test: fix contract tests failing due to strict SSRF checks

.gitignore

@@ -67,7 +67,6 @@ go-gost/ss/
 .entire/
 bin/
 tmp/
-.worktrees/
 *.swp
 *.bak
 

docs/superpowers/plans/001-floating-save-button.md

@@ -1,132 +0,0 @@
-# Floating Save Button Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add a floating save button (FAB) to the config page that appears when configuration changes are detected.
-
-**Architecture:** Inline FAB implementation using framer-motion AnimatePresence for enter/exit animations. Fixed-position circular button with slide-up animation, reusing existing hasChanges state and handleSave function.
-
-**Tech Stack:** React, framer-motion (v11.18.2), shadcn-bridge/heroui Button, Tailwind CSS
-
----
-
-## File Structure
-
-| File | Action | Purpose |
-|------|--------|---------|
-| `vite-frontend/src/pages/config.tsx` | Modify | Add FAB imports and component at page bottom |
-
----
-
-### Task 1: Add framer-motion Imports
-
-**Files:**
-- Modify: `vite-frontend/src/pages/config.tsx:1-5`
-
-- [ ] **Step 1: Add AnimatePresence and motion imports**
-
-Add import statement after existing framer-motion imports (or at top if none exist).
-
-Current imports at line 1-2:
-```typescript
-import { useState, useEffect, useRef } from "react";
-import { useNavigate } from "react-router-dom";
-```
-
-Add new import after line 2:
-```typescript
-import { AnimatePresence, motion } from "framer-motion";
-```
-
-- [ ] **Step 2: Commit import addition**
-
-```bash
-git add vite-frontend/src/pages/config.tsx
-git commit -m "feat(config): add framer-motion imports for FAB animation"
-```
-
----
-
-### Task 2: Add FAB Component
-
-**Files:**
-- Modify: `vite-frontend/src/pages/config.tsx:1220-1224` (end of component)
-
-- [ ] **Step 1: Add FAB at end of component (before closing div)**
-
-Locate the end of `ConfigPage` component (line ~1223, the closing `</div>` after all modals).
-
-Insert FAB component before the closing `</div>`:
-
-```tsx
-      {/* Floating Save Button (FAB) */}
-      <AnimatePresence>
-        {hasChanges && (
-          <motion.div
-            initial={{ y: 100, opacity: 0 }}
-            animate={{ y: 0, opacity: 1 }}
-            exit={{ y: 100, opacity: 0 }}
-            transition={{ type: "spring", damping: 20, stiffness: 300 }}
-            className="fixed bottom-6 right-6 z-50"
-          >
-            <Button
-              isIconOnly
-              color="primary"
-              size="lg"
-              className="w-12 h-12 rounded-full shadow-lg"
-              isLoading={saving}
-              onPress={handleSave}
-            >
-              {!saving && <SaveIcon className="w-5 h-5" />}
-            </Button>
-          </motion.div>
-        )}
-      </AnimatePresence>
-    </div>
-  );
-}
-```
-
-- [ ] **Step 2: Run dev server to verify**
-
-```bash
-cd vite-frontend && npm run dev
-```
-
-Manual verification checklist:
-- Open config page at http://localhost:3000/config
-- Modify any config field
-- Verify FAB appears with slide-up animation
-- Click FAB to save
-- Verify FAB disappears with slide-down animation after save
-- Scroll page and verify FAB stays fixed in viewport corner
-- Test on mobile viewport (resize browser or use dev tools)
-
-- [ ] **Step 3: Commit FAB implementation**
-
-```bash
-git add vite-frontend/src/pages/config.tsx
-git commit -m "feat(config): add floating save button (FAB) for issue #266"
-```
-
----
-
-## Verification Summary
-
-| Requirement | Verification Method |
-|-------------|---------------------|
-| FAB hidden by default | Visual: no FAB on page load with no changes |
-| FAB appears on change | Visual: modify field → FAB slides up |
-| Fixed position | Visual: scroll page → FAB stays in corner |
-| Slide-up animation | Visual: observe animation timing/bounce |
-| Slide-down on save | Visual: click save → FAB slides down |
-| Loading state | Visual: click save → spinner shown during save |
-| Mobile compatibility | Visual: resize to mobile viewport → same behavior |
-
----
-
-## Self-Review Checklist
-
-- [x] Spec coverage: All requirements from design doc covered (imports + FAB component, animation params, button style, interaction behavior)
-- [x] No placeholders: All code shown, no TBD/TODO
-- [x] Type consistency: SaveIcon (line 45-59), handleSave (line 372-434), hasChanges (line 214), saving (line 213) all exist in config.tsx

docs/superpowers/plans/2026-04-01-github-proxy-config.md

@@ -1,520 +0,0 @@
-# GitHub 加速地址自定义配置实现计划
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** 允许用户在面板设置中自定义 GitHub 加速地址，支持开启/关闭加速，配置影响全部下载场景。
-
-**Architecture:** 使用现有 `vite_config` 表存储配置，后端 Handler 读取配置替换硬编码，前端复用现有配置项渲染逻辑，安装脚本支持环境变量和交互式询问。
-
-**Tech Stack:** Go 1.24, React/TypeScript, Shell/Bash
-
----
-
-## 文件结构
-
-| 文件 | 操作 | 说明 |
-|------|------|------|
-| `go-backend/internal/http/handler/upgrade.go` | 修改 | 移除硬编码，添加配置读取函数 |
-| `go-backend/internal/http/handler/mutations.go` | 修改 | `nodeInstall` 函数使用动态配置 |
-| `vite-frontend/src/pages/config.tsx` | 修改 | 添加两个新配置项 |
-| `install.sh` | 修改 | 支持交互式询问和环境变量 |
-| `panel_install.sh` | 修改 | 支持交互式询问和环境变量 |
-| `test-install-scripts-proxy.sh` | 新增 | 覆盖代理交互与下载 URL 回归 |
-
----
-
-## Task 1: 后端 - upgrade.go 修改
-
-**Files:**
-- Modify: `go-backend/internal/http/handler/upgrade.go`
-
-- [x] **Step 1: 移除硬编码常量，添加配置读取函数**
-
-在 `upgrade.go` 中，移除 `githubProxy` 常量，添加 `getGithubProxyConfig` 函数：
-
-找到第 16-26 行：
-```go
-const (
-	githubRepo     = "Sagit-chu/flvx"
-	githubProxy    = "https://gcode.hostcentral.cc"
-	githubAPIBase  = "https://api.github.com"
-	githubHTMLBase = "https://github.com"
-	upgradeTimeout = 5 * time.Minute
-	batchWorkers   = 5
-
-	releaseChannelStable = "stable"
-	releaseChannelDev    = "dev"
-)
-```
-
-替换为：
-```go
-const (
-	githubRepo     = "Sagit-chu/flvx"
-	githubAPIBase  = "https://api.github.com"
-	githubHTMLBase = "https://github.com"
-	upgradeTimeout = 5 * time.Minute
-	batchWorkers   = 5
-
-	releaseChannelStable = "stable"
-	releaseChannelDev    = "dev"
-
-	defaultGithubProxyEnabled = true
-	defaultGithubProxyURL     = "https://gcode.hostcentral.cc"
-)
-```
-
-然后在 `releaseChannelLabel` 函数后（约第 71 行之后）添加新函数：
-```go
-// getGithubProxyConfig 获取 GitHub 加速配置
-// 返回: (是否开启加速, 加速地址)
-func (h *Handler) getGithubProxyConfig() (enabled bool, proxyURL string) {
-	enabled = defaultGithubProxyEnabled
-	proxyURL = defaultGithubProxyURL
-
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	// 读取开启状态
-	if enabledCfg, err := h.repo.GetConfigByName("github_proxy_enabled"); err == nil && enabledCfg != nil {
-		enabled = enabledCfg.Value != "false"
-	}
-
-	// 读取加速地址
-	if urlCfg, err := h.repo.GetConfigByName("github_proxy_url"); err == nil && urlCfg != nil && urlCfg.Value != "" {
-		proxyURL = strings.TrimSpace(urlCfg.Value)
-		// 确保 URL 格式正确
-		if !strings.HasPrefix(proxyURL, "http://") && !strings.HasPrefix(proxyURL, "https://") {
-			proxyURL = "https://" + proxyURL
-		}
-		proxyURL = strings.TrimSuffix(proxyURL, "/")
-	}
-
-	return
-}
-
-// buildGithubDownloadURL 构建 GitHub 下载地址
-func (h *Handler) buildGithubDownloadURL(version, filename string) string {
-	enabled, proxyURL := h.getGithubProxyConfig()
-	base := fmt.Sprintf("%s/%s/releases/download/%s/%s", githubHTMLBase, githubRepo, version, filename)
-
-	if enabled {
-		return fmt.Sprintf("%s/%s", proxyURL, base)
-	}
-	return base
-}
-```
-
-- [x] **Step 2: 修改 nodeUpgrade 函数使用动态配置**
-
-找到第 152-159 行：
-```go
-	downloadURL := fmt.Sprintf(
-		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}",
-		githubHTMLBase, githubRepo, version,
-	)
-	checksumURL := fmt.Sprintf(
-		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}.sha256",
-		githubHTMLBase, githubRepo, version,
-	)
-```
-
-替换为：
-```go
-	downloadURL := h.buildGithubDownloadURL(version, "gost-{ARCH}")
-	checksumURL := h.buildGithubDownloadURL(version, "gost-{ARCH}.sha256")
-```
-
-- [x] **Step 3: 修改 nodeBatchUpgrade 函数使用动态配置**
-
-找到第 216-223 行：
-```go
-	downloadURL := fmt.Sprintf(
-		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}",
-		githubHTMLBase, githubRepo, version,
-	)
-	checksumURL := fmt.Sprintf(
-		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}.sha256",
-		githubHTMLBase, githubRepo, version,
-	)
-```
-
-替换为：
-```go
-	downloadURL := h.buildGithubDownloadURL(version, "gost-{ARCH}")
-	checksumURL := h.buildGithubDownloadURL(version, "gost-{ARCH}.sha256")
-```
-
-- [x] **Step 4: 验证编译**
-
-Run: `cd go-backend && go build ./...`
-Expected: 编译成功，无错误
-
-- [x] **Step 5: 提交**
-
-```bash
-git add go-backend/internal/http/handler/upgrade.go
-git commit -m "feat(backend): use configurable github proxy for node upgrades"
-```
-
----
-
-## Task 2: 后端 - mutations.go 修改
-
-**Files:**
-- Modify: `go-backend/internal/http/handler/mutations.go`
-
-- [x] **Step 1: 修改 nodeInstall 函数使用动态配置**
-
-找到第 456 行：
-```go
-	cmd := fmt.Sprintf("curl -L https://gcode.hostcentral.cc/https://github.com/Sagit-chu/flvx/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && VERSION=%s ./install.sh -a %s -s %s", version, version, processServerAddress(panelAddr), secret)
-```
-
-替换为：
-```go
-	enabled, proxyURL := h.getGithubProxyConfig()
-
-	var cmd string
-	if enabled {
-		cmd = fmt.Sprintf("curl -L %s/https://github.com/%s/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && PROXY_ENABLED=true PROXY_URL=%s VERSION=%s ./install.sh -a %s -s %s",
-			proxyURL, githubRepo, version, proxyURL, version, processServerAddress(panelAddr), secret)
-	} else {
-		cmd = fmt.Sprintf("curl -L https://github.com/%s/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && PROXY_ENABLED=false VERSION=%s ./install.sh -a %s -s %s",
-			githubRepo, version, version, processServerAddress(panelAddr), secret)
-	}
-```
-
-- [x] **Step 2: 验证编译**
-
-Run: `cd go-backend && go build ./...`
-Expected: 编译成功，无错误
-
-- [x] **Step 3: 提交**
-
-```bash
-git add go-backend/internal/http/handler/mutations.go
-git commit -m "feat(backend): use configurable github proxy for node install command"
-```
-
----
-
-## Task 3: 前端 - config.tsx 添加配置项
-
-**Files:**
-- Modify: `vite-frontend/src/pages/config.tsx`
-
-- [x] **Step 1: 在 CONFIG_ITEMS 数组中添加配置项**
-
-找到第 158 行（`CONFIG_ITEMS` 数组的结束位置）：
-```go
-  {
-    key: "cloudflare_secret_key",
-    label: "Cloudflare Secret Key",
-    placeholder: "请输入 Cloudflare Secret Key",
-    description: "Cloudflare Turnstile 密钥",
-    type: "input",
-    dependsOn: "captcha_enabled",
-    dependsValue: "true",
-  },
-];
-```
-
-在 `];` 之前添加：
-```typescript
-  {
-    key: "github_proxy_enabled",
-    label: "开启 GitHub 加速",
-    description: "用于节点更新和安装脚本下载，解决部分地区 GitHub 访问受限问题",
-    type: "switch",
-  },
-  {
-    key: "github_proxy_url",
-    label: "加速地址",
-    placeholder: "https://gcode.hostcentral.cc",
-    description: "GitHub 下载加速代理地址，开启加速后生效",
-    type: "input",
-    dependsOn: "github_proxy_enabled",
-    dependsValue: "true",
-  },
-```
-
-- [x] **Step 2: 在缓存键列表中添加新键**
-
-找到第 179-190 行：
-```typescript
-  const configKeys = [
-    "app_name",
-    "captcha_enabled",
-    "cloudflare_site_key",
-    "cloudflare_secret_key",
-    "forward_compact_mode",
-    "monitor_tunnel_quality_enabled",
-    "ip",
-    "panel_domain",
-    "app_logo",
-    "app_favicon",
-  ];
-```
-
-在 `"app_favicon",` 之后添加：
-```typescript
-    "github_proxy_enabled",
-    "github_proxy_url",
-```
-
-- [x] **Step 3: 验证前端编译**
-
-Run: `cd vite-frontend && npm run build`
-Expected: 编译成功，无错误
-
-- [x] **Step 4: 提交**
-
-```bash
-git add vite-frontend/src/pages/config.tsx
-git commit -m "feat(frontend): add github proxy config settings"
-```
-
----
-
-## Task 4: 安装脚本 - install.sh 修改
-
-**Files:**
-- Modify: `install.sh`
-
-- [x] **Step 1: 添加环境变量声明和修改 maybe_proxy_url 函数**
-
-找到第 28-32 行：
-```bash
-# 镜像加速（所有下载均经过镜像源，以支持 IPv6）
-maybe_proxy_url() {
-  local url="$1"
-  echo "https://gcode.hostcentral.cc/${url}"
-}
-```
-
-替换为：
-```bash
-# 镜像加速配置（可由面板传入或交互式询问）
-PROXY_ENABLED="${PROXY_ENABLED:-}"
-PROXY_URL="${PROXY_URL:-}"
-
-# 镜像加速
-maybe_proxy_url() {
-  local url="$1"
-
-  # 如果明确关闭加速
-  if [[ "$PROXY_ENABLED" == "false" ]]; then
-    echo "$url"
-    return
-  fi
-
-  # 默认开启加速
-  local proxy="${PROXY_URL:-gcode.hostcentral.cc}"
-
-  # 处理 URL 格式
-  if [[ "$proxy" == https://* || "$proxy" == http://* ]]; then
-    proxy="${proxy%/}"
-  else
-    proxy="https://${proxy}"
-  fi
-
-  echo "${proxy}/${url}"
-}
-
-# 询问加速配置（如果未由面板传入）
-ask_proxy_config() {
-  if [[ -n "$PROXY_ENABLED" ]]; then
-    return
-  fi
-
-  echo ""
-  echo "==============================================="
-  echo "           GitHub 加速配置"
-  echo "==============================================="
-  read -p "是否开启 GitHub 加速? (Y/n): " proxy_choice
-  case "$proxy_choice" in
-    n|N)
-      PROXY_ENABLED="false"
-      echo "已关闭加速，将直连 GitHub"
-      ;;
-    *)
-      PROXY_ENABLED="true"
-      read -p "加速地址 (默认 gcode.hostcentral.cc): " input_url
-      PROXY_URL="${input_url:-gcode.hostcentral.cc}"
-      echo "已开启加速: $PROXY_URL"
-      ;;
-  esac
-  echo "==============================================="
-}
-```
-
-- [x] **Step 2: 修改 install_flux_agent 函数添加询问**
-
-找到第 211-214 行：
-```bash
-# 安装功能
-install_flux_agent() {
-  echo "🚀 开始安装 flux_agent..."
-  get_config_params
-```
-
-替换为：
-```bash
-# 安装功能
-install_flux_agent() {
-  echo "🚀 开始安装 flux_agent..."
-
-  # 询问加速配置（如果未由面板传入）
-  ask_proxy_config
-
-  get_config_params
-```
-
-- [ ] **Step 3: 提交**
-
-```bash
-git add install.sh
-git commit -m "feat(script): add configurable github proxy for install.sh"
-```
-
----
-
-## Task 5: 安装脚本 - panel_install.sh 修改
-
-**Files:**
-- Modify: `panel_install.sh`
-
-- [x] **Step 1: 添加环境变量声明和修改 maybe_proxy_url 函数**
-
-找到第 16-20 行：
-```bash
-# 镜像加速（所有下载均经过镜像源，以支持 IPv6）
-maybe_proxy_url() {
-  local url="$1"
-  echo "https://gcode.hostcentral.cc/${url}"
-}
-```
-
-替换为：
-```bash
-# 镜像加速配置（可由面板传入或交互式询问）
-PROXY_ENABLED="${PROXY_ENABLED:-}"
-PROXY_URL="${PROXY_URL:-}"
-
-# 镜像加速
-maybe_proxy_url() {
-  local url="$1"
-
-  # 如果明确关闭加速
-  if [[ "$PROXY_ENABLED" == "false" ]]; then
-    echo "$url"
-    return
-  fi
-
-  # 默认开启加速
-  local proxy="${PROXY_URL:-gcode.hostcentral.cc}"
-
-  # 处理 URL 格式
-  if [[ "$proxy" == https://* || "$proxy" == http://* ]]; then
-    proxy="${proxy%/}"
-  else
-    proxy="https://${proxy}"
-  fi
-
-  echo "${proxy}/${url}"
-}
-
-# 询问加速配置（如果未由面板传入）
-ask_proxy_config() {
-  if [[ -n "$PROXY_ENABLED" ]]; then
-    return
-  fi
-
-  echo ""
-  echo "==============================================="
-  echo "           GitHub 加速配置"
-  echo "==============================================="
-  read -p "是否开启 GitHub 加速? (Y/n): " proxy_choice
-  case "$proxy_choice" in
-    n|N)
-      PROXY_ENABLED="false"
-      echo "已关闭加速，将直连 GitHub"
-      ;;
-    *)
-      PROXY_ENABLED="true"
-      read -p "加速地址 (默认 gcode.hostcentral.cc): " input_url
-      PROXY_URL="${input_url:-gcode.hostcentral.cc}"
-      echo "已开启加速: $PROXY_URL"
-      ;;
-  esac
-  echo "==============================================="
-}
-```
-
-- [x] **Step 2: 修改 install_panel 函数添加询问**
-
-找到第 375-378 行：
-```bash
-# 安装功能
-install_panel() {
-  echo "🚀 开始安装面板..."
-  check_docker
-  get_config_params
-```
-
-替换为：
-```bash
-# 安装功能
-install_panel() {
-  echo "🚀 开始安装面板..."
-
-  # 询问加速配置（如果未由面板传入）
-  ask_proxy_config
-
-  check_docker
-  get_config_params
-```
-
-- [ ] **Step 3: 提交**
-
-```bash
-git add panel_install.sh
-git commit -m "feat(script): add configurable github proxy for panel_install.sh"
-```
-
----
-
-## Task 6: 最终验证和提交
-
-- [x] **Step 1: 验证后端编译**
-
-Run: `cd go-backend && go build ./...`
-Expected: 编译成功
-
-- [x] **Step 2: 验证前端编译**
-
-Run: `cd vite-frontend && npm run build`
-Expected: 编译成功
-
-- [x] **Step 3: 验证脚本语法**
-
-Run: `bash -n install.sh && bash -n panel_install.sh && bash test-install-scripts-proxy.sh`
-Expected: 无语法错误，且脚本代理回归测试通过
-
-- [ ] **Step 4: 推送所有提交**
-
-```bash
-git push
-```
-
----
-
-## 验收标准
-
-1. 面板设置页面显示 GitHub 加速配置项
-2. 开关关闭后，下载地址直连 GitHub
-3. 自定义加速地址后，节点更新和安装命令使用自定义地址
-4. 安装脚本支持交互式询问加速配置
-5. 面板生成的安装命令包含加速配置环境变量

docs/superpowers/specs/2026-04-01-floating-save-button-design.md

@@ -1,162 +0,0 @@
-# Floating Save Button Design
-
-**Date:** 2026-04-01
-**Issue:** https://github.com/Sagit-chu/flvx/issues/266
-**Status:** Approved
-
-## Overview
-
-Add a Floating Action Button (FAB) to the config page (`vite-frontend/src/pages/config.tsx`) that appears when configuration changes are detected, allowing users to save without scrolling to the top.
-
-## Requirements
-
-From Issue #266:
-
-1. **Default hidden**: FAB not visible when no config changes
-2. **Show on change**: Auto-display when `hasChanges` becomes true
-3. **Fixed position**: Suspended at bottom-right corner, does not scroll with page
-4. **Mobile compatible**: Same behavior on desktop and mobile devices
-
-## Design Decisions
-
-### 1. Implementation Approach
-
-**Inline FAB in config.tsx** (not a reusable component)
-
-- Rationale: Current need is limited to config page only
-- State management (`hasChanges`, `saving`) already exists in the page
-- framer-motion patterns already established in project
-- Avoids over-abstraction (YAGNI)
-
-### 2. UI Structure
-
-Position: `fixed bottom-6 right-6` (24px from viewport edges)
-
-Visual layout:
-```
-┌──────────────────────────────────────┐
-│  [页面内容，可滚动]                    │
-│                                      │
-│                                [●]   │ ← FAB (fixed position)
-└──────────────────────────────────────┘
-```
-
-### 3. Button Appearance
-
-- Shape: Circular (`w-12 h-12 rounded-full`)
-- Color: Primary (matches existing save button)
-- Icon: SaveIcon (already defined in config.tsx)
-- Shadow: `shadow-lg` for visual hierarchy
-- Style: Icon-only (no text label)
-
-### 4. Animation
-
-Using framer-motion with `AnimatePresence`:
-
-| Phase | Properties |
-|-------|------------|
-| `initial` | `{ y: 100, opacity: 0 }` - starts below viewport |
-| `animate` | `{ y: 0, opacity: 1 }` - slides up to position |
-| `exit` | `{ y: 100, opacity: 0 }` - slides back down on hide |
-
-Transition config:
-```typescript
-transition={{ type: "spring", damping: 20, stiffness: 300 }}
-```
-
-Spring parameters produce Material Design-like feel: smooth entrance, slight bounce settle.
-
-### 5. Interaction Details
-
-- **Click**: Calls existing `handleSave()` function
-- **Loading state**: Button shows Spinner when `saving === true`
-- **Hover**: Inherits Button component's primary color hover behavior
-- **z-index**: `z-50` (above page content, below modals)
-- **Prevent duplicate click**: Button disabled when `saving === true`
-
-## Technical Implementation
-
-### Code Location
-
-File: `vite-frontend/src/pages/config.tsx`
-
-### Required Imports
-
-```typescript
-import { AnimatePresence, motion } from "framer-motion";
-```
-
-### FAB Component Structure
-
-```tsx
-<AnimatePresence>
-  {hasChanges && (
-    <motion.div
-      initial={{ y: 100, opacity: 0 }}
-      animate={{ y: 0, opacity: 1 }}
-      exit={{ y: 100, opacity: 0 }}
-      transition={{ type: "spring", damping: 20, stiffness: 300 }}
-      className="fixed bottom-6 right-6 z-50"
-    >
-      <Button
-        isIconOnly
-        color="primary"
-        size="lg"
-        className="w-12 h-12 rounded-full shadow-lg"
-        isLoading={saving}
-        onPress={handleSave}
-      >
-        {!saving && <SaveIcon className="w-5 h-5" />}
-      </Button>
-    </motion.div>
-  )}
-</AnimatePresence>
-```
-
-### Placement
-
-Insert FAB at the end of the component, before the closing `</div>` (after all Cards and Modals).
-
-### Dependencies
-
-- framer-motion: Already installed (v11.18.2)
-- Button: Already imported from `@/shadcn-bridge/heroui/button`
-- SaveIcon: Already defined in config.tsx
-
-## Behavior Matrix
-
-| State | FAB Visibility | Button Enabled |
-|-------|----------------|----------------|
-| `hasChanges = false` | Hidden (not rendered) | N/A |
-| `hasChanges = true, saving = false` | Visible, animating in | Yes |
-| `hasChanges = true, saving = true` | Visible | No (loading) |
-| Save success | Hidden (animating out) | N/A |
-
-## Responsive Behavior
-
-No special handling needed. `fixed bottom-6 right-6` works identically on:
-- Desktop browsers
-- Mobile browsers
-- H5/WebView mode
-
-The FAB maintains consistent 24px margin from viewport edges regardless of screen size.
-
-## Edge Cases
-
-1. **Multiple rapid toggles**: AnimatePresence handles gracefully - exit animation completes before new enter animation
-2. **Page unload with unsaved changes**: Not addressed in this design (separate concern)
-3. **FAB covers existing warning banner**: z-50 places FAB above the warning banner at line 1004-1013
-
-## Testing Checklist
-
-After implementation, verify:
-
-- [ ] FAB appears when any config field is modified
-- [ ] FAB slides up from bottom on appearance
-- [ ] FAB slides down to bottom on disappearance
-- [ ] FAB fixed position during page scroll
-- [ ] FAB triggers save on click
-- [ ] FAB shows spinner during save
-- [ ] FAB disappears after successful save
-- [ ] FAB works on mobile viewport
-- [ ] FAB does not interfere with Modal dialogs

docs/superpowers/specs/2026-04-01-github-proxy-config-design.md

@@ -1,274 +0,0 @@
-# GitHub 加速地址自定义配置设计
-
-**日期**: 2026-04-01
-**状态**: 待审核
-**作者**: AI Assistant
-
-## 概述
-
-允许用户在面板设置中自定义 GitHub 加速地址，支持开启/关闭加速功能。配置后，面板更新节点、生成安装命令以及安装脚本都使用配置的加速地址。
-
-## 背景
-
-当前 `gcode.hostcentral.cc` 硬编码在多个位置：
-- `go-backend/internal/http/handler/upgrade.go` - 节点升级下载 URL
-- `go-backend/internal/http/handler/mutations.go` - 节点安装命令生成
-- `install.sh` - 节点安装脚本
-- `panel_install.sh` - 面板安装脚本
-
-用户无法自定义加速地址或关闭加速功能。
-
-## 目标
-
-1. 面板设置中支持配置加速开关和加速地址
-2. 配置影响全部下载场景（面板端 + 安装脚本）
-3. 安装脚本支持交互式询问加速配置
-4. 面板生成的安装命令自动嵌入加速配置
-
-## 影响范围
-
-### 后端
-- `go-backend/internal/http/handler/upgrade.go`
-- `go-backend/internal/http/handler/mutations.go`
-
-### 前端
-- `vite-frontend/src/pages/config.tsx`
-- `vite-frontend/src/config/site.ts`（缓存配置键）
-
-### 安装脚本
-- `install.sh`
-- `panel_install.sh`
-
-## 详细设计
-
-### 1. 数据存储
-
-使用现有 `vite_config` 表存储两个配置项：
-
-| name | value | 说明 |
-|------|-------|------|
-| `github_proxy_enabled` | `"true"` / `"false"` | 是否开启加速，默认 `"true"` |
-| `github_proxy_url` | URL 字符串 | 加速地址，默认 `"https://gcode.hostcentral.cc"` |
-
-### 2. 后端 Handler 修改
-
-#### upgrade.go
-
-移除硬编码常量，新增辅助函数：
-
-```go
-// getGithubProxyConfig 获取 GitHub 加速配置
-// 返回: (是否开启, 加速地址)
-func (h *Handler) getGithubProxyConfig() (enabled bool, proxyURL string) {
-    enabled = true  // 默认开启
-    proxyURL = "https://gcode.hostcentral.cc"  // 默认地址
-    
-    if h == nil || h.repo == nil {
-        return
-    }
-    
-    // 读取开启状态
-    if enabledCfg, err := h.repo.GetConfigByName("github_proxy_enabled"); err == nil && enabledCfg != nil {
-        enabled = enabledCfg.Value != "false"
-    }
-    
-    // 读取加速地址
-    if urlCfg, err := h.repo.GetConfigByName("github_proxy_url"); err == nil && urlCfg != nil && urlCfg.Value != "" {
-        proxyURL = strings.TrimSpace(urlCfg.Value)
-        // 确保 URL 格式正确
-        if !strings.HasPrefix(proxyURL, "http://") && !strings.HasPrefix(proxyURL, "https://") {
-            proxyURL = "https://" + proxyURL
-        }
-        proxyURL = strings.TrimSuffix(proxyURL, "/")
-    }
-    
-    return
-}
-
-// buildDownloadURL 构建下载地址
-func (h *Handler) buildDownloadURL(version, arch string) string {
-    enabled, proxyURL := h.getGithubProxyConfig()
-    base := fmt.Sprintf("https://github.com/%s/releases/download/%s/gost-%s", githubRepo, version, arch)
-    
-    if enabled {
-        return fmt.Sprintf("%s/%s", proxyURL, base)
-    }
-    return base
-}
-```
-
-修改 `nodeUpgrade` 和 `nodeBatchUpgrade` 使用动态配置。
-
-#### mutations.go
-
-修改 `getNodeInstallCmd` 函数（约第 440-456 行）：
-
-```go
-func (h *Handler) getNodeInstallCmd(w http.ResponseWriter, r *http.Request) {
-    // ... 现有逻辑 ...
-    
-    enabled, proxyURL := h.getGithubProxyConfig()
-    
-    var cmd string
-    if enabled {
-        cmd = fmt.Sprintf(
-            "curl -L %s/https://github.com/%s/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && PROXY_ENABLED=true PROXY_URL=%s VERSION=%s ./install.sh -a %s -s %s",
-            proxyURL, githubRepo, version, proxyURL, version, processServerAddress(panelAddr), secret,
-        )
-    } else {
-        cmd = fmt.Sprintf(
-            "curl -L https://github.com/%s/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && PROXY_ENABLED=false VERSION=%s ./install.sh -a %s -s %s",
-            githubRepo, version, version, processServerAddress(panelAddr), secret,
-        )
-    }
-    
-    response.WriteJSON(w, response.OK(cmd))
-}
-```
-
-### 3. 前端修改
-
-#### config.tsx
-
-在 `CONFIG_ITEMS` 数组中添加配置项（约第 87-158 行之后）：
-
-```typescript
-{
-  key: "github_proxy_enabled",
-  label: "开启 GitHub 加速",
-  description: "用于节点更新和安装脚本下载，解决部分地区 GitHub 访问受限问题",
-  type: "switch",
-},
-{
-  key: "github_proxy_url",
-  label: "加速地址",
-  placeholder: "https://gcode.hostcentral.cc",
-  description: "GitHub 下载加速代理地址，开启加速后生效",
-  type: "input",
-  dependsOn: "github_proxy_enabled",
-  dependsValue: "true",
-},
-```
-
-在 `getInitialConfigs` 函数的 `configKeys` 数组中添加缓存键：
-
-```typescript
-"github_proxy_enabled",
-"github_proxy_url",
-```
-
-### 4. 安装脚本修改
-
-#### install.sh
-
-在脚本开头添加配置变量和环境变量读取：
-
-```bash
-# 镜像加速配置（可由面板传入）
-PROXY_ENABLED="${PROXY_ENABLED:-}"
-PROXY_URL="${PROXY_URL:-}"
-```
-
-修改 `maybe_proxy_url` 函数：
-
-```bash
-# 镜像加速
-maybe_proxy_url() {
-  local url="$1"
-  
-  # 如果明确关闭加速
-  if [[ "$PROXY_ENABLED" == "false" ]]; then
-    echo "$url"
-    return
-  fi
-  
-  # 默认开启加速
-  local proxy="${PROXY_URL:-gcode.hostcentral.cc}"
-  
-  # 处理 URL 格式
-  if [[ "$proxy" == https://* || "$proxy" == http://* ]]; then
-    proxy="${proxy%/}"  # 移除末尾斜杠
-  else
-    proxy="https://${proxy}"
-  fi
-  
-  echo "${proxy}/${url}"
-}
-```
-
-在 `install_flux_agent` 函数开头添加交互式询问：
-
-```bash
-install_flux_agent() {
-  echo "🚀 开始安装 flux_agent..."
-  
-  # 询问加速配置（如果未由面板传入）
-  if [[ -z "$PROXY_ENABLED" ]]; then
-    echo ""
-    read -p "是否开启 GitHub 加速? (Y/n): " proxy_choice
-    case "$proxy_choice" in
-      n|N) PROXY_ENABLED="false" ;;
-      *)   
-        PROXY_ENABLED="true"
-        read -p "加速地址 (默认 gcode.hostcentral.cc): " input_url
-        PROXY_URL="${input_url:-gcode.hostcentral.cc}"
-        ;;
-    esac
-  fi
-  
-  # ... 现有安装逻辑 ...
-}
-```
-
-#### panel_install.sh
-
-类似修改，在 `install_panel` 函数开头添加询问逻辑。
-
-### 5. 配置缓存
-
-#### site.ts
-
-在配置缓存键列表中添加新键（如果需要前端缓存加速配置）。
-
-## 默认行为
-
-- `github_proxy_enabled`: 默认 `"true"`（开启加速）
-- `github_proxy_url`: 默认 `"https://gcode.hostcentral.cc"`
-
-## 测试要点
-
-1. **后端 API 测试**：
-   - 未配置时使用默认值
-   - 配置后正确读取并应用
-   - 关闭加速后直连 GitHub
-
-2. **前端 UI 测试**：
-   - Switch 开关正确切换
-   - 关闭加速时隐藏地址输入框
-   - 保存配置后正确持久化
-
-3. **安装脚本测试**：
-   - 交互式询问正常工作
-   - 环境变量传入时跳过询问
-   - 加速关闭时直连 GitHub
-
-4. **集成测试**：
-   - 面板生成安装命令正确包含加速配置
-   - 节点升级下载使用配置的加速地址
-
-## 风险与缓解
-
-| 风险 | 缓解措施 |
-|------|----------|
-| 用户输入无效加速地址 | 后端验证 URL 格式，前端添加格式提示 |
-| 旧版本安装脚本不兼容 | 保持 `maybe_proxy_url` 函数签名不变，仅修改内部逻辑 |
-| 配置缺失时行为不一致 | 在 `getGithubProxyConfig` 中提供合理的默认值 |
-
-## 任务清单
-
-- [ ] 后端：upgrade.go 修改
-- [ ] 后端：mutations.go 修改
-- [ ] 前端：config.tsx 添加配置项
-- [ ] 脚本：install.sh 修改
-- [ ] 脚本：panel_install.sh 修改
-- [ ] 测试：验证功能正常

go-backend/internal/http/handler/control_plane.go

@@ -1577,11 +1577,10 @@ func buildForwardServiceConfigs(baseName string, forward *forwardRecord, tunnel
 		}
 		var serviceAddr string
 		if bindIP != "" {
-			trimmedBindIP := strings.TrimSpace(bindIP)
-			if _, _, err := net.SplitHostPort(trimmedBindIP); err == nil {
-				serviceAddr = processServerAddress(trimmedBindIP)
+			if strings.Contains(bindIP, ":") {
+				serviceAddr = processServerAddress(bindIP)
 			} else {
-				serviceAddr = processServerAddress(net.JoinHostPort(strings.Trim(trimmedBindIP, "[]"), strconv.Itoa(port)))
+				serviceAddr = processServerAddress(fmt.Sprintf("%s:%d", bindIP, port))
 			}
 		} else {
 			serviceAddr = processServerAddress(fmt.Sprintf("%s:%d", listenerAddr, port))

go-backend/internal/http/handler/control_plane_test.go

@@ -421,63 +421,6 @@ func TestBuildForwardServiceConfigs_BindIPAlreadyContainsPort(t *testing.T) {
 	}
 }
 
-func TestBuildForwardServiceConfigs_IPv6BindIP(t *testing.T) {
-	tests := []struct {
-		name     string
-		bindIP   string
-		port     int
-		wantAddr string
-	}{
-		{
-			name:     "pure ipv6 without port",
-			bindIP:   "2001:db8::1",
-			port:     22000,
-			wantAddr: "[2001:db8::1]:22000",
-		},
-		{
-			name:     "bracketed ipv6 without port",
-			bindIP:   "[2001:db8::2]",
-			port:     22001,
-			wantAddr: "[2001:db8::2]:22001",
-		},
-		{
-			name:     "bracketed ipv6 with port",
-			bindIP:   "[2001:db8::3]:8080",
-			port:     55555,
-			wantAddr: "[2001:db8::3]:8080",
-		},
-		{
-			name:     "ipv6 link-local with zone",
-			bindIP:   "fe80::1%eth0",
-			port:     22002,
-			wantAddr: "[fe80::1%eth0]:22002",
-		},
-		{
-			name:     "ipv6 localhost",
-			bindIP:   "::1",
-			port:     22003,
-			wantAddr: "[::1]:22003",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-			node := &nodeRecord{TCPListenAddr: "[::]", UDPListenAddr: "[::]"}
-			services := buildForwardServiceConfigs("1_2_0", forward, nil, node, tt.port, tt.bindIP, nil, false)
-			if len(services) != 2 {
-				t.Fatalf("expected 2 services, got %d", len(services))
-			}
-			for _, svc := range services {
-				addr, _ := svc["addr"].(string)
-				if addr != tt.wantAddr {
-					t.Fatalf("expected addr %q, got %q", tt.wantAddr, addr)
-				}
-			}
-		})
-	}
-}
-
 func TestProcessServerAddress_StripsURLSchemeAndPath(t *testing.T) {
 	tests := []struct {
 		name string

go-backend/internal/http/handler/federation.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -636,6 +637,16 @@ func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	rUrl, err := url.Parse(req.RemoteURL)
+	if err != nil || (rUrl.Scheme != "http" && rUrl.Scheme != "https") {
+		response.WriteJSON(w, response.ErrDefault("Invalid Remote URL format"))
+		return
+	}
+	if err := IsSafeRemoteAddr(rUrl.Host); err != nil {
+		response.WriteJSON(w, response.Err(403, "禁止将远程节点地址设置为内部网络或保留地址"))
+		return
+	}
+
 	domainCfg, _ := h.repo.GetConfigByName("panel_domain")
 	localDomain := ""
 	if domainCfg != nil {

go-backend/internal/http/handler/flow_policy.go

@@ -22,7 +22,6 @@ type userTunnelPolicy struct {
 	OutFlow  int64
 	ExpTime  int64
 	Status   int
-	Num      int
 }
 
 type gostConfigSnapshot struct {
@@ -364,16 +363,6 @@ func (h *Handler) ensureUserTunnelForwardAllowed(userID int64, tunnelID int64, n
 		return err
 	}
 
-	if user.Num > 0 {
-		currentForwardCount, err := h.repo.CountActiveForwardsByUser(userID)
-		if err != nil {
-			return err
-		}
-		if currentForwardCount >= int64(user.Num) {
-			return errors.New("转发数量已达上限")
-		}
-	}
-
 	userTunnelID, _, _, err := h.resolveUserTunnelAndLimiter(userID, tunnelID)
 	if err != nil {
 		return err
@@ -403,16 +392,6 @@ func (h *Handler) ensureUserTunnelForwardAllowed(userID int64, tunnelID int64, n
 		return errors.New("该隧道流量已超额，禁止开启转发")
 	}
 
-	if policy.Num > 0 {
-		currentTunnelForwardCount, err := h.repo.CountActiveForwardsByUserTunnel(userID, tunnelID)
-		if err != nil {
-			return err
-		}
-		if currentTunnelForwardCount >= int64(policy.Num) {
-			return errors.New("该隧道转发数量已达上限")
-		}
-	}
-
 	return nil
 }
 
@@ -463,7 +442,7 @@ func (h *Handler) getUserTunnelPolicy(userTunnelID int64) (*userTunnelPolicy, er
 	return &userTunnelPolicy{
 		ID: ut.ID, UserID: ut.UserID, TunnelID: ut.TunnelID,
 		Flow: ut.Flow, InFlow: ut.InFlow, OutFlow: ut.OutFlow,
-		ExpTime: ut.ExpTime, Status: ut.Status, Num: ut.Num,
+		ExpTime: ut.ExpTime, Status: ut.Status,
 	}, nil
 }
 

go-backend/internal/http/handler/handler.go

@@ -350,6 +350,13 @@ func (h *Handler) getConfigByName(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	configName := strings.ToLower(strings.TrimSpace(req.Name))
+	switch configName {
+	case "license_key", "cloudflare_secret_key", "jwt_secret":
+		response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
+		return
+	}
+
 	cfg, err := h.repo.GetConfigByName(req.Name)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
@@ -374,6 +381,15 @@ func (h *Handler) getConfigs(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+
+	// Filter sensitive config keys if the user is not an admin
+	ctxClaims := r.Context().Value(middleware.ClaimsContextKey)
+	if claims, ok := ctxClaims.(auth.Claims); !ok || claims.RoleID != 0 {
+		delete(cfgMap, "license_key")
+		delete(cfgMap, "cloudflare_secret_key")
+		delete(cfgMap, "jwt_secret")
+	}
+
 	response.WriteJSON(w, response.OK(cfgMap))
 }
 

go-backend/internal/http/handler/monitoring.go

@@ -245,7 +245,6 @@ func (h *Handler) monitorTunnelQualityHandler(w http.ResponseWriter, r *http.Req
 			Success:            q.Success == 1,
 			ErrorMessage:       q.ErrorMessage,
 			Timestamp:          q.Timestamp,
-			ChainDetails:       q.ChainDetails,
 		})
 	}
 	response.WriteJSON(w, response.OK(snapshots))

go-backend/internal/http/handler/mutations.go

@@ -301,6 +301,10 @@ func (h *Handler) nodeCreate(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("节点名称和地址不能为空"))
 		return
 	}
+	if err := IsValidNodeAddress(serverIP); err != nil {
+		response.WriteJSON(w, response.ErrDefault(err.Error()))
+		return
+	}
 
 	now := time.Now().UnixMilli()
 	inx := h.repo.NextIndex("node")
@@ -365,6 +369,15 @@ func (h *Handler) nodeUpdate(w http.ResponseWriter, r *http.Request) {
 	newHTTP := asInt(req["http"], currentHTTP)
 	newTLS := asInt(req["tls"], currentTLS)
 	newSocks := asInt(req["socks"], currentSocks)
+	
+	serverIP := asString(req["serverIp"])
+	if serverIP != "" {
+		if err := IsValidNodeAddress(serverIP); err != nil {
+			response.WriteJSON(w, response.ErrDefault(err.Error()))
+			return
+		}
+	}
+
 	if currentStatus == 1 && (newHTTP != currentHTTP || newTLS != currentTLS || newSocks != currentSocks) {
 		if err := h.applyNodeProtocolChange(id, newHTTP, newTLS, newSocks); err != nil {
 			response.WriteJSON(w, response.ErrDefault(err.Error()))
@@ -375,7 +388,7 @@ func (h *Handler) nodeUpdate(w http.ResponseWriter, r *http.Request) {
 	now := time.Now().UnixMilli()
 	if err := h.repo.UpdateNode(id,
 		asString(req["name"]),
-		asString(req["serverIp"]),
+		serverIP,
 		nullableText(asString(req["serverIpV4"])),
 		nullableText(asString(req["serverIpV6"])),
 		defaultString(asString(req["port"]), "1000-65535"),
@@ -453,16 +466,7 @@ func (h *Handler) nodeInstall(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	enabled, proxyURL := h.getGithubProxyConfig()
-
-	var cmd string
-	if enabled {
-		cmd = fmt.Sprintf("curl -L %s/https://github.com/%s/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && PROXY_ENABLED=true PROXY_URL=%s VERSION=%s ./install.sh -a %s -s %s",
-			proxyURL, githubRepo, version, proxyURL, version, processServerAddress(panelAddr), secret)
-	} else {
-		cmd = fmt.Sprintf("curl -L https://github.com/%s/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && PROXY_ENABLED=false VERSION=%s ./install.sh -a %s -s %s",
-			githubRepo, version, version, processServerAddress(panelAddr), secret)
-	}
+	cmd := fmt.Sprintf("curl -L https://gcode.hostcentral.cc/https://github.com/Sagit-chu/flvx/releases/download/%s/install.sh -o ./install.sh && chmod +x ./install.sh && VERSION=%s ./install.sh -a %s -s %s", version, version, processServerAddress(panelAddr), secret)
 	response.WriteJSON(w, response.OK(cmd))
 }
 
@@ -1689,6 +1693,10 @@ func (h *Handler) forwardCreate(w http.ResponseWriter, r *http.Request) {
 			response.WriteJSON(w, response.Err(-1, "普通用户无法设置限速规则"))
 			return
 		}
+		if err := IsSafeRemoteAddr(remoteAddr); err != nil {
+			response.WriteJSON(w, response.Err(403, "禁止将目标地址设置为内部网络或保留地址"))
+			return
+		}
 	}
 	speedID := asAnyToInt64Ptr(req["speedId"])
 	speedID, err = h.normalizeSpeedLimitReference(speedID)
@@ -1804,6 +1812,12 @@ func (h *Handler) forwardUpdate(w http.ResponseWriter, r *http.Request) {
 	if remoteAddr == "" {
 		remoteAddr = forward.RemoteAddr
 	}
+	if actorRole != 0 {
+		if err := IsSafeRemoteAddr(remoteAddr); err != nil {
+			response.WriteJSON(w, response.Err(403, "禁止将目标地址设置为内部网络或保留地址"))
+			return
+		}
+	}
 	strategy := strings.TrimSpace(asString(req["strategy"]))
 	if strategy == "" {
 		strategy = forward.Strategy
@@ -2306,24 +2320,13 @@ func (h *Handler) forwardBatchChangeTunnel(w http.ResponseWriter, r *http.Reques
 			nd, ndErr := h.getNodeRecord(nid)
 			if ndErr != nil {
 				portRangeErr = ndErr
-				portRangeOk = false
-				break
+				continue
 			}
 			if validateErr := validateRemoteNodePort(nd, p); validateErr != nil {
 				portRangeOk = false
 				portRangeErr = validateErr
 				break
 			}
-			if validateErr := validateLocalNodePort(nd, p); validateErr != nil {
-				portRangeOk = false
-				portRangeErr = validateErr
-				break
-			}
-			if validateErr := h.validateForwardPortAvailability(nd, p, id); validateErr != nil {
-				portRangeOk = false
-				portRangeErr = validateErr
-				break
-			}
 		}
 		if !portRangeOk {
 			fail++
@@ -2743,11 +2746,7 @@ func (h *Handler) prepareTunnelCreateState(tx *gorm.DB, req map[string]interface
 				}
 				if !isRemote {
 					var err error
-					if excludeTunnelID > 0 {
-						port, err = h.repo.PickNodePortTx(tx, nodeID, allocated, excludeTunnelID)
-					} else {
-						port, err = h.repo.PickRandomNodePortTx(tx, nodeID, allocated, excludeTunnelID)
-					}
+					port, err = h.repo.PickNodePortTx(tx, nodeID, allocated, excludeTunnelID)
 					if err != nil {
 						return nil, err
 					}
@@ -2782,11 +2781,7 @@ func (h *Handler) prepareTunnelCreateState(tx *gorm.DB, req map[string]interface
 					}
 					if !isRemote {
 						var err error
-						if excludeTunnelID > 0 {
-							port, err = h.repo.PickNodePortTx(tx, nodeID, allocated, excludeTunnelID)
-						} else {
-							port, err = h.repo.PickRandomNodePortTx(tx, nodeID, allocated, excludeTunnelID)
-						}
+						port, err = h.repo.PickNodePortTx(tx, nodeID, allocated, excludeTunnelID)
 						if err != nil {
 							return nil, err
 						}
@@ -3660,7 +3655,7 @@ func (h *Handler) replaceTunnelChainsTx(tx *gorm.DB, tunnelID int64, req map[str
 		port := asInt(n["port"], 0)
 		if port <= 0 {
 			var pickErr error
-			port, pickErr = h.repo.PickRandomNodePortTx(tx, nodeID, allocated, 0)
+			port, pickErr = h.repo.PickNodePortTx(tx, nodeID, allocated, 0)
 			if pickErr != nil {
 				return pickErr
 			}
@@ -3690,7 +3685,7 @@ func (h *Handler) replaceTunnelChainsTx(tx *gorm.DB, tunnelID int64, req map[str
 			port := asInt(n["port"], 0)
 			if port <= 0 {
 				var pickErr error
-				port, pickErr = h.repo.PickRandomNodePortTx(tx, nodeID, allocated, 0)
+				port, pickErr = h.repo.PickNodePortTx(tx, nodeID, allocated, 0)
 				if pickErr != nil {
 					return pickErr
 				}

go-backend/internal/http/handler/security_utils.go

@@ -0,0 +1,64 @@
+package handler
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+// DisableSafeRemoteAddrCheckForTesting allows bypassing the safety check during integration tests.
+var DisableSafeRemoteAddrCheckForTesting = false
+
+// IsSafeRemoteAddr checks if a given address is safe to connect to (prevents SSRF/Open Proxy).
+// It resolves domains to IPs to prevent DNS rebinding attacks pointing to internal networks.
+func IsSafeRemoteAddr(addr string) error {
+	if DisableSafeRemoteAddrCheckForTesting {
+		return nil
+	}
+
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		// If there is no port, try to treat the whole string as host
+		if strings.Contains(err.Error(), "missing port in address") {
+			host = addr
+		} else {
+			return fmt.Errorf("invalid address format: %v", err)
+		}
+	}
+
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		return fmt.Errorf("could not resolve address: %v", err)
+	}
+
+	for _, ip := range ips {
+		if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsUnspecified() || ip.IsMulticast() {
+			return fmt.Errorf("address resolves to internal or reserved IP: %s", ip.String())
+		}
+	}
+
+	return nil
+}
+
+// IsValidNodeAddress ensures the address is strictly a host or host:port.
+// It explicitly denies schemes (http://, https://), paths (/...), and query params (?).
+func IsValidNodeAddress(addr string) error {
+	addr = strings.TrimSpace(addr)
+	if strings.Contains(addr, "://") {
+		return fmt.Errorf("address must not contain scheme (e.g. http://)")
+	}
+	if strings.ContainsAny(addr, "/?") {
+		return fmt.Errorf("address must not contain path or query parameters")
+	}
+	
+	// Try parsing as host:port
+	_, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		if strings.Contains(err.Error(), "missing port in address") {
+			// It's just a host, which is fine
+		} else {
+			return fmt.Errorf("invalid address format")
+		}
+	}
+	return nil
+}

go-backend/internal/http/handler/tunnel_quality_prober.go

@@ -2,7 +2,6 @@ package handler
 
 import (
 	"context"
-	"encoding/json"
 	"log"
 	"sync"
 	"sync/atomic"
@@ -20,17 +19,6 @@ const (
 	tunnelQualityReportInterval = 30 * time.Second // DB save interval
 )
 
-type TunnelQualityHop struct {
-	FromNodeID   int64   `json:"fromNodeId"`
-	FromNodeName string  `json:"fromNodeName"`
-	ToNodeID     int64   `json:"toNodeId"`
-	ToNodeName   string  `json:"toNodeName"`
-	Latency      float64 `json:"latency"`
-	Loss         float64 `json:"loss"`
-	TargetIP     string  `json:"targetIp,omitempty"`
-	TargetPort   int     `json:"targetPort,omitempty"`
-}
-
 // tunnelQualitySnapshot is the in-memory latest probe result for a tunnel.
 type tunnelQualitySnapshot struct {
 	TunnelID           int64   `json:"tunnelId"`
@@ -41,7 +29,6 @@ type tunnelQualitySnapshot struct {
 	Success            bool    `json:"success"`
 	ErrorMessage       string  `json:"errorMessage,omitempty"`
 	Timestamp          int64   `json:"timestamp"`
-	ChainDetails       string  `json:"chainDetails,omitempty"`
 
 	// internal fields for db reporting
 	lastDBWrite int64 `json:"-"`
@@ -228,7 +215,7 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 	}
 
 	ipPreference := h.repo.GetTunnelIPPreference(tunnelID)
-	inNodes, midNodesGrouped, outNodes := splitChainNodeGroups(chainRows)
+	inNodes, _, outNodes := splitChainNodeGroups(chainRows)
 
 	options := diagnosisExecOptions{
 		commandTimeout: tunnelQualityProbeTimeout,
@@ -254,85 +241,28 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 		probeOK := true
 
 		if len(inNodes) > 0 && len(outNodes) > 0 {
-			var hops []TunnelQualityHop
-			var totalLat float64
-			remainingSuccessProb := 1.0
-
-			nodesInPath := make([]chainNodeRecord, 0, 2+len(midNodesGrouped))
-			nodesInPath = append(nodesInPath, inNodes[0])
-			for _, midGroup := range midNodesGrouped {
-				if len(midGroup) > 0 {
-					nodesInPath = append(nodesInPath, midGroup[0])
-				}
-			}
-			nodesInPath = append(nodesInPath, outNodes[0])
-
-			for i := 0; i < len(nodesInPath)-1; i++ {
-				source := nodesInPath[i]
-				target := nodesInPath[i+1]
-
-				hop := TunnelQualityHop{
-					FromNodeID:   source.NodeID,
-					FromNodeName: source.NodeName,
-					ToNodeID:     target.NodeID,
-					ToNodeName:   target.NodeName,
-				}
-
-				targetNode, nodeErr := h.getNodeRecord(target.NodeID)
-				if nodeErr != nil || targetNode == nil {
-					snap.ErrorMessage = "节点 " + target.NodeName + " 不可用"
-					probeOK = false
-					hop.Latency = -1
-					hop.Loss = 100
-					hops = append(hops, hop)
-					break
-				}
-				
-				fromNode, _ := h.getNodeRecord(source.NodeID)
-				targetIP, targetPort, resolveErr := resolveChainProbeTarget(fromNode, targetNode, target.Port, ipPreference, target.ConnectIP)
-				if resolveErr != nil {
-					snap.ErrorMessage = "解析节点 " + target.NodeName + " 失败: " + resolveErr.Error()
-					probeOK = false
-					hop.Latency = -1
-					hop.Loss = 100
-					hops = append(hops, hop)
-					break
-				}
-
-				hop.TargetIP = targetIP
-				hop.TargetPort = targetPort
-
-				lat, loss, err := p.tcpPingNode(source.NodeID, targetIP, targetPort, options)
-				if err == nil {
-					hop.Latency = lat
-					hop.Loss = loss
-					totalLat += lat
-					remainingSuccessProb *= (1.0 - loss/100.0)
-					hops = append(hops, hop)
-				} else {
-					probeOK = false
-					hop.Latency = -1
-					hop.Loss = 100
-					hops = append(hops, hop)
-					if snap.ErrorMessage == "" {
-						snap.ErrorMessage = err.Error()
+			// Entry → Exit
+			targetNode, nodeErr := h.getNodeRecord(outNodes[0].NodeID)
+			if nodeErr == nil && targetNode != nil {
+				fromNode, _ := h.getNodeRecord(inNodes[0].NodeID)
+				targetIP, targetPort, resolveErr := resolveChainProbeTarget(fromNode, targetNode, outNodes[0].Port, ipPreference, outNodes[0].ConnectIP)
+				if resolveErr == nil {
+					lat, loss, err := p.tcpPingNode(inNodes[0].NodeID, targetIP, targetPort, options)
+					if err == nil {
+						snap.EntryToExitLatency = lat
+						snap.EntryToExitLoss = loss
+					} else {
+						snap.EntryToExitLatency = -1
+						snap.EntryToExitLoss = 100
+						probeOK = false
 					}
-					break
+				} else {
+					snap.ErrorMessage = resolveErr.Error()
+					probeOK = false
 				}
-			}
-
-			if probeOK {
-				snap.EntryToExitLatency = totalLat
-				snap.EntryToExitLoss = (1.0 - remainingSuccessProb) * 100.0
 			} else {
-				snap.EntryToExitLatency = -1
-				snap.EntryToExitLoss = 100
-			}
-
-			if len(hops) > 0 {
-				if b, err := json.Marshal(hops); err == nil {
-					snap.ChainDetails = string(b)
-				}
+				snap.ErrorMessage = "出口节点不可用"
+				probeOK = false
 			}
 		}
 
@@ -444,7 +374,6 @@ func (p *tunnelQualityProber) storeResult(snap *tunnelQualitySnapshot) {
 		Success:            successInt,
 		ErrorMessage:       snap.ErrorMessage,
 		Timestamp:          snap.Timestamp,
-		ChainDetails:       snap.ChainDetails,
 	}
 	if err := h.repo.InsertTunnelQuality(q); err != nil {
 		log.Printf("tunnel_quality_prober: insert db err=%v tunnel_id=%d", err, snap.TunnelID)

go-backend/internal/http/handler/upgrade.go

@@ -15,6 +15,7 @@ import (
 
 const (
 	githubRepo     = "Sagit-chu/flvx"
+	githubProxy    = "https://gcode.hostcentral.cc"
 	githubAPIBase  = "https://api.github.com"
 	githubHTMLBase = "https://github.com"
 	upgradeTimeout = 5 * time.Minute
@@ -22,9 +23,6 @@ const (
 
 	releaseChannelStable = "stable"
 	releaseChannelDev    = "dev"
-
-	defaultGithubProxyEnabled = true
-	defaultGithubProxyURL     = "https://gcode.hostcentral.cc"
 )
 
 var (
@@ -72,39 +70,6 @@ func releaseChannelLabel(channel string) string {
 	return "正式版"
 }
 
-func (h *Handler) getGithubProxyConfig() (enabled bool, proxyURL string) {
-	enabled = defaultGithubProxyEnabled
-	proxyURL = defaultGithubProxyURL
-
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	if enabledCfg, err := h.repo.GetConfigByName("github_proxy_enabled"); err == nil && enabledCfg != nil {
-		enabled = enabledCfg.Value != "false"
-	}
-
-	if urlCfg, err := h.repo.GetConfigByName("github_proxy_url"); err == nil && urlCfg != nil && urlCfg.Value != "" {
-		proxyURL = strings.TrimSpace(urlCfg.Value)
-		if !strings.HasPrefix(proxyURL, "http://") && !strings.HasPrefix(proxyURL, "https://") {
-			proxyURL = "https://" + proxyURL
-		}
-		proxyURL = strings.TrimSuffix(proxyURL, "/")
-	}
-
-	return
-}
-
-func (h *Handler) buildGithubDownloadURL(version, filename string) string {
-	enabled, proxyURL := h.getGithubProxyConfig()
-	base := fmt.Sprintf("%s/%s/releases/download/%s/%s", githubHTMLBase, githubRepo, version, filename)
-
-	if enabled {
-		return fmt.Sprintf("%s/%s", proxyURL, base)
-	}
-	return base
-}
-
 func fetchGitHubReleases(perPage int) ([]githubRelease, error) {
 	if perPage <= 0 {
 		perPage = 20
@@ -184,8 +149,14 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	downloadURL := h.buildGithubDownloadURL(version, "gost-{ARCH}")
-	checksumURL := h.buildGithubDownloadURL(version, "gost-{ARCH}.sha256")
+	downloadURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}",
+		githubHTMLBase, githubRepo, version,
+	)
+	checksumURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}.sha256",
+		githubHTMLBase, githubRepo, version,
+	)
 
 	result, err := h.wsServer.SendCommand(req.ID, "UpgradeAgent", map[string]interface{}{
 		"downloadUrl": downloadURL,
@@ -242,8 +213,14 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	downloadURL := h.buildGithubDownloadURL(version, "gost-{ARCH}")
-	checksumURL := h.buildGithubDownloadURL(version, "gost-{ARCH}.sha256")
+	downloadURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}",
+		githubHTMLBase, githubRepo, version,
+	)
+	checksumURL := fmt.Sprintf(
+		githubProxy+"/%s/%s/releases/download/%s/gost-{ARCH}.sha256",
+		githubHTMLBase, githubRepo, version,
+	)
 
 	type upgradeResult struct {
 		ID      int64  `json:"id"`

go-backend/internal/http/middleware/auth.go

@@ -109,7 +109,7 @@ func requiresAdmin(path string) bool {
 		return true
 	}
 
-	if strings.HasPrefix(path, "/api/v1/federation/share/") {
+	if strings.HasPrefix(path, "/api/v1/federation/share/") || strings.HasPrefix(path, "/api/v1/federation/node/") {
 		return true
 	}
 

go-backend/internal/store/model/model.go

@@ -728,7 +728,6 @@ type TunnelQuality struct {
 	Success            int     `gorm:"not null;default:1" json:"success"`
 	ErrorMessage       string  `gorm:"column:error_message;type:text" json:"errorMessage,omitempty"`
 	Timestamp          int64   `gorm:"not null;index:idx_tunnel_quality_tunnel_time,priority:2;index:idx_tunnel_quality_time" json:"timestamp"`
-	ChainDetails       string  `gorm:"column:chain_details;type:text" json:"chainDetails,omitempty"`
 }
 
 func (TunnelQuality) TableName() string { return "tunnel_quality" }

go-backend/internal/store/repo/repository.go

@@ -683,7 +683,6 @@ func (r *Repository) ListNodes() ([]map[string]interface{}, error) {
 			"remoteToken":               nullableString(n.RemoteToken),
 			"remoteConfig":              nullableString(n.RemoteConfig),
 			"expiryReminderDismissed":   n.ExpiryReminderDismissed,
-			"interfaceName":             nullableString(n.InterfaceName),
 		})
 	}
 	return items, nil

go-backend/internal/store/repo/repository_flow.go

@@ -262,24 +262,6 @@ func (r *Repository) SpeedLimitExists(id int64) (bool, error) {
 	return count > 0, nil
 }
 
-func (r *Repository) CountActiveForwardsByUser(userID int64) (int64, error) {
-	if r == nil || r.db == nil {
-		return 0, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.Forward{}).Where("user_id = ? AND status = 1", userID).Count(&count).Error
-	return count, err
-}
-
-func (r *Repository) CountActiveForwardsByUserTunnel(userID, tunnelID int64) (int64, error) {
-	if r == nil || r.db == nil {
-		return 0, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.Forward{}).Where("user_id = ? AND tunnel_id = ? AND status = 1", userID, tunnelID).Count(&count).Error
-	return count, err
-}
-
 func (r *Repository) GetSpeedLimitSpeed(id int64) (int, error) {
 	if r == nil || r.db == nil {
 		return 0, errors.New("repository not initialized")

go-backend/internal/store/repo/repository_mutations.go

@@ -1,11 +1,9 @@
 package repo
 
 import (
-	"crypto/rand"
 	"database/sql"
 	"errors"
 	"fmt"
-	"math/big"
 	"sort"
 	"strconv"
 	"strings"
@@ -455,14 +453,6 @@ func (r *Repository) IsRemoteNodeTx(tx *gorm.DB, nodeID int64) (bool, error) {
 }
 
 func (r *Repository) PickNodePortTx(tx *gorm.DB, nodeID int64, allocated map[int64]int, excludeTunnelID int64) (int, error) {
-	return r.pickNodePortTx(tx, nodeID, allocated, excludeTunnelID, false)
-}
-
-func (r *Repository) PickRandomNodePortTx(tx *gorm.DB, nodeID int64, allocated map[int64]int, excludeTunnelID int64) (int, error) {
-	return r.pickNodePortTx(tx, nodeID, allocated, excludeTunnelID, true)
-}
-
-func (r *Repository) pickNodePortTx(tx *gorm.DB, nodeID int64, allocated map[int64]int, excludeTunnelID int64, randomPick bool) (int, error) {
 	if tx == nil {
 		return 0, errors.New("database unavailable")
 	}
@@ -515,7 +505,6 @@ func (r *Repository) pickNodePortTx(tx *gorm.DB, nodeID int64, allocated map[int
 		}
 	}
 
-	var available []int
 	for _, candidate := range candidates {
 		if candidate <= 0 {
 			continue
@@ -523,25 +512,11 @@ func (r *Repository) pickNodePortTx(tx *gorm.DB, nodeID int64, allocated map[int
 		if _, ok := used[candidate]; ok {
 			continue
 		}
-		available = append(available, candidate)
+		allocated[nodeID] = candidate
+		return candidate, nil
 	}
 
-	if len(available) == 0 {
-		return 0, errors.New("节点端口已满，无可用端口")
-	}
-	if !randomPick {
-		allocated[nodeID] = available[0]
-		return available[0], nil
-	}
-
-	idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(available))))
-	if err != nil {
-		allocated[nodeID] = available[0]
-		return available[0], nil
-	}
-	port := available[idx.Int64()]
-	allocated[nodeID] = port
-	return port, nil
+	return 0, errors.New("节点端口已满，无可用端口")
 }
 
 func (r *Repository) GetTunnelIPPreference(tunnelID int64) string {

go-backend/tests/contract/db_test_helper_test.go

@@ -6,9 +6,14 @@ import (
 	"strings"
 	"testing"
 
+	"go-backend/internal/http/handler"
 	"go-backend/internal/store/repo"
 )
 
+func init() {
+	handler.DisableSafeRemoteAddrCheckForTesting = true
+}
+
 func mustLastInsertID(t *testing.T, r *repo.Repository, label string) int64 {
 	t.Helper()
 	var id int64

go-backend/tests/contract/forward_count_limit_contract_test.go

@@ -1,376 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestForwardCreateBlockedWhenUserNumLimitExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(100)
-	tunnelID := int64(1)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'num_limit_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 2, ?, ?, 1)
-	`, userID, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'num_limit_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, ?, 'num_limit_user', 'existing_forward_1', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 1: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, ?, 'num_limit_user', 'existing_forward_2', ?, '8.8.4.4:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 2: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "num_limit_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	payload := `{"tunnelId":1,"name":"new_forward","remoteAddr":"1.1.1.1:53"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when num limit exceeded, got code=%d msg=%q", out.Code, out.Msg)
-	}
-	if !strings.Contains(out.Msg, "转发数量已达上限") {
-		t.Fatalf("expected forward count limit message, got %q", out.Msg)
-	}
-}
-
-func TestForwardResumeBlockedWhenUserNumLimitExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(101)
-	tunnelID := int64(1)
-	pausedForwardID := int64(3)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'num_resume_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 2, ?, ?, 1)
-	`, userID, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'num_resume_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, ?, 'num_resume_user', 'existing_forward_1', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 1: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, ?, 'num_resume_user', 'existing_forward_2', ?, '8.8.4.4:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 2: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, 'num_resume_user', 'paused_forward', ?, '1.1.1.1:53', 'fifo', 0, 0, ?, ?, 0, 0)
-	`, pausedForwardID, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert paused forward: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "num_resume_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/resume", bytes.NewBufferString(`{"id":3}`))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when num limit exceeded, got code=%d msg=%q", out.Code, out.Msg)
-	}
-	if !strings.Contains(out.Msg, "转发数量已达上限") {
-		t.Fatalf("expected forward count limit message, got %q", out.Msg)
-	}
-
-	status := mustQueryInt(t, repo, `SELECT status FROM forward WHERE id = ?`, pausedForwardID)
-	if status != 0 {
-		t.Fatalf("expected forward status to remain 0, got %d", status)
-	}
-}
-
-func TestForwardCreateBlockedWhenUserTunnelNumLimitExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(102)
-	tunnelID := int64(1)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'ut_num_limit_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, userID, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'ut_num_limit_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 1, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel with num=1: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, ?, 'ut_num_limit_user', 'existing_tunnel_forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "ut_num_limit_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	payload := `{"tunnelId":1,"name":"new_tunnel_forward","remoteAddr":"1.1.1.1:53"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when user_tunnel num limit exceeded, got code=%d msg=%q", out.Code, out.Msg)
-	}
-	if !strings.Contains(out.Msg, "隧道转发数量已达上限") {
-		t.Fatalf("expected tunnel forward count limit message, got %q", out.Msg)
-	}
-}
-
-func TestForwardCreateAllowedWhenBelowUserNumLimit(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(103)
-	tunnelID := int64(1)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'num_ok_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 3, ?, ?, 1)
-	`, userID, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'num_ok_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES('num-ok-entry', 'num-ok-secret', '10.50.0.1', '10.50.0.1', '', '10000-10010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert entry node: %v", err)
-	}
-	entryNodeID := mustLastInsertID(t, repo, "num-ok-entry")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 10001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
-		t.Fatalf("insert chain_tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, ?, 'num_ok_user', 'existing_forward_1', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 1: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "num_ok_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	payload := `{"tunnelId":1,"name":"new_forward_ok","remoteAddr":"1.1.1.1:53"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected success (code=0) when below num limit, got code=%d msg=%q", out.Code, out.Msg)
-	}
-}
-
-func TestForwardCreateAllowedWhenNumZero(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(104)
-	tunnelID := int64(1)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'num_zero_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 0, ?, ?, 1)
-	`, userID, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'num_zero_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES('num-zero-entry', 'num-zero-secret', '10.60.0.1', '10.60.0.1', '', '11000-11010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert entry node: %v", err)
-	}
-	entryNodeID := mustLastInsertID(t, repo, "num-zero-entry")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 11001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
-		t.Fatalf("insert chain_tunnel: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 0, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel with num=0: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, ?, 'num_zero_user', 'existing_forward_1', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 1: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, ?, 'num_zero_user', 'existing_forward_2', ?, '8.8.4.4:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert existing forward 2: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "num_zero_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	payload := `{"tunnelId":1,"name":"new_forward_zero","remoteAddr":"1.1.1.1:53"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected success (code=0) when num=0 (unlimited), got code=%d msg=%q", out.Code, out.Msg)
-	}
-}

go-backend/tests/contract/tunnel_create_contract_test.go

@@ -50,18 +50,21 @@ func TestTunnelCreateRuntimeRollbackContract(t *testing.T) {
 	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
 		t.Fatalf("decode response: %v", err)
 	}
-	if out.Code != 0 {
-		t.Fatalf("expected create success (runtime deferred when nodes offline), got code=%d msg=%q", out.Code, out.Msg)
+	if out.Code == 0 {
+		t.Fatalf("expected create failure when nodes are offline")
+	}
+	if !strings.Contains(out.Msg, "节点") {
+		t.Fatalf("expected node-related error, got %q", out.Msg)
 	}
 
 	tunnelCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM tunnel WHERE name = ?`, "runtime-rollback-tunnel")
-	if tunnelCount != 1 {
-		t.Fatalf("expected tunnel record preserved (runtime deferred), found %d records", tunnelCount)
+	if tunnelCount != 0 {
+		t.Fatalf("expected tunnel rollback, found %d records", tunnelCount)
 	}
 
 	chainCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM chain_tunnel`)
-	if chainCount != 3 {
-		t.Fatalf("expected 3 chain_tunnel records preserved (in/chain/out), found %d records", chainCount)
+	if chainCount != 0 {
+		t.Fatalf("expected chain_tunnel rollback, found %d records", chainCount)
 	}
 }
 

go-gost/x/api/config_service.go

@@ -624,11 +624,6 @@ func resumeService(ctx *gin.Context) {
 	existingSvc.Close()
 	registry.ServiceRegistry().Unregister(name)
 
-	// 强制断开端口的所有连接
-	if serviceConfig.Addr != "" {
-		_ = kill.ForceClosePortConnections(serviceConfig.Addr)
-	}
-
 	// 等待端口释放
 	time.Sleep(500 * time.Millisecond)
 
@@ -1044,13 +1039,8 @@ func resumeServices(ctx *gin.Context) {
 		str.service.Close()
 		registry.ServiceRegistry().Unregister(str.name)
 
-		// 强制断开端口的所有连接
-		if str.serviceConfig.Addr != "" {
-			_ = kill.ForceClosePortConnections(str.serviceConfig.Addr)
-		}
-
 		// 等待端口释放
-		time.Sleep(500 * time.Millisecond)
+		time.Sleep(100 * time.Millisecond)
 
 		// 重新解析并启动服务
 		svc, err := parser.ParseService(str.serviceConfig)

go-gost/x/socket/service.go

@@ -397,13 +397,8 @@ func resumeServices(req resumeServicesRequest) error {
 		str.service.Close()
 		registry.ServiceRegistry().Unregister(str.name)
 
-		// 强制断开端口的所有连接
-		if str.serviceConfig.Addr != "" {
-			_ = kill.ForceClosePortConnections(str.serviceConfig.Addr)
-		}
-
 		// 等待端口释放
-		time.Sleep(500 * time.Millisecond)
+		time.Sleep(100 * time.Millisecond)
 
 		// 重新解析并启动服务
 		svc, err := parser.ParseService(str.serviceConfig)

install.sh

@@ -25,62 +25,10 @@ get_architecture() {
 # 安装目录
 INSTALL_DIR="/etc/flux_agent"
 
-# 镜像加速配置（可由面板传入或交互式询问）
-PROXY_ENABLED="${PROXY_ENABLED:-}"
-PROXY_URL="${PROXY_URL:-}"
-
-# 镜像加速
+# 镜像加速（所有下载均经过镜像源，以支持 IPv6）
 maybe_proxy_url() {
   local url="$1"
-
-  if [[ "$PROXY_ENABLED" == "false" ]]; then
-    echo "$url"
-    return
-  fi
-
-  local proxy="${PROXY_URL:-gcode.hostcentral.cc}"
-
-  if [[ "$proxy" == https://* || "$proxy" == http://* ]]; then
-    proxy="${proxy%/}"
-  else
-    proxy="https://${proxy%/}"
-  fi
-
-  echo "${proxy}/${url}"
-}
-
-ask_proxy_config() {
-  if [[ -n "$PROXY_ENABLED" ]]; then
-    return
-  fi
-
-  if [[ -n "$PROXY_URL" ]]; then
-    PROXY_ENABLED="true"
-    return
-  fi
-
-  echo ""
-  echo "==============================================="
-  echo "           GitHub 加速配置"
-  echo "==============================================="
-  if ! read -r -p "是否开启 GitHub 加速? (Y/n): " proxy_choice; then
-    proxy_choice=""
-  fi
-  case "$proxy_choice" in
-    n|N)
-      PROXY_ENABLED="false"
-      echo "已关闭加速，将直连 GitHub"
-      ;;
-    *)
-      PROXY_ENABLED="true"
-      if ! read -r -p "加速地址 (默认 gcode.hostcentral.cc): " input_url; then
-        input_url=""
-      fi
-      PROXY_URL="${input_url:-gcode.hostcentral.cc}"
-      echo "已开启加速: $PROXY_URL"
-      ;;
-  esac
-  echo "==============================================="
+  echo "https://gcode.hostcentral.cc/${url}"
 }
 
 resolve_latest_release_tag() {
@@ -133,14 +81,9 @@ build_download_url() {
     echo "https://github.com/${REPO}/releases/download/${RESOLVED_VERSION}/gost-${ARCH}"
 }
 
-ensure_download_url_initialized() {
-  if [[ -n "${DOWNLOAD_URL:-}" ]]; then
-    return 0
-  fi
-
-  RESOLVED_VERSION=$(resolve_version) || return 1
-  DOWNLOAD_URL=$(maybe_proxy_url "$(build_download_url)")
-}
+# 解析版本并构建下载地址
+RESOLVED_VERSION=$(resolve_version) || exit 1
+DOWNLOAD_URL=$(maybe_proxy_url "$(build_download_url)")
 
 
 
@@ -267,10 +210,6 @@ done
 # 安装功能
 install_flux_agent() {
   echo "🚀 开始安装 flux_agent..."
-
-  ask_proxy_config
-  ensure_download_url_initialized || exit 1
-
   get_config_params
 
     # 检查并安装 tcpkill
@@ -369,9 +308,6 @@ update_flux_agent() {
     echo "❌ flux_agent 未安装，请先选择安装。"
     return 1
   fi
-
-  ask_proxy_config
-  ensure_download_url_initialized || return 1
   
   echo "📥 使用下载地址: $DOWNLOAD_URL"
   

panel_install.sh

@@ -13,62 +13,10 @@ REPO="Sagit-chu/flux-panel"
 # 固定版本号（Release 构建时自动填充，留空则获取最新版）
 PINNED_VERSION=""
 
-# 镜像加速配置（可由面板传入或交互式询问）
-PROXY_ENABLED="${PROXY_ENABLED:-}"
-PROXY_URL="${PROXY_URL:-}"
-
-# 镜像加速
+# 镜像加速（所有下载均经过镜像源，以支持 IPv6）
 maybe_proxy_url() {
   local url="$1"
-
-  if [[ "$PROXY_ENABLED" == "false" ]]; then
-    echo "$url"
-    return
-  fi
-
-  local proxy="${PROXY_URL:-gcode.hostcentral.cc}"
-
-  if [[ "$proxy" == https://* || "$proxy" == http://* ]]; then
-    proxy="${proxy%/}"
-  else
-    proxy="https://${proxy%/}"
-  fi
-
-  echo "${proxy}/${url}"
-}
-
-ask_proxy_config() {
-  if [[ -n "$PROXY_ENABLED" ]]; then
-    return
-  fi
-
-  if [[ -n "$PROXY_URL" ]]; then
-    PROXY_ENABLED="true"
-    return
-  fi
-
-  echo ""
-  echo "==============================================="
-  echo "           GitHub 加速配置"
-  echo "==============================================="
-  if ! read -r -p "是否开启 GitHub 加速? (Y/n): " proxy_choice; then
-    proxy_choice=""
-  fi
-  case "$proxy_choice" in
-    n|N)
-      PROXY_ENABLED="false"
-      echo "已关闭加速，将直连 GitHub"
-      ;;
-    *)
-      PROXY_ENABLED="true"
-      if ! read -r -p "加速地址 (默认 gcode.hostcentral.cc): " input_url; then
-        input_url=""
-      fi
-      PROXY_URL="${input_url:-gcode.hostcentral.cc}"
-      echo "已开启加速: $PROXY_URL"
-      ;;
-  esac
-  echo "==============================================="
+  echo "https://gcode.hostcentral.cc/${url}"
 }
 
 resolve_latest_release_tag() {
@@ -122,14 +70,9 @@ set_compose_urls_by_version() {
   DOCKER_COMPOSEV6_URL=$(maybe_proxy_url "https://github.com/${REPO}/releases/download/${version}/docker-compose-v6.yml")
 }
 
-ensure_compose_urls_initialized() {
-  if [[ -n "${DOCKER_COMPOSEV4_URL:-}" && -n "${DOCKER_COMPOSEV6_URL:-}" ]]; then
-    return 0
-  fi
-
-  RESOLVED_VERSION=$(resolve_version) || return 1
-  set_compose_urls_by_version "$RESOLVED_VERSION"
-}
+# 全局下载地址配置（默认获取最新版本；也可用 VERSION=... 覆盖）
+RESOLVED_VERSION=$(resolve_version) || exit 1
+set_compose_urls_by_version "$RESOLVED_VERSION"
 
 
 
@@ -431,10 +374,6 @@ get_config_params() {
 # 安装功能
 install_panel() {
   echo "🚀 开始安装面板..."
-
-  ask_proxy_config
-  ensure_compose_urls_initialized || return 1
-
   check_docker
   get_config_params
 
@@ -486,7 +425,6 @@ EOF
 # 更新功能
 update_panel() {
   echo "🔄 开始更新面板..."
-  ask_proxy_config
   check_docker
 
   if [[ ! -f ".env" ]]; then
@@ -568,8 +506,6 @@ migrate_to_postgres() {
 
   if [[ ! -f "docker-compose.yml" ]]; then
     echo "⚠️ 未找到 docker-compose.yml 文件，正在下载..."
-    ask_proxy_config
-    ensure_compose_urls_initialized || return 1
     DOCKER_COMPOSE_URL=$(get_docker_compose_url)
     echo "📡 选择配置文件：$(basename "$DOCKER_COMPOSE_URL")"
     curl -L -o docker-compose.yml "$DOCKER_COMPOSE_URL"
@@ -645,8 +581,6 @@ uninstall_panel() {
 
   if [[ ! -f "docker-compose.yml" ]]; then
     echo "⚠️ 未找到 docker-compose.yml 文件，正在下载以完成卸载..."
-    ask_proxy_config
-    ensure_compose_urls_initialized || return 1
     DOCKER_COMPOSE_URL=$(get_docker_compose_url)
     echo "📡 选择配置文件：$(basename "$DOCKER_COMPOSE_URL")"
     curl -L -o docker-compose.yml "$DOCKER_COMPOSE_URL"

plans/068-tunnel-quality-chain-probe.md

@@ -1,25 +0,0 @@
-# PLAN: Detailed Hop-by-Hop Tunnel Quality Probing (Option B)
-
-## Objective
-Enhance the tunnel quality monitoring to correctly execute and record hop-by-hop latency and loss through the entire forwarding chain (Entry -> Mids -> Exit), rather than directly forcing Entry to ping Exit. Expose these details in the UI for advanced troubleshooting.
-
-## Tasks
-
-- [ ] **1. DB Schema & Model Updates**
-  - Update `model.TunnelQuality` in `model.go` with `ChainDetails string` (`gorm:"column:chain_details;type:text"`).
-  - GORM AutoMigrate will handle adding the column to SQLite/PostgreSQL automatically on backend restart.
-- [ ] **2. Backend Data Structures (`tunnel_quality_prober.go`)**
-  - Define `TunnelQualityHop` to store `FromNodeID`, `FromNodeName`, `ToNodeID`, `ToNodeName`, `Latency`, `Loss`.
-  - Update `tunnelQualitySnapshot` to include `ChainDetails []TunnelQualityHop` (`json:"chainDetails,omitempty"`).
-  - Update DB query models to pass `ChainDetails` back to the frontend.
-- [ ] **3. Prober Logic Restructuring**
-  - In `tunnel_quality_prober.go:probeTunnel()`, handle `Type 2` (Forwarding Chain) properly.
-  - Extract the intermediate nodes using `splitChainNodeGroups`.
-  - Form the hop pairs: `in[0]->mid[0]`, `mid[i]->mid[i+1]`, `mid[last]->out[0]`.
-  - Probe each hop sequentially. Resolve target IPs via `resolveChainProbeTarget` using `connect_ip` fields and node preferences.
-  - Cumulative metrics: `EntryToExitLatency` = `sum(latency)`. `EntryToExitLoss` = $1 - \prod (1 - loss\_i)$.
-- [ ] **4. Frontend API & Component**
-  - Add `chainDetails?: string;` to `TunnelQualityApiItem` in `vite-frontend/src/api/types.ts`.
-  - In `TunnelMonitorView`, parse the JSON string back into an array of hops if it exists.
-  - Design a horizontal topology diagram (e.g., using `heroui/chip` and `lucide-react` arrows) to show `[上海入口] --25ms--> [香港跳板] --15ms--> [落地出口]`.
-  - Highlight bottlenecks (e.g., > 100ms or loss > 0%) in yellow or red.

test-install-scripts-proxy.sh

@@ -1,314 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-
-fail() {
-  echo "FAIL: $1" >&2
-  exit 1
-}
-
-assert_equals() {
-  local expected="$1"
-  local actual="$2"
-  local message="$3"
-
-  if [[ "$actual" != "$expected" ]]; then
-    fail "$message (expected: $expected, actual: $actual)"
-  fi
-}
-
-load_script_without_main() {
-  local script_path="$1"
-  local temp_file
-
-  temp_file=$(mktemp)
-  sed '/^# 执行主函数$/,$d' "$script_path" > "$temp_file"
-  VERSION="v-test"
-  source "$temp_file"
-  rm -f "$temp_file"
-}
-
-test_install_script_respects_disabled_proxy() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  PROXY_ENABLED="false"
-  PROXY_URL=""
-
-  local actual
-  actual=$(maybe_proxy_url "https://github.com/example/release")
-
-  assert_equals \
-    "https://github.com/example/release" \
-    "$actual" \
-    "install.sh should bypass the proxy when disabled"
-)
-
-test_install_script_asks_for_proxy_config() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  PROXY_ENABLED=""
-  PROXY_URL=""
-
-  ask_proxy_config >/dev/null < <(printf '\nmirror.example.com/\n')
-
-  assert_equals "true" "$PROXY_ENABLED" "install.sh should enable proxy by default"
-  assert_equals "mirror.example.com/" "$PROXY_URL" "install.sh should keep the entered proxy URL"
-
-  local actual
-  actual=$(maybe_proxy_url "https://github.com/example/release")
-
-  assert_equals \
-    "https://mirror.example.com/https://github.com/example/release" \
-    "$actual" \
-    "install.sh should normalize the entered proxy URL"
-)
-
-test_install_script_recomputes_download_url_after_prompt() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  PROXY_ENABLED=""
-  PROXY_URL=""
-  DOWNLOAD_URL=""
-
-  ask_proxy_config >/dev/null < <(printf 'n\n')
-  ensure_download_url_initialized
-
-  local expected
-  expected=$(build_download_url)
-
-  assert_equals \
-    "$expected" \
-    "$DOWNLOAD_URL" \
-    "install.sh should build the final download URL after the interactive proxy choice"
-)
-
-test_update_flux_agent_asks_for_proxy_config() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  cat > "$INSTALL_DIR/flux_agent" <<'EOF'
-#!/bin/bash
-echo "old version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent"
-
-  local ask_called="0"
-
-  ask_proxy_config() {
-    ask_called="1"
-    PROXY_ENABLED="false"
-    DOWNLOAD_URL=""
-  }
-
-  check_and_install_tcpkill() { :; }
-
-  systemctl() {
-    return 0
-  }
-
-  curl() {
-    local output=""
-
-    while [[ $# -gt 0 ]]; do
-      if [[ "$1" == "-o" ]]; then
-        output="$2"
-        shift 2
-        continue
-      fi
-      shift
-    done
-
-    cat > "$output" <<'EOF'
-#!/bin/bash
-echo "new version"
-EOF
-    chmod +x "$output"
-  }
-
-  update_flux_agent >/dev/null
-
-  assert_equals "1" "$ask_called" "update_flux_agent should ask for proxy config before downloading"
-  assert_equals "$(build_download_url)" "$DOWNLOAD_URL" "update_flux_agent should honor the prompted proxy choice"
-)
-
-test_update_flux_agent_skips_proxy_prompt_when_not_installed() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -u)
-
-  local ask_called="0"
-
-  ask_proxy_config() {
-    ask_called="1"
-  }
-
-  local rc="0"
-  update_flux_agent >/dev/null || rc="$?"
-
-  assert_equals "1" "$rc" "update_flux_agent should fail when the agent is not installed"
-  assert_equals "0" "$ask_called" "update_flux_agent should not prompt for proxy config when the agent is missing"
-)
-
-test_install_script_accepts_proxy_url_env_without_prompt() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  PROXY_ENABLED=""
-  PROXY_URL="mirror.example.com"
-
-  ask_proxy_config >/dev/null < <(printf '\n\n')
-
-  assert_equals "true" "$PROXY_ENABLED" "install.sh should treat PROXY_URL as enabling the proxy"
-  assert_equals "mirror.example.com" "$PROXY_URL" "install.sh should preserve PROXY_URL when provided via env"
-)
-
-test_panel_install_script_can_disable_proxy() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  PROXY_ENABLED=""
-  PROXY_URL=""
-
-  ask_proxy_config >/dev/null < <(printf 'n\n')
-
-  assert_equals "false" "$PROXY_ENABLED" "panel_install.sh should allow disabling proxy"
-
-  local actual
-  actual=$(maybe_proxy_url "https://github.com/example/release")
-
-  assert_equals \
-    "https://github.com/example/release" \
-    "$actual" \
-    "panel_install.sh should bypass the proxy after disabling it"
-)
-
-test_panel_install_script_recomputes_compose_urls_after_prompt() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  PROXY_ENABLED=""
-  PROXY_URL=""
-  DOCKER_COMPOSEV4_URL=""
-  DOCKER_COMPOSEV6_URL=""
-
-  ask_proxy_config >/dev/null < <(printf 'n\n')
-  ensure_compose_urls_initialized
-
-  assert_equals \
-    "https://github.com/${REPO}/releases/download/${RESOLVED_VERSION}/docker-compose-v4.yml" \
-    "$DOCKER_COMPOSEV4_URL" \
-    "panel_install.sh should build the compose URL after the interactive proxy choice"
-)
-
-test_update_panel_asks_for_proxy_config() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  local ask_called="0"
-
-  ask_proxy_config() {
-    ask_called="1"
-    PROXY_ENABLED="false"
-    DOCKER_COMPOSEV4_URL=""
-    DOCKER_COMPOSEV6_URL=""
-  }
-
-  check_docker() {
-    DOCKER_CMD="true"
-  }
-
-  get_current_db_type() {
-    echo "sqlite"
-  }
-
-  resolve_latest_release_tag() {
-    echo "v-test"
-  }
-
-  upsert_env_var() { :; }
-  check_ipv6_support() { return 1; }
-  configure_docker_ipv6() { :; }
-  docker() { return 0; }
-  wait_for_backend_healthy() { return 0; }
-  sleep() { :; }
-  curl() { :; }
-
-  update_panel >/dev/null
-
-  assert_equals "1" "$ask_called" "update_panel should ask for proxy config before downloading"
-  assert_equals \
-    "https://github.com/${REPO}/releases/download/v-test/docker-compose-v4.yml" \
-    "$DOCKER_COMPOSEV4_URL" \
-    "update_panel should honor the prompted proxy choice"
-)
-
-test_panel_install_script_accepts_proxy_url_env_without_prompt() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  PROXY_ENABLED=""
-  PROXY_URL="mirror.example.com"
-
-  ask_proxy_config >/dev/null < <(printf '\n\n')
-
-  assert_equals "true" "$PROXY_ENABLED" "panel_install.sh should treat PROXY_URL as enabling the proxy"
-  assert_equals "mirror.example.com" "$PROXY_URL" "panel_install.sh should preserve PROXY_URL when provided via env"
-)
-
-test_panel_install_script_defaults_proxy_on_eof() {
-  local rc="0"
-  local output
-  local temp_script
-
-  temp_script=$(mktemp)
-  sed '/^# 执行主函数$/,$d' "$ROOT_DIR/panel_install.sh" > "$temp_script"
-  cat >> "$temp_script" <<'EOF'
-PROXY_ENABLED=""
-PROXY_URL=""
-ask_proxy_config >/dev/null < /dev/null
-printf '%s\n%s\n' "$PROXY_ENABLED" "$PROXY_URL"
-EOF
-
-  output=$(bash "$temp_script") || rc="$?"
-  rm -f "$temp_script"
-
-  assert_equals "0" "$rc" "panel_install.sh should not fail when proxy prompt receives EOF"
-  assert_equals $'true\ngcode.hostcentral.cc' "$output" "panel_install.sh should fall back to the default proxy on EOF"
-}
-
-test_panel_install_script_uses_default_proxy() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  PROXY_ENABLED="true"
-  PROXY_URL=""
-
-  local actual
-  actual=$(maybe_proxy_url "https://github.com/example/release")
-
-  assert_equals \
-    "https://gcode.hostcentral.cc/https://github.com/example/release" \
-    "$actual" \
-    "panel_install.sh should keep the default proxy when enabled"
-)
-
-test_install_script_respects_disabled_proxy
-test_install_script_asks_for_proxy_config
-test_install_script_recomputes_download_url_after_prompt
-test_update_flux_agent_asks_for_proxy_config
-test_update_flux_agent_skips_proxy_prompt_when_not_installed
-test_install_script_accepts_proxy_url_env_without_prompt
-test_panel_install_script_can_disable_proxy
-test_panel_install_script_recomputes_compose_urls_after_prompt
-test_update_panel_asks_for_proxy_config
-test_panel_install_script_uses_default_proxy
-test_panel_install_script_accepts_proxy_url_env_without_prompt
-test_panel_install_script_defaults_proxy_on_eof
-
-echo "install script proxy tests passed"

vite-frontend/src/api/types.ts

@@ -489,17 +489,6 @@ export interface MonitorAccessApiData {
   reason?: string;
 }
 
-export interface TunnelQualityHopApiItem {
-  fromNodeId: number;
-  fromNodeName: string;
-  toNodeId: number;
-  toNodeName: string;
-  latency: number;
-  loss: number;
-  targetIp?: string;
-  targetPort?: number;
-}
-
 export interface TunnelQualityApiItem {
   tunnelId: number;
   entryToExitLatency: number;
@@ -509,5 +498,4 @@ export interface TunnelQualityApiItem {
   success: boolean;
   errorMessage?: string;
   timestamp: number;
-  chainDetails?: string;
 }

vite-frontend/src/pages/config.tsx

@@ -1,6 +1,5 @@
 import { useState, useEffect, useRef } from "react";
 import { useNavigate } from "react-router-dom";
-import { AnimatePresence, motion } from "framer-motion";
 import toast from "react-hot-toast";
 
 import { Button } from "@/shadcn-bridge/heroui/button";
@@ -155,21 +154,6 @@ const CONFIG_ITEMS: ConfigItem[] = [
     dependsOn: "captcha_enabled",
     dependsValue: "true",
   },
-  {
-    key: "github_proxy_enabled",
-    label: "开启 GitHub 加速",
-    description: "用于节点更新和安装脚本下载，解决部分地区 GitHub 访问受限问题",
-    type: "switch",
-  },
-  {
-    key: "github_proxy_url",
-    label: "加速地址",
-    placeholder: "https://gcode.hostcentral.cc",
-    description: "GitHub 下载加速代理地址，开启加速后生效",
-    type: "input",
-    dependsOn: "github_proxy_enabled",
-    dependsValue: "true",
-  },
 ];
 
 const BACKUP_TYPE_OPTIONS = [
@@ -202,8 +186,6 @@ const getInitialConfigs = (): Record<string, string> => {
     "panel_domain",
     "app_logo",
     "app_favicon",
-    "github_proxy_enabled",
-    "github_proxy_url",
   ];
   const initialConfigs: Record<string, string> = {};
 
@@ -1238,30 +1220,6 @@ export default function ConfigPage() {
           )}
         </ModalContent>
       </Modal>
-
-      {/* Floating Save Button (FAB) */}
-      <AnimatePresence>
-        {hasChanges && (
-          <motion.div
-            initial={{ y: 100, opacity: 0 }}
-            animate={{ y: 0, opacity: 1 }}
-            exit={{ y: 100, opacity: 0 }}
-            transition={{ type: "spring", damping: 20, stiffness: 300 }}
-            className="fixed bottom-6 right-6 z-50"
-          >
-            <Button
-              isIconOnly
-              color="primary"
-              size="lg"
-              className="w-12 h-12 rounded-full shadow-lg"
-              isLoading={saving}
-              onPress={handleSave}
-            >
-              {!saving && <SaveIcon className="w-5 h-5" />}
-            </Button>
-          </motion.div>
-        )}
-      </AnimatePresence>
     </div>
   );
 }

vite-frontend/src/pages/node/tunnel-monitor-view.tsx

@@ -2,7 +2,6 @@ import type {
   MonitorTunnelApiItem,
   TunnelMetricApiItem,
   TunnelQualityApiItem,
-  TunnelQualityHopApiItem,
 } from "@/api/types";
 
 import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
@@ -24,7 +23,6 @@ import {
   ArrowRightLeft,
   Wifi,
   WifiOff,
-  ArrowRight,
 } from "lucide-react";
 import toast from "react-hot-toast";
 
@@ -329,63 +327,6 @@ const TrafficChartCard = React.memo(function TrafficChartCard({
   );
 });
 
-function ForwardingChainTopology({ hopsStr }: { hopsStr?: string }) {
-  if (!hopsStr) return null;
-
-  let hops: TunnelQualityHopApiItem[] = [];
-  try {
-    hops = JSON.parse(hopsStr);
-  } catch {
-    return null;
-  }
-
-  if (!Array.isArray(hops) || hops.length === 0) return null;
-
-  return (
-    <Card className="border border-divider/60 shadow-sm transition-shadow bg-gradient-to-br from-background to-default-50/50 mt-4">
-      <CardHeader className="py-3 px-4 flex flex-row items-center justify-between pb-1">
-        <h3 className="text-sm font-semibold flex items-center gap-1.5 text-default-700">
-          <Activity className="w-4 h-4 text-primary" />
-          全链路拓扑状态 (实时)
-        </h3>
-      </CardHeader>
-      <CardBody className="py-2 px-4 pb-4">
-        <div className="flex items-center overflow-x-auto pb-2 py-2">
-          {hops.map((hop, index) => {
-            const hasError = hop.latency < 0 || hop.loss > 0;
-            const colorClass = hop.latency < 0 ? "text-danger" : (hop.loss > 0 ? "text-warning" : "text-success");
-            const borderColor = hasError ? "border-danger" : "";
-
-            return (
-              <React.Fragment key={index}>
-                {index === 0 && (
-                  <Chip size="sm" variant="flat" className="shrink-0 font-mono shadow-sm">
-                    {hop.fromNodeName}
-                  </Chip>
-                )}
-                <div className="flex flex-col items-center justify-center min-w-[70px] mx-1 shrink-0 relative">
-                  <span className={`text-[10px] font-mono leading-none mb-1 ${colorClass}`}>
-                    {hop.latency >= 0 ? `${hop.latency.toFixed(0)}ms` : "超时"}
-                  </span>
-                  <div className={`h-[2px] w-full relative flex items-center justify-end bg-default-200 ${hop.latency < 0 ? "!bg-danger" : ""}`}>
-                    <ArrowRight className={`w-3.5 h-3.5 absolute -right-2 ${colorClass} bg-background rounded-full p-[1px] z-10`} />
-                  </div>
-                  <span className={`text-[10px] font-mono leading-none mt-1.5 ${hop.loss > 0 ? "text-warning" : "text-default-400"}`}>
-                    {hop.loss.toFixed(0)}% 丢包
-                  </span>
-                </div>
-                <Chip size="sm" variant="flat" className={`shrink-0 font-mono shadow-sm ${borderColor}`}>
-                  {hop.toNodeName}
-                </Chip>
-              </React.Fragment>
-            );
-          })}
-        </div>
-      </CardBody>
-    </Card>
-  );
-}
-
 export function TunnelMonitorView({ viewMode = "grid" }: TunnelMonitorViewProps) {
   const [tunnels, setTunnels] = useState<MonitorTunnelApiItem[]>([]);
   const [tunnelsLoading, setTunnelsLoading] = useState(false);
@@ -837,11 +778,6 @@ export function TunnelMonitorView({ viewMode = "grid" }: TunnelMonitorViewProps)
           )}
         </div>
 
-        {/* ====== Chain Topology ====== */}
-        {monitorTunnelQualityEnabled && quality?.chainDetails && (
-          <ForwardingChainTopology hopsStr={quality.chainDetails} />
-        )}
-
         {/* ====== Quality History Chart — isolated with React.memo ====== */}
         <QualityChartCard
           rangeMs={qualityRangeMs}