fix(backend): clean stale forward runtimes on entry updates (#307 )

Entire-Checkpoint: 6a6b91fb5f0c
fix(backend): sync forward ports when tunnel entry changes (#304 )
2026-11-13 00:14:22 +08:00 · 2026-03-11 05:53:31 +00:00 · 2026-03-11 11:25:20 +08:00 · 2026-03-11 11:24:19 +08:00 · 2026-03-11 11:24:02 +08:00 · 2026-03-11 11:21:44 +08:00
78 changed files with 35165 additions and 764 deletions
@@ -0,0 +1,30 @@
+# Session Context
+
+Session ID: ses_32f7e3b05ffeK8IxNvZAZISGWO
+Commit Message: 编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+## Prompts
+
+### Prompt 1
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+### Prompt 2
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+### Prompt 3
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+### Prompt 4
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+### Prompt 5
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+## Summary
+
+已成功构建并推送 `ghcr.io/sagit-chu/vite-frontend:beta` (linux/amd64)
@@ -0,0 +1,17 @@
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+---
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+---
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+---
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
+
+---
+
+编译docker 镜像 ghcr.io/sagit-chu/vite-frontend:beta linux/amd64架构 推送
@@ -0,0 +1 @@
+已成功构建并推送 `ghcr.io/sagit-chu/vite-frontend:beta` (linux/amd64)
@@ -0,0 +1 @@
+提交全部变更并且push，创建pr
@@ -0,0 +1,6 @@
+✅ 已完成！
+- 提交: `e7548e7` - style(frontend): format code and improve node card layout
+- 推送到: `origin/opencode/quiet-canyon`
+- PR 创建成功: https://github.com/Sagit-chu/flvx/pull/297
+
+注意: 有 12 个未跟踪的 `.entire/metadata/ses_*` 文件，这些看起来是会话临时文件，未包含在提交中。
@@ -0,0 +1,17 @@
+# Session Context
+
+Session ID: ses_32fb9de62ffeXG3aOGlPDusGE8
+Commit Message: 规则标签页下，精简模式，和非精简模式一样要显示规则数量
+
+## Prompts
+
+### Prompt 1
+
+规则标签页下，精简模式，和非精简模式一样要显示规则数量
+
+## Summary
+
+I have successfully modified `vite-frontend/src/pages/forward.tsx` to include the rule count ("{sortedForwards.length} 条规则") when the forward page is in the `compactMode` (精简模式) and `viewMode === "grouped"`. This ensures consistency with the regular view modes where the total rule count is already displayed.
+
+The fix was committed and pushed to the repository in the recent step:
+`fix(frontend): show rule count in compact view mode for forward pages`
@@ -0,0 +1 @@
+这个没改对，页面没变化，请检查
@@ -0,0 +1,4 @@
+I have successfully modified `vite-frontend/src/pages/forward.tsx` to include the rule count ("{sortedForwards.length} 条规则") when the forward page is in the `compactMode` (精简模式) and `viewMode === "grouped"`. This ensures consistency with the regular view modes where the total rule count is already displayed.
+
+The fix was committed and pushed to the repository in the recent step:
+`fix(frontend): show rule count in compact view mode for forward pages`
@@ -0,0 +1,7 @@
+节点添加备注和下次续费后，卡片会被撑开，和其他卡片高度不统一，有什么优化方法，或者隐藏一些内容
+
+---
+
+1. 统一限制卡片高度
+2. 限制「备注」只显示 1 行
+3. 下次续费只显示距离到期
@@ -0,0 +1,30 @@
+我已经详细查阅了节点卡片 (`vite-frontend/src/pages/node.tsx`) 的代码结构。由于现在处于**计划模式 (Plan Mode)**，我目前只能读取和分析，不能直接修改代码。
+
+我已经为你准备了详细的修改方案，这套方案同时满足你提到的 3 个要求：
+
+### 修改计划：
+
+**1. 统一限制卡片高度**
+*   **目标代码位置**：修改包裹 `Card` 的外层 `SortableItem` 的 `className`，以及 `Card` 内部的结构。
+*   **具体修改**：
+    *   给 `SortableItem` 内部渲染的 `div` 增加 `flex flex-col h-full`，使其占满整个 Grid 格子的高度。
+    *   给 `Card` 增加 `h-full flex flex-col` 类名。
+    *   在 `<CardBody>` 内部，将顶部的基础信息区域（包含备注、续费等）和底部的控制区域（系统监控及按钮）分开。给包含底部按钮区域的 div 添加 `mt-auto`，这样它就会自动被推到卡片的最底部，使所有的操作按钮和监控进度条在同一行水平对齐，从而强制拉伸中间的空白区域以保证卡片等高。
+
+**2. 限制「备注」只显示 1 行**
+*   **目标代码位置**：备注内容显示的 div (`{node.remark.trim()}`)。
+*   **具体修改**：
+    *   将包含备注文本的 `div` 上的 `whitespace-pre-wrap break-words` 替换为 `line-clamp-1 break-all`。
+    *   在这个文本外层包一个 `title={node.remark.trim()}` 属性（原生 Tooltip），这样用户只要把鼠标悬停在被截断的备注上，就能看到完整的备注内容。
+
+**3. 下次续费只显示距离到期**
+*   **目标代码位置**：`{node.expiryTime && node.expiryTime > 0 && node.renewalCycle && ( ... )}` 渲染逻辑内。
+*   **具体修改**：
+    *   精简现有的 3 行布局（具体时间、剩余时间 Chip、续费周期）。
+    *   将其压缩为 1 行显示，只展示带颜色的 Chip（里面包含了“还有 x 天”的 `expiryMeta.label`）。
+    *   为了保留完整信息，我们给这个 Chip 加上 `title` 属性，比如鼠标移上去会显示完整的：`下次续费：2026-12-01 (年付)`。
+    *   这会把原先极度占用垂直空间的 3 行内容直接缩减到单行。
+
+---
+
+如果这个方案符合你的预期，你可以退出计划模式（或者直接回复同意执行），我会在下一次交互中立即为你实施这些代码修改！
@@ -0,0 +1,5 @@
+提交全部变更并且push，创建pr并且合并，合并后推送新tag，在已有的tag 递增 alpha版本
+
+---
+
+提交全部变更并且push，创建pr并且合并，合并后推送新tag，在已有的tag 递增 alpha版本
@@ -0,0 +1,3 @@
+当前没有新的变更需要提交。工作目录干净，只有 `.entire/metadata/` 临时文件。最新 tag 是 `2.1.8-alpha4`。
+
+如有新变更需要提交，请先进行修改。
@@ -0,0 +1,5 @@
+提交全部变更并且push
+
+---
+
+合并pr，发布新tag 2.1.8-alpha3
@@ -0,0 +1,3 @@
+完成:
+- PR #293 已合并
+- Tag `2.1.8-alpha3` 已发布
@@ -0,0 +1,2 @@
+设计一下这个issue实现
+https://github.com/Sagit-chu/flvx/issues/280
@@ -0,0 +1,52 @@
+我看过 issue #280，也把前后端相关实现路径过了一遍。这个需求适合做成“后端补字段，前端直接消费”的小改动，不建议只在前端二次拼装。
+
+- 现在 `/forward/list` 的数据来自 `h.repo.ListForwards()`，对应查询在 `go-backend/internal/store/repo/repository.go:700`，当前只 `LEFT JOIN tunnel` 取了 `tunnel_name`，还没把 `tunnel.traffic_ratio` 带出来。
+- 前端规则页自己的 `Forward` 类型定义在 `vite-frontend/src/pages/forward.tsx:102`，`mapForwardApiItems` 在 `vite-frontend/src/pages/forward.tsx:507` 负责把接口结果映射成本地状态；这里目前也没有倍率字段。
+- 规则列表的主要展示点有 3 处：表格隧道列 `vite-frontend/src/pages/forward.tsx:3306`、卡片副标题 `vite-frontend/src/pages/forward.tsx:3469`、分组标题 `vite-frontend/src/pages/forward.tsx:2919`。如果只改一处，体验会不一致。
+- 隧道页已经有统一的倍率展示格式 `vite-frontend/src/pages/tunnel.tsx:1336`，直接沿用 `"{trafficRatio}x"` 最稳。
+
+建议实现方案
+
+- 后端优先：在 `go-backend/internal/store/repo/repository.go:705` 的 `fwdRow` 增加 `TrafficRatio float64`，并在 `Select(...)` 中补上 `COALESCE(tunnel.traffic_ratio, 1.0) AS traffic_ratio`。
+- 后端返回：在构造 `item` 的地方把 `trafficRatio` 以 `tunnelTrafficRatio` 键返回，保持前端语义清晰，避免和规则自身字段混淆。
+- 前端类型：给 `vite-frontend/src/api/types.ts:45` 的 `ForwardApiItem` 增加 `tunnelTrafficRatio?: number`；给 `vite-frontend/src/pages/forward.tsx:102` 的本地 `Forward` interface 同步增加该字段。
+- 前端映射：在 `vite-frontend/src/pages/forward.tsx:507` 的 `mapForwardApiItems` 里做默认值归一化，比如没有值时回退到 `1`，避免旧数据或异常响应导致显示空白。
+- 前端展示：优先把倍率放进“隧道名称展示块”里，而不是新增独立列。原因是当前表格列已经偏宽，issue 也接受“名称旁边显示”；卡片和分组视图也更容易保持一致。建议形式：
+  - 表格：`TunnelName` 主文案 + 小号次级 `1x`
+  - 卡片：副标题显示为 `隧道名 · 1x`
+  - 分组标题：`隧道名` 后加一个轻量 Chip / muted 文本 `1x`
+
+为什么不建议纯前端拼装
+
+- `forward.tsx` 虽然在 `loadData` 里已经请求了 `getTunnelList()` 和 `userTunnel()`，但 `refreshForwardList()` 是独立刷新的，规则状态刷新时不保证隧道缓存始终同步，容易出现倍率滞后。
+- 当前分组逻辑主要基于规则数据本身，若依赖前端再按 `tunnelId` 做二次映射，会把一个本来单接口即可闭环的信息拆成两份状态，后面维护更麻烦。
+- 后端本来已经 `JOIN tunnel` 取名字，只是顺手再取一个倍率字段，成本最低。
+
+推荐实施步骤
+
+- 后端：扩展 `/forward/list` 查询与返回结构，默认倍率回退 `1.0`。
+- 合约测试：在 `go-backend/tests/contract/forward_contract_test.go` 增加对 `/forward/list` 返回 `tunnelTrafficRatio` 的断言，至少覆盖一个非默认值例如 `2.5`。
+- 前端类型：同步更新 `ForwardApiItem` 和页面内 `Forward`。
+- 前端映射：在 `mapForwardApiItems` 里规范化 `tunnelTrafficRatio`。
+- 前端 UI：统一更新表格、卡片、分组标题 3 处展示，避免 direct/grouped 两种模式信息不一致。
+- 回归验证：确认管理员和普通用户视角下，`/forward/list` 权限过滤不受影响，因为过滤逻辑在 `go-backend/internal/http/handler/handler.go:395` 之后仅按 `userId` 过滤，不会受新增字段影响。
+
+风险和注意点
+
+- `ForwardApiItem` 现在是宽松结构，短期不会因新增字段报错，但如果只改页面本地类型不改 API 类型，后面别处复用时会产生类型漂移。
+- 分组标题 `ForwardTunnelGroup` 目前只有 `tunnelName`，如果要在分组头也显示倍率，最好给分组结构补一个 `tunnelTrafficRatio?: number`，并在构建分组时从首条规则或同组规则里带出。
+- 需要统一倍率格式，避免出现 `1`, `1.0`, `1.00` 混用。建议做一个小格式化函数：整数显示 `1x`，小数保留必要精度如 `0.5x`、`1.25x`。
+- 若某条规则关联的隧道已删除，后端 `COALESCE(..., 1.0)` 能保证页面仍可显示默认 `1x`，不会变成空。
+
+验收标准
+
+- `/api/v1/forward/list` 每条规则都带 `tunnelTrafficRatio`。
+- 规则页 direct 表格模式能看到倍率。
+- grouped 卡片模式和分组标题也能看到倍率，信息一致。
+- 隧道缺失或旧数据情况下仍稳定显示 `1x`。
+- 普通用户只能看到自己的规则，但倍率字段仍正常返回。
+
+如果你要我下一步继续，我建议按这个实现顺序做：
+1. 先补后端查询和 contract test
+2. 再补前端类型与统一展示
+3. 最后跑 `go test ./tests/contract/...` 和前端 build 做回归
@@ -0,0 +1,2 @@
+提交全部变更并且push，并且修改pr内容关联
+https://github.com/Sagit-chu/flvx/issues/246
@@ -0,0 +1,15 @@
+已完成。
+
+- 提交了当前代码变更，commit 是 `31ef861`
+- 已 push 到远端分支 `opencode/quiet-canyon`
+- 已更新 PR `https://github.com/Sagit-chu/flvx/pull/293`
+- PR 标题改为 `feat(nodes): add node metadata and expiry reminders`
+- PR 内容已改成这次节点备注/标签/到期提醒相关说明，并加入 `Closes #246` 关联 issue
+
+补充一点：
+- 工作区里还有未提交的 `.entire/metadata/...` 会话元数据文件，它们没有被加入这次提交
+
+如果你要，我下一步可以继续：
+1. 帮你检查这条 PR 的 diff 和描述是否还需要再精简
+2. 帮你补充 reviewer-friendly 的 PR checklist
+3. 帮你查看 CI / checks 状态
@@ -0,0 +1,14 @@
+# Session Context
+
+Session ID: ses_332cb6fa9ffehf0BwC73iSeZUR
+Commit Message: 你好
+
+## Prompts
+
+### Prompt 1
+
+你好
+
+## Summary
+
+你好！我在这儿。要我帮你看代码、改功能、排查报错，还是跑命令都可以。
@@ -0,0 +1,125 @@
+{
+  "info": {
+    "id": "ses_332cb6fa9ffehf0BwC73iSeZUR",
+    "slug": "proud-pixel",
+    "projectID": "03c3dd2e5791a80ef100ef53744e013d779d671c",
+    "directory": "/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon",
+    "title": "问候",
+    "version": "1.2.21",
+    "summary": {
+      "additions": 0,
+      "deletions": 0,
+      "files": 0
+    },
+    "time": {
+      "created": 1772969300054,
+      "updated": 1772969309055
+    }
+  },
+  "messages": [
+    {
+      "info": {
+        "role": "user",
+        "time": {
+          "created": 1772969305082
+        },
+        "summary": {
+          "diffs": []
+        },
+        "agent": "build",
+        "model": {
+          "providerID": "api",
+          "modelID": "gpt-5.4"
+        },
+        "variant": "high",
+        "id": "msg_27c12106663448898b7e25726a28ce04",
+        "sessionID": "ses_332cb6fa9ffehf0BwC73iSeZUR"
+      },
+      "parts": [
+        {
+          "type": "text",
+          "text": "你好",
+          "time": {
+            "start": 1772969305.0665522,
+            "end": 1772969305.066553
+          },
+          "id": "prt_ccd34a3fa0015dQBm2oO5f6vPN",
+          "sessionID": "ses_332cb6fa9ffehf0BwC73iSeZUR",
+          "messageID": "msg_27c12106663448898b7e25726a28ce04"
+        }
+      ]
+    },
+    {
+      "info": {
+        "role": "assistant",
+        "time": {
+          "created": 1772969305091,
+          "completed": 1772969309611
+        },
+        "parentID": "msg_27c12106663448898b7e25726a28ce04",
+        "modelID": "gpt-5.4",
+        "providerID": "api",
+        "mode": "build",
+        "agent": "build",
+        "path": {
+          "cwd": "/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon",
+          "root": "/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon"
+        },
+        "cost": 0,
+        "tokens": {
+          "total": 17138,
+          "input": 2210,
+          "output": 80,
+          "reasoning": 45,
+          "cache": {
+            "read": 14848,
+            "write": 0
+          }
+        },
+        "variant": "high",
+        "finish": "stop",
+        "id": "msg_ccd34a4030014dwF4qM30pkR3k",
+        "sessionID": "ses_332cb6fa9ffehf0BwC73iSeZUR"
+      },
+      "parts": [
+        {
+          "type": "step-start",
+          "snapshot": "d23faf4e134b40b649cf9ec6e7a21a632c4c61b1",
+          "id": "prt_ccd34b520001tv5ON6ERsriuUJ",
+          "sessionID": "ses_332cb6fa9ffehf0BwC73iSeZUR",
+          "messageID": "msg_ccd34a4030014dwF4qM30pkR3k"
+        },
+        {
+          "type": "text",
+          "text": "你好！我在这儿。要我帮你看代码、改功能、排查报错，还是跑命令都可以。",
+          "time": {
+            "start": 1772969309550,
+            "end": 1772969309550
+          },
+          "id": "prt_ccd34b521001WeBauxJnuorFa5",
+          "sessionID": "ses_332cb6fa9ffehf0BwC73iSeZUR",
+          "messageID": "msg_ccd34a4030014dwF4qM30pkR3k"
+        },
+        {
+          "type": "step-finish",
+          "reason": "stop",
+          "snapshot": "d23faf4e134b40b649cf9ec6e7a21a632c4c61b1",
+          "cost": 0,
+          "tokens": {
+            "total": 17138,
+            "input": 2210,
+            "output": 80,
+            "reasoning": 45,
+            "cache": {
+              "read": 14848,
+              "write": 0
+            }
+          },
+          "id": "prt_ccd34b56f001tUZXybdhjVzB22",
+          "sessionID": "ses_332cb6fa9ffehf0BwC73iSeZUR",
+          "messageID": "msg_ccd34a4030014dwF4qM30pkR3k"
+        }
+      ]
+    }
+  ]
+}
@@ -0,0 +1 @@
+你好
@@ -0,0 +1 @@
+你好！我在这儿。要我帮你看代码、改功能、排查报错，还是跑命令都可以。
@@ -0,0 +1,14 @@
+# Session Context
+
+Session ID: ses_332ce68b1ffe0R9vUQZ6yq5gUd
+Commit Message: 在agent.md中加上，尽量使用能使用的skills和mcp
+
+## Prompts
+
+### Prompt 1
+
+在agent.md中加上，尽量使用能使用的skills和mcp
+
+## Summary
+
+已添加到 `AGENTS.md` 的 CONVENTIONS 部分。
@@ -0,0 +1 @@
+在agent.md中加上，尽量使用能使用的skills和mcp
@@ -0,0 +1 @@
+已添加到 `AGENTS.md` 的 CONVENTIONS 部分。
@@ -0,0 +1,11 @@
+# Session Context
+
+Session ID: ses_332d83674ffeNMa9Z9UerwU3tq
+Commit Message: 提交全部变更并且push，创建pr
+
+## Prompts
+
+### Prompt 1
+
+提交全部变更并且push，创建pr
+
@@ -0,0 +1 @@
+提交全部变更并且push，创建pr
@@ -0,0 +1 @@
+提交全部变更并且push，创建pr
@@ -0,0 +1,8 @@
+已完成！
+
+**提交摘要：**
+- 10 个文件变更（939 行新增，173 行删除）
+- 新增计划文档 `plans/020-ajax-no-refresh-ux.md`
+- 新增工具函数 `vite-frontend/src/utils/list-state.ts`
+
+**PR 已创建：** https://github.com/Sagit-chu/flvx/pull/293
@@ -0,0 +1 @@
+You are auditing the FLVX frontend for GitHub issue #276 (AJAX no-refresh UX improvements). Read-only only. Focus on existing implementation status for: 1) dashboard traffic auto-refresh, 2) node status real-time updates, 3) form submissions without full page reload, 4) local/partial list refresh after CRUD/toggle, 5) batch operation progress UI, 6) search/filter instant response. Inspect relevant files under vite-frontend/src/pages and src/api. Return a concise report with: a) what already exists, b) what is missing or partial, c) specific file paths and functions to touch for an implementation plan, d) notable risks or edge cases. Do not edit anything.
@@ -0,0 +1,230 @@
+Concise audit for issue #276, focused on `vite-frontend/src/pages` and `src/api`.
+
+a) What already exists
+
+1. Dashboard traffic auto-refresh
+- Dashboard data is loaded via async API calls in a hook, not by page reload:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/dashboard/use-dashboard-data.ts`
+  - `useDashboardData()` calls `getUserPackageInfo()` and `getAnnouncement()`.
+- The 24h traffic chart is already rendered from `statisticsFlows`:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/dashboard.tsx`
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/dashboard/components/flow-chart-card.tsx`
+
+2. Node status real-time updates
+- This is the strongest existing area.
+- WebSocket realtime hook already exists:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node/use-node-realtime.ts`
+  - `useNodeRealtime()`
+- Offline debounce exists:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node/use-node-offline-timers.ts`
+- Node page consumes websocket messages and updates local state without reload:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+  - `handleWebSocketMessage()`
+  - `loadNodes()`
+- Realtime also includes system info updates and upgrade progress updates.
+
+3. Form submissions without full page reload
+- Broadly already implemented across main CRUD pages using async handlers + modal close + state refresh.
+- Examples:
+  - Nodes: `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+    - `handleSubmit()`
+  - Tunnels: `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/tunnel.tsx`
+    - `handleSubmit()`
+  - Forwards: `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/forward.tsx`
+    - `handleSubmit()`
+  - Users: `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/user.tsx`
+    - `handleSubmitUser()`
+- I did not find page reload patterns in these CRUD pages (`location.reload` / `window.location.reload` absent there).
+
+4. Local/partial list refresh after CRUD/toggle
+- Some local optimistic/partial updates already exist:
+  - Node delete updates local state directly:
+    - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+    - `confirmDelete()`
+  - Node edit updates local item directly:
+    - `handleSubmit()` edit branch
+  - Forward service toggle uses optimistic local update + rollback on failure:
+    - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/forward.tsx`
+    - `handleServiceToggle()`
+  - Sorting persists locally and updates item `inx` in-memory after success:
+    - Node `handleDragEnd()`
+    - Tunnel `handleDragEnd()`
+    - Forward `handleDragEnd()`
+
+5. Batch operation progress UI
+- Node upgrade has actual per-node progress UI:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+  - `upgradeProgress` state
+  - websocket `type === "upgrade_progress"` handling in `handleWebSocketMessage()`
+  - `<Progress />` render around lines ~1307+
+- Forward batch actions are factored and return structured outcomes:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/forward/batch-actions.ts`
+
+6. Search/filter instant response
+- Instant client-side filtering already exists in:
+  - Nodes: `sortedNodes` memo filters by `searchKeyword`
+    - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+  - Tunnels: `sortedTunnels`
+    - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/tunnel.tsx`
+  - Forwards: `orderedForwards`
+    - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/forward.tsx`
+- Forward also has instant client-side filter dropdowns (`filterUserId`, `filterTunnelId`).
+
+b) What is missing or partial
+
+1. Dashboard traffic auto-refresh: missing
+- `useDashboardData()` only fetches once on mount.
+- No polling, websocket, refetch trigger, focus refresh, or manual refresh hook.
+- So “AJAX no-refresh” exists only for initial load, not ongoing refresh.
+
+2. Node realtime: partial but good
+- Realtime status/system-info exists only for nodes.
+- It reconnects with limited retries (5 attempts) and then stops.
+- `loadNodes()` initially sets `systemInfo: null`, so a full reload can temporarily wipe metrics until WS catches up again.
+- No obvious fallback polling if websocket dies permanently.
+
+3. Form submission no full reload: mostly done
+- CRUD forms are already async and modal-driven.
+- But post-submit refresh style is inconsistent:
+  - some do local patch,
+  - many do full page-level list refetch (`loadData()`, `loadUsers()`, `loadNodes()`).
+
+4. Local/partial list refresh after CRUD/toggle: partial/inconsistent
+- Forward toggle is good and local.
+- Node edit/delete are relatively local.
+- But many operations still refetch the whole page dataset:
+  - Tunnel create/update/delete -> `loadData()`
+  - Forward create/update/delete -> `loadData()`
+  - User create/update/delete -> `loadUsers()`
+  - User tunnel assignment/update/remove -> `loadUserTunnels()`
+- This is AJAX and avoids full browser reload, but not “partial/local refresh” in the stronger UX sense.
+
+5. Batch operation progress UI: largely missing outside node upgrade
+- Tunnel batch delete/redeploy: only loading spinner/toast + full reload, no per-item progress/result panel.
+- Forward batch actions: summarized via toast and optional refresh, but no visible progress timeline/progress list.
+- User batch tunnel assignment: no progress UI beyond loading state.
+
+6. Search/filter instant response: mixed
+- Nodes/tunnels/forwards are instant client-side.
+- Users are not fully instant:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/user.tsx`
+  - `loadUsers()` is server-driven and tied to `useEffect([pagination.current, pagination.size, searchKeyword])`
+  - Enter key also manually calls `handleSearch()`
+- So user search is AJAX but not purely local/instant in the same way.
+
+c) Specific file paths and functions to touch for an implementation plan
+
+Primary targets
+
+1. Dashboard auto-refresh
+- `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/dashboard/use-dashboard-data.ts`
+  - `useDashboardData()`
+  - extract `loadPackageData()` / `loadAnnouncement()` into stable callbacks
+  - add polling or visibility/focus-based refetch
+- `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/dashboard.tsx`
+  - if adding manual refresh indicator/button, this is the page entry
+- API source already exists:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/api/index.ts`
+  - `getUserPackageInfo()`, `getAnnouncement()`
+
+2. Node realtime hardening / fallback
+- `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node/use-node-realtime.ts`
+  - `useNodeRealtime()`
+  - retry policy, reconnect strategy, possible fallback refresh trigger
+- `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+  - `handleWebSocketMessage()`
+  - `loadNodes()`
+  - `handleSubmit()`
+  - `confirmDelete()`
+  - `handleBatchDelete()`
+
+3. Replace whole-list reloads with local/partial updates
+- Tunnels:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/tunnel.tsx`
+  - `loadData()`
+  - `handleSubmit()`
+  - `confirmDelete()`
+  - `handleBatchDelete()`
+  - `handleBatchRedeploy()`
+- Forwards:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/forward.tsx`
+  - `loadData()`
+  - `handleSubmit()`
+  - `confirmDelete()`
+  - `handleServiceToggle()`
+  - `handleBatchDelete()`
+  - `handleBatchToggleService()`
+  - `handleBatchRedeploy()`
+  - `handleBatchChangeTunnel()`
+- Users:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/user.tsx`
+  - `loadUsers()`
+  - `handleSubmitUser()`
+  - `handleConfirmDelete()`
+  - `loadUserTunnels()`
+  - `handleBatchAssignTunnel()`
+  - `handleUpdateTunnel()`
+  - `handleConfirmRemoveTunnel()`
+  - `handleConfirmResetFlow()`
+  - `handleConfirmResetTunnelFlow()`
+
+4. Batch progress/result UX
+- Nodes already have a model to copy:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node.tsx`
+  - `upgradeProgress`
+  - websocket `upgrade_progress`
+- Forward batch abstraction:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/forward/batch-actions.ts`
+  - likely extend return shape if backend can expose richer progress/events
+- API endpoints involved:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/api/index.ts`
+  - `batchDeleteForwards()`
+  - `batchPauseForwards()`
+  - `batchResumeForwards()`
+  - `batchRedeployForwards()`
+  - `batchChangeTunnel()`
+  - `batchDeleteTunnels()`
+  - `batchRedeployTunnels()`
+  - `batchDeleteNodes()`
+  - `batchUpgradeNodes()`
+
+5. Search/filter behavior normalization
+- `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/user.tsx`
+  - `loadUsers()`
+  - `handleSearch()`
+  - search input around lines ~718+
+- Nodes/tunnels/forwards already have memo-based client filtering and are the pattern to follow.
+
+d) Notable risks / edge cases
+
+1. Dashboard polling could spam toasts
+- `checkExpirationNotifications()` runs inside package load flow.
+- If polling is added naively, expiration toasts could repeat or localStorage notification keys could churn unexpectedly.
+
+2. Dashboard chart semantics
+- `statisticsFlows` appears to be a snapshot list, not a stream API.
+- Frequent polling may redraw aggressively and may need dedupe/staleness handling.
+
+3. Node websocket auth/security
+- Realtime URL sends token in query string (`secret=${getToken()}`) in:
+  - `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/quiet-canyon/vite-frontend/src/pages/node/use-node-realtime.ts`
+- Any changes should be careful not to break backend expectations.
+
+4. Realtime/local state merge complexity
+- `loadNodes()` normalizes nodes and clears `systemInfo`.
+- If partial refetch is introduced, merging fetched node metadata with live websocket state must avoid wiping online metrics/progress.
+
+5. Batch APIs may not provide granular progress
+- Current batch helpers mostly return summary counts, not per-item progress.
+- True progress UI may require backend support, not only frontend work.
+
+6. Forward toggle consistency
+- `handleServiceToggle()` optimistically flips `serviceRunning` and later patches `status`.
+- If backend returns partial failure or delayed actual state, UI may drift until a refresh.
+
+7. User search behavior currently depends on backend pagination/search
+- Moving to fully instant local filtering may conflict with server-side pagination semantics and large datasets.
+
+Bottom line
+- Already present: async modal CRUD, no browser reloads, strong node realtime, optimistic forward toggle, instant search/filter on node/tunnel/forward pages.
+- Missing/partial for #276: dashboard traffic auto-refresh, consistent partial/local state updates after CRUD, batch progress UI outside node upgrade, and more unified instant-search UX on the user page.
@@ -0,0 +1,41 @@
+# Session Context
+
+Session ID: ses_332fdb603ffeYxhpzgAB64sSTN
+Commit Message: 开始实施
+
+## Prompts
+
+### Prompt 1
+
+https://github.com/Sagit-chu/flvx/issues/276
+计划一下这个issue实现
+
+### Prompt 2
+
+写出 plans/020-ajax-no-refresh-ux.md 的完整实施计划内容
+
+### Prompt 3
+
+开始实施
+
+## Summary
+
+我先把 Phase 1 落地了，重点做了仪表盘自动刷新和节点实时连接兜底，并把计划文档同步更新了。
+
+- `vite-frontend/src/pages/dashboard/use-dashboard-data.ts:55` 现在加入了 5 秒静默轮询、标签页可见性恢复刷新，以及更稳定的加载回调拆分，避免每次刷新都走整套初始化逻辑。
+- `vite-frontend/src/pages/dashboard/use-dashboard-data.ts:82` 把过期提醒的去重 key 改成基于用户/隧道到期信息的稳定标识，轮询刷新流量时不会反复弹 toast。
+- `vite-frontend/src/pages/node/use-node-realtime.ts:13` 补强了 WebSocket 重连策略：前几次按递增延迟重连，超过阈值后进入长间隔 fallback 模式，而不是彻底停掉。
+- `vite-frontend/src/pages/node.tsx:68` 增加了节点列表 merge 逻辑；fallback 刷新时会保留已有 `systemInfo`、升级/复制/回退 loading 状态，避免列表刷新把实时信息清空。
+- `vite-frontend/src/pages/node.tsx:1160` 节点页断线提示现在会区分“正在重连”和“已切换为列表自动刷新兜底模式”。
+- `vite-frontend/src/vite-env.d.ts:4` 补上了 `VITE_API_BASE` 类型声明，顺手消掉这次构建会碰到的环境变量类型报错。
+- `plans/020-ajax-no-refresh-ux.md:19` 已把本次完成的 3 个 Phase 1 checklist 勾掉。
+
+验证情况：
+- 运行了 `cd vite-frontend && npm install`
+- 运行了 `cd vite-frontend && npm run build`
+- 前端构建已通过
+
+这次额外生成了依赖文件：
+- `vite-frontend/package-lock.json`
+
+下一步自然就是继续 Phase 2，把 `forward` / `tunnel` / `user` 的“操作后整页数据重拉”改成局部 patch。你要我继续的话，我建议从 `vite-frontend/src/pages/forward.tsx` 开始，因为它已经有一部分本地更新模式，改起来最顺。
@@ -0,0 +1,10 @@
+https://github.com/Sagit-chu/flvx/issues/276
+计划一下这个issue实现
+
+---
+
+写出 plans/020-ajax-no-refresh-ux.md 的完整实施计划内容
+
+---
+
+开始实施
@@ -0,0 +1,19 @@
+我先把 Phase 1 落地了，重点做了仪表盘自动刷新和节点实时连接兜底，并把计划文档同步更新了。
+
+- `vite-frontend/src/pages/dashboard/use-dashboard-data.ts:55` 现在加入了 5 秒静默轮询、标签页可见性恢复刷新，以及更稳定的加载回调拆分，避免每次刷新都走整套初始化逻辑。
+- `vite-frontend/src/pages/dashboard/use-dashboard-data.ts:82` 把过期提醒的去重 key 改成基于用户/隧道到期信息的稳定标识，轮询刷新流量时不会反复弹 toast。
+- `vite-frontend/src/pages/node/use-node-realtime.ts:13` 补强了 WebSocket 重连策略：前几次按递增延迟重连，超过阈值后进入长间隔 fallback 模式，而不是彻底停掉。
+- `vite-frontend/src/pages/node.tsx:68` 增加了节点列表 merge 逻辑；fallback 刷新时会保留已有 `systemInfo`、升级/复制/回退 loading 状态，避免列表刷新把实时信息清空。
+- `vite-frontend/src/pages/node.tsx:1160` 节点页断线提示现在会区分“正在重连”和“已切换为列表自动刷新兜底模式”。
+- `vite-frontend/src/vite-env.d.ts:4` 补上了 `VITE_API_BASE` 类型声明，顺手消掉这次构建会碰到的环境变量类型报错。
+- `plans/020-ajax-no-refresh-ux.md:19` 已把本次完成的 3 个 Phase 1 checklist 勾掉。
+
+验证情况：
+- 运行了 `cd vite-frontend && npm install`
+- 运行了 `cd vite-frontend && npm run build`
+- 前端构建已通过
+
+这次额外生成了依赖文件：
+- `vite-frontend/package-lock.json`
+
+下一步自然就是继续 Phase 2，把 `forward` / `tunnel` / `user` 的“操作后整页数据重拉”改成局部 patch。你要我继续的话，我建议从 `vite-frontend/src/pages/forward.tsx` 开始，因为它已经有一部分本地更新模式，改起来最顺。
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -311,6 +312,14 @@ func (h *Handler) syncForwardServicesWithWarnings(forward *forwardRecord, method
 			return warnings, fmt.Errorf("节点 %s 下发失败: %w", node.Name, err)
 		}
 	}
+
+	// Keep paused forwards paused after UpdateService/AddService, since agent-side UpdateService
+	// always restarts services.
+	if forward.Status != 1 {
+		if err := h.controlForwardServices(forward, "PauseService", false); err != nil {
+			return warnings, err
+		}
+	}
 	return warnings, nil
 }

@@ -1612,13 +1621,21 @@ func buildForwarderNodes(targets []string) []map[string]interface{} {
 }

 func processServerAddress(serverAddr string) string {
-	serverAddr = strings.TrimSpace(serverAddr)
+	serverAddr = normalizeServerAddressInput(serverAddr)
 	if serverAddr == "" {
 		return serverAddr
 	}
 	if strings.HasPrefix(serverAddr, "[") {
 		return serverAddr
 	}
+	// If the input is a bare IPv6 host (no port), bracket it.
+	// IPv6-with-port must be provided in bracket form: [::1]:443.
+	if looksLikeIPv6(serverAddr) {
+		if ip := net.ParseIP(serverAddr); ip != nil && ip.To4() == nil {
+			return "[" + serverAddr + "]"
+		}
+	}
+
 	idx := strings.LastIndex(serverAddr, ":")
 	if idx < 0 {
 		if looksLikeIPv6(serverAddr) {
@@ -1637,6 +1654,27 @@ func processServerAddress(serverAddr string) string {
 	return serverAddr
 }

+func normalizeServerAddressInput(serverAddr string) string {
+	serverAddr = strings.TrimSpace(serverAddr)
+	if serverAddr == "" {
+		return serverAddr
+	}
+
+	if idx := strings.Index(serverAddr, "://"); idx > 0 {
+		if parsed, err := url.Parse(serverAddr); err == nil {
+			if host := strings.TrimSpace(parsed.Host); host != "" {
+				return host
+			}
+		}
+		serverAddr = serverAddr[idx+3:]
+	}
+
+	if idx := strings.IndexAny(serverAddr, "/?#"); idx >= 0 {
+		serverAddr = serverAddr[:idx]
+	}
+	return strings.TrimSpace(serverAddr)
+}
+
 func looksLikeIPv6(address string) bool {
 	return strings.Count(address, ":") >= 2
 }
@@ -420,3 +420,68 @@ func TestBuildForwardServiceConfigs_BindIPAlreadyContainsPort(t *testing.T) {
 		}
 	}
 }
+
+func TestProcessServerAddress_StripsURLSchemeAndPath(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "https with path",
+			in:   "https://panel.example.com:8443/api/v1",
+			want: "panel.example.com:8443",
+		},
+		{
+			name: "wss with query",
+			in:   "wss://panel.example.com:443/system-info?x=1",
+			want: "panel.example.com:443",
+		},
+		{
+			name: "http without port",
+			in:   "http://panel.example.com",
+			want: "panel.example.com",
+		},
+		{
+			name: "manual host with trailing path",
+			in:   "panel.example.com:8080/path",
+			want: "panel.example.com:8080",
+		},
+	}
+
+	for _, tt := range tests {
+		if got := processServerAddress(tt.in); got != tt.want {
+			t.Fatalf("%s: expected %q, got %q", tt.name, tt.want, got)
+		}
+	}
+}
+
+func TestProcessServerAddress_NormalizesIPv6(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "ipv6 host only",
+			in:   "2001:db8::1",
+			want: "[2001:db8::1]",
+		},
+		{
+			name: "ipv6 host and port",
+			in:   "https://[2001:db8::1]:8443/path",
+			want: "[2001:db8::1]:8443",
+		},
+		{
+			name: "already bracketed",
+			in:   "[2001:db8::2]:9000",
+			want: "[2001:db8::2]:9000",
+		},
+	}
+
+	for _, tt := range tests {
+		if got := processServerAddress(tt.in); got != tt.want {
+			t.Fatalf("%s: expected %q, got %q", tt.name, tt.want, got)
+		}
+	}
+}
@@ -2,6 +2,7 @@ package handler

 import (
 	"encoding/json"
+	"errors"
 	"log"
 	"strconv"
 	"strings"
@@ -327,6 +328,67 @@ func (h *Handler) enforceFlowPolicies(userID int64, userTunnelID int64) {
 	}
 }

+func (h *Handler) ensureUserTunnelForwardAllowed(userID int64, tunnelID int64, now int64) error {
+	if h == nil || h.repo == nil {
+		return errors.New("invalid flow policy context")
+	}
+	if userID <= 0 || tunnelID <= 0 {
+		return nil
+	}
+
+	user, err := h.repo.GetUserByID(userID)
+	if err != nil {
+		return err
+	}
+	if user == nil {
+		return errors.New("用户不存在")
+	}
+
+	if user.Status != 1 {
+		return errors.New("账号已禁用")
+	}
+	if user.ExpTime > 0 && user.ExpTime <= now {
+		return errors.New("账号已过期")
+	}
+
+	flowLimit := user.Flow * bytesPerGB
+	current := user.InFlow + user.OutFlow
+	if flowLimit < current {
+		return errors.New("流量已超额，禁止开启转发")
+	}
+
+	userTunnelID, _, _, err := h.resolveUserTunnelAndLimiter(userID, tunnelID)
+	if err != nil {
+		return err
+	}
+	if userTunnelID <= 0 {
+		return nil
+	}
+
+	policy, err := h.getUserTunnelPolicy(userTunnelID)
+	if err != nil {
+		return err
+	}
+	if policy == nil {
+		return nil
+	}
+
+	if policy.Status != 1 {
+		return errors.New("该隧道已禁用")
+	}
+	if policy.ExpTime > 0 && policy.ExpTime <= now {
+		return errors.New("该隧道已过期")
+	}
+
+	utFlowLimit := policy.Flow * bytesPerGB
+	utCurrent := policy.InFlow + policy.OutFlow
+	if utCurrent >= utFlowLimit {
+		return errors.New("该隧道流量已超额，禁止开启转发")
+	}
+
+	return nil
+}
+
 func (h *Handler) shouldPauseUser(userID int64, now int64) bool {
 	user, err := h.repo.GetUserByID(userID)
 	if err != nil || user == nil {
@@ -262,7 +262,6 @@ func (h *Handler) nodeCreate(w http.ResponseWriter, r *http.Request) {
 		nullableText(asString(req["interfaceName"])),
 		nullableText(""),
 		nullableText(strings.TrimSpace(asString(req["remark"]))),
-		nullableText(strings.TrimSpace(asString(req["tags"]))),
 		nullableUnixMilli(asInt64(req["expiryTime"], 0)),
 		nullableText(normalizeNodeRenewalCycle(asString(req["renewalCycle"]))),
 		asInt(req["http"], 0),
@@ -331,7 +330,6 @@ func (h *Handler) nodeUpdate(w http.ResponseWriter, r *http.Request) {
 		nullableText(asString(req["interfaceName"])),
 		nullableText(asString(req["extraIPs"])),
 		nullableText(strings.TrimSpace(asString(req["remark"]))),
-		nullableText(strings.TrimSpace(asString(req["tags"]))),
 		nullableUnixMilli(asInt64(req["expiryTime"], 0)),
 		nullableText(normalizeNodeRenewalCycle(asString(req["renewalCycle"]))),
 		newHTTP,
@@ -686,6 +684,7 @@ func (h *Handler) tunnelUpdate(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("隧道ID不能为空"))
 		return
 	}
+	oldEntryNodeIDs, _ := h.tunnelEntryNodeIDs(id)

 	h.cleanupTunnelRuntime(id)
 	h.cleanupFederationRuntime(id)
@@ -757,6 +756,12 @@ func (h *Handler) tunnelUpdate(w http.ResponseWriter, r *http.Request) {
 		return
 	}

+	newEntryNodeIDs, _ := h.tunnelEntryNodeIDs(id)
+	if !sameInt64Set(oldEntryNodeIDs, newEntryNodeIDs) {
+		h.cleanupTunnelForwardRuntimesOnRemovedEntryNodes(id, oldEntryNodeIDs, newEntryNodeIDs)
+		h.syncTunnelForwardsEntryPorts(id, newEntryNodeIDs)
+	}
+
 	if typeVal == 2 {
 		createdChains, createdServices, applyErr := h.applyTunnelRuntime(runtimeState)
 		if applyErr != nil {
@@ -781,6 +786,146 @@ func (h *Handler) tunnelUpdate(w http.ResponseWriter, r *http.Request) {
 	response.WriteJSON(w, response.OKEmpty())
 }

+func sameInt64Set(a, b []int64) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	if len(a) == 0 {
+		return true
+	}
+	m := make(map[int64]int, len(a))
+	for _, v := range a {
+		m[v]++
+	}
+	for _, v := range b {
+		c, ok := m[v]
+		if !ok || c <= 0 {
+			return false
+		}
+		if c == 1 {
+			delete(m, v)
+			continue
+		}
+		m[v] = c - 1
+	}
+	return len(m) == 0
+}
+
+func pickForwardPortFromRecords(ports []forwardPortRecord) int {
+	min := 0
+	for _, fp := range ports {
+		if fp.Port <= 0 {
+			continue
+		}
+		if min == 0 || fp.Port < min {
+			min = fp.Port
+		}
+	}
+	return min
+}
+
+func uniqueInt64s(input []int64) []int64 {
+	if len(input) <= 1 {
+		return input
+	}
+	seen := make(map[int64]struct{}, len(input))
+	out := make([]int64, 0, len(input))
+	for _, v := range input {
+		if _, ok := seen[v]; ok {
+			continue
+		}
+		seen[v] = struct{}{}
+		out = append(out, v)
+	}
+	return out
+}
+
+func diffInt64s(base, subtract []int64) []int64 {
+	if len(base) == 0 {
+		return nil
+	}
+	seen := make(map[int64]struct{}, len(subtract))
+	for _, v := range subtract {
+		seen[v] = struct{}{}
+	}
+	out := make([]int64, 0, len(base))
+	for _, v := range base {
+		if _, ok := seen[v]; ok {
+			continue
+		}
+		out = append(out, v)
+	}
+	return uniqueInt64s(out)
+}
+
+func (h *Handler) cleanupTunnelForwardRuntimesOnRemovedEntryNodes(tunnelID int64, oldEntryNodeIDs, newEntryNodeIDs []int64) {
+	if h == nil || h.repo == nil || tunnelID <= 0 {
+		return
+	}
+
+	removedNodeIDs := diffInt64s(oldEntryNodeIDs, newEntryNodeIDs)
+	if len(removedNodeIDs) == 0 {
+		return
+	}
+
+	forwards, err := h.listForwardsByTunnel(tunnelID)
+	if err != nil || len(forwards) == 0 {
+		return
+	}
+
+	for i := range forwards {
+		f := &forwards[i]
+		if f == nil {
+			continue
+		}
+		for _, nodeID := range removedNodeIDs {
+			_ = h.deleteForwardServicesOnNode(f, nodeID)
+		}
+	}
+}
+
+func (h *Handler) syncTunnelForwardsEntryPorts(tunnelID int64, entryNodeIDs []int64) {
+	if h == nil || h.repo == nil || tunnelID <= 0 {
+		return
+	}
+	entryNodeIDs = uniqueInt64s(entryNodeIDs)
+	if len(entryNodeIDs) == 0 {
+		return
+	}
+
+	forwards, err := h.listForwardsByTunnel(tunnelID)
+	if err != nil || len(forwards) == 0 {
+		return
+	}
+
+	allowInIP := len(entryNodeIDs) == 1
+	for i := range forwards {
+		f := &forwards[i]
+		if f == nil {
+			continue
+		}
+		oldPorts, err := h.listForwardPorts(f.ID)
+		if err != nil {
+			continue
+		}
+		port := pickForwardPortFromRecords(oldPorts)
+		if port <= 0 {
+			continue
+		}
+
+		var entries []forwardPortReplaceEntry
+		if allowInIP {
+			entries = buildForwardPortEntriesWithPreservedInIP(entryNodeIDs, oldPorts, port)
+		} else {
+			entries = make([]forwardPortReplaceEntry, 0, len(entryNodeIDs))
+			for _, nid := range entryNodeIDs {
+				entries = append(entries, forwardPortReplaceEntry{NodeID: nid, Port: port, InIP: ""})
+			}
+		}
+		_ = h.repo.ReplaceForwardPorts(f.ID, entries)
+	}
+}
+
 func (h *Handler) tunnelDelete(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
@@ -1157,6 +1302,10 @@ func (h *Handler) forwardCreate(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("隧道已禁用，无法创建转发"))
 		return
 	}
+	if err := h.ensureUserTunnelForwardAllowed(userID, tunnelID, time.Now().UnixMilli()); err != nil {
+		response.WriteJSON(w, response.ErrDefault(err.Error()))
+		return
+	}
 	name := asString(req["name"])
 	remoteAddr := asString(req["remoteAddr"])
 	if name == "" || remoteAddr == "" {
@@ -1446,11 +1595,16 @@ func (h *Handler) forwardResume(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+	now := time.Now().UnixMilli()
+	if err := h.ensureUserTunnelForwardAllowed(forward.UserID, forward.TunnelID, now); err != nil {
+		response.WriteJSON(w, response.ErrDefault(err.Error()))
+		return
+	}
 	if err := h.controlForwardServices(forward, "ResumeService", false); err != nil {
 		response.WriteJSON(w, response.ErrDefault(err.Error()))
 		return
 	}
-	_ = h.repo.UpdateForwardStatus(id, 1, time.Now().UnixMilli())
+	_ = h.repo.UpdateForwardStatus(id, 1, now)
 	response.WriteJSON(w, response.OKEmpty())
 }

@@ -1573,17 +1727,22 @@ func (h *Handler) forwardBatchResume(w http.ResponseWriter, r *http.Request) {
 	}
 	s := 0
 	f := 0
+	now := time.Now().UnixMilli()
 	for _, id := range ids {
 		forward, accessErr := h.ensureForwardAccessByActor(actorUserID, actorRole, id)
 		if accessErr != nil {
 			f++
 			continue
 		}
+		if err := h.ensureUserTunnelForwardAllowed(forward.UserID, forward.TunnelID, now); err != nil {
+			f++
+			continue
+		}
 		if err := h.controlForwardServices(forward, "ResumeService", false); err != nil {
 			f++
 			continue
 		}
-		if err := h.repo.UpdateForwardStatus(id, 1, time.Now().UnixMilli()); err != nil {
+		if err := h.repo.UpdateForwardStatus(id, 1, now); err != nil {
 			f++
 		} else {
 			s++
@@ -61,7 +61,6 @@ type Node struct {
 	ID            int64          `gorm:"primaryKey;autoIncrement"`
 	Name          string         `gorm:"type:varchar(100);not null"`
 	Remark        sql.NullString `gorm:"column:remark;type:text"`
-	Tags          sql.NullString `gorm:"column:tags;type:text"`
 	ExpiryTime    sql.NullInt64  `gorm:"column:expiry_time"`
 	RenewalCycle  sql.NullString `gorm:"column:renewal_cycle;type:varchar(20)"`
 	Secret        string         `gorm:"type:varchar(100);not null"`
@@ -341,7 +340,6 @@ type NodeBackup struct {
 	ID            int64  `json:"id"`
 	Name          string `json:"name"`
 	Remark        string `json:"remark,omitempty"`
-	Tags          string `json:"tags,omitempty"`
 	ExpiryTime    int64  `json:"expiryTime,omitempty"`
 	RenewalCycle  string `json:"renewalCycle,omitempty"`
 	Secret        string `json:"secret"`
@@ -260,7 +260,7 @@ func prepareSQLiteLegacyColumns(db *gorm.DB) error {
 	m := db.Migrator()

 	if m.HasTable(&model.Node{}) {
-		for _, field := range []string{"ServerIPV4", "ServerIPV6", "ExtraIPs", "TCPListenAddr", "UDPListenAddr", "Inx", "IsRemote", "RemoteURL", "RemoteToken", "RemoteConfig", "Remark", "Tags", "ExpiryTime", "RenewalCycle"} {
+		for _, field := range []string{"ServerIPV4", "ServerIPV6", "ExtraIPs", "TCPListenAddr", "UDPListenAddr", "Inx", "IsRemote", "RemoteURL", "RemoteToken", "RemoteConfig", "Remark", "ExpiryTime", "RenewalCycle"} {
 			if m.HasColumn(&model.Node{}, field) {
 				continue
 			}
@@ -635,7 +635,6 @@ func (r *Repository) ListNodes() ([]map[string]interface{}, error) {
 		items = append(items, map[string]interface{}{
 			"id": n.ID, "inx": n.Inx, "name": n.Name,
 			"remark":       nullableString(n.Remark),
-			"tags":         nullableString(n.Tags),
 			"expiryTime":   nullableInt64(n.ExpiryTime),
 			"renewalCycle": nullableString(n.RenewalCycle),
 			"ip":           n.ServerIP, "serverIp": n.ServerIP,
@@ -1820,7 +1819,7 @@ func (r *Repository) exportNodes() ([]model.NodeBackup, error) {
 	for _, n := range nodes {
 		b := model.NodeBackup{
 			ID: n.ID, Name: n.Name, Secret: n.Secret, ServerIP: n.ServerIP,
-			Remark: n.Remark.String, Tags: n.Tags.String, RenewalCycle: n.RenewalCycle.String,
+			Remark: n.Remark.String, RenewalCycle: n.RenewalCycle.String,
 			Port: n.Port, HTTP: n.HTTP, TLS: n.TLS, Socks: n.Socks,
 			CreatedTime: n.CreatedTime, Status: n.Status,
 			TCPListenAddr: n.TCPListenAddr, UDPListenAddr: n.UDPListenAddr,
@@ -2179,7 +2178,6 @@ func importNodes(tx *gorm.DB, nodes []model.NodeBackup, now int64) (int, error)
 			ID:            n.ID,
 			Name:          n.Name,
 			Remark:        sql.NullString{String: n.Remark, Valid: n.Remark != ""},
-			Tags:          sql.NullString{String: n.Tags, Valid: n.Tags != ""},
 			ExpiryTime:    sql.NullInt64{Int64: n.ExpiryTime, Valid: n.ExpiryTime > 0},
 			RenewalCycle:  sql.NullString{String: n.RenewalCycle, Valid: n.RenewalCycle != ""},
 			Secret:        n.Secret,
@@ -2206,7 +2204,7 @@ func importNodes(tx *gorm.DB, nodes []model.NodeBackup, now int64) (int, error)
 		err := tx.Clauses(clause.OnConflict{
 			Columns: []clause.Column{{Name: "id"}},
 			DoUpdates: clause.AssignmentColumns([]string{
-				"name", "remark", "tags", "expiry_time", "renewal_cycle", "secret", "server_ip", "server_ip_v4", "server_ip_v6", "port", "interface_name", "version",
+				"name", "remark", "expiry_time", "renewal_cycle", "secret", "server_ip", "server_ip_v4", "server_ip_v6", "port", "interface_name", "version",
 				"http", "tls", "socks", "updated_time", "status", "tcp_listen_addr", "udp_listen_addr",
 				"inx", "is_remote", "remote_url", "remote_token", "remote_config",
 			}),
@@ -51,7 +51,7 @@ func TestPrepareSQLiteLegacyColumnsAddsNodeMetadataColumns(t *testing.T) {
 	}

 	m := db.Migrator()
-	for _, field := range []string{"Remark", "Tags", "ExpiryTime", "RenewalCycle"} {
+	for _, field := range []string{"Remark", "ExpiryTime", "RenewalCycle"} {
 		if !m.HasColumn(&model.Node{}, field) {
 			t.Fatalf("expected node.%s column to exist", field)
 		}
@@ -197,14 +197,13 @@ func (r *Repository) GetUserDefaultsForTunnel(userID int64) (flow int64, num int
 	return user.Flow, user.Num, user.ExpTime, user.FlowResetTime, nil
 }

-func (r *Repository) CreateNode(name, secret, serverIP string, serverIPV4, serverIPV6, port, interfaceName, version, remark, tags, expiryTime, renewalCycle interface{}, httpFlag, tlsFlag, socksFlag int, now int64, status int, tcpAddr, udpAddr string, inx, isRemote int, remoteURL, remoteToken, remoteConfig, extraIPs interface{}) error {
+func (r *Repository) CreateNode(name, secret, serverIP string, serverIPV4, serverIPV6, port, interfaceName, version, remark, expiryTime, renewalCycle interface{}, httpFlag, tlsFlag, socksFlag int, now int64, status int, tcpAddr, udpAddr string, inx, isRemote int, remoteURL, remoteToken, remoteConfig, extraIPs interface{}) error {
 	if r == nil || r.db == nil {
 		return errors.New("repository not initialized")
 	}
 	node := model.Node{
 		Name:          name,
 		Remark:        nullStringFromInterface(remark),
-		Tags:          nullStringFromInterface(tags),
 		ExpiryTime:    nullInt64FromInterface(expiryTime),
 		RenewalCycle:  nullStringFromInterface(renewalCycle),
 		Secret:        secret,
@@ -244,7 +243,7 @@ func (r *Repository) GetNodeStatusFields(nodeID int64) (status, httpFlag, tlsFla
 	return node.Status, node.HTTP, node.TLS, node.Socks, nil
 }

-func (r *Repository) UpdateNode(id int64, name, serverIP string, serverIPV4, serverIPV6, port, interfaceName, extraIPs, remark, tags, expiryTime, renewalCycle interface{}, httpFlag, tlsFlag, socksFlag int, tcpAddr, udpAddr string, now int64) error {
+func (r *Repository) UpdateNode(id int64, name, serverIP string, serverIPV4, serverIPV6, port, interfaceName, extraIPs, remark, expiryTime, renewalCycle interface{}, httpFlag, tlsFlag, socksFlag int, tcpAddr, udpAddr string, now int64) error {
 	if r == nil || r.db == nil {
 		return errors.New("repository not initialized")
 	}
@@ -253,7 +252,6 @@ func (r *Repository) UpdateNode(id int64, name, serverIP string, serverIPV4, ser
 		Updates(map[string]interface{}{
 			"name":            name,
 			"remark":          nullStringFromInterface(remark),
-			"tags":            nullStringFromInterface(tags),
 			"expiry_time":     nullInt64FromInterface(expiryTime),
 			"renewal_cycle":   nullStringFromInterface(renewalCycle),
 			"server_ip":       serverIP,
@@ -0,0 +1,201 @@
+package contract_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/response"
+)
+
+const contractBytesPerGB int64 = 1024 * 1024 * 1024
+
+func TestForwardResumeBlockedWhenUserFlowExceeded(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	userID := int64(2)
+	tunnelID := int64(1)
+	forwardID := int64(1)
+
+	flowGB := int64(120)
+	used := flowGB*contractBytesPerGB + 1
+
+	if err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(?, 'flow_user', 'pwd', 1, 2727251700000, ?, ?, 0, 1, 99999, ?, ?, 1)
+	`, userID, flowGB, used, now, now).Error; err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	if err := repo.DB().Exec(`
+		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, 'flow_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	if err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
+	`, userID, tunnelID).Error; err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+	if err := repo.DB().Exec(`
+		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, 'flow_user', 'flow_forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 0, 0)
+	`, forwardID, userID, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+
+	token, err := auth.GenerateToken(userID, "flow_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate token: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/resume", bytes.NewBufferString(`{"id":1}`))
+	req.Header.Set("Authorization", token)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code == 0 {
+		t.Fatalf("expected non-zero code when flow exceeded")
+	}
+	if !strings.Contains(out.Msg, "流量") {
+		t.Fatalf("expected flow exceeded message, got %q", out.Msg)
+	}
+
+	status := mustQueryInt(t, repo, `SELECT status FROM forward WHERE id = ?`, forwardID)
+	if status != 0 {
+		t.Fatalf("expected forward status to remain 0, got %d", status)
+	}
+}
+
+func TestForwardResumeBlockedWhenUserTunnelFlowExceeded(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	userID := int64(2)
+	tunnelID := int64(1)
+	forwardID := int64(1)
+
+	if err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(?, 'ut_flow_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, userID, now, now).Error; err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	if err := repo.DB().Exec(`
+		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, 'ut_flow_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+
+	utFlowGB := int64(120)
+	utUsed := utFlowGB * contractBytesPerGB
+	if err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(10, ?, ?, NULL, 99999, ?, ?, 0, 1, 2727251700000, 1)
+	`, userID, tunnelID, utFlowGB, utUsed).Error; err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+	if err := repo.DB().Exec(`
+		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, 'ut_flow_user', 'ut_flow_forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 0, 0)
+	`, forwardID, userID, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+
+	token, err := auth.GenerateToken(userID, "ut_flow_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate token: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/resume", bytes.NewBufferString(`{"id":1}`))
+	req.Header.Set("Authorization", token)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code == 0 {
+		t.Fatalf("expected non-zero code when tunnel flow exceeded")
+	}
+	if !strings.Contains(out.Msg, "隧道") || !strings.Contains(out.Msg, "流量") {
+		t.Fatalf("expected tunnel flow exceeded message, got %q", out.Msg)
+	}
+}
+
+func TestForwardCreateBlockedWhenFlowExceeded(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	userID := int64(2)
+	tunnelID := int64(1)
+
+	flowGB := int64(120)
+	used := flowGB*contractBytesPerGB + 1
+
+	if err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(?, 'create_flow_user', 'pwd', 1, 2727251700000, ?, ?, 0, 1, 99999, ?, ?, 1)
+	`, userID, flowGB, used, now, now).Error; err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	if err := repo.DB().Exec(`
+		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, 'create_flow_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	if err := repo.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
+	`, userID, tunnelID).Error; err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+
+	token, err := auth.GenerateToken(userID, "create_flow_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate token: %v", err)
+	}
+
+	payload := `{"tunnelId":1,"name":"n","remoteAddr":"1.1.1.1:53"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(payload))
+	req.Header.Set("Authorization", token)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	router.ServeHTTP(res, req)
+
+	var out response.R
+	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if out.Code == 0 {
+		t.Fatalf("expected non-zero code when flow exceeded")
+	}
+	if !strings.Contains(out.Msg, "流量") {
+		t.Fatalf("expected flow exceeded message, got %q", out.Msg)
+	}
+}
@@ -667,6 +667,421 @@ func TestTunnelUpdateRecoversFromAddressInUseContract(t *testing.T) {
 	}
 }

+func TestTunnelUpdateChangesEntryNodeButLeavesOldForwardRuntimeContract(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, r := setupContractRouter(t, secret)
+	server := httptest.NewServer(router)
+	defer server.Close()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	now := time.Now().UnixMilli()
+	if err := r.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'issue281_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now).Error; err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	if err := r.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "issue281-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID := mustLastInsertID(t, r, "issue281-tunnel")
+
+	insertNode := func(name, secretValue, ip, portRange string, inx int) int64 {
+		if err := r.DB().Exec(`
+			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, secretValue, ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", inx).Error; err != nil {
+			t.Fatalf("insert node %s: %v", name, err)
+		}
+		return mustLastInsertID(t, r, name)
+	}
+
+	oldEntryNodeID := insertNode("issue281-old-entry", "issue281-old-entry-secret", "10.51.0.1", "51000-51010", 0)
+	newEntryNodeID := insertNode("issue281-new-entry", "issue281-new-entry-secret", "10.51.0.2", "52000-52010", 1)
+	exitNodeID := insertNode("issue281-exit", "issue281-exit-secret", "10.51.0.3", "53000-53010", 2)
+
+	if err := r.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 1, ?, 51001, 'round', 1, 'tls')
+	`, tunnelID, oldEntryNodeID).Error; err != nil {
+		t.Fatalf("insert old entry chain_tunnel: %v", err)
+	}
+	if err := r.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 3, ?, 53001, 'round', 1, 'tls')
+	`, tunnelID, exitNodeID).Error; err != nil {
+		t.Fatalf("insert exit chain_tunnel: %v", err)
+	}
+
+	if err := r.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(281, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
+	`, tunnelID).Error; err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+
+	if err := r.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(2, 'issue281_user', 'issue281-forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
+	`, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+	forwardID := mustLastInsertID(t, r, "issue281-forward")
+
+	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, oldEntryNodeID, 51001).Error; err != nil {
+		t.Fatalf("insert forward_port: %v", err)
+	}
+
+	forwardBase := fmt.Sprintf("%d_%d_%d", forwardID, 2, 281)
+
+	var commandMu sync.Mutex
+	oldEntryDeleteNames := make([]string, 0)
+	newEntryUpdateNames := make([]string, 0)
+
+	recordForwardServiceNames := func(data json.RawMessage, list *[]string) {
+		var serviceList []map[string]interface{}
+		if err := json.Unmarshal(data, &serviceList); err == nil {
+			for _, service := range serviceList {
+				name, _ := service["name"].(string)
+				if strings.HasPrefix(strings.TrimSpace(name), forwardBase) {
+					*list = append(*list, name)
+				}
+			}
+			return
+		}
+
+		var payload map[string]interface{}
+		if err := json.Unmarshal(data, &payload); err != nil {
+			return
+		}
+		if rawServices, ok := payload["services"].([]interface{}); ok {
+			for _, raw := range rawServices {
+				name, _ := raw.(string)
+				if strings.HasPrefix(strings.TrimSpace(name), forwardBase) {
+					*list = append(*list, name)
+				}
+			}
+			return
+		}
+	}
+
+	stopOldEntry := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-old-entry-secret", func(cmdType string, data json.RawMessage) (bool, string) {
+		commandMu.Lock()
+		defer commandMu.Unlock()
+		if strings.EqualFold(strings.TrimSpace(cmdType), "DeleteService") {
+			recordForwardServiceNames(data, &oldEntryDeleteNames)
+		}
+		return false, ""
+	})
+	defer stopOldEntry()
+
+	stopNewEntry := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-new-entry-secret", func(cmdType string, data json.RawMessage) (bool, string) {
+		commandMu.Lock()
+		defer commandMu.Unlock()
+		if strings.EqualFold(strings.TrimSpace(cmdType), "UpdateService") || strings.EqualFold(strings.TrimSpace(cmdType), "AddService") {
+			recordForwardServiceNames(data, &newEntryUpdateNames)
+		}
+		return false, ""
+	})
+	defer stopNewEntry()
+
+	stopExit := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-exit-secret", func(cmdType string, data json.RawMessage) (bool, string) {
+		return false, ""
+	})
+	defer stopExit()
+
+	waitNodeStatus(t, r, oldEntryNodeID, 1)
+	waitNodeStatus(t, r, newEntryNodeID, 1)
+	waitNodeStatus(t, r, exitNodeID, 1)
+
+	payload := map[string]interface{}{
+		"id":           tunnelID,
+		"name":         "issue281-tunnel",
+		"type":         2,
+		"flow":         99999,
+		"trafficRatio": 1.0,
+		"status":       1,
+		"inNodeId": []map[string]interface{}{
+			{"nodeId": newEntryNodeID, "protocol": "tls", "strategy": "round"},
+		},
+		"chainNodes": []interface{}{},
+		"outNodeId": []map[string]interface{}{
+			{"nodeId": exitNodeID, "protocol": "tls", "strategy": "round", "port": 53001},
+		},
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("marshal payload: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", bytes.NewReader(body))
+	req.Header.Set("Authorization", adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+	router.ServeHTTP(res, req)
+	assertCode(t, res, 0)
+
+	nodeAfter, portAfter := mustQueryInt64Int(t, r, `SELECT node_id, port FROM forward_port WHERE forward_id = ? LIMIT 1`, forwardID)
+	if nodeAfter != newEntryNodeID || portAfter != 51001 {
+		t.Fatalf("expected forward_port rebound to node=%d port=51001, got node=%d port=%d", newEntryNodeID, nodeAfter, portAfter)
+	}
+
+	commandMu.Lock()
+	defer commandMu.Unlock()
+	if len(newEntryUpdateNames) == 0 {
+		t.Fatalf("expected new entry node to receive forward runtime sync for %s", forwardBase)
+	}
+	if len(oldEntryDeleteNames) == 0 {
+		t.Fatalf("expected old entry node to receive forward DeleteService cleanup for %s, got none", forwardBase)
+	}
+}
+
+func TestTunnelUpdateEntryTransitionsCleanupForwardRuntimeContract(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, r := setupContractRouter(t, secret)
+	server := httptest.NewServer(router)
+	defer server.Close()
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	now := time.Now().UnixMilli()
+	if err := r.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'issue281_transition_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now).Error; err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	if err := r.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "issue281-transition-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID := mustLastInsertID(t, r, "issue281-transition-tunnel")
+
+	insertNode := func(name, secretValue, ip, portRange string, inx int) int64 {
+		if err := r.DB().Exec(`
+			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
+			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`, name, secretValue, ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", inx).Error; err != nil {
+			t.Fatalf("insert node %s: %v", name, err)
+		}
+		return mustLastInsertID(t, r, name)
+	}
+
+	entryA := insertNode("issue281-transition-entry-a", "issue281-transition-entry-a-secret", "10.52.0.1", "54000-54010", 0)
+	entryB := insertNode("issue281-transition-entry-b", "issue281-transition-entry-b-secret", "10.52.0.2", "55000-55010", 1)
+	entryC := insertNode("issue281-transition-entry-c", "issue281-transition-entry-c-secret", "10.52.0.3", "56000-56010", 2)
+	exitNodeID := insertNode("issue281-transition-exit", "issue281-transition-exit-secret", "10.52.0.4", "57000-57010", 3)
+
+	if err := r.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 1, ?, 54001, 'round', 1, 'tls')
+	`, tunnelID, entryA).Error; err != nil {
+		t.Fatalf("insert initial entry chain_tunnel: %v", err)
+	}
+	if err := r.DB().Exec(`
+		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
+		VALUES(?, 3, ?, 57001, 'round', 1, 'tls')
+	`, tunnelID, exitNodeID).Error; err != nil {
+		t.Fatalf("insert exit chain_tunnel: %v", err)
+	}
+
+	if err := r.DB().Exec(`
+		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
+		VALUES(282, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
+	`, tunnelID).Error; err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+
+	if err := r.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(2, 'issue281_transition_user', 'issue281-transition-forward', ?, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
+	`, tunnelID, now, now).Error; err != nil {
+		t.Fatalf("insert forward: %v", err)
+	}
+	forwardID := mustLastInsertID(t, r, "issue281-transition-forward")
+
+	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, entryA, 54001).Error; err != nil {
+		t.Fatalf("insert forward_port: %v", err)
+	}
+
+	forwardBase := fmt.Sprintf("%d_%d_%d", forwardID, 2, 282)
+	recorder := newForwardRuntimeCommandRecorder(forwardBase)
+
+	stopEntryA := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-transition-entry-a-secret", recorder.handler("entry-a"))
+	defer stopEntryA()
+	stopEntryB := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-transition-entry-b-secret", recorder.handler("entry-b"))
+	defer stopEntryB()
+	stopEntryC := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-transition-entry-c-secret", recorder.handler("entry-c"))
+	defer stopEntryC()
+	stopExit := startMockNodeSessionWithCommandRecorder(t, server.URL, "issue281-transition-exit-secret", recorder.handler("exit"))
+	defer stopExit()
+
+	waitNodeStatus(t, r, entryA, 1)
+	waitNodeStatus(t, r, entryB, 1)
+	waitNodeStatus(t, r, entryC, 1)
+	waitNodeStatus(t, r, exitNodeID, 1)
+
+	updateTunnelEntries := func(entries []map[string]interface{}) {
+		payload := map[string]interface{}{
+			"id":           tunnelID,
+			"name":         "issue281-transition-tunnel",
+			"type":         2,
+			"flow":         99999,
+			"trafficRatio": 1.0,
+			"status":       1,
+			"inNodeId":     entries,
+			"chainNodes":   []interface{}{},
+			"outNodeId": []map[string]interface{}{
+				{"nodeId": exitNodeID, "protocol": "tls", "strategy": "round", "port": 57001},
+			},
+		}
+		body, err := json.Marshal(payload)
+		if err != nil {
+			t.Fatalf("marshal payload: %v", err)
+		}
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", bytes.NewReader(body))
+		req.Header.Set("Authorization", adminToken)
+		req.Header.Set("Content-Type", "application/json")
+		res := httptest.NewRecorder()
+		router.ServeHTTP(res, req)
+		assertCode(t, res, 0)
+	}
+
+	updateTunnelEntries([]map[string]interface{}{
+		{"nodeId": entryA, "protocol": "tls", "strategy": "round"},
+		{"nodeId": entryB, "protocol": "tls", "strategy": "round"},
+	})
+
+	afterMulti := mustQueryNodePorts(t, r, `SELECT node_id, port FROM forward_port WHERE forward_id = ? ORDER BY id ASC`, forwardID)
+	if len(afterMulti) != 2 || afterMulti[entryA] != 54001 || afterMulti[entryB] != 54001 {
+		t.Fatalf("expected forward_port on entryA+entryB with port 54001, got %v", afterMulti)
+	}
+	if recorder.syncCount("entry-b") == 0 {
+		t.Fatalf("expected entry-b to receive forward runtime sync for %s", forwardBase)
+	}
+	if recorder.deleteCount("entry-a") != 0 {
+		t.Fatalf("expected no cleanup on retained entry-a during single->multi transition, got %v", recorder.deleteNames("entry-a"))
+	}
+
+	updateTunnelEntries([]map[string]interface{}{
+		{"nodeId": entryC, "protocol": "tls", "strategy": "round"},
+	})
+
+	afterSingle := mustQueryNodePorts(t, r, `SELECT node_id, port FROM forward_port WHERE forward_id = ? ORDER BY id ASC`, forwardID)
+	if len(afterSingle) != 1 || afterSingle[entryC] != 54001 {
+		t.Fatalf("expected forward_port on entryC with port 54001, got %v", afterSingle)
+	}
+	if recorder.deleteCount("entry-a") == 0 {
+		t.Fatalf("expected cleanup on removed entry-a during multi->single transition, got %v", recorder.deleteNames("entry-a"))
+	}
+	if recorder.deleteCount("entry-b") == 0 {
+		t.Fatalf("expected cleanup on removed entry-b during multi->single transition, got %v", recorder.deleteNames("entry-b"))
+	}
+	if recorder.syncCount("entry-c") == 0 {
+		t.Fatalf("expected entry-c to receive forward runtime sync for %s", forwardBase)
+	}
+}
+
+type forwardRuntimeCommandRecorder struct {
+	prefix string
+
+	mu        sync.Mutex
+	deletes   map[string][]string
+	syncNames map[string][]string
+}
+
+func newForwardRuntimeCommandRecorder(prefix string) *forwardRuntimeCommandRecorder {
+	return &forwardRuntimeCommandRecorder{
+		prefix:    strings.TrimSpace(prefix),
+		deletes:   make(map[string][]string),
+		syncNames: make(map[string][]string),
+	}
+}
+
+func (r *forwardRuntimeCommandRecorder) handler(node string) func(string, json.RawMessage) (bool, string) {
+	return func(cmdType string, data json.RawMessage) (bool, string) {
+		names := collectForwardServiceNames(data, r.prefix)
+		if len(names) == 0 {
+			return false, ""
+		}
+
+		r.mu.Lock()
+		defer r.mu.Unlock()
+
+		if strings.EqualFold(strings.TrimSpace(cmdType), "DeleteService") {
+			r.deletes[node] = append(r.deletes[node], names...)
+		}
+		if strings.EqualFold(strings.TrimSpace(cmdType), "UpdateService") || strings.EqualFold(strings.TrimSpace(cmdType), "AddService") {
+			r.syncNames[node] = append(r.syncNames[node], names...)
+		}
+		return false, ""
+	}
+}
+
+func (r *forwardRuntimeCommandRecorder) deleteCount(node string) int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return len(r.deletes[node])
+}
+
+func (r *forwardRuntimeCommandRecorder) syncCount(node string) int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return len(r.syncNames[node])
+}
+
+func (r *forwardRuntimeCommandRecorder) deleteNames(node string) []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return append([]string(nil), r.deletes[node]...)
+}
+
+func collectForwardServiceNames(data json.RawMessage, prefix string) []string {
+	prefix = strings.TrimSpace(prefix)
+	if prefix == "" {
+		return nil
+	}
+
+	names := make([]string, 0)
+	var serviceList []map[string]interface{}
+	if err := json.Unmarshal(data, &serviceList); err == nil {
+		for _, service := range serviceList {
+			name, _ := service["name"].(string)
+			if strings.HasPrefix(strings.TrimSpace(name), prefix) {
+				names = append(names, name)
+			}
+		}
+		return names
+	}
+
+	var payload map[string]interface{}
+	if err := json.Unmarshal(data, &payload); err != nil {
+		return nil
+	}
+	if rawServices, ok := payload["services"].([]interface{}); ok {
+		for _, raw := range rawServices {
+			name, _ := raw.(string)
+			if strings.HasPrefix(strings.TrimSpace(name), prefix) {
+				names = append(names, name)
+			}
+		}
+	}
+	return names
+}
+
 func startMockNodeSessionWithCommandFailures(t *testing.T, baseURL string, nodeSecret string, failCommands map[string]string) func() {
 	t.Helper()

@@ -109,12 +109,12 @@ func main() {
 	// 加载配置文件
 	config, err := LoadConfig("config.json")
 	if err != nil {
-		fmt.Println("❌ 配置加载失败: %v\n", err)
+		fmt.Printf("❌ 配置加载失败: %v\n", err)
 		fmt.Println("请确保当前目录存在 config.json 文件")
 		os.Exit(1)
 	}

-	fmt.Println("✅ 配置加载成功 - addr: %s", config.Addr)
+	fmt.Printf("✅ 配置加载成功 - addr: %s\n", config.Addr)

 	log := xlogger.NewLogger()
 	logger.SetDefault(log)
@@ -6,7 +6,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
+	"sync"
 	"time"

 	"github.com/go-gost/core/observer/stats"
@@ -18,6 +20,15 @@ import (
 var httpReportURL string
 var configReportURL string
 var httpAESCrypto *crypto.AESCrypto // 新增：HTTP上报加密器
+var reportURLPreferenceMutex sync.RWMutex
+var preferredUploadURL string
+var preferredConfigURL string
+var reportDo = func(ctx context.Context, req *http.Request, timeout time.Duration) (*http.Response, error) {
+	client := &http.Client{
+		Timeout: timeout,
+	}
+	return client.Do(req.WithContext(ctx))
+}

 // TrafficReportItem 流量报告项（压缩格式）
 type TrafficReportItem struct {
@@ -27,8 +38,17 @@ type TrafficReportItem struct {
 }

 func SetHTTPReportURL(addr string, secret string) {
-	httpReportURL = "http://" + addr + "/flow/upload?secret=" + secret
-	configReportURL = "http://" + addr + "/flow/config?secret=" + secret
+	uploadURLs, configURLs := buildReportURLCandidates(addr, secret)
+	if len(uploadURLs) > 0 {
+		httpReportURL = strings.Join(uploadURLs, ",")
+	}
+	if len(configURLs) > 0 {
+		configReportURL = strings.Join(configURLs, ",")
+	}
+	reportURLPreferenceMutex.Lock()
+	preferredUploadURL = ""
+	preferredConfigURL = ""
+	reportURLPreferenceMutex.Unlock()

 	// 创建 AES 加密器
 	var err error
@@ -41,8 +61,173 @@ func SetHTTPReportURL(addr string, secret string) {
 	}
 }

+func buildReportURLCandidates(addr string, secret string) (upload []string, config []string) {
+	normalizedAddr, explicitScheme := normalizeReportAddress(addr)
+	if normalizedAddr == "" {
+		normalizedAddr = strings.TrimSpace(addr)
+	}
+
+	schemes := []string{"https", "http"}
+	if mappedScheme := mapToHTTPScheme(explicitScheme); mappedScheme == "http" {
+		schemes = []string{"http", "https"}
+	}
+
+	upload = []string{
+		schemes[0] + "://" + normalizedAddr + "/flow/upload?secret=" + secret,
+		schemes[1] + "://" + normalizedAddr + "/flow/upload?secret=" + secret,
+	}
+	config = []string{
+		schemes[0] + "://" + normalizedAddr + "/flow/config?secret=" + secret,
+		schemes[1] + "://" + normalizedAddr + "/flow/config?secret=" + secret,
+	}
+	return upload, config
+}
+
+func normalizeReportAddress(addr string) (string, string) {
+	raw := strings.TrimSpace(addr)
+	if raw == "" {
+		return "", ""
+	}
+
+	scheme := ""
+	if idx := strings.Index(raw, "://"); idx > 0 {
+		scheme = strings.ToLower(strings.TrimSpace(raw[:idx]))
+		if parsed, err := url.Parse(raw); err == nil {
+			if host := strings.TrimSpace(parsed.Host); host != "" {
+				return host, scheme
+			}
+		}
+		raw = raw[idx+3:]
+	}
+
+	if idx := strings.IndexAny(raw, "/?#"); idx >= 0 {
+		raw = raw[:idx]
+	}
+	return strings.TrimSpace(raw), scheme
+}
+
+func mapToHTTPScheme(scheme string) string {
+	switch strings.ToLower(strings.TrimSpace(scheme)) {
+	case "https", "wss":
+		return "https"
+	case "http", "ws":
+		return "http"
+	default:
+		return ""
+	}
+}
+
+func loadPreferredURL(preferred *string) string {
+	if preferred == nil {
+		return ""
+	}
+
+	reportURLPreferenceMutex.RLock()
+	defer reportURLPreferenceMutex.RUnlock()
+	return *preferred
+}
+
+func storePreferredURL(preferred *string, value string) {
+	if preferred == nil {
+		return
+	}
+
+	reportURLPreferenceMutex.Lock()
+	defer reportURLPreferenceMutex.Unlock()
+	*preferred = value
+}
+
+func prioritizeURLs(urls []string, preferred string) []string {
+	ordered := append([]string(nil), urls...)
+	if preferred == "" || len(ordered) < 2 {
+		return ordered
+	}
+
+	for i, targetURL := range ordered {
+		if targetURL == preferred {
+			if i > 0 {
+				ordered[0], ordered[i] = ordered[i], ordered[0]
+			}
+			break
+		}
+	}
+
+	return ordered
+}
+
+func postJSONWithFallback(ctx context.Context, urls []string, requestBody []byte, userAgent string, timeout time.Duration, preferred *string) (bool, error) {
+	if len(urls) == 0 {
+		return false, fmt.Errorf("上报URL未设置")
+	}
+
+	orderedURLs := prioritizeURLs(urls, loadPreferredURL(preferred))
+
+	var errs []string
+	for i, targetURL := range orderedURLs {
+		req, err := http.NewRequest("POST", targetURL, bytes.NewBuffer(requestBody))
+		if err != nil {
+			errs = append(errs, fmt.Sprintf("%s => 创建请求失败: %v", targetURL, err))
+			if i < len(orderedURLs)-1 {
+				fmt.Printf("⚠️ HTTP上报尝试失败，准备回退: %s => 创建请求失败: %v\n", targetURL, err)
+			}
+			continue
+		}
+
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("User-Agent", userAgent)
+
+		resp, err := reportDo(ctx, req, timeout)
+		if err != nil {
+			errs = append(errs, fmt.Sprintf("%s => 请求失败: %v", targetURL, err))
+			if i < len(orderedURLs)-1 {
+				fmt.Printf("⚠️ HTTP上报尝试失败，准备回退: %s => 请求失败: %v\n", targetURL, err)
+			}
+			continue
+		}
+
+		var responseBytes bytes.Buffer
+		_, readErr := responseBytes.ReadFrom(resp.Body)
+		resp.Body.Close()
+		if readErr != nil {
+			errs = append(errs, fmt.Sprintf("%s => 读取响应失败: %v", targetURL, readErr))
+			if i < len(orderedURLs)-1 {
+				fmt.Printf("⚠️ HTTP上报尝试失败，准备回退: %s => 读取响应失败: %v\n", targetURL, readErr)
+			}
+			continue
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			errs = append(errs, fmt.Sprintf("%s => HTTP响应错误: %d %s", targetURL, resp.StatusCode, resp.Status))
+			if i < len(orderedURLs)-1 {
+				fmt.Printf("⚠️ HTTP上报尝试失败，准备回退: %s => HTTP响应错误: %d %s\n", targetURL, resp.StatusCode, resp.Status)
+			}
+			continue
+		}
+
+		responseText := strings.TrimSpace(responseBytes.String())
+		if responseText == "ok" {
+			if i > 0 {
+				fmt.Printf("↪️ HTTP上报已自动回退到: %s\n", targetURL)
+			}
+			storePreferredURL(preferred, targetURL)
+			return true, nil
+		}
+
+		errs = append(errs, fmt.Sprintf("%s => 服务器响应: %s (期望: ok)", targetURL, responseText))
+		if i < len(orderedURLs)-1 {
+			fmt.Printf("⚠️ HTTP上报尝试失败，准备回退: %s => 服务器响应: %s (期望: ok)\n", targetURL, responseText)
+		}
+	}
+
+	return false, fmt.Errorf("发送HTTP请求失败: %s", strings.Join(errs, " | "))
+}
+
 // sendBatchTrafficReport 批量发送多个服务的流量报告到HTTP接口
 func sendBatchTrafficReport(ctx context.Context, reportItems []TrafficReportItem) (bool, error) {
+	if httpReportURL == "" {
+		return false, fmt.Errorf("流量上报URL未设置")
+	}
+
 	jsonData, err := json.Marshal(reportItems)
 	if err != nil {
 		return false, fmt.Errorf("序列化报告数据失败: %v", err)
@@ -73,46 +258,16 @@ func sendBatchTrafficReport(ctx context.Context, reportItems []TrafficReportItem
 		requestBody = jsonData
 	}

-	req, err := http.NewRequestWithContext(ctx, "POST", httpReportURL, bytes.NewBuffer(requestBody))
-	if err != nil {
-		return false, fmt.Errorf("创建HTTP请求失败: %v", err)
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("User-Agent", "GOST-Traffic-Reporter/1.0")
-
-	client := &http.Client{
-		Timeout: 5 * time.Second,
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return false, fmt.Errorf("发送HTTP请求失败: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return false, fmt.Errorf("HTTP响应错误: %d %s", resp.StatusCode, resp.Status)
-	}
-
-	// 读取响应内容
-	var responseBytes bytes.Buffer
-	_, err = responseBytes.ReadFrom(resp.Body)
-	if err != nil {
-		return false, fmt.Errorf("读取响应内容失败: %v", err)
-	}
-
-	responseText := strings.TrimSpace(responseBytes.String())
-
-	// 检查响应是否为"ok"
-	if responseText == "ok" {
-		return true, nil
-	} else {
-		return false, fmt.Errorf("服务器响应: %s (期望: ok)", responseText)
-	}
+	return postJSONWithFallback(
+		ctx,
+		strings.Split(httpReportURL, ","),
+		requestBody,
+		"GOST-Traffic-Reporter/1.0",
+		5*time.Second,
+		&preferredUploadURL,
+	)
 }

-
 // sendConfigReport 发送配置报告到HTTP接口
 func sendConfigReport(ctx context.Context) (bool, error) {
 	if configReportURL == "" {
@@ -150,43 +305,14 @@ func sendConfigReport(ctx context.Context) (bool, error) {
 		requestBody = configData
 	}

-	req, err := http.NewRequestWithContext(ctx, "POST", configReportURL, bytes.NewBuffer(requestBody))
-	if err != nil {
-		return false, fmt.Errorf("创建HTTP请求失败: %v", err)
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("User-Agent", "Config-Reporter/1.0")
-
-	client := &http.Client{
-		Timeout: 10 * time.Second, // 配置上报可以稍长一些
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return false, fmt.Errorf("发送HTTP请求失败: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return false, fmt.Errorf("HTTP响应错误: %d %s", resp.StatusCode, resp.Status)
-	}
-
-	// 读取响应内容
-	var responseBytes bytes.Buffer
-	_, err = responseBytes.ReadFrom(resp.Body)
-	if err != nil {
-		return false, fmt.Errorf("读取响应内容失败: %v", err)
-	}
-
-	responseText := strings.TrimSpace(responseBytes.String())
-
-	// 检查响应是否为"ok"
-	if responseText == "ok" {
-		return true, nil
-	} else {
-		return false, fmt.Errorf("服务器响应: %s (期望: ok)", responseText)
-	}
+	return postJSONWithFallback(
+		ctx,
+		strings.Split(configReportURL, ","),
+		requestBody,
+		"Config-Reporter/1.0",
+		10*time.Second,
+		&preferredConfigURL,
+	)
 }

 // StartConfigReporter 启动配置定时上报器（每10分钟上报一次）
@@ -0,0 +1,150 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestBuildReportURLCandidatesSecureFirst(t *testing.T) {
+	upload, config := buildReportURLCandidates("panel.example.com:443", "abc")
+
+	if len(upload) != 2 {
+		t.Fatalf("expected 2 upload candidates, got %d", len(upload))
+	}
+	if len(config) != 2 {
+		t.Fatalf("expected 2 config candidates, got %d", len(config))
+	}
+
+	if upload[0] != "https://panel.example.com:443/flow/upload?secret=abc" {
+		t.Fatalf("unexpected upload[0]: %s", upload[0])
+	}
+	if upload[1] != "http://panel.example.com:443/flow/upload?secret=abc" {
+		t.Fatalf("unexpected upload[1]: %s", upload[1])
+	}
+	if config[0] != "https://panel.example.com:443/flow/config?secret=abc" {
+		t.Fatalf("unexpected config[0]: %s", config[0])
+	}
+	if config[1] != "http://panel.example.com:443/flow/config?secret=abc" {
+		t.Fatalf("unexpected config[1]: %s", config[1])
+	}
+}
+
+func TestBuildReportURLCandidatesNormalizeSchemeAddr(t *testing.T) {
+	upload, config := buildReportURLCandidates("https://panel.example.com:8443/path", "abc")
+
+	if upload[0] != "https://panel.example.com:8443/flow/upload?secret=abc" {
+		t.Fatalf("unexpected upload[0]: %s", upload[0])
+	}
+	if upload[1] != "http://panel.example.com:8443/flow/upload?secret=abc" {
+		t.Fatalf("unexpected upload[1]: %s", upload[1])
+	}
+	if config[0] != "https://panel.example.com:8443/flow/config?secret=abc" {
+		t.Fatalf("unexpected config[0]: %s", config[0])
+	}
+	if config[1] != "http://panel.example.com:8443/flow/config?secret=abc" {
+		t.Fatalf("unexpected config[1]: %s", config[1])
+	}
+}
+
+func TestPostJSONWithFallbackUsesHTTPAfterHTTPSFailure(t *testing.T) {
+	orig := reportDo
+	defer func() { reportDo = orig }()
+
+	var calls []string
+	reportDo = func(_ context.Context, req *http.Request, _ time.Duration) (*http.Response, error) {
+		calls = append(calls, req.URL.String())
+		if strings.HasPrefix(req.URL.String(), "https://") {
+			return nil, errors.New("tls handshake failed")
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Body:       io.NopCloser(strings.NewReader("ok")),
+		}, nil
+	}
+
+	ok, err := postJSONWithFallback(
+		context.Background(),
+		[]string{
+			"https://panel.example.com:443/flow/upload?secret=abc",
+			"http://panel.example.com:443/flow/upload?secret=abc",
+		},
+		[]byte(`[]`),
+		"GOST-Traffic-Reporter/1.0",
+		5*time.Second,
+		nil,
+	)
+	if !ok || err != nil {
+		t.Fatalf("expected fallback success, ok=%v err=%v", ok, err)
+	}
+	if len(calls) != 2 {
+		t.Fatalf("expected 2 calls, got %d", len(calls))
+	}
+	if !strings.HasPrefix(calls[0], "https://") || !strings.HasPrefix(calls[1], "http://") {
+		t.Fatalf("unexpected call order: %#v", calls)
+	}
+}
+
+func TestPostJSONWithFallbackRemembersDetectedURL(t *testing.T) {
+	orig := reportDo
+	defer func() { reportDo = orig }()
+
+	targets := []string{
+		"https://panel.example.com:443/flow/upload?secret=abc",
+		"http://panel.example.com:443/flow/upload?secret=abc",
+	}
+
+	var preferred string
+	var calls []string
+	reportDo = func(_ context.Context, req *http.Request, _ time.Duration) (*http.Response, error) {
+		calls = append(calls, req.URL.String())
+		if strings.HasPrefix(req.URL.String(), "https://") {
+			return nil, errors.New("tls handshake failed")
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Body:       io.NopCloser(strings.NewReader("ok")),
+		}, nil
+	}
+
+	ok, err := postJSONWithFallback(
+		context.Background(),
+		targets,
+		[]byte(`[]`),
+		"GOST-Traffic-Reporter/1.0",
+		5*time.Second,
+		&preferred,
+	)
+	if !ok || err != nil {
+		t.Fatalf("expected first call success, ok=%v err=%v", ok, err)
+	}
+	if preferred != targets[1] {
+		t.Fatalf("expected preferred url to be remembered as %s, got %s", targets[1], preferred)
+	}
+	if len(calls) != 2 {
+		t.Fatalf("expected 2 calls on first attempt, got %d", len(calls))
+	}
+
+	calls = nil
+	ok, err = postJSONWithFallback(
+		context.Background(),
+		targets,
+		[]byte(`[]`),
+		"GOST-Traffic-Reporter/1.0",
+		5*time.Second,
+		&preferred,
+	)
+	if !ok || err != nil {
+		t.Fatalf("expected second call success, ok=%v err=%v", ok, err)
+	}
+	if len(calls) != 1 {
+		t.Fatalf("expected second call to use remembered url once, got %d calls", len(calls))
+	}
+	if !strings.HasPrefix(calls[0], "http://") {
+		t.Fatalf("expected remembered http url first, got %s", calls[0])
+	}
+}
@@ -97,20 +97,25 @@ const (
 )

 type WebSocketReporter struct {
-	url            string
-	addr           string // 保存服务器地址
-	secret         string // 保存密钥
-	version        string // 保存版本号
-	conn           *websocket.Conn
-	reconnectTime  time.Duration
-	pingInterval   time.Duration
-	configInterval time.Duration
-	ctx            context.Context
-	cancel         context.CancelFunc
-	connected      bool
-	connecting     bool              // 新增：正在连接状态
-	connMutex      sync.Mutex        // 新增：连接状态锁
-	aesCrypto      *crypto.AESCrypto // 新增：AES加密器
+	url               string
+	addr              string // 保存服务器地址
+	secret            string // 保存密钥
+	version           string // 保存版本号
+	preferredWSScheme string
+	conn              *websocket.Conn
+	reconnectTime     time.Duration
+	pingInterval      time.Duration
+	configInterval    time.Duration
+	ctx               context.Context
+	cancel            context.CancelFunc
+	connected         bool
+	connecting        bool              // 新增：正在连接状态
+	connMutex         sync.Mutex        // 新增：连接状态锁
+	aesCrypto         *crypto.AESCrypto // 新增：AES加密器
+}
+
+var wsDial = func(dialer *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
+	return dialer.Dial(rawURL, nil)
 }

 // NewWebSocketReporter 创建一个新的WebSocket报告器
@@ -223,21 +228,14 @@ func (w *WebSocketReporter) connect() error {
 		json.Unmarshal(b, &cfg)
 	}

-	// 使用最新的配置重新构建 URL
-	currentURL := "ws://" + w.addr + "/system-info?type=1&secret=" + w.secret + "&version=" + w.version +
-		"&http=" + strconv.Itoa(cfg.Http) + "&tls=" + strconv.Itoa(cfg.Tls) + "&socks=" + strconv.Itoa(cfg.Socks)
-
-	u, err := url.Parse(currentURL)
-	if err != nil {
-		return fmt.Errorf("解析URL失败: %v", err)
-	}
+	candidates := buildWebSocketCandidates(w.addr, w.secret, w.version, cfg.Http, cfg.Tls, cfg.Socks, w.preferredWSScheme)

 	dialer := websocket.DefaultDialer
 	dialer.HandshakeTimeout = 10 * time.Second

-	conn, _, err := dialer.Dial(u.String(), nil)
+	conn, usedURL, err := dialWebSocketWithFallback(dialer, candidates)
 	if err != nil {
-		return fmt.Errorf("连接WebSocket失败: %v", err)
+		return err
 	}

 	// 如果在连接过程中已经有连接了，关闭新连接
@@ -248,6 +246,9 @@ func (w *WebSocketReporter) connect() error {

 	w.conn = conn
 	w.connected = true
+	if scheme := detectWebSocketScheme(usedURL); scheme != "" {
+		w.preferredWSScheme = scheme
+	}
 	_ = conn.SetReadDeadline(time.Now().Add(reporterReadWait))
 	conn.SetPingHandler(func(appData string) error {
 		_ = conn.SetReadDeadline(time.Now().Add(reporterReadWait))
@@ -265,10 +266,145 @@ func (w *WebSocketReporter) connect() error {
 		return nil
 	})

-	fmt.Printf("✅ WebSocket连接建立成功 (http=%d, tls=%d, socks=%d)\n", cfg.Http, cfg.Tls, cfg.Socks)
+	fmt.Printf("✅ WebSocket连接建立成功 (%s, http=%d, tls=%d, socks=%d)\n", sanitizeWebSocketURL(usedURL), cfg.Http, cfg.Tls, cfg.Socks)
 	return nil
 }

+func buildWebSocketCandidates(addr string, secret string, version string, http int, tls int, socks int, preferredScheme string) []string {
+	normalizedAddr, explicitScheme := normalizeReporterAddress(addr)
+	if normalizedAddr == "" {
+		normalizedAddr = strings.TrimSpace(addr)
+	}
+
+	query := "/system-info?type=1&secret=" + secret + "&version=" + version +
+		"&http=" + strconv.Itoa(http) + "&tls=" + strconv.Itoa(tls) + "&socks=" + strconv.Itoa(socks)
+
+	schemes := []string{"wss", "ws"}
+	if mappedScheme := mapToWebSocketScheme(explicitScheme); mappedScheme != "" {
+		if mappedScheme == "ws" {
+			schemes = []string{"ws", "wss"}
+		}
+	} else if preferredScheme == "ws" {
+		schemes = []string{"ws", "wss"}
+	}
+
+	return []string{
+		schemes[0] + "://" + normalizedAddr + query,
+		schemes[1] + "://" + normalizedAddr + query,
+	}
+}
+
+func normalizeReporterAddress(addr string) (string, string) {
+	raw := strings.TrimSpace(addr)
+	if raw == "" {
+		return "", ""
+	}
+
+	scheme := ""
+	if idx := strings.Index(raw, "://"); idx > 0 {
+		scheme = strings.ToLower(strings.TrimSpace(raw[:idx]))
+		if parsed, err := url.Parse(raw); err == nil {
+			if host := strings.TrimSpace(parsed.Host); host != "" {
+				return host, scheme
+			}
+		}
+		raw = raw[idx+3:]
+	}
+
+	if idx := strings.IndexAny(raw, "/?#"); idx >= 0 {
+		raw = raw[:idx]
+	}
+	return strings.TrimSpace(raw), scheme
+}
+
+func mapToWebSocketScheme(scheme string) string {
+	switch strings.ToLower(strings.TrimSpace(scheme)) {
+	case "wss", "https":
+		return "wss"
+	case "ws", "http":
+		return "ws"
+	default:
+		return ""
+	}
+}
+
+func detectWebSocketScheme(rawURL string) string {
+	if strings.HasPrefix(rawURL, "wss://") {
+		return "wss"
+	}
+	if strings.HasPrefix(rawURL, "ws://") {
+		return "ws"
+	}
+	return ""
+}
+
+func dialWebSocketWithFallback(dialer *websocket.Dialer, candidates []string) (*websocket.Conn, string, error) {
+	if len(candidates) == 0 {
+		return nil, "", fmt.Errorf("WebSocket候选地址为空")
+	}
+
+	var errs []string
+	for i, targetURL := range candidates {
+		conn, resp, err := wsDial(dialer, targetURL)
+		if err == nil {
+			if i > 0 {
+				fmt.Printf("↪️ WebSocket已自动回退成功: %s\n", sanitizeWebSocketURL(targetURL))
+			}
+			return conn, targetURL, nil
+		}
+		errMsg := formatWebSocketDialError(err, resp)
+		errs = append(errs, fmt.Sprintf("%s => %s", sanitizeWebSocketURL(targetURL), errMsg))
+		if i < len(candidates)-1 {
+			fmt.Printf(
+				"⚠️ WebSocket连接失败，准备从 %s 回退到 %s: %s\n",
+				strings.ToUpper(detectWebSocketScheme(targetURL)),
+				strings.ToUpper(detectWebSocketScheme(candidates[i+1])),
+				errMsg,
+			)
+		}
+	}
+
+	return nil, "", fmt.Errorf("连接WebSocket失败（已尝试%d种协议）: %s", len(candidates), strings.Join(errs, " | "))
+}
+
+func sanitizeWebSocketURL(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return rawURL
+	}
+
+	q := u.Query()
+	if q.Get("secret") != "" {
+		q.Set("secret", "***")
+		u.RawQuery = q.Encode()
+	}
+	return u.String()
+}
+
+func formatWebSocketDialError(err error, resp *http.Response) string {
+	if err == nil {
+		return ""
+	}
+	if resp == nil {
+		return err.Error()
+	}
+
+	msg := fmt.Sprintf("%s (HTTP %s)", err, resp.Status)
+	if resp.Body == nil {
+		return msg
+	}
+
+	body, readErr := io.ReadAll(io.LimitReader(resp.Body, 256))
+	if readErr != nil {
+		return msg
+	}
+	bodyText := strings.TrimSpace(string(body))
+	if bodyText == "" {
+		return msg
+	}
+	return fmt.Sprintf("%s, body=%q", msg, bodyText)
+}
+
 // handleConnection 处理WebSocket连接
 func (w *WebSocketReporter) handleConnection() {
 	defer func() {
@@ -1290,7 +1426,8 @@ func getMemoryInfo() MemoryInfo {
 func StartWebSocketReporterWithConfig(addr string, secret string, http int, tls int, socks int, version string) *WebSocketReporter {

 	// 构建初始 WebSocket URL
-	fullURL := "ws://" + addr + "/system-info?type=1&secret=" + secret + "&version=" + version + "&http=" + strconv.Itoa(http) + "&tls=" + strconv.Itoa(tls) + "&socks=" + strconv.Itoa(socks)
+	candidates := buildWebSocketCandidates(addr, secret, version, http, tls, socks, "")
+	fullURL := candidates[0]

 	fmt.Printf("🔗 WebSocket连接URL: %s\n", fullURL)

@@ -0,0 +1,127 @@
+package socket
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/websocket"
+)
+
+func TestBuildWebSocketCandidatesSecureFirst(t *testing.T) {
+	candidates := buildWebSocketCandidates("panel.example.com:443", "abc", "2.0.2", 1, 0, 1, "")
+
+	if len(candidates) != 2 {
+		t.Fatalf("expected 2 candidates, got %d", len(candidates))
+	}
+	if !strings.HasPrefix(candidates[0], "wss://") {
+		t.Fatalf("expected first candidate to start with wss://, got %s", candidates[0])
+	}
+	if !strings.HasPrefix(candidates[1], "ws://") {
+		t.Fatalf("expected second candidate to start with ws://, got %s", candidates[1])
+	}
+}
+
+func TestBuildWebSocketCandidatesUsesPreferredScheme(t *testing.T) {
+	candidates := buildWebSocketCandidates("panel.example.com:443", "abc", "2.0.2", 1, 0, 1, "ws")
+
+	if len(candidates) != 2 {
+		t.Fatalf("expected 2 candidates, got %d", len(candidates))
+	}
+	if !strings.HasPrefix(candidates[0], "ws://") {
+		t.Fatalf("expected preferred ws:// candidate first, got %s", candidates[0])
+	}
+	if !strings.HasPrefix(candidates[1], "wss://") {
+		t.Fatalf("expected fallback wss:// candidate second, got %s", candidates[1])
+	}
+}
+
+func TestBuildWebSocketCandidatesNormalizesSchemePrefixedAddr(t *testing.T) {
+	candidates := buildWebSocketCandidates("https://panel.example.com:443/path?q=1", "abc", "2.0.2", 0, 0, 0, "")
+
+	if len(candidates) != 2 {
+		t.Fatalf("expected 2 candidates, got %d", len(candidates))
+	}
+	if !strings.HasPrefix(candidates[0], "wss://panel.example.com:443/") {
+		t.Fatalf("expected normalized wss candidate, got %s", candidates[0])
+	}
+	if !strings.HasPrefix(candidates[1], "ws://panel.example.com:443/") {
+		t.Fatalf("expected normalized ws fallback candidate, got %s", candidates[1])
+	}
+}
+
+func TestDialWebSocketWithFallbackTriesWSAfterWSSFailure(t *testing.T) {
+	orig := wsDial
+	defer func() { wsDial = orig }()
+
+	var attempts []string
+	wsDial = func(_ *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
+		attempts = append(attempts, rawURL)
+		if strings.HasPrefix(rawURL, "wss://") {
+			return nil, nil, errors.New("tls failed")
+		}
+		return &websocket.Conn{}, nil, nil
+	}
+
+	_, usedURL, err := dialWebSocketWithFallback(
+		&websocket.Dialer{},
+		[]string{
+			"wss://panel.example.com/system-info?type=1&secret=abc",
+			"ws://panel.example.com/system-info?type=1&secret=abc",
+		},
+	)
+	if err != nil {
+		t.Fatalf("expected fallback success, got err=%v", err)
+	}
+	if !strings.HasPrefix(usedURL, "ws://") {
+		t.Fatalf("expected fallback ws:// url, got %s", usedURL)
+	}
+	if len(attempts) != 2 {
+		t.Fatalf("expected 2 attempts, got %d", len(attempts))
+	}
+	if !strings.HasPrefix(attempts[0], "wss://") || !strings.HasPrefix(attempts[1], "ws://") {
+		t.Fatalf("unexpected attempt order: %#v", attempts)
+	}
+}
+
+func TestDetectWebSocketScheme(t *testing.T) {
+	if detectWebSocketScheme("wss://panel.example.com/system-info") != "wss" {
+		t.Fatalf("expected wss detection")
+	}
+	if detectWebSocketScheme("ws://panel.example.com/system-info") != "ws" {
+		t.Fatalf("expected ws detection")
+	}
+	if detectWebSocketScheme("http://panel.example.com/system-info") != "" {
+		t.Fatalf("expected empty detection for non-websocket scheme")
+	}
+}
+
+func TestSanitizeWebSocketURL(t *testing.T) {
+	raw := "wss://panel.example.com/system-info?type=1&secret=abc&version=2.0.2"
+	sanitized := sanitizeWebSocketURL(raw)
+
+	if strings.Contains(sanitized, "secret=abc") {
+		t.Fatalf("expected secret to be masked, got %s", sanitized)
+	}
+	if !strings.Contains(sanitized, "secret=%2A%2A%2A") {
+		t.Fatalf("expected masked secret in url, got %s", sanitized)
+	}
+}
+
+func TestFormatWebSocketDialErrorIncludesHTTPStatus(t *testing.T) {
+	err := errors.New("websocket: bad handshake")
+	resp := &http.Response{
+		Status: "403 Forbidden",
+		Body:   io.NopCloser(strings.NewReader("forbidden")),
+	}
+
+	msg := formatWebSocketDialError(err, resp)
+	if !strings.Contains(msg, "HTTP 403 Forbidden") {
+		t.Fatalf("expected status in message, got %s", msg)
+	}
+	if !strings.Contains(msg, "forbidden") {
+		t.Fatalf("expected response body in message, got %s", msg)
+	}
+}
@@ -0,0 +1,5 @@
+# Node Full-Stack Tags Removal Plan
+
+- [x] Remove node tags usage from frontend node management and dashboard views
+- [x] Remove node tags fields from backend models, handlers, repository, and backup logic
+- [x] Verify frontend build and backend tests pass after the removal
@@ -0,0 +1,5 @@
+# PR 292 Node Page Merge Conflict Resolution Plan
+
+- [x] Review the conflicted node page and identify all overlapping feature areas from main and PR #292
+- [x] Merge tab split, per-tab search, remote usage cards, expiry filters, and renewal indicators into `vite-frontend/src/pages/node.tsx`
+- [x] Build `vite-frontend` and fix any integration issues from the merged result
@@ -0,0 +1,19 @@
+# 028 - Sync Forward Ports On Tunnel Entry Change
+
+## Goal
+When a tunnel's entry nodes change, automatically keep all forwards under that tunnel aligned by rebuilding `forward_port` rows to match the latest entry node set.
+
+## Scope
+- Backend only: update tunnel mutation flow to sync forward entry mappings.
+- Preserve existing forward port and bind IP behavior:
+  - Keep the existing forward port (choose the current min port in `forward_port`).
+  - Preserve `in_ip` only when the tunnel has a single entry node; clear `in_ip` for multi-entry tunnels.
+
+## Checklist
+- [x] Capture old entry node IDs before tunnel update commits.
+- [x] After commit, compare old/new entry node sets.
+- [x] If changed, rebuild `forward_port` for all forwards in the tunnel.
+- [x] Run `go test ./...` in `go-backend`.
+
+## Notes
+- Runtime redeploy/downlink is handled elsewhere; this change focuses on DB-level consistency of forward entry mappings.
@@ -0,0 +1,14 @@
+# 029 - Issue 281 Contract Repro
+
+## Goal
+Add a contract test that reproduces issue #281: after changing a tunnel's entry node, forward runtime cleanup does not remove the stale service from the old entry node.
+
+## Checklist
+- [x] Review existing contract test helpers for mock node command recording.
+- [x] Add a contract test that updates a tunnel entry node while a forward is bound to the tunnel.
+- [x] Assert the new entry node receives forward sync commands and the old entry node does not receive forward cleanup, reproducing the bug.
+- [x] Run the focused contract test and capture the failure.
+
+## Test Record
+- Command: `cd go-backend && go test ./tests/contract/... -run TestTunnelUpdateChangesEntryNodeButLeavesOldForwardRuntimeContract`
+- Result: failed as expected with `expected old entry node to receive forward DeleteService cleanup for 1_2_281, got none`.
@@ -0,0 +1,14 @@
+# 030 - Fix Issue 281 Stale Forward Runtime Cleanup
+
+## Goal
+When a tunnel's entry nodes change, remove forward runtime services from entry nodes that are no longer part of the tunnel before syncing the forward to its new entry nodes.
+
+## Checklist
+- [x] Review the tunnel update flow and identify where old/new entry node sets are available.
+- [x] Add backend cleanup for forward runtimes on removed entry nodes.
+- [x] Keep existing forward port rebuild and forward resync behavior intact.
+- [x] Run focused contract regression tests for the issue 281 repro.
+
+## Test Record
+- Command: `cd go-backend && go test ./tests/contract/... -run 'TestTunnelUpdateChangesEntryNodeButLeavesOldForwardRuntimeContract|TestTunnelUpdateRecoversFromAddressInUseContract'`
+- Result: passed.
@@ -0,0 +1,14 @@
+# 031 - Entry Transition Regression Coverage
+
+## Goal
+Expand issue #281 regression coverage to verify forward runtime cleanup and `forward_port` rebuilding across both single-entry to multi-entry and multi-entry to single-entry tunnel updates.
+
+## Checklist
+- [x] Review the current issue 281 contract repro and reuse its mock-node recording helpers.
+- [x] Add a broader contract test that exercises both entry transition directions.
+- [x] Assert removed entry nodes receive forward cleanup and retained/new entry nodes receive forward sync.
+- [x] Run focused contract tests and record the result.
+
+## Test Record
+- Command: `cd go-backend && go test ./tests/contract/... -run 'TestTunnelUpdateChangesEntryNodeButLeavesOldForwardRuntimeContract|TestTunnelUpdateEntryTransitionsCleanupForwardRuntimeContract|TestTunnelUpdateRecoversFromAddressInUseContract'`
+- Result: passed.
@@ -0,0 +1,18 @@
+node_modules
+dist
+
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+.DS_Store
+.vscode
+.idea
+
+.env.local
+.env.*.local
+
+coverage
+*.tsbuildinfo
@@ -4,7 +4,6 @@ export interface NodeApiItem {
  status: number;
  inx?: number;
  remark?: string;
-  tags?: string;
  expiryTime?: number;
  renewalCycle?: "month" | "quarter" | "year" | "";
  syncError?: string;
@@ -220,7 +219,6 @@ export interface NodeMutationPayload {
  status?: number;
  inx?: number;
  remark?: string;
-  tags?: string;
  expiryTime?: number;
  renewalCycle?: "month" | "quarter" | "year" | "";
  serverIp?: string;
@@ -90,7 +90,9 @@ export default function DashboardPage() {
      };
    }

-    const diffDays = Math.ceil((nextDueTime - Date.now()) / (1000 * 60 * 60 * 24));
+    const diffDays = Math.ceil(
+      (nextDueTime - Date.now()) / (1000 * 60 * 60 * 24),
+    );

    if (renewalState === "expired" || diffDays <= 0) {
      return {
@@ -120,15 +122,6 @@ export default function DashboardPage() {
    };
  };

-  const parseNodeTags = (tags?: string) => {
-    if (!tags) return [];
-    return tags
-      .split(",")
-      .map((tag) => tag.trim())
-      .filter(Boolean)
-      .slice(0, 3);
-  };
-
  const renderNodeExpiryCard = (node: DashboardNodeExpiryItem) => {
    const renewalSnapshot = getNodeRenewalSnapshot(
      node.expiryTime,
@@ -138,7 +131,6 @@ export default function DashboardPage() {
      renewalSnapshot.nextDueTime,
      renewalSnapshot.state,
    );
-    const tags = parseNodeTags(node.tags);

    return (
      <div
@@ -150,7 +142,9 @@ export default function DashboardPage() {
            <div className="text-sm font-semibold text-foreground truncate">
              {node.name}
            </div>
-            <div className="mt-1 text-xs text-default-500">节点 ID: {node.id}</div>
+            <div className="mt-1 text-xs text-default-500">
+              节点 ID: {node.id}
+            </div>
          </div>
          <span
            className={`shrink-0 rounded-full px-2.5 py-1 text-[11px] font-medium ${expiryStatus.badgeClassName}`}
@@ -172,19 +166,6 @@ export default function DashboardPage() {
            {node.remark.trim()}
          </p>
        )}
-
-        {tags.length > 0 && (
-          <div className="mt-3 flex flex-wrap gap-2">
-            {tags.map((tag) => (
-              <span
-                key={`${node.id}-${tag}`}
-                className="rounded-full bg-white/80 px-2 py-1 text-[11px] text-default-600 ring-1 ring-amber-200/80 dark:bg-white/5 dark:text-default-300 dark:ring-amber-500/20"
-              >
-                #{tag}
-              </span>
-            ))}
-          </div>
-        )}
      </div>
    );
  };
@@ -804,7 +785,8 @@ export default function DashboardPage() {
                    节点到期提醒
                  </h2>
                  <p className="text-sm text-default-500">
-                    展示 7 天内需要续费或已经逾期的节点，基于月付/季付/年付周期自动推算
+                    展示 7
+                    天内需要续费或已经逾期的节点，基于月付/季付/年付周期自动推算
                  </p>
                </div>
              </div>
@@ -819,7 +801,8 @@ export default function DashboardPage() {
            </div>
            {nodeExpiryReminders.length > 6 && (
              <p className="mt-4 text-xs text-default-500">
-                还有 {nodeExpiryReminders.length - 6} 个节点未展开显示，可前往节点页面继续处理。
+                还有 {nodeExpiryReminders.length - 6}{" "}
+                个节点未展开显示，可前往节点页面继续处理。
              </p>
            )}
          </CardBody>
@@ -58,7 +58,6 @@ export interface DashboardNodeExpiryItem {
  id: number;
  name: string;
  remark?: string;
-  tags?: string;
  expiryTime?: number;
  renewalCycle?: "month" | "quarter" | "year" | "";
 }
@@ -222,7 +221,6 @@ const normalizeNodeExpiryReminders = (items: NodeApiItem[]) => {
      id: item.id,
      name: item.name || "",
      remark: typeof item.remark === "string" ? item.remark : "",
-      tags: typeof item.tags === "string" ? item.tags : "",
      renewalCycle: normalizeDashboardRenewalCycle(item.renewalCycle),
      expiryTime:
        typeof item.expiryTime === "number" && item.expiryTime > 0
@@ -231,14 +229,20 @@ const normalizeNodeExpiryReminders = (items: NodeApiItem[]) => {
    }))
    .filter((item) => {
      if (!item.expiryTime || !item.renewalCycle) return false;
-      const snapshot = getNodeRenewalSnapshot(item.expiryTime, item.renewalCycle);
+      const snapshot = getNodeRenewalSnapshot(
+        item.expiryTime,
+        item.renewalCycle,
+      );

      if (!snapshot.nextDueTime) return false;
+
      return snapshot.nextDueTime <= now + warningWindowMs;
    })
    .sort((a, b) => {
-      const aDue = getNodeRenewalSnapshot(a.expiryTime, a.renewalCycle).nextDueTime || 0;
-      const bDue = getNodeRenewalSnapshot(b.expiryTime, b.renewalCycle).nextDueTime || 0;
+      const aDue =
+        getNodeRenewalSnapshot(a.expiryTime, a.renewalCycle).nextDueTime || 0;
+      const bDue =
+        getNodeRenewalSnapshot(b.expiryTime, b.renewalCycle).nextDueTime || 0;

      return aDue - bDue;
    });
@@ -265,31 +269,34 @@ export const useDashboardData = (): DashboardDataState => {
  const packageRequestInFlightRef = useRef(false);
  const nodeExpiryRequestInFlightRef = useRef(false);

-  const applyPackageData = useCallback((data: {
-    userInfo?: DashboardUserInfo;
-    tunnelPermissions?: DashboardUserTunnel[];
-    forwards?: ForwardApiItem[];
-    statisticsFlows?: DashboardStatisticsFlow[];
-  }) => {
-    const normalizedTunnelPermissions = normalizeTunnelPermissions(
-      data.tunnelPermissions || [],
-    );
-    const normalizedForwards = normalizeForwards(data.forwards || []);
+  const applyPackageData = useCallback(
+    (data: {
+      userInfo?: DashboardUserInfo;
+      tunnelPermissions?: DashboardUserTunnel[];
+      forwards?: ForwardApiItem[];
+      statisticsFlows?: DashboardStatisticsFlow[];
+    }) => {
+      const normalizedTunnelPermissions = normalizeTunnelPermissions(
+        data.tunnelPermissions || [],
+      );
+      const normalizedForwards = normalizeForwards(data.forwards || []);

-    if (!isMountedRef.current) {
-      return;
-    }
+      if (!isMountedRef.current) {
+        return;
+      }

-    setUserInfo(data.userInfo || ({} as DashboardUserInfo));
-    setUserTunnels(normalizedTunnelPermissions);
-    setForwardList(normalizedForwards);
-    setStatisticsFlows(data.statisticsFlows || []);
+      setUserInfo(data.userInfo || ({} as DashboardUserInfo));
+      setUserTunnels(normalizedTunnelPermissions);
+      setForwardList(normalizedForwards);
+      setStatisticsFlows(data.statisticsFlows || []);

-    checkExpirationNotifications(
-      data.userInfo || ({} as DashboardUserInfo),
-      normalizedTunnelPermissions,
-    );
-  }, []);
+      checkExpirationNotifications(
+        data.userInfo || ({} as DashboardUserInfo),
+        normalizedTunnelPermissions,
+      );
+    },
+    [],
+  );

  const loadPackageData = useCallback(
    async ({ silent = false, notifyOnError = false } = {}) => {
@@ -538,9 +538,7 @@ const mapForwardApiItems = (items: ForwardApiItem[]): Forward[] => {
    name: forward.name,
    tunnelId: forward.tunnelId ?? 0,
    tunnelName: forward.tunnelName || "",
-    tunnelTrafficRatio: normalizeTunnelTrafficRatio(
-      forward.tunnelTrafficRatio,
-    ),
+    tunnelTrafficRatio: normalizeTunnelTrafficRatio(forward.tunnelTrafficRatio),
    inIp: forward.inIp || "",
    inPort: forward.inPort ?? 0,
    remoteAddr: forward.remoteAddr || "",
@@ -776,7 +774,10 @@ export default function ForwardPage() {
      currentTunnel.portRangeMin > 0 &&
      currentTunnel.portRangeMax > 0
    ) {
-      return { min: currentTunnel.portRangeMin, max: currentTunnel.portRangeMax };
+      return {
+        min: currentTunnel.portRangeMin,
+        max: currentTunnel.portRangeMax,
+      };
    }

    return null;
@@ -1036,183 +1037,184 @@ export default function ForwardPage() {
    return Number.isFinite(shareId) && shareId > 0 ? shareId : null;
  };

-  const mergeFederationShareFlow = useCallback(async (
-    forwardsData: Forward[],
-  ): Promise<Forward[]> => {
-    if (forwardsData.length === 0) {
-      return forwardsData;
-    }
-
-    try {
-      const [usageRes, localShareRes] = await Promise.all([
-        getPeerRemoteUsageList(),
-        getPeerShareList(),
-      ]);
-
-      const flowByShare = new Map<number, number>();
-      const shareIdsByTunnel = new Map<number, Set<number>>();
-
-      if (usageRes.code === 0 && Array.isArray(usageRes.data)) {
-        usageRes.data.forEach((item: Record<string, unknown>) => {
-          const shareId = Number(item.shareId || 0);
-          const currentFlow = Number(item.currentFlow || 0);
-
-          if (
-            Number.isFinite(shareId) &&
-            shareId > 0 &&
-            Number.isFinite(currentFlow) &&
-            currentFlow > 0
-          ) {
-            const prev = flowByShare.get(shareId) || 0;
-
-            flowByShare.set(shareId, Math.max(prev, currentFlow));
-          }
-
-          if (Number.isFinite(shareId) && shareId > 0) {
-            const bindings = Array.isArray(item.bindings)
-              ? (item.bindings as Array<Record<string, unknown>>)
-              : [];
-
-            bindings.forEach((binding) => {
-              const tunnelId = Number(binding.tunnelId || 0);
-              const chainType = Number(binding.chainType || 0);
-
-              if (!Number.isFinite(tunnelId) || tunnelId <= 0) {
-                return;
-              }
-
-              if (Number.isFinite(chainType) && chainType !== 1) {
-                return;
-              }
-
-              let shareSet = shareIdsByTunnel.get(tunnelId);
-
-              if (!shareSet) {
-                shareSet = new Set<number>();
-                shareIdsByTunnel.set(tunnelId, shareSet);
-              }
-
-              shareSet.add(shareId);
-            });
-          }
-        });
-      }
-
-      if (localShareRes.code === 0 && Array.isArray(localShareRes.data)) {
-        localShareRes.data.forEach((item: Record<string, unknown>) => {
-          const shareId = Number(item.id || 0);
-          const currentFlow = Number(item.currentFlow || 0);
-
-          if (
-            Number.isFinite(shareId) &&
-            shareId > 0 &&
-            Number.isFinite(currentFlow) &&
-            currentFlow > 0
-          ) {
-            const prev = flowByShare.get(shareId) || 0;
-
-            flowByShare.set(shareId, Math.max(prev, currentFlow));
-          }
-        });
-      }
-
-      if (flowByShare.size === 0) {
+  const mergeFederationShareFlow = useCallback(
+    async (forwardsData: Forward[]): Promise<Forward[]> => {
+      if (forwardsData.length === 0) {
        return forwardsData;
      }

-      const resolveShareIdForForward = (forward: Forward): number | null => {
-        const candidates = new Set<number>();
-        const shareIdFromName = parseShareIdFromTunnelName(
-          forward.tunnelName || "",
-        );
+      try {
+        const [usageRes, localShareRes] = await Promise.all([
+          getPeerRemoteUsageList(),
+          getPeerShareList(),
+        ]);

-        if (shareIdFromName) {
-          candidates.add(shareIdFromName);
-        }
+        const flowByShare = new Map<number, number>();
+        const shareIdsByTunnel = new Map<number, Set<number>>();

-        const tunnelId = Number(forward.tunnelId || 0);
-        const shareSetByTunnel = shareIdsByTunnel.get(tunnelId);
+        if (usageRes.code === 0 && Array.isArray(usageRes.data)) {
+          usageRes.data.forEach((item: Record<string, unknown>) => {
+            const shareId = Number(item.shareId || 0);
+            const currentFlow = Number(item.currentFlow || 0);
+
+            if (
+              Number.isFinite(shareId) &&
+              shareId > 0 &&
+              Number.isFinite(currentFlow) &&
+              currentFlow > 0
+            ) {
+              const prev = flowByShare.get(shareId) || 0;
+
+              flowByShare.set(shareId, Math.max(prev, currentFlow));
+            }

-        if (shareSetByTunnel && shareSetByTunnel.size > 0) {
-          shareSetByTunnel.forEach((shareId) => {
            if (Number.isFinite(shareId) && shareId > 0) {
-              candidates.add(shareId);
+              const bindings = Array.isArray(item.bindings)
+                ? (item.bindings as Array<Record<string, unknown>>)
+                : [];
+
+              bindings.forEach((binding) => {
+                const tunnelId = Number(binding.tunnelId || 0);
+                const chainType = Number(binding.chainType || 0);
+
+                if (!Number.isFinite(tunnelId) || tunnelId <= 0) {
+                  return;
+                }
+
+                if (Number.isFinite(chainType) && chainType !== 1) {
+                  return;
+                }
+
+                let shareSet = shareIdsByTunnel.get(tunnelId);
+
+                if (!shareSet) {
+                  shareSet = new Set<number>();
+                  shareIdsByTunnel.set(tunnelId, shareSet);
+                }
+
+                shareSet.add(shareId);
+              });
            }
          });
        }

-        if (candidates.size === 0) {
-          return null;
+        if (localShareRes.code === 0 && Array.isArray(localShareRes.data)) {
+          localShareRes.data.forEach((item: Record<string, unknown>) => {
+            const shareId = Number(item.id || 0);
+            const currentFlow = Number(item.currentFlow || 0);
+
+            if (
+              Number.isFinite(shareId) &&
+              shareId > 0 &&
+              Number.isFinite(currentFlow) &&
+              currentFlow > 0
+            ) {
+              const prev = flowByShare.get(shareId) || 0;
+
+              flowByShare.set(shareId, Math.max(prev, currentFlow));
+            }
+          });
        }

-        let bestShareId: number | null = null;
-        let bestFlow = 0;
+        if (flowByShare.size === 0) {
+          return forwardsData;
+        }

-        candidates.forEach((shareId) => {
-          const shareFlow = flowByShare.get(shareId) || 0;
+        const resolveShareIdForForward = (forward: Forward): number | null => {
+          const candidates = new Set<number>();
+          const shareIdFromName = parseShareIdFromTunnelName(
+            forward.tunnelName || "",
+          );

-          if (shareFlow > bestFlow) {
-            bestFlow = shareFlow;
-            bestShareId = shareId;
+          if (shareIdFromName) {
+            candidates.add(shareIdFromName);
+          }
+
+          const tunnelId = Number(forward.tunnelId || 0);
+          const shareSetByTunnel = shareIdsByTunnel.get(tunnelId);
+
+          if (shareSetByTunnel && shareSetByTunnel.size > 0) {
+            shareSetByTunnel.forEach((shareId) => {
+              if (Number.isFinite(shareId) && shareId > 0) {
+                candidates.add(shareId);
+              }
+            });
+          }
+
+          if (candidates.size === 0) {
+            return null;
+          }
+
+          let bestShareId: number | null = null;
+          let bestFlow = 0;
+
+          candidates.forEach((shareId) => {
+            const shareFlow = flowByShare.get(shareId) || 0;
+
+            if (shareFlow > bestFlow) {
+              bestFlow = shareFlow;
+              bestShareId = shareId;
+            }
+          });
+
+          return bestShareId;
+        };
+
+        const resolvedShareByForwardId = new Map<number, number>();
+
+        forwardsData.forEach((forward) => {
+          const shareId = resolveShareIdForForward(forward);
+
+          if (shareId) {
+            resolvedShareByForwardId.set(forward.id, shareId);
          }
        });

-        return bestShareId;
-      };
+        const forwardCountByShare = new Map<number, number>();

-      const resolvedShareByForwardId = new Map<number, number>();
+        forwardsData.forEach((forward) => {
+          const shareId = resolvedShareByForwardId.get(forward.id) || null;

-      forwardsData.forEach((forward) => {
-        const shareId = resolveShareIdForForward(forward);
+          if (!shareId || !flowByShare.has(shareId)) {
+            return;
+          }

-        if (shareId) {
-          resolvedShareByForwardId.set(forward.id, shareId);
-        }
-      });
+          forwardCountByShare.set(
+            shareId,
+            (forwardCountByShare.get(shareId) || 0) + 1,
+          );
+        });

-      const forwardCountByShare = new Map<number, number>();
+        return forwardsData.map((forward) => {
+          const shareId = resolvedShareByForwardId.get(forward.id) || null;

-      forwardsData.forEach((forward) => {
-        const shareId = resolvedShareByForwardId.get(forward.id) || null;
+          if (!shareId) {
+            return { ...forward, federationShareFlow: undefined };
+          }

-        if (!shareId || !flowByShare.has(shareId)) {
-          return;
-        }
+          const shareFlow = flowByShare.get(shareId) || 0;

-        forwardCountByShare.set(
-          shareId,
-          (forwardCountByShare.get(shareId) || 0) + 1,
-        );
-      });
+          if (shareFlow <= 0) {
+            return { ...forward, federationShareFlow: undefined };
+          }

-      return forwardsData.map((forward) => {
-        const shareId = resolvedShareByForwardId.get(forward.id) || null;
+          const directFlow = (forward.inFlow || 0) + (forward.outFlow || 0);

-        if (!shareId) {
-          return { ...forward, federationShareFlow: undefined };
-        }
+          if (directFlow > 0) {
+            return { ...forward, federationShareFlow: undefined };
+          }

-        const shareFlow = flowByShare.get(shareId) || 0;
+          const count = forwardCountByShare.get(shareId) || 1;
+          const estimated = Math.max(1, Math.floor(shareFlow / count));

-        if (shareFlow <= 0) {
-          return { ...forward, federationShareFlow: undefined };
-        }
-
-        const directFlow = (forward.inFlow || 0) + (forward.outFlow || 0);
-
-        if (directFlow > 0) {
-          return { ...forward, federationShareFlow: undefined };
-        }
-
-        const count = forwardCountByShare.get(shareId) || 1;
-        const estimated = Math.max(1, Math.floor(shareFlow / count));
-
-        return { ...forward, federationShareFlow: estimated };
-      });
-    } catch {
-      return forwardsData;
-    }
-  }, []);
+          return { ...forward, federationShareFlow: estimated };
+        });
+      } catch {
+        return forwardsData;
+      }
+    },
+    [],
+  );

  const getForwardDisplayFlow = (forward: Forward): number => {
    const directFlow = (forward.inFlow || 0) + (forward.outFlow || 0);
@@ -1283,45 +1285,48 @@ export default function ForwardPage() {
  );

  // 加载所有数据
-  const loadData = useCallback(async (lod = true) => {
-    setLoading(lod);
-    try {
-      const [tunnelsRes, speedLimitsRes] = await Promise.all([
-        userTunnel(),
-        getSpeedLimitList(),
-      ]);
-      const [allTunnelsRes, nodesRes] = await Promise.allSettled([
-        getTunnelList(),
-        getNodeList(),
-      ]);
+  const loadData = useCallback(
+    async (lod = true) => {
+      setLoading(lod);
+      try {
+        const [tunnelsRes, speedLimitsRes] = await Promise.all([
+          userTunnel(),
+          getSpeedLimitList(),
+        ]);
+        const [allTunnelsRes, nodesRes] = await Promise.allSettled([
+          getTunnelList(),
+          getNodeList(),
+        ]);

-      await refreshForwardList(false);
+        await refreshForwardList(false);

-      if (tunnelsRes.code === 0) {
-        setTunnels(tunnelsRes.data || []);
-      } else {
+        if (tunnelsRes.code === 0) {
+          setTunnels(tunnelsRes.data || []);
+        } else {
+        }
+
+        if (
+          allTunnelsRes.status === "fulfilled" &&
+          allTunnelsRes.value.code === 0
+        ) {
+          setAllTunnels((allTunnelsRes.value.data || []) as Tunnel[]);
+        }
+
+        if (nodesRes.status === "fulfilled" && nodesRes.value.code === 0) {
+          setNodes((nodesRes.value.data || []) as Node[]);
+        }
+
+        if (speedLimitsRes.code === 0) {
+          setSpeedLimits(speedLimitsRes.data || []);
+        }
+      } catch {
+        toast.error("加载数据失败");
+      } finally {
+        setLoading(false);
      }
-
-      if (
-        allTunnelsRes.status === "fulfilled" &&
-        allTunnelsRes.value.code === 0
-      ) {
-        setAllTunnels((allTunnelsRes.value.data || []) as Tunnel[]);
-      }
-
-      if (nodesRes.status === "fulfilled" && nodesRes.value.code === 0) {
-        setNodes((nodesRes.value.data || []) as Node[]);
-      }
-
-      if (speedLimitsRes.code === 0) {
-        setSpeedLimits(speedLimitsRes.data || []);
-      }
-    } catch {
-      toast.error("加载数据失败");
-    } finally {
-      setLoading(false);
-    }
-  }, [refreshForwardList]);
+    },
+    [refreshForwardList],
+  );

  useEffect(() => {
    loadData();
@@ -1389,8 +1394,16 @@ export default function ForwardPage() {
      newErrors.tunnelId = "请选择关联隧道";
    }

-    if (form.inPort !== null && form.inPort !== undefined && form.inPort > 0 && currentTunnelPortRange) {
-      if (form.inPort < currentTunnelPortRange.min || form.inPort > currentTunnelPortRange.max) {
+    if (
+      form.inPort !== null &&
+      form.inPort !== undefined &&
+      form.inPort > 0 &&
+      currentTunnelPortRange
+    ) {
+      if (
+        form.inPort < currentTunnelPortRange.min ||
+        form.inPort > currentTunnelPortRange.max
+      ) {
        newErrors.inPort = `端口 ${currentTunnelPortRange.min}-${currentTunnelPortRange.max} 超出允许范围`;
      }
    }
@@ -1485,17 +1498,21 @@ export default function ForwardPage() {
        toast.success("删除成功");
        setDeleteModalOpen(false);
        setForwardToDelete(null);
-        setForwards((prev) => prev.filter((forward) => forward.id !== forwardToDelete.id));
+        setForwards((prev) =>
+          prev.filter((forward) => forward.id !== forwardToDelete.id),
+        );
        setForwardOrder((prev) => {
          const next = prev.filter((id) => id !== forwardToDelete.id);

          saveOrder(FORWARD_ORDER_KEY, next);
+
          return next;
        });
        setSelectedIds((prev) => {
          const next = new Set(prev);

          next.delete(forwardToDelete.id);
+
          return next;
        });
      } else {
@@ -1518,12 +1535,14 @@ export default function ForwardPage() {
              const next = prev.filter((id) => id !== forwardToDelete.id);

              saveOrder(FORWARD_ORDER_KEY, next);
+
              return next;
            });
            setSelectedIds((prev) => {
              const next = new Set(prev);

              next.delete(forwardToDelete.id);
+
              return next;
            });
          } else {
@@ -1597,6 +1616,7 @@ export default function ForwardPage() {
          strategy: addressCount > 1 ? form.strategy : "fifo",
          speedId: normalizedSpeedId,
        };
+
        res = await createForward(createData);
      }

@@ -2787,7 +2807,8 @@ export default function ForwardPage() {
      }

      if (
-        normalizeTunnelTrafficRatio(existingTunnelGroup.tunnelTrafficRatio) === 1 &&
+        normalizeTunnelTrafficRatio(existingTunnelGroup.tunnelTrafficRatio) ===
+          1 &&
        normalizeTunnelTrafficRatio(forward.tunnelTrafficRatio) !== 1
      ) {
        existingTunnelGroup.tunnelTrafficRatio = normalizeTunnelTrafficRatio(
@@ -4032,66 +4053,76 @@ export default function ForwardPage() {
      {compactMode ? (
        viewMode === "grouped" ? (
          sortedForwards.length > 0 ? (
-            <div className="overflow-hidden rounded-xl border border-divider bg-content1 shadow-md">
-              <DndContext
-                collisionDetection={closestCenter}
-                sensors={sensors}
-                onDragEnd={handleDragEnd}
-              >
-                <SortableContext
-                  items={sortableForwardIds}
-                  strategy={verticalListSortingStrategy}
+            <>
+              <div className="flex items-center justify-between px-1 mb-3">
+                <span className="text-sm font-semibold text-foreground">
+                  全部规则
+                </span>
+                <span className="text-xs text-default-600">
+                  {sortedForwards.length} 条规则
+                </span>
+              </div>
+              <div className="overflow-hidden rounded-xl border border-divider bg-content1 shadow-md">
+                <DndContext
+                  collisionDetection={closestCenter}
+                  sensors={sensors}
+                  onDragEnd={handleDragEnd}
                >
-                  <Table
-                    aria-label="全部规则列表"
-                    classNames={{
-                      th: "bg-default-100/50 text-default-600 font-semibold text-sm border-b border-divider py-3 uppercase tracking-wider",
-                      td: "py-3 border-b border-divider/50 group-data-[last=true]:border-b-0",
-                      tr: "hover:bg-default-50/50 transition-colors",
-                    }}
+                  <SortableContext
+                    items={sortableForwardIds}
+                    strategy={verticalListSortingStrategy}
                  >
-                    <TableHeader>
-                      {selectMode && (
-                        <TableColumn className="w-14">选择</TableColumn>
-                      )}
-                      <TableColumn className="w-10 pl-4" />
-                      <TableColumn>用户</TableColumn>
-                      <TableColumn>名称</TableColumn>
-                      <TableColumn>隧道</TableColumn>
-                      <TableColumn>入口</TableColumn>
-                      <TableColumn>目标</TableColumn>
-                      <TableColumn>策略</TableColumn>
-                      <TableColumn>总流量</TableColumn>
-                      <TableColumn>状态</TableColumn>
-                      <TableColumn className="text-right">操作</TableColumn>
-                    </TableHeader>
-                    <TableBody
-                      emptyContent="暂无规则配置"
-                      items={sortedForwards}
+                    <Table
+                      aria-label="全部规则列表"
+                      classNames={{
+                        th: "bg-default-100/50 text-default-600 font-semibold text-sm border-b border-divider py-3 uppercase tracking-wider",
+                        td: "py-3 border-b border-divider/50 group-data-[last=true]:border-b-0",
+                        tr: "hover:bg-default-50/50 transition-colors",
+                      }}
                    >
-                      {(forward) => (
-                        <SortableCompactTableRow
-                          formatFlow={formatFlow}
-                          formatInAddress={formatInAddress}
-                          formatRemoteAddress={formatRemoteAddress}
-                          forward={forward}
-                          getStrategyDisplay={getStrategyDisplay}
-                          handleDelete={handleDelete}
-                          handleDiagnose={handleDiagnose}
-                          handleEdit={handleEdit}
-                          handleServiceToggle={handleServiceToggle}
-                          hasMultipleAddresses={hasMultipleAddresses}
-                          selectMode={selectMode}
-                          selectedIds={selectedIds}
-                          showAddressModal={showAddressModal}
-                          toggleSelect={toggleSelect}
-                        />
-                      )}
-                    </TableBody>
-                  </Table>
-                </SortableContext>
-              </DndContext>
-            </div>
+                      <TableHeader>
+                        {selectMode && (
+                          <TableColumn className="w-14">选择</TableColumn>
+                        )}
+                        <TableColumn className="w-10 pl-4" />
+                        <TableColumn>用户</TableColumn>
+                        <TableColumn>名称</TableColumn>
+                        <TableColumn>隧道</TableColumn>
+                        <TableColumn>入口</TableColumn>
+                        <TableColumn>目标</TableColumn>
+                        <TableColumn>策略</TableColumn>
+                        <TableColumn>总流量</TableColumn>
+                        <TableColumn>状态</TableColumn>
+                        <TableColumn className="text-right">操作</TableColumn>
+                      </TableHeader>
+                      <TableBody
+                        emptyContent="暂无规则配置"
+                        items={sortedForwards}
+                      >
+                        {(forward) => (
+                          <SortableCompactTableRow
+                            formatFlow={formatFlow}
+                            formatInAddress={formatInAddress}
+                            formatRemoteAddress={formatRemoteAddress}
+                            forward={forward}
+                            getStrategyDisplay={getStrategyDisplay}
+                            handleDelete={handleDelete}
+                            handleDiagnose={handleDiagnose}
+                            handleEdit={handleEdit}
+                            handleServiceToggle={handleServiceToggle}
+                            hasMultipleAddresses={hasMultipleAddresses}
+                            selectMode={selectMode}
+                            selectedIds={selectedIds}
+                            showAddressModal={showAddressModal}
+                            toggleSelect={toggleSelect}
+                          />
+                        )}
+                      </TableBody>
+                    </Table>
+                  </SortableContext>
+                </DndContext>
+              </div>
+            </>
          ) : (
            <Card className="shadow-sm border border-gray-200 dark:border-gray-700 bg-default-50/50">
              <CardBody className="text-center py-20 flex flex-col items-center justify-center min-h-[240px]">
@@ -14,6 +14,7 @@ const addMonths = (timestamp: number, months: number): number => {
  const next = new Date(date);

  next.setMonth(next.getMonth() + months);
+
  return next.getTime();
 };

@@ -72,7 +73,9 @@ export const getNodeRenewalSnapshot = (
    nextDueTime = advanced;
  }

-  const diffDays = Math.ceil((nextDueTime - Date.now()) / (1000 * 60 * 60 * 24));
+  const diffDays = Math.ceil(
+    (nextDueTime - Date.now()) / (1000 * 60 * 60 * 24),
+  );

  if (diffDays <= 0) {
    return {
@@ -110,5 +113,6 @@ export const formatNodeRenewalTime = (timestamp?: number): string => {
  if (!timestamp || timestamp <= 0) {
    return "未设置";
  }
+
  return new Date(timestamp).toLocaleString();
 };
@@ -265,27 +265,30 @@ export default function TunnelPage() {
    );
  }, []);

-  const refreshTunnelList = useCallback(async (withLoading = true) => {
-    if (withLoading) {
-      setLoading(true);
-    }
-
-    try {
-      const tunnelsRes = await getTunnelList();
-
-      if (tunnelsRes.code === 0) {
-        applyTunnelList(mapTunnelApiItems(tunnelsRes.data || []));
-      } else {
-        toast.error(tunnelsRes.msg || "获取隧道列表失败");
-      }
-    } catch {
-      toast.error("获取隧道列表失败");
-    } finally {
+  const refreshTunnelList = useCallback(
+    async (withLoading = true) => {
      if (withLoading) {
-        setLoading(false);
+        setLoading(true);
      }
-    }
-  }, [applyTunnelList]);
+
+      try {
+        const tunnelsRes = await getTunnelList();
+
+        if (tunnelsRes.code === 0) {
+          applyTunnelList(mapTunnelApiItems(tunnelsRes.data || []));
+        } else {
+          toast.error(tunnelsRes.msg || "获取隧道列表失败");
+        }
+      } catch {
+        toast.error("获取隧道列表失败");
+      } finally {
+        if (withLoading) {
+          setLoading(false);
+        }
+      }
+    },
+    [applyTunnelList],
+  );

  const refreshNodes = useCallback(async () => {
    try {
@@ -381,12 +384,14 @@ export default function TunnelPage() {
          const next = prev.filter((id) => id !== tunnelToDelete.id);

          saveOrder(TUNNEL_ORDER_KEY, next);
+
          return next;
        });
        setSelectedIds((prev) => {
          const next = new Set(prev);

          next.delete(tunnelToDelete.id);
+
          return next;
        });
      } else {
@@ -858,11 +863,14 @@ export default function TunnelPage() {
            label: `删除完成：成功 ${result.successCount} 项`,
            percent: 100,
          });
-          setTunnels((prev) => prev.filter((tunnel) => !selectedIds.has(tunnel.id)));
+          setTunnels((prev) =>
+            prev.filter((tunnel) => !selectedIds.has(tunnel.id)),
+          );
          setTunnelOrder((prev) => {
            const next = prev.filter((id) => !selectedIds.has(id));

            saveOrder(TUNNEL_ORDER_KEY, next);
+
            return next;
          });
        } else {
@@ -66,10 +66,7 @@ import {
 } from "@/components/icons";
 import { PageLoadingState } from "@/components/page-state";
 import { useLocalStorageState } from "@/hooks/use-local-storage-state";
-import {
-  removeItemsById,
-  replaceItemById,
-} from "@/utils/list-state";
+import { removeItemsById, replaceItemById } from "@/utils/list-state";

 // 工具函数
 const formatFlow = (value: number, unit: string = "bytes"): string => {
@@ -304,30 +301,30 @@ export default function UserPage() {
  // 数据加载函数
  const loadUsers = useCallback(
    async (keywordOverride?: string) => {
-    setLoading(true);
-    try {
-      const keyword = keywordOverride ?? searchKeyword;
-      const response = await getAllUsers({
-        current: pagination.current,
-        size: pagination.size,
-        keyword,
-      });
+      setLoading(true);
+      try {
+        const keyword = keywordOverride ?? searchKeyword;
+        const response = await getAllUsers({
+          current: pagination.current,
+          size: pagination.size,
+          keyword,
+        });

-      if (response.code === 0) {
-        const nextUsers = Array.isArray(response.data)
-          ? response.data.map((item) => normalizeUserItem(item))
-          : [];
+        if (response.code === 0) {
+          const nextUsers = Array.isArray(response.data)
+            ? response.data.map((item) => normalizeUserItem(item))
+            : [];

-        setUsers(nextUsers);
-        setPagination((prev) => ({ ...prev, total: nextUsers.length }));
-      } else {
-        toast.error(response.msg || "获取用户列表失败");
+          setUsers(nextUsers);
+          setPagination((prev) => ({ ...prev, total: nextUsers.length }));
+        } else {
+          toast.error(response.msg || "获取用户列表失败");
+        }
+      } catch {
+        toast.error("获取用户列表失败");
+      } finally {
+        setLoading(false);
      }
-    } catch {
-      toast.error("获取用户列表失败");
-    } finally {
-      setLoading(false);
-    }
    },
    [pagination.current, pagination.size],
  );
@@ -411,6 +408,7 @@ export default function UserPage() {
      setPagination((prev) => {
        if (prev.current === 1) {
          void loadUsers(searchKeyword);
+
          return prev;
        }

@@ -667,7 +665,8 @@ export default function UserPage() {
              normalizeSpeedId(editTunnelForm.speedId) !== null
                ? speedLimits.find(
                    (speedLimit) =>
-                      speedLimit.id === normalizeSpeedId(editTunnelForm.speedId),
+                      speedLimit.id ===
+                      normalizeSpeedId(editTunnelForm.speedId),
                  )?.name
                : undefined,
          });
@@ -733,7 +732,9 @@ export default function UserPage() {

        setUsers((prev) =>
          prev.map((user) =>
-            user.id === targetUserId ? { ...user, inFlow: 0, outFlow: 0 } : user,
+            user.id === targetUserId
+              ? { ...user, inFlow: 0, outFlow: 0 }
+              : user,
          ),
        );
        setUserToReset(null);
Author	SHA1	Message	Date
sagit	69faeaa9a6	fix(backend): clean stale forward runtimes on entry updates (#307 ) Entire-Checkpoint: 6a6b91fb5f0c	2026-03-11 05:53:31 +00:00
sagit	e8bfe52104	fix(backend): sync forward ports when tunnel entry changes (#304 ) ## What - When a tunnel's entry node set changes, automatically rebuild all forwards' `forward_port` rows under that tunnel to match the latest entry nodes. - Preserves existing forward port (uses current min port from `forward_port`). - Preserves `in_ip` only for single-entry tunnels; clears it for multi-entry tunnels. ## Why Forward runtime dispatch is keyed by `forward_port`. If a tunnel entry node goes offline or is removed, existing forwards could remain mapped to stale entry nodes and become impossible to redeploy cleanly. ## Notes - Plan doc: `plans/028-tunnel-entry-change-sync-forward-ports.md` Refs #285	2026-03-11 11:25:20 +08:00
sagit	9767cc3247	Merge branch 'main' into fix/issue-285-sync-forward-ports	2026-03-11 11:24:19 +08:00
sagit	e8a7f999c8	fix(node): keep info popover above sidebar (#306 ) ## What - Raise the node-card info popover z-index so it renders above the left sidebar. ## Why - The sidebar uses a higher stacking context (z-50), causing the popover (z-30) to be covered when it opens to the left. ## Notes - Verified: `vite-frontend` `npm run build`. Closes #305	2026-03-11 11:24:02 +08:00
sagitchu	4d4f5f8b1f	fix(node): keep info popover above sidebar Entire-Checkpoint: ea4d99cf1c43	2026-03-11 11:21:44 +08:00
sagitchu	d2a425d761	fix(backend): sync forward ports on tunnel entry change	2026-03-11 11:19:53 +08:00
sagit	673d38a089	fix(backend): enforce traffic quota on forwards (#303 ) ## What - Block creating/resuming forwards when user or user_tunnel traffic quota is exceeded (or expired/disabled). - Keep paused forwards paused after service sync (UpdateService restarts services on agent side). ## Why Traffic limit could be bypassed by manually resuming/creating forwards after quota is exceeded. ## Tests - (cd go-backend && go test ./...) Closes #295	2026-03-11 09:38:25 +08:00
sagitchu	2e8c0530a9	fix(backend): block forwards when flow exceeded	2026-03-11 09:34:36 +08:00
sagit	32ee511eac	fix(node): compact card metadata for mobile (#300 ) ## Summary - move secondary node metadata into a compact info dropdown so cards fit better on smaller screens - replace the full connection status chip in the header with a status dot while keeping detailed status inside the info panel - keep remarks and renewal metadata accessible without permanently increasing card height ## Testing - not run	2026-03-10 20:13:11 +08:00
sagitchu	f410640862	fix: calculate info popover placement relative to card container Changed info popover position calculation to use the card container as reference instead of viewport, ensuring consistent placement within card boundaries.	2026-03-10 20:11:49 +08:00
sagitchu	6427b830ea	refactor(node): improve card metadata popup with hover trigger Entire-Checkpoint: 7a033056acc0	2026-03-10 17:19:21 +08:00
sagitchu	5e7bf3ba5c	fix(node): compact card metadata for mobile Entire-Checkpoint: b3c79b0fd2f9	2026-03-10 09:48:11 +08:00
sagit	27d6691232	feat: 支持节点 wss/https 并在失败时回退 ws（兼容旧 ws） (#294 ) ## 变更说明本 PR 聚焦节点与面板通信协议兼容性增强： - 支持节点优先使用 `wss`（WebSocket over TLS）连接后端 - 保持原有 `ws` 连接逻辑完全兼容，不破坏现有节点 - 当 `wss` 握手失败时自动回退到 `ws` - HTTP 上报链路支持 `https/http` 自动识别与回退 - 兼容旧格式地址输入，避免已有配置失效 ## 兼容性 - 旧节点配置（`ws`）可继续正常工作 - 新场景可直接使用 `wss/https`（含 CDN 场景） - 回退策略可避免因 TLS/CDN 配置差异导致节点离线 ## 额外说明 - 本 PR 仅包含协议兼容与回退相关改动 - 不包含安装脚本仓库指向调整相关提交	2026-03-09 18:21:25 +08:00
sagit	cc4b8a916a	Merge branch 'main' into pr/wss-https-fallback	2026-03-09 18:20:07 +08:00
sagit	d9dd5131b2	feat(node): split node page into local and remote sections (#292 ) ## Summary - split node page into local/remote sections (tab switch) - keep per-tab search and count - keep sorting/actions behavior under the selected section - include remote usage detail rendering improvements on remote cards ## Scope - only touches `vite-frontend/src/pages/node.tsx` ## Verify - `cd vite-frontend && npm install && npm run build` passed locally ## Notes - this PR intentionally avoids unrelated layout/sidebar customizations and keeps changes focused on node page UX	2026-03-09 17:56:58 +08:00
sagitchu	a98c9f4f59	merge(main): resolve node page conflicts with renewal UX updates	2026-03-09 17:52:18 +08:00
sagit	5cb935e0e5	fix(frontend): refine node renewal UI and filters (#299 ) * style: restore Prettier formatting in renewal.ts * fix(frontend): refine node renewal UI and filters Entire-Checkpoint: 88c8ae47fb7d * refactor(nodes): remove unused tags field from node model * refactor(node): improve card layout and reorder elements Entire-Checkpoint: fb89f3ebef5c	2026-03-09 08:37:57 +00:00
sagit	6f59e4be0c	Merge branch 'main' into pr/wss-https-fallback	2026-03-09 12:38:47 +08:00
sagitchu	647446a2a2	fix(node): isolate tab search and selection state	2026-03-09 12:17:25 +08:00
sagit	42d6249af5	style: restore Prettier formatting in renewal.ts (#298 )	2026-03-09 10:29:33 +08:00
sagit	de9ab51def	feat: node management enhancements and UX improvements (#297 ) * feat(nodes): add renewal cycle and auto-advance scheduling - Add renewal_cycle field to nodes for tracking paid vs free cycles - Implement auto-advance scheduling when renewal is processed - Add migration test for renewal_cycle column - Update dashboard to show renewal cycle count - Add renewal status display on node detail page * fix(frontend): show rule count in compact view mode for forward pages * style(frontend): format code and improve node card layout Entire-Checkpoint: 08b760b76538 * fix: restore renewal.ts from main to resolve build errors	2026-03-09 10:01:55 +08:00
qimaoww	a2ec08f033	fix(tunnel): restore upstream ipv6 address normalization logic	2026-03-09 03:33:40 +08:00
qimaoww	f8809d73fb	Merge branch 'main' into pr/wss-https-fallback	2026-03-08 22:38:26 +08:00
qimaoww	e5339a8072	chore: improve websocket wss->ws fallback diagnostics	2026-03-08 20:07:37 +08:00
qimaoww	fbb4d82a44	feat: add wss/https auto-detect with fallback for node-backend comm	2026-03-08 20:07:37 +08:00
Su-cyber-art	61b71a11c7	feat(node): split node page into local and remote sections	2026-03-08 18:45:56 +08:00
Su-cyber-art	4c69ff491d	feat(node): render remote usage details on remote node cards (cherry picked from commit 67294fa76422f994de8d95ec88f8f03e02ea6b9f)	2026-03-08 18:42:40 +08:00
Su-cyber-art	0ad4904e20	feat(node): split local and remote nodes into separate tabs (cherry picked from commit 30793b2997040dd29ff5fe6397d0bcab174ecc9e)	2026-03-08 18:42:36 +08:00
				`@@ -0,0 +1 @@`
				已成功构建并推送 `ghcr.io/sagit-chu/vite-frontend:beta` (linux/amd64)
				`@@ -0,0 +1 @@`
				`这个没改对，页面没变化，请检查`
				`@@ -0,0 +1 @@`
				`你好！我在这儿。要我帮你看代码、改功能、排查报错，还是跑命令都可以。`
				`@@ -0,0 +1 @@`
				`在agent.md中加上，尽量使用能使用的skills和mcp`
				`@@ -0,0 +1 @@`
				已添加到 `AGENTS.md` 的 CONVENTIONS 部分。
				`@@ -0,0 +1 @@`
				You are auditing the FLVX frontend for GitHub issue #276 (AJAX no-refresh UX improvements). Read-only only. Focus on existing implementation status for: 1) dashboard traffic auto-refresh, 2) node status real-time updates, 3) form submissions without full page reload, 4) local/partial list refresh after CRUD/toggle, 5) batch operation progress UI, 6) search/filter instant response. Inspect relevant files under vite-frontend/src/pages and src/api. Return a concise report with: a) what already exists, b) what is missing or partial, c) specific file paths and functions to touch for an implementation plan, d) notable risks or edge cases. Do not edit anything.