Merge pull request #92 from Sagit-chu/opencode/lucky-otter

fix(upgrade): stabilize batch node upgrades

.github/workflows/docker-build.yml

@@ -112,6 +112,12 @@ jobs:
           upx --best --lzma gost-amd64
           upx --best --lzma gost-arm64
 
+      - name: Generate SHA256 checksums
+        working-directory: ./go-gost
+        run: |
+          sha256sum gost-amd64 > gost-amd64.sha256
+          sha256sum gost-arm64 > gost-arm64.sha256
+
       - name: Upload GOST AMD64 artifact
         uses: actions/upload-artifact@v4
         with:
@@ -124,6 +130,18 @@ jobs:
           name: gost-binary-arm64
           path: ./go-gost/gost-arm64
 
+      - name: Upload GOST AMD64 checksum artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: gost-checksum-amd64
+          path: ./go-gost/gost-amd64.sha256
+
+      - name: Upload GOST ARM64 checksum artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: gost-checksum-arm64
+          path: ./go-gost/gost-arm64.sha256
+
   build-vite:
     name: Build & Push Vite Frontend
     needs: check-version
@@ -238,7 +256,20 @@ jobs:
           name: gost-binary-arm64
           path: ./artifacts/arm64
 
+      - name: Download GOST AMD64 checksum
+        uses: actions/download-artifact@v4
+        with:
+          name: gost-checksum-amd64
+          path: ./artifacts/
+
+      - name: Download GOST ARM64 checksum
+        uses: actions/download-artifact@v4
+        with:
+          name: gost-checksum-arm64
+          path: ./artifacts/
+
       - name: Prepare release files
+
         run: |
           VERSION="${{ needs.check-version.outputs.version }}"
           OWNER="${{ needs.check-version.outputs.image_owner }}"
@@ -268,6 +299,10 @@ jobs:
           sed -i "s|2.0.7-beta|${VERSION}|g" ./artifacts/install.sh
           sed -i "s|2.0.7-beta|${VERSION}|g" ./artifacts/panel_install.sh
 
+          # 注入固定版本号，使从 Release 页下载的脚本只安装该版本
+          sed -i "s|^PINNED_VERSION=\"\"|PINNED_VERSION=\"${VERSION}\"|" ./artifacts/install.sh
+          sed -i "s|^PINNED_VERSION=\"\"|PINNED_VERSION=\"${VERSION}\"|" ./artifacts/panel_install.sh
+
       - name: Create Release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -303,14 +338,22 @@ jobs:
 
           ## 🚀 Quick Install
 
-          **Panel:**
+          **Panel (安装此版本 ${VERSION}):**
           \`\`\`bash
           curl -L https://github.com/${{ github.repository }}/releases/download/${VERSION}/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
           \`\`\`
 
-          **Node:**
+          **Node (安装此版本 ${VERSION}):**
           \`\`\`bash
           curl -L https://github.com/${{ github.repository }}/releases/download/${VERSION}/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+          \`\`\`
+
+          **安装最新版:**
+          \`\`\`bash
+          # 面板端
+          curl -L https://raw.githubusercontent.com/${{ github.repository }}/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+          # 节点端
+          curl -L https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
           \`\`\`" \
             --repo ${{ github.repository }}
 
@@ -319,6 +362,10 @@ jobs:
           gh release upload "${VERSION}" ./artifacts/gost-amd64 --clobber
           gh release upload "${VERSION}" ./artifacts/gost-arm64 --clobber
 
+          echo "📤 上传 GOST 校验文件..."
+          gh release upload "${VERSION}" ./artifacts/gost-amd64.sha256 --clobber
+          gh release upload "${VERSION}" ./artifacts/gost-arm64.sha256 --clobber
+
           echo "📤 上传安装脚本..."
           gh release upload "${VERSION}" ./artifacts/install.sh --clobber
           gh release upload "${VERSION}" ./artifacts/panel_install.sh --clobber
@@ -351,6 +398,18 @@ jobs:
           name: gost-binary-arm64
           path: ./artifacts/arm64
 
+      - name: Download GOST AMD64 checksum
+        uses: actions/download-artifact@v4
+        with:
+          name: gost-checksum-amd64
+          path: ./artifacts/
+
+      - name: Download GOST ARM64 checksum
+        uses: actions/download-artifact@v4
+        with:
+          name: gost-checksum-arm64
+          path: ./artifacts/
+
       - name: Rename binaries
         run: |
           mv ./artifacts/amd64/gost-amd64 ./artifacts/gost-amd64
@@ -367,4 +426,9 @@ jobs:
           gh release upload "${VERSION}" ./artifacts/gost-amd64 --clobber
           gh release upload "${VERSION}" ./artifacts/gost-arm64 --clobber
 
+          echo "📤 上传 GOST 校验文件..."
+          gh release upload "${VERSION}" ./artifacts/gost-amd64.sha256 --clobber
+          gh release upload "${VERSION}" ./artifacts/gost-arm64.sha256 --clobber
+
           echo "✅ GOST 二进制文件更新完成"
+

.gitignore

@@ -177,6 +177,7 @@ build/
 *.dylib
 your_app.exe
 go-backend/paneld
+go-gost/gost
 
 # Go 测试二进制文件
 *.test

README.md

@@ -2,6 +2,54 @@
 
 > **联系我们**: [Telegram群组](https://t.me/flvxpanel)
 
+
+## 特性
+
+- 支持按 **隧道账号级别** 管理流量转发数量，可用于用户/隧道配额控制
+- 支持 **TCP** 和 **UDP** 协议的转发
+- 支持两种转发模式：**端口转发** 与 **隧道转发**
+- 可针对 **指定用户的指定隧道进行限速** 设置
+- 支持配置 **单向或双向流量计费方式**，灵活适配不同计费模型
+- 提供灵活的转发策略配置，适用于多种网络场景
+- 面板分享，支持将节点分享给其他人，面板对接面板
+- 支持分组权限管理，隧道分组、用户分组
+- 支持批量功能，可以批量下发配置，启停等
+- 支持隧道修改配置、转发修改隧道
+
+
+## 部署流程
+---
+### Docker Compose部署
+#### 快速部署（安装最新版）
+面板端：
+```bash
+curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+```
+节点端：
+```bash
+curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+```
+
+#### 安装特定版本
+从 [Releases](https://github.com/Sagit-chu/flux-panel/releases) 页面复制对应版本的安装命令，脚本会自动安装该版本而非最新版。
+
+面板端（以 2.1.0 为例）：
+```bash
+curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+```
+节点端（以 2.1.0 为例）：
+```bash
+curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+```
+
+#### 默认管理员账号
+
+- **账号**: admin_user
+- **密码**: admin_user
+
+> ⚠️ 首次登录后请立即修改默认密码！
+
+---
 ## Original Project
 - **Name**: flux-panel
 - **Source**: https://github.com/bqlpfy/flux-panel
@@ -31,35 +79,6 @@ The following major changes and additions have been made in this fork (FLVX):
 - **Added**: `AGENTS.md` (Project documentation).
 
 ---
-## 特性
-
-- 支持按 **隧道账号级别** 管理流量转发数量，可用于用户/隧道配额控制
-- 支持 **TCP** 和 **UDP** 协议的转发
-- 支持两种转发模式：**端口转发** 与 **隧道转发**
-- 可针对 **指定用户的指定隧道进行限速** 设置
-- 支持配置 **单向或双向流量计费方式**，灵活适配不同计费模型
-- 提供灵活的转发策略配置，适用于多种网络场景
-
-
-## 部署流程
----
-### Docker Compose部署
-#### 快速部署
-面板端：
-```bash
-curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
-```
-节点端：
-```bash
-curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
-```
-
-#### 默认管理员账号
-
-- **账号**: admin_user
-- **密码**: admin_user
-
-> ⚠️ 首次登录后请立即修改默认密码！
 
 
 ## 免责声明

doc/install.md

@@ -77,3 +77,57 @@ curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -
 安装完成后，服务会自动启动。
 - 查看状态: `systemctl status flux_agent`
 - 回到面板 **节点管理** 页面，该节点状态应显示为 **在线**。
+
+---
+
+## 三、Caddy 反向代理（可选）
+
+如果需要通过域名访问面板并自动获取 HTTPS 证书，可以使用 Caddy 作为反向代理。
+
+### 1. 安装 Caddy
+
+```bash
+# Debian / Ubuntu
+sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
+curl -1sLf 'https://dl.cloudflare.com/content/v1/e2qwFJ2fRP2b2q/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+curl -1sLf 'https://dl.cloudflare.com/content/v1/e2qwFJ2fRP2b2q/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
+sudo apt update
+sudo apt install caddy
+```
+
+其他系统请参考 [Caddy 官方安装文档](https://caddyserver.com/docs/install)。
+
+### 2. 配置 Caddyfile
+
+编辑 Caddy 配置文件：
+
+```bash
+sudo nano /etc/caddy/Caddyfile
+```
+
+#### 面板域名配置
+
+将 `panel.example.com` 替换为你自己的域名：
+
+```caddyfile
+panel.example.com {
+    reverse_proxy localhost:6366
+}
+```
+
+Caddy 会自动为域名申请和续期 HTTPS 证书，无需额外配置。
+
+### 3. 重启 Caddy
+
+```bash
+sudo systemctl restart caddy
+```
+
+### 4. 注意事项
+
+- 确保域名已正确解析到服务器 IP。
+- 确保服务器防火墙放行了 **80** 和 **443** 端口（Caddy 自动申请证书需要）。
+- 使用 Caddy 反向代理后，可以在 `.env` 中将前端端口改为仅监听本地，避免直接暴露：
+  ```
+  FRONTEND_PORT=127.0.0.1:6366
+  ```

go-backend/internal/http/client/federation.go

@@ -21,6 +21,7 @@ type RemoteNodeInfo struct {
 	ServerIP       string `json:"serverIp"`
 	Status         int    `json:"status"`
 	MaxBandwidth   int64  `json:"maxBandwidth"`
+	CurrentFlow    int64  `json:"currentFlow"`
 	ExpiryTime     int64  `json:"expiryTime"`
 	PortRangeStart int    `json:"portRangeStart"`
 	PortRangeEnd   int    `json:"portRangeEnd"`
@@ -84,6 +85,14 @@ func NewFederationClient() *FederationClient {
 	}
 }
 
+func NewFederationClientWithTimeout(timeout time.Duration) *FederationClient {
+	return &FederationClient{
+		client: &http.Client{
+			Timeout: timeout,
+		},
+	}
+}
+
 func (c *FederationClient) Connect(url, token, localDomain string) (*RemoteNodeInfo, error) {
 	url = strings.TrimSuffix(url, "/")
 	req, err := http.NewRequest("POST", url+"/api/v1/federation/connect", nil)

go-backend/internal/http/handler/federation.go

@@ -6,7 +6,9 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"go-backend/internal/http/client"
@@ -35,6 +37,21 @@ type deletePeerShareRequest struct {
 	ID int64 `json:"id"`
 }
 
+type resetPeerShareFlowRequest struct {
+	ID int64 `json:"id"`
+}
+
+type updatePeerShareRequest struct {
+	ID             int64  `json:"id"`
+	Name           string `json:"name"`
+	MaxBandwidth   int64  `json:"maxBandwidth"`
+	ExpiryTime     int64  `json:"expiryTime"`
+	PortRangeStart int    `json:"portRangeStart"`
+	PortRangeEnd   int    `json:"portRangeEnd"`
+	AllowedDomains string `json:"allowedDomains"`
+	AllowedIPs     string `json:"allowedIps"`
+}
+
 type nodeImportRequest struct {
 	RemoteURL string `json:"remoteUrl"`
 	Token     string `json:"token"`
@@ -74,6 +91,51 @@ type federationRuntimeDiagnoseRequest struct {
 	Timeout int    `json:"timeout"`
 }
 
+type peerShareUsedPort struct {
+	RuntimeID   int64  `json:"runtimeId"`
+	Port        int    `json:"port"`
+	Role        string `json:"role"`
+	Protocol    string `json:"protocol"`
+	ResourceKey string `json:"resourceKey"`
+	Applied     int    `json:"applied"`
+	UpdatedTime int64  `json:"updatedTime"`
+}
+
+type peerShareListItem struct {
+	sqlite.PeerShare
+	UsedPorts        []int               `json:"usedPorts"`
+	UsedPortDetails  []peerShareUsedPort `json:"usedPortDetails"`
+	ActiveRuntimeNum int                 `json:"activeRuntimeNum"`
+}
+
+type remoteUsageBindingItem struct {
+	BindingID       int64  `json:"bindingId"`
+	TunnelID        int64  `json:"tunnelId"`
+	TunnelName      string `json:"tunnelName"`
+	ChainType       int    `json:"chainType"`
+	HopInx          int    `json:"hopInx"`
+	AllocatedPort   int    `json:"allocatedPort"`
+	ResourceKey     string `json:"resourceKey"`
+	RemoteBindingID string `json:"remoteBindingId"`
+	UpdatedTime     int64  `json:"updatedTime"`
+}
+
+type remoteUsageNodeItem struct {
+	NodeID           int64                    `json:"nodeId"`
+	NodeName         string                   `json:"nodeName"`
+	RemoteURL        string                   `json:"remoteUrl"`
+	ShareID          int64                    `json:"shareId"`
+	PortRangeStart   int                      `json:"portRangeStart"`
+	PortRangeEnd     int                      `json:"portRangeEnd"`
+	MaxBandwidth     int64                    `json:"maxBandwidth"`
+	CurrentFlow      int64                    `json:"currentFlow"`
+	ExpiryTime       int64                    `json:"expiryTime"`
+	UsedPorts        []int                    `json:"usedPorts"`
+	Bindings         []remoteUsageBindingItem `json:"bindings"`
+	ActiveBindingNum int                      `json:"activeBindingNum"`
+	SyncError        string                   `json:"syncError,omitempty"`
+}
+
 func (h *Handler) federationShareList(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("Invalid method"))
@@ -85,7 +147,55 @@ func (h *Handler) federationShareList(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	response.WriteJSON(w, response.OK(shares))
+
+	items := make([]peerShareListItem, 0, len(shares))
+	for i := range shares {
+		share := shares[i]
+		runtimes, err := h.repo.ListActivePeerShareRuntimesByShareID(share.ID)
+		if err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+
+		usedSet := make(map[int]struct{}, len(runtimes))
+		details := make([]peerShareUsedPort, 0, len(runtimes))
+		for _, runtime := range runtimes {
+			if runtime.Port > 0 {
+				usedSet[runtime.Port] = struct{}{}
+			}
+			details = append(details, peerShareUsedPort{
+				RuntimeID:   runtime.ID,
+				Port:        runtime.Port,
+				Role:        runtime.Role,
+				Protocol:    runtime.Protocol,
+				ResourceKey: runtime.ResourceKey,
+				Applied:     runtime.Applied,
+				UpdatedTime: runtime.UpdatedTime,
+			})
+		}
+
+		usedPorts := make([]int, 0, len(usedSet))
+		for port := range usedSet {
+			usedPorts = append(usedPorts, port)
+		}
+		sort.Ints(usedPorts)
+
+		sort.Slice(details, func(i, j int) bool {
+			if details[i].Port == details[j].Port {
+				return details[i].RuntimeID < details[j].RuntimeID
+			}
+			return details[i].Port < details[j].Port
+		})
+
+		items = append(items, peerShareListItem{
+			PeerShare:        share,
+			UsedPorts:        usedPorts,
+			UsedPortDetails:  details,
+			ActiveRuntimeNum: len(details),
+		})
+	}
+
+	response.WriteJSON(w, response.OK(items))
 }
 
 func (h *Handler) federationShareCreate(w http.ResponseWriter, r *http.Request) {
@@ -183,6 +293,8 @@ func (h *Handler) federationShareDelete(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	h.cleanupPeerShareRuntimes(req.ID)
+
 	if err := h.repo.DeletePeerShare(req.ID); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
@@ -191,6 +303,261 @@ func (h *Handler) federationShareDelete(w http.ResponseWriter, r *http.Request)
 	response.WriteJSON(w, response.OKEmpty())
 }
 
+func (h *Handler) federationShareResetFlow(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	var req resetPeerShareFlowRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+	if req.ID <= 0 {
+		response.WriteJSON(w, response.ErrDefault("Share ID is required"))
+		return
+	}
+
+	share, err := h.repo.GetPeerShare(req.ID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if share == nil {
+		response.WriteJSON(w, response.ErrDefault("Share not found"))
+		return
+	}
+
+	if err := h.repo.ResetPeerShareCurrentFlow(req.ID, time.Now().UnixMilli()); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) federationShareUpdate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	var req updatePeerShareRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+	if req.ID <= 0 {
+		response.WriteJSON(w, response.ErrDefault("Share ID is required"))
+		return
+	}
+
+	share, err := h.repo.GetPeerShare(req.ID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if share == nil {
+		response.WriteJSON(w, response.ErrDefault("Share not found"))
+		return
+	}
+
+	if req.Name == "" {
+		response.WriteJSON(w, response.ErrDefault("Name is required"))
+		return
+	}
+
+	if req.MaxBandwidth < 0 {
+		response.WriteJSON(w, response.ErrDefault("Max bandwidth cannot be negative"))
+		return
+	}
+
+	if req.ExpiryTime < 0 {
+		response.WriteJSON(w, response.ErrDefault("Expiry time cannot be negative"))
+		return
+	}
+
+	if req.PortRangeStart < 0 || req.PortRangeStart > 65535 || req.PortRangeEnd < 0 || req.PortRangeEnd > 65535 {
+		response.WriteJSON(w, response.ErrDefault("Invalid port range"))
+		return
+	}
+
+	if req.PortRangeStart > req.PortRangeEnd {
+		response.WriteJSON(w, response.ErrDefault("Port range start cannot be greater than end"))
+		return
+	}
+
+	allowedIPs, err := normalizePeerShareAllowedIPs(req.AllowedIPs)
+	if err != nil {
+		response.WriteJSON(w, response.ErrDefault(err.Error()))
+		return
+	}
+
+	share.Name = req.Name
+	share.MaxBandwidth = req.MaxBandwidth
+	share.ExpiryTime = req.ExpiryTime
+	share.PortRangeStart = req.PortRangeStart
+	share.PortRangeEnd = req.PortRangeEnd
+	share.AllowedDomains = req.AllowedDomains
+	share.AllowedIPs = allowedIPs
+	share.UpdatedTime = time.Now().UnixMilli()
+
+	if err := h.repo.UpdatePeerShare(share); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	rows, err := h.repo.DB().Query(`
+		SELECT id, name, remote_url, remote_token, remote_config
+		FROM node
+		WHERE is_remote = 1
+		ORDER BY id DESC
+	`)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	defer rows.Close()
+
+	fc := client.NewFederationClient()
+	localDomain := h.federationLocalDomain()
+
+	items := make([]remoteUsageNodeItem, 0)
+	for rows.Next() {
+		var (
+			nodeID       int64
+			nodeName     string
+			remoteURL    sql.NullString
+			remoteToken  sql.NullString
+			remoteConfig sql.NullString
+		)
+		if err := rows.Scan(&nodeID, &nodeName, &remoteURL, &remoteToken, &remoteConfig); err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+
+		shareID, maxBandwidth, currentFlow, expiryTime, portRangeStart, portRangeEnd := parseRemoteShareUsageConfig(remoteConfig.String)
+
+		var syncError string
+		url := strings.TrimSpace(remoteURL.String)
+		token := strings.TrimSpace(remoteToken.String)
+		if url != "" && token != "" {
+			info, connectErr := fc.Connect(url, token, localDomain)
+			if connectErr != nil {
+				syncError = connectErr.Error()
+			} else if info != nil {
+				shareID = info.ShareID
+				maxBandwidth = info.MaxBandwidth
+				currentFlow = info.CurrentFlow
+				expiryTime = info.ExpiryTime
+				portRangeStart = info.PortRangeStart
+				portRangeEnd = info.PortRangeEnd
+
+				configData, _ := json.Marshal(map[string]interface{}{
+					"shareId":        info.ShareID,
+					"maxBandwidth":   info.MaxBandwidth,
+					"currentFlow":    info.CurrentFlow,
+					"expiryTime":     info.ExpiryTime,
+					"portRangeStart": info.PortRangeStart,
+					"portRangeEnd":   info.PortRangeEnd,
+				})
+				_, _ = h.repo.DB().Exec(`UPDATE node SET remote_config = ? WHERE id = ?`, string(configData), nodeID)
+			}
+		}
+
+		bindingRows, err := h.repo.DB().Query(`
+			SELECT fb.id, fb.tunnel_id, COALESCE(t.name, ''), fb.chain_type, fb.hop_inx, fb.allocated_port, fb.resource_key, fb.remote_binding_id, fb.updated_time
+			FROM federation_tunnel_binding fb
+			LEFT JOIN tunnel t ON t.id = fb.tunnel_id
+			WHERE fb.node_id = ? AND fb.status = 1
+			ORDER BY fb.allocated_port ASC, fb.id ASC
+		`, nodeID)
+		if err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+
+		usedSet := make(map[int]struct{})
+		bindings := make([]remoteUsageBindingItem, 0)
+		for bindingRows.Next() {
+			var item remoteUsageBindingItem
+			if err := bindingRows.Scan(&item.BindingID, &item.TunnelID, &item.TunnelName, &item.ChainType, &item.HopInx, &item.AllocatedPort, &item.ResourceKey, &item.RemoteBindingID, &item.UpdatedTime); err != nil {
+				_ = bindingRows.Close()
+				response.WriteJSON(w, response.Err(-2, err.Error()))
+				return
+			}
+			bindings = append(bindings, item)
+			if item.AllocatedPort > 0 {
+				usedSet[item.AllocatedPort] = struct{}{}
+			}
+		}
+		if err := bindingRows.Err(); err != nil {
+			_ = bindingRows.Close()
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+		_ = bindingRows.Close()
+
+		usedPorts := make([]int, 0, len(usedSet))
+		for port := range usedSet {
+			usedPorts = append(usedPorts, port)
+		}
+		sort.Ints(usedPorts)
+
+		items = append(items, remoteUsageNodeItem{
+			NodeID:           nodeID,
+			NodeName:         nodeName,
+			RemoteURL:        url,
+			ShareID:          shareID,
+			PortRangeStart:   portRangeStart,
+			PortRangeEnd:     portRangeEnd,
+			MaxBandwidth:     maxBandwidth,
+			CurrentFlow:      currentFlow,
+			ExpiryTime:       expiryTime,
+			UsedPorts:        usedPorts,
+			Bindings:         bindings,
+			ActiveBindingNum: len(bindings),
+			SyncError:        syncError,
+		})
+	}
+	if err := rows.Err(); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OK(items))
+}
+
+func parseRemoteShareUsageConfig(raw string) (int64, int64, int64, int64, int, int) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return 0, 0, 0, 0, 0, 0
+	}
+
+	var cfg map[string]interface{}
+	if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
+		return 0, 0, 0, 0, 0, 0
+	}
+
+	shareID := asInt64(cfg["shareId"], 0)
+	maxBandwidth := asInt64(cfg["maxBandwidth"], 0)
+	currentFlow := asInt64(cfg["currentFlow"], 0)
+	expiryTime := asInt64(cfg["expiryTime"], 0)
+	portRangeStart := int(asInt64(cfg["portRangeStart"], 0))
+	portRangeEnd := int(asInt64(cfg["portRangeEnd"], 0))
+	return shareID, maxBandwidth, currentFlow, expiryTime, portRangeStart, portRangeEnd
+}
+
 func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("Invalid method"))
@@ -225,6 +592,7 @@ func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
 	configData := map[string]interface{}{
 		"shareId":        info.ShareID,
 		"maxBandwidth":   info.MaxBandwidth,
+		"currentFlow":    info.CurrentFlow,
 		"expiryTime":     info.ExpiryTime,
 		"portRangeStart": info.PortRangeStart,
 		"portRangeEnd":   info.PortRangeEnd,
@@ -370,6 +738,7 @@ func (h *Handler) federationConnect(w http.ResponseWriter, r *http.Request) {
 		"serverIp":       serverIP,
 		"status":         status,
 		"maxBandwidth":   share.MaxBandwidth,
+		"currentFlow":    share.CurrentFlow,
 		"expiryTime":     share.ExpiryTime,
 		"portRangeStart": share.PortRangeStart,
 		"portRangeEnd":   share.PortRangeEnd,
@@ -388,6 +757,10 @@ func (h *Handler) federationTunnelCreate(w http.ResponseWriter, r *http.Request)
 		response.WriteJSON(w, response.Err(401, "Unauthorized"))
 		return
 	}
+	if isPeerShareFlowExceeded(share) {
+		response.WriteJSON(w, response.Err(403, "Share traffic limit exceeded"))
+		return
+	}
 
 	var req federationTunnelRequest
 	if err := decodeJSON(r.Body, &req); err != nil {
@@ -488,6 +861,10 @@ func (h *Handler) federationRuntimeReservePort(w http.ResponseWriter, r *http.Re
 		}))
 		return
 	}
+	if isPeerShareFlowExceeded(share) {
+		response.WriteJSON(w, response.Err(403, "Share traffic limit exceeded"))
+		return
+	}
 
 	allocatedPort, err := h.pickPeerSharePort(share, req.RequestedPort)
 	if err != nil {
@@ -597,6 +974,10 @@ func (h *Handler) federationRuntimeApplyRole(w http.ResponseWriter, r *http.Requ
 		}))
 		return
 	}
+	if isPeerShareFlowExceeded(share) {
+		response.WriteJSON(w, response.Err(403, "Share traffic limit exceeded"))
+		return
+	}
 
 	node, err := h.getNodeRecord(share.NodeID)
 	if err != nil {
@@ -885,6 +1266,16 @@ func extractBearerToken(r *http.Request) string {
 	return ""
 }
 
+func isPeerShareFlowExceeded(share *sqlite.PeerShare) bool {
+	if share == nil {
+		return false
+	}
+	if share.MaxBandwidth <= 0 {
+		return false
+	}
+	return share.CurrentFlow >= share.MaxBandwidth
+}
+
 func normalizePeerShareAllowedIPs(raw string) (string, error) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
@@ -1011,3 +1402,94 @@ func isPeerIPAllowed(clientIP net.IP, whitelist string) bool {
 
 	return false
 }
+
+func (h *Handler) syncRemoteNodeStatuses(items []map[string]interface{}) {
+	type remoteEntry struct {
+		index       int
+		remoteURL   string
+		remoteToken string
+	}
+
+	var remotes []remoteEntry
+	for i, item := range items {
+		isRemote, _ := item["isRemote"].(int)
+		if isRemote != 1 {
+			continue
+		}
+		url, _ := item["remoteUrl"].(string)
+		token, _ := item["remoteToken"].(string)
+		url = strings.TrimSpace(url)
+		token = strings.TrimSpace(token)
+		if url == "" || token == "" {
+			continue
+		}
+		remotes = append(remotes, remoteEntry{index: i, remoteURL: url, remoteToken: token})
+	}
+	if len(remotes) == 0 {
+		return
+	}
+
+	localDomain := h.federationLocalDomain()
+	fc := client.NewFederationClientWithTimeout(5 * time.Second)
+
+	type syncResult struct {
+		index     int
+		status    int
+		syncError string
+	}
+
+	results := make([]syncResult, len(remotes))
+	var wg sync.WaitGroup
+	for i, entry := range remotes {
+		wg.Add(1)
+		go func(idx int, e remoteEntry) {
+			defer wg.Done()
+			info, err := fc.Connect(e.remoteURL, e.remoteToken, localDomain)
+			if err != nil {
+				errMsg := err.Error()
+				if strings.Contains(errMsg, "401") || strings.Contains(errMsg, "Invalid token") || strings.Contains(errMsg, "Unauthorized") {
+					results[idx] = syncResult{index: e.index, status: 0, syncError: "provider_share_deleted"}
+				} else if strings.Contains(errMsg, "403") || strings.Contains(errMsg, "Share is disabled") {
+					results[idx] = syncResult{index: e.index, status: 0, syncError: "provider_share_disabled"}
+				} else if strings.Contains(errMsg, "Share expired") {
+					results[idx] = syncResult{index: e.index, status: 0, syncError: "provider_share_expired"}
+				} else {
+					results[idx] = syncResult{index: e.index, status: 0, syncError: errMsg}
+				}
+			} else {
+				results[idx] = syncResult{index: e.index, status: info.Status, syncError: ""}
+			}
+		}(i, entry)
+	}
+	wg.Wait()
+
+	for _, r := range results {
+		items[r.index]["status"] = r.status
+		if r.syncError != "" {
+			items[r.index]["syncError"] = r.syncError
+		}
+	}
+}
+
+func (h *Handler) cleanupPeerShareRuntimes(shareID int64) {
+	if h == nil || h.repo == nil || shareID <= 0 {
+		return
+	}
+	runtimes, err := h.repo.ListActivePeerShareRuntimesByShareID(shareID)
+	if err != nil || len(runtimes) == 0 {
+		return
+	}
+
+	now := time.Now().UnixMilli()
+	for _, runtime := range runtimes {
+		if h.wsServer != nil && runtime.Applied == 1 {
+			if strings.TrimSpace(runtime.ServiceName) != "" {
+				_, _ = h.sendNodeCommand(runtime.NodeID, "DeleteService", map[string]interface{}{"services": []string{runtime.ServiceName}}, false, true)
+			}
+			if strings.TrimSpace(runtime.Role) == "middle" && strings.TrimSpace(runtime.ChainName) != "" {
+				_, _ = h.sendNodeCommand(runtime.NodeID, "DeleteChains", map[string]interface{}{"chain": runtime.ChainName}, false, true)
+			}
+		}
+		_ = h.repo.MarkPeerShareRuntimeReleased(runtime.ID, now)
+	}
+}

go-backend/internal/http/handler/federation_runtime_test.go

@@ -1,10 +1,15 @@
 package handler
 
 import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
 	"testing"
 	"time"
 
+	"go-backend/internal/http/response"
 	"go-backend/internal/store/sqlite"
 )
 
@@ -146,3 +151,60 @@ func TestPrepareTunnelCreateStateRemoteAutoPortDefersToFederation(t *testing.T)
 		t.Fatalf("expected remote out port to remain 0 before federation reserve, got %d", state.OutNodes[0].Port)
 	}
 }
+
+func TestFederationRuntimeReservePortRejectsWhenShareFlowExceeded(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open repo: %v", err)
+	}
+	defer repo.Close()
+
+	h := &Handler{repo: repo}
+	now := time.Now().UnixMilli()
+
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
+		Name:           "limited-share",
+		NodeID:         1,
+		Token:          "limited-token",
+		MaxBandwidth:   2048,
+		CurrentFlow:    2048,
+		PortRangeStart: 30000,
+		PortRangeEnd:   30010,
+		IsActive:       1,
+		CreatedTime:    now,
+		UpdatedTime:    now,
+	}); err != nil {
+		t.Fatalf("create share: %v", err)
+	}
+
+	body, err := json.Marshal(map[string]interface{}{
+		"resourceKey":   "tunnel:1:node:1:type:3:hop:0",
+		"protocol":      "tls",
+		"requestedPort": 0,
+	})
+	if err != nil {
+		t.Fatalf("marshal request: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/runtime/reserve-port", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer limited-token")
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	h.federationRuntimeReservePort(res, req)
+
+	if res.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
+	}
+
+	var payload response.R
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if payload.Code != 403 {
+		t.Fatalf("expected response code 403, got %d (%s)", payload.Code, payload.Msg)
+	}
+	if payload.Msg != "Share traffic limit exceeded" {
+		t.Fatalf("unexpected response message: %q", payload.Msg)
+	}
+}

go-backend/internal/http/handler/federation_share_test.go

@@ -144,6 +144,393 @@ func TestFederationShareCreateRejectsInvalidAllowedIPs(t *testing.T) {
 	}
 }
 
+func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "test-jwt-secret")
+	now := time.Now().UnixMilli()
+
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
+		Name:           "provider-share",
+		NodeID:         9,
+		Token:          "share-list-token",
+		MaxBandwidth:   1024,
+		CurrentFlow:    512,
+		PortRangeStart: 22000,
+		PortRangeEnd:   22010,
+		IsActive:       1,
+		CreatedTime:    now,
+		UpdatedTime:    now,
+	}); err != nil {
+		t.Fatalf("create peer share: %v", err)
+	}
+
+	share, err := repo.GetPeerShareByToken("share-list-token")
+	if err != nil || share == nil {
+		t.Fatalf("load peer share: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
+		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
+		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`,
+		share.ID, share.NodeID, "r-1", "rk-1", "b-1", "middle", "fed_chain_1", "fed_svc_1", "tls", "round", 22001, "", 1, 1, now, now,
+		share.ID, share.NodeID, "r-2", "rk-2", "b-2", "exit", "", "fed_svc_2", "tls", "round", 22002, "", 1, 1, now, now,
+		share.ID, share.NodeID, "r-3", "rk-3", "", "", "", "", "tls", "round", 22003, "", 0, 0, now, now,
+	); err != nil {
+		t.Fatalf("insert peer_share_runtime rows: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/list", nil)
+	res := httptest.NewRecorder()
+	h.federationShareList(res, req)
+
+	if res.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
+	}
+
+	var payload response.R
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if payload.Code != 0 {
+		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
+	}
+
+	rows, ok := payload.Data.([]interface{})
+	if !ok || len(rows) == 0 {
+		t.Fatalf("expected non-empty share list, got %T", payload.Data)
+	}
+
+	first, ok := rows[0].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected share row object, got %T", rows[0])
+	}
+
+	if int(first["activeRuntimeNum"].(float64)) != 2 {
+		t.Fatalf("expected activeRuntimeNum=2, got %v", first["activeRuntimeNum"])
+	}
+
+	usedPortsRaw, ok := first["usedPorts"].([]interface{})
+	if !ok {
+		t.Fatalf("expected usedPorts array, got %T", first["usedPorts"])
+	}
+	if len(usedPortsRaw) != 2 {
+		t.Fatalf("expected 2 used ports, got %d", len(usedPortsRaw))
+	}
+	if int(usedPortsRaw[0].(float64)) != 22001 || int(usedPortsRaw[1].(float64)) != 22002 {
+		t.Fatalf("unexpected used ports payload: %v", usedPortsRaw)
+	}
+
+	detailsRaw, ok := first["usedPortDetails"].([]interface{})
+	if !ok {
+		t.Fatalf("expected usedPortDetails array, got %T", first["usedPortDetails"])
+	}
+	if len(detailsRaw) != 2 {
+		t.Fatalf("expected 2 usedPortDetails rows, got %d", len(detailsRaw))
+	}
+}
+
+func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "test-jwt-secret")
+	now := time.Now().UnixMilli()
+
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
+		Name:           "delete-cleanup-share",
+		NodeID:         99,
+		Token:          "delete-cleanup-token",
+		MaxBandwidth:   4096,
+		PortRangeStart: 40000,
+		PortRangeEnd:   40010,
+		IsActive:       1,
+		CreatedTime:    now,
+		UpdatedTime:    now,
+	}); err != nil {
+		t.Fatalf("create peer share: %v", err)
+	}
+
+	share, err := repo.GetPeerShareByToken("delete-cleanup-token")
+	if err != nil || share == nil {
+		t.Fatalf("load peer share: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
+		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`,
+		share.ID, 99, "dc-r1", "dc-rk1", "dc-b1", "exit", "", "fed_svc_dc1", "tls", "round", 40001, "", 1, 1, now, now,
+		share.ID, 99, "dc-r2", "dc-rk2", "dc-b2", "middle", "fed_chain_dc2", "fed_svc_dc2", "tls", "round", 40002, "", 1, 1, now, now,
+	); err != nil {
+		t.Fatalf("insert peer_share_runtime rows: %v", err)
+	}
+
+	var runtimeCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1`, share.ID).Scan(&runtimeCount); err != nil {
+		t.Fatalf("count active runtimes before: %v", err)
+	}
+	if runtimeCount != 2 {
+		t.Fatalf("expected 2 active runtimes before delete, got %d", runtimeCount)
+	}
+
+	body, err := json.Marshal(deletePeerShareRequest{ID: share.ID})
+	if err != nil {
+		t.Fatalf("marshal request: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/delete", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	h.federationShareDelete(res, req)
+
+	if res.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
+	}
+	var payload response.R
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if payload.Code != 0 {
+		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
+	}
+
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE id = ?`, share.ID).Scan(&shareCount); err != nil {
+		t.Fatalf("count peer_share after: %v", err)
+	}
+	if shareCount != 0 {
+		t.Fatalf("expected peer_share deleted, got %d rows", shareCount)
+	}
+
+	var runtimeCountAfter int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, share.ID).Scan(&runtimeCountAfter); err != nil {
+		t.Fatalf("count peer_share_runtime after: %v", err)
+	}
+	if runtimeCountAfter != 0 {
+		t.Fatalf("expected all peer_share_runtime rows deleted, got %d", runtimeCountAfter)
+	}
+}
+
+func TestFederationRemoteUsageListSyncErrorFallback(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "test-jwt-secret")
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "sync-error-node", "sync-error-secret", "10.50.60.70", "10.50.60.70", "", "32000-32010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://unreachable.invalid:9999", "bad-token", `{"shareId":42,"maxBandwidth":5368709120,"currentFlow":999999,"portRangeStart":32000,"portRangeEnd":32010}`); err != nil {
+		t.Fatalf("insert remote node: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/remote-usage/list", nil)
+	res := httptest.NewRecorder()
+	h.federationRemoteUsageList(res, req)
+
+	if res.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
+	}
+
+	var payload response.R
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if payload.Code != 0 {
+		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
+	}
+
+	rows, ok := payload.Data.([]interface{})
+	if !ok || len(rows) == 0 {
+		t.Fatalf("expected non-empty usage list, got %T", payload.Data)
+	}
+
+	first, ok := rows[0].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected row map, got %T", rows[0])
+	}
+
+	if int64(first["shareId"].(float64)) != 42 {
+		t.Fatalf("expected stale shareId=42 on sync failure, got %v", first["shareId"])
+	}
+	if int64(first["currentFlow"].(float64)) != 999999 {
+		t.Fatalf("expected stale currentFlow=999999 on sync failure, got %v", first["currentFlow"])
+	}
+
+	syncErr, _ := first["syncError"].(string)
+	if syncErr == "" {
+		t.Fatalf("expected non-empty syncError field on unreachable provider")
+	}
+}
+
+func TestFederationShareResetFlow(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "test-jwt-secret")
+	now := time.Now().UnixMilli()
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
+		Name:           "reset-flow-share",
+		NodeID:         11,
+		Token:          "reset-flow-token",
+		MaxBandwidth:   4096,
+		CurrentFlow:    2048,
+		PortRangeStart: 23000,
+		PortRangeEnd:   23010,
+		IsActive:       1,
+		CreatedTime:    now,
+		UpdatedTime:    now,
+	}); err != nil {
+		t.Fatalf("create peer share: %v", err)
+	}
+	share, err := repo.GetPeerShareByToken("reset-flow-token")
+	if err != nil || share == nil {
+		t.Fatalf("load peer share: %v", err)
+	}
+
+	body, err := json.Marshal(resetPeerShareFlowRequest{ID: share.ID})
+	if err != nil {
+		t.Fatalf("marshal request: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/reset-flow", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	h.federationShareResetFlow(res, req)
+
+	if res.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
+	}
+	var payload response.R
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if payload.Code != 0 {
+		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
+	}
+
+	updated, err := repo.GetPeerShare(share.ID)
+	if err != nil || updated == nil {
+		t.Fatalf("reload peer share: %v", err)
+	}
+	if updated.CurrentFlow != 0 {
+		t.Fatalf("expected current flow reset to 0, got %d", updated.CurrentFlow)
+	}
+}
+
+func TestFederationRemoteUsageList(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = repo.Close() })
+
+	h := New(repo, "test-jwt-secret")
+	now := time.Now().UnixMilli()
+
+	resNode, err := repo.DB().Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "remote-consumer-node", "remote-consumer-secret", "10.30.40.50", "10.30.40.50", "", "31000-31010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":88,"maxBandwidth":2147483648,"currentFlow":1073741824,"portRangeStart":31000,"portRangeEnd":31010}`)
+	if err != nil {
+		t.Fatalf("insert remote node: %v", err)
+	}
+	nodeID, err := resNode.LastInsertId()
+	if err != nil {
+		t.Fatalf("remote node id: %v", err)
+	}
+
+	resTunnelA, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-a", 2, "tls", 1, now, now, 1, "", 0)
+	if err != nil {
+		t.Fatalf("insert tunnel a: %v", err)
+	}
+	tunnelAID, _ := resTunnelA.LastInsertId()
+
+	resTunnelB, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-b", 2, "tls", 1, now, now, 1, "", 0)
+	if err != nil {
+		t.Fatalf("insert tunnel b: %v", err)
+	}
+	tunnelBID, _ := resTunnelB.LastInsertId()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx, remote_url, resource_key, remote_binding_id, allocated_port, status, created_time, updated_time)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
+		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`,
+		tunnelAID, nodeID, 2, 1, "http://peer.example", "rk-a", "rb-a", 31001, 1, now, now,
+		tunnelBID, nodeID, 3, 0, "http://peer.example", "rk-b", "rb-b", 31002, 1, now, now,
+	); err != nil {
+		t.Fatalf("insert federation bindings: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/remote-usage/list", nil)
+	res := httptest.NewRecorder()
+	h.federationRemoteUsageList(res, req)
+
+	if res.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
+	}
+
+	var payload response.R
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if payload.Code != 0 {
+		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
+	}
+
+	rows, ok := payload.Data.([]interface{})
+	if !ok || len(rows) == 0 {
+		t.Fatalf("expected non-empty usage list, got %T", payload.Data)
+	}
+
+	first, ok := rows[0].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected first usage row map, got %T", rows[0])
+	}
+	if int64(first["shareId"].(float64)) != 88 {
+		t.Fatalf("expected shareId=88, got %v", first["shareId"])
+	}
+
+	usedPortsRaw, ok := first["usedPorts"].([]interface{})
+	if !ok {
+		t.Fatalf("expected usedPorts array, got %T", first["usedPorts"])
+	}
+	if len(usedPortsRaw) != 2 {
+		t.Fatalf("expected 2 used ports, got %d", len(usedPortsRaw))
+	}
+	if int(usedPortsRaw[0].(float64)) != 31001 || int(usedPortsRaw[1].(float64)) != 31002 {
+		t.Fatalf("unexpected used ports payload: %v", usedPortsRaw)
+	}
+
+	bindingsRaw, ok := first["bindings"].([]interface{})
+	if !ok {
+		t.Fatalf("expected bindings array, got %T", first["bindings"])
+	}
+	if len(bindingsRaw) != 2 {
+		t.Fatalf("expected 2 binding rows, got %d", len(bindingsRaw))
+	}
+}
+
 func TestAuthPeerAllowedIPs(t *testing.T) {
 	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {

go-backend/internal/http/handler/flow_policy.go

@@ -38,16 +38,21 @@ func (h *Handler) processFlowItem(item flowItem) {
 	}
 
 	forwardID, userID, userTunnelID, ok := parseFlowServiceIDs(serviceName)
-	if !ok {
+	if ok {
+		inFlow, outFlow := h.scaleFlowByTunnel(forwardID, item.D, item.U)
+		_ = h.repo.AddFlow(forwardID, userID, userTunnelID, inFlow, outFlow)
+
+		if userTunnelID > 0 {
+			h.enforceFlowPolicies(userID, userTunnelID)
+		}
 		return
 	}
 
-	inFlow, outFlow := h.scaleFlowByTunnel(forwardID, item.D, item.U)
-	_ = h.repo.AddFlow(forwardID, userID, userTunnelID, inFlow, outFlow)
-
-	if userTunnelID > 0 {
-		h.enforceFlowPolicies(userID, userTunnelID)
+	runtimeID, ok := parsePeerShareRuntimeServiceID(serviceName)
+	if !ok {
+		return
 	}
+	h.processPeerShareFlow(runtimeID, item)
 }
 
 func parseFlowServiceIDs(serviceName string) (int64, int64, int64, bool) {
@@ -66,6 +71,72 @@ func parseFlowServiceIDs(serviceName string) (int64, int64, int64, bool) {
 	return forwardID, userID, userTunnelID, true
 }
 
+func parsePeerShareRuntimeServiceID(serviceName string) (int64, bool) {
+	const prefix = "fed_svc_"
+	if !strings.HasPrefix(serviceName, prefix) {
+		return 0, false
+	}
+	raw := strings.TrimPrefix(serviceName, prefix)
+	if raw == "" {
+		return 0, false
+	}
+	parts := strings.SplitN(raw, "_", 2)
+	runtimeID, err := strconv.ParseInt(parts[0], 10, 64)
+	if err != nil || runtimeID <= 0 {
+		return 0, false
+	}
+	return runtimeID, true
+}
+
+func (h *Handler) processPeerShareFlow(runtimeID int64, item flowItem) {
+	if h == nil || h.repo == nil || runtimeID <= 0 {
+		return
+	}
+	runtime, err := h.repo.GetPeerShareRuntimeByID(runtimeID)
+	if err != nil || runtime == nil || runtime.ShareID <= 0 || runtime.Status != 1 {
+		return
+	}
+
+	delta := item.D + item.U
+	if delta <= 0 {
+		return
+	}
+
+	_ = h.repo.AddPeerShareCurrentFlow(runtime.ShareID, delta)
+
+	share, err := h.repo.GetPeerShare(runtime.ShareID)
+	if err != nil || share == nil {
+		return
+	}
+	if !isPeerShareFlowExceeded(share) {
+		return
+	}
+	h.enforcePeerShareFlowLimit(share.ID)
+}
+
+func (h *Handler) enforcePeerShareFlowLimit(shareID int64) {
+	if h == nil || h.repo == nil || shareID <= 0 {
+		return
+	}
+	runtimes, err := h.repo.ListActivePeerShareRuntimesByShareID(shareID)
+	if err != nil || len(runtimes) == 0 {
+		return
+	}
+
+	now := time.Now().UnixMilli()
+	for _, runtime := range runtimes {
+		if h.wsServer != nil && runtime.Applied == 1 {
+			if strings.TrimSpace(runtime.ServiceName) != "" {
+				_, _ = h.sendNodeCommand(runtime.NodeID, "DeleteService", map[string]interface{}{"services": []string{runtime.ServiceName}}, false, true)
+			}
+			if strings.TrimSpace(runtime.Role) == "middle" && strings.TrimSpace(runtime.ChainName) != "" {
+				_, _ = h.sendNodeCommand(runtime.NodeID, "DeleteChains", map[string]interface{}{"chain": runtime.ChainName}, false, true)
+			}
+		}
+		_ = h.repo.MarkPeerShareRuntimeReleased(runtime.ID, now)
+	}
+}
+
 func (h *Handler) scaleFlowByTunnel(forwardID int64, inFlow int64, outFlow int64) (int64, int64) {
 	forward, err := h.getForwardRecord(forwardID)
 	if err != nil || forward == nil {

go-backend/internal/http/handler/flow_policy_federation_test.go

@@ -0,0 +1,63 @@
+package handler
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"go-backend/internal/store/sqlite"
+)
+
+func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
+	if err != nil {
+		t.Fatalf("open repo: %v", err)
+	}
+	defer repo.Close()
+
+	now := time.Now().UnixMilli()
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
+		Name:           "flow-share",
+		NodeID:         1,
+		Token:          "flow-share-token",
+		MaxBandwidth:   3000,
+		CurrentFlow:    1000,
+		PortRangeStart: 32000,
+		PortRangeEnd:   32010,
+		IsActive:       1,
+		CreatedTime:    now,
+		UpdatedTime:    now,
+	}); err != nil {
+		t.Fatalf("create peer share: %v", err)
+	}
+	share, err := repo.GetPeerShareByToken("flow-share-token")
+	if err != nil || share == nil {
+		t.Fatalf("load peer share: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, 17, share.ID, share.NodeID, "res-17", "rk-17", "17", "exit", "", "fed_svc_17", "tls", "round", 32001, "", 1, 1, now, now); err != nil {
+		t.Fatalf("insert peer_share_runtime: %v", err)
+	}
+
+	h := &Handler{repo: repo}
+	h.processFlowItem(flowItem{N: "fed_svc_17", U: 1200, D: 900})
+
+	updatedShare, err := repo.GetPeerShare(share.ID)
+	if err != nil || updatedShare == nil {
+		t.Fatalf("reload share: %v", err)
+	}
+	if updatedShare.CurrentFlow != 3100 {
+		t.Fatalf("expected current_flow=3100, got %d", updatedShare.CurrentFlow)
+	}
+
+	runtime, err := repo.GetPeerShareRuntimeByID(17)
+	if err != nil || runtime == nil {
+		t.Fatalf("reload runtime: %v", err)
+	}
+	if runtime.Status != 0 {
+		t.Fatalf("expected runtime status=0 after limit enforcement, got %d", runtime.Status)
+	}
+}

go-backend/internal/http/handler/handler.go

@@ -105,6 +105,10 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/node/update-order", h.nodeUpdateOrder)
 	mux.HandleFunc("/api/v1/node/batch-delete", h.nodeBatchDelete)
 	mux.HandleFunc("/api/v1/node/check-status", h.nodeCheckStatus)
+	mux.HandleFunc("/api/v1/node/upgrade", h.nodeUpgrade)
+	mux.HandleFunc("/api/v1/node/batch-upgrade", h.nodeBatchUpgrade)
+	mux.HandleFunc("/api/v1/node/rollback", h.nodeRollback)
+	mux.HandleFunc("/api/v1/node/releases", h.listReleases)
 	mux.HandleFunc("/api/v1/tunnel/list", h.tunnelList)
 	mux.HandleFunc("/api/v1/tunnel/create", h.tunnelCreate)
 	mux.HandleFunc("/api/v1/tunnel/get", h.tunnelGet)
@@ -155,7 +159,10 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/open_api/sub_store", h.openAPISubStore)
 	mux.HandleFunc("/api/v1/federation/share/list", h.federationShareList)
 	mux.HandleFunc("/api/v1/federation/share/create", h.federationShareCreate)
+	mux.HandleFunc("/api/v1/federation/share/update", h.federationShareUpdate)
 	mux.HandleFunc("/api/v1/federation/share/delete", h.federationShareDelete)
+	mux.HandleFunc("/api/v1/federation/share/reset-flow", h.federationShareResetFlow)
+	mux.HandleFunc("/api/v1/federation/share/remote-usage/list", h.federationRemoteUsageList)
 	mux.HandleFunc("/api/v1/federation/connect", h.authPeer(h.federationConnect))
 	mux.HandleFunc("/api/v1/federation/tunnel/create", h.authPeer(h.federationTunnelCreate))
 	mux.HandleFunc("/api/v1/federation/runtime/reserve-port", h.authPeer(h.federationRuntimeReservePort))
@@ -318,6 +325,9 @@ func (h *Handler) nodeList(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+
+	h.syncRemoteNodeStatuses(items)
+
 	response.WriteJSON(w, response.OK(items))
 }
 

go-backend/internal/http/handler/mutations.go

@@ -413,7 +413,7 @@ func (h *Handler) nodeInstall(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	cmd := fmt.Sprintf("curl -L https://github.com/Sagit-chu/flux-panel/releases/latest/download/install.sh -o ./install.sh && chmod +x ./install.sh && ./install.sh -a %s -s %s", processServerAddress(panelAddr), secret)
+	cmd := fmt.Sprintf("curl -L https://gcode.hostcentral.cc/https://github.com/Sagit-chu/flvx/releases/latest/download/install.sh -o ./install.sh && chmod +x ./install.sh && ./install.sh -a %s -s %s", processServerAddress(panelAddr), secret)
 	response.WriteJSON(w, response.OK(cmd))
 }
 

go-backend/internal/http/handler/upgrade.go

@@ -0,0 +1,291 @@
+package handler
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"go-backend/internal/http/response"
+)
+
+const (
+	githubRepo     = "Sagit-chu/flvx"
+	githubProxy    = "https://gcode.hostcentral.cc"
+	githubAPIBase  = "https://api.github.com"
+	githubHTMLBase = "https://github.com"
+	upgradeTimeout = 5 * time.Minute
+	batchWorkers   = 5
+)
+
+func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req struct {
+		ID      int64  `json:"id"`
+		Version string `json:"version"`
+	}
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
+		return
+	}
+	if req.ID <= 0 {
+		response.WriteJSON(w, response.ErrDefault("节点ID无效"))
+		return
+	}
+
+	version := strings.TrimSpace(req.Version)
+	if version == "" {
+		var err error
+		version, err = resolveLatestRelease()
+		if err != nil {
+			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新版本失败: %v", err)))
+			return
+		}
+	}
+
+	downloadURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}",
+		githubHTMLBase, githubRepo, version,
+	)
+	checksumURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}.sha256",
+		githubHTMLBase, githubRepo, version,
+	)
+
+	result, err := h.wsServer.SendCommand(req.ID, "UpgradeAgent", map[string]interface{}{
+		"downloadUrl": downloadURL,
+		"checksumUrl": checksumURL,
+	}, upgradeTimeout)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("升级失败: %v", err)))
+		return
+	}
+
+	response.WriteJSON(w, response.OK(map[string]interface{}{
+		"version": version,
+		"message": result.Message,
+	}))
+}
+
+func resolveLatestRelease() (string, error) {
+	client := &http.Client{
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+		Timeout: 10 * time.Second,
+	}
+
+	resp, err := client.Get(githubProxy + "/" + githubHTMLBase + "/" + githubRepo + "/releases/latest")
+	if err != nil {
+		return "", fmt.Errorf("请求GitHub失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusMovedPermanently {
+		return resolveLatestReleaseAPI()
+	}
+
+	location := resp.Header.Get("Location")
+	if location == "" {
+		return resolveLatestReleaseAPI()
+	}
+
+	parts := strings.Split(location, "/")
+	tag := parts[len(parts)-1]
+	if tag == "" || tag == "latest" {
+		return resolveLatestReleaseAPI()
+	}
+
+	return tag, nil
+}
+
+func resolveLatestReleaseAPI() (string, error) {
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get(githubAPIBase + "/repos/" + githubRepo + "/releases/latest")
+	if err != nil {
+		return "", fmt.Errorf("请求GitHub API失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return "", fmt.Errorf("GitHub API返回 %d: %s", resp.StatusCode, string(body))
+	}
+
+	var release struct {
+		TagName string `json:"tag_name"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
+		return "", fmt.Errorf("解析GitHub API响应失败: %v", err)
+	}
+	if strings.TrimSpace(release.TagName) == "" {
+		return "", fmt.Errorf("无法从GitHub获取最新版本号")
+	}
+
+	return release.TagName, nil
+}
+
+func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req struct {
+		IDs     []int64 `json:"ids"`
+		Version string  `json:"version"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
+		return
+	}
+	if len(req.IDs) == 0 {
+		response.WriteJSON(w, response.ErrDefault("ids不能为空"))
+		return
+	}
+
+	version := strings.TrimSpace(req.Version)
+	if version == "" {
+		var err error
+		version, err = resolveLatestRelease()
+		if err != nil {
+			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新版本失败: %v", err)))
+			return
+		}
+	}
+
+	downloadURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}",
+		githubHTMLBase, githubRepo, version,
+	)
+	checksumURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}.sha256",
+		githubHTMLBase, githubRepo, version,
+	)
+
+	type upgradeResult struct {
+		ID      int64  `json:"id"`
+		Success bool   `json:"success"`
+		Message string `json:"message"`
+	}
+
+	results := make([]upgradeResult, len(req.IDs))
+	sem := make(chan struct{}, batchWorkers)
+	var wg sync.WaitGroup
+
+	for i, id := range req.IDs {
+		wg.Add(1)
+		go func(index int, nodeID int64) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			result, err := h.wsServer.SendCommand(nodeID, "UpgradeAgent", map[string]interface{}{
+				"downloadUrl": downloadURL,
+				"checksumUrl": checksumURL,
+			}, upgradeTimeout)
+			if err != nil {
+				results[index] = upgradeResult{ID: nodeID, Success: false, Message: err.Error()}
+				return
+			}
+			results[index] = upgradeResult{ID: nodeID, Success: true, Message: result.Message}
+		}(i, id)
+	}
+	wg.Wait()
+
+	response.WriteJSON(w, response.OK(map[string]interface{}{
+		"version": version,
+		"results": results,
+	}))
+}
+
+func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Get(githubAPIBase + "/repos/" + githubRepo + "/releases?per_page=20")
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: %v", err)))
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: GitHub API返回 %d: %s", resp.StatusCode, string(body))))
+		return
+	}
+
+	var releases []struct {
+		TagName     string `json:"tag_name"`
+		Name        string `json:"name"`
+		PublishedAt string `json:"published_at"`
+		Prerelease  bool   `json:"prerelease"`
+		Draft       bool   `json:"draft"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("解析版本列表失败: %v", err)))
+		return
+	}
+
+	type releaseItem struct {
+		Version     string `json:"version"`
+		Name        string `json:"name"`
+		PublishedAt string `json:"publishedAt"`
+		Prerelease  bool   `json:"prerelease"`
+	}
+
+	items := make([]releaseItem, 0, len(releases))
+	for _, r := range releases {
+		if r.Draft {
+			continue
+		}
+		items = append(items, releaseItem{
+			Version:     r.TagName,
+			Name:        r.Name,
+			PublishedAt: r.PublishedAt,
+			Prerelease:  r.Prerelease,
+		})
+	}
+
+	response.WriteJSON(w, response.OK(items))
+}
+
+func (h *Handler) nodeRollback(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("请求失败"))
+		return
+	}
+
+	var req struct {
+		ID int64 `json:"id"`
+	}
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
+		return
+	}
+	if req.ID <= 0 {
+		response.WriteJSON(w, response.ErrDefault("节点ID无效"))
+		return
+	}
+
+	result, err := h.wsServer.SendCommand(req.ID, "RollbackAgent", map[string]interface{}{}, 30*time.Second)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("回退失败: %v", err)))
+		return
+	}
+
+	response.WriteJSON(w, response.OK(map[string]interface{}{
+		"message": result.Message,
+	}))
+}

go-backend/internal/store/sqlite/repository.go

@@ -165,7 +165,13 @@ func Open(path string) (*Repository, error) {
 		return nil, err
 	}
 
-	db, err := sql.Open("sqlite", path)
+	// Use _pragma DSN parameters so every connection from the pool gets
+	// the same settings (busy_timeout and synchronous are per-connection).
+	dsn := "file:" + path +
+		"?_pragma=busy_timeout(5000)" +
+		"&_pragma=journal_mode(WAL)" +
+		"&_pragma=synchronous(NORMAL)"
+	db, err := sql.Open("sqlite", dsn)
 	if err != nil {
 		return nil, err
 	}
@@ -1335,8 +1341,16 @@ func (r *Repository) DeletePeerShare(id int64) error {
 	if r == nil || r.db == nil {
 		return errors.New("repository not initialized")
 	}
-	_, err := r.db.Exec(`DELETE FROM peer_share WHERE id=?`, id)
-	return err
+	tx, err := r.db.Begin()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+	_, _ = tx.Exec(`DELETE FROM peer_share_runtime WHERE share_id = ?`, id)
+	if _, err := tx.Exec(`DELETE FROM peer_share WHERE id=?`, id); err != nil {
+		return err
+	}
+	return tx.Commit()
 }
 
 func (r *Repository) GetPeerShare(id int64) (*PeerShare, error) {
@@ -1450,6 +1464,80 @@ func (r *Repository) GetPeerShareRuntimeByBindingID(shareID int64, bindingID str
 	return &item, nil
 }
 
+func (r *Repository) GetPeerShareRuntimeByID(id int64) (*PeerShareRuntime, error) {
+	if r == nil || r.db == nil {
+		return nil, errors.New("repository not initialized")
+	}
+	row := r.db.QueryRow(`
+		SELECT id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time
+		FROM peer_share_runtime
+		WHERE id = ?
+		LIMIT 1
+	`, id)
+	var item PeerShareRuntime
+	if err := row.Scan(&item.ID, &item.ShareID, &item.NodeID, &item.ReservationID, &item.ResourceKey, &item.BindingID, &item.Role, &item.ChainName, &item.ServiceName, &item.Protocol, &item.Strategy, &item.Port, &item.Target, &item.Applied, &item.Status, &item.CreatedTime, &item.UpdatedTime); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &item, nil
+}
+
+func (r *Repository) ListActivePeerShareRuntimesByShareID(shareID int64) ([]PeerShareRuntime, error) {
+	if r == nil || r.db == nil {
+		return nil, errors.New("repository not initialized")
+	}
+	rows, err := r.db.Query(`
+		SELECT id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time
+		FROM peer_share_runtime
+		WHERE share_id = ? AND status = 1
+		ORDER BY port ASC, id ASC
+	`, shareID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := make([]PeerShareRuntime, 0)
+	for rows.Next() {
+		var item PeerShareRuntime
+		if err := rows.Scan(&item.ID, &item.ShareID, &item.NodeID, &item.ReservationID, &item.ResourceKey, &item.BindingID, &item.Role, &item.ChainName, &item.ServiceName, &item.Protocol, &item.Strategy, &item.Port, &item.Target, &item.Applied, &item.Status, &item.CreatedTime, &item.UpdatedTime); err != nil {
+			return nil, err
+		}
+		out = append(out, item)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (r *Repository) AddPeerShareCurrentFlow(shareID int64, delta int64) error {
+	if r == nil || r.db == nil {
+		return errors.New("repository not initialized")
+	}
+	if shareID <= 0 || delta <= 0 {
+		return nil
+	}
+	_, err := r.db.Exec(`UPDATE peer_share SET current_flow = current_flow + ?, updated_time = ? WHERE id = ?`, delta, unixMilliNow(), shareID)
+	return err
+}
+
+func (r *Repository) ResetPeerShareCurrentFlow(shareID int64, updatedTime int64) error {
+	if r == nil || r.db == nil {
+		return errors.New("repository not initialized")
+	}
+	if shareID <= 0 {
+		return nil
+	}
+	if updatedTime <= 0 {
+		updatedTime = unixMilliNow()
+	}
+	_, err := r.db.Exec(`UPDATE peer_share SET current_flow = 0, updated_time = ? WHERE id = ?`, updatedTime, shareID)
+	return err
+}
+
 func (r *Repository) CreatePeerShareRuntime(item *PeerShareRuntime) error {
 	if r == nil || r.db == nil {
 		return errors.New("repository not initialized")

go-backend/internal/ws/server.go

@@ -54,6 +54,12 @@ type pendingRequest struct {
 	ch     chan CommandResult
 }
 
+const (
+	wsPingPeriod = 15 * time.Second
+	wsPongWait   = 45 * time.Second
+	wsWriteWait  = 5 * time.Second
+)
+
 type CommandResult struct {
 	Type    string                 `json:"type"`
 	Success bool                   `json:"success"`
@@ -120,12 +126,19 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	cw := &connWrap{conn: conn}
+	_ = conn.SetReadDeadline(time.Now().Add(wsPongWait))
+	conn.SetPongHandler(func(string) error {
+		return conn.SetReadDeadline(time.Now().Add(wsPongWait))
+	})
+	done := make(chan struct{})
+	go startKeepalive(cw, done)
 
 	s.mu.Lock()
 	s.admins[cw] = struct{}{}
 	s.mu.Unlock()
 
 	defer func() {
+		close(done)
 		s.mu.Lock()
 		delete(s.admins, cw)
 		s.mu.Unlock()
@@ -145,6 +158,12 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 		return
 	}
 	cw := &connWrap{conn: conn}
+	_ = conn.SetReadDeadline(time.Now().Add(wsPongWait))
+	conn.SetPongHandler(func(string) error {
+		return conn.SetReadDeadline(time.Now().Add(wsPongWait))
+	})
+	done := make(chan struct{})
+	go startKeepalive(cw, done)
 
 	version := r.URL.Query().Get("version")
 	httpVal := parseIntDefault(r.URL.Query().Get("http"), 0)
@@ -165,6 +184,7 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 	s.broadcastStatus(nodeID, 1)
 
 	defer func() {
+		close(done)
 		needOfflineBroadcast := false
 		s.mu.Lock()
 		current, ok := s.nodes[nodeID]
@@ -190,7 +210,15 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 
 		msg := decryptIfNeeded(payload, secret)
 		s.tryResolvePending(nodeID, msg)
-		s.broadcastInfo(nodeID, msg)
+
+		var parsed struct {
+			Type string `json:"type"`
+		}
+		if json.Unmarshal([]byte(msg), &parsed) == nil && parsed.Type == "UpgradeProgress" {
+			s.broadcastTyped(nodeID, "upgrade_progress", msg)
+		} else {
+			s.broadcastInfo(nodeID, msg)
+		}
 	}
 }
 
@@ -264,7 +292,9 @@ func (s *Server) SendCommand(nodeID int64, cmdType string, data interface{}, tim
 	}
 
 	ns.conn.mu.Lock()
+	_ = ns.conn.conn.SetWriteDeadline(time.Now().Add(wsWriteWait))
 	err = ns.conn.conn.WriteMessage(websocket.TextMessage, messageData)
+	_ = ns.conn.conn.SetWriteDeadline(time.Time{})
 	ns.conn.mu.Unlock()
 	if err != nil {
 		cleanup()
@@ -385,6 +415,12 @@ func (s *Server) broadcastInfo(nodeID int64, data string) {
 	s.broadcastToAdmins(string(raw))
 }
 
+func (s *Server) broadcastTyped(nodeID int64, msgType string, data string) {
+	payload := broadcastMessage{ID: nodeID, Type: msgType, Data: data}
+	raw, _ := json.Marshal(payload)
+	s.broadcastToAdmins(string(raw))
+}
+
 func (s *Server) broadcastToAdmins(message string) {
 	s.mu.RLock()
 	admins := make([]*connWrap, 0, len(s.admins))
@@ -395,7 +431,9 @@ func (s *Server) broadcastToAdmins(message string) {
 
 	for _, c := range admins {
 		c.mu.Lock()
+		_ = c.conn.SetWriteDeadline(time.Now().Add(wsWriteWait))
 		err := c.conn.WriteMessage(websocket.TextMessage, []byte(message))
+		_ = c.conn.SetWriteDeadline(time.Time{})
 		c.mu.Unlock()
 		if err != nil {
 			log.Printf("websocket broadcast failed: %v", err)
@@ -428,3 +466,28 @@ func parseIntDefault(v string, fallback int) int {
 	}
 	return x
 }
+
+func startKeepalive(cw *connWrap, done <-chan struct{}) {
+	if cw == nil || cw.conn == nil {
+		return
+	}
+	ticker := time.NewTicker(wsPingPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-done:
+			return
+		case <-ticker.C:
+			cw.mu.Lock()
+			_ = cw.conn.SetWriteDeadline(time.Now().Add(wsWriteWait))
+			err := cw.conn.WriteMessage(websocket.PingMessage, nil)
+			_ = cw.conn.SetWriteDeadline(time.Time{})
+			cw.mu.Unlock()
+			if err != nil {
+				_ = cw.conn.Close()
+				return
+			}
+		}
+	}
+}

go-gost/x/socket/websocket_reporter.go

@@ -4,10 +4,17 @@ import (
 	"bytes"
 	"compress/gzip"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net"
+	"net/http"
 	"net/url"
+	"os"
+	"os/exec"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync" // 新增：用于管理连接状态的互斥锁
@@ -21,7 +28,6 @@ import (
 	"github.com/shirou/gopsutil/v3/host"
 	"github.com/shirou/gopsutil/v3/mem"
 	psnet "github.com/shirou/gopsutil/v3/net"
-	"os"
 )
 
 // SystemInfo 系统信息结构体
@@ -85,6 +91,11 @@ type TcpPingResponse struct {
 	RequestId    string  `json:"requestId,omitempty"`
 }
 
+const (
+	reporterReadWait  = 60 * time.Second
+	reporterWriteWait = 5 * time.Second
+)
+
 type WebSocketReporter struct {
 	url            string
 	addr           string // 保存服务器地址
@@ -237,6 +248,14 @@ func (w *WebSocketReporter) connect() error {
 
 	w.conn = conn
 	w.connected = true
+	_ = conn.SetReadDeadline(time.Now().Add(reporterReadWait))
+	conn.SetPingHandler(func(appData string) error {
+		_ = conn.SetReadDeadline(time.Now().Add(reporterReadWait))
+		return conn.WriteControl(websocket.PongMessage, []byte(appData), time.Now().Add(reporterWriteWait))
+	})
+	conn.SetPongHandler(func(string) error {
+		return conn.SetReadDeadline(time.Now().Add(reporterReadWait))
+	})
 
 	// 设置关闭处理器来检测连接状态
 	w.conn.SetCloseHandler(func(code int, text string) error {
@@ -377,7 +396,7 @@ func (w *WebSocketReporter) receiveMessages() {
 			}
 
 			// 设置读取超时
-			conn.SetReadDeadline(time.Now().Add(30 * time.Second))
+			conn.SetReadDeadline(time.Now().Add(reporterReadWait))
 
 			messageType, message, err := conn.ReadMessage()
 			if err != nil {
@@ -466,9 +485,8 @@ func (w *WebSocketReporter) handleReceivedMessage(messageType int, message []byt
 			}
 
 			if cmdMsg.Type != "call" {
-				// TcpPing 诊断命令异步执行，避免阻塞其他命令
 				// 其他状态变更命令保持同步，确保顺序执行
-				if cmdMsg.Type == "TcpPing" {
+				if cmdMsg.Type == "TcpPing" || cmdMsg.Type == "UpgradeAgent" || cmdMsg.Type == "RollbackAgent" {
 					go w.routeCommand(cmdMsg)
 				} else {
 					w.routeCommand(cmdMsg)
@@ -483,9 +501,8 @@ func (w *WebSocketReporter) handleReceivedMessage(messageType int, message []byt
 				return
 			}
 			if cmdMsg.Type != "call" {
-				// TcpPing 诊断命令异步执行，避免阻塞其他命令
 				// 其他状态变更命令保持同步，确保顺序执行
-				if cmdMsg.Type == "TcpPing" {
+				if cmdMsg.Type == "TcpPing" || cmdMsg.Type == "UpgradeAgent" || cmdMsg.Type == "RollbackAgent" {
 					go w.routeCommand(cmdMsg)
 				} else {
 					w.routeCommand(cmdMsg)
@@ -579,6 +596,18 @@ func (w *WebSocketReporter) routeCommand(cmd CommandMessage) {
 		response.Type = "SetProtocolResponse"
 		needSaveConfig = true
 
+	// 升级 Agent 命令（异步执行，不需要保存配置）
+	case "UpgradeAgent":
+		err = w.handleUpgradeAgent(cmd.Data)
+		response.Type = "UpgradeAgentResponse"
+		// needSaveConfig = false (默认值)
+
+	// 回退 Agent 到旧版本
+	case "RollbackAgent":
+		err = w.handleRollbackAgent(cmd.Data)
+		response.Type = "RollbackAgentResponse"
+		// needSaveConfig = false (默认值)
+
 	default:
 		err = fmt.Errorf("未知命令类型: %s", cmd.Type)
 		response.Type = "UnknownCommandResponse"
@@ -881,6 +910,186 @@ func (w *WebSocketReporter) handleSetProtocol(data interface{}) error {
 	return nil
 }
 
+// sendUpgradeProgress 通过 WS 发送升级进度消息
+func (w *WebSocketReporter) sendUpgradeProgress(stage string, percent int, message string) {
+	response := CommandResponse{
+		Type:    "UpgradeProgress",
+		Success: true,
+		Message: message,
+		Data: map[string]interface{}{
+			"stage":   stage,
+			"percent": percent,
+		},
+	}
+	w.sendResponse(response)
+}
+
+func (w *WebSocketReporter) handleUpgradeAgent(data interface{}) error {
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return fmt.Errorf("序列化数据失败: %v", err)
+	}
+
+	var req struct {
+		DownloadURL string `json:"downloadUrl"`
+		ChecksumURL string `json:"checksumUrl"`
+	}
+	if err := json.Unmarshal(jsonData, &req); err != nil {
+		return fmt.Errorf("解析升级参数失败: %v", err)
+	}
+	if strings.TrimSpace(req.DownloadURL) == "" {
+		return fmt.Errorf("下载地址不能为空")
+	}
+
+	// 替换架构占位符
+	downloadURL := strings.ReplaceAll(req.DownloadURL, "{ARCH}", runtime.GOARCH)
+	checksumURL := strings.ReplaceAll(req.ChecksumURL, "{ARCH}", runtime.GOARCH)
+
+	w.sendUpgradeProgress("downloading", 0, "开始下载升级包...")
+	fmt.Printf("📦 开始下载升级包: %s\n", downloadURL)
+
+	// 下载新版本二进制
+	const binaryPath = "/etc/flux_agent/flux_agent"
+	tmpPath := binaryPath + ".new"
+	backupPath := binaryPath + ".old"
+
+	resp, err := http.Get(downloadURL)
+	if err != nil {
+		return fmt.Errorf("下载升级包失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("下载升级包失败, HTTP状态码: %d", resp.StatusCode)
+	}
+
+	outFile, err := os.Create(tmpPath)
+	if err != nil {
+		return fmt.Errorf("创建临时文件失败: %v", err)
+	}
+
+	// 带进度的下载
+	totalSize := resp.ContentLength
+	var downloaded int64
+	buf := make([]byte, 32*1024)
+	lastPercent := 0
+	hasher := sha256.New()
+
+	for {
+		n, readErr := resp.Body.Read(buf)
+		if n > 0 {
+			if _, wErr := outFile.Write(buf[:n]); wErr != nil {
+				outFile.Close()
+				os.Remove(tmpPath)
+				return fmt.Errorf("写入升级包失败: %v", wErr)
+			}
+			hasher.Write(buf[:n])
+			downloaded += int64(n)
+			if totalSize > 0 {
+				percent := int(downloaded * 100 / totalSize)
+				if percent-lastPercent >= 10 {
+					lastPercent = percent
+					w.sendUpgradeProgress("downloading", percent, fmt.Sprintf("下载中... %d%%", percent))
+				}
+			}
+		}
+		if readErr != nil {
+			if readErr == io.EOF {
+				break
+			}
+			outFile.Close()
+			os.Remove(tmpPath)
+			return fmt.Errorf("读取升级包失败: %v", readErr)
+		}
+	}
+	outFile.Close()
+
+	if downloaded == 0 {
+		os.Remove(tmpPath)
+		return fmt.Errorf("下载的升级包为空")
+	}
+
+	w.sendUpgradeProgress("downloading", 100, fmt.Sprintf("下载完成 (%d bytes)", downloaded))
+
+	// Checksum 校验
+	if checksumURL != "" {
+		w.sendUpgradeProgress("verifying", 0, "校验文件完整性...")
+		checksumResp, err := http.Get(checksumURL)
+		if err == nil {
+			defer checksumResp.Body.Close()
+			if checksumResp.StatusCode == http.StatusOK {
+				checksumBody, err := io.ReadAll(checksumResp.Body)
+				if err == nil {
+					// 格式: "<hash>  <filename>" 或 "<hash>"
+					expectedHash := strings.TrimSpace(strings.Split(string(checksumBody), " ")[0])
+					actualHash := hex.EncodeToString(hasher.Sum(nil))
+					if !strings.EqualFold(expectedHash, actualHash) {
+						os.Remove(tmpPath)
+						return fmt.Errorf("校验失败: 期望 %s, 实际 %s", expectedHash, actualHash)
+					}
+					fmt.Printf("✅ Checksum 校验通过: %s\n", actualHash)
+				}
+			}
+		}
+		w.sendUpgradeProgress("verifying", 100, "校验通过")
+	}
+
+	if err := os.Chmod(tmpPath, 0755); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("设置执行权限失败: %v", err)
+	}
+
+	// 备份旧版本
+	w.sendUpgradeProgress("installing", 50, "备份旧版本...")
+	if _, err := os.Stat(binaryPath); err == nil {
+		// 复制旧文件作为备份（不用 rename，因为可能正在运行）
+		oldData, err := os.ReadFile(binaryPath)
+		if err == nil {
+			_ = os.WriteFile(backupPath, oldData, 0755)
+			fmt.Println("📦 旧版本已备份到", backupPath)
+		}
+	}
+
+	w.sendUpgradeProgress("installing", 80, "准备重启...")
+	fmt.Printf("✅ 升级包下载完成 (%d bytes), 准备重启...\n", downloaded)
+
+	// 执行重启脚本
+	// 使用 systemd-run 在独立的 transient unit 中运行重启脚本，
+	// 避免 systemctl stop 杀死 flux_agent cgroup 内所有进程（包括此脚本自身）导致 mv 未执行。
+	script := fmt.Sprintf("sleep 1 && systemctl stop flux_agent && mv %s %s && systemctl start flux_agent", tmpPath, binaryPath)
+	cmd := exec.Command("systemd-run", "--quiet", "/bin/sh", "-c", script)
+	if err := cmd.Start(); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("启动重启脚本失败: %v", err)
+	}
+
+	w.sendUpgradeProgress("installing", 100, "重启中...")
+	fmt.Println("🔄 重启脚本已启动, Agent 将在 1 秒后重启...")
+	return nil
+}
+
+func (w *WebSocketReporter) handleRollbackAgent(data interface{}) error {
+	const binaryPath = "/etc/flux_agent/flux_agent"
+	backupPath := binaryPath + ".old"
+
+	// 检查备份文件是否存在
+	if _, err := os.Stat(backupPath); os.IsNotExist(err) {
+		return fmt.Errorf("没有可用的备份文件，无法回退")
+	}
+
+	fmt.Println("🔄 开始回退到旧版本...")
+
+	// 执行回退脚本（同升级逻辑，使用 systemd-run 避免 cgroup 问题）
+	script := fmt.Sprintf("sleep 1 && systemctl stop flux_agent && cp %s %s && systemctl start flux_agent", backupPath, binaryPath)
+	cmd := exec.Command("systemd-run", "--quiet", "/bin/sh", "-c", script)
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("启动回退脚本失败: %v", err)
+	}
+
+	fmt.Println("🔄 回退脚本已启动, Agent 将在 1 秒后重启...")
+	return nil
+}
+
 // updateLocalConfigJSON 将 http/tls/socks 写入工作目录下的 config.json
 func updateLocalConfigJSON(httpVal int, tlsVal int, socksVal int) error {
 	path := "config.json"

install.sh

@@ -3,6 +3,9 @@
 # GitHub repo used for release downloads
 REPO="Sagit-chu/flux-panel"
 
+# 固定版本号（Release 构建时自动填充，留空则获取最新版）
+PINNED_VERSION=""
+
 # 获取系统架构
 get_architecture() {
     ARCH=$(uname -m)
@@ -22,16 +25,10 @@ get_architecture() {
 # 安装目录
 INSTALL_DIR="/etc/flux_agent"
 
-# 识别国家（用于镜像加速）
-COUNTRY=$(curl -s https://ipinfo.io/country)
-
+# 镜像加速（所有下载均经过镜像源，以支持 IPv6）
 maybe_proxy_url() {
   local url="$1"
-  if [ "$COUNTRY" = "CN" ]; then
-    echo "https://gcode.hostcentral.cc/${url}"
-  else
-    echo "$url"
-  fi
+  echo "https://gcode.hostcentral.cc/${url}"
 }
 
 resolve_latest_release_tag() {
@@ -40,39 +37,19 @@ resolve_latest_release_tag() {
   latest_url="https://github.com/${REPO}/releases/latest"
   api_url="https://api.github.com/repos/${REPO}/releases/latest"
 
-  # 方式1：跟随重定向，取最终 URL 的最后一段作为 tag
-  effective_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' -L "$latest_url" 2>/dev/null || true)
+  effective_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' -L "$(maybe_proxy_url "$latest_url")" 2>/dev/null || true)
   tag="${effective_url##*/}"
   if [[ -n "$tag" && "$tag" != "latest" ]]; then
     echo "$tag"
     return 0
   fi
 
-  # CN 环境下可尝试通过镜像访问（不影响非 CN）
-  if [ "$COUNTRY" = "CN" ]; then
-    effective_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' -L "$(maybe_proxy_url "$latest_url")" 2>/dev/null || true)
-    tag="${effective_url##*/}"
-    if [[ -n "$tag" && "$tag" != "latest" ]]; then
-      echo "$tag"
-      return 0
-    fi
-  fi
-
-  # 方式2：GitHub API（无需 jq）
-  api_tag=$(curl -fsSL "$api_url" 2>/dev/null | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' || true)
+  api_tag=$(curl -fsSL "$(maybe_proxy_url "$api_url")" 2>/dev/null | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' || true)
   if [[ -n "$api_tag" ]]; then
     echo "$api_tag"
     return 0
   fi
 
-  if [ "$COUNTRY" = "CN" ]; then
-    api_tag=$(curl -fsSL "$(maybe_proxy_url "$api_url")" 2>/dev/null | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' || true)
-    if [[ -n "$api_tag" ]]; then
-      echo "$api_tag"
-      return 0
-    fi
-  fi
-
   return 1
 }
 
@@ -85,6 +62,10 @@ resolve_version() {
     echo "$FLUX_VERSION"
     return 0
   fi
+  if [[ -n "${PINNED_VERSION:-}" ]]; then
+    echo "$PINNED_VERSION"
+    return 0
+  fi
 
   if resolve_latest_release_tag; then
     return 0

panel_install.sh

@@ -10,15 +10,13 @@ export LC_ALL=C
 # GitHub repo used for release downloads
 REPO="Sagit-chu/flux-panel"
 
-COUNTRY=$(curl -s https://ipinfo.io/country)
+# 固定版本号（Release 构建时自动填充，留空则获取最新版）
+PINNED_VERSION=""
 
+# 镜像加速（所有下载均经过镜像源，以支持 IPv6）
 maybe_proxy_url() {
   local url="$1"
-  if [ "$COUNTRY" = "CN" ]; then
-    echo "https://gcode.hostcentral.cc/${url}"
-  else
-    echo "$url"
-  fi
+  echo "https://gcode.hostcentral.cc/${url}"
 }
 
 resolve_latest_release_tag() {
@@ -27,36 +25,19 @@ resolve_latest_release_tag() {
   latest_url="https://github.com/${REPO}/releases/latest"
   api_url="https://api.github.com/repos/${REPO}/releases/latest"
 
-  effective_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' -L "$latest_url" 2>/dev/null || true)
+  effective_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' -L "$(maybe_proxy_url "$latest_url")" 2>/dev/null || true)
   tag="${effective_url##*/}"
   if [[ -n "$tag" && "$tag" != "latest" ]]; then
     echo "$tag"
     return 0
   fi
 
-  if [ "$COUNTRY" = "CN" ]; then
-    effective_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' -L "$(maybe_proxy_url "$latest_url")" 2>/dev/null || true)
-    tag="${effective_url##*/}"
-    if [[ -n "$tag" && "$tag" != "latest" ]]; then
-      echo "$tag"
-      return 0
-    fi
-  fi
-
-  api_tag=$(curl -fsSL "$api_url" 2>/dev/null | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' || true)
+  api_tag=$(curl -fsSL "$(maybe_proxy_url "$api_url")" 2>/dev/null | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' || true)
   if [[ -n "$api_tag" ]]; then
     echo "$api_tag"
     return 0
   fi
 
-  if [ "$COUNTRY" = "CN" ]; then
-    api_tag=$(curl -fsSL "$(maybe_proxy_url "$api_url")" 2>/dev/null | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' || true)
-    if [[ -n "$api_tag" ]]; then
-      echo "$api_tag"
-      return 0
-    fi
-  fi
-
   return 1
 }
 
@@ -69,6 +50,10 @@ resolve_version() {
     echo "$FLUX_VERSION"
     return 0
   fi
+  if [[ -n "${PINNED_VERSION:-}" ]]; then
+    echo "$PINNED_VERSION"
+    return 0
+  fi
 
   if resolve_latest_release_tag; then
     return 0

vite-frontend/nginx.conf

@@ -87,6 +87,8 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
             
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -94,4 +96,4 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
     }
-} 
+} 

vite-frontend/src/api/index.ts

@@ -41,6 +41,14 @@ export const checkNodeStatus = (nodeId?: number) => {
   return Network.post("/node/check-status", params);
 };
 
+export const upgradeNode = (id: number, version?: string) =>
+  Network.post("/node/upgrade", { id, version: version || "" }, { timeout: 5 * 60 * 1000 });
+export const batchUpgradeNodes = (ids: number[], version?: string) =>
+  Network.post("/node/batch-upgrade", { ids, version: version || "" }, { timeout: 15 * 60 * 1000 });
+export const getNodeReleases = () => Network.post("/node/releases");
+export const rollbackNode = (id: number) =>
+  Network.post("/node/rollback", { id });
+
 // 隧道CRUD操作 - 全部使用POST请求
 export const createTunnel = (data: any) => Network.post("/tunnel/create", data);
 export const getTunnelList = () => Network.post("/tunnel/list");
@@ -200,8 +208,22 @@ export const createPeerShare = (data: {
   allowedDomains?: string;
   allowedIps?: string;
 }) => Network.post("/federation/share/create", data);
+export const updatePeerShare = (data: {
+  id: number;
+  name: string;
+  maxBandwidth: number;
+  expiryTime: number;
+  portRangeStart: number;
+  portRangeEnd: number;
+  allowedDomains: string;
+  allowedIps: string;
+}) => Network.post("/federation/share/update", data);
 export const deletePeerShare = (id: number) =>
   Network.post("/federation/share/delete", { id });
+export const resetPeerShareFlow = (id: number) =>
+  Network.post("/federation/share/reset-flow", { id });
+export const getPeerRemoteUsageList = () =>
+  Network.post("/federation/share/remote-usage/list");
 export const importRemoteNode = (data: {
   remoteUrl: string;
   token: string;

vite-frontend/src/api/network.ts

@@ -43,6 +43,10 @@ interface ApiResponse<T = any> {
   data: T;
 }
 
+interface RequestOptions {
+  timeout?: number;
+}
+
 // 处理token失效的逻辑
 function handleTokenExpired() {
   // 清除localStorage中的token
@@ -71,6 +75,7 @@ const Network = {
   get: function <T = any>(
     path: string = "",
     data: any = {},
+    options: RequestOptions = {},
   ): Promise<ApiResponse<T>> {
     return new Promise(function (resolve) {
       // 如果baseURL是默认值且是WebView环境，说明没有设置面板地址
@@ -83,7 +88,7 @@ const Network = {
       axios
         .get(path, {
           params: data,
-          timeout: 30000,
+          timeout: options.timeout ?? 30000,
           headers: {
             Authorization: window.localStorage.getItem("token"),
           },
@@ -117,6 +122,7 @@ const Network = {
   post: function <T = any>(
     path: string = "",
     data: any = {},
+    options: RequestOptions = {},
   ): Promise<ApiResponse<T>> {
     return new Promise(function (resolve) {
       // 如果baseURL是默认值且是WebView环境，说明没有设置面板地址
@@ -128,7 +134,7 @@ const Network = {
 
       axios
         .post(path, data, {
-          timeout: 30000,
+          timeout: options.timeout ?? 30000,
           headers: {
             Authorization: window.localStorage.getItem("token"),
             "Content-Type": "application/json",

vite-frontend/src/pages/node.tsx

@@ -16,6 +16,7 @@ import { Spinner } from "@heroui/spinner";
 import { Alert } from "@heroui/alert";
 import { Progress } from "@heroui/progress";
 import { Accordion, AccordionItem } from "@heroui/accordion";
+import { Select, SelectItem } from "@heroui/select";
 import { Checkbox } from "@heroui/checkbox";
 import toast from "react-hot-toast";
 import axios from "axios";
@@ -45,6 +46,10 @@ import {
   getNodeInstallCommand,
   updateNodeOrder,
   batchDeleteNodes,
+  upgradeNode,
+  batchUpgradeNodes,
+  getNodeReleases,
+  rollbackNode,
 } from "@/api";
 
 interface Node {
@@ -65,6 +70,7 @@ interface Node {
   status: number;
   isRemote?: number;
   remoteUrl?: string;
+  syncError?: string;
   connectionStatus: "online" | "offline";
   systemInfo?: {
     cpuUsage: number;
@@ -76,6 +82,8 @@ interface Node {
     uptime: number;
   } | null;
   copyLoading?: boolean;
+  upgradeLoading?: boolean;
+  rollbackLoading?: boolean;
 }
 
 interface NodeForm {
@@ -117,7 +125,7 @@ const SortableItem = ({
   };
 
   return (
-    <div ref={setNodeRef} style={style} {...attributes}>
+    <div ref={setNodeRef} style={style} {...attributes} className="overflow-hidden">
       {children(listeners)}
     </div>
   );
@@ -164,6 +172,16 @@ export default function NodePage() {
   const [installCommand, setInstallCommand] = useState("");
   const [currentNodeName, setCurrentNodeName] = useState("");
 
+  // 升级相关状态
+  const [upgradeModalOpen, setUpgradeModalOpen] = useState(false);
+  const [upgradeTarget, setUpgradeTarget] = useState<"single" | "batch">("single");
+  const [upgradeTargetNodeId, setUpgradeTargetNodeId] = useState<number | null>(null);
+  const [releases, setReleases] = useState<Array<{ version: string; name: string; publishedAt: string; prerelease: boolean }>>([]);
+  const [releasesLoading, setReleasesLoading] = useState(false);
+  const [selectedVersion, setSelectedVersion] = useState("");
+  const [batchUpgradeLoading, setBatchUpgradeLoading] = useState(false);
+  const [upgradeProgress, setUpgradeProgress] = useState<Record<number, { stage: string; percent: number; message: string }>>({});
+
   const websocketRef = useRef<WebSocket | null>(null);
   const reconnectTimerRef = useRef<NodeJS.Timeout | null>(null);
   const reconnectAttemptsRef = useRef(0);
@@ -219,7 +237,8 @@ export default function NodePage() {
         const nodesData: Node[] = (res.data || []).map((node: any) => ({
           ...node,
           inx: node.inx ?? 0,
-          connectionStatus: node.status === 1 ? "online" : "offline",
+          connectionStatus: node.syncError ? "offline" : node.status === 1 ? "online" : "offline",
+          syncError: node.syncError || undefined,
           systemInfo: null,
           copyLoading: false,
         }));
@@ -423,6 +442,22 @@ export default function NodePage() {
           return node;
         }),
       );
+    } else if (type === "upgrade_progress") {
+      try {
+        const progressData = typeof messageData === "string" ? JSON.parse(messageData) : messageData;
+        if (progressData?.data) {
+          setUpgradeProgress((prev) => ({
+            ...prev,
+            [nodeId]: {
+              stage: progressData.data.stage || "",
+              percent: progressData.data.percent || 0,
+              message: progressData.message || "",
+            },
+          }));
+        }
+      } catch {
+        // ignore parse errors
+      }
     }
   };
 
@@ -768,6 +803,93 @@ export default function NodePage() {
     }
   };
 
+
+
+  // 打开版本选择弹窗
+  const openUpgradeModal = async (target: "single" | "batch", nodeId?: number) => {
+    setUpgradeTarget(target);
+    setUpgradeTargetNodeId(nodeId || null);
+    setSelectedVersion("");
+    setUpgradeModalOpen(true);
+    setReleasesLoading(true);
+    try {
+      const res = await getNodeReleases();
+      if (res.code === 0 && Array.isArray(res.data)) {
+        setReleases(res.data);
+      } else {
+        toast.error(res.msg || "获取版本列表失败");
+      }
+    } catch {
+      toast.error("获取版本列表失败");
+    } finally {
+      setReleasesLoading(false);
+    }
+  };
+
+  // 确认升级（从版本弹窗）
+  const handleConfirmUpgrade = async () => {
+    const version = selectedVersion || undefined;
+    if (upgradeTarget === "single" && upgradeTargetNodeId) {
+      setUpgradeModalOpen(false);
+      // Find the node
+      const node = nodeList.find((n) => n.id === upgradeTargetNodeId);
+      if (!node) return;
+      setNodeList((prev) =>
+        prev.map((n) => (n.id === upgradeTargetNodeId ? { ...n, upgradeLoading: true } : n)),
+      );
+      try {
+        const res = await upgradeNode(upgradeTargetNodeId, version);
+        if (res.code === 0) {
+          toast.success(`节点升级命令已发送，节点将自动重启`);
+        } else {
+          toast.error(res.msg || "升级失败");
+        }
+      } catch {
+        toast.error("网络错误，请重试");
+      } finally {
+        setNodeList((prev) =>
+          prev.map((n) => (n.id === upgradeTargetNodeId ? { ...n, upgradeLoading: false } : n)),
+        );
+      }
+    } else if (upgradeTarget === "batch") {
+      setBatchUpgradeLoading(true);
+      setUpgradeModalOpen(false);
+      try {
+        const res = await batchUpgradeNodes(Array.from(selectedIds), version);
+        if (res.code === 0) {
+          toast.success(`批量升级命令已发送到 ${selectedIds.size} 个节点`);
+        } else {
+          toast.error(res.msg || "批量升级失败");
+        }
+      } catch {
+        toast.error("网络错误，请重试");
+      } finally {
+        setBatchUpgradeLoading(false);
+      }
+    }
+  };
+
+  // 回退节点
+  const handleRollbackNode = async (node: Node) => {
+    setNodeList((prev) =>
+      prev.map((n) => (n.id === node.id ? { ...n, rollbackLoading: true } : n)),
+    );
+    try {
+      const res = await rollbackNode(node.id);
+      if (res.code === 0) {
+        toast.success(`节点 ${node.name} 回退命令已发送，节点将自动重启`);
+      } else {
+        toast.error(res.msg || "回退失败");
+      }
+    } catch {
+      toast.error("网络错误，请重试");
+    } finally {
+      setNodeList((prev) =>
+        prev.map((n) => (n.id === node.id ? { ...n, rollbackLoading: false } : n)),
+      );
+    }
+  };
+
   // 提交表单
   const handleSubmit = async () => {
     if (!validateForm()) return;
@@ -1046,6 +1168,15 @@ export default function NodePage() {
             <Button size="sm" variant="flat" onPress={deselectAll}>
               清空
             </Button>
+            <Button
+              color="warning"
+              isLoading={batchUpgradeLoading}
+              size="sm"
+              variant="flat"
+              onPress={() => openUpgradeModal("batch")}
+            >
+              升级
+            </Button>
             <Button
               color="danger"
               size="sm"
@@ -1114,12 +1245,15 @@ export default function NodePage() {
             strategy={rectSortingStrategy}
           >
             <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4 2xl:grid-cols-5 gap-4">
-              {sortedNodes.map((node) => (
-                <SortableItem key={node.id} id={node.id}>
-                  {(listeners) => (
+              {sortedNodes.map((node) => {
+                const isRemoteNode = node.isRemote === 1;
+
+                return (
+                  <SortableItem key={node.id} id={node.id}>
+                    {(listeners) => (
                     <Card
                       key={node.id}
-                      className="group shadow-sm border border-divider hover:shadow-md transition-shadow duration-200"
+                      className="group shadow-sm border border-divider hover:shadow-md transition-shadow duration-200 overflow-hidden"
                     >
                       <CardHeader className="pb-2">
                         <div className="flex justify-between items-start w-full">
@@ -1135,16 +1269,6 @@ export default function NodePage() {
                             </h3>
                           </div>
                           <div className="flex items-center gap-1.5 ml-2">
-                            {node.isRemote === 1 && (
-                              <Chip
-                                className="text-xs"
-                                color="secondary"
-                                size="sm"
-                                variant="flat"
-                              >
-                                远程
-                              </Chip>
-                            )}
                             <div
                               className="cursor-grab active:cursor-grabbing p-2 text-default-400 hover:text-default-600 transition-colors touch-manipulation opacity-100 sm:opacity-0 sm:group-hover:opacity-100"
                               {...listeners}
@@ -1159,6 +1283,16 @@ export default function NodePage() {
                                 <path d="M7 2a2 2 0 1 1 .001 4.001A2 2 0 0 1 7 2zm0 6a2 2 0 1 1 .001 4.001A2 2 0 0 1 7 8zm0 6a2 2 0 1 1 .001 4.001A2 2 0 0 1 7 14zm6-8a2 2 0 1 1-.001-4.001A2 2 0 0 1 13 6zm0 2a2 2 0 1 1 .001 4.001A2 2 0 0 1 13 8zm0 6a2 2 0 1 1 .001 4.001A2 2 0 0 1 13 14z" />
                               </svg>
                             </div>
+                            {isRemoteNode && (
+                              <Chip
+                                className="text-xs"
+                                color="secondary"
+                                size="sm"
+                                variant="flat"
+                              >
+                                远程
+                              </Chip>
+                            )}
                             <Chip
                               className="text-xs"
                               color={
@@ -1178,6 +1312,17 @@ export default function NodePage() {
                       </CardHeader>
 
                       <CardBody className="pt-0 pb-3">
+                        {isRemoteNode && node.syncError && (
+                          <div className="mb-3 px-2 py-1.5 rounded-md bg-warning-50 dark:bg-warning-100/10 text-warning-700 dark:text-warning-400 text-xs">
+                            {node.syncError === "provider_share_deleted"
+                              ? "提供方已删除该分享"
+                              : node.syncError === "provider_share_disabled"
+                                ? "提供方已禁用该分享"
+                                : node.syncError === "provider_share_expired"
+                                  ? "提供方分享已过期"
+                                  : `远程同步失败: ${node.syncError}`}
+                          </div>
+                        )}
                         {/* 基础信息 */}
                         <div className="space-y-2 mb-4">
                           <div className="flex justify-between items-center text-sm min-w-0">
@@ -1215,164 +1360,210 @@ export default function NodePage() {
                               )}
                             </div>
                           </div>
-                          <div className="flex justify-between text-sm">
-                            <span className="text-default-600">版本</span>
-                            <span className="text-xs">
-                              {node.version || "未知"}
-                            </span>
-                          </div>
-                          <div className="flex justify-between text-sm">
-                            <span className="text-default-600">开机时间</span>
-                            <span className="text-xs">
-                              {node.connectionStatus === "online" &&
-                              node.systemInfo
-                                ? formatUptime(node.systemInfo.uptime)
-                                : "-"}
-                            </span>
-                          </div>
-                        </div>
-
-                        {/* 系统监控 */}
-                        <div className="space-y-3 mb-4">
-                          <div className="grid grid-cols-2 gap-3">
-                            <div>
-                              <div className="flex justify-between text-xs mb-1">
-                                <span>CPU</span>
-                                <span className="font-mono">
+                          {!isRemoteNode && (
+                            <>
+                              <div className="flex justify-between text-sm">
+                                <span className="text-default-600">版本</span>
+                                <span className="text-xs">
+                                  {node.version || "未知"}
+                                </span>
+                              </div>
+                              {upgradeProgress[node.id] && upgradeProgress[node.id].percent < 100 && (
+                                <div className="mt-1">
+                                  <Progress
+                                    aria-label="升级进度"
+                                    color="warning"
+                                    label={upgradeProgress[node.id].message}
+                                    showValueLabel
+                                    size="sm"
+                                    value={upgradeProgress[node.id].percent}
+                                  />
+                                </div>
+                              )}
+                              <div className="flex justify-between text-sm">
+                                <span className="text-default-600">开机时间</span>
+                                <span className="text-xs">
                                   {node.connectionStatus === "online" &&
                                   node.systemInfo
-                                    ? `${node.systemInfo.cpuUsage.toFixed(1)}%`
+                                    ? formatUptime(node.systemInfo.uptime)
                                     : "-"}
                                 </span>
                               </div>
-                              <Progress
-                                aria-label="CPU使用率"
-                                color={getProgressColor(
-                                  node.connectionStatus === "online" &&
-                                    node.systemInfo
-                                    ? node.systemInfo.cpuUsage
-                                    : 0,
-                                  node.connectionStatus !== "online",
-                                )}
-                                size="sm"
-                                value={
-                                  node.connectionStatus === "online" &&
-                                  node.systemInfo
-                                    ? node.systemInfo.cpuUsage
-                                    : 0
-                                }
-                              />
-                            </div>
-                            <div>
-                              <div className="flex justify-between text-xs mb-1">
-                                <span>内存</span>
-                                <span className="font-mono">
-                                  {node.connectionStatus === "online" &&
-                                  node.systemInfo
-                                    ? `${node.systemInfo.memoryUsage.toFixed(1)}%`
-                                    : "-"}
-                                </span>
-                              </div>
-                              <Progress
-                                aria-label="内存使用率"
-                                color={getProgressColor(
-                                  node.connectionStatus === "online" &&
-                                    node.systemInfo
-                                    ? node.systemInfo.memoryUsage
-                                    : 0,
-                                  node.connectionStatus !== "online",
-                                )}
-                                size="sm"
-                                value={
-                                  node.connectionStatus === "online" &&
-                                  node.systemInfo
-                                    ? node.systemInfo.memoryUsage
-                                    : 0
-                                }
-                              />
-                            </div>
-                          </div>
-
-                          <div className="grid grid-cols-2 gap-2 text-xs">
-                            <div className="text-center p-2 bg-default-50 dark:bg-default-100 rounded">
-                              <div className="text-default-600 mb-0.5">
-                                上传
-                              </div>
-                              <div className="font-mono">
-                                {node.connectionStatus === "online" &&
-                                node.systemInfo
-                                  ? formatSpeed(node.systemInfo.uploadSpeed)
-                                  : "-"}
-                              </div>
-                            </div>
-                            <div className="text-center p-2 bg-default-50 dark:bg-default-100 rounded">
-                              <div className="text-default-600 mb-0.5">
-                                下载
-                              </div>
-                              <div className="font-mono">
-                                {node.connectionStatus === "online" &&
-                                node.systemInfo
-                                  ? formatSpeed(node.systemInfo.downloadSpeed)
-                                  : "-"}
-                              </div>
-                            </div>
-                          </div>
-
-                          {/* 流量统计 */}
-                          <div className="grid grid-cols-2 gap-2 text-xs">
-                            <div className="text-center p-2 bg-primary-50 dark:bg-primary-100/20 rounded border border-primary-200 dark:border-primary-300/20">
-                              <div className="text-primary-600 dark:text-primary-400 mb-0.5">
-                                ↑ 上行流量
-                              </div>
-                              <div className="font-mono text-primary-700 dark:text-primary-300">
-                                {node.connectionStatus === "online" &&
-                                node.systemInfo
-                                  ? formatTraffic(node.systemInfo.uploadTraffic)
-                                  : "-"}
-                              </div>
-                            </div>
-                            <div className="text-center p-2 bg-success-50 dark:bg-success-100/20 rounded border border-success-200 dark:border-success-300/20">
-                              <div className="text-success-600 dark:text-success-400 mb-0.5">
-                                ↓ 下行流量
-                              </div>
-                              <div className="font-mono text-success-700 dark:text-success-300">
-                                {node.connectionStatus === "online" &&
-                                node.systemInfo
-                                  ? formatTraffic(
-                                      node.systemInfo.downloadTraffic,
-                                    )
-                                  : "-"}
-                              </div>
-                            </div>
-                          </div>
+                            </>
+                          )}
                         </div>
 
+                        {!isRemoteNode && (
+                          <>
+                            {/* 系统监控 */}
+                            <div className="space-y-3 mb-4">
+                              <div className="grid grid-cols-2 gap-3">
+                                <div>
+                                  <div className="flex justify-between text-xs mb-1">
+                                    <span>CPU</span>
+                                    <span className="font-mono">
+                                      {node.connectionStatus === "online" &&
+                                      node.systemInfo
+                                        ? `${node.systemInfo.cpuUsage.toFixed(1)}%`
+                                        : "-"}
+                                    </span>
+                                  </div>
+                                  <Progress
+                                    aria-label="CPU使用率"
+                                    color={getProgressColor(
+                                      node.connectionStatus === "online" &&
+                                        node.systemInfo
+                                        ? node.systemInfo.cpuUsage
+                                        : 0,
+                                      node.connectionStatus !== "online",
+                                    )}
+                                    size="sm"
+                                    value={
+                                      node.connectionStatus === "online" &&
+                                      node.systemInfo
+                                        ? node.systemInfo.cpuUsage
+                                        : 0
+                                    }
+                                  />
+                                </div>
+                                <div>
+                                  <div className="flex justify-between text-xs mb-1">
+                                    <span>内存</span>
+                                    <span className="font-mono">
+                                      {node.connectionStatus === "online" &&
+                                      node.systemInfo
+                                        ? `${node.systemInfo.memoryUsage.toFixed(1)}%`
+                                        : "-"}
+                                    </span>
+                                  </div>
+                                  <Progress
+                                    aria-label="内存使用率"
+                                    color={getProgressColor(
+                                      node.connectionStatus === "online" &&
+                                        node.systemInfo
+                                        ? node.systemInfo.memoryUsage
+                                        : 0,
+                                      node.connectionStatus !== "online",
+                                    )}
+                                    size="sm"
+                                    value={
+                                      node.connectionStatus === "online" &&
+                                      node.systemInfo
+                                        ? node.systemInfo.memoryUsage
+                                        : 0
+                                    }
+                                  />
+                                </div>
+                              </div>
+
+                              <div className="grid grid-cols-2 gap-2 text-xs">
+                                <div className="text-center p-2 bg-default-50 dark:bg-default-100 rounded">
+                                  <div className="text-default-600 mb-0.5">
+                                    上传
+                                  </div>
+                                  <div className="font-mono">
+                                    {node.connectionStatus === "online" &&
+                                    node.systemInfo
+                                      ? formatSpeed(node.systemInfo.uploadSpeed)
+                                      : "-"}
+                                  </div>
+                                </div>
+                                <div className="text-center p-2 bg-default-50 dark:bg-default-100 rounded">
+                                  <div className="text-default-600 mb-0.5">
+                                    下载
+                                  </div>
+                                  <div className="font-mono">
+                                    {node.connectionStatus === "online" &&
+                                    node.systemInfo
+                                      ? formatSpeed(node.systemInfo.downloadSpeed)
+                                      : "-"}
+                                  </div>
+                                </div>
+                              </div>
+
+                              {/* 流量统计 */}
+                              <div className="grid grid-cols-2 gap-2 text-xs">
+                                <div className="text-center p-2 bg-primary-50 dark:bg-primary-100/20 rounded border border-primary-200 dark:border-primary-300/20">
+                                  <div className="text-primary-600 dark:text-primary-400 mb-0.5">
+                                    ↑ 上行流量
+                                  </div>
+                                  <div className="font-mono text-primary-700 dark:text-primary-300">
+                                    {node.connectionStatus === "online" &&
+                                    node.systemInfo
+                                      ? formatTraffic(node.systemInfo.uploadTraffic)
+                                      : "-"}
+                                  </div>
+                                </div>
+                                <div className="text-center p-2 bg-success-50 dark:bg-success-100/20 rounded border border-success-200 dark:border-success-300/20">
+                                  <div className="text-success-600 dark:text-success-400 mb-0.5">
+                                    ↓ 下行流量
+                                  </div>
+                                  <div className="font-mono text-success-700 dark:text-success-300">
+                                    {node.connectionStatus === "online" &&
+                                    node.systemInfo
+                                      ? formatTraffic(
+                                          node.systemInfo.downloadTraffic,
+                                        )
+                                      : "-"}
+                                  </div>
+                                </div>
+                              </div>
+                            </div>
+                          </>
+                        )}
+
                         {/* 操作按钮 */}
                         <div className="space-y-1.5">
-                          <div className="flex gap-1.5">
+                          {!isRemoteNode && (
+                            <div className="grid grid-cols-3 gap-1.5">
+                              <Button
+                                className="min-h-8"
+                                color="success"
+                                isLoading={node.copyLoading}
+                                size="sm"
+                                variant="flat"
+                                onPress={() => handleCopyInstallCommand(node)}
+                              >
+                                安装
+                              </Button>
+                              <Button
+                                className="min-h-8"
+                                color="warning"
+                                isDisabled={node.connectionStatus !== "online"}
+                                isLoading={node.upgradeLoading}
+                                size="sm"
+                                variant="flat"
+                                onPress={() => openUpgradeModal("single", node.id)}
+                              >
+                                升级
+                              </Button>
+                              <Button
+                                className="min-h-8"
+                                color="secondary"
+                                isDisabled={node.connectionStatus !== "online"}
+                                isLoading={node.rollbackLoading}
+                                size="sm"
+                                variant="flat"
+                                onPress={() => handleRollbackNode(node)}
+                              >
+                                回退
+                              </Button>
+                            </div>
+                          )}
+                          <div className={`grid gap-1.5 ${isRemoteNode ? "grid-cols-1" : "grid-cols-2"}`}>
+                            {!isRemoteNode && (
+                              <Button
+                                className="min-h-8"
+                                color="primary"
+                                size="sm"
+                                variant="flat"
+                                onPress={() => handleEdit(node)}
+                              >
+                                编辑
+                              </Button>
+                            )}
                             <Button
-                              className="flex-1 min-h-8"
-                              color="success"
-                              isDisabled={node.isRemote === 1}
-                              isLoading={node.copyLoading}
-                              size="sm"
-                              variant="flat"
-                              onPress={() => handleCopyInstallCommand(node)}
-                            >
-                              安装
-                            </Button>
-                            <Button
-                              className="flex-1 min-h-8"
-                              color="primary"
-                              isDisabled={node.isRemote === 1}
-                              size="sm"
-                              variant="flat"
-                              onPress={() => handleEdit(node)}
-                            >
-                              编辑
-                            </Button>
-                            <Button
-                              className="flex-1 min-h-8"
+                              className="min-h-8"
                               color="danger"
                               size="sm"
                               variant="flat"
@@ -1386,7 +1577,8 @@ export default function NodePage() {
                     </Card>
                   )}
                 </SortableItem>
-              ))}
+                );
+              })}
             </div>
           </SortableContext>
         </DndContext>
@@ -1817,6 +2009,84 @@ export default function NodePage() {
         </ModalContent>
       </Modal>
 
+      {/* 版本选择升级模态框 */}
+      <Modal
+        backdrop="blur"
+        isOpen={upgradeModalOpen}
+        placement="center"
+        scrollBehavior="outside"
+        size="md"
+        onOpenChange={setUpgradeModalOpen}
+      >
+        <ModalContent>
+          {(onClose) => (
+            <>
+              <ModalHeader className="flex flex-col gap-1">
+                <h2 className="text-xl font-bold">
+                  {upgradeTarget === "batch"
+                    ? `批量升级 (${selectedIds.size} 个节点)`
+                    : "升级节点"}
+                </h2>
+              </ModalHeader>
+              <ModalBody>
+                {releasesLoading ? (
+                  <div className="flex justify-center py-8">
+                    <Spinner size="lg" />
+                  </div>
+                ) : (
+                  <div className="space-y-4">
+                    <Select
+                      label="选择版本"
+                      placeholder="留空则使用最新版本"
+                      selectedKeys={selectedVersion ? [selectedVersion] : []}
+                      onSelectionChange={(keys) => {
+                        const selected = Array.from(keys)[0] as string;
+                        setSelectedVersion(selected || "");
+                      }}
+                    >
+                      {releases.map((r) => (
+                        <SelectItem key={r.version} textValue={r.version}>
+                          <div className="flex justify-between items-center">
+                            <span>{r.version}</span>
+                            <span className="text-xs text-default-400">
+                              {r.publishedAt
+                                ? new Date(r.publishedAt).toLocaleDateString()
+                                : ""}
+                              {r.prerelease && (
+                                <Chip className="ml-1" color="warning" size="sm" variant="flat">
+                                  预览
+                                </Chip>
+                              )}
+                            </span>
+                          </div>
+                        </SelectItem>
+                      ))}
+                    </Select>
+                    <p className="text-sm text-default-500">
+                      {selectedVersion
+                        ? `将升级到版本 ${selectedVersion}`
+                        : "未选择版本，将自动使用最新稳定版"}
+                    </p>
+                  </div>
+                )}
+              </ModalBody>
+              <ModalFooter>
+                <Button variant="light" onPress={onClose}>
+                  取消
+                </Button>
+                <Button
+                  color="warning"
+                  isDisabled={releasesLoading}
+                  onPress={handleConfirmUpgrade}
+                >
+                  确认升级
+                </Button>
+              </ModalFooter>
+            </>
+          )}
+        </ModalContent>
+      </Modal>
+
       {/* 批量删除确认模态框 */}
       <Modal
         backdrop="blur"

vite-frontend/src/pages/panel-sharing.tsx

@@ -17,7 +17,10 @@ import {
   createPeerShare,
   getPeerShareList,
   deletePeerShare,
+  resetPeerShareFlow,
+  getPeerRemoteUsageList,
   importRemoteNode,
+  updatePeerShare,
 } from "@/api";
 
 interface Node {
@@ -31,22 +34,66 @@ interface PeerShare {
   name: string;
   token: string;
   maxBandwidth: number;
+  currentFlow: number;
   expiryTime: number;
   portRangeStart: number;
   portRangeEnd: number;
   isActive: number;
   allowedDomains?: string;
   allowedIps?: string;
+  usedPorts?: number[];
+  usedPortDetails?: Array<{
+    runtimeId: number;
+    port: number;
+    role: string;
+    protocol: string;
+    resourceKey: string;
+    applied: number;
+    updatedTime: number;
+  }>;
+  activeRuntimeNum?: number;
+}
+
+interface RemoteUsageBinding {
+  bindingId: number;
+  tunnelId: number;
+  tunnelName: string;
+  chainType: number;
+  hopInx: number;
+  allocatedPort: number;
+  resourceKey: string;
+  remoteBindingId: string;
+  updatedTime: number;
+}
+
+interface RemoteUsageNode {
+  nodeId: number;
+  nodeName: string;
+  remoteUrl: string;
+  shareId: number;
+  portRangeStart: number;
+  portRangeEnd: number;
+  maxBandwidth: number;
+  currentFlow: number;
+  usedPorts: number[];
+  bindings: RemoteUsageBinding[];
+  activeBindingNum: number;
+  syncError?: string;
 }
 
 export default function PanelSharingPage() {
   const [selectedTab, setSelectedTab] = useState("my-shares");
   const [shares, setShares] = useState<PeerShare[]>([]);
+  const [remoteUsageNodes, setRemoteUsageNodes] = useState<RemoteUsageNode[]>(
+    [],
+  );
   const [nodes, setNodes] = useState<Node[]>([]);
   const [loading, setLoading] = useState(false);
+  const [remoteUsageLoading, setRemoteUsageLoading] = useState(false);
 
   // Modals
   const [createShareOpen, setCreateShareOpen] = useState(false);
+  const [editShareOpen, setEditShareOpen] = useState(false);
   const [importNodeOpen, setImportNodeOpen] = useState(false);
 
   // Forms
@@ -66,6 +113,17 @@ export default function PanelSharingPage() {
     token: "",
   });
 
+  const [editForm, setEditForm] = useState({
+    id: 0,
+    name: "",
+    maxBandwidth: 0,
+    expiryTime: 0,
+    portRangeStart: 10000,
+    portRangeEnd: 20000,
+    allowedDomains: "",
+    allowedIps: "",
+  });
+
   const loadShares = useCallback(async () => {
     setLoading(true);
     try {
@@ -103,12 +161,30 @@ export default function PanelSharingPage() {
     }
   }, []);
 
+  const loadRemoteUsage = useCallback(async () => {
+    setRemoteUsageLoading(true);
+    try {
+      const res = await getPeerRemoteUsageList();
+      if (res.code === 0) {
+        setRemoteUsageNodes(res.data || []);
+      } else {
+        toast.error(res.msg || "加载远程占用端口失败");
+      }
+    } finally {
+      setRemoteUsageLoading(false);
+    }
+  }, []);
+
   useEffect(() => {
     if (selectedTab === "my-shares") {
       loadShares();
       loadNodes();
+      return;
     }
-  }, [selectedTab, loadShares, loadNodes]);
+    if (selectedTab === "remote-nodes") {
+      loadRemoteUsage();
+    }
+  }, [selectedTab, loadShares, loadNodes, loadRemoteUsage]);
 
   const handleCreateShare = async () => {
     if (!shareForm.name || !shareForm.nodeId) {
@@ -120,13 +196,17 @@ export default function PanelSharingPage() {
       toast.error("仅可选择本地节点");
       return;
     }
+    if (shareForm.maxBandwidth < 0) {
+      toast.error("流量上限不能为负数");
+      return;
+    }
     try {
       const expiryTime =
         Date.now() + shareForm.expiryDays * 24 * 60 * 60 * 1000;
       const res = await createPeerShare({
         name: shareForm.name,
         nodeId,
-        maxBandwidth: shareForm.maxBandwidth * 1024 * 1024 * 1024,
+        maxBandwidth: Math.max(0, shareForm.maxBandwidth) * 1024 * 1024 * 1024,
         expiryTime: shareForm.expiryDays === 0 ? 0 : expiryTime,
         portRangeStart: shareForm.portRangeStart,
         portRangeEnd: shareForm.portRangeEnd,
@@ -159,6 +239,66 @@ export default function PanelSharingPage() {
     }
   };
 
+  const handleResetShareFlow = async (id: number) => {
+    try {
+      const res = await resetPeerShareFlow(id);
+      if (res.code === 0) {
+        toast.success("共享流量已重置");
+        loadShares();
+      } else {
+        toast.error(res.msg || "重置流量失败");
+      }
+    } catch {
+      toast.error("网络错误");
+    }
+  };
+
+  const openEditShare = (share: PeerShare) => {
+    setEditForm({
+      id: share.id,
+      name: share.name,
+      maxBandwidth: share.maxBandwidth > 0 ? Math.round(share.maxBandwidth / (1024 * 1024 * 1024)) : 0,
+      expiryTime: share.expiryTime,
+      portRangeStart: share.portRangeStart,
+      portRangeEnd: share.portRangeEnd,
+      allowedDomains: share.allowedDomains || "",
+      allowedIps: share.allowedIps || "",
+    });
+    setEditShareOpen(true);
+  };
+
+  const handleEditShare = async () => {
+    if (!editForm.name) {
+      toast.error("名称不能为空");
+      return;
+    }
+    if (editForm.maxBandwidth < 0) {
+      toast.error("流量上限不能为负数");
+      return;
+    }
+    try {
+      const res = await updatePeerShare({
+        id: editForm.id,
+        name: editForm.name,
+        maxBandwidth: Math.max(0, editForm.maxBandwidth) * 1024 * 1024 * 1024,
+        expiryTime: editForm.expiryTime,
+        portRangeStart: editForm.portRangeStart,
+        portRangeEnd: editForm.portRangeEnd,
+        allowedDomains: editForm.allowedDomains,
+        allowedIps: editForm.allowedIps,
+      });
+      if (res.code === 0) {
+        toast.success("编辑成功");
+        setEditShareOpen(false);
+        loadShares();
+      } else {
+        toast.error(res.msg || "编辑失败");
+      }
+    } catch {
+      toast.error("网络错误");
+    }
+  };
+
   const handleImportNode = async () => {
     if (!importForm.remoteUrl || !importForm.token) {
       toast.error("请填写完整信息");
@@ -179,6 +319,7 @@ export default function PanelSharingPage() {
         toast.success("导入成功，请前往节点列表查看");
         setImportNodeOpen(false);
         setImportForm({ remoteUrl: "", token: "" });
+        loadRemoteUsage();
       } else {
         toast.error(res.msg || "导入失败");
       }
@@ -192,6 +333,27 @@ export default function PanelSharingPage() {
     toast.success("Token已复制");
   };
 
+  const formatFlowGB = (bytes: number) => {
+    if (!Number.isFinite(bytes) || bytes <= 0) {
+      return "0 B";
+    }
+    if (bytes < 1024) return bytes + " B";
+    if (bytes < 1024 * 1024) return (bytes / 1024).toFixed(2) + " KB";
+    if (bytes < 1024 * 1024 * 1024)
+      return (bytes / (1024 * 1024)).toFixed(2) + " MB";
+    return (bytes / (1024 * 1024 * 1024)).toFixed(2) + " GB";
+  };
+
+  const formatChainType = (chainType: number, hopInx: number) => {
+    if (chainType === 2) {
+      return `中继跳点 #${hopInx}`;
+    }
+    if (chainType === 3) {
+      return "出口节点";
+    }
+    return "未知链路";
+  };
+
   return (
     <div className="p-4 md:p-6 space-y-6">
       <div className="flex justify-between items-center">
@@ -199,6 +361,7 @@ export default function PanelSharingPage() {
       </div>
 
       <Tabs
+        disableCursorAnimation
         aria-label="Options"
         selectedKey={selectedTab}
         onSelectionChange={(k) => setSelectedTab(k as string)}
@@ -222,10 +385,38 @@ export default function PanelSharingPage() {
                     <Card key={share.id} className="border border-divider shadow-sm">
                       <CardHeader className="flex justify-between">
                         <h3 className="font-bold">{share.name}</h3>
-                        <Button size="sm" color="danger" variant="flat" onPress={() => handleDeleteShare(share.id)}>删除</Button>
+                        <div className="flex gap-2">
+                          <Button
+                            size="sm"
+                            variant="flat"
+                            onPress={() => openEditShare(share)}
+                          >
+                            编辑
+                          </Button>
+                          <Button
+                            size="sm"
+                            variant="flat"
+                            onPress={() => handleResetShareFlow(share.id)}
+                          >
+                            重置流量
+                          </Button>
+                          <Button size="sm" color="danger" variant="flat" onPress={() => handleDeleteShare(share.id)}>删除</Button>
+                        </div>
                       </CardHeader>
                       <CardBody className="text-sm space-y-2">
                         <p>端口范围: {share.portRangeStart} - {share.portRangeEnd}</p>
+                        <p>流量上限: {share.maxBandwidth > 0 ? formatFlowGB(share.maxBandwidth) : "不限制"}</p>
+                        <p>当前流量: {formatFlowGB(share.currentFlow || 0)}</p>
+                        <p>远程占用端口: {share.usedPorts && share.usedPorts.length > 0 ? share.usedPorts.join(", ") : "暂无"}</p>
+                        {share.usedPortDetails && share.usedPortDetails.length > 0 && (
+                          <div className="flex flex-wrap gap-2">
+                            {share.usedPortDetails.map((item) => (
+                              <span key={item.runtimeId} className="text-xs rounded-full px-2 py-1 bg-default-100">
+                                {item.port} / {item.role || "reserved"}
+                              </span>
+                            ))}
+                          </div>
+                        )}
                         {share.allowedDomains && <p>允许域名: {share.allowedDomains}</p>}
                         {share.allowedIps && <p>允许API IP: {share.allowedIps}</p>}
                         <p>过期时间: {share.expiryTime === 0 ? "永久" : new Date(share.expiryTime).toLocaleDateString()}</p>
@@ -249,10 +440,57 @@ export default function PanelSharingPage() {
                   导入远程节点
                 </Button>
               </div>
-              <div className="text-center py-10 text-gray-500">
-                <p>已导入的节点将显示在“节点管理”页面，带有“远程”标记。</p>
-                <p className="mt-2">请使用其创建隧道。</p>
-              </div>
+
+              {remoteUsageLoading ? (
+                <div className="text-center py-10 text-gray-500">加载中...</div>
+              ) : remoteUsageNodes.length === 0 ? (
+                <div className="text-center py-10 text-gray-500">
+                  <p>暂无远程节点占用记录。</p>
+                  <p className="mt-2">导入远程节点并创建隧道后，这里会显示远端端口占用情况。</p>
+                </div>
+              ) : (
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                  {remoteUsageNodes.map((node) => (
+                    <Card key={node.nodeId} className="border border-divider shadow-sm">
+                      <CardHeader className="flex justify-between">
+                        <h3 className="font-bold">{node.nodeName}</h3>
+                        <span className="text-xs text-default-500">绑定 {node.activeBindingNum || 0}</span>
+                      </CardHeader>
+                      <CardBody className="text-sm space-y-2">
+                        {node.syncError && (
+                          <div className="px-2 py-1.5 rounded-md bg-warning-50 dark:bg-warning-100/10 text-warning-700 dark:text-warning-400 text-xs">
+                            {node.syncError === "provider_share_deleted"
+                              ? "提供方已删除该分享"
+                              : node.syncError === "provider_share_disabled"
+                                ? "提供方已禁用该分享"
+                                : node.syncError === "provider_share_expired"
+                                  ? "提供方分享已过期"
+                                  : `远程同步失败: ${node.syncError}`}
+                          </div>
+                        )}
+                        {node.remoteUrl && <p>远程地址: {node.remoteUrl}</p>}
+                        <p>共享ID: {node.shareId || "-"}</p>
+                        <p>端口范围: {node.portRangeStart > 0 && node.portRangeEnd > 0 ? `${node.portRangeStart} - ${node.portRangeEnd}` : "-"}</p>
+                        <p>共享流量: {node.maxBandwidth > 0 ? `${formatFlowGB(node.currentFlow || 0)} / ${formatFlowGB(node.maxBandwidth)}` : `${formatFlowGB(node.currentFlow || 0)} / 不限制`}</p>
+                        <p>远端占用端口: {node.usedPorts && node.usedPorts.length > 0 ? node.usedPorts.join(", ") : "暂无"}</p>
+                        {node.bindings && node.bindings.length > 0 && (
+                          <div className="space-y-1 pt-1">
+                            {node.bindings.map((binding) => (
+                              <p key={binding.bindingId} className="text-xs text-default-600">
+                                隧道 {binding.tunnelName || `#${binding.tunnelId}`}
+                                {" · "}
+                                端口 {binding.allocatedPort}
+                                {" · "}
+                                {formatChainType(binding.chainType, binding.hopInx)}
+                              </p>
+                            ))}
+                          </div>
+                        )}
+                      </CardBody>
+                    </Card>
+                  ))}
+                </div>
+              )}
             </CardBody>
           </Card>
         </Tab>
@@ -302,6 +540,13 @@ export default function PanelSharingPage() {
               value={shareForm.expiryDays.toString()}
               onChange={(e) => setShareForm({ ...shareForm, expiryDays: parseInt(e.target.value) })}
             />
+            <Input
+              label="流量上限 (GB)"
+              type="number"
+              description="0 表示不限流量"
+              value={shareForm.maxBandwidth.toString()}
+              onChange={(e) => setShareForm({ ...shareForm, maxBandwidth: parseInt(e.target.value, 10) || 0 })}
+            />
             <Input
               label="允许的域名 (可选)"
               placeholder="example.com, panel.test.com"
@@ -324,6 +569,67 @@ export default function PanelSharingPage() {
         </ModalContent>
       </Modal>
 
+      {/* Edit Share Modal */}
+      <Modal isOpen={editShareOpen} onClose={() => setEditShareOpen(false)}>
+        <ModalContent>
+          <ModalHeader>编辑分享</ModalHeader>
+          <ModalBody>
+            <Input
+              label="名称"
+              placeholder="备注名称"
+              value={editForm.name}
+              onChange={(e) => setEditForm({ ...editForm, name: e.target.value })}
+            />
+            <div className="flex gap-4">
+              <Input
+                label="起始端口"
+                type="number"
+                value={editForm.portRangeStart.toString()}
+                onChange={(e) => setEditForm({ ...editForm, portRangeStart: parseInt(e.target.value) || 0 })}
+              />
+              <Input
+                label="结束端口"
+                type="number"
+                value={editForm.portRangeEnd.toString()}
+                onChange={(e) => setEditForm({ ...editForm, portRangeEnd: parseInt(e.target.value) || 0 })}
+              />
+            </div>
+            <Input
+              label="流量上限 (GB)"
+              type="number"
+              description="0 表示不限流量"
+              value={editForm.maxBandwidth.toString()}
+              onChange={(e) => setEditForm({ ...editForm, maxBandwidth: parseInt(e.target.value, 10) || 0 })}
+            />
+            <Input
+              label="过期时间"
+              type="datetime-local"
+              description="留空或清除表示永久有效"
+              value={editForm.expiryTime > 0 ? new Date(editForm.expiryTime).toISOString().slice(0, 16) : ""}
+              onChange={(e) => setEditForm({ ...editForm, expiryTime: e.target.value ? new Date(e.target.value).getTime() : 0 })}
+            />
+            <Input
+              label="允许的域名 (可选)"
+              placeholder="example.com, panel.test.com"
+              description="限制使用此Token的来源面板域名，多个域名用逗号分隔，留空不限制"
+              value={editForm.allowedDomains}
+              onChange={(e) => setEditForm({ ...editForm, allowedDomains: e.target.value })}
+            />
+            <Input
+              label="允许的API IP (可选)"
+              placeholder="203.0.113.10, 2001:db8::10, 198.51.100.0/24"
+              description="仅白名单IP可导入此分享，支持IPv4/IPv6/CIDR，多个用逗号分隔"
+              value={editForm.allowedIps}
+              onChange={(e) => setEditForm({ ...editForm, allowedIps: e.target.value })}
+            />
+          </ModalBody>
+          <ModalFooter>
+            <Button onPress={() => setEditShareOpen(false)}>取消</Button>
+            <Button color="primary" onPress={handleEditShare}>保存</Button>
+          </ModalFooter>
+        </ModalContent>
+      </Modal>
+
       {/* Import Node Modal */}
       <Modal isOpen={importNodeOpen} onClose={() => setImportNodeOpen(false)}>
         <ModalContent>