnelDiagnoseStream(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+	id := asInt64FromBodyKey(r, w, "tunnelId")
+	if id <= 0 {
+		return
+	}
+
+	tunnelName, tunnelType, workItems, err := h.prepareTunnelDiagnosis(id)
+	if err != nil {
+		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不完整") {
+			response.WriteJSON(w, response.ErrDefault(err.Error()))
+			return
+		}
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
+	defer cancel()
+
+	startPayload := map[string]interface{}{
+		"tunnelName": tunnelName,
+		"tunnelType": tunnelType,
+	}
+	if err := h.streamDiagnosisRuntime(ctx, cancel, w, startPayload, workItems); err != nil {
+		if shouldIgnoreDiagnosisStreamError(err) {
+			return
+		}
+		if strings.Contains(err.Error(), "不支持流式响应") {
+			response.WriteJSON(w, response.ErrDefault(err.Error()))
+			return
+		}
+		return
+	}
+}
+
+func (h *Handler) forwardDiagnoseStream(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+	id := asInt64FromBodyKey(r, w, "forwardId")
+	if id <= 0 {
+		return
+	}
+
+	forward, _, _, err := h.resolveForwardAccess(r, id)
+	if err != nil {
+		if errors.Is(err, errForwardNotFound) {
+			response.WriteJSON(w, response.ErrDefault("转发不存在"))
+			return
+		}
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	forwardName, workItems, err := h.prepareForwardDiagnosis(forward)
+	if err != nil {
+		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不能为空") || strings.Contains(err.Error(), "错误") {
+			response.WriteJSON(w, response.ErrDefault(err.Error()))
+			return
+		}
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
+	defer cancel()
+
+	startPayload := map[string]interface{}{
+		"forwardName": forwardName,
+	}
+	if err := h.streamDiagnosisRuntime(ctx, cancel, w, startPayload, workItems); err != nil {
+		if shouldIgnoreDiagnosisStreamError(err) {
+			return
+		}
+		if strings.Contains(err.Error(), "不支持流式响应") {
+			response.WriteJSON(w, response.ErrDefault(err.Error()))
+			return
+		}
+		return
+	}
+}

go-backend/internal/http/handler/federation.go

@@ -1232,16 +1232,20 @@ func (h *Handler) federationRuntimeDiagnose(w http.ResponseWriter, r *http.Reque
 	if req.Count <= 0 {
 		req.Count = 4
 	}
-	if req.Timeout <= 0 {
-		req.Timeout = 5000
+	if req.Timeout <= 0 || req.Timeout > int(diagnosisCommandTimeout/time.Millisecond) {
+		req.Timeout = int(diagnosisCommandTimeout / time.Millisecond)
+	}
+	commandTimeout := time.Duration(req.Timeout) * time.Millisecond
+	if commandTimeout <= 0 || commandTimeout > diagnosisCommandTimeout {
+		commandTimeout = diagnosisCommandTimeout
 	}
 
-	res, err := h.sendNodeCommand(share.NodeID, "TcpPing", map[string]interface{}{
+	res, err := h.sendNodeCommandWithTimeout(share.NodeID, "TcpPing", map[string]interface{}{
 		"ip":      req.IP,
 		"port":    req.Port,
 		"count":   req.Count,
 		"timeout": req.Timeout,
-	}, false, false)
+	}, commandTimeout, false, false)
 	if err != nil {
 		response.WriteJSON(w, response.ErrDefault(err.Error()))
 		return

go-backend/internal/http/handler/handler.go

@@ -134,6 +134,7 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/tunnel/update", h.tunnelUpdate)
 	mux.HandleFunc("/api/v1/tunnel/delete", h.tunnelDelete)
 	mux.HandleFunc("/api/v1/tunnel/diagnose", h.tunnelDiagnose)
+	mux.HandleFunc("/api/v1/tunnel/diagnose/stream", h.tunnelDiagnoseStream)
 	mux.HandleFunc("/api/v1/tunnel/update-order", h.tunnelUpdateOrder)
 	mux.HandleFunc("/api/v1/tunnel/batch-delete", h.tunnelBatchDelete)
 	mux.HandleFunc("/api/v1/tunnel/batch-redeploy", h.tunnelBatchRedeploy)
@@ -149,6 +150,7 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/forward/pause", h.forwardPause)
 	mux.HandleFunc("/api/v1/forward/resume", h.forwardResume)
 	mux.HandleFunc("/api/v1/forward/diagnose", h.forwardDiagnose)
+	mux.HandleFunc("/api/v1/forward/diagnose/stream", h.forwardDiagnoseStream)
 	mux.HandleFunc("/api/v1/forward/update-order", h.forwardUpdateOrder)
 	mux.HandleFunc("/api/v1/forward/batch-delete", h.forwardBatchDelete)
 	mux.HandleFunc("/api/v1/forward/batch-pause", h.forwardBatchPause)

go-backend/internal/http/handler/mutations.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"context"
 	"crypto/rand"
 	"database/sql"
 	"encoding/hex"
@@ -787,7 +788,9 @@ func (h *Handler) tunnelDiagnose(w http.ResponseWriter, r *http.Request) {
 	if id <= 0 {
 		return
 	}
-	result, err := h.diagnoseTunnelRuntime(id)
+	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
+	defer cancel()
+	result, err := h.diagnoseTunnelRuntime(ctx, id)
 	if err != nil {
 		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不完整") {
 			response.WriteJSON(w, response.ErrDefault(err.Error()))
@@ -1399,7 +1402,9 @@ func (h *Handler) forwardDiagnose(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	payload, err := h.diagnoseForwardRuntime(forward)
+	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
+	defer cancel()
+	payload, err := h.diagnoseForwardRuntime(ctx, forward)
 	if err != nil {
 		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不能为空") || strings.Contains(err.Error(), "错误") {
 			response.WriteJSON(w, response.ErrDefault(err.Error()))