Merge pull request #46 from Sagit-chu/opencode/jolly-circuit

fix: fix some bugs
Merge branch 'main' into opencode/jolly-circuit
2026-09-28 15:46:38 +08:00 · 2026-02-08 15:28:28 +08:00 · 2026-02-08 15:27:09 +08:00 · 2026-02-08 07:25:35 +00:00 · 2026-02-08 07:21:10 +00:00 · 2026-02-08 07:15:47 +00:00
310 changed files with 9729 additions and 15115 deletions
@@ -28,23 +28,25 @@ jobs:
        run: npm run build

  backend:
-    name: Build Backend
+    name: Build Go Backend
    runs-on: ubuntu-latest
    defaults:
      run:
-        working-directory: springboot-backend
+        working-directory: go-backend
    steps:
      - uses: actions/checkout@v4

-      - name: Setup Java 21
-        uses: actions/setup-java@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
        with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
+          go-version: '1.23'
+          cache-dependency-path: go-backend/go.sum

-      - name: Build with Maven
-        run: mvn clean package -DskipTests
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Build
+        run: go build -v ./...

  agent:
    name: Build Agent
@@ -165,8 +165,8 @@ jobs:
            -t ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION} \
            ./vite-frontend

-  build-java:
-    name: Build & Push Spring Boot Backend
+  build-go-backend:
+    name: Build & Push Go Backend
    needs: check-version
    if: needs.check-version.outputs.should_build == 'true'
    runs-on: ubuntu-latest
@@ -176,22 +176,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

-      - name: Set up JDK and Maven
-        uses: actions/setup-java@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
        with:
-          java-version: 21
-          distribution: 'temurin'
+          go-version: '1.23'

-      - name: Cache Maven dependencies
+      - name: Cache Go dependencies
        uses: actions/cache@v4
        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-backend-${{ hashFiles('go-backend/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-backend-

-      - name: Build Java JAR
-        working-directory: ./springboot-backend
-        run: mvn clean package -DskipTests
+      - name: Download dependencies
+        working-directory: ./go-backend
+        run: go mod download

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -203,7 +204,7 @@ jobs:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Build and push Java Docker images
+      - name: Build and push Go backend Docker images
        run: |
          VERSION="${{ needs.check-version.outputs.version }}"
          OWNER="${{ needs.check-version.outputs.image_owner }}"
@@ -211,13 +212,13 @@ jobs:
          docker buildx build \
            --platform linux/amd64,linux/arm64 \
            --push \
-            -t ${{ env.REGISTRY }}/${OWNER}/springboot-backend:latest \
-            -t ${{ env.REGISTRY }}/${OWNER}/springboot-backend:${VERSION} \
-            ./springboot-backend
+            -t ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:latest \
+            -t ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION} \
+            ./go-backend

  create-release:
    name: Create Release (Tag Only)
-    needs: [check-version, build-gost, build-vite, build-java]
+    needs: [check-version, build-gost, build-vite, build-go-backend]
    if: needs.check-version.outputs.is_tag == 'true'
    runs-on: ubuntu-latest
    permissions:
@@ -252,10 +253,10 @@ jobs:
          cp docker-compose-v6.yml ./artifacts/docker-compose-v6.yml

          # 替换镜像地址为 GHCR
-          sed -i "s|bqlpfy/springboot-backend:[^[:space:]]*|${{ env.REGISTRY }}/${OWNER}/springboot-backend:${VERSION}|g" ./artifacts/docker-compose-v4.yml
-          sed -i "s|bqlpfy/vite-frontend:[^[:space:]]*|${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}|g" ./artifacts/docker-compose-v4.yml
-          sed -i "s|bqlpfy/springboot-backend:[^[:space:]]*|${{ env.REGISTRY }}/${OWNER}/springboot-backend:${VERSION}|g" ./artifacts/docker-compose-v6.yml
-          sed -i "s|bqlpfy/vite-frontend:[^[:space:]]*|${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}|g" ./artifacts/docker-compose-v6.yml
+          sed -i "s|image: .*flux-panel-backend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION}|g" ./artifacts/docker-compose-v4.yml
+          sed -i "s|image: .*vite-frontend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}|g" ./artifacts/docker-compose-v4.yml
+          sed -i "s|image: .*flux-panel-backend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION}|g" ./artifacts/docker-compose-v6.yml
+          sed -i "s|image: .*vite-frontend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}|g" ./artifacts/docker-compose-v6.yml

          # 复制并修改安装脚本
          cp install.sh ./artifacts/install.sh
@@ -294,7 +295,7 @@ jobs:

          \`\`\`bash
          # Backend
-          docker pull ${{ env.REGISTRY }}/${OWNER}/springboot-backend:${VERSION}
+          docker pull ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION}

          # Frontend
          docker pull ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}
@@ -257,4 +257,7 @@ gitee/
 doraemon.jks
 device.id
 commit.sh
-sql/
+sql/
+!go-backend/internal/store/sqlite/sql/
+!go-backend/internal/store/sqlite/sql/schema.sql
+!go-backend/internal/store/sqlite/sql/data.sql
@@ -1,15 +0,0 @@
-*.iml
-.gradle
-/local.properties
-/.idea/caches
-/.idea/libraries
-/.idea/modules.xml
-/.idea/workspace.xml
-/.idea/navEditor.xml
-/.idea/assetWizardSettings.xml
-.DS_Store
-/build
-/captures
-.externalNativeBuild
-.cxx
-local.properties
@@ -1 +0,0 @@
-/build
@@ -1,45 +0,0 @@
-plugins {
-    id 'com.android.application'
-    id 'org.jetbrains.kotlin.android'
-}
-
-android {
-    namespace 'com.flux'
-    compileSdk 34
-
-    defaultConfig {
-        applicationId "com.flux"
-        minSdk 24
-        targetSdk 34
-        versionCode 1
-        versionName "1.0.1"
-
-        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
-    }
-
-    buildTypes {
-        release {
-            minifyEnabled false
-            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
-        }
-    }
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
-    }
-    kotlinOptions {
-        jvmTarget = '1.8'
-    }
-}
-
-dependencies {
-
-    implementation 'androidx.core:core-ktx:1.9.0'
-    implementation 'androidx.appcompat:appcompat:1.7.1'
-    implementation 'com.google.android.material:material:1.12.0'
-    implementation 'androidx.constraintlayout:constraintlayout:2.2.1'
-    implementation 'androidx.webkit:webkit:1.8.0'
-    testImplementation 'junit:junit:4.13.2'
-    androidTestImplementation 'androidx.test.ext:junit:1.3.0'
-    androidTestImplementation 'androidx.test.espresso:espresso-core:3.7.0'
-}
@@ -1,21 +0,0 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
@@ -1,20 +0,0 @@
-{
-  "version": 3,
-  "artifactType": {
-    "type": "APK",
-    "kind": "Directory"
-  },
-  "applicationId": "com.flux",
-  "variantName": "release",
-  "elements": [
-    {
-      "type": "SINGLE",
-      "filters": [],
-      "attributes": [],
-      "versionCode": 1,
-      "versionName": "1.0.1",
-      "outputFile": "app-release.apk"
-    }
-  ],
-  "elementType": "File"
-}
@@ -1,24 +0,0 @@
-package com.flux
-
-import androidx.test.platform.app.InstrumentationRegistry
-import androidx.test.ext.junit.runners.AndroidJUnit4
-
-import org.junit.Test
-import org.junit.runner.RunWith
-
-import org.junit.Assert.*
-
-/**
- * Instrumented test, which will execute on an Android device.
- *
- * See [testing documentation](http://d.android.com/tools/testing).
- */
-@RunWith(AndroidJUnit4::class)
-class ExampleInstrumentedTest {
-    @Test
-    fun useAppContext() {
-        // Context of the app under test.
-        val appContext = InstrumentationRegistry.getInstrumentation().targetContext
-        assertEquals("com.flux", appContext.packageName)
-    }
-}
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    package="com.flux" >
-
-    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
-
-    <application
-        android:allowBackup="true"
-        android:dataExtractionRules="@xml/data_extraction_rules"
-        android:fullBackupContent="@xml/backup_rules"
-        android:icon="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:roundIcon="@mipmap/ic_launcher_round"
-        android:supportsRtl="true"
-        android:theme="@style/Theme.Flux"
-        android:usesCleartextTraffic="true"
-        tools:targetApi="31" >
-        <activity
-            android:name="com.flux.MainActivity"
-            android:exported="true"
-            android:configChanges="uiMode|orientation|screenSize" >
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-        </activity>
-    </application>
-
-</manifest>
@@ -1,214 +0,0 @@
-package com.flux
-
-import androidx.core.content.edit
-import android.graphics.Color
-import android.os.Build
-import android.os.Bundle
-import android.view.View
-import android.view.WindowInsetsController
-import androidx.appcompat.app.AppCompatActivity
-import android.webkit.*
-import android.content.res.Configuration
-import org.json.JSONArray
-import org.json.JSONObject
-
-
-class MainActivity : AppCompatActivity() {
-
-    private lateinit var webView: WebView
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        setContentView(R.layout.activity_main)
-
-        webView = findViewById(R.id.webView)
-        WebView.setWebContentsDebuggingEnabled(true)
-        setupWebView()
-        loadUrl()
-
-        setupSystemBars()
-        setupRootBackground()
-    }
-
-    private fun setupWebView() {
-        val settings = webView.settings
-        settings.javaScriptEnabled = true
-        settings.domStorageEnabled = true
-        settings.databaseEnabled = true
-        settings.loadWithOverviewMode = true
-        settings.useWideViewPort = true
-        settings.setSupportZoom(true)
-        settings.builtInZoomControls = true
-        settings.displayZoomControls = false
-
-        // 隐藏滚动条但不影响滚动
-        webView.isVerticalScrollBarEnabled = false
-        webView.isHorizontalScrollBarEnabled = false
-        webView.scrollBarStyle = View.SCROLLBARS_INSIDE_OVERLAY
-        webView.overScrollMode = View.OVER_SCROLL_NEVER
-
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
-            settings.mixedContentMode = WebSettings.MIXED_CONTENT_ALWAYS_ALLOW
-        }
-
-        val isDarkTheme = resources.configuration.uiMode and
-                Configuration.UI_MODE_NIGHT_MASK ==
-                Configuration.UI_MODE_NIGHT_YES
-
-        webView.setBackgroundColor(if (isDarkTheme) Color.BLACK else Color.WHITE)
-
-
-        // 添加JavaScript接口
-        webView.addJavascriptInterface(object {
-
-            @android.webkit.JavascriptInterface
-            fun getPanelAddresses(callback: String) {
-                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
-                val addresses = sharedPrefs.getString("panel_addresses", "[]")
-                webView.post {
-                    webView.evaluateJavascript("window.$callback($addresses);", null)
-                }
-            }
-
-            @android.webkit.JavascriptInterface
-            fun savePanelAddress(name: String, address: String) {
-                val json = JSONObject()
-                json.put("name", name)
-                json.put("address", address)
-                json.put("inx", false)
-                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
-                val addresses = sharedPrefs.getString("panel_addresses", "[]")
-                val jsonArray = JSONArray(addresses)
-                jsonArray.put(json)
-                sharedPrefs.edit {
-                    putString("panel_addresses", jsonArray.toString())
-                }
-                webView.post {
-                    webView.evaluateJavascript("window.setPanelAddresses(${jsonArray.toString()});", null)
-                }
-            }
-
-            @android.webkit.JavascriptInterface
-            fun setCurrentPanelAddress(name: String) {
-
-                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
-                val addresses = sharedPrefs.getString("panel_addresses", "[]")
-                val jsonArray = JSONArray(addresses)
-                for (i in 0 until jsonArray.length()) {
-                    val obj = jsonArray.getJSONObject(i)
-                    if (name == obj.getString("name")) {
-                        obj.put("inx", true)
-                    }else{
-                        obj.put("inx", false)
-                    }
-                }
-                sharedPrefs.edit {
-                    putString("panel_addresses", jsonArray.toString())
-                }
-                webView.post {
-                    webView.evaluateJavascript("window.setPanelAddresses(${jsonArray.toString()});", null)
-                }
-            }
-
-            @android.webkit.JavascriptInterface
-            fun deletePanelAddress(name: String) {
-                val jsonArray = JSONArray()
-                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
-                val addresses = sharedPrefs.getString("panel_addresses", "[]")
-                val jsonArraya = JSONArray(addresses)
-                for (i in 0 until jsonArraya.length()) {
-                    val obj = jsonArraya.getJSONObject(i)
-                    if (name != obj.getString("name")) {
-                        jsonArray.put(obj)
-                    }
-                }
-                sharedPrefs.edit {
-                    putString("panel_addresses", jsonArray.toString())
-                }
-                webView.post {
-                    webView.evaluateJavascript("window.setPanelAddresses(${jsonArray.toString()});", null)
-                }
-            }
-        }, "JsInterface")
-
-    }
-
-    private fun loadUrl() {
-        //webView.loadUrl("http://192.168.100.9:3000")
-        webView.loadUrl("file:///android_asset/index.html")
-    }
-
-    private fun setupSystemBars() {
-        val isDarkTheme = resources.configuration.uiMode and
-                Configuration.UI_MODE_NIGHT_MASK ==
-                Configuration.UI_MODE_NIGHT_YES
-
-        if (isDarkTheme) {
-            window.statusBarColor = Color.BLACK
-            window.navigationBarColor = Color.BLACK
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-                window.insetsController?.setSystemBarsAppearance(
-                    0,
-                    WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS or
-                            WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS
-                )
-            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                @Suppress("DEPRECATION")
-                window.decorView.systemUiVisibility =
-                    window.decorView.systemUiVisibility and View.SYSTEM_UI_FLAG_LIGHT_STATUS_BAR.inv()
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                    @Suppress("DEPRECATION")
-                    window.decorView.systemUiVisibility =
-                        window.decorView.systemUiVisibility and View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR.inv()
-                }
-            }
-        } else {
-            window.statusBarColor = Color.WHITE
-            window.navigationBarColor = Color.WHITE
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-                window.insetsController?.setSystemBarsAppearance(
-                    WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS or
-                            WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS,
-                    WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS or
-                            WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS
-                )
-            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                @Suppress("DEPRECATION")
-                window.decorView.systemUiVisibility =
-                    window.decorView.systemUiVisibility or View.SYSTEM_UI_FLAG_LIGHT_STATUS_BAR
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                    @Suppress("DEPRECATION")
-                    window.decorView.systemUiVisibility =
-                        window.decorView.systemUiVisibility or View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR
-                }
-            }
-        }
-    }
-
-    override fun onBackPressed() {
-        if (webView.canGoBack()) webView.goBack() else super.onBackPressed()
-    }
-
-    override fun onConfigurationChanged(newConfig: Configuration) {
-        super.onConfigurationChanged(newConfig)
-        setupSystemBars()
-        setupWebViewBackground()
-        setupRootBackground()
-    }
-
-    private fun setupWebViewBackground() {
-        val isDarkTheme = resources.configuration.uiMode and
-                Configuration.UI_MODE_NIGHT_MASK ==
-                Configuration.UI_MODE_NIGHT_YES
-        webView.setBackgroundColor(if (isDarkTheme) Color.BLACK else Color.WHITE)
-    }
-
-    private fun setupRootBackground() {
-        val isDarkTheme = resources.configuration.uiMode and
-                Configuration.UI_MODE_NIGHT_MASK ==
-                Configuration.UI_MODE_NIGHT_YES
-        val rootView = findViewById<View>(android.R.id.content)
-        rootView.setBackgroundColor(if (isDarkTheme) Color.BLACK else Color.WHITE)
-    }
-}
@@ -1,74 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<vector
-    android:height="108dp"
-    android:width="108dp"
-    android:viewportHeight="108"
-    android:viewportWidth="108"
-    xmlns:android="http://schemas.android.com/apk/res/android">
-    <path android:fillColor="#3DDC84"
-          android:pathData="M0,0h108v108h-108z"/>
-    <path android:fillColor="#00000000" android:pathData="M9,0L9,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,0L19,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M29,0L29,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M39,0L39,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M49,0L49,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M59,0L59,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M69,0L69,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M79,0L79,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M89,0L89,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M99,0L99,108"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,9L108,9"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,19L108,19"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,29L108,29"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,39L108,39"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,49L108,49"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,59L108,59"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,69L108,69"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,79L108,79"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,89L108,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M0,99L108,99"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,29L89,29"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,39L89,39"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,49L89,49"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,59L89,59"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,69L89,69"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M19,79L89,79"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M29,19L29,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M39,19L39,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M49,19L49,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M59,19L59,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M69,19L69,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-    <path android:fillColor="#00000000" android:pathData="M79,19L79,89"
-          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
-</vector>
@@ -1,30 +0,0 @@
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:aapt="http://schemas.android.com/aapt"
-    android:width="108dp"
-    android:height="108dp"
-    android:viewportWidth="108"
-    android:viewportHeight="108">
-    <path android:pathData="M31,63.928c0,0 6.4,-11 12.1,-13.1c7.2,-2.6 26,-1.4 26,-1.4l38.1,38.1L107,108.928l-32,-1L31,63.928z">
-        <aapt:attr name="android:fillColor">
-            <gradient
-                android:endX="85.84757"
-                android:endY="92.4963"
-                android:startX="42.9492"
-                android:startY="49.59793"
-                android:type="linear">
-                <item
-                    android:color="#44000000"
-                    android:offset="0.0" />
-                <item
-                    android:color="#00000000"
-                    android:offset="1.0" />
-            </gradient>
-        </aapt:attr>
-    </path>
-    <path
-        android:fillColor="#FFFFFF"
-        android:fillType="nonZero"
-        android:pathData="M65.3,45.828l3.8,-6.6c0.2,-0.4 0.1,-0.9 -0.3,-1.1c-0.4,-0.2 -0.9,-0.1 -1.1,0.3l-3.9,6.7c-6.3,-2.8 -13.4,-2.8 -19.7,0l-3.9,-6.7c-0.2,-0.4 -0.7,-0.5 -1.1,-0.3C38.8,38.328 38.7,38.828 38.9,39.228l3.8,6.6C36.2,49.428 31.7,56.028 31,63.928h46C76.3,56.028 71.8,49.428 65.3,45.828zM43.4,57.328c-0.8,0 -1.5,-0.5 -1.8,-1.2c-0.3,-0.7 -0.1,-1.5 0.4,-2.1c0.5,-0.5 1.4,-0.7 2.1,-0.4c0.7,0.3 1.2,1 1.2,1.8C45.3,56.528 44.5,57.328 43.4,57.328L43.4,57.328zM64.6,57.328c-0.8,0 -1.5,-0.5 -1.8,-1.2s-0.1,-1.5 0.4,-2.1c0.5,-0.5 1.4,-0.7 2.1,-0.4c0.7,0.3 1.2,1 1.2,1.8C66.5,56.528 65.6,57.328 64.6,57.328L64.6,57.328z"
-        android:strokeWidth="1"
-        android:strokeColor="#00000000" />
-</vector>
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<androidx.constraintlayout.widget.ConstraintLayout
-    xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    xmlns:app="http://schemas.android.com/apk/res-auto"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    tools:context=".MainActivity">
-
-    <WebView
-        android:id="@+id/webView"
-        android:layout_width="0dp"
-        android:layout_height="0dp"
-        app:layout_constraintBottom_toBottomOf="parent"
-        app:layout_constraintStart_toStartOf="parent"
-        app:layout_constraintEnd_toEndOf="parent"
-        app:layout_constraintTop_toTopOf="parent" />
-
-</androidx.constraintlayout.widget.ConstraintLayout>
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background"/>
-    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
-</adaptive-icon>
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background"/>
-    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
-</adaptive-icon>
@@ -1,9 +0,0 @@
-<resources xmlns:tools="http://schemas.android.com/tools">
-    <!-- Base application theme. -->
-    <style name="Base.Theme.Flux" parent="Theme.Material3.DayNight.NoActionBar">
-        <!-- Customize your dark theme here. -->
-        <!-- <item name="colorPrimary">@color/my_dark_primary</item> -->
-        <item name="android:statusBarColor">@android:color/transparent</item>
-        <item name="android:navigationBarColor">@android:color/transparent</item>
-    </style>
-</resources>
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <color name="black">#FF000000</color>
-    <color name="white">#FFFFFFFF</color>
-
-</resources>
@@ -1,3 +0,0 @@
-<resources>
-    <string name="app_name">Flux</string>
-</resources>
@@ -1,11 +0,0 @@
-<resources xmlns:tools="http://schemas.android.com/tools">
-    <!-- Base application theme. -->
-    <style name="Base.Theme.Flux" parent="Theme.Material3.DayNight.NoActionBar">
-        <!-- Customize your light theme here. -->
-        <!-- <item name="colorPrimary">@color/my_light_primary</item> -->
-        <item name="android:statusBarColor">@android:color/transparent</item>
-        <item name="android:navigationBarColor">@android:color/transparent</item>
-    </style>
-
-    <style name="Theme.Flux" parent="Base.Theme.Flux" />
-</resources>
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-   Sample backup rules file; uncomment and customize as necessary.
-   See https://developer.android.com/guide/topics/data/autobackup
-   for details.
-   Note: This file is ignored for devices older that API 31
-   See https://developer.android.com/about/versions/12/backup-restore
-->
-<full-backup-content>
-    <!--
-   <include domain="sharedpref" path="."/>
-   <exclude domain="sharedpref" path="device.xml"/>
-->
-</full-backup-content>
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-   Sample data extraction rules file; uncomment and customize as necessary.
-   See https://developer.android.com/about/versions/12/backup-restore#xml-changes
-   for details.
-->
-<data-extraction-rules>
-    <cloud-backup>
-        <!-- TODO: Use <include> and <exclude> to control what is backed up.
-        <include .../>
-        <exclude .../>
-        -->
-    </cloud-backup>
-    <!--
-    <device-transfer>
-        <include .../>
-        <exclude .../>
-    </device-transfer>
-    -->
-</data-extraction-rules>
@@ -1,17 +0,0 @@
-package com.flux
-
-import org.junit.Test
-
-import org.junit.Assert.*
-
-/**
- * Example local unit test, which will execute on the development machine (host).
- *
- * See [testing documentation](http://d.android.com/tools/testing).
- */
-class ExampleUnitTest {
-    @Test
-    fun addition_isCorrect() {
-        assertEquals(4, 2 + 2)
-    }
-}
@@ -1,5 +0,0 @@
-// Top-level build file where you can add configuration options common to all sub-projects/modules.
-plugins {
-    id 'com.android.application' version '8.2.2' apply false
-    id 'org.jetbrains.kotlin.android' version '1.8.0' apply false
-}
@@ -1,23 +0,0 @@
-# Project-wide Gradle settings.
-# IDE (e.g. Android Studio) users:
-# Gradle settings configured through the IDE *will override*
-# any settings specified in this file.
-# For more details on how to configure your build environment visit
-# http://www.gradle.org/docs/current/userguide/build_environment.html
-# Specifies the JVM arguments used for the daemon process.
-# The setting is particularly useful for tweaking memory settings.
-org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
-# When configured, Gradle will run in incubating parallel mode.
-# This option should only be used with decoupled projects. More details, visit
-# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
-# org.gradle.parallel=true
-# AndroidX package structure to make it clearer which packages are bundled with the
-# Android operating system, and which are packaged with your app's APK
-# https://developer.android.com/topic/libraries/support-library/androidx-rn
-android.useAndroidX=true
-# Kotlin code style for this project: "official" or "obsolete":
-kotlin.code.style=official
-# Enables namespacing of each library's R class so that its R class includes only the
-# resources declared in the library itself and none from the library's dependencies,
-# thereby reducing the size of the R class for that library
-android.nonTransitiveRClass=true
@@ -1,6 +0,0 @@
-#Wed Aug 20 09:15:27 CST 2025
-distributionBase=GRADLE_USER_HOME
-distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
-zipStoreBase=GRADLE_USER_HOME
-zipStorePath=wrapper/dists
@@ -1,185 +0,0 @@
-#!/usr/bin/env sh
-
-#
-# Copyright 2015 the original author or authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-##############################################################################
-##
-##  Gradle start up script for UN*X
-##
-##############################################################################
-
-# Attempt to set APP_HOME
-# Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
-done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
-
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
-
-# Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
-
-warn () {
-    echo "$*"
-}
-
-die () {
-    echo
-    echo "$*"
-    echo
-    exit 1
-}
-
-# OS specific support (must be 'true' or 'false').
-cygwin=false
-msys=false
-darwin=false
-nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
-esac
-
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
-
-
-# Determine the Java command to use to start the JVM.
-if [ -n "$JAVA_HOME" ] ; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
-        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
-    else
-        JAVACMD="$JAVA_HOME/bin/java"
-    fi
-    if [ ! -x "$JAVACMD" ] ; then
-        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-fi
-
-# Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
-fi
-
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
-        fi
-        i=`expr $i + 1`
-    done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
-    esac
-fi
-
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
-
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
-
-exec "$JAVACMD" "$@"
@@ -1,89 +0,0 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-
-@if "%DEBUG%" == "" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
-
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
@@ -1,17 +0,0 @@
-pluginManagement {
-    repositories {
-        google()
-        mavenCentral()
-        gradlePluginPortal()
-    }
-}
-dependencyResolutionManagement {
-    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-rootProject.name = "Flux"
-include ':app'
@@ -1,7 +1,7 @@
 services:
  backend:
-    image: ghcr.io/sagit-chu/springboot-backend:${FLUX_VERSION:-latest}
-    container_name: springboot-backend
+    image: ghcr.io/sagit-chu/flux-panel-backend:${FLUX_VERSION:-latest}
+    container_name: flux-panel-backend
    restart: unless-stopped
    logging:
      driver: json-file
@@ -11,7 +11,7 @@ services:
      DB_PATH: /app/data/gost.db
      JWT_SECRET: ${JWT_SECRET}
      LOG_DIR: /app/logs
-      JAVA_OPTS: "-Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Duser.timezone=Asia/Shanghai"
+      SERVER_ADDR: :6365
    ports:
      - "${BACKEND_PORT}:6365"
    volumes:
@@ -26,7 +26,7 @@ services:
      interval: 30s
      timeout: 10s
      retries: 5
-      start_period: 60s
+      start_period: 30s

  frontend:
    image: ghcr.io/sagit-chu/vite-frontend:${FLUX_VERSION:-latest}
@@ -1,7 +1,7 @@
 services:
  backend:
-    image: ghcr.io/sagit-chu/springboot-backend:${FLUX_VERSION:-latest}
-    container_name: springboot-backend
+    image: ghcr.io/sagit-chu/flux-panel-backend:${FLUX_VERSION:-latest}
+    container_name: flux-panel-backend
    restart: unless-stopped
    logging:
      driver: json-file
@@ -11,7 +11,7 @@ services:
      DB_PATH: /app/data/gost.db
      JWT_SECRET: ${JWT_SECRET}
      LOG_DIR: /app/logs
-      JAVA_OPTS: "-Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Duser.timezone=Asia/Shanghai"
+      SERVER_ADDR: :6365
    ports:
      - "${BACKEND_PORT}:6365"
    volumes:
@@ -26,7 +26,7 @@ services:
      interval: 30s
      timeout: 10s
      retries: 5
-      start_period: 60s
+      start_period: 30s

  frontend:
    image: ghcr.io/sagit-chu/vite-frontend:${FLUX_VERSION:-latest}
@@ -0,0 +1,17 @@
+FROM golang:1.23-bookworm AS builder
+WORKDIR /src
+
+COPY go.mod ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /out/paneld ./cmd/paneld
+
+FROM debian:bookworm-slim
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /out/paneld /app/paneld
+
+ENV SERVER_ADDR=:6365
+EXPOSE 6365
+ENTRYPOINT ["/app/paneld"]
@@ -0,0 +1,12 @@
+GO ?= go
+
+.PHONY: test build run
+
+test:
+	$(GO) test ./...
+
+build:
+	$(GO) build ./cmd/paneld
+
+run:
+	SERVER_ADDR=:6365 $(GO) run ./cmd/paneld
@@ -0,0 +1,51 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"go-backend/internal/app"
+	"go-backend/internal/config"
+)
+
+func main() {
+	cfg := config.FromEnv()
+	if cfg.JWTSecret == "" {
+		log.Println("warning: JWT_SECRET is empty")
+	}
+	log.Printf("starting go-backend on %s (db=%s)", cfg.Addr, cfg.DBPath)
+
+	a, err := app.New(cfg)
+	if err != nil {
+		log.Fatalf("failed to create app: %v", err)
+	}
+
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- a.Run()
+	}()
+
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
+
+	select {
+	case sig := <-sigCh:
+		log.Printf("received signal %s, shutting down", sig)
+	case runErr := <-errCh:
+		if runErr != nil && !errors.Is(runErr, http.ErrServerClosed) {
+			log.Fatalf("server stopped unexpectedly: %v", runErr)
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if err := a.Shutdown(ctx); err != nil {
+		log.Fatalf("shutdown failed: %v", err)
+	}
+}
@@ -0,0 +1,23 @@
+module go-backend
+
+go 1.23.0
+
+toolchain go1.24.4
+
+require (
+	github.com/gorilla/websocket v1.5.3
+	modernc.org/sqlite v1.37.1
+)
+
+require (
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	modernc.org/libc v1.65.7 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+)
@@ -0,0 +1,49 @@
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
+modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/fileutil v1.3.1 h1:8vq5fe7jdtEvoCf3Zf9Nm0Q05sH6kGx0Op2CPx1wTC8=
+modernc.org/fileutil v1.3.1/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/libc v1.65.7 h1:Ia9Z4yzZtWNtUIuiPuQ7Qf7kxYrxP1/jeHZzG8bFu00=
+modernc.org/libc v1.65.7/go.mod h1:011EQibzzio/VX3ygj1qGFt5kMjP0lHb0qCW5/D/pQU=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.37.1 h1:EgHJK/FPoqC+q2YBXg7fUmES37pCHFc97sI7zSayBEs=
+modernc.org/sqlite v1.37.1/go.mod h1:XwdRtsE1MpiBcL54+MbKcaDvcuej+IYSMfLN6gSKV8g=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
@@ -0,0 +1,60 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	"go-backend/internal/config"
+	httpserver "go-backend/internal/http"
+	"go-backend/internal/http/handler"
+	"go-backend/internal/store/sqlite"
+)
+
+type App struct {
+	cfg    config.Config
+	server *http.Server
+	repo   *sqlite.Repository
+	h      *handler.Handler
+}
+
+func New(cfg config.Config) (*App, error) {
+	repo, err := sqlite.Open(cfg.DBPath)
+	if err != nil {
+		return nil, fmt.Errorf("open sqlite: %w", err)
+	}
+
+	h := handler.New(repo, cfg.JWTSecret)
+	router := httpserver.NewRouter(h, cfg.JWTSecret)
+
+	s := &http.Server{
+		Addr:              cfg.Addr,
+		Handler:           router,
+		ReadTimeout:       30 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       60 * time.Second,
+	}
+
+	return &App{cfg: cfg, server: s, repo: repo, h: h}, nil
+}
+
+func (a *App) Run() error {
+	if a.h != nil {
+		a.h.StartBackgroundJobs()
+	}
+	return a.server.ListenAndServe()
+}
+
+func (a *App) Shutdown(ctx context.Context) error {
+	if a.h != nil {
+		a.h.StopBackgroundJobs()
+	}
+	shutdownErr := a.server.Shutdown(ctx)
+	closeErr := a.repo.Close()
+	if shutdownErr != nil {
+		return shutdownErr
+	}
+	return closeErr
+}
@@ -0,0 +1,121 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"strconv"
+	"time"
+)
+
+const (
+	algorithm  = "HmacSHA256"
+	expireTime = 90 * 24 * time.Hour
+)
+
+type Claims struct {
+	Sub    string `json:"sub"`
+	Iat    int64  `json:"iat"`
+	Exp    int64  `json:"exp"`
+	User   string `json:"user"`
+	Name   string `json:"name"`
+	RoleID int    `json:"role_id"`
+}
+
+type tokenHeader struct {
+	Alg string `json:"alg"`
+	Typ string `json:"typ"`
+}
+
+func GenerateToken(userID int64, username string, roleID int, secret string) (string, error) {
+	now := time.Now()
+	header := tokenHeader{Alg: algorithm, Typ: "JWT"}
+	claims := Claims{
+		Sub:    strconv.FormatInt(userID, 10),
+		Iat:    now.Unix(),
+		Exp:    now.Add(expireTime).Unix(),
+		User:   username,
+		Name:   username,
+		RoleID: roleID,
+	}
+
+	headerPart, err := encodeJSON(header)
+	if err != nil {
+		return "", err
+	}
+	payloadPart, err := encodeJSON(claims)
+	if err != nil {
+		return "", err
+	}
+	sig := sign(headerPart+"."+payloadPart, secret)
+
+	return headerPart + "." + payloadPart + "." + sig, nil
+}
+
+func ValidateToken(token, secret string) (Claims, bool) {
+	claims, err := ParseClaims(token, secret)
+	if err != nil {
+		return Claims{}, false
+	}
+	return claims, true
+}
+
+func ParseClaims(token, secret string) (Claims, error) {
+	parts := splitToken(token)
+	if len(parts) != 3 {
+		return Claims{}, errors.New("invalid token")
+	}
+
+	signedContent := parts[0] + "." + parts[1]
+	expected := sign(signedContent, secret)
+	if !hmac.Equal([]byte(expected), []byte(parts[2])) {
+		return Claims{}, errors.New("invalid signature")
+	}
+
+	payloadBytes, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return Claims{}, err
+	}
+
+	var claims Claims
+	if err := json.Unmarshal(payloadBytes, &claims); err != nil {
+		return Claims{}, err
+	}
+
+	if claims.Exp <= time.Now().Unix() {
+		return Claims{}, errors.New("token expired")
+	}
+
+	return claims, nil
+}
+
+func splitToken(token string) []string {
+	parts := make([]string, 0, 3)
+	current := ""
+	for i := 0; i < len(token); i++ {
+		if token[i] == '.' {
+			parts = append(parts, current)
+			current = ""
+			continue
+		}
+		current += string(token[i])
+	}
+	parts = append(parts, current)
+	return parts
+}
+
+func encodeJSON(v interface{}) (string, error) {
+	raw, err := json.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(raw), nil
+}
+
+func sign(content, secret string) string {
+	h := hmac.New(sha256.New, []byte(secret))
+	h.Write([]byte(content))
+	return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
+}
@@ -0,0 +1,28 @@
+package config
+
+import "os"
+
+type Config struct {
+	Addr      string
+	DBPath    string
+	JWTSecret string
+	LogDir    string
+}
+
+func FromEnv() Config {
+	cfg := Config{
+		Addr:      getEnv("SERVER_ADDR", ":6365"),
+		DBPath:    getEnv("DB_PATH", "/app/data/gost.db"),
+		JWTSecret: getEnv("JWT_SECRET", ""),
+		LogDir:    getEnv("LOG_DIR", "/app/logs"),
+	}
+
+	return cfg
+}
+
+func getEnv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
@@ -0,0 +1,55 @@
+package handler
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestBuildForwardControlServiceNamesPauseResume(t *testing.T) {
+	base := "12_34_56"
+	want := []string{base + "_tcp", base + "_udp"}
+
+	for _, command := range []string{"PauseService", "ResumeService"} {
+		got := buildForwardControlServiceNames(base, command)
+		if !reflect.DeepEqual(got, want) {
+			t.Fatalf("command %s expected %v, got %v", command, want, got)
+		}
+	}
+}
+
+func TestBuildForwardControlServiceNamesDelete(t *testing.T) {
+	base := "12_34_56"
+	want := []string{base, base + "_tcp", base + "_udp"}
+	got := buildForwardControlServiceNames(base, " DeleteService ")
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("expected %v, got %v", want, got)
+	}
+}
+
+func TestBuildForwardServiceBaseCandidates(t *testing.T) {
+	got := buildForwardServiceBaseCandidates(12, 34, 56, []int64{56, 78, 90})
+	want := []string{"12_34_56", "12_34_78", "12_34_90", "12_34_0"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("expected %v, got %v", want, got)
+	}
+}
+
+func TestBuildForwardServiceBaseCandidatesWithZeroPreferred(t *testing.T) {
+	got := buildForwardServiceBaseCandidates(12, 34, 0, []int64{78, 0, 90})
+	want := []string{"12_34_0", "12_34_78", "12_34_90"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("expected %v, got %v", want, got)
+	}
+}
+
+func TestShouldTryLegacySingleService(t *testing.T) {
+	if !shouldTryLegacySingleService("PauseService") {
+		t.Fatalf("PauseService should require legacy fallback")
+	}
+	if !shouldTryLegacySingleService("resumeService") {
+		t.Fatalf("ResumeService should require legacy fallback")
+	}
+	if shouldTryLegacySingleService("DeleteService") {
+		t.Fatalf("DeleteService should not require legacy fallback")
+	}
+}
@@ -0,0 +1,338 @@
+package handler
+
+import (
+	"database/sql"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const bytesPerGB int64 = 1024 * 1024 * 1024
+
+type userTunnelPolicy struct {
+	ID       int64
+	UserID   int64
+	TunnelID int64
+	Flow     int64
+	InFlow   int64
+	OutFlow  int64
+	ExpTime  int64
+	Status   int
+}
+
+type gostConfigSnapshot struct {
+	Services []namedConfigItem `json:"services"`
+	Chains   []namedConfigItem `json:"chains"`
+	Limiters []namedConfigItem `json:"limiters"`
+}
+
+type namedConfigItem struct {
+	Name string `json:"name"`
+}
+
+func (h *Handler) processFlowItem(item flowItem) {
+	serviceName := strings.TrimSpace(item.N)
+	if serviceName == "" || serviceName == "web_api" {
+		return
+	}
+
+	forwardID, userID, userTunnelID, ok := parseFlowServiceIDs(serviceName)
+	if !ok {
+		return
+	}
+
+	inFlow, outFlow := h.scaleFlowByTunnel(forwardID, item.D, item.U)
+	_ = h.repo.AddFlow(forwardID, userID, userTunnelID, inFlow, outFlow)
+
+	if userTunnelID > 0 {
+		h.enforceFlowPolicies(userID, userTunnelID)
+	}
+}
+
+func parseFlowServiceIDs(serviceName string) (int64, int64, int64, bool) {
+	parts := strings.Split(serviceName, "_")
+	if len(parts) < 3 {
+		return 0, 0, 0, false
+	}
+
+	forwardID, err1 := strconv.ParseInt(parts[0], 10, 64)
+	userID, err2 := strconv.ParseInt(parts[1], 10, 64)
+	userTunnelID, err3 := strconv.ParseInt(parts[2], 10, 64)
+	if err1 != nil || err2 != nil || err3 != nil || forwardID <= 0 || userID <= 0 {
+		return 0, 0, 0, false
+	}
+
+	return forwardID, userID, userTunnelID, true
+}
+
+func (h *Handler) scaleFlowByTunnel(forwardID int64, inFlow int64, outFlow int64) (int64, int64) {
+	forward, err := h.getForwardRecord(forwardID)
+	if err != nil || forward == nil {
+		return inFlow, outFlow
+	}
+
+	tunnel, err := h.getTunnelRecord(forward.TunnelID)
+	if err != nil || tunnel == nil {
+		return inFlow, outFlow
+	}
+
+	scaledIn := int64(float64(inFlow)*tunnel.TrafficRatio) * tunnel.Flow
+	scaledOut := int64(float64(outFlow)*tunnel.TrafficRatio) * tunnel.Flow
+	return scaledIn, scaledOut
+}
+
+func (h *Handler) enforceFlowPolicies(userID int64, userTunnelID int64) {
+	now := time.Now().UnixMilli()
+
+	if h.shouldPauseUser(userID, now) {
+		h.pauseUserForwards(userID, now)
+	}
+
+	policy, err := h.getUserTunnelPolicy(userTunnelID)
+	if err != nil || policy == nil {
+		return
+	}
+
+	if shouldPauseUserTunnel(policy, now) {
+		h.pauseUserTunnelForwards(policy.UserID, policy.TunnelID, now)
+	}
+}
+
+func (h *Handler) shouldPauseUser(userID int64, now int64) bool {
+	user, err := h.repo.GetUserByID(userID)
+	if err != nil || user == nil {
+		return false
+	}
+
+	flowLimit := user.Flow * bytesPerGB
+	current := user.InFlow + user.OutFlow
+	if flowLimit < current {
+		return true
+	}
+	if user.ExpTime > 0 && user.ExpTime <= now {
+		return true
+	}
+	return user.Status != 1
+}
+
+func shouldPauseUserTunnel(policy *userTunnelPolicy, now int64) bool {
+	if policy == nil {
+		return false
+	}
+
+	flowLimit := policy.Flow * bytesPerGB
+	current := policy.InFlow + policy.OutFlow
+	if current >= flowLimit {
+		return true
+	}
+	if policy.ExpTime > 0 && policy.ExpTime <= now {
+		return true
+	}
+	return policy.Status != 1
+}
+
+func (h *Handler) getUserTunnelPolicy(userTunnelID int64) (*userTunnelPolicy, error) {
+	if userTunnelID <= 0 {
+		return nil, nil
+	}
+
+	row := h.repo.DB().QueryRow(`
+		SELECT id, user_id, tunnel_id, flow, in_flow, out_flow, exp_time, status
+		FROM user_tunnel
+		WHERE id = ?
+		LIMIT 1
+	`, userTunnelID)
+
+	var policy userTunnelPolicy
+	if err := row.Scan(&policy.ID, &policy.UserID, &policy.TunnelID, &policy.Flow, &policy.InFlow, &policy.OutFlow, &policy.ExpTime, &policy.Status); err != nil {
+		if err == sql.ErrNoRows {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &policy, nil
+}
+
+func (h *Handler) pauseUserForwards(userID int64, now int64) {
+	forwards, err := h.listActiveForwardsByUser(userID)
+	if err != nil {
+		return
+	}
+	h.pauseForwardRecords(forwards, now)
+}
+
+func (h *Handler) pauseUserTunnelForwards(userID int64, tunnelID int64, now int64) {
+	forwards, err := h.listActiveForwardsByUserTunnel(userID, tunnelID)
+	if err != nil {
+		return
+	}
+	h.pauseForwardRecords(forwards, now)
+}
+
+func (h *Handler) pauseForwardRecords(forwards []forwardRecord, now int64) {
+	for i := range forwards {
+		forward := forwards[i]
+		_ = h.controlForwardServices(&forward, "PauseService", false)
+		_, _ = h.repo.DB().Exec(`UPDATE forward SET status = 0, updated_time = ? WHERE id = ?`, now, forward.ID)
+	}
+}
+
+func (h *Handler) listActiveForwardsByUser(userID int64) ([]forwardRecord, error) {
+	rows, err := h.repo.DB().Query(`
+		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, strategy, status
+		FROM forward
+		WHERE user_id = ? AND status = 1
+		ORDER BY id ASC
+	`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanForwardRecords(rows)
+}
+
+func (h *Handler) listActiveForwardsByUserTunnel(userID int64, tunnelID int64) ([]forwardRecord, error) {
+	rows, err := h.repo.DB().Query(`
+		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, strategy, status
+		FROM forward
+		WHERE user_id = ? AND tunnel_id = ? AND status = 1
+		ORDER BY id ASC
+	`, userID, tunnelID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanForwardRecords(rows)
+}
+
+func scanForwardRecords(rows *sql.Rows) ([]forwardRecord, error) {
+	out := make([]forwardRecord, 0)
+	for rows.Next() {
+		var record forwardRecord
+		if err := rows.Scan(&record.ID, &record.UserID, &record.UserName, &record.Name, &record.TunnelID, &record.RemoteAddr, &record.Strategy, &record.Status); err != nil {
+			return nil, err
+		}
+		if strings.TrimSpace(record.Strategy) == "" {
+			record.Strategy = "fifo"
+		}
+		out = append(out, record)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (h *Handler) cleanNodeConfigs(nodeID int64, rawConfig string) {
+	if h == nil || h.repo == nil || h.repo.DB() == nil || nodeID <= 0 {
+		return
+	}
+	if strings.TrimSpace(rawConfig) == "" {
+		return
+	}
+
+	var snapshot gostConfigSnapshot
+	if err := json.Unmarshal([]byte(rawConfig), &snapshot); err != nil {
+		return
+	}
+
+	h.cleanOrphanedServices(nodeID, snapshot.Services)
+	h.cleanOrphanedChains(nodeID, snapshot.Chains)
+	h.cleanOrphanedLimiters(nodeID, snapshot.Limiters)
+}
+
+func (h *Handler) cleanOrphanedServices(nodeID int64, services []namedConfigItem) {
+	for _, item := range services {
+		name := strings.TrimSpace(item.Name)
+		if name == "" || name == "web_api" {
+			continue
+		}
+
+		parts := strings.Split(name, "_")
+		if len(parts) >= 3 {
+			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
+			if err == nil && forwardID > 0 && !h.forwardExists(forwardID) {
+				_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{name, parts[0] + "_" + parts[1] + "_" + parts[2], parts[0] + "_" + parts[1] + "_" + parts[2] + "_tcp", parts[0] + "_" + parts[1] + "_" + parts[2] + "_udp"}}, false, true)
+				continue
+			}
+		}
+		suffix := parts[len(parts)-1]
+
+		switch suffix {
+		case "tls":
+			tunnelID, err := strconv.ParseInt(parts[0], 10, 64)
+			if err != nil || tunnelID <= 0 || h.tunnelExists(tunnelID) {
+				continue
+			}
+			_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{name}}, false, true)
+		case "tcp":
+			if len(parts) < 4 {
+				continue
+			}
+			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
+			if err != nil || forwardID <= 0 || h.forwardExists(forwardID) {
+				continue
+			}
+			base := strings.TrimSuffix(name, "_tcp")
+			_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{base + "_tcp", base + "_udp"}}, false, true)
+		}
+	}
+}
+
+func (h *Handler) cleanOrphanedChains(nodeID int64, chains []namedConfigItem) {
+	for _, item := range chains {
+		name := strings.TrimSpace(item.Name)
+		if name == "" {
+			continue
+		}
+
+		idx := strings.LastIndex(name, "_")
+		if idx <= 0 || idx >= len(name)-1 {
+			continue
+		}
+		tunnelID, err := strconv.ParseInt(name[idx+1:], 10, 64)
+		if err != nil || tunnelID <= 0 || h.tunnelExists(tunnelID) {
+			continue
+		}
+		_, _ = h.sendNodeCommand(nodeID, "DeleteChains", map[string]interface{}{"chain": name}, false, true)
+	}
+}
+
+func (h *Handler) cleanOrphanedLimiters(nodeID int64, limiters []namedConfigItem) {
+	for _, item := range limiters {
+		name := strings.TrimSpace(item.Name)
+		if name == "" || h.speedLimiterExists(name) {
+			continue
+		}
+		_, _ = h.sendNodeCommand(nodeID, "DeleteLimiters", map[string]interface{}{"limiter": name}, false, true)
+	}
+}
+
+func (h *Handler) tunnelExists(tunnelID int64) bool {
+	var count int
+	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM tunnel WHERE id = ?`, tunnelID).Scan(&count)
+	return err == nil && count > 0
+}
+
+func (h *Handler) forwardExists(forwardID int64) bool {
+	var count int
+	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM forward WHERE id = ?`, forwardID).Scan(&count)
+	return err == nil && count > 0
+}
+
+func (h *Handler) speedLimiterExists(name string) bool {
+	if name == "" {
+		return false
+	}
+	id, err := strconv.ParseInt(name, 10, 64)
+	if err != nil || id <= 0 {
+		return false
+	}
+
+	var count int
+	err = h.repo.DB().QueryRow(`SELECT COUNT(1) FROM speed_limit WHERE id = ?`, id).Scan(&count)
+	return err == nil && count > 0
+}
@@ -0,0 +1,988 @@
+package handler
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/middleware"
+	"go-backend/internal/http/response"
+	"go-backend/internal/security"
+	"go-backend/internal/store/sqlite"
+	"go-backend/internal/ws"
+)
+
+type Handler struct {
+	repo      *sqlite.Repository
+	jwtSecret string
+	wsServer  *ws.Server
+
+	jobsMu      sync.Mutex
+	jobsCancel  context.CancelFunc
+	jobsStarted bool
+	jobsWG      sync.WaitGroup
+}
+
+type loginRequest struct {
+	Username  string `json:"username"`
+	Password  string `json:"password"`
+	CaptchaID string `json:"captchaId"`
+}
+
+type nameRequest struct {
+	Name string `json:"name"`
+}
+
+type configSingleRequest struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+type changePasswordRequest struct {
+	NewUsername     string `json:"newUsername"`
+	CurrentPassword string `json:"currentPassword"`
+	NewPassword     string `json:"newPassword"`
+	ConfirmPassword string `json:"confirmPassword"`
+}
+
+type flowItem struct {
+	N string `json:"n"`
+	U int64  `json:"u"`
+	D int64  `json:"d"`
+}
+
+func New(repo *sqlite.Repository, jwtSecret string) *Handler {
+	return &Handler{
+		repo:      repo,
+		jwtSecret: jwtSecret,
+		wsServer:  ws.NewServer(repo, jwtSecret),
+	}
+}
+
+func (h *Handler) WebSocketHandler() http.Handler {
+	return h.wsServer
+}
+
+func (h *Handler) Register(mux *http.ServeMux) {
+	mux.HandleFunc("/api/v1/user/login", h.login)
+	mux.HandleFunc("/api/v1/user/list", h.userList)
+	mux.HandleFunc("/api/v1/user/create", h.userCreate)
+	mux.HandleFunc("/api/v1/user/update", h.userUpdate)
+	mux.HandleFunc("/api/v1/user/delete", h.userDelete)
+	mux.HandleFunc("/api/v1/user/reset", h.userResetFlow)
+	mux.HandleFunc("/api/v1/config/get", h.getConfigByName)
+	mux.HandleFunc("/api/v1/config/list", h.getConfigs)
+	mux.HandleFunc("/api/v1/config/update", h.updateConfigs)
+	mux.HandleFunc("/api/v1/config/update-single", h.updateSingleConfig)
+	mux.HandleFunc("/api/v1/captcha/check", h.checkCaptcha)
+	mux.HandleFunc("/api/v1/user/package", h.userPackage)
+	mux.HandleFunc("/api/v1/user/updatePassword", h.updatePassword)
+	mux.HandleFunc("/api/v1/node/list", h.nodeList)
+	mux.HandleFunc("/api/v1/node/create", h.nodeCreate)
+	mux.HandleFunc("/api/v1/node/update", h.nodeUpdate)
+	mux.HandleFunc("/api/v1/node/delete", h.nodeDelete)
+	mux.HandleFunc("/api/v1/node/install", h.nodeInstall)
+	mux.HandleFunc("/api/v1/node/update-order", h.nodeUpdateOrder)
+	mux.HandleFunc("/api/v1/node/batch-delete", h.nodeBatchDelete)
+	mux.HandleFunc("/api/v1/node/check-status", h.nodeCheckStatus)
+	mux.HandleFunc("/api/v1/tunnel/list", h.tunnelList)
+	mux.HandleFunc("/api/v1/tunnel/create", h.tunnelCreate)
+	mux.HandleFunc("/api/v1/tunnel/get", h.tunnelGet)
+	mux.HandleFunc("/api/v1/tunnel/update", h.tunnelUpdate)
+	mux.HandleFunc("/api/v1/tunnel/delete", h.tunnelDelete)
+	mux.HandleFunc("/api/v1/tunnel/diagnose", h.tunnelDiagnose)
+	mux.HandleFunc("/api/v1/tunnel/update-order", h.tunnelUpdateOrder)
+	mux.HandleFunc("/api/v1/tunnel/batch-delete", h.tunnelBatchDelete)
+	mux.HandleFunc("/api/v1/tunnel/batch-redeploy", h.tunnelBatchRedeploy)
+	mux.HandleFunc("/api/v1/tunnel/user/assign", h.userTunnelAssign)
+	mux.HandleFunc("/api/v1/tunnel/user/batch-assign", h.userTunnelBatchAssign)
+	mux.HandleFunc("/api/v1/tunnel/user/remove", h.userTunnelRemove)
+	mux.HandleFunc("/api/v1/tunnel/user/update", h.userTunnelUpdate)
+	mux.HandleFunc("/api/v1/forward/list", h.forwardList)
+	mux.HandleFunc("/api/v1/forward/create", h.forwardCreate)
+	mux.HandleFunc("/api/v1/forward/update", h.forwardUpdate)
+	mux.HandleFunc("/api/v1/forward/delete", h.forwardDelete)
+	mux.HandleFunc("/api/v1/forward/force-delete", h.forwardForceDelete)
+	mux.HandleFunc("/api/v1/forward/pause", h.forwardPause)
+	mux.HandleFunc("/api/v1/forward/resume", h.forwardResume)
+	mux.HandleFunc("/api/v1/forward/diagnose", h.forwardDiagnose)
+	mux.HandleFunc("/api/v1/forward/update-order", h.forwardUpdateOrder)
+	mux.HandleFunc("/api/v1/forward/batch-delete", h.forwardBatchDelete)
+	mux.HandleFunc("/api/v1/forward/batch-pause", h.forwardBatchPause)
+	mux.HandleFunc("/api/v1/forward/batch-resume", h.forwardBatchResume)
+	mux.HandleFunc("/api/v1/forward/batch-redeploy", h.forwardBatchRedeploy)
+	mux.HandleFunc("/api/v1/forward/batch-change-tunnel", h.forwardBatchChangeTunnel)
+	mux.HandleFunc("/api/v1/speed-limit/list", h.speedLimitList)
+	mux.HandleFunc("/api/v1/speed-limit/create", h.speedLimitCreate)
+	mux.HandleFunc("/api/v1/speed-limit/update", h.speedLimitUpdate)
+	mux.HandleFunc("/api/v1/speed-limit/delete", h.speedLimitDelete)
+	mux.HandleFunc("/api/v1/speed-limit/tunnels", h.tunnelList)
+	mux.HandleFunc("/api/v1/tunnel/user/tunnel", h.userTunnelVisibleList)
+	mux.HandleFunc("/api/v1/tunnel/user/list", h.userTunnelList)
+	mux.HandleFunc("/api/v1/group/tunnel/list", h.tunnelGroupList)
+	mux.HandleFunc("/api/v1/group/tunnel/create", h.groupTunnelCreate)
+	mux.HandleFunc("/api/v1/group/tunnel/update", h.groupTunnelUpdate)
+	mux.HandleFunc("/api/v1/group/tunnel/delete", h.groupTunnelDelete)
+	mux.HandleFunc("/api/v1/group/tunnel/assign", h.groupTunnelAssign)
+	mux.HandleFunc("/api/v1/group/user/list", h.userGroupList)
+	mux.HandleFunc("/api/v1/group/user/create", h.groupUserCreate)
+	mux.HandleFunc("/api/v1/group/user/update", h.groupUserUpdate)
+	mux.HandleFunc("/api/v1/group/user/delete", h.groupUserDelete)
+	mux.HandleFunc("/api/v1/group/user/assign", h.groupUserAssign)
+	mux.HandleFunc("/api/v1/group/permission/list", h.groupPermissionList)
+	mux.HandleFunc("/api/v1/group/permission/assign", h.groupPermissionAssign)
+	mux.HandleFunc("/api/v1/group/permission/remove", h.groupPermissionRemove)
+	mux.HandleFunc("/api/v1/open_api/sub_store", h.openAPISubStore)
+
+	mux.HandleFunc("/flow/test", h.flowTest)
+	mux.HandleFunc("/flow/config", h.flowConfig)
+	mux.HandleFunc("/flow/upload", h.flowUpload)
+	mux.HandleFunc("/error", h.errorPage)
+}
+
+func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req loginRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.Err(500, "请求参数错误"))
+		return
+	}
+
+	if strings.TrimSpace(req.Username) == "" {
+		response.WriteJSON(w, response.Err(500, "用户名不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.Password) == "" {
+		response.WriteJSON(w, response.Err(500, "密码不能为空"))
+		return
+	}
+
+	captchaEnabled, err := h.captchaEnabled()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if captchaEnabled {
+		if strings.TrimSpace(req.CaptchaID) == "" {
+			response.WriteJSON(w, response.ErrDefault("验证码校验失败"))
+			return
+		}
+
+		secretCfg, err := h.repo.GetConfigByName("cloudflare_secret_key")
+		if err != nil || secretCfg == nil || secretCfg.Value == "" {
+			response.WriteJSON(w, response.ErrDefault("验证码配置错误：未配置Secret Key"))
+			return
+		}
+
+		if !h.verifyCloudflareTurnstile(req.CaptchaID, secretCfg.Value) {
+			response.WriteJSON(w, response.ErrDefault("验证码校验失败"))
+			return
+		}
+	}
+
+	user, err := h.repo.GetUserByUsername(req.Username)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if user == nil {
+		response.WriteJSON(w, response.ErrDefault("账号或密码错误"))
+		return
+	}
+	if user.Pwd != security.MD5(req.Password) {
+		response.WriteJSON(w, response.ErrDefault("账号或密码错误"))
+		return
+	}
+	if user.Status == 0 {
+		response.WriteJSON(w, response.ErrDefault("账号被停用"))
+		return
+	}
+
+	token, err := auth.GenerateToken(user.ID, user.User, user.RoleID, h.jwtSecret)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	requirePasswordChange := req.Username == "admin_user" || req.Password == "admin_user"
+	response.WriteJSON(w, response.OK(map[string]interface{}{
+		"token":                 token,
+		"name":                  user.User,
+		"role_id":               user.RoleID,
+		"requirePasswordChange": requirePasswordChange,
+	}))
+}
+
+func (h *Handler) getConfigByName(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req nameRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.Name) == "" {
+		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
+		return
+	}
+
+	cfg, err := h.repo.GetConfigByName(req.Name)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if cfg == nil {
+		response.WriteJSON(w, response.ErrDefault("配置不存在"))
+		return
+	}
+
+	response.WriteJSON(w, response.OK(cfg))
+}
+
+func (h *Handler) getConfigs(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	cfgMap, err := h.repo.ListConfigs()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(cfgMap))
+}
+
+func (h *Handler) userList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	users, err := h.repo.ListUsers()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(users))
+}
+
+func (h *Handler) nodeList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	items, err := h.repo.ListNodes()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) tunnelList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	items, err := h.repo.ListTunnels()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) forwardList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	userID, roleID, err := userRoleFromRequest(r)
+	if err != nil {
+		response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+		return
+	}
+
+	items, err := h.repo.ListForwards()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if roleID != 0 {
+		filtered := make([]map[string]interface{}, 0, len(items))
+		for _, item := range items {
+			if asInt64(item["userId"], 0) == userID {
+				filtered = append(filtered, item)
+			}
+		}
+		items = filtered
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) speedLimitList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	items, err := h.repo.ListSpeedLimits()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) openAPISubStore(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
+		response.WriteJSON(w, response.Err(-2, "database unavailable"))
+		return
+	}
+
+	username := strings.TrimSpace(r.URL.Query().Get("user"))
+	password := strings.TrimSpace(r.URL.Query().Get("pwd"))
+	tunnel := strings.TrimSpace(r.URL.Query().Get("tunnel"))
+	if tunnel == "" {
+		tunnel = "-1"
+	}
+
+	if username == "" {
+		response.WriteJSON(w, response.ErrDefault("用户不能为空"))
+		return
+	}
+	if password == "" {
+		response.WriteJSON(w, response.ErrDefault("密码不能为空"))
+		return
+	}
+
+	user, err := h.repo.GetUserByUsername(username)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if user == nil || user.Pwd != security.MD5(password) {
+		response.WriteJSON(w, response.ErrDefault("鉴权失败"))
+		return
+	}
+
+	const giga = int64(1024 * 1024 * 1024)
+	headerValue := ""
+
+	if tunnel == "-1" {
+		headerValue = buildSubscriptionHeader(user.OutFlow, user.InFlow, user.Flow*giga, user.ExpTime/1000)
+	} else {
+		tunnelID, parseErr := strconv.ParseInt(tunnel, 10, 64)
+		if parseErr != nil || tunnelID <= 0 {
+			response.WriteJSON(w, response.ErrDefault("隧道不存在"))
+			return
+		}
+
+		var userID int64
+		var inFlow int64
+		var outFlow int64
+		var flow int64
+		var expTime int64
+		err = h.repo.DB().QueryRow(`SELECT user_id, in_flow, out_flow, flow, exp_time FROM user_tunnel WHERE id = ? LIMIT 1`, tunnelID).
+			Scan(&userID, &inFlow, &outFlow, &flow, &expTime)
+		if err != nil {
+			if err == sql.ErrNoRows {
+				response.WriteJSON(w, response.ErrDefault("隧道不存在"))
+				return
+			}
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+		if userID != user.ID {
+			response.WriteJSON(w, response.ErrDefault("隧道不存在"))
+			return
+		}
+
+		headerValue = buildSubscriptionHeader(outFlow, inFlow, flow*giga, expTime/1000)
+	}
+
+	w.Header().Set("subscription-userinfo", headerValue)
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = w.Write([]byte(headerValue))
+}
+
+func (h *Handler) errorPage(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/html; charset=UTF-8")
+	w.WriteHeader(http.StatusNotFound)
+	_, _ = w.Write([]byte("<!DOCTYPE html><html lang='zh-CN'><head><meta charset='UTF-8'><meta name='viewport' content='width=device-width, initial-scale=1.0'><title>错误 404</title></head><body><div style='min-height:100vh;display:flex;align-items:center;justify-content:center;flex-direction:column;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Arial,sans-serif;'><div style='font-size:6rem;color:#333;font-weight:300;'>404</div><div style='font-size:1.2rem;color:#666;'>你推开了后端的大门，却发现里面只有寂寞。</div></div></body></html>"))
+}
+
+func buildSubscriptionHeader(upload, download, total, expire int64) string {
+	return fmt.Sprintf("upload=%d; download=%d; total=%d; expire=%d", download, upload, total, expire)
+}
+
+func (h *Handler) userTunnelVisibleList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	userID, roleID, err := userRoleFromRequest(r)
+	if err != nil {
+		response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+		return
+	}
+
+	items := make([]map[string]interface{}, 0)
+	if roleID == 0 {
+		items, err = h.repo.ListEnabledTunnelSummaries()
+	} else {
+		items, err = h.repo.ListUserAccessibleTunnels(userID)
+	}
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) userTunnelList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req struct {
+		UserID int64 `json:"userId"`
+	}
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
+		return
+	}
+	if req.UserID <= 0 {
+		response.WriteJSON(w, response.OK([]interface{}{}))
+		return
+	}
+
+	tunnels, err := h.repo.GetUserPackageTunnels(req.UserID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	out := make([]map[string]interface{}, 0, len(tunnels))
+	for _, t := range tunnels {
+		item := map[string]interface{}{
+			"id":             t.ID,
+			"userId":         t.UserID,
+			"tunnelId":       t.TunnelID,
+			"tunnelName":     t.TunnelName,
+			"status":         1,
+			"flow":           t.Flow,
+			"num":            t.Num,
+			"expTime":        t.ExpTime,
+			"flowResetTime":  t.FlowResetTime,
+			"inFlow":         t.InFlow,
+			"outFlow":        t.OutFlow,
+			"tunnelFlow":     t.TunnelFlow,
+			"speedId":        nil,
+			"speedLimitName": nil,
+		}
+		if t.SpeedID.Valid {
+			item["speedId"] = t.SpeedID.Int64
+		}
+		if t.SpeedLimit.Valid {
+			item["speedLimitName"] = t.SpeedLimit.String
+		}
+		out = append(out, item)
+	}
+	response.WriteJSON(w, response.OK(out))
+}
+
+func (h *Handler) tunnelGroupList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	items, err := h.repo.ListTunnelGroups()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) userGroupList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	items, err := h.repo.ListUserGroups()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) groupPermissionList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	items, err := h.repo.ListGroupPermissions()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) checkCaptcha(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	enabled, err := h.captchaEnabled()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if enabled {
+		response.WriteJSON(w, response.OK(1))
+		return
+	}
+	response.WriteJSON(w, response.OK(0))
+}
+
+func (h *Handler) flowTest(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = w.Write([]byte("test"))
+}
+
+func (h *Handler) flowConfig(w http.ResponseWriter, r *http.Request) {
+	secret := r.URL.Query().Get("secret")
+	node, err := h.repo.GetNodeBySecret(secret)
+	if err != nil || node == nil {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		_, _ = w.Write([]byte("ok"))
+		return
+	}
+
+	rawData, err := readAndDecryptFlowBody(r.Body, secret)
+	if err == nil && strings.TrimSpace(rawData) != "" {
+		h.cleanNodeConfigs(node.ID, rawData)
+	}
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = w.Write([]byte("ok"))
+}
+
+func (h *Handler) flowUpload(w http.ResponseWriter, r *http.Request) {
+	secret := r.URL.Query().Get("secret")
+	if ok, _ := h.repo.NodeExistsBySecret(secret); !ok {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		_, _ = w.Write([]byte("ok"))
+		return
+	}
+
+	raw, err := readAndDecryptFlowBody(r.Body, secret)
+	if err == nil && strings.TrimSpace(raw) != "" {
+		var items []flowItem
+		if json.Unmarshal([]byte(raw), &items) == nil {
+			for _, item := range items {
+				h.processFlowItem(item)
+			}
+		}
+	}
+
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = w.Write([]byte("ok"))
+}
+
+func (h *Handler) updateConfigs(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var payload map[string]string
+	if err := decodeJSON(r.Body, &payload); err != nil {
+		response.WriteJSON(w, response.ErrDefault("配置数据不能为空"))
+		return
+	}
+	if len(payload) == 0 {
+		response.WriteJSON(w, response.ErrDefault("配置数据不能为空"))
+		return
+	}
+
+	now := time.Now().UnixMilli()
+	for k, v := range payload {
+		key := strings.TrimSpace(k)
+		if key == "" {
+			continue
+		}
+		if err := h.repo.UpsertConfig(key, v, now); err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req configSingleRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.Name) == "" {
+		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.Value) == "" {
+		response.WriteJSON(w, response.ErrDefault("配置值不能为空"))
+		return
+	}
+
+	if err := h.repo.UpsertConfig(strings.TrimSpace(req.Name), req.Value, time.Now().UnixMilli()); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) userPackage(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	claims, ok := r.Context().Value(middleware.ClaimsContextKey).(auth.Claims)
+	if !ok {
+		response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+		return
+	}
+
+	userID, err := parseUserID(claims.Sub)
+	if err != nil {
+		response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+		return
+	}
+
+	user, err := h.repo.GetUserByID(userID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if user == nil {
+		response.WriteJSON(w, response.ErrDefault("用户不存在"))
+		return
+	}
+
+	tunnels, err := h.repo.GetUserPackageTunnels(userID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	forwards, err := h.repo.GetUserPackageForwards(userID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	stats, err := h.repo.GetStatisticsFlows(userID, 24)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	sort.Slice(stats, func(i, j int) bool { return stats[i].ID < stats[j].ID })
+
+	tunnelOut := make([]map[string]interface{}, 0, len(tunnels))
+	for _, t := range tunnels {
+		item := map[string]interface{}{
+			"id":             t.ID,
+			"userId":         t.UserID,
+			"tunnelId":       t.TunnelID,
+			"tunnelName":     t.TunnelName,
+			"tunnelFlow":     t.TunnelFlow,
+			"flow":           t.Flow,
+			"inFlow":         t.InFlow,
+			"outFlow":        t.OutFlow,
+			"num":            t.Num,
+			"flowResetTime":  t.FlowResetTime,
+			"expTime":        t.ExpTime,
+			"speedId":        nil,
+			"speedLimitName": nil,
+			"speed":          nil,
+		}
+		if t.SpeedID.Valid {
+			item["speedId"] = t.SpeedID.Int64
+		}
+		if t.SpeedLimit.Valid {
+			item["speedLimitName"] = t.SpeedLimit.String
+		}
+		if t.Speed.Valid {
+			item["speed"] = t.Speed.Int64
+		}
+		tunnelOut = append(tunnelOut, item)
+	}
+
+	forwardOut := make([]map[string]interface{}, 0, len(forwards))
+	for _, f := range forwards {
+		item := map[string]interface{}{
+			"id":          f.ID,
+			"name":        f.Name,
+			"tunnelId":    f.TunnelID,
+			"tunnelName":  f.TunnelName,
+			"inIp":        f.InIP,
+			"inPort":      nil,
+			"remoteAddr":  f.RemoteAddr,
+			"inFlow":      f.InFlow,
+			"outFlow":     f.OutFlow,
+			"status":      f.Status,
+			"createdTime": f.CreatedAt,
+		}
+		if f.InPort.Valid {
+			item["inPort"] = f.InPort.Int64
+		}
+		forwardOut = append(forwardOut, item)
+	}
+
+	payload := map[string]interface{}{
+		"userInfo": map[string]interface{}{
+			"id":            user.ID,
+			"name":          user.User,
+			"user":          user.User,
+			"status":        user.Status,
+			"flow":          user.Flow,
+			"inFlow":        user.InFlow,
+			"outFlow":       user.OutFlow,
+			"num":           user.Num,
+			"expTime":       user.ExpTime,
+			"flowResetTime": user.FlowResetTime,
+			"createdTime":   user.CreatedTime,
+			"updatedTime":   nullableNullInt64(user.UpdatedTime),
+		},
+		"tunnelPermissions": tunnelOut,
+		"forwards":          forwardOut,
+		"statisticsFlows":   stats,
+	}
+
+	response.WriteJSON(w, response.OK(payload))
+}
+
+func (h *Handler) updatePassword(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	claims, ok := r.Context().Value(middleware.ClaimsContextKey).(auth.Claims)
+	if !ok {
+		response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+		return
+	}
+
+	userID, err := parseUserID(claims.Sub)
+	if err != nil {
+		response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+		return
+	}
+
+	var req changePasswordRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("修改账号密码时发生错误"))
+		return
+	}
+
+	if strings.TrimSpace(req.NewUsername) == "" {
+		response.WriteJSON(w, response.ErrDefault("新用户名不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.CurrentPassword) == "" {
+		response.WriteJSON(w, response.ErrDefault("当前密码不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.NewPassword) == "" {
+		response.WriteJSON(w, response.ErrDefault("新密码不能为空"))
+		return
+	}
+	if strings.TrimSpace(req.ConfirmPassword) == "" {
+		response.WriteJSON(w, response.ErrDefault("确认密码不能为空"))
+		return
+	}
+	if req.NewPassword != req.ConfirmPassword {
+		response.WriteJSON(w, response.ErrDefault("新密码和确认密码不匹配"))
+		return
+	}
+
+	user, err := h.repo.GetUserByID(userID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if user == nil {
+		response.WriteJSON(w, response.ErrDefault("用户不存在"))
+		return
+	}
+
+	if user.Pwd != security.MD5(req.CurrentPassword) {
+		response.WriteJSON(w, response.ErrDefault("当前密码错误"))
+		return
+	}
+
+	exists, err := h.repo.UsernameExistsExceptID(req.NewUsername, userID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if exists {
+		response.WriteJSON(w, response.ErrDefault("用户名已存在"))
+		return
+	}
+
+	if err := h.repo.UpdateUserNameAndPassword(userID, req.NewUsername, security.MD5(req.NewPassword), time.Now().UnixMilli()); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) captchaEnabled() (bool, error) {
+	cfg, err := h.repo.GetConfigByName("captcha_enabled")
+	if err != nil {
+		return false, err
+	}
+	if cfg == nil {
+		return false, nil
+	}
+	return strings.EqualFold(cfg.Value, "true"), nil
+}
+
+func decodeJSON(body io.ReadCloser, out interface{}) error {
+	defer body.Close()
+	decoder := json.NewDecoder(body)
+	decoder.DisallowUnknownFields()
+	return decoder.Decode(out)
+}
+
+func parseUserID(sub string) (int64, error) {
+	id, err := strconv.ParseInt(sub, 10, 64)
+	if err != nil || id <= 0 {
+		return 0, strconv.ErrSyntax
+	}
+	return id, nil
+}
+
+func userIDFromRequest(r *http.Request) (int64, error) {
+	claims, ok := r.Context().Value(middleware.ClaimsContextKey).(auth.Claims)
+	if !ok {
+		return 0, strconv.ErrSyntax
+	}
+	return parseUserID(claims.Sub)
+}
+
+func userRoleFromRequest(r *http.Request) (int64, int, error) {
+	claims, ok := r.Context().Value(middleware.ClaimsContextKey).(auth.Claims)
+	if !ok {
+		return 0, 0, strconv.ErrSyntax
+	}
+	userID, err := parseUserID(claims.Sub)
+	if err != nil {
+		return 0, 0, err
+	}
+	return userID, claims.RoleID, nil
+}
+
+func nullableNullInt64(v sql.NullInt64) interface{} {
+	if v.Valid {
+		return v.Int64
+	}
+	return nil
+}
+
+func readAndDecryptFlowBody(body io.ReadCloser, secret string) (string, error) {
+	defer body.Close()
+	raw, err := io.ReadAll(body)
+	if err != nil {
+		return "", err
+	}
+	text := strings.TrimSpace(string(raw))
+	if text == "" {
+		return "", nil
+	}
+
+	var wrap struct {
+		Encrypted bool   `json:"encrypted"`
+		Data      string `json:"data"`
+		Timestamp int64  `json:"timestamp"`
+	}
+	if err := json.Unmarshal(raw, &wrap); err != nil || !wrap.Encrypted || strings.TrimSpace(wrap.Data) == "" {
+		return text, nil
+	}
+
+	crypto, err := security.NewAESCrypto(secret)
+	if err != nil {
+		return text, nil
+	}
+	plain, err := crypto.Decrypt(wrap.Data)
+	if err != nil {
+		return text, nil
+	}
+	return string(plain), nil
+}
+
+func (h *Handler) verifyCloudflareTurnstile(token, secretKey string) bool {
+	if token == "" || secretKey == "" {
+		return false
+	}
+	resp, err := http.PostForm("https://challenges.cloudflare.com/turnstile/v0/siteverify", url.Values{
+		"secret":   {secretKey},
+		"response": {token},
+	})
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+	var body struct {
+		Success bool `json:"success"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return false
+	}
+	return body.Success
+}
@@ -0,0 +1,270 @@
+package handler
+
+import (
+	"context"
+	"database/sql"
+	"time"
+)
+
+func (h *Handler) StartBackgroundJobs() {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
+		return
+	}
+
+	h.jobsMu.Lock()
+	if h.jobsStarted {
+		h.jobsMu.Unlock()
+		return
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	h.jobsCancel = cancel
+	h.jobsStarted = true
+	h.jobsWG.Add(2)
+	h.jobsMu.Unlock()
+
+	go h.runHourlyStatsLoop(ctx)
+	go h.runDailyMaintenanceLoop(ctx)
+}
+
+func (h *Handler) StopBackgroundJobs() {
+	if h == nil {
+		return
+	}
+
+	h.jobsMu.Lock()
+	if !h.jobsStarted {
+		h.jobsMu.Unlock()
+		return
+	}
+	cancel := h.jobsCancel
+	h.jobsCancel = nil
+	h.jobsStarted = false
+	h.jobsMu.Unlock()
+
+	if cancel != nil {
+		cancel()
+	}
+	h.jobsWG.Wait()
+}
+
+func (h *Handler) runHourlyStatsLoop(ctx context.Context) {
+	defer h.jobsWG.Done()
+
+	for {
+		wait := durationUntilNextHour(time.Now())
+		timer := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			if !timer.Stop() {
+				<-timer.C
+			}
+			return
+		case <-timer.C:
+			h.runStatisticsFlowJob(time.Now())
+		}
+	}
+}
+
+func (h *Handler) runDailyMaintenanceLoop(ctx context.Context) {
+	defer h.jobsWG.Done()
+
+	for {
+		wait := durationUntilNextDailyMaintenance(time.Now())
+		timer := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			if !timer.Stop() {
+				<-timer.C
+			}
+			return
+		case <-timer.C:
+			h.runResetAndExpiryJob(time.Now())
+		}
+	}
+}
+
+func durationUntilNextHour(now time.Time) time.Duration {
+	next := now.Truncate(time.Hour).Add(time.Hour)
+	return next.Sub(now)
+}
+
+func durationUntilNextDailyMaintenance(now time.Time) time.Duration {
+	next := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 5, 0, now.Location())
+	if !next.After(now) {
+		next = next.Add(24 * time.Hour)
+	}
+	return next.Sub(now)
+}
+
+func (h *Handler) runStatisticsFlowJob(now time.Time) {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
+		return
+	}
+
+	db := h.repo.DB()
+	nowMs := now.UnixMilli()
+	cutoffMs := nowMs - int64((48*time.Hour)/time.Millisecond)
+	_, _ = db.Exec(`DELETE FROM statistics_flow WHERE created_time < ?`, cutoffMs)
+
+	hourMark := now.Truncate(time.Hour)
+	hourText := hourMark.Format("15:04")
+	createdTime := hourMark.UnixMilli()
+
+	rows, err := db.Query(`SELECT id, in_flow, out_flow FROM user ORDER BY id ASC`)
+	if err != nil {
+		return
+	}
+	type userFlowSnapshot struct {
+		userID  int64
+		inFlow  int64
+		outFlow int64
+	}
+	users := make([]userFlowSnapshot, 0)
+
+	for rows.Next() {
+		var userID int64
+		var inFlow int64
+		var outFlow int64
+		if err := rows.Scan(&userID, &inFlow, &outFlow); err != nil {
+			continue
+		}
+		users = append(users, userFlowSnapshot{userID: userID, inFlow: inFlow, outFlow: outFlow})
+	}
+	_ = rows.Close()
+
+	for _, user := range users {
+		currentTotal := user.inFlow + user.outFlow
+		increment := currentTotal
+
+		var lastTotal sql.NullInt64
+		err := db.QueryRow(`SELECT total_flow FROM statistics_flow WHERE user_id = ? ORDER BY id DESC LIMIT 1`, user.userID).Scan(&lastTotal)
+		if err == nil && lastTotal.Valid {
+			increment = currentTotal - lastTotal.Int64
+			if increment < 0 {
+				increment = currentTotal
+			}
+		}
+
+		_, _ = db.Exec(`
+			INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time)
+			VALUES(?, ?, ?, ?, ?)
+		`, user.userID, increment, currentTotal, hourText, createdTime)
+	}
+}
+
+func (h *Handler) runResetAndExpiryJob(now time.Time) {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
+		return
+	}
+
+	h.resetMonthlyFlow(now)
+	h.disableExpiredUsers(now.UnixMilli())
+	h.disableExpiredUserTunnels(now.UnixMilli())
+}
+
+func (h *Handler) resetMonthlyFlow(now time.Time) {
+	db := h.repo.DB()
+	currentDay := now.Day()
+	lastDay := time.Date(now.Year(), now.Month()+1, 0, 0, 0, 0, 0, now.Location()).Day()
+
+	if currentDay == lastDay {
+		_, _ = db.Exec(`
+			UPDATE user
+			SET in_flow = 0, out_flow = 0
+			WHERE flow_reset_time != 0
+			  AND (flow_reset_time = ? OR flow_reset_time > ?)
+		`, currentDay, lastDay)
+		_, _ = db.Exec(`
+			UPDATE user_tunnel
+			SET in_flow = 0, out_flow = 0
+			WHERE flow_reset_time != 0
+			  AND (flow_reset_time = ? OR flow_reset_time > ?)
+		`, currentDay, lastDay)
+		return
+	}
+
+	_, _ = db.Exec(`
+		UPDATE user
+		SET in_flow = 0, out_flow = 0
+		WHERE flow_reset_time != 0
+		  AND flow_reset_time = ?
+	`, currentDay)
+	_, _ = db.Exec(`
+		UPDATE user_tunnel
+		SET in_flow = 0, out_flow = 0
+		WHERE flow_reset_time != 0
+		  AND flow_reset_time = ?
+	`, currentDay)
+}
+
+func (h *Handler) disableExpiredUsers(nowMs int64) {
+	db := h.repo.DB()
+	rows, err := db.Query(`
+		SELECT id
+		FROM user
+		WHERE role_id != 0
+		  AND status = 1
+		  AND exp_time IS NOT NULL
+		  AND exp_time < ?
+	`, nowMs)
+	if err != nil {
+		return
+	}
+	userIDs := make([]int64, 0)
+
+	for rows.Next() {
+		var userID int64
+		if err := rows.Scan(&userID); err != nil {
+			continue
+		}
+		userIDs = append(userIDs, userID)
+	}
+	_ = rows.Close()
+
+	for _, userID := range userIDs {
+		forwards, err := h.listActiveForwardsByUser(userID)
+		if err == nil {
+			h.pauseForwardRecords(forwards, nowMs)
+		}
+		_, _ = db.Exec(`UPDATE user SET status = 0 WHERE id = ?`, userID)
+	}
+}
+
+func (h *Handler) disableExpiredUserTunnels(nowMs int64) {
+	db := h.repo.DB()
+	rows, err := db.Query(`
+		SELECT id, user_id, tunnel_id
+		FROM user_tunnel
+		WHERE status = 1
+		  AND exp_time IS NOT NULL
+		  AND exp_time < ?
+	`, nowMs)
+	if err != nil {
+		return
+	}
+	type expiredUserTunnel struct {
+		userTunnelID int64
+		userID       int64
+		tunnelID     int64
+	}
+	items := make([]expiredUserTunnel, 0)
+
+	for rows.Next() {
+		var userTunnelID int64
+		var userID int64
+		var tunnelID int64
+		if err := rows.Scan(&userTunnelID, &userID, &tunnelID); err != nil {
+			continue
+		}
+		items = append(items, expiredUserTunnel{userTunnelID: userTunnelID, userID: userID, tunnelID: tunnelID})
+	}
+	_ = rows.Close()
+
+	for _, item := range items {
+		forwards, err := h.listActiveForwardsByUserTunnel(item.userID, item.tunnelID)
+		if err == nil {
+			h.pauseForwardRecords(forwards, nowMs)
+		}
+		_, _ = db.Exec(`UPDATE user_tunnel SET status = 0 WHERE id = ?`, item.userTunnelID)
+	}
+}
@@ -0,0 +1,128 @@
+package handler
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"go-backend/internal/store/sqlite"
+)
+
+func TestRunStatisticsFlowJobTracksIncrementAndPrunes(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "jobs-stats.db")
+	repo, err := sqlite.Open(dbPath)
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "secret")
+	now := time.Date(2026, 2, 7, 12, 0, 0, 0, time.UTC)
+	nowMs := now.UnixMilli()
+
+	if _, err := repo.DB().Exec(`UPDATE user SET in_flow = 100, out_flow = 200 WHERE id = 1`); err != nil {
+		t.Fatalf("seed user flow: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 250, 250, '11:00', ?)`, now.Add(-time.Hour).UnixMilli()); err != nil {
+		t.Fatalf("seed recent statistics row: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 10, 10, '00:00', ?)`, now.Add(-49*time.Hour).UnixMilli()); err != nil {
+		t.Fatalf("seed stale statistics row: %v", err)
+	}
+
+	h.runStatisticsFlowJob(now)
+
+	var staleCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM statistics_flow WHERE created_time < ?`, nowMs-int64((48*time.Hour)/time.Millisecond)).Scan(&staleCount); err != nil {
+		t.Fatalf("query stale statistics rows: %v", err)
+	}
+	if staleCount != 0 {
+		t.Fatalf("expected stale statistics rows to be pruned, got %d", staleCount)
+	}
+
+	var flow int64
+	var total int64
+	var hour string
+	if err := repo.DB().QueryRow(`SELECT flow, total_flow, time FROM statistics_flow WHERE user_id = 1 ORDER BY id DESC LIMIT 1`).Scan(&flow, &total, &hour); err != nil {
+		t.Fatalf("query latest statistics row: %v", err)
+	}
+	if flow != 50 {
+		t.Fatalf("expected increment flow 50, got %d", flow)
+	}
+	if total != 300 {
+		t.Fatalf("expected total flow 300, got %d", total)
+	}
+	if hour != "12:00" {
+		t.Fatalf("expected hour mark 12:00, got %s", hour)
+	}
+}
+
+func TestRunResetAndExpiryJobResetsFlowAndDisablesExpiredRecords(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "jobs-reset.db")
+	repo, err := sqlite.Open(dbPath)
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "secret")
+	now := time.Date(2026, 3, 15, 0, 0, 5, 0, time.UTC)
+	nowMs := now.UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'expired_user', 'x', 1, ?, 100, 1000, 2000, 15, 1, ?, ?, 1)
+	`, nowMs-1000, nowMs, nowMs); err != nil {
+		t.Fatalf("insert expired user: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(1, 't1', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
+	`, nowMs, nowMs); err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(10, 2, 1, NULL, 1, 1, 300, 400, 15, ?, 1)
+	`, nowMs-1000); err != nil {
+		t.Fatalf("insert expired user_tunnel: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(20, 2, 'expired_user', 'f1', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
+	`, nowMs, nowMs); err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+
+	h.runResetAndExpiryJob(now)
+
+	var userIn, userOut int64
+	var userStatus int
+	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user WHERE id = 2`).Scan(&userIn, &userOut, &userStatus); err != nil {
+		t.Fatalf("query user after maintenance: %v", err)
+	}
+	if userIn != 0 || userOut != 0 || userStatus != 0 {
+		t.Fatalf("expected user reset+disabled, got in=%d out=%d status=%d", userIn, userOut, userStatus)
+	}
+
+	var utIn, utOut int64
+	var utStatus int
+	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user_tunnel WHERE id = 10`).Scan(&utIn, &utOut, &utStatus); err != nil {
+		t.Fatalf("query user_tunnel after maintenance: %v", err)
+	}
+	if utIn != 0 || utOut != 0 || utStatus != 0 {
+		t.Fatalf("expected user_tunnel reset+disabled, got in=%d out=%d status=%d", utIn, utOut, utStatus)
+	}
+
+	var forwardStatus int
+	if err := repo.DB().QueryRow(`SELECT status FROM forward WHERE id = 20`).Scan(&forwardStatus); err != nil {
+		t.Fatalf("query forward after maintenance: %v", err)
+	}
+	if forwardStatus != 0 {
+		t.Fatalf("expected forward status=0 after expiry handling, got %d", forwardStatus)
+	}
+}
@@ -0,0 +1,117 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	"strings"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/response"
+)
+
+type contextKey string
+
+const ClaimsContextKey contextKey = "claims"
+
+type AuthOptions struct {
+	JWTSecret string
+}
+
+func JWT(opts AuthOptions) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if shouldSkip(r.URL.Path) {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			if !strings.HasPrefix(r.URL.Path, "/api/") {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			token := strings.TrimSpace(r.Header.Get("Authorization"))
+			if token == "" {
+				response.WriteJSON(w, response.Err(401, "未登录或token已过期"))
+				return
+			}
+
+			claims, ok := auth.ValidateToken(token, opts.JWTSecret)
+			if !ok {
+				response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
+				return
+			}
+
+			if requiresAdmin(r.URL.Path) && claims.RoleID != 0 {
+				response.WriteJSON(w, response.Err(403, "权限不足，仅管理员可操作"))
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), ClaimsContextKey, claims)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+func RequireAdmin(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		raw := r.Context().Value(ClaimsContextKey)
+		claims, ok := raw.(auth.Claims)
+		if !ok {
+			response.WriteJSON(w, response.Err(401, "无法获取用户权限信息"))
+			return
+		}
+		if claims.RoleID != 0 {
+			response.WriteJSON(w, response.Err(403, "权限不足，仅管理员可操作"))
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func shouldSkip(path string) bool {
+	switch {
+	case strings.HasPrefix(path, "/flow/"):
+		return true
+	case strings.HasPrefix(path, "/api/v1/open_api/"):
+		return true
+	case strings.HasPrefix(path, "/api/v1/captcha/"):
+		return true
+	case path == "/api/v1/config/get":
+		return true
+	case path == "/api/v1/user/login":
+		return true
+	default:
+		return false
+	}
+}
+
+func requiresAdmin(path string) bool {
+	if strings.HasPrefix(path, "/api/v1/group/") {
+		return true
+	}
+
+	if strings.HasPrefix(path, "/api/v1/node/") {
+		return true
+	}
+
+	if strings.HasPrefix(path, "/api/v1/speed-limit/") {
+		return true
+	}
+
+	if strings.HasPrefix(path, "/api/v1/tunnel/") {
+		if strings.HasPrefix(path, "/api/v1/tunnel/user/tunnel") {
+			return false
+		}
+		return true
+	}
+
+	switch path {
+	case "/api/v1/user/create", "/api/v1/user/list", "/api/v1/user/update", "/api/v1/user/delete", "/api/v1/user/reset":
+		return true
+	case "/api/v1/config/update", "/api/v1/config/update-single":
+		return true
+	default:
+		return false
+	}
+}
@@ -0,0 +1,17 @@
+package middleware
+
+import "net/http"
+
+func CORS(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Allow-Headers", "*")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT, OPTIONS")
+		w.Header().Set("Access-Control-Expose-Headers", "Authorization")
+		if r.Method == http.MethodOptions {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
@@ -0,0 +1,19 @@
+package middleware
+
+import (
+	"fmt"
+	"net/http"
+
+	"go-backend/internal/http/response"
+)
+
+func Recover(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			if rec := recover(); rec != nil {
+				response.WriteJSON(w, response.Err(-2, fmt.Sprint(rec)))
+			}
+		}()
+		next.ServeHTTP(w, r)
+	})
+}
@@ -0,0 +1,57 @@
+package middleware
+
+import (
+	"bufio"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"time"
+)
+
+type statusWriter struct {
+	http.ResponseWriter
+	status int
+}
+
+func (w *statusWriter) WriteHeader(code int) {
+	w.status = code
+	w.ResponseWriter.WriteHeader(code)
+}
+
+func (w *statusWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	hj, ok := w.ResponseWriter.(http.Hijacker)
+	if !ok {
+		return nil, nil, http.ErrNotSupported
+	}
+	return hj.Hijack()
+}
+
+func (w *statusWriter) Flush() {
+	if f, ok := w.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+func (w *statusWriter) ReadFrom(r io.Reader) (int64, error) {
+	if rf, ok := w.ResponseWriter.(io.ReaderFrom); ok {
+		return rf.ReadFrom(r)
+	}
+	return io.Copy(w.ResponseWriter, r)
+}
+
+func (w *statusWriter) Push(target string, opts *http.PushOptions) error {
+	if p, ok := w.ResponseWriter.(http.Pusher); ok {
+		return p.Push(target, opts)
+	}
+	return http.ErrNotSupported
+}
+
+func RequestLog(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sw := &statusWriter{ResponseWriter: w, status: http.StatusOK}
+		start := time.Now()
+		next.ServeHTTP(sw, r)
+		log.Printf("%s %s -> %d (%s)", r.Method, r.URL.Path, sw.status, time.Since(start).String())
+	})
+}
@@ -0,0 +1,48 @@
+package response
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+)
+
+type R struct {
+	Code int         `json:"code"`
+	Msg  string      `json:"msg"`
+	TS   int64       `json:"ts"`
+	Data interface{} `json:"data,omitempty"`
+}
+
+func OK(data interface{}) R {
+	return R{
+		Code: 0,
+		Msg:  "操作成功",
+		TS:   time.Now().UnixMilli(),
+		Data: data,
+	}
+}
+
+func OKEmpty() R {
+	return R{
+		Code: 0,
+		Msg:  "操作成功",
+		TS:   time.Now().UnixMilli(),
+	}
+}
+
+func Err(code int, msg string) R {
+	return R{
+		Code: code,
+		Msg:  msg,
+		TS:   time.Now().UnixMilli(),
+	}
+}
+
+func ErrDefault(msg string) R {
+	return Err(-1, msg)
+}
+
+func WriteJSON(w http.ResponseWriter, payload R) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	_ = json.NewEncoder(w).Encode(payload)
+}
@@ -0,0 +1,20 @@
+package httpserver
+
+import (
+	"net/http"
+
+	"go-backend/internal/http/handler"
+	"go-backend/internal/http/middleware"
+)
+
+func NewRouter(h *handler.Handler, jwtSecret string) http.Handler {
+	mux := http.NewServeMux()
+	h.Register(mux)
+	mux.Handle("/system-info", h.WebSocketHandler())
+
+	wrapped := middleware.Recover(mux)
+	wrapped = middleware.JWT(middleware.AuthOptions{JWTSecret: jwtSecret})(wrapped)
+	wrapped = middleware.RequestLog(wrapped)
+	wrapped = middleware.CORS(wrapped)
+	return wrapped
+}
@@ -0,0 +1,65 @@
+package security
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+)
+
+type AESCrypto struct {
+	key []byte
+}
+
+func NewAESCrypto(secret string) (*AESCrypto, error) {
+	if secret == "" {
+		return nil, fmt.Errorf("secret is empty")
+	}
+	hash := sha256.Sum256([]byte(secret))
+	return &AESCrypto{key: hash[:]}, nil
+}
+
+func (a *AESCrypto) Encrypt(plain []byte) (string, error) {
+	if len(plain) == 0 {
+		return "", fmt.Errorf("empty plaintext")
+	}
+	block, err := aes.NewCipher(a.key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", err
+	}
+	sealed := gcm.Seal(nil, nonce, plain, nil)
+	data := append(nonce, sealed...)
+	return base64.StdEncoding.EncodeToString(data), nil
+}
+
+func (a *AESCrypto) Decrypt(cipherText string) ([]byte, error) {
+	raw, err := base64.StdEncoding.DecodeString(cipherText)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(a.key)
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonceSize := gcm.NonceSize()
+	if len(raw) < nonceSize {
+		return nil, fmt.Errorf("ciphertext too short")
+	}
+	nonce := raw[:nonceSize]
+	data := raw[nonceSize:]
+	return gcm.Open(nil, nonce, data, nil)
+}
@@ -0,0 +1,11 @@
+package security
+
+import (
+	"crypto/md5"
+	"fmt"
+)
+
+func MD5(input string) string {
+	hash := md5.Sum([]byte(input))
+	return fmt.Sprintf("%x", hash)
+}
@@ -1,7 +1,5 @@
-
-INSERT OR IGNORE INTO user (id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status) 
+INSERT OR IGNORE INTO user (id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 VALUES (1, 'admin_user', '3c85cdebade1c51cf64ca9f3c09d182d', 0, 2727251700000, 99999, 0, 0, 1, 99999, 1748914865000, 1754011744252, 1);

-
-INSERT OR IGNORE INTO vite_config (id, name, value, time) 
+INSERT OR IGNORE INTO vite_config (id, name, value, time)
 VALUES (1, 'app_name', 'flux', 1755147963000);
@@ -173,6 +173,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_tunnel_unique ON tunnel_group
 CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_user_unique ON user_group_user(user_group_id, user_id);
 CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_unique ON group_permission(user_group_id, tunnel_group_id);
 CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_grant_unique ON group_permission_grant(user_group_id, tunnel_group_id, user_tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_tunnel_unique ON user_tunnel(user_id, tunnel_id);

 CREATE TABLE IF NOT EXISTS vite_config (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -0,0 +1,430 @@
+package ws
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/security"
+	"go-backend/internal/store/sqlite"
+)
+
+type encryptedMessage struct {
+	Encrypted bool   `json:"encrypted"`
+	Data      string `json:"data"`
+	Timestamp int64  `json:"timestamp"`
+}
+
+type broadcastMessage struct {
+	ID   int64  `json:"id"`
+	Type string `json:"type"`
+	Data string `json:"data"`
+}
+
+type connWrap struct {
+	conn *websocket.Conn
+	mu   sync.Mutex
+}
+
+type nodeSession struct {
+	nodeID int64
+	secret string
+	conn   *connWrap
+}
+
+type commandResponse struct {
+	Type      string          `json:"type"`
+	Success   bool            `json:"success"`
+	Message   string          `json:"message"`
+	Data      json.RawMessage `json:"data,omitempty"`
+	RequestID string          `json:"requestId,omitempty"`
+}
+
+type pendingRequest struct {
+	nodeID int64
+	ch     chan CommandResult
+}
+
+type CommandResult struct {
+	Type    string                 `json:"type"`
+	Success bool                   `json:"success"`
+	Message string                 `json:"message"`
+	Data    map[string]interface{} `json:"data,omitempty"`
+}
+
+type Server struct {
+	repo      *sqlite.Repository
+	jwtSecret string
+	upgrader  websocket.Upgrader
+
+	mu      sync.RWMutex
+	admins  map[*connWrap]struct{}
+	nodes   map[int64]*nodeSession
+	byConn  map[*websocket.Conn]*nodeSession
+	pending map[string]pendingRequest
+}
+
+func NewServer(repo *sqlite.Repository, jwtSecret string) *Server {
+	return &Server{
+		repo:      repo,
+		jwtSecret: jwtSecret,
+		upgrader: websocket.Upgrader{
+			CheckOrigin: func(r *http.Request) bool { return true },
+		},
+		admins:  make(map[*connWrap]struct{}),
+		nodes:   make(map[int64]*nodeSession),
+		byConn:  make(map[*websocket.Conn]*nodeSession),
+		pending: make(map[string]pendingRequest),
+	}
+}
+
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	query := r.URL.Query()
+	typeVal := query.Get("type")
+	secret := query.Get("secret")
+
+	if typeVal == "1" {
+		node, err := s.repo.GetNodeBySecret(secret)
+		if err != nil || node == nil {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		s.handleNode(w, r, node.ID, secret)
+		return
+	}
+
+	if typeVal == "0" {
+		if _, ok := auth.ValidateToken(secret, s.jwtSecret); !ok {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		s.handleAdmin(w, r)
+		return
+	}
+
+	http.Error(w, "bad request", http.StatusBadRequest)
+}
+
+func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
+	conn, err := s.upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return
+	}
+	cw := &connWrap{conn: conn}
+
+	s.mu.Lock()
+	s.admins[cw] = struct{}{}
+	s.mu.Unlock()
+
+	defer func() {
+		s.mu.Lock()
+		delete(s.admins, cw)
+		s.mu.Unlock()
+		_ = conn.Close()
+	}()
+
+	for {
+		if _, _, err := conn.ReadMessage(); err != nil {
+			return
+		}
+	}
+}
+
+func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64, secret string) {
+	conn, err := s.upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return
+	}
+	cw := &connWrap{conn: conn}
+
+	version := r.URL.Query().Get("version")
+	httpVal := parseIntDefault(r.URL.Query().Get("http"), 0)
+	tlsVal := parseIntDefault(r.URL.Query().Get("tls"), 0)
+	socksVal := parseIntDefault(r.URL.Query().Get("socks"), 0)
+
+	s.mu.Lock()
+	if old, ok := s.nodes[nodeID]; ok {
+		_ = old.conn.conn.Close()
+		delete(s.byConn, old.conn.conn)
+	}
+	ns := &nodeSession{nodeID: nodeID, secret: secret, conn: cw}
+	s.nodes[nodeID] = ns
+	s.byConn[conn] = ns
+	s.mu.Unlock()
+
+	_ = s.repo.UpdateNodeOnline(nodeID, 1, version, httpVal, tlsVal, socksVal)
+	s.broadcastStatus(nodeID, 1)
+
+	defer func() {
+		needOfflineBroadcast := false
+		s.mu.Lock()
+		current, ok := s.nodes[nodeID]
+		if ok && current.conn.conn == conn {
+			delete(s.nodes, nodeID)
+			needOfflineBroadcast = true
+		}
+		delete(s.byConn, conn)
+		s.mu.Unlock()
+		if needOfflineBroadcast {
+			s.failPendingForNode(nodeID, "节点连接已断开")
+			_ = s.repo.UpdateNodeStatus(nodeID, 0)
+			s.broadcastStatus(nodeID, 0)
+		}
+		_ = conn.Close()
+	}()
+
+	for {
+		_, payload, err := conn.ReadMessage()
+		if err != nil {
+			return
+		}
+
+		msg := decryptIfNeeded(payload, secret)
+		s.tryResolvePending(nodeID, msg)
+		s.broadcastInfo(nodeID, msg)
+	}
+}
+
+func (s *Server) SendCommand(nodeID int64, cmdType string, data interface{}, timeout time.Duration) (CommandResult, error) {
+	if s == nil {
+		return CommandResult{}, errors.New("server not initialized")
+	}
+	if strings.TrimSpace(cmdType) == "" {
+		return CommandResult{}, errors.New("command type is empty")
+	}
+	if timeout <= 0 {
+		timeout = 10 * time.Second
+	}
+
+	s.mu.RLock()
+	ns, ok := s.nodes[nodeID]
+	s.mu.RUnlock()
+	if !ok || ns == nil || ns.conn == nil || ns.conn.conn == nil {
+		return CommandResult{}, errors.New("节点不在线")
+	}
+
+	requestID := fmt.Sprintf("%d_%d", nodeID, time.Now().UnixNano())
+	ch := make(chan CommandResult, 1)
+
+	s.mu.Lock()
+	s.pending[requestID] = pendingRequest{nodeID: nodeID, ch: ch}
+	s.mu.Unlock()
+
+	cleanup := func() {
+		s.mu.Lock()
+		if p, exists := s.pending[requestID]; exists {
+			delete(s.pending, requestID)
+			close(p.ch)
+		}
+		s.mu.Unlock()
+	}
+
+	cmdPayload := map[string]interface{}{
+		"type":      cmdType,
+		"data":      data,
+		"requestId": requestID,
+	}
+	rawCmd, err := json.Marshal(cmdPayload)
+	if err != nil {
+		cleanup()
+		return CommandResult{}, err
+	}
+
+	messageData := rawCmd
+	if strings.TrimSpace(ns.secret) != "" {
+		crypto, err := security.NewAESCrypto(ns.secret)
+		if err != nil {
+			cleanup()
+			return CommandResult{}, err
+		}
+		encrypted, err := crypto.Encrypt(rawCmd)
+		if err != nil {
+			cleanup()
+			return CommandResult{}, err
+		}
+		wrapper := map[string]interface{}{
+			"encrypted": true,
+			"data":      encrypted,
+			"timestamp": time.Now().UnixMilli(),
+		}
+		messageData, err = json.Marshal(wrapper)
+		if err != nil {
+			cleanup()
+			return CommandResult{}, err
+		}
+	}
+
+	ns.conn.mu.Lock()
+	err = ns.conn.conn.WriteMessage(websocket.TextMessage, messageData)
+	ns.conn.mu.Unlock()
+	if err != nil {
+		cleanup()
+		return CommandResult{}, err
+	}
+
+	select {
+	case result, ok := <-ch:
+		if !ok {
+			return CommandResult{}, errors.New("命令通道已关闭")
+		}
+		if !result.Success {
+			if strings.TrimSpace(result.Message) == "" {
+				result.Message = "命令执行失败"
+			}
+			return result, errors.New(result.Message)
+		}
+		return result, nil
+	case <-time.After(timeout):
+		cleanup()
+		return CommandResult{}, errors.New("等待节点响应超时")
+	}
+}
+
+func (s *Server) tryResolvePending(nodeID int64, message string) {
+	if s == nil || strings.TrimSpace(message) == "" {
+		return
+	}
+
+	var resp commandResponse
+	if err := json.Unmarshal([]byte(message), &resp); err != nil {
+		return
+	}
+	if strings.TrimSpace(resp.RequestID) == "" {
+		return
+	}
+
+	s.mu.Lock()
+	p, ok := s.pending[resp.RequestID]
+	if ok {
+		delete(s.pending, resp.RequestID)
+	}
+	s.mu.Unlock()
+	if !ok {
+		return
+	}
+	if p.nodeID != nodeID {
+		select {
+		case p.ch <- CommandResult{Type: resp.Type, Success: false, Message: "节点响应与请求不匹配"}:
+		default:
+		}
+		close(p.ch)
+		return
+	}
+
+	result := CommandResult{
+		Type:    resp.Type,
+		Success: resp.Success,
+		Message: resp.Message,
+	}
+	if len(resp.Data) > 0 {
+		var data map[string]interface{}
+		if err := json.Unmarshal(resp.Data, &data); err == nil {
+			result.Data = data
+		}
+	}
+
+	select {
+	case p.ch <- result:
+	default:
+	}
+	close(p.ch)
+}
+
+func (s *Server) failPendingForNode(nodeID int64, message string) {
+	if s == nil {
+		return
+	}
+
+	type pair struct {
+		id string
+		pr pendingRequest
+	}
+	items := make([]pair, 0)
+
+	s.mu.Lock()
+	for id, pr := range s.pending {
+		if pr.nodeID != nodeID {
+			continue
+		}
+		items = append(items, pair{id: id, pr: pr})
+		delete(s.pending, id)
+	}
+	s.mu.Unlock()
+
+	for _, item := range items {
+		select {
+		case item.pr.ch <- CommandResult{Success: false, Message: message}:
+		default:
+		}
+		close(item.pr.ch)
+	}
+}
+
+func (s *Server) broadcastStatus(nodeID int64, status int) {
+	payload := map[string]interface{}{
+		"id":   strconv.FormatInt(nodeID, 10),
+		"type": "status",
+		"data": status,
+	}
+	raw, _ := json.Marshal(payload)
+	s.broadcastToAdmins(string(raw))
+}
+
+func (s *Server) broadcastInfo(nodeID int64, data string) {
+	payload := broadcastMessage{ID: nodeID, Type: "info", Data: data}
+	raw, _ := json.Marshal(payload)
+	s.broadcastToAdmins(string(raw))
+}
+
+func (s *Server) broadcastToAdmins(message string) {
+	s.mu.RLock()
+	admins := make([]*connWrap, 0, len(s.admins))
+	for c := range s.admins {
+		admins = append(admins, c)
+	}
+	s.mu.RUnlock()
+
+	for _, c := range admins {
+		c.mu.Lock()
+		err := c.conn.WriteMessage(websocket.TextMessage, []byte(message))
+		c.mu.Unlock()
+		if err != nil {
+			log.Printf("websocket broadcast failed: %v", err)
+		}
+	}
+}
+
+func decryptIfNeeded(payload []byte, secret string) string {
+	text := string(payload)
+	var wrap encryptedMessage
+	if err := json.Unmarshal(payload, &wrap); err != nil || !wrap.Encrypted || strings.TrimSpace(wrap.Data) == "" {
+		return text
+	}
+
+	crypto, err := security.NewAESCrypto(secret)
+	if err != nil {
+		return text
+	}
+	plain, err := crypto.Decrypt(wrap.Data)
+	if err != nil {
+		return text
+	}
+	return string(plain)
+}
+
+func parseIntDefault(v string, fallback int) int {
+	x, err := strconv.Atoi(v)
+	if err != nil {
+		return fallback
+	}
+	return x
+}
@@ -0,0 +1,90 @@
+package contract_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/middleware"
+	"go-backend/internal/http/response"
+)
+
+func TestJWTMiddlewareContracts(t *testing.T) {
+	secret := "unit-test-secret"
+
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		response.WriteJSON(w, response.OK("pass"))
+	})
+
+	wrapped := middleware.JWT(middleware.AuthOptions{JWTSecret: secret})(next)
+
+	t.Run("login path is excluded", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", nil)
+		res := httptest.NewRecorder()
+		wrapped.ServeHTTP(res, req)
+		assertCode(t, res, 0)
+	})
+
+	t.Run("missing token returns 401 contract message", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
+		res := httptest.NewRecorder()
+		wrapped.ServeHTTP(res, req)
+		assertCodeMsg(t, res, 401, "未登录或token已过期")
+	})
+
+	t.Run("invalid token returns 401 contract message", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
+		req.Header.Set("Authorization", "invalid.token.value")
+		res := httptest.NewRecorder()
+		wrapped.ServeHTTP(res, req)
+		assertCodeMsg(t, res, 401, "无效的token或token已过期")
+	})
+
+	t.Run("valid token reaches next", func(t *testing.T) {
+		token, err := auth.GenerateToken(1, "admin_user", 0, secret)
+		if err != nil {
+			t.Fatalf("generate token: %v", err)
+		}
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
+		req.Header.Set("Authorization", token)
+		res := httptest.NewRecorder()
+		wrapped.ServeHTTP(res, req)
+		assertCode(t, res, 0)
+	})
+
+	t.Run("non-admin blocked on admin path", func(t *testing.T) {
+		token, err := auth.GenerateToken(2, "normal_user", 1, secret)
+		if err != nil {
+			t.Fatalf("generate token: %v", err)
+		}
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/config/update", nil)
+		req.Header.Set("Authorization", token)
+		res := httptest.NewRecorder()
+		wrapped.ServeHTTP(res, req)
+		assertCodeMsg(t, res, 403, "权限不足，仅管理员可操作")
+	})
+}
+
+func assertCode(t *testing.T, rec *httptest.ResponseRecorder, expected int) {
+	t.Helper()
+	var out response.R
+	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code != expected {
+		t.Fatalf("expected code %d, got %d", expected, out.Code)
+	}
+}
+
+func assertCodeMsg(t *testing.T, rec *httptest.ResponseRecorder, expectedCode int, expectedMsg string) {
+	t.Helper()
+	var out response.R
+	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code != expectedCode || out.Msg != expectedMsg {
+		t.Fatalf("expected (%d,%q), got (%d,%q)", expectedCode, expectedMsg, out.Code, out.Msg)
+	}
+}
@@ -0,0 +1,239 @@
+package contract
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	httpserver "go-backend/internal/http"
+	"go-backend/internal/http/handler"
+	"go-backend/internal/http/response"
+	"go-backend/internal/store/sqlite"
+)
+
+func TestDiagnosisChainCoverageContracts(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupDiagnosisContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	tunnelRes, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "diagnose-chain-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
+
+	insertNode := func(name, ip string) int64 {
+		res, err := repo.DB().Exec(`
+			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
+			t.Fatalf("insert node %s: %v", name, err)
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
+	}
+
+	entryNodeID := insertNode("entry-node", "10.0.1.10")
+	chainNodeID := insertNode("chain-node", "10.0.1.20")
+	exitNodeID := insertNode("exit-node", "10.0.1.30")
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
+	`, tunnelID, entryNodeID); err != nil {
+		t.Fatalf("insert entry chain: %v", err)
+	}
+	if _, err := repo.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 2, ?, 30002, 'round', 1, 'tls')
+	`, tunnelID, chainNodeID); err != nil {
+		t.Fatalf("insert middle chain: %v", err)
+	}
+	if _, err := repo.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 3, ?, 30003, 'round', 1, 'tls')
+	`, tunnelID, exitNodeID); err != nil {
+		t.Fatalf("insert exit chain: %v", err)
+	}
+
+	forwardRes, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
+	`, 2, "normal_user", "chain-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 0)
+	if err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+	forwardID, err := forwardRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get forward id: %v", err)
+	}
+
+	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate user token: %v", err)
+	}
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	t.Run("forward diagnose includes entry chain exit paths", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/diagnose", bytes.NewBufferString(`{"forwardId":`+strconv.FormatInt(forwardID, 10)+`}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+
+		payload, ok := out.Data.(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object payload, got %T", out.Data)
+		}
+		results, ok := payload["results"].([]interface{})
+		if !ok || len(results) == 0 {
+			t.Fatalf("expected non-empty results, got %v", payload["results"])
+		}
+
+		hasEntryToChain := false
+		hasChainToExit := false
+		hasExitToTarget := false
+		for _, raw := range results {
+			item, ok := raw.(map[string]interface{})
+			if !ok {
+				t.Fatalf("expected result object, got %T", raw)
+			}
+			if strings.TrimSpace(valueAsString(item["message"])) == "" {
+				t.Fatalf("expected non-empty message field")
+			}
+			from := valueAsInt(item["fromChainType"])
+			to := valueAsInt(item["toChainType"])
+			if from == 1 && to == 2 {
+				hasEntryToChain = true
+			}
+			if from == 2 && to == 3 {
+				hasChainToExit = true
+			}
+			if from == 3 {
+				hasExitToTarget = true
+			}
+		}
+
+		if !hasEntryToChain || !hasChainToExit || !hasExitToTarget {
+			t.Fatalf("expected entry->chain, chain->exit, exit->target coverage; got entry=%v chain=%v exit=%v", hasEntryToChain, hasChainToExit, hasExitToTarget)
+		}
+	})
+
+	t.Run("tunnel diagnose includes entry chain exit groups", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(`{"tunnelId":`+strconv.FormatInt(tunnelID, 10)+`}`))
+		req.Header.Set("Authorization", adminToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+
+		payload, ok := out.Data.(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object payload, got %T", out.Data)
+		}
+		results, ok := payload["results"].([]interface{})
+		if !ok || len(results) == 0 {
+			t.Fatalf("expected non-empty results, got %v", payload["results"])
+		}
+
+		hasEntry := false
+		hasChain := false
+		hasExit := false
+		for _, raw := range results {
+			item, ok := raw.(map[string]interface{})
+			if !ok {
+				t.Fatalf("expected result object, got %T", raw)
+			}
+			if strings.TrimSpace(valueAsString(item["message"])) == "" {
+				t.Fatalf("expected non-empty message field")
+			}
+			switch valueAsInt(item["fromChainType"]) {
+			case 1:
+				hasEntry = true
+			case 2:
+				hasChain = true
+			case 3:
+				hasExit = true
+			}
+		}
+
+		if !hasEntry || !hasChain || !hasExit {
+			t.Fatalf("expected entry/chain/exit groups, got entry=%v chain=%v exit=%v", hasEntry, hasChain, hasExit)
+		}
+	})
+}
+
+func valueAsInt(v interface{}) int {
+	switch n := v.(type) {
+	case float64:
+		return int(n)
+	case int:
+		return n
+	case int64:
+		return int(n)
+	default:
+		return 0
+	}
+}
+
+func valueAsString(v interface{}) string {
+	s, _ := v.(string)
+	return s
+}
+
+func setupDiagnosisContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "diagnosis-contract.db")
+	repo, err := sqlite.Open(dbPath)
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = repo.Close()
+	})
+
+	h := handler.New(repo, jwtSecret)
+	return httpserver.NewRouter(h, jwtSecret), repo
+}
@@ -0,0 +1,44 @@
+package contract_test
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"go-backend/internal/http/handler"
+)
+
+func TestFlowEndpointsStringResponses(t *testing.T) {
+	h := handler.New(nil, "secret")
+	mux := http.NewServeMux()
+	h.Register(mux)
+
+	tests := []struct {
+		name     string
+		method   string
+		path     string
+		expected string
+	}{
+		{name: "flow test", method: http.MethodGet, path: "/flow/test", expected: "test"},
+		{name: "flow config", method: http.MethodPost, path: "/flow/config?secret=abc", expected: "ok"},
+		{name: "flow upload", method: http.MethodPost, path: "/flow/upload?secret=abc", expected: "ok"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.method, tc.path, nil)
+			res := httptest.NewRecorder()
+			mux.ServeHTTP(res, req)
+
+			body, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("read body: %v", err)
+			}
+
+			if string(body) != tc.expected {
+				t.Fatalf("expected %q, got %q", tc.expected, string(body))
+			}
+		})
+	}
+}
@@ -0,0 +1,535 @@
+package contract_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/response"
+)
+
+func TestForwardOwnershipAndScopeContracts(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	res, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "contract-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
+
+	nodeRes, err := repo.DB().Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "entry-node", "entry-secret", "10.0.0.10", "10.0.0.10", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+	if err != nil {
+		t.Fatalf("insert node: %v", err)
+	}
+	entryNodeID, err := nodeRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get node id: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 1, ?, 20001, 'round', 1, 'tls')
+	`, tunnelID, entryNodeID); err != nil {
+		t.Fatalf("insert chain_tunnel: %v", err)
+	}
+
+	resAdmin, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
+	`, 1, "admin_user", "admin-forward", tunnelID, "1.1.1.1:443", "fifo", now, now, 0)
+	if err != nil {
+		t.Fatalf("insert admin forward: %v", err)
+	}
+	adminForwardID, err := resAdmin.LastInsertId()
+	if err != nil {
+		t.Fatalf("get admin forward id: %v", err)
+	}
+
+	resUser, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
+	`, 2, "normal_user", "user-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 1)
+	if err != nil {
+		t.Fatalf("insert user forward: %v", err)
+	}
+	userForwardID, err := resUser.LastInsertId()
+	if err != nil {
+		t.Fatalf("get user forward id: %v", err)
+	}
+
+	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate user token: %v", err)
+	}
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	t.Run("non-owner cannot delete another user's forward", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/delete", bytes.NewBufferString(`{"id":`+jsonNumber(adminForwardID)+`}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		assertCodeMsg(t, res, -1, "转发不存在")
+	})
+
+	t.Run("non-admin forward list is scoped to owner", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/list", bytes.NewBufferString(`{}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+		arr, ok := out.Data.([]interface{})
+		if !ok {
+			t.Fatalf("expected array data, got %T", out.Data)
+		}
+		if len(arr) != 1 {
+			t.Fatalf("expected 1 forward, got %d", len(arr))
+		}
+		item, ok := arr[0].(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object item, got %T", arr[0])
+		}
+		if got := int64(item["id"].(float64)); got != userForwardID {
+			t.Fatalf("expected forward id %d, got %d", userForwardID, got)
+		}
+	})
+
+	t.Run("forward diagnose returns structured payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/diagnose", bytes.NewBufferString(`{"forwardId":`+jsonNumber(userForwardID)+`}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+
+		payload, ok := out.Data.(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object payload, got %T", out.Data)
+		}
+		results, ok := payload["results"].([]interface{})
+		if !ok || len(results) == 0 {
+			t.Fatalf("expected non-empty results, got %v", payload["results"])
+		}
+		first, ok := results[0].(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected result object, got %T", results[0])
+		}
+		if _, ok := first["message"]; !ok {
+			t.Fatalf("expected message field in diagnosis result")
+		}
+		if got := int(first["fromChainType"].(float64)); got != 1 {
+			t.Fatalf("expected fromChainType=1, got %d", got)
+		}
+	})
+
+	t.Run("tunnel diagnose returns structured payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(`{"tunnelId":`+jsonNumber(tunnelID)+`}`))
+		req.Header.Set("Authorization", adminToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+
+		payload, ok := out.Data.(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object payload, got %T", out.Data)
+		}
+		results, ok := payload["results"].([]interface{})
+		if !ok || len(results) == 0 {
+			t.Fatalf("expected non-empty results, got %v", payload["results"])
+		}
+		first, ok := results[0].(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected result object, got %T", results[0])
+		}
+		if _, ok := first["message"]; !ok {
+			t.Fatalf("expected message field in tunnel diagnosis result")
+		}
+	})
+}
+
+func TestForwardSwitchTunnelRollbackOnSyncFailure(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'switch_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	insertTunnel := func(name string, inx int) int64 {
+		res, err := repo.DB().Exec(`
+			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, 1.0, 1, "tls", 99999, now, now, 1, nil, inx)
+		if err != nil {
+			t.Fatalf("insert tunnel %s: %v", name, err)
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get tunnel id %s: %v", name, err)
+		}
+		return id
+	}
+
+	insertNode := func(name, ip, portRange string, inx int) int64 {
+		res, err := repo.DB().Exec(`
+			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", inx)
+		if err != nil {
+			t.Fatalf("insert node %s: %v", name, err)
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
+	}
+
+	tunnelA := insertTunnel("switch-tunnel-a", 0)
+	tunnelB := insertTunnel("switch-tunnel-b", 1)
+	nodeA := insertNode("switch-node-a", "10.10.0.1", "21000-21010", 0)
+	nodeB := insertNode("switch-node-b", "10.10.0.2", "22000-22010", 1)
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 1, ?, 21001, 'round', 1, 'tls')
+	`, tunnelA, nodeA); err != nil {
+		t.Fatalf("insert chain_tunnel tunnelA: %v", err)
+	}
+	if _, err := repo.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 1, ?, 22001, 'round', 1, 'tls')
+	`, tunnelB, nodeB); err != nil {
+		t.Fatalf("insert chain_tunnel tunnelB: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(10, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
+	`, tunnelA); err != nil {
+		t.Fatalf("insert user_tunnel A: %v", err)
+	}
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(11, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
+	`, tunnelB); err != nil {
+		t.Fatalf("insert user_tunnel B: %v", err)
+	}
+
+	forwardRes, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(2, 'switch_user', 'switch-forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
+	`, tunnelA, now, now)
+	if err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+	forwardID, err := forwardRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get forward id: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeA, 21001); err != nil {
+		t.Fatalf("insert forward_port: %v", err)
+	}
+
+	payload := `{"id":` + jsonNumber(forwardID) + `,"tunnelId":` + jsonNumber(tunnelB) + `}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/update", bytes.NewBufferString(payload))
+	req.Header.Set("Authorization", adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code == 0 {
+		t.Fatalf("expected update failure when node is offline")
+	}
+
+	var tunnelAfter int64
+	if err := repo.DB().QueryRow(`SELECT tunnel_id FROM forward WHERE id = ?`, forwardID).Scan(&tunnelAfter); err != nil {
+		t.Fatalf("query forward tunnel_id: %v", err)
+	}
+	if tunnelAfter != tunnelA {
+		t.Fatalf("expected tunnel rollback to %d, got %d", tunnelA, tunnelAfter)
+	}
+
+	var nodeAfter int64
+	var portAfter int
+	if err := repo.DB().QueryRow(`SELECT node_id, port FROM forward_port WHERE forward_id = ? LIMIT 1`, forwardID).Scan(&nodeAfter, &portAfter); err != nil {
+		t.Fatalf("query forward_port: %v", err)
+	}
+	if nodeAfter != nodeA || portAfter != 21001 {
+		t.Fatalf("expected forward_port rollback to node=%d port=21001, got node=%d port=%d", nodeA, nodeAfter, portAfter)
+	}
+}
+
+func TestForwardBatchChangeTunnelRollbackOnSyncFailure(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'batch_switch_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	tunnelResA, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES('batch-switch-tunnel-a', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel A: %v", err)
+	}
+	tunnelA, _ := tunnelResA.LastInsertId()
+
+	tunnelResB, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES('batch-switch-tunnel-b', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 1)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel B: %v", err)
+	}
+	tunnelB, _ := tunnelResB.LastInsertId()
+
+	nodeResA, err := repo.DB().Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+		VALUES('batch-switch-node-a', 'batch-switch-node-a-secret', '10.11.0.1', '10.11.0.1', '', '23000-23010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert node A: %v", err)
+	}
+	nodeA, _ := nodeResA.LastInsertId()
+
+	nodeResB, err := repo.DB().Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+		VALUES('batch-switch-node-b', 'batch-switch-node-b-secret', '10.11.0.2', '10.11.0.2', '', '24000-24010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 1)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert node B: %v", err)
+	}
+	nodeB, _ := nodeResB.LastInsertId()
+
+	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, 1, ?, 23001, 'round', 1, 'tls')`, tunnelA, nodeA); err != nil {
+		t.Fatalf("insert chain_tunnel A: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, 1, ?, 24001, 'round', 1, 'tls')`, tunnelB, nodeB); err != nil {
+		t.Fatalf("insert chain_tunnel B: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(20, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)`, tunnelA); err != nil {
+		t.Fatalf("insert user_tunnel A: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(21, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)`, tunnelB); err != nil {
+		t.Fatalf("insert user_tunnel B: %v", err)
+	}
+
+	forwardRes, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(2, 'batch_switch_user', 'batch-switch-forward', ?, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
+	`, tunnelA, now, now)
+	if err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+	forwardID, _ := forwardRes.LastInsertId()
+
+	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeA, 23001); err != nil {
+		t.Fatalf("insert forward_port: %v", err)
+	}
+
+	payload := `{"forwardIds":[` + jsonNumber(forwardID) + `],"targetTunnelId":` + jsonNumber(tunnelB) + `}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/batch-change-tunnel", bytes.NewBufferString(payload))
+	req.Header.Set("Authorization", adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code != 0 {
+		t.Fatalf("expected API success envelope, got code=%d msg=%q", out.Code, out.Msg)
+	}
+
+	result, ok := out.Data.(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected map result, got %T", out.Data)
+	}
+	if int(result["failCount"].(float64)) != 1 {
+		t.Fatalf("expected failCount=1, got %v", result["failCount"])
+	}
+
+	var tunnelAfter int64
+	if err := repo.DB().QueryRow(`SELECT tunnel_id FROM forward WHERE id = ?`, forwardID).Scan(&tunnelAfter); err != nil {
+		t.Fatalf("query forward tunnel_id: %v", err)
+	}
+	if tunnelAfter != tunnelA {
+		t.Fatalf("expected tunnel rollback to %d, got %d", tunnelA, tunnelAfter)
+	}
+
+	var nodeAfter int64
+	var portAfter int
+	if err := repo.DB().QueryRow(`SELECT node_id, port FROM forward_port WHERE forward_id = ? LIMIT 1`, forwardID).Scan(&nodeAfter, &portAfter); err != nil {
+		t.Fatalf("query forward_port: %v", err)
+	}
+	if nodeAfter != nodeA || portAfter != 23001 {
+		t.Fatalf("expected forward_port rollback to node=%d port=23001, got node=%d port=%d", nodeA, nodeAfter, portAfter)
+	}
+}
+
+func TestUserTunnelReassignmentKeepsStableID(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(100, 'stable_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	tunnelRes, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES('stable-tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, _ := tunnelRes.LastInsertId()
+
+	// 1. Assign permission (creates new user_tunnel)
+	// userTunnelBatchAssign expects structure: {userId: 123, tunnels: [{tunnelId: 456, ...}]}
+	assignPayload := `{"userId":100,"tunnels":[{"tunnelId":` + jsonNumber(tunnelID) + `}]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/batch-assign", bytes.NewBufferString(assignPayload))
+	req.Header.Set("Authorization", adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code != 0 {
+		t.Fatalf("expected code 0, got %d msg=%q", out.Code, out.Msg)
+	}
+
+	var initialID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 100 AND tunnel_id = ?`, tunnelID).Scan(&initialID); err != nil {
+		t.Fatalf("query initial user_tunnel id: %v", err)
+	}
+
+	// 2. Re-assign permission (should UPDATE, not INSERT)
+	reassignPayload := `{"userId":100,"tunnels":[{"tunnelId":` + jsonNumber(tunnelID) + `}]}`
+	req2 := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/batch-assign", bytes.NewBufferString(reassignPayload))
+	req2.Header.Set("Authorization", adminToken)
+	req2.Header.Set("Content-Type", "application/json")
+	res2 := httptest.NewRecorder()
+	router.ServeHTTP(res2, req2)
+
+	var out2 response.R
+	if err := json.NewDecoder(res2.Body).Decode(&out2); err != nil {
+		t.Fatalf("decode response 2: %v", err)
+	}
+	if out2.Code != 0 {
+		t.Fatalf("expected code 0, got %d msg=%q", out2.Code, out2.Msg)
+	}
+
+	// 3. Verify stable ID and no duplicates
+	var count int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM user_tunnel WHERE user_id = 100 AND tunnel_id = ?`, tunnelID).Scan(&count); err != nil {
+		t.Fatalf("query count: %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("expected exactly 1 user_tunnel record, got %d", count)
+	}
+
+	var currentID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 100 AND tunnel_id = ?`, tunnelID).Scan(&currentID); err != nil {
+		t.Fatalf("query current user_tunnel: %v", err)
+	}
+
+	if currentID != initialID {
+		t.Fatalf("user_tunnel ID changed from %d to %d (unstable ID!)", initialID, currentID)
+	}
+}
+
+func jsonNumber(v int64) string {
+	return strconv.FormatInt(v, 10)
+}
@@ -0,0 +1,215 @@
+package contract_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	httpserver "go-backend/internal/http"
+	"go-backend/internal/http/handler"
+	"go-backend/internal/http/response"
+	"go-backend/internal/store/sqlite"
+)
+
+func TestCaptchaVerifyLoginContract(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+
+	_, err := repo.DB().Exec(`
+		INSERT INTO vite_config(name, value, time)
+		VALUES(?, ?, ?)
+		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
+	`, "captcha_enabled", "true", time.Now().UnixMilli())
+	if err != nil {
+		t.Fatalf("enable captcha: %v", err)
+	}
+
+	t.Run("login denied without verified captcha token", func(t *testing.T) {
+		body := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":""}`)
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
+		req.Header.Set("Content-Type", "application/json")
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, -1, "验证码校验失败")
+	})
+
+	t.Run("captcha token is one-time and consumed by login", func(t *testing.T) {
+		verifyReq := httptest.NewRequest(http.MethodPost, "/api/v1/captcha/verify", bytes.NewBufferString(`{"id":"captcha-token-1","data":"ok"}`))
+		verifyReq.Header.Set("Content-Type", "application/json")
+		verifyResp := httptest.NewRecorder()
+
+		router.ServeHTTP(verifyResp, verifyReq)
+
+		var verifyOut struct {
+			Success bool `json:"success"`
+			Data    struct {
+				ValidToken string `json:"validToken"`
+			} `json:"data"`
+		}
+		if err := json.NewDecoder(verifyResp.Body).Decode(&verifyOut); err != nil {
+			t.Fatalf("decode captcha verify response: %v", err)
+		}
+		if !verifyOut.Success || verifyOut.Data.ValidToken != "captcha-token-1" {
+			t.Fatalf("unexpected captcha verify payload: success=%v token=%q", verifyOut.Success, verifyOut.Data.ValidToken)
+		}
+
+		loginBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"captcha-token-1"}`)
+		loginReq := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", loginBody)
+		loginReq.Header.Set("Content-Type", "application/json")
+		loginResp := httptest.NewRecorder()
+		router.ServeHTTP(loginResp, loginReq)
+		assertCode(t, loginResp, 0)
+
+		replayBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"captcha-token-1"}`)
+		replayReq := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", replayBody)
+		replayReq.Header.Set("Content-Type", "application/json")
+		replayResp := httptest.NewRecorder()
+		router.ServeHTTP(replayResp, replayReq)
+		assertCodeMsg(t, replayResp, -1, "验证码校验失败")
+	})
+}
+
+func TestOpenAPISubStoreContracts(t *testing.T) {
+	router, repo := setupContractRouter(t, "contract-jwt-secret")
+
+	const tunnelFlowGB = int64(500)
+	const tunnelInFlow = int64(123)
+	const tunnelOutFlow = int64(456)
+	const tunnelExpTimeMs = int64(2727251700000)
+
+	now := time.Now().UnixMilli()
+	res, err := repo.DB().Exec(`INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		"contract-tunnel", 1.0, 1, "tls", 1, now, now, 1, nil, 0)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("last insert id: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(?, ?, NULL, ?, ?, ?, ?, ?, ?, ?)`,
+		1, tunnelID, 99999, tunnelFlowGB, tunnelInFlow, tunnelOutFlow, 1, tunnelExpTimeMs, 1); err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+
+	t.Run("default user subscription payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+
+		expected := "upload=0; download=0; total=107373108658176; expire=2727251700"
+		if string(body) != expected {
+			t.Fatalf("expected body %q, got %q", expected, string(body))
+		}
+		if got := resp.Header().Get("subscription-userinfo"); got != expected {
+			t.Fatalf("expected subscription-userinfo %q, got %q", expected, got)
+		}
+		if !strings.Contains(resp.Header().Get("Content-Type"), "text/plain") {
+			t.Fatalf("expected text/plain content type, got %q", resp.Header().Get("Content-Type"))
+		}
+	})
+
+	t.Run("tunnel scoped subscription payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user&tunnel="+strconv.FormatInt(tunnelID, 10), nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+
+		expected := "upload=123; download=456; total=536870912000; expire=2727251700"
+		if string(body) != expected {
+			t.Fatalf("expected body %q, got %q", expected, string(body))
+		}
+		if got := resp.Header().Get("subscription-userinfo"); got != expected {
+			t.Fatalf("expected subscription-userinfo %q, got %q", expected, got)
+		}
+	})
+
+	t.Run("invalid credentials returns contract error", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=wrong", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, -1, "鉴权失败")
+	})
+
+	t.Run("missing tunnel returns contract error", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user&tunnel=999999", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, -1, "隧道不存在")
+	})
+}
+
+func TestSpeedLimitTunnelsRouteAlias(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, _ := setupContractRouter(t, secret)
+
+	t.Run("missing token blocked", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, 401, "未登录或token已过期")
+	})
+
+	t.Run("admin token receives success envelope", func(t *testing.T) {
+		token, err := auth.GenerateToken(1, "admin_user", 0, secret)
+		if err != nil {
+			t.Fatalf("generate token: %v", err)
+		}
+
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
+		req.Header.Set("Authorization", token)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		var out response.R
+		if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+	})
+}
+
+func setupContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "contract.db")
+	repo, err := sqlite.Open(dbPath)
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = repo.Close()
+	})
+
+	h := handler.New(repo, jwtSecret)
+	return httpserver.NewRouter(h, jwtSecret), repo
+}
@@ -0,0 +1,151 @@
+package contract_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/response"
+)
+
+func TestTunnelCreateRuntimeRollbackContract(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	insertNode := func(name, ip, portRange string) int64 {
+		res, err := repo.DB().Exec(`
+			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
+			t.Fatalf("insert node %s: %v", name, err)
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
+	}
+
+	entryID := insertNode("create-entry", "10.20.0.1", "30000-30010")
+	chainID := insertNode("create-chain", "10.20.0.2", "31000-31010")
+	exitID := insertNode("create-exit", "10.20.0.3", "32000-32010")
+
+	payload := `{"name":"runtime-rollback-tunnel","type":2,"flow":99999,"status":1,"inNodeId":[{"nodeId":` + jsonInt(entryID) + `,"protocol":"tls"}],"chainNodes":[[{"nodeId":` + jsonInt(chainID) + `,"protocol":"tls","strategy":"round"}]],"outNodeId":[{"nodeId":` + jsonInt(exitID) + `,"protocol":"tls"}]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/create", bytes.NewBufferString(payload))
+	req.Header.Set("Authorization", adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code == 0 {
+		t.Fatalf("expected create failure when nodes are offline")
+	}
+	if !strings.Contains(out.Msg, "节点") {
+		t.Fatalf("expected node-related error, got %q", out.Msg)
+	}
+
+	var tunnelCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM tunnel WHERE name = ?`, "runtime-rollback-tunnel").Scan(&tunnelCount); err != nil {
+		t.Fatalf("count tunnel: %v", err)
+	}
+	if tunnelCount != 0 {
+		t.Fatalf("expected tunnel rollback, found %d records", tunnelCount)
+	}
+
+	var chainCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM chain_tunnel`).Scan(&chainCount); err != nil {
+		t.Fatalf("count chain_tunnel: %v", err)
+	}
+	if chainCount != 0 {
+		t.Fatalf("expected chain_tunnel rollback, found %d records", chainCount)
+	}
+}
+
+func TestTunnelUpdateAssignsChainPortsContract(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	insertNode := func(name, ip, portRange string) int64 {
+		res, err := repo.DB().Exec(`
+			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
+			t.Fatalf("insert node %s: %v", name, err)
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
+	}
+
+	entryID := insertNode("update-entry", "10.30.0.1", "40000-40010")
+	chainID := insertNode("update-chain", "10.30.0.2", "41000-41010")
+	exitID := insertNode("update-exit", "10.30.0.3", "42000-42010")
+
+	tunnelRes, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "update-port-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
+
+	payload := `{"id":` + jsonInt(tunnelID) + `,"name":"update-port-tunnel","type":2,"flow":99999,"trafficRatio":1.0,"status":1,"inNodeId":[{"nodeId":` + jsonInt(entryID) + `,"protocol":"tls"}],"chainNodes":[[{"nodeId":` + jsonInt(chainID) + `,"protocol":"tls","strategy":"round"}]],"outNodeId":[{"nodeId":` + jsonInt(exitID) + `,"protocol":"tls"}]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", bytes.NewBufferString(payload))
+	req.Header.Set("Authorization", adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+	assertCode(t, res, 0)
+
+	var chainPort int
+	if err := repo.DB().QueryRow(`SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 2 LIMIT 1`, tunnelID).Scan(&chainPort); err != nil {
+		t.Fatalf("query chain port: %v", err)
+	}
+	if chainPort <= 0 {
+		t.Fatalf("expected chain node port to be assigned, got %d", chainPort)
+	}
+
+	var outPort int
+	if err := repo.DB().QueryRow(`SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 3 LIMIT 1`, tunnelID).Scan(&outPort); err != nil {
+		t.Fatalf("query out port: %v", err)
+	}
+	if outPort <= 0 {
+		t.Fatalf("expected out node port to be assigned, got %d", outPort)
+	}
+}
+
+func jsonInt(v int64) string {
+	return strconv.FormatInt(v, 10)
+}
@@ -0,0 +1,138 @@
+package contract
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/response"
+)
+
+func TestUserTunnelVisibleListContracts(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupDiagnosisContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	insertTunnel := func(name string, status int, inx int64) int64 {
+		res, err := repo.DB().Exec(`
+			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, 1.0, 1, "tls", 99999, now, now, status, nil, inx)
+		if err != nil {
+			t.Fatalf("insert tunnel %s: %v", name, err)
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get tunnel id %s: %v", name, err)
+		}
+		return id
+	}
+
+	enabledA := insertTunnel("enabled-A", 1, 1)
+	enabledB := insertTunnel("enabled-B", 1, 2)
+	disabledC := insertTunnel("disabled-C", 0, 3)
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(?, ?, NULL, ?, ?, 0, 0, ?, ?, ?)
+	`, 2, enabledA, 100, 1000, 1, 2727251700000, 0); err != nil {
+		t.Fatalf("insert user_tunnel enabledA: %v", err)
+	}
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(?, ?, NULL, ?, ?, 0, 0, ?, ?, ?)
+	`, 2, enabledB, 100, 1000, 1, 2727251700000, 1); err != nil {
+		t.Fatalf("insert user_tunnel enabledB: %v", err)
+	}
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(?, ?, NULL, ?, ?, 0, 0, ?, ?, ?)
+	`, 2, disabledC, 100, 1000, 1, 2727251700000, 1); err != nil {
+		t.Fatalf("insert user_tunnel disabledC: %v", err)
+	}
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate user token: %v", err)
+	}
+
+	t.Run("admin sees all enabled tunnels without user_tunnel rows", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/tunnel", nil)
+		req.Header.Set("Authorization", adminToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+
+		ids := collectTunnelIDs(t, out.Data)
+		if !ids[enabledA] || !ids[enabledB] {
+			t.Fatalf("expected enabled tunnels for admin, got %v", ids)
+		}
+		if ids[disabledC] {
+			t.Fatalf("did not expect disabled tunnel for admin")
+		}
+	})
+
+	t.Run("normal user sees enabled assigned tunnels regardless of user_tunnel status", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/tunnel", nil)
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+
+		ids := collectTunnelIDs(t, out.Data)
+		if !ids[enabledA] || !ids[enabledB] {
+			t.Fatalf("expected enabled assigned tunnels for user, got %v", ids)
+		}
+		if ids[disabledC] {
+			t.Fatalf("did not expect disabled tunnel for user")
+		}
+	})
+}
+
+func collectTunnelIDs(t *testing.T, data interface{}) map[int64]bool {
+	t.Helper()
+	arr, ok := data.([]interface{})
+	if !ok {
+		t.Fatalf("expected array data, got %T", data)
+	}
+	ids := make(map[int64]bool, len(arr))
+	for _, item := range arr {
+		obj, ok := item.(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object item, got %T", item)
+		}
+		id := int64(obj["id"].(float64))
+		ids[id] = true
+	}
+	return ids
+}
@@ -43,8 +43,8 @@ func updateChain(req updateChainRequest) error {

 	name := strings.TrimSpace(req.Chain)

-	if !registry.ChainRegistry().IsRegistered(name) {
-		return errors.New("chain " + name + " not found")
+	if registry.ChainRegistry().IsRegistered(name) {
+		registry.ChainRegistry().Unregister(name)
 	}

 	req.Data.Name = name
@@ -54,19 +54,22 @@ func updateChain(req updateChainRequest) error {
 		return errors.New("create chain " + name + " failed: " + err.Error())
 	}

-	registry.ChainRegistry().Unregister(name)
-
 	if err := registry.ChainRegistry().Register(name, v); err != nil {
 		return errors.New("chain " + name + " already exists")
 	}

 	config.OnUpdate(func(c *config.Config) error {
+		found := false
 		for i := range c.Chains {
 			if c.Chains[i].Name == name {
 				c.Chains[i] = &req.Data
+				found = true
 				break
 			}
 		}
+		if !found {
+			c.Chains = append(c.Chains, &req.Data)
+		}
 		return nil
 	})

@@ -77,10 +80,9 @@ func deleteChain(req deleteChainRequest) error {

 	name := strings.TrimSpace(req.Chain)

-	if !registry.ChainRegistry().IsRegistered(name) {
-		return errors.New("chain " + name + " not found")
+	if registry.ChainRegistry().IsRegistered(name) {
+		registry.ChainRegistry().Unregister(name)
 	}
-	registry.ChainRegistry().Unregister(name)

 	config.OnUpdate(func(c *config.Config) error {
 		chains := c.Chains
@@ -37,27 +37,30 @@ func updateLimiter(req updateLimiterRequest) error {

 	name := strings.TrimSpace(req.Limiter)

-	if !registry.TrafficLimiterRegistry().IsRegistered(name) {
-		return errors.New("limiter " + name + " not found")
+	if registry.TrafficLimiterRegistry().IsRegistered(name) {
+		registry.TrafficLimiterRegistry().Unregister(name)
 	}

 	req.Data.Name = name

 	v := parser.ParseTrafficLimiter(&req.Data)

-	registry.TrafficLimiterRegistry().Unregister(name)
-
 	if err := registry.TrafficLimiterRegistry().Register(name, v); err != nil {
 		return errors.New("limiter " + name + " already exists")
 	}

 	config.OnUpdate(func(c *config.Config) error {
+		found := false
 		for i := range c.Limiters {
 			if c.Limiters[i].Name == name {
 				c.Limiters[i] = &req.Data
+				found = true
 				break
 			}
 		}
+		if !found {
+			c.Limiters = append(c.Limiters, &req.Data)
+		}
 		return nil
 	})

@@ -68,10 +71,9 @@ func deleteLimiter(req deleteLimiterRequest) error {

 	name := strings.TrimSpace(req.Limiter)

-	if !registry.TrafficLimiterRegistry().IsRegistered(name) {
-		return errors.New("limiter " + name + " not found")
+	if registry.TrafficLimiterRegistry().IsRegistered(name) {
+		registry.TrafficLimiterRegistry().Unregister(name)
 	}
-	registry.TrafficLimiterRegistry().Unregister(name)

 	config.OnUpdate(func(c *config.Config) error {
 		limiteres := c.Limiters
@@ -87,36 +87,32 @@ func updateServices(req updateServicesRequest) error {
 		return errors.New("services list cannot be empty")
 	}

-	// 第一阶段：验证所有服务存在
-	for _, serviceConfig := range req.Data {
-		name := strings.TrimSpace(serviceConfig.Name)
+	// 第一阶段：验证所有服务名称有效性
+	for i := range req.Data {
+		name := strings.TrimSpace(req.Data[i].Name)
 		if name == "" {
 			return errors.New("service name is required")
 		}
-		serviceConfig.Name = name
-
-		old := registry.ServiceRegistry().Get(name)
-		if old == nil {
-			return errors.New("service " + name + " not found")
-		}
+		req.Data[i].Name = name
 	}

-	// 第二阶段：按照原来的updateService逻辑，逐个更新服务
-	for _, serviceConfig := range req.Data {
-		name := strings.TrimSpace(serviceConfig.Name)
-		serviceConfig.Name = name
+	// 第二阶段：逐个更新服务（Upsert模式：存在则更新，不存在则创建）
+	for i := range req.Data {
+		serviceConfig := &req.Data[i]
+		name := serviceConfig.Name

 		// 1. 获取旧服务
 		old := registry.ServiceRegistry().Get(name)

-		// 2. 关闭旧服务
-		old.Close()
-
-		// 3. 从注册表移除旧服务
-		registry.ServiceRegistry().Unregister(name)
+		// 2. 关闭旧服务 (如果存在)
+		if old != nil {
+			old.Close()
+			// 3. 从注册表移除旧服务
+			registry.ServiceRegistry().Unregister(name)
+		}

 		// 4. 解析新服务配置
-		svc, err := parser.ParseService(&serviceConfig)
+		svc, err := parser.ParseService(serviceConfig)
 		if err != nil {
 			return errors.New("create service " + name + " failed: " + err.Error())
 		}
@@ -133,13 +129,20 @@ func updateServices(req updateServicesRequest) error {

 	// 第三阶段：更新配置
 	config.OnUpdate(func(c *config.Config) error {
-		for _, serviceConfig := range req.Data {
-			for i := range c.Services {
-				if c.Services[i].Name == serviceConfig.Name {
-					c.Services[i] = &serviceConfig
+		for i := range req.Data {
+			// 创建副本以确保指针安全
+			cfgCopy := req.Data[i]
+			found := false
+			for j := range c.Services {
+				if c.Services[j].Name == cfgCopy.Name {
+					c.Services[j] = &cfgCopy
+					found = true
 					break
 				}
 			}
+			if !found {
+				c.Services = append(c.Services, &cfgCopy)
+			}
 		}
 		return nil
 	})
@@ -158,22 +161,22 @@ func deleteServices(req deleteServicesRequest) error {
 		name    string
 		service service.Service
 	}
+	var namesToRemove []string

 	for _, serviceName := range req.Services {
 		name := strings.TrimSpace(serviceName)
 		if name == "" {
 			return errors.New("service name is required")
 		}
+		namesToRemove = append(namesToRemove, name)

 		svc := registry.ServiceRegistry().Get(name)
-		if svc == nil {
-			return errors.New("service " + name + " not found")
+		if svc != nil {
+			servicesToDelete = append(servicesToDelete, struct {
+				name    string
+				service service.Service
+			}{name, svc})
 		}
-
-		servicesToDelete = append(servicesToDelete, struct {
-			name    string
-			service service.Service
-		}{name, svc})
 	}

 	// 第二阶段：删除所有服务
@@ -181,6 +184,12 @@ func deleteServices(req deleteServicesRequest) error {
 		registry.ServiceRegistry().Unregister(std.name)
 		std.service.Close()
 	}
+	// 确保所有请求删除的服务都从注册表中移除（即使之前未找到实例）
+	for _, name := range namesToRemove {
+		if registry.ServiceRegistry().IsRegistered(name) {
+			registry.ServiceRegistry().Unregister(name)
+		}
+	}

 	// 第三阶段：更新配置
 	config.OnUpdate(func(c *config.Config) error {
@@ -188,8 +197,8 @@ func deleteServices(req deleteServicesRequest) error {
 		c.Services = nil
 		for _, s := range services {
 			shouldDelete := false
-			for _, std := range servicesToDelete {
-				if s.Name == std.name {
+			for _, name := range namesToRemove {
+				if s.Name == name {
 					shouldDelete = true
 					break
 				}
@@ -1,563 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 77;
-	objects = {
-
-/* Begin PBXContainerItemProxy section */
-		296FEB8A2E56AAF900DC77A3 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = 296FEB742E56AAF700DC77A3 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 296FEB7B2E56AAF700DC77A3;
-			remoteInfo = flux;
-		};
-		296FEB942E56AAF900DC77A3 /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = 296FEB742E56AAF700DC77A3 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = 296FEB7B2E56AAF700DC77A3;
-			remoteInfo = flux;
-		};
-/* End PBXContainerItemProxy section */
-
-/* Begin PBXFileReference section */
-		296FEB7C2E56AAF700DC77A3 /* flux.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = flux.app; sourceTree = BUILT_PRODUCTS_DIR; };
-		296FEB892E56AAF900DC77A3 /* fluxTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = fluxTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
-		296FEB932E56AAF900DC77A3 /* fluxUITests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = fluxUITests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
-/* End PBXFileReference section */
-
-/* Begin PBXFileSystemSynchronizedRootGroup section */
-		296FEB7E2E56AAF700DC77A3 /* flux */ = {
-			isa = PBXFileSystemSynchronizedRootGroup;
-			path = flux;
-			sourceTree = "<group>";
-		};
-		296FEB8C2E56AAF900DC77A3 /* fluxTests */ = {
-			isa = PBXFileSystemSynchronizedRootGroup;
-			path = fluxTests;
-			sourceTree = "<group>";
-		};
-		296FEB962E56AAF900DC77A3 /* fluxUITests */ = {
-			isa = PBXFileSystemSynchronizedRootGroup;
-			path = fluxUITests;
-			sourceTree = "<group>";
-		};
-/* End PBXFileSystemSynchronizedRootGroup section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		296FEB792E56AAF700DC77A3 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		296FEB862E56AAF900DC77A3 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		296FEB902E56AAF900DC77A3 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		296FEB732E56AAF700DC77A3 = {
-			isa = PBXGroup;
-			children = (
-				296FEB7E2E56AAF700DC77A3 /* flux */,
-				296FEB8C2E56AAF900DC77A3 /* fluxTests */,
-				296FEB962E56AAF900DC77A3 /* fluxUITests */,
-				296FEB7D2E56AAF700DC77A3 /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		296FEB7D2E56AAF700DC77A3 /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				296FEB7C2E56AAF700DC77A3 /* flux.app */,
-				296FEB892E56AAF900DC77A3 /* fluxTests.xctest */,
-				296FEB932E56AAF900DC77A3 /* fluxUITests.xctest */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		296FEB7B2E56AAF700DC77A3 /* flux */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 296FEB9D2E56AAF900DC77A3 /* Build configuration list for PBXNativeTarget "flux" */;
-			buildPhases = (
-				296FEB782E56AAF700DC77A3 /* Sources */,
-				296FEB792E56AAF700DC77A3 /* Frameworks */,
-				296FEB7A2E56AAF700DC77A3 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			fileSystemSynchronizedGroups = (
-				296FEB7E2E56AAF700DC77A3 /* flux */,
-			);
-			name = flux;
-			packageProductDependencies = (
-			);
-			productName = flux;
-			productReference = 296FEB7C2E56AAF700DC77A3 /* flux.app */;
-			productType = "com.apple.product-type.application";
-		};
-		296FEB882E56AAF900DC77A3 /* fluxTests */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 296FEBA02E56AAF900DC77A3 /* Build configuration list for PBXNativeTarget "fluxTests" */;
-			buildPhases = (
-				296FEB852E56AAF900DC77A3 /* Sources */,
-				296FEB862E56AAF900DC77A3 /* Frameworks */,
-				296FEB872E56AAF900DC77A3 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				296FEB8B2E56AAF900DC77A3 /* PBXTargetDependency */,
-			);
-			fileSystemSynchronizedGroups = (
-				296FEB8C2E56AAF900DC77A3 /* fluxTests */,
-			);
-			name = fluxTests;
-			packageProductDependencies = (
-			);
-			productName = fluxTests;
-			productReference = 296FEB892E56AAF900DC77A3 /* fluxTests.xctest */;
-			productType = "com.apple.product-type.bundle.unit-test";
-		};
-		296FEB922E56AAF900DC77A3 /* fluxUITests */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 296FEBA32E56AAF900DC77A3 /* Build configuration list for PBXNativeTarget "fluxUITests" */;
-			buildPhases = (
-				296FEB8F2E56AAF900DC77A3 /* Sources */,
-				296FEB902E56AAF900DC77A3 /* Frameworks */,
-				296FEB912E56AAF900DC77A3 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				296FEB952E56AAF900DC77A3 /* PBXTargetDependency */,
-			);
-			fileSystemSynchronizedGroups = (
-				296FEB962E56AAF900DC77A3 /* fluxUITests */,
-			);
-			name = fluxUITests;
-			packageProductDependencies = (
-			);
-			productName = fluxUITests;
-			productReference = 296FEB932E56AAF900DC77A3 /* fluxUITests.xctest */;
-			productType = "com.apple.product-type.bundle.ui-testing";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		296FEB742E56AAF700DC77A3 /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				BuildIndependentTargetsInParallel = 1;
-				LastSwiftUpdateCheck = 1640;
-				LastUpgradeCheck = 1640;
-				TargetAttributes = {
-					296FEB7B2E56AAF700DC77A3 = {
-						CreatedOnToolsVersion = 16.4;
-					};
-					296FEB882E56AAF900DC77A3 = {
-						CreatedOnToolsVersion = 16.4;
-						TestTargetID = 296FEB7B2E56AAF700DC77A3;
-					};
-					296FEB922E56AAF900DC77A3 = {
-						CreatedOnToolsVersion = 16.4;
-						TestTargetID = 296FEB7B2E56AAF700DC77A3;
-					};
-				};
-			};
-			buildConfigurationList = 296FEB772E56AAF700DC77A3 /* Build configuration list for PBXProject "flux" */;
-			developmentRegion = en;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				en,
-				Base,
-			);
-			mainGroup = 296FEB732E56AAF700DC77A3;
-			minimizedProjectReferenceProxies = 1;
-			preferredProjectObjectVersion = 77;
-			productRefGroup = 296FEB7D2E56AAF700DC77A3 /* Products */;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				296FEB7B2E56AAF700DC77A3 /* flux */,
-				296FEB882E56AAF900DC77A3 /* fluxTests */,
-				296FEB922E56AAF900DC77A3 /* fluxUITests */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		296FEB7A2E56AAF700DC77A3 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		296FEB872E56AAF900DC77A3 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		296FEB912E56AAF900DC77A3 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		296FEB782E56AAF700DC77A3 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		296FEB852E56AAF900DC77A3 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		296FEB8F2E56AAF900DC77A3 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin PBXTargetDependency section */
-		296FEB8B2E56AAF900DC77A3 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = 296FEB7B2E56AAF700DC77A3 /* flux */;
-			targetProxy = 296FEB8A2E56AAF900DC77A3 /* PBXContainerItemProxy */;
-		};
-		296FEB952E56AAF900DC77A3 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = 296FEB7B2E56AAF700DC77A3 /* flux */;
-			targetProxy = 296FEB942E56AAF900DC77A3 /* PBXContainerItemProxy */;
-		};
-/* End PBXTargetDependency section */
-
-/* Begin XCBuildConfiguration section */
-		296FEB9B2E56AAF900DC77A3 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu17;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"DEBUG=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 18.5;
-				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-			};
-			name = Debug;
-		};
-		296FEB9C2E56AAF900DC77A3 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu17;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 18.5;
-				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				MTL_FAST_MATH = YES;
-				SDKROOT = iphoneos;
-				SWIFT_COMPILATION_MODE = wholemodule;
-				VALIDATE_PRODUCT = YES;
-			};
-			name = Release;
-		};
-		296FEB9E2E56AAF900DC77A3 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
-				DEVELOPMENT_TEAM = XRXD4YN2Y6;
-				ENABLE_PREVIEWS = YES;
-				GENERATE_INFOPLIST_FILE = YES;
-				INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
-				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
-				INFOPLIST_KEY_UILaunchScreen_Generation = YES;
-				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
-				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
-				IPHONEOS_DEPLOYMENT_TARGET = 15.6;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = bqlpfy.flux;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SWIFT_EMIT_LOC_STRINGS = YES;
-				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
-			};
-			name = Debug;
-		};
-		296FEB9F2E56AAF900DC77A3 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
-				DEVELOPMENT_TEAM = XRXD4YN2Y6;
-				ENABLE_PREVIEWS = YES;
-				GENERATE_INFOPLIST_FILE = YES;
-				INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
-				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
-				INFOPLIST_KEY_UILaunchScreen_Generation = YES;
-				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
-				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
-				IPHONEOS_DEPLOYMENT_TARGET = 15.6;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = bqlpfy.flux;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SWIFT_EMIT_LOC_STRINGS = YES;
-				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
-			};
-			name = Release;
-		};
-		296FEBA12E56AAF900DC77A3 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				BUNDLE_LOADER = "$(TEST_HOST)";
-				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
-				GENERATE_INFOPLIST_FILE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 18.5;
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = bqlpfy.fluxTests;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SWIFT_EMIT_LOC_STRINGS = NO;
-				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/flux.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/flux";
-			};
-			name = Debug;
-		};
-		296FEBA22E56AAF900DC77A3 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				BUNDLE_LOADER = "$(TEST_HOST)";
-				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
-				GENERATE_INFOPLIST_FILE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 18.5;
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = bqlpfy.fluxTests;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SWIFT_EMIT_LOC_STRINGS = NO;
-				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/flux.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/flux";
-			};
-			name = Release;
-		};
-		296FEBA42E56AAF900DC77A3 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
-				GENERATE_INFOPLIST_FILE = YES;
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = bqlpfy.fluxUITests;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SWIFT_EMIT_LOC_STRINGS = NO;
-				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				TEST_TARGET_NAME = flux;
-			};
-			name = Debug;
-		};
-		296FEBA52E56AAF900DC77A3 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
-				GENERATE_INFOPLIST_FILE = YES;
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = bqlpfy.fluxUITests;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SWIFT_EMIT_LOC_STRINGS = NO;
-				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				TEST_TARGET_NAME = flux;
-			};
-			name = Release;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		296FEB772E56AAF700DC77A3 /* Build configuration list for PBXProject "flux" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				296FEB9B2E56AAF900DC77A3 /* Debug */,
-				296FEB9C2E56AAF900DC77A3 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		296FEB9D2E56AAF900DC77A3 /* Build configuration list for PBXNativeTarget "flux" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				296FEB9E2E56AAF900DC77A3 /* Debug */,
-				296FEB9F2E56AAF900DC77A3 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		296FEBA02E56AAF900DC77A3 /* Build configuration list for PBXNativeTarget "fluxTests" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				296FEBA12E56AAF900DC77A3 /* Debug */,
-				296FEBA22E56AAF900DC77A3 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		296FEBA32E56AAF900DC77A3 /* Build configuration list for PBXNativeTarget "fluxUITests" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				296FEBA42E56AAF900DC77A3 /* Debug */,
-				296FEBA52E56AAF900DC77A3 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = 296FEB742E56AAF700DC77A3 /* Project object */;
-}
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Workspace
-   version = "1.0">
-   <FileRef
-      location = "self:">
-   </FileRef>
-</Workspace>
@@ -1,217 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>top-level-items</key>
-	<array>
-		<dict>
-			<key>children</key>
-			<array>
-				<dict>
-					<key>children</key>
-					<array>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/bg-Ck8MrDZ5.jpg</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/favicon-DI5FVxIz.ico</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/index-Bf4rZ0gS.css</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/index-ByTRlFFk.js</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/index-Drx943H4.js</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/index-legacy-BYgRAl5I.js</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/index-legacy-DUPUAMxs.js</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-						<dict>
-							<key>destination</key>
-							<dict>
-								<key>rebasable-url</key>
-								<dict>
-									<key>base</key>
-									<string>workspace</string>
-									<key>payload</key>
-									<dict>
-										<key>relative-path</key>
-										<string>flux/dist/assets/polyfills-legacy-DIE4kOxF.js</string>
-									</dict>
-								</dict>
-								<key>type</key>
-								<string>DVTDocumentLocation</string>
-							</dict>
-							<key>type</key>
-							<string>bookmark</string>
-						</dict>
-					</array>
-					<key>title</key>
-					<string>assets</string>
-					<key>type</key>
-					<string>group</string>
-				</dict>
-				<dict>
-					<key>destination</key>
-					<dict>
-						<key>rebasable-url</key>
-						<dict>
-							<key>base</key>
-							<string>workspace</string>
-							<key>payload</key>
-							<dict>
-								<key>relative-path</key>
-								<string>flux/dist/index.html</string>
-							</dict>
-						</dict>
-						<key>type</key>
-						<string>DVTDocumentLocation</string>
-					</dict>
-					<key>type</key>
-					<string>bookmark</string>
-				</dict>
-				<dict>
-					<key>destination</key>
-					<dict>
-						<key>rebasable-url</key>
-						<dict>
-							<key>base</key>
-							<string>workspace</string>
-							<key>payload</key>
-							<dict>
-								<key>relative-path</key>
-								<string>flux/dist/vite.svg</string>
-							</dict>
-						</dict>
-						<key>type</key>
-						<string>DVTDocumentLocation</string>
-					</dict>
-					<key>type</key>
-					<string>bookmark</string>
-				</dict>
-			</array>
-			<key>title</key>
-			<string>dist</string>
-			<key>type</key>
-			<string>group</string>
-		</dict>
-	</array>
-</dict>
-</plist>
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>SchemeUserState</key>
-	<dict>
-		<key>flux.xcscheme_^#shared#^_</key>
-		<dict>
-			<key>orderHint</key>
-			<integer>0</integer>
-		</dict>
-	</dict>
-</dict>
-</plist>
@@ -1,11 +0,0 @@
-{
-  "colors" : [
-    {
-      "idiom" : "universal"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}
@@ -1,35 +0,0 @@
-{
-  "images" : [
-    {
-      "idiom" : "universal",
-      "platform" : "ios",
-      "size" : "1024x1024"
-    },
-    {
-      "appearances" : [
-        {
-          "appearance" : "luminosity",
-          "value" : "dark"
-        }
-      ],
-      "idiom" : "universal",
-      "platform" : "ios",
-      "size" : "1024x1024"
-    },
-    {
-      "appearances" : [
-        {
-          "appearance" : "luminosity",
-          "value" : "tinted"
-        }
-      ],
-      "idiom" : "universal",
-      "platform" : "ios",
-      "size" : "1024x1024"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}
@@ -1,6 +0,0 @@
-{
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}
@@ -1,220 +0,0 @@
-import SwiftUI
-import WebKit
-
-
-struct WebView: UIViewRepresentable {
-    let fileName: String?
-    let urlString: String?
-
-    func makeCoordinator() -> Coordinator {
-        Coordinator()
-    }
-
-    func makeUIView(context: Context) -> WKWebView {
-        let config = WKWebViewConfiguration()
-        let userContentController = WKUserContentController()
-
-        // 注册 JS -> Native 消息通道
-        userContentController.add(context.coordinator, name: "getPanelAddresses")
-        userContentController.add(context.coordinator, name: "savePanelAddress")
-        userContentController.add(context.coordinator, name: "setCurrentPanelAddress")
-        userContentController.add(context.coordinator, name: "deletePanelAddress")
-
-        // 注入 CSS 隐藏滚动条
-        let css = "body::-webkit-scrollbar { display: none; }"
-        let cssJS = """
-        var style = document.createElement('style');
-        style.innerHTML = '\(css)';
-        document.head.appendChild(style);
-        """
-        let cssScript = WKUserScript(source: cssJS, injectionTime: .atDocumentEnd, forMainFrameOnly: true)
-        userContentController.addUserScript(cssScript)
-
-        config.userContentController = userContentController
-
-        let webView = WKWebView(frame: .zero, configuration: config)
-        context.coordinator.webView = webView
-
-        // 去掉滚动条和弹性
-        webView.scrollView.showsHorizontalScrollIndicator = false
-        webView.scrollView.showsVerticalScrollIndicator = false
-        webView.scrollView.bounces = false
-
-        // 加载本地 HTML 或远程 URL
-        if let fileName = fileName,
-           let htmlURL = Bundle.main.url(forResource: fileName, withExtension: "html") {
-            webView.loadFileURL(htmlURL, allowingReadAccessTo: htmlURL.deletingLastPathComponent())
-        } else if let urlString = urlString,
-                  let url = URL(string: urlString) {
-            webView.load(URLRequest(url: url))
-        }
-
-        return webView
-    }
-
-    func updateUIView(_ uiView: WKWebView, context: Context) {}
-
-    class Coordinator: NSObject, WKScriptMessageHandler {
-        weak var webView: WKWebView?
-        private let storageKey = "panel_addresses"
-
-        
-        func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
-            switch message.name {
-            case "getPanelAddresses":
-                handleGetPanelAddresses(message: message)
-            case "savePanelAddress":
-                handleSavePanelAddress(message: message)
-            case "setCurrentPanelAddress":
-                handleSetCurrentPanelAddress(message: message)
-            case "deletePanelAddress":
-                handleDeletePanelAddress(message: message)
-            default:
-                break
-            }
-        }
-
-        
-        private func handleGetPanelAddresses(message: WKScriptMessage) {
-            let callbackName: String
-            if let cb = message.body as? String, !cb.isEmpty {
-                callbackName = cb
-            } else {
-                callbackName = "setPanelAddresses"
-            }
-
-            let addresses = loadAddressesJSONString()
-            let js = "window.\(callbackName)(\(addresses));"
-            evaluate(js: js)
-        }
-
-        private func handleSavePanelAddress(message: WKScriptMessage) {
-            var name: String?
-            var address: String?
-
-            if let dict = message.body as? [String: Any] {
-                name = dict["name"] as? String
-                address = dict["address"] as? String
-            } else if let arr = message.body as? [Any], arr.count >= 2 {
-                name = arr[0] as? String
-                address = arr[1] as? String
-            } else if let jsonString = message.body as? String,
-                      let data = jsonString.data(using: .utf8),
-                      let dict = try? JSONSerialization.jsonObject(with: data) as? [String: Any] {
-                name = dict["name"] as? String
-                address = dict["address"] as? String
-            }
-
-            guard let panelName = name, let panelAddress = address, !panelName.isEmpty, !panelAddress.isEmpty else {
-                return
-            }
-
-            var array = loadAddressesArray()
-            let newItem: [String: Any] = [
-                "name": panelName,
-                "address": panelAddress,
-                "inx": false
-            ]
-            array.append(newItem)
-            saveAddressesArray(array)
-
-            let js = "window.setPanelAddresses(\(toJSONString(array)));"
-            evaluate(js: js)
-        }
-
-        private func handleSetCurrentPanelAddress(message: WKScriptMessage) {
-            var name: String?
-            if let str = message.body as? String {
-                name = str
-            } else if let dict = message.body as? [String: Any] {
-                name = dict["name"] as? String
-            }
-
-            guard let targetName = name else { return }
-
-            var array = loadAddressesArray()
-            for i in 0..<array.count {
-                var obj = array[i]
-                if let n = obj["name"] as? String, n == targetName {
-                    obj["inx"] = true
-                } else {
-                    obj["inx"] = false
-                }
-                array[i] = obj
-            }
-            saveAddressesArray(array)
-            let js = "window.setPanelAddresses(\(toJSONString(array)));"
-            evaluate(js: js)
-        }
-
-        private func handleDeletePanelAddress(message: WKScriptMessage) {
-            var name: String?
-            if let str = message.body as? String {
-                name = str
-            } else if let dict = message.body as? [String: Any] {
-                name = dict["name"] as? String
-            }
-            guard let targetName = name else { return }
-
-            let oldArray = loadAddressesArray()
-            let newArray = oldArray.filter { obj in
-                guard let n = obj["name"] as? String else { return true }
-                return n != targetName
-            }
-            saveAddressesArray(newArray)
-            let js = "window.setPanelAddresses(\(toJSONString(newArray)));"
-            evaluate(js: js)
-        }
-
-        private func loadAddressesJSONString() -> String {
-            let defaults = UserDefaults.standard
-            if let s = defaults.string(forKey: storageKey), !s.isEmpty {
-                return s
-            }
-            return "[]"
-        }
-
-        private func loadAddressesArray() -> [[String: Any]] {
-            let s = loadAddressesJSONString()
-            guard let data = s.data(using: .utf8),
-                  let json = try? JSONSerialization.jsonObject(with: data) as? [[String: Any]] else {
-                return []
-            }
-            return json
-        }
-
-        private func saveAddressesArray(_ array: [[String: Any]]) {
-            let jsonString = toJSONString(array)
-            let defaults = UserDefaults.standard
-            defaults.set(jsonString, forKey: storageKey)
-        }
-
-        private func toJSONString(_ array: [[String: Any]]) -> String {
-            if let data = try? JSONSerialization.data(withJSONObject: array, options: []),
-               let s = String(data: data, encoding: .utf8) {
-                return s
-            }
-            return "[]"
-        }
-
-        private func evaluate(js: String) {
-            DispatchQueue.main.async { [weak self] in
-                self?.webView?.evaluateJavaScript(js, completionHandler: nil)
-            }
-        }
-    }
-}
-
-
-
-struct ContentView: View {
-    var body: some View {
-        //WebView(fileName: nil, urlString: "http://192.168.100.9:3000")
-        WebView(fileName: "index", urlString: nil)
-    }
-}
-
-
-#Preview {
-    ContentView()
-}
@@ -1,17 +0,0 @@
-//
-//  fluxApp.swift
-//  flux
-//
-//  Created by 何磊 on 21/08/2025.
-//
-
-import SwiftUI
-
-@main
-struct fluxApp: App {
-    var body: some Scene {
-        WindowGroup {
-            ContentView()
-        }
-    }
-}
@@ -1,17 +0,0 @@
-//
-//  fluxTests.swift
-//  fluxTests
-//
-//  Created by 何磊 on 21/08/2025.
-//
-
-import Testing
-@testable import flux
-
-struct fluxTests {
-
-    @Test func example() async throws {
-        // Write your test here and use APIs like `#expect(...)` to check expected conditions.
-    }
-
-}
@@ -1,41 +0,0 @@
-//
-//  fluxUITests.swift
-//  fluxUITests
-//
-//  Created by 何磊 on 21/08/2025.
-//
-
-import XCTest
-
-final class fluxUITests: XCTestCase {
-
-    override func setUpWithError() throws {
-        // Put setup code here. This method is called before the invocation of each test method in the class.
-
-        // In UI tests it is usually best to stop immediately when a failure occurs.
-        continueAfterFailure = false
-
-        // In UI tests it’s important to set the initial state - such as interface orientation - required for your tests before they run. The setUp method is a good place to do this.
-    }
-
-    override func tearDownWithError() throws {
-        // Put teardown code here. This method is called after the invocation of each test method in the class.
-    }
-
-    @MainActor
-    func testExample() throws {
-        // UI tests must launch the application that they test.
-        let app = XCUIApplication()
-        app.launch()
-
-        // Use XCTAssert and related functions to verify your tests produce the correct results.
-    }
-
-    @MainActor
-    func testLaunchPerformance() throws {
-        // This measures how long it takes to launch your application.
-        measure(metrics: [XCTApplicationLaunchMetric()]) {
-            XCUIApplication().launch()
-        }
-    }
-}
@@ -1,33 +0,0 @@
-//
-//  fluxUITestsLaunchTests.swift
-//  fluxUITests
-//
-//  Created by 何磊 on 21/08/2025.
-//
-
-import XCTest
-
-final class fluxUITestsLaunchTests: XCTestCase {
-
-    override class var runsForEachTargetApplicationUIConfiguration: Bool {
-        true
-    }
-
-    override func setUpWithError() throws {
-        continueAfterFailure = false
-    }
-
-    @MainActor
-    func testLaunch() throws {
-        let app = XCUIApplication()
-        app.launch()
-
-        // Insert steps here to perform after app launch but before taking a screenshot,
-        // such as logging into a test account or navigating somewhere in the app
-
-        let attachment = XCTAttachment(screenshot: app.screenshot())
-        attachment.name = "Launch Screen"
-        attachment.lifetime = .keepAlways
-        add(attachment)
-    }
-}
@@ -337,7 +337,7 @@ update_panel() {
  fi

  # 先发送 SIGTERM 信号，让应用优雅关闭
-  docker stop -t 30 springboot-backend 2>/dev/null || true
+  docker stop -t 30 flux-panel-backend 2>/dev/null || true
  docker stop -t 10 vite-frontend 2>/dev/null || true
  
  # 等待 WAL 文件同步
@@ -359,8 +359,8 @@ update_panel() {
  # 检查后端容器健康状态
  echo "🔍 检查后端服务状态..."
  for i in {1..90}; do
-    if docker ps --format "{{.Names}}" | grep -q "^springboot-backend$"; then
-      BACKEND_HEALTH=$(docker inspect -f '{{.State.Health.Status}}' springboot-backend 2>/dev/null || echo "unknown")
+    if docker ps --format "{{.Names}}" | grep -q "^flux-panel-backend$"; then
+      BACKEND_HEALTH=$(docker inspect -f '{{.State.Health.Status}}' flux-panel-backend 2>/dev/null || echo "unknown")
      if [[ "$BACKEND_HEALTH" == "healthy" ]]; then
        echo "✅ 后端服务健康检查通过"
        break
@@ -376,7 +376,7 @@ update_panel() {
    fi
    if [ $i -eq 90 ]; then
      echo "❌ 后端服务启动超时（90秒）"
-      echo "🔍 当前状态：$(docker inspect -f '{{.State.Health.Status}}' springboot-backend 2>/dev/null || echo '容器不存在')"
+      echo "🔍 当前状态：$(docker inspect -f '{{.State.Health.Status}}' flux-panel-backend 2>/dev/null || echo '容器不存在')"
      echo "🛑 更新终止"
      return 1
    fi
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
sagit	1c72fb233a	Merge pull request #46 from Sagit-chu/opencode/jolly-circuit fix: fix some bugs	2026-02-08 15:28:28 +08:00
sagit	ac1c2fa6bf	Merge branch 'main' into opencode/jolly-circuit	2026-02-08 15:27:09 +08:00
sagit	4af2186e35	fix: 修复修改隧道负载策略不生效的问题	2026-02-08 07:25:35 +00:00
sagit	9fe9798677	fix: sync forward rules when updating user tunnel to preserve ports	2026-02-08 07:21:10 +00:00
sagit	cfee6092c7	chore: delete springboot-backend directory	2026-02-08 07:15:47 +00:00
sagit	7ab6545594	fix: make chain and limiter updates idempotent Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-02-08 07:04:06 +00:00
sagit	2e2c182a0d	fix: make service update idempotent (upsert) Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-02-08 07:04:05 +00:00
sagit	96eec61a92	Merge pull request #45 from Sagit-chu/opencode/cosmic-sailor fix(frontend): update turnstile implementation for login page	2026-02-08 14:54:32 +08:00
sagit	6e4bde4053	fix(frontend): update turnstile implementation for login page	2026-02-08 06:50:46 +00:00
sagit	33f347d1db	Merge pull request #41 from Sagit-chu/opencode/proud-cactus chore: remove obsolete root-level legacy Go files	2026-02-08 14:07:00 +08:00
sagit	17e5f4f95a	Merge branch 'main' into opencode/proud-cactus	2026-02-08 14:05:43 +08:00
sagit	b0304876a8	fix: implement random port assignment with conflict check for forward creation	2026-02-08 06:00:48 +00:00
sagit	2710cd1674	feat: replace legacy captcha with Cloudflare Turnstile	2026-02-08 04:51:41 +00:00
sagit	a74eb9f431	fix: make service control robust against partial service absence	2026-02-08 04:17:10 +00:00
sagit	d5c0060cd9	fix: resolve user_tunnel instability and service name drift	2026-02-08 03:09:38 +00:00
sagit	7f9c05172b	fix: rollback forward mutation on tunnel switch failure	2026-02-08 02:30:36 +00:00
sagit	d720b9e00c	chore: remove mobile wrappers and harden go-backend service control	2026-02-08 01:59:45 +00:00
sagit	15cf25f74b	chore: remove obsolete root-level legacy Go files	2026-02-07 15:08:23 +00:00
sagit	ae6c65e9a9	Merge pull request #40 from Sagit-chu/fix/backend-image-name fix(ci): rename go-backend image to flux-panel-backend to avoid permi…	2026-02-07 23:04:19 +08:00
sagit	8a85ab2844	fix(ci): rename go-backend image to flux-panel-backend to avoid permission issues	2026-02-07 15:01:21 +00:00
sagit	b9b4312768	Merge pull request #36 from Sagit-chu/opencode/proud-cactus feat: add Go backend compatibility service scaffold	2026-02-07 22:23:42 +08:00
sagit	a2b819dbcc	merge: sync origin/main and resolve compose backend conflicts	2026-02-07 14:16:00 +00:00
sagit	6f0412de0f	fix: align forward pause/resume service control with Java	2026-02-07 13:52:54 +00:00
sagit	e2ae241f8c	fix: complete tunnel-create parity with runtime rollback	2026-02-07 13:36:30 +00:00
sagit	1a8f424d53	fix: complete diagnosis parity and tunnel visibility on Go backend	2026-02-07 12:48:41 +00:00
sagit	1977ba9eab	fix: adapt frontend captcha flow for Go backend	2026-02-07 12:10:34 +00:00
sagit	b2407c3442	feat: finalize Go backend migration and deployment cutover	2026-02-07 11:03:12 +00:00
sagit	f9bc165c16	feat: complete Go backend control-plane parity Bridge Java-to-Go runtime behavior by enforcing forward ownership checks, wiring node command dispatch/diagnostics, and adding contract coverage so migrated APIs can run with production semantics.	2026-02-07 07:10:45 +00:00
sagit	b6333d81a2	fix: restore panel list endpoints and bootstrap sqlite state	2026-02-06 12:23:46 +00:00
sagit	0f37017760	feat: add Go backend compatibility service scaffold	2026-02-06 10:42:48 +00:00