fix(agent): harden Alpine OpenRC installation

.github/workflows/ci-build.yml

@@ -7,18 +7,6 @@ on:
     branches: ['**']
 
 jobs:
-  install-scripts:
-    name: Test Installer Scripts (systemd and Alpine OpenRC)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run installer regression tests
-        run: bash test-install-scripts-proxy.sh
-
-      - name: Test Alpine bootstrap and OpenRC lifecycle
-        run: docker run --rm -v "$PWD:/workspace:ro" alpine:3.22 sh /workspace/test-install-scripts-alpine.sh
-
   frontend:
     name: Build Frontend
     runs-on: ubuntu-latest
@@ -34,7 +22,7 @@ jobs:
           node-version: '20.19.0'
 
       - name: Install pnpm
-        run: npm install -g pnpm@10.28.1
+        run: npm install -g pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/docker-build.yml

@@ -229,7 +229,6 @@ jobs:
 
           docker buildx build \
             --platform linux/amd64,linux/arm64 \
-            --build-arg KEYGEN_ACCOUNT_ID=${{ secrets.KEYGEN_ACCOUNT_ID }} \
             --push \
             -t ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:latest \
             -t ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION} \
@@ -304,9 +303,6 @@ jobs:
           sed -i "s|^PINNED_VERSION=\"\"|PINNED_VERSION=\"${VERSION}\"|" ./artifacts/install.sh
           sed -i "s|^PINNED_VERSION=\"\"|PINNED_VERSION=\"${VERSION}\"|" ./artifacts/panel_install.sh
 
-      - name: Verify release installer on Alpine OpenRC
-        run: docker run --rm -v "$PWD:/workspace:ro" alpine:3.22 sh /workspace/test-install-scripts-alpine.sh /workspace/artifacts/install.sh
-
       - name: Create Release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -435,3 +431,4 @@ jobs:
           gh release upload "${VERSION}" ./artifacts/gost-arm64.sha256 --clobber
 
           echo "✅ GOST 二进制文件更新完成"
+

go-backend/Dockerfile

@@ -7,8 +7,7 @@ RUN go mod download
 COPY . .
 ARG TARGETOS
 ARG TARGETARCH
-ARG KEYGEN_ACCOUNT_ID
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} env ${TARGETARCH:+GOARCH=${TARGETARCH}} go build -ldflags="-X 'go-backend/internal/license.AccountID=${KEYGEN_ACCOUNT_ID}'" -o /out/paneld ./cmd/paneld
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} env ${TARGETARCH:+GOARCH=${TARGETARCH}} go build -o /out/paneld ./cmd/paneld
 
 FROM docker:27-cli AS dockercli
 

go-backend/internal/http/handler/config_access.go

@@ -29,10 +29,6 @@ func (h *Handler) getPublicConfigByName(w http.ResponseWriter, r *http.Request)
 		response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
 		return
 	}
-	if value, gated := h.unlicensedPublicBrandValue(configName); gated {
-		response.WriteJSON(w, response.OK(map[string]string{"name": configName, "value": value}))
-		return
-	}
 
 	cfg, err := h.repo.GetConfigByName(configName)
 	if err != nil {
@@ -46,22 +42,3 @@ func (h *Handler) getPublicConfigByName(w http.ResponseWriter, r *http.Request)
 
 	response.WriteJSON(w, response.OK(cfg))
 }
-
-func (h *Handler) unlicensedPublicBrandValue(configName string) (string, bool) {
-	switch configName {
-	case "app_name", "app_logo", "app_favicon", "hide_footer_brand":
-	default:
-		return "", false
-	}
-	isCommercial, _ := h.repo.GetViteConfigValue("is_commercial")
-	if isCommercial == "true" {
-		return "", false
-	}
-	if configName == "app_name" {
-		return "FLVX", true
-	}
-	if configName == "hide_footer_brand" {
-		return "false", true
-	}
-	return "", true
-}

go-backend/internal/http/handler/config_access_test.go

@@ -19,8 +19,6 @@ func TestPublicConfigGetAllowsBrandKeys(t *testing.T) {
 	seedConfigValue(t, r, "app_logo", "logo-data")
 	seedConfigValue(t, r, "app_favicon", "favicon-data")
 	seedConfigValue(t, r, "app_bg_image", "bg-data")
-	seedConfigValue(t, r, "app_bg_image_light", "light-bg-data")
-	seedConfigValue(t, r, "app_bg_image_dark", "dark-bg-data")
 	seedConfigValue(t, r, "cloudflare_site_key", "site-key")
 
 	req := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"app_name"}`))
@@ -30,50 +28,6 @@ func TestPublicConfigGetAllowsBrandKeys(t *testing.T) {
 	router.ServeHTTP(resp, req)
 
 	assertHandlerCode(t, resp, 0)
-	for name, want := range map[string]string{
-		"app_bg_image_light": "light-bg-data",
-		"app_bg_image_dark":  "dark-bg-data",
-	} {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"`+name+`"}`))
-		req.Header.Set("Content-Type", "application/json")
-		resp := httptest.NewRecorder()
-		router.ServeHTTP(resp, req)
-		assertHandlerConfigValue(t, resp, name, want)
-	}
-}
-
-func TestPublicBrandConfigFallsBackWithoutCommercialLicense(t *testing.T) {
-	router, r := setupConfigAccessTestRouter(t)
-	seedConfigValue(t, r, "app_name", "Paid Brand")
-	seedConfigValue(t, r, "app_logo", "logo-data")
-	seedConfigValue(t, r, "app_favicon", "favicon-data")
-	seedConfigValue(t, r, "hide_footer_brand", "true")
-	seedConfigValue(t, r, "is_commercial", "false")
-
-	for name, want := range map[string]string{
-		"app_name":          "FLVX",
-		"app_logo":          "",
-		"app_favicon":       "",
-		"hide_footer_brand": "false",
-	} {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"`+name+`"}`))
-		req.Header.Set("Content-Type", "application/json")
-		resp := httptest.NewRecorder()
-		router.ServeHTTP(resp, req)
-		assertHandlerConfigValue(t, resp, name, want)
-	}
-}
-
-func TestPublicBrandConfigUsesSavedValuesWithCommercialLicense(t *testing.T) {
-	router, r := setupConfigAccessTestRouter(t)
-	seedConfigValue(t, r, "app_name", "Paid Brand")
-	seedConfigValue(t, r, "is_commercial", "true")
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/public/config/get", bytes.NewBufferString(`{"name":"app_name"}`))
-	req.Header.Set("Content-Type", "application/json")
-	resp := httptest.NewRecorder()
-	router.ServeHTTP(resp, req)
-	assertHandlerConfigValue(t, resp, "app_name", "Paid Brand")
 }
 
 func TestPublicConfigGetRejectsSensitiveKeys(t *testing.T) {
@@ -128,56 +82,6 @@ func TestConfigGetAllowsSensitiveKeysForAdmin(t *testing.T) {
 	assertHandlerConfigValue(t, resp, "jwt_secret", "jwt-secret")
 }
 
-func TestConfigGetNeverReturnsLicenseCredentials(t *testing.T) {
-	router, r := setupConfigAccessTestRouter(t)
-	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
-	seedConfigValue(t, r, "license_key", "license-secret")
-	seedConfigValue(t, r, "machine_fingerprint", "fingerprint-secret")
-
-	for _, name := range []string{"license_key", "license_machine_id", "machine_fingerprint"} {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/config/get", bytes.NewBufferString(`{"name":"`+name+`"}`))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", adminToken)
-		resp := httptest.NewRecorder()
-		router.ServeHTTP(resp, req)
-		assertHandlerCodeMsg(t, resp, 403, "禁止访问系统授权凭据")
-	}
-}
-
-func TestConfigListNeverReturnsLicenseCredentials(t *testing.T) {
-	router, r := setupConfigAccessTestRouter(t)
-	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
-	seedConfigValue(t, r, "license_key", "license-secret")
-	seedConfigValue(t, r, "license_machine_id", "machine-id")
-	seedConfigValue(t, r, "machine_fingerprint", "fingerprint-secret")
-	seedConfigValue(t, r, "is_commercial", "true")
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/config/list", nil)
-	req.Header.Set("Authorization", adminToken)
-	resp := httptest.NewRecorder()
-	router.ServeHTTP(resp, req)
-
-	var out struct {
-		Code int               `json:"code"`
-		Data map[string]string `json:"data"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 || out.Data["is_commercial"] != "true" {
-		t.Fatalf("unexpected config response: %+v", out)
-	}
-	if _, ok := out.Data["license_key"]; ok {
-		t.Fatal("license_key must not be returned")
-	}
-	if _, ok := out.Data["license_machine_id"]; ok {
-		t.Fatal("license_machine_id must not be returned")
-	}
-	if _, ok := out.Data["machine_fingerprint"]; ok {
-		t.Fatal("machine_fingerprint must not be returned")
-	}
-}
-
 func TestConfigUpdateAllowsSensitiveKeysForAdmin(t *testing.T) {
 	router, _ := setupConfigAccessTestRouter(t)
 	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
@@ -250,7 +154,7 @@ func TestConfigUpdateSingleAllowsCloudflareSecretKeyWrite(t *testing.T) {
 	}
 }
 
-func TestConfigUpdateRejectsLicenseKeyWrite(t *testing.T) {
+func TestConfigUpdateAllowsLicenseKeyWrite(t *testing.T) {
 	router, r := setupConfigAccessTestRouter(t)
 	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
 
@@ -261,13 +165,18 @@ func TestConfigUpdateRejectsLicenseKeyWrite(t *testing.T) {
 
 	router.ServeHTTP(resp, req)
 
-	assertHandlerCodeMsg(t, resp, -1, "该配置由系统管理")
-	if cfg, err := r.GetConfigByName("license_key"); err != nil || cfg != nil {
-		t.Fatalf("license_key should not be written, got %#v err=%v", cfg, err)
+	assertHandlerCode(t, resp, 0)
+
+	cfg, err := r.GetConfigByName("license_key")
+	if err != nil {
+		t.Fatalf("get config: %v", err)
+	}
+	if cfg == nil || cfg.Value != "license-secret" {
+		t.Fatalf("expected license_key to be updated, got %#v", cfg)
 	}
 }
 
-func TestConfigUpdateSingleRejectsLicenseKeyWrite(t *testing.T) {
+func TestConfigUpdateSingleAllowsLicenseKeyWrite(t *testing.T) {
 	router, r := setupConfigAccessTestRouter(t)
 	adminToken := mustGenerateConfigAccessToken(t, 1, "admin_user", 0)
 
@@ -278,9 +187,14 @@ func TestConfigUpdateSingleRejectsLicenseKeyWrite(t *testing.T) {
 
 	router.ServeHTTP(resp, req)
 
-	assertHandlerCodeMsg(t, resp, -1, "该配置由系统管理")
-	if cfg, err := r.GetConfigByName("license_key"); err != nil || cfg != nil {
-		t.Fatalf("license_key should not be written, got %#v err=%v", cfg, err)
+	assertHandlerCode(t, resp, 0)
+
+	cfg, err := r.GetConfigByName("license_key")
+	if err != nil {
+		t.Fatalf("get config: %v", err)
+	}
+	if cfg == nil || cfg.Value != "license-secret" {
+		t.Fatalf("expected license_key to be updated, got %#v", cfg)
 	}
 }
 

go-backend/internal/http/handler/flow_policy.go

@@ -659,21 +659,9 @@ func (h *Handler) sendDeleteOrphanedForwardService(nodeID int64, serviceName str
 }
 
 func (h *Handler) speedLimiterExists(name string) bool {
-	name = strings.TrimSpace(name)
 	if name == "" {
 		return false
 	}
-
-	const forwardRulePrefix = "rule_traffic_limit_"
-	if strings.HasPrefix(name, forwardRulePrefix) {
-		forwardID, err := strconv.ParseInt(strings.TrimPrefix(name, forwardRulePrefix), 10, 64)
-		if err != nil || forwardID <= 0 {
-			return false
-		}
-		forward, err := h.getForwardRecord(forwardID)
-		return err == nil && forward != nil && forward.IPSpeedID.Valid && forward.IPSpeedID.Int64 > 0
-	}
-
 	id, err := strconv.ParseInt(name, 10, 64)
 	if err != nil || id <= 0 {
 		return false

go-backend/internal/http/handler/flow_policy_limiter_test.go

@@ -1,38 +0,0 @@
-package handler
-
-import (
-	"path/filepath"
-	"testing"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestSpeedLimiterExistsPreservesForwardRuleLimiter(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx, ip_speed_id)
-		VALUES(8, 1, 'user', 'forward', 1, '127.0.0.1:80', 'fifo', 0, 0, 1, 1, 1, 0, 3),
-		       (9, 1, 'user', 'forward-without-ip-limit', 1, '127.0.0.1:81', 'fifo', 0, 0, 1, 1, 1, 0, NULL)
-	`).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	if !h.speedLimiterExists("rule_traffic_limit_8") {
-		t.Fatal("expected runtime limiter for existing forward to be preserved")
-	}
-	if h.speedLimiterExists("rule_traffic_limit_9") {
-		t.Fatal("expected runtime limiter for forward without per-IP speed limit to be treated as orphaned")
-	}
-	if h.speedLimiterExists("rule_traffic_limit_10") {
-		t.Fatal("expected runtime limiter for missing forward to be treated as orphaned")
-	}
-	if h.speedLimiterExists("rule_traffic_limit_invalid") {
-		t.Fatal("expected malformed runtime limiter name to be treated as orphaned")
-	}
-}

go-backend/internal/http/handler/handler.go

@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"encoding/base64"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -21,6 +20,7 @@ import (
 	"go-backend/internal/health"
 	"go-backend/internal/http/middleware"
 	"go-backend/internal/http/response"
+	"go-backend/internal/license"
 	"go-backend/internal/metrics"
 	"go-backend/internal/monitoring"
 	runtimenft "go-backend/internal/runtime/nftables"
@@ -42,12 +42,10 @@ type Handler struct {
 	captchaMu     sync.Mutex
 	captchaTokens map[string]int64
 
-	jobsMu              sync.Mutex
-	jobsCancel          context.CancelFunc
-	jobsStarted         bool
-	jobsWG              sync.WaitGroup
-	fingerprintMu       sync.Mutex
-	licenseValidationMu sync.Mutex
+	jobsMu      sync.Mutex
+	jobsCancel  context.CancelFunc
+	jobsStarted bool
+	jobsWG      sync.WaitGroup
 
 	upgradeMu                sync.Mutex
 	systemUpgradeMu          sync.Mutex
@@ -402,10 +400,6 @@ func (h *Handler) getConfigByName(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	configName := strings.ToLower(strings.TrimSpace(req.Name))
-	if configName == "license_key" || configName == "license_machine_id" || configName == "machine_fingerprint" {
-		response.WriteJSON(w, response.Err(403, "禁止访问系统授权凭据"))
-		return
-	}
 	if repo.IsSensitiveConfigKey(configName) && !isAdminRequest(r) {
 		response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
 		return
@@ -441,13 +435,11 @@ func (h *Handler) getConfigs(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	ctxClaims := r.Context().Value(middleware.ClaimsContextKey)
-	claims, isAdmin := ctxClaims.(auth.Claims)
-	if !isAdmin || claims.RoleID != 0 {
-		cfgMap = repo.FilterSensitiveConfigs(cfgMap)
+	if claims, ok := ctxClaims.(auth.Claims); !ok || claims.RoleID != 0 {
+		delete(cfgMap, "license_key")
+		delete(cfgMap, "cloudflare_secret_key")
+		delete(cfgMap, "jwt_secret")
 	}
-	delete(cfgMap, "license_key")
-	delete(cfgMap, "license_machine_id")
-	delete(cfgMap, "machine_fingerprint")
 	response.WriteJSON(w, response.OK(cfgMap))
 }
 
@@ -886,16 +878,10 @@ func (h *Handler) flowUpload(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) getOrCreateMachineFingerprint() (string, error) {
-	h.fingerprintMu.Lock()
-	defer h.fingerprintMu.Unlock()
-
-	fp, err := h.repo.GetViteConfigValue("machine_fingerprint")
+	fp, _ := h.repo.GetViteConfigValue("machine_fingerprint")
 	if fp != "" {
 		return fp, nil
 	}
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		return "", err
-	}
 
 	newFp := uuid.New().String()
 	now := time.Now().UnixMilli()
@@ -922,35 +908,56 @@ func (h *Handler) licenseActivate(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("授权码不能为空"))
 		return
 	}
-	h.licenseValidationMu.Lock()
-	defer h.licenseValidationMu.Unlock()
 
-	valResp, err := h.validateLicenseForMachine(key)
+	accountID := "1bc96cac-09de-4cf4-af34-26afdad63a90"
+
+	fingerprint, err := h.getOrCreateMachineFingerprint()
 	if err != nil {
-		log.Printf("license activation failed: %v", err)
-		response.WriteJSON(w, response.ErrDefault(licenseValidationErrorMessage(err)))
+		response.WriteJSON(w, response.ErrDefault("生成设备指纹失败"))
+		return
+	}
+
+	client := license.NewKeygenClient(accountID, "")
+	valResp, err := client.ValidateKeyWithFingerprint(key, fingerprint)
+	if err != nil {
+		response.WriteJSON(w, response.ErrDefault("连接授权服务器失败: "+err.Error()))
 		return
 	}
 
 	if !valResp.Meta.Valid {
-		response.WriteJSON(w, response.ErrDefault("授权码无效或已过期 (Code: "+valResp.Meta.Code+")"))
-		return
+		if valResp.Meta.Code == "NO_MACHINES" || valResp.Meta.Code == "NO_MACHINE" || valResp.Meta.Code == "MACHINE_SCOPE_REQUIRED" || valResp.Meta.Code == "FINGERPRINT_SCOPE_MISMATCH" {
+			// Needs machine activation
+			client.Token = key
+			err = client.ActivateMachine(valResp.Data.ID, fingerprint)
+			if err != nil {
+				// Translate specific error messages or log them
+				response.WriteJSON(w, response.ErrDefault("设备绑定失败: "+err.Error()))
+				return
+			}
+
+			// Validation might still fail with scope if we don't query via machine id, but since activate machine succeeded
+			// we can consider the license valid for our simple usecase
+		} else {
+			response.WriteJSON(w, response.ErrDefault("授权码无效或已过期 (Code: "+valResp.Meta.Code+")"))
+			return
+		}
 	}
 
 	now := time.Now().UnixMilli()
+	if err := h.repo.UpsertConfig("license_key", key, now); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if err := h.repo.UpsertConfig("is_commercial", "true", now); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
 	expiry := valResp.Data.Attributes.Expiry
 	if expiry == "" {
 		expiry = "never"
 	}
-	licenseState := map[string]string{
-		"license_key":    key,
-		"is_commercial":  "true",
-		"license_expiry": expiry,
-	}
-	if valResp.MachineID != "" {
-		licenseState["license_machine_id"] = valResp.MachineID
-	}
-	if err := h.repo.UpsertConfigs(licenseState, now); err != nil {
+	if err := h.repo.UpsertConfig("license_expiry", expiry, now); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
@@ -992,10 +999,6 @@ func (h *Handler) updateConfigs(w http.ResponseWriter, r *http.Request) {
 			response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
 			return
 		}
-		if repo.IsSystemManagedConfigKey(key) {
-			response.WriteJSON(w, response.ErrDefault("该配置由系统管理"))
-			return
-		}
 
 		if protectedKeys[key] && isCommercial != "true" {
 			response.WriteJSON(w, response.ErrDefault("需要商业版授权"))
@@ -1038,10 +1041,6 @@ func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(403, "禁止访问敏感配置"))
 		return
 	}
-	if repo.IsSystemManagedConfigKey(name) {
-		response.WriteJSON(w, response.ErrDefault("该配置由系统管理"))
-		return
-	}
 
 	isCommercial, _ := h.repo.GetViteConfigValue("is_commercial")
 	if (name == "app_name" || name == "app_logo" || name == "app_favicon" || name == "hide_footer_brand") && isCommercial != "true" {

go-backend/internal/http/handler/jobs.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"log"
 	"time"
+
+	"go-backend/internal/license"
 )
 
 var nftablesTrafficCollectInterval = 30 * time.Second
@@ -36,7 +38,6 @@ func (h *Handler) StartBackgroundJobs() {
 
 func (h *Handler) runValidateLicenseJob(ctx context.Context) {
 	defer h.jobsWG.Done()
-	h.validateLicenseJob()
 	ticker := time.NewTicker(12 * time.Hour)
 	defer ticker.Stop()
 
@@ -54,25 +55,22 @@ func (h *Handler) validateLicenseJob() {
 	if h == nil || h.repo == nil {
 		return
 	}
-	h.licenseValidationMu.Lock()
-	defer h.licenseValidationMu.Unlock()
+
+	accountID := "1bc96cac-09de-4cf4-af34-26afdad63a90"
 
 	key, _ := h.repo.GetViteConfigValue("license_key")
+	isCommercial, _ := h.repo.GetViteConfigValue("is_commercial")
 
-	if key == "" {
+	if key == "" || isCommercial != "true" {
 		return // Nothing to validate
 	}
 
-	valResp, err := h.validateLicenseForMachine(key)
+	fingerprint, _ := h.repo.GetViteConfigValue("machine_fingerprint")
+	client := license.NewKeygenClient(accountID, "")
+	valResp, err := client.ValidateKeyWithFingerprint(key, fingerprint)
 
 	if err != nil {
-		// Network and decode failures have no validation response, so retain the
-		// current state as a grace period. A rejected machine binding still has
-		// the original invalid response and must not stay commercially enabled.
-		if licenseValidationErrorIsDefinitive(valResp, err) {
-			now := time.Now().UnixMilli()
-			_ = h.repo.UpsertConfig("is_commercial", "false", now)
-		}
+		// Network error or timeout. Grace period by not revoking immediately here.
 		return
 	}
 
@@ -86,14 +84,7 @@ func (h *Handler) validateLicenseJob() {
 		if expiry == "" {
 			expiry = "never"
 		}
-		licenseState := map[string]string{
-			"is_commercial":  "true",
-			"license_expiry": expiry,
-		}
-		if valResp.MachineID != "" {
-			licenseState["license_machine_id"] = valResp.MachineID
-		}
-		_ = h.repo.UpsertConfigs(licenseState, now)
+		_ = h.repo.UpsertConfig("license_expiry", expiry, now)
 	}
 }
 

go-backend/internal/http/handler/license_validation.go

@@ -1,109 +0,0 @@
-package handler
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"os"
-	"strings"
-
-	"go-backend/internal/license"
-)
-
-var newLicenseClient = license.NewKeygenClient
-
-func keygenAccountID() string {
-	if value := strings.TrimSpace(license.AccountID); value != "" {
-		return value
-	}
-	return strings.TrimSpace(os.Getenv("KEYGEN_ACCOUNT_ID"))
-}
-
-func licenseNeedsMachineActivation(code string) bool {
-	switch strings.ToUpper(strings.TrimSpace(code)) {
-	case "NO_MACHINES", "NO_MACHINE", "MACHINE_SCOPE_REQUIRED", "FINGERPRINT_SCOPE_MISMATCH":
-		return true
-	default:
-		return false
-	}
-}
-
-func licenseValidationErrorIsDefinitive(validation *license.ValidateResponse, err error) bool {
-	if err == nil {
-		return validation != nil && !validation.Meta.Valid
-	}
-	var apiErr *license.APIError
-	if !errors.As(err, &apiErr) {
-		return false
-	}
-	if apiErr.StatusCode == http.StatusTooManyRequests || apiErr.StatusCode >= http.StatusInternalServerError {
-		return false
-	}
-	return apiErr.Operation == "activate machine" && validation != nil && !validation.Meta.Valid
-}
-
-func licenseValidationErrorMessage(err error) string {
-	if strings.Contains(err.Error(), "keygen account id is not configured") {
-		return "授权服务配置错误"
-	}
-	var apiErr *license.APIError
-	if errors.As(err, &apiErr) {
-		if apiErr.HasCode("MACHINE_LIMIT_EXCEEDED") {
-			return "授权设备数量已达上限"
-		}
-		if apiErr.StatusCode == http.StatusUnauthorized || apiErr.StatusCode == http.StatusForbidden {
-			return "授权码无效或无权绑定设备"
-		}
-	}
-	return "连接授权服务器失败，请稍后重试"
-}
-
-func (h *Handler) validateLicenseForMachine(key string) (*license.ValidateResponse, error) {
-	fingerprint, err := h.getOrCreateMachineFingerprint()
-	if err != nil {
-		return nil, fmt.Errorf("prepare machine fingerprint: %w", err)
-	}
-	storedMachineID, _ := h.repo.GetViteConfigValue("license_machine_id")
-
-	accountID := keygenAccountID()
-	if accountID == "" {
-		return nil, fmt.Errorf("keygen account id is not configured")
-	}
-	client := newLicenseClient(accountID, "")
-	var validation *license.ValidateResponse
-	if storedMachineID != "" {
-		validation, err = client.ValidateKeyWithMachine(key, fingerprint, storedMachineID)
-	} else {
-		validation, err = client.ValidateKeyWithFingerprint(key, fingerprint)
-	}
-	if err != nil {
-		return nil, err
-	}
-	if validation.Meta.Valid || !licenseNeedsMachineActivation(validation.Meta.Code) {
-		if validation.Meta.Valid {
-			validation.MachineID = storedMachineID
-		}
-		return validation, nil
-	}
-
-	client.Token = key
-	machineID, err := client.ActivateMachine(validation.Data.ID, fingerprint)
-	if err != nil {
-		return validation, err
-	}
-	if machineID == "" {
-		machineID, err = client.GetMachineID(fingerprint)
-		if err != nil {
-			return validation, fmt.Errorf("retrieve activated machine: %w", err)
-		}
-	}
-
-	validation, err = client.ValidateKeyWithMachine(key, fingerprint, machineID)
-	if err != nil {
-		return nil, err
-	}
-	if validation.Meta.Valid {
-		validation.MachineID = machineID
-	}
-	return validation, nil
-}

go-backend/internal/http/handler/license_validation_test.go

@@ -1,358 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"go-backend/internal/license"
-	"go-backend/internal/store/repo"
-)
-
-func TestValidateLicenseJobRepairsMissingMachineBinding(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "true", now)
-
-	var validations atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			if validations.Add(1) == 1 {
-				_, _ = fmt.Fprint(w, `{"meta":{"valid":false,"code":"NO_MACHINE"},"data":{"id":"license-id","attributes":{}}}`)
-				return
-			}
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":true,"code":"VALID"},"data":{"id":"license-id","attributes":{"expiry":"2030-01-02T00:00:00.000Z"}}}`)
-		case strings.HasSuffix(req.URL.Path, "/machines"):
-			w.WriteHeader(http.StatusCreated)
-			_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-		case strings.Contains(req.URL.Path, "/machines/"):
-			_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "true")
-	assertLicenseConfig(t, r, "license_expiry", "2030-01-02T00:00:00.000Z")
-	fingerprint, err := r.GetViteConfigValue("machine_fingerprint")
-	if err != nil || strings.TrimSpace(fingerprint) == "" {
-		t.Fatalf("expected persisted machine fingerprint, got value=%q err=%v", fingerprint, err)
-	}
-	if got := validations.Load(); got != 2 {
-		t.Fatalf("validation calls = %d, want 2", got)
-	}
-}
-
-func TestValidateLicenseJobAcceptsExistingMachineActivation(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "true", now)
-
-	var validations atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			if validations.Add(1) == 1 {
-				_, _ = fmt.Fprint(w, `{"meta":{"valid":false,"code":"NO_MACHINE"},"data":{"id":"license-id","attributes":{}}}`)
-				return
-			}
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":true,"code":"VALID"},"data":{"id":"license-id","attributes":{"expiry":"never"}}}`)
-		case strings.HasSuffix(req.URL.Path, "/machines"):
-			w.WriteHeader(http.StatusUnprocessableEntity)
-			_, _ = fmt.Fprint(w, `{"errors":[{"code":"FINGERPRINT_TAKEN"},{"code":"MACHINE_LIMIT_EXCEEDED"}]}`)
-		case strings.Contains(req.URL.Path, "/machines/"):
-			_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "true")
-	assertLicenseConfig(t, r, "license_expiry", "never")
-	if got := validations.Load(); got != 2 {
-		t.Fatalf("validation calls = %d, want 2", got)
-	}
-}
-
-func TestLicenseActivateRequiresSuccessfulPostActivationValidation(t *testing.T) {
-	r := openLicenseTestRepository(t)
-
-	var validations atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			code := "NO_MACHINE"
-			if validations.Add(1) > 1 {
-				code = "FINGERPRINT_SCOPE_MISMATCH"
-			}
-			_, _ = fmt.Fprintf(w, `{"meta":{"valid":false,"code":%q},"data":{"id":"license-id","attributes":{}}}`, code)
-		case strings.HasSuffix(req.URL.Path, "/machines"):
-			w.WriteHeader(http.StatusCreated)
-			_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-		case strings.Contains(req.URL.Path, "/machines/"):
-			_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/license/activate", bytes.NewBufferString(`{"license_key":"license-secret"}`))
-	res := httptest.NewRecorder()
-	h.licenseActivate(res, req)
-
-	if !strings.Contains(res.Body.String(), "FINGERPRINT_SCOPE_MISMATCH") {
-		t.Fatalf("expected post-activation validation failure, got %s", res.Body.String())
-	}
-	assertLicenseConfig(t, r, "is_commercial", "false")
-	for _, name := range []string{"license_key", "license_expiry"} {
-		if value, err := r.GetViteConfigValue(name); err == nil || value != "" {
-			t.Fatalf("%s should not be persisted, got value=%q err=%v", name, value, err)
-		}
-	}
-}
-
-func TestLicenseActivatePersistsValidatedState(t *testing.T) {
-	r := openLicenseTestRepository(t)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":true,"code":"VALID"},"data":{"id":"license-id","attributes":{"expiry":"2030-01-02T00:00:00.000Z"}}}`)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/license/activate", bytes.NewBufferString(`{"license_key":"license-secret"}`))
-	res := httptest.NewRecorder()
-	h.licenseActivate(res, req)
-
-	if !strings.Contains(res.Body.String(), `"code":0`) {
-		t.Fatalf("expected activation success, got %s", res.Body.String())
-	}
-	assertLicenseConfig(t, r, "license_key", "license-secret")
-	assertLicenseConfig(t, r, "is_commercial", "true")
-	assertLicenseConfig(t, r, "license_expiry", "2030-01-02T00:00:00.000Z")
-}
-
-func TestValidateLicenseJobDowngradesWhenMachineBindingIsRejected(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "true", now)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":false,"code":"NO_MACHINE"},"data":{"id":"license-id","attributes":{}}}`)
-		case strings.HasSuffix(req.URL.Path, "/machines"):
-			w.WriteHeader(http.StatusUnprocessableEntity)
-			_, _ = fmt.Fprint(w, `{"errors":[{"code":"MACHINE_LIMIT_EXCEEDED"}]}`)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "false")
-}
-
-func TestValidateLicenseJobRestoresCommercialStateWhenLicenseRecovers(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "false", now)
-	seedLicenseConfig(t, r, "machine_fingerprint", "fingerprint", now)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		if strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key") {
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":true,"code":"VALID"},"data":{"id":"license-id","attributes":{"expiry":"never"}}}`)
-			return
-		}
-		http.NotFound(w, req)
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "true")
-	assertLicenseConfig(t, r, "license_expiry", "never")
-}
-
-func TestValidateLicenseJobUsesStoredMachineScope(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "true", now)
-	seedLicenseConfig(t, r, "machine_fingerprint", "fingerprint", now)
-	seedLicenseConfig(t, r, "license_machine_id", "machine-id", now)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		if !strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key") {
-			t.Fatalf("unexpected request %s %s", req.Method, req.URL.Path)
-		}
-		var body struct {
-			Meta struct {
-				Scope map[string]string `json:"scope"`
-			} `json:"meta"`
-		}
-		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-			t.Fatalf("decode request: %v", err)
-		}
-		if body.Meta.Scope["machine"] != "machine-id" || body.Meta.Scope["fingerprint"] != "fingerprint" {
-			t.Fatalf("unexpected validation scope: %+v", body.Meta.Scope)
-		}
-		_, _ = fmt.Fprint(w, `{"meta":{"valid":true,"code":"VALID"},"data":{"id":"license-id","attributes":{"expiry":"never"}}}`)
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "true")
-	assertLicenseConfig(t, r, "license_machine_id", "machine-id")
-}
-
-func TestValidateLicenseJobKeepsStateOnMachineLookupServerFailure(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "true", now)
-	seedLicenseConfig(t, r, "machine_fingerprint", "fingerprint", now)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":false,"code":"MACHINE_SCOPE_REQUIRED"},"data":{"id":"license-id","attributes":{}}}`)
-		case strings.HasSuffix(req.URL.Path, "/machines"):
-			w.WriteHeader(http.StatusUnprocessableEntity)
-			_, _ = fmt.Fprint(w, `{"errors":[{"code":"FINGERPRINT_TAKEN"}]}`)
-		case strings.Contains(req.URL.Path, "/machines/"):
-			w.WriteHeader(http.StatusServiceUnavailable)
-			_, _ = fmt.Fprint(w, `{"errors":[{"code":"SERVICE_UNAVAILABLE"}]}`)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "true")
-}
-
-func TestValidateLicenseJobKeepsStateOnMachineLookupNotFound(t *testing.T) {
-	r := openLicenseTestRepository(t)
-	now := time.Now().UnixMilli()
-	seedLicenseConfig(t, r, "license_key", "license-secret", now)
-	seedLicenseConfig(t, r, "is_commercial", "true", now)
-	seedLicenseConfig(t, r, "machine_fingerprint", "fingerprint", now)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		switch {
-		case strings.HasSuffix(req.URL.Path, "/licenses/actions/validate-key"):
-			_, _ = fmt.Fprint(w, `{"meta":{"valid":false,"code":"MACHINE_SCOPE_REQUIRED"},"data":{"id":"license-id","attributes":{}}}`)
-		case strings.HasSuffix(req.URL.Path, "/machines"):
-			w.WriteHeader(http.StatusUnprocessableEntity)
-			_, _ = fmt.Fprint(w, `{"errors":[{"code":"FINGERPRINT_TAKEN"}]}`)
-		case strings.Contains(req.URL.Path, "/machines/"):
-			http.NotFound(w, req)
-		default:
-			http.NotFound(w, req)
-		}
-	}))
-	defer server.Close()
-	restoreLicenseClientFactory(t, server.URL)
-
-	h := &Handler{repo: r}
-	h.validateLicenseJob()
-
-	assertLicenseConfig(t, r, "is_commercial", "true")
-}
-
-func TestLicenseValidationErrorMessageDoesNotExposeKeygenResponse(t *testing.T) {
-	err := &license.APIError{
-		Operation:  "activate machine",
-		StatusCode: http.StatusUnprocessableEntity,
-		Body:       `{"errors":[{"code":"MACHINE_LIMIT_EXCEEDED","detail":"private detail"}]}`,
-	}
-	message := licenseValidationErrorMessage(err)
-	if message != "授权设备数量已达上限" || strings.Contains(message, "private detail") {
-		t.Fatalf("unexpected public error message %q", message)
-	}
-}
-
-func openLicenseTestRepository(t *testing.T) *repo.Repository {
-	t.Helper()
-	r, err := repo.Open(filepath.Join(t.TempDir(), "license.db"))
-	if err != nil {
-		t.Fatalf("repo.Open() error = %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-	return r
-}
-
-func seedLicenseConfig(t *testing.T, r *repo.Repository, name, value string, now int64) {
-	t.Helper()
-	if err := r.UpsertConfig(name, value, now); err != nil {
-		t.Fatalf("UpsertConfig(%q) error = %v", name, err)
-	}
-}
-
-func assertLicenseConfig(t *testing.T, r *repo.Repository, name, want string) {
-	t.Helper()
-	got, err := r.GetViteConfigValue(name)
-	if err != nil {
-		t.Fatalf("GetViteConfigValue(%q) error = %v", name, err)
-	}
-	if got != want {
-		t.Fatalf("config %q = %q, want %q", name, got, want)
-	}
-}
-
-func restoreLicenseClientFactory(t *testing.T, baseURL string) {
-	t.Helper()
-	t.Setenv("KEYGEN_ACCOUNT_ID", "account-id")
-	previous := newLicenseClient
-	newLicenseClient = func(accountID, token string) *license.KeygenClient {
-		client := license.NewKeygenClient(accountID, token)
-		client.BaseURL = baseURL
-		return client
-	}
-	t.Cleanup(func() { newLicenseClient = previous })
-}

go-backend/internal/http/middleware/auth.go

@@ -182,8 +182,6 @@ func requiresAdmin(path string) bool {
 		return true
 	case "/api/v1/config/update", "/api/v1/config/update-single":
 		return true
-	case "/api/v1/license/activate":
-		return true
 	case "/api/v1/announcement/update":
 		return true
 	default:

go-backend/internal/http/middleware/auth_test.go

@@ -197,39 +197,6 @@ func TestShouldSkipBypassesPublicConfigGet(t *testing.T) {
 	}
 }
 
-func TestLicenseActivateRequiresAdmin(t *testing.T) {
-	if !requiresAdmin("/api/v1/license/activate") {
-		t.Fatal("expected license activation to require admin")
-	}
-}
-
-func TestJWTRejectsNonAdminLicenseActivation(t *testing.T) {
-	secret := "unit-test-secret"
-	token, err := auth.GenerateToken(2, "regular_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	claims, err := auth.ParseClaims(token, secret)
-	if err != nil {
-		t.Fatalf("parse claims: %v", err)
-	}
-
-	wrapped := JWT(AuthOptions{
-		JWTSecret: secret,
-		GetUserAuthState: func(userID int64) (*auth.UserAuthState, error) {
-			return &auth.UserAuthState{ID: userID, RoleID: 1, Status: 1, PasswordChangedAt: claims.IatMs - 1}, nil
-		},
-	})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	}))
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/license/activate", nil)
-	req.Header.Set("Authorization", token)
-	res := httptest.NewRecorder()
-	wrapped.ServeHTTP(res, req)
-	assertCodeMsg(t, res, 403, "权限不足，仅管理员可操作")
-}
-
 func TestJWTExpiresAfterSevenDays(t *testing.T) {
 	secret := "unit-test-secret"
 	token, err := auth.GenerateToken(1, "admin_user", 0, secret)

go-backend/internal/license/keygen.go

@@ -6,53 +6,24 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"strings"
 	"time"
 )
 
-var AccountID string
-
 type KeygenClient struct {
 	AccountID  string
 	Token      string
-	BaseURL    string
 	HTTPClient *http.Client
 }
 
-type APIError struct {
-	Operation  string
-	StatusCode int
-	Body       string
-}
-
-func (e *APIError) Error() string {
-	return fmt.Sprintf("keygen %s failed: status %d, response: %s", e.Operation, e.StatusCode, e.Body)
-}
-
-func (e *APIError) HasCode(code string) bool {
-	return e != nil && hasKeygenErrorCode([]byte(e.Body), code)
-}
-
-const defaultAPIBaseURL = "https://api.keygen.sh/v1"
-
 func NewKeygenClient(accountID, token string) *KeygenClient {
 	return &KeygenClient{
-		AccountID:  accountID,
-		Token:      token,
-		BaseURL:    defaultAPIBaseURL,
+		AccountID: accountID,
+		Token:     token,
 		HTTPClient: &http.Client{Timeout: 10 * time.Second},
 	}
 }
 
-func (c *KeygenClient) apiURL(path string) string {
-	baseURL := strings.TrimRight(c.BaseURL, "/")
-	if baseURL == "" {
-		baseURL = defaultAPIBaseURL
-	}
-	return fmt.Sprintf("%s/accounts/%s/%s", baseURL, c.AccountID, strings.TrimLeft(path, "/"))
-}
-
 type ValidateResponse struct {
 	Meta struct {
 		Valid bool   `json:"valid"`
@@ -64,7 +35,6 @@ type ValidateResponse struct {
 			Expiry string `json:"expiry"`
 		} `json:"attributes"`
 	} `json:"data"`
-	MachineID string `json:"-"`
 }
 
 type ActivateMachineRequest struct {
@@ -84,37 +54,8 @@ type ActivateMachineRequest struct {
 	} `json:"data"`
 }
 
-type keygenErrorResponse struct {
-	Errors []struct {
-		Code string `json:"code"`
-	} `json:"errors"`
-}
-
-type MachineResponse struct {
-	Data struct {
-		ID string `json:"id"`
-	} `json:"data"`
-}
-
-func hasKeygenErrorCode(body []byte, code string) bool {
-	var resp keygenErrorResponse
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return false
-	}
-	for _, item := range resp.Errors {
-		if strings.EqualFold(strings.TrimSpace(item.Code), code) {
-			return true
-		}
-	}
-	return false
-}
-
 func (c *KeygenClient) ValidateKeyWithFingerprint(key string, fingerprint string) (*ValidateResponse, error) {
-	return c.ValidateKeyWithMachine(key, fingerprint, "")
-}
-
-func (c *KeygenClient) ValidateKeyWithMachine(key, fingerprint, machineID string) (*ValidateResponse, error) {
-	url := c.apiURL("licenses/actions/validate-key")
+	url := fmt.Sprintf("https://api.keygen.sh/v1/accounts/%s/licenses/actions/validate-key", c.AccountID)
 
 	meta := map[string]interface{}{
 		"key": key,
@@ -125,14 +66,6 @@ func (c *KeygenClient) ValidateKeyWithMachine(key, fingerprint, machineID string
 			"fingerprint": fingerprint,
 		}
 	}
-	if machineID != "" {
-		scope, _ := meta["scope"].(map[string]interface{})
-		if scope == nil {
-			scope = make(map[string]interface{})
-			meta["scope"] = scope
-		}
-		scope["machine"] = machineID
-	}
 
 	reqBody := map[string]interface{}{
 		"meta": meta,
@@ -158,8 +91,7 @@ func (c *KeygenClient) ValidateKeyWithMachine(key, fingerprint, machineID string
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, &APIError{Operation: "validate license", StatusCode: resp.StatusCode, Body: string(body)}
+		return nil, fmt.Errorf("keygen api error: status %d", resp.StatusCode)
 	}
 
 	var valResp ValidateResponse
@@ -170,44 +102,8 @@ func (c *KeygenClient) ValidateKeyWithMachine(key, fingerprint, machineID string
 	return &valResp, nil
 }
 
-func (c *KeygenClient) GetMachineID(fingerprint string) (string, error) {
-	machineURL := c.apiURL("machines/" + url.PathEscape(fingerprint))
-	req, err := http.NewRequest(http.MethodGet, machineURL, nil)
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Accept", "application/vnd.api+json")
-	if c.Token != "" {
-		if !strings.HasPrefix(c.Token, "Bearer ") && !strings.HasPrefix(c.Token, "License ") {
-			req.Header.Set("Authorization", "License "+c.Token)
-		} else {
-			req.Header.Set("Authorization", c.Token)
-		}
-	}
-
-	resp, err := c.HTTPClient.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return "", &APIError{Operation: "retrieve machine", StatusCode: resp.StatusCode, Body: string(body)}
-	}
-
-	var machineResp MachineResponse
-	if err := json.NewDecoder(resp.Body).Decode(&machineResp); err != nil {
-		return "", err
-	}
-	machineID := strings.TrimSpace(machineResp.Data.ID)
-	if machineID == "" {
-		return "", fmt.Errorf("failed to retrieve machine: empty machine id")
-	}
-	return machineID, nil
-}
-
 func (c *KeygenClient) ValidateKey(key string) (*ValidateResponse, error) {
-	url := c.apiURL("licenses/actions/validate-key")
+	url := fmt.Sprintf("https://api.keygen.sh/v1/accounts/%s/licenses/actions/validate-key", c.AccountID)
 
 	reqBody := map[string]interface{}{
 		"meta": map[string]string{
@@ -234,8 +130,7 @@ func (c *KeygenClient) ValidateKey(key string) (*ValidateResponse, error) {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, &APIError{Operation: "validate license", StatusCode: resp.StatusCode, Body: string(body)}
+		return nil, fmt.Errorf("keygen api error: status %d", resp.StatusCode)
 	}
 
 	var valResp ValidateResponse
@@ -246,8 +141,8 @@ func (c *KeygenClient) ValidateKey(key string) (*ValidateResponse, error) {
 	return &valResp, nil
 }
 
-func (c *KeygenClient) ActivateMachine(licenseID, fingerprint string) (string, error) {
-	url := c.apiURL("machines")
+func (c *KeygenClient) ActivateMachine(licenseID, fingerprint string) error {
+	url := fmt.Sprintf("https://api.keygen.sh/v1/accounts/%s/machines", c.AccountID)
 
 	var reqBody ActivateMachineRequest
 	reqBody.Data.Type = "machines"
@@ -270,24 +165,23 @@ func (c *KeygenClient) ActivateMachine(licenseID, fingerprint string) (string, e
 
 	resp, err := c.HTTPClient.Do(req)
 	if err != nil {
-		return "", err
+		return err
 	}
 	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
 
 	if resp.StatusCode == http.StatusCreated || resp.StatusCode == http.StatusOK {
-		var machineResp MachineResponse
-		if json.Unmarshal(body, &machineResp) == nil {
-			return strings.TrimSpace(machineResp.Data.ID), nil
+		return nil
+	}
+
+	body, _ := io.ReadAll(resp.Body)
+	
+	if resp.StatusCode == http.StatusConflict || resp.StatusCode == http.StatusUnprocessableEntity {
+		if strings.Contains(string(body), "FINGERPRINT_TAKEN") || strings.Contains(string(body), "MACHINE_LIMIT_EXCEEDED") {
+			// Machine already registered to this license or limit reached because it's already us.
+			// The subsequent ValidateKey check will determine if the existing machine is actually us.
+			return nil
 		}
-		return "", nil
 	}
 
-	if resp.StatusCode == http.StatusUnprocessableEntity && hasKeygenErrorCode(body, "FINGERPRINT_TAKEN") {
-		// Machine activation is idempotent. Keygen scopes fingerprint uniqueness
-		// to the target license, so this means the same machine is already bound.
-		return "", nil
-	}
-
-	return "", &APIError{Operation: "activate machine", StatusCode: resp.StatusCode, Body: string(body)}
-}
+	return fmt.Errorf("failed to activate machine: status %d, response: %s", resp.StatusCode, string(body))
+}

go-backend/internal/license/keygen_test.go

@@ -1,104 +0,0 @@
-package license
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func TestValidateKeyWithMachineSendsFingerprintAndMachineScopes(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var body struct {
-			Meta struct {
-				Scope map[string]string `json:"scope"`
-			} `json:"meta"`
-		}
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-			t.Fatalf("decode request: %v", err)
-		}
-		if body.Meta.Scope["fingerprint"] != "fingerprint" {
-			t.Fatalf("fingerprint scope = %q", body.Meta.Scope["fingerprint"])
-		}
-		if body.Meta.Scope["machine"] != "machine-id" {
-			t.Fatalf("machine scope = %q", body.Meta.Scope["machine"])
-		}
-		_, _ = fmt.Fprint(w, `{"meta":{"valid":true,"code":"VALID"},"data":{"id":"license-id","attributes":{}}}`)
-	}))
-	defer server.Close()
-
-	client := NewKeygenClient("account-id", "")
-	client.BaseURL = server.URL
-	validation, err := client.ValidateKeyWithMachine("license-key", "fingerprint", "machine-id")
-	if err != nil || !validation.Meta.Valid {
-		t.Fatalf("ValidateKeyWithMachine() validation=%+v err=%v", validation, err)
-	}
-}
-
-func TestGetMachineIDRetrievesMachineByFingerprint(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodGet || !strings.HasSuffix(r.URL.Path, "/machines/fingerprint") {
-			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
-		}
-		if r.Header.Get("Authorization") != "License license-key" {
-			t.Fatalf("authorization = %q", r.Header.Get("Authorization"))
-		}
-		_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-	}))
-	defer server.Close()
-
-	client := NewKeygenClient("account-id", "license-key")
-	client.BaseURL = server.URL
-	machineID, err := client.GetMachineID("fingerprint")
-	if err != nil || machineID != "machine-id" {
-		t.Fatalf("GetMachineID() = %q, %v", machineID, err)
-	}
-}
-
-func TestActivateMachineTreatsFingerprintTakenAsIdempotent(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusUnprocessableEntity)
-		_, _ = fmt.Fprint(w, `{"errors":[{"code":"FINGERPRINT_TAKEN"},{"code":"MACHINE_LIMIT_EXCEEDED"}]}`)
-	}))
-	defer server.Close()
-
-	client := NewKeygenClient("account-id", "license-key")
-	client.BaseURL = server.URL
-
-	if machineID, err := client.ActivateMachine("license-id", "fingerprint"); err != nil || machineID != "" {
-		t.Fatalf("ActivateMachine() error = %v, want idempotent success", err)
-	}
-}
-
-func TestActivateMachineReturnsCreatedMachineID(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusCreated)
-		_, _ = fmt.Fprint(w, `{"data":{"type":"machines","id":"machine-id"}}`)
-	}))
-	defer server.Close()
-
-	client := NewKeygenClient("account-id", "license-key")
-	client.BaseURL = server.URL
-	machineID, err := client.ActivateMachine("license-id", "fingerprint")
-	if err != nil || machineID != "machine-id" {
-		t.Fatalf("ActivateMachine() = %q, %v", machineID, err)
-	}
-}
-
-func TestActivateMachineRejectsMachineLimitWithoutFingerprintTaken(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusUnprocessableEntity)
-		_, _ = fmt.Fprint(w, `{"errors":[{"code":"MACHINE_LIMIT_EXCEEDED"}]}`)
-	}))
-	defer server.Close()
-
-	client := NewKeygenClient("account-id", "license-key")
-	client.BaseURL = server.URL
-
-	_, err := client.ActivateMachine("license-id", "fingerprint")
-	if err == nil || !strings.Contains(err.Error(), "MACHINE_LIMIT_EXCEEDED") {
-		t.Fatalf("ActivateMachine() error = %v, want machine limit failure", err)
-	}
-}

go-backend/internal/runtime/nftables/renderer.go

@@ -46,8 +46,7 @@ func RenderTable(plan NodePlan) string {
 		}
 		targetHost := strings.Trim(strings.TrimSpace(rule.TargetHost), "[]")
 		for _, protocol := range normalizedProtocols(rule.Protocols) {
-			b.WriteString(fmt.Sprintf("    meta l4proto %s ct original proto-dst %d %s daddr %s %s dport %d counter comment %q\n",
-				protocol,
+			b.WriteString(fmt.Sprintf("    ct original proto-dst %d %s daddr %s %s dport %d counter comment %q\n",
 				rule.InPort,
 				family,
 				targetHost,
@@ -55,8 +54,7 @@ func RenderTable(plan NodePlan) string {
 				rule.TargetPort,
 				counterComment(rule.ForwardID, CounterDirectionToTarget, protocol),
 			))
-			b.WriteString(fmt.Sprintf("    meta l4proto %s ct original proto-dst %d %s saddr %s %s sport %d counter comment %q\n",
-				protocol,
+			b.WriteString(fmt.Sprintf("    ct original proto-dst %d %s saddr %s %s sport %d counter comment %q\n",
 				rule.InPort,
 				family,
 				targetHost,

go-backend/internal/runtime/nftables/renderer_test.go

@@ -62,10 +62,10 @@ func TestRenderTableIncludesForwardAccountingCounters(t *testing.T) {
 	wantLines := []string{
 		`tcp dport 12345 counter dnat ip to 198.51.100.20:443 comment "flvx forward:42 dnat tcp"`,
 		`udp dport 12345 counter dnat ip to 198.51.100.20:443 comment "flvx forward:42 dnat udp"`,
-		`meta l4proto tcp ct original proto-dst 12345 ip daddr 198.51.100.20 tcp dport 443 counter comment "flvx forward:42 to-target tcp"`,
-		`meta l4proto tcp ct original proto-dst 12345 ip saddr 198.51.100.20 tcp sport 443 counter comment "flvx forward:42 from-target tcp"`,
-		`meta l4proto udp ct original proto-dst 12345 ip daddr 198.51.100.20 udp dport 443 counter comment "flvx forward:42 to-target udp"`,
-		`meta l4proto udp ct original proto-dst 12345 ip saddr 198.51.100.20 udp sport 443 counter comment "flvx forward:42 from-target udp"`,
+		`ct original proto-dst 12345 ip daddr 198.51.100.20 tcp dport 443 counter comment "flvx forward:42 to-target tcp"`,
+		`ct original proto-dst 12345 ip saddr 198.51.100.20 tcp sport 443 counter comment "flvx forward:42 from-target tcp"`,
+		`ct original proto-dst 12345 ip daddr 198.51.100.20 udp dport 443 counter comment "flvx forward:42 to-target udp"`,
+		`ct original proto-dst 12345 ip saddr 198.51.100.20 udp sport 443 counter comment "flvx forward:42 from-target udp"`,
 	}
 	for _, want := range wantLines {
 		if !strings.Contains(got, want) {
@@ -89,8 +89,8 @@ func TestRenderTableIncludesIPv6ForwardAccountingCounters(t *testing.T) {
 	got := RenderTable(plan)
 	wantLines := []string{
 		`tcp dport 12346 counter dnat ip6 to [2001:db8::20]:8443 comment "flvx forward:43 dnat tcp"`,
-		`meta l4proto tcp ct original proto-dst 12346 ip6 daddr 2001:db8::20 tcp dport 8443 counter comment "flvx forward:43 to-target tcp"`,
-		`meta l4proto tcp ct original proto-dst 12346 ip6 saddr 2001:db8::20 tcp sport 8443 counter comment "flvx forward:43 from-target tcp"`,
+		`ct original proto-dst 12346 ip6 daddr 2001:db8::20 tcp dport 8443 counter comment "flvx forward:43 to-target tcp"`,
+		`ct original proto-dst 12346 ip6 saddr 2001:db8::20 tcp sport 8443 counter comment "flvx forward:43 from-target tcp"`,
 	}
 	for _, want := range wantLines {
 		if !strings.Contains(got, want) {
@@ -110,8 +110,8 @@ func TestRenderTableAccountingCountersIncludeOriginalPort(t *testing.T) {
 
 	got := RenderTable(plan)
 	wantLines := []string{
-		`meta l4proto tcp ct original proto-dst 12345 ip daddr 198.51.100.20 tcp dport 443 counter comment "flvx forward:42 to-target tcp"`,
-		`meta l4proto tcp ct original proto-dst 12346 ip daddr 198.51.100.20 tcp dport 443 counter comment "flvx forward:43 to-target tcp"`,
+		`ct original proto-dst 12345 ip daddr 198.51.100.20 tcp dport 443 counter comment "flvx forward:42 to-target tcp"`,
+		`ct original proto-dst 12346 ip daddr 198.51.100.20 tcp dport 443 counter comment "flvx forward:43 to-target tcp"`,
 	}
 	for _, want := range wantLines {
 		if !strings.Contains(got, want) {

go-backend/internal/runtime/nftables/runner.go

@@ -26,58 +26,23 @@ func NewSSHRunner() *SSHRunner {
 }
 
 func (r *SSHRunner) Test(ctx context.Context, cfg SSHConfig) error {
-	nft := nftBinary(cfg)
-	tableName := fmt.Sprintf("flvx_capability_%d", time.Now().UnixNano())
-	return r.run(ctx, cfg, buildCapabilityCheckCommand(nft, tableName))
-}
-
-func buildCapabilityCheckCommand(nft, tableName string) string {
-	script := RenderTable(NodePlan{
-		Rules: []Rule{{
-			ForwardID:  1,
-			InPort:     12345,
-			TargetHost: "192.0.2.1",
-			TargetPort: 443,
-			Protocols:  []string{"tcp", "udp"},
-		}},
-	})
-	script = strings.Replace(script, "table inet flvx {", "table inet "+tableName+" {", 1)
-	return "set -eu\n" +
-		"command -v nft >/dev/null 2>&1\n" +
-		nft + " --version >/dev/null 2>&1\n" +
-		"tmp=$(mktemp /tmp/flvx-nft-capability-XXXXXX.nft)\n" +
-		"trap 'rm -f \"$tmp\"' EXIT\n" +
-		"cat > \"$tmp\" <<'EOF'\n" + script + "\nEOF\n" +
-		"if ! " + nft + " -c -f \"$tmp\"; then\n" +
-		"  echo 'nftables cannot validate the generated FLVX rules' >&2\n" +
-		"  exit 1\n" +
-		"fi"
+	return r.run(ctx, cfg, "command -v nft >/dev/null 2>&1 && nft --version >/dev/null 2>&1")
 }
 
 func (r *SSHRunner) ApplyScript(ctx context.Context, cfg SSHConfig, script string) error {
-	command := buildApplyCommand(nftBinary(cfg), script)
-	return r.run(ctx, cfg, command)
-}
-
-func buildApplyCommand(nft, script string) string {
-	return "set -eu\n" +
-		"tmp=$(mktemp /tmp/flvx-nft-XXXXXX.nft)\n" +
-		"batch=$(mktemp /tmp/flvx-nft-batch-XXXXXX.nft) || { rm -f \"$tmp\"; exit 1; }\n" +
+	nft := nftBinary(cfg)
+	command := "tmp=$(mktemp /tmp/flvx-nft-XXXXXX.nft) || exit 1\n" +
 		"cleanup() {\n" +
-		"  rm -f \"$tmp\" \"$batch\"\n" +
+		"  rm -f \"$tmp\"\n" +
 		"}\n" +
 		"trap cleanup EXIT\n" +
 		"cat > \"$tmp\" <<'EOF'\n" + script + "\nEOF\n" +
+		nft + " -c -f \"$tmp\"\n" +
 		"if " + nft + " list table inet flvx >/dev/null 2>&1; then\n" +
-		"  { printf '%s\\n' 'delete table inet flvx'; cat \"$tmp\"; } > \"$batch\"\n" +
-		"else\n" +
-		"  cp \"$tmp\" \"$batch\"\n" +
+		"  " + nft + " delete table inet flvx\n" +
 		"fi\n" +
-		"if ! " + nft + " -c -f \"$batch\"; then\n" +
-		"  echo 'nftables rule validation failed; active rules were preserved' >&2\n" +
-		"  exit 1\n" +
-		"fi\n" +
-		nft + " -f \"$batch\""
+		nft + " -f \"$tmp\""
+	return r.run(ctx, cfg, command)
 }
 
 func (r *SSHRunner) ListTableJSON(ctx context.Context, cfg SSHConfig) ([]byte, error) {

go-backend/internal/runtime/nftables/runner_test.go

@@ -5,113 +5,10 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
 )
 
-func TestBuildApplyCommandStopsAfterValidationFailure(t *testing.T) {
-	dir := t.TempDir()
-	logPath := filepath.Join(dir, "calls.log")
-	applyMarker := filepath.Join(dir, "applied")
-	nftPath := filepath.Join(dir, "nft")
-	fake := `#!/bin/sh
-echo "$*" >> "` + logPath + `"
-if [ "$1" = "list" ]; then
-  exit 0
-fi
-if [ "$1" = "-c" ]; then
-  exit 1
-fi
-touch "` + applyMarker + `"
-`
-	if err := os.WriteFile(nftPath, []byte(fake), 0o755); err != nil {
-		t.Fatalf("write fake nft: %v", err)
-	}
-
-	command := buildApplyCommand(nftPath, "table inet flvx { }")
-	result := exec.Command("sh", "-c", command)
-	if err := result.Run(); err == nil {
-		t.Fatal("expected validation failure")
-	}
-	if _, err := os.Stat(applyMarker); !os.IsNotExist(err) {
-		t.Fatalf("apply ran after validation failure, stat err=%v", err)
-	}
-	calls, err := os.ReadFile(logPath)
-	if err != nil {
-		t.Fatalf("read fake nft calls: %v", err)
-	}
-	if strings.Count(string(calls), "-f ") != 1 {
-		t.Fatalf("expected validation only, got calls:\n%s", calls)
-	}
-}
-
-func TestBuildCapabilityCheckCommandValidatesRenderedRulesWithoutApplying(t *testing.T) {
-	dir := t.TempDir()
-	logPath := filepath.Join(dir, "calls.log")
-	nftPath := filepath.Join(dir, "nft")
-	fake := `#!/bin/sh
-echo "$*" >> "` + logPath + `"
-if [ "$1" = "--version" ] || [ "$1" = "-c" ]; then
-  exit 0
-fi
-exit 1
-`
-	if err := os.WriteFile(nftPath, []byte(fake), 0o755); err != nil {
-		t.Fatalf("write fake nft: %v", err)
-	}
-
-	command := strings.Replace(buildCapabilityCheckCommand(nftPath, "flvx_capability_test"), "command -v nft", "command -v "+nftPath, 1)
-	result := exec.Command("sh", "-c", command)
-	if output, err := result.CombinedOutput(); err != nil {
-		t.Fatalf("capability command failed: %v: %s", err, output)
-	}
-	calls, err := os.ReadFile(logPath)
-	if err != nil {
-		t.Fatalf("read fake nft calls: %v", err)
-	}
-	if strings.Count(string(calls), "-c -f ") != 1 || strings.Contains(string(calls), "\n-f ") {
-		t.Fatalf("expected one check-only invocation, got calls:\n%s", calls)
-	}
-	if !strings.Contains(command, "table inet flvx_capability_test") || !strings.Contains(command, "meta l4proto tcp ct original proto-dst") {
-		t.Fatalf("capability check does not contain representative rendered rules:\n%s", command)
-	}
-}
-
-func TestBuildApplyCommandUsesAtomicReplacementBatch(t *testing.T) {
-	dir := t.TempDir()
-	batchPath := filepath.Join(dir, "batch.nft")
-	nftPath := filepath.Join(dir, "nft")
-	fake := `#!/bin/sh
-if [ "$1" = "list" ]; then
-  exit 0
-fi
-if [ "$1" = "-f" ]; then
-  cp "$2" "` + batchPath + `"
-fi
-exit 0
-`
-	if err := os.WriteFile(nftPath, []byte(fake), 0o755); err != nil {
-		t.Fatalf("write fake nft: %v", err)
-	}
-
-	script := "table inet flvx {\n  chain forward { }\n}"
-	result := exec.Command("sh", "-c", buildApplyCommand(nftPath, script))
-	if output, err := result.CombinedOutput(); err != nil {
-		t.Fatalf("apply command failed: %v: %s", err, output)
-	}
-	batch, err := os.ReadFile(batchPath)
-	if err != nil {
-		t.Fatalf("read applied batch: %v", err)
-	}
-	want := "delete table inet flvx\n" + script + "\n"
-	if string(batch) != want {
-		t.Fatalf("atomic batch = %q, want %q", batch, want)
-	}
-}
-
 func TestAuthMethodsDefaultToPrivateKey(t *testing.T) {
 	privateKey := mustGeneratePrivateKey(t)
 	methods, err := authMethods(SSHConfig{PrivateKey: privateKey})

go-backend/internal/store/repo/config_policy.go

@@ -14,30 +14,15 @@ var publicConfigKeys = map[string]struct{}{
 	"app_logo":            {},
 	"app_favicon":         {},
 	"app_bg_image":        {},
-	"app_bg_image_light":  {},
-	"app_bg_image_dark":   {},
 	"cloudflare_site_key": {},
-	"is_commercial":       {},
-	"hide_footer_brand":   {},
 }
 
 var sensitiveConfigKeys = map[string]struct{}{
 	"jwt_secret":            {},
 	"license_key":           {},
-	"license_expiry":        {},
-	"license_machine_id":    {},
-	"machine_fingerprint":   {},
 	"cloudflare_secret_key": {},
 }
 
-var systemManagedConfigKeys = map[string]struct{}{
-	"license_key":         {},
-	"license_expiry":      {},
-	"license_machine_id":  {},
-	"is_commercial":       {},
-	"machine_fingerprint": {},
-}
-
 func PolicyForConfig(name string) ConfigAccessPolicy {
 	if IsPublicConfigKey(name) {
 		return ConfigAccessPublic
@@ -58,11 +43,6 @@ func IsSensitiveConfigKey(name string) bool {
 	return ok
 }
 
-func IsSystemManagedConfigKey(name string) bool {
-	_, ok := systemManagedConfigKeys[normalizeConfigKey(name)]
-	return ok
-}
-
 func FilterSensitiveConfigs(in map[string]string) map[string]string {
 	if len(in) == 0 {
 		return map[string]string{}
@@ -77,20 +57,6 @@ func FilterSensitiveConfigs(in map[string]string) map[string]string {
 	return out
 }
 
-func FilterBackupConfigs(in map[string]string) map[string]string {
-	if len(in) == 0 {
-		return map[string]string{}
-	}
-	out := make(map[string]string, len(in))
-	for name, value := range in {
-		if IsSensitiveConfigKey(name) || IsSystemManagedConfigKey(name) {
-			continue
-		}
-		out[name] = value
-	}
-	return out
-}
-
 func normalizeConfigKey(name string) string {
 	return strings.ToLower(strings.TrimSpace(name))
 }

go-backend/internal/store/repo/config_policy_test.go

@@ -12,11 +12,7 @@ func TestConfigPolicy(t *testing.T) {
 		{name: "app_logo is public", key: "app_logo", want: ConfigAccessPublic},
 		{name: "app_favicon is public", key: "app_favicon", want: ConfigAccessPublic},
 		{name: "app_bg_image is public", key: "app_bg_image", want: ConfigAccessPublic},
-		{name: "app_bg_image_light is public", key: "app_bg_image_light", want: ConfigAccessPublic},
-		{name: "app_bg_image_dark is public", key: "app_bg_image_dark", want: ConfigAccessPublic},
 		{name: "cloudflare_site_key is public", key: "cloudflare_site_key", want: ConfigAccessPublic},
-		{name: "is_commercial is public", key: "is_commercial", want: ConfigAccessPublic},
-		{name: "hide_footer_brand is public", key: "hide_footer_brand", want: ConfigAccessPublic},
 		{name: "jwt_secret is sensitive", key: "jwt_secret", want: ConfigAccessSensitive},
 		{name: "license_key is sensitive", key: "license_key", want: ConfigAccessSensitive},
 		{name: "cloudflare_secret_key is sensitive", key: "cloudflare_secret_key", want: ConfigAccessSensitive},
@@ -33,14 +29,14 @@ func TestConfigPolicy(t *testing.T) {
 }
 
 func TestConfigPolicyHelpers(t *testing.T) {
-	publicKeys := []string{"app_name", "app_logo", "app_favicon", "app_bg_image", "app_bg_image_light", "app_bg_image_dark", "cloudflare_site_key", "is_commercial", "hide_footer_brand"}
+	publicKeys := []string{"app_name", "app_logo", "app_favicon", "app_bg_image", "cloudflare_site_key"}
 	for _, key := range publicKeys {
 		if !IsPublicConfigKey(key) {
 			t.Fatalf("expected %q to be public", key)
 		}
 	}
 
-	sensitiveKeys := []string{"jwt_secret", "license_key", "license_expiry", "license_machine_id", "machine_fingerprint", "cloudflare_secret_key"}
+	sensitiveKeys := []string{"jwt_secret", "license_key", "cloudflare_secret_key"}
 	for _, key := range sensitiveKeys {
 		if !IsSensitiveConfigKey(key) {
 			t.Fatalf("expected %q to be sensitive", key)
@@ -71,30 +67,3 @@ func TestConfigPolicyHelpers(t *testing.T) {
 		t.Fatal("expected cloudflare_secret_key to be filtered out")
 	}
 }
-
-func TestFilterBackupConfigsOmitsLicenseState(t *testing.T) {
-	filtered := FilterBackupConfigs(map[string]string{
-		"app_name":            "Brand",
-		"license_key":         "secret-license",
-		"license_expiry":      "never",
-		"license_machine_id":  "machine-id",
-		"is_commercial":       "true",
-		"machine_fingerprint": "fingerprint",
-	})
-	if len(filtered) != 1 || filtered["app_name"] != "Brand" {
-		t.Fatalf("unexpected backup configs: %+v", filtered)
-	}
-}
-
-func TestSystemManagedConfigKeys(t *testing.T) {
-	for _, key := range []string{"license_key", "license_expiry", "license_machine_id", "is_commercial", "machine_fingerprint"} {
-		if !IsSystemManagedConfigKey(key) {
-			t.Fatalf("expected %s to be system managed", key)
-		}
-	}
-	for _, key := range []string{"jwt_secret", "cloudflare_secret_key", "app_name"} {
-		if IsSystemManagedConfigKey(key) {
-			t.Fatalf("did not expect %s to be system managed", key)
-		}
-	}
-}

go-backend/internal/store/repo/repository.go

@@ -473,14 +473,6 @@ func seedData(db *gorm.DB) {
 
 	appNameConfig := model.ViteConfig{ID: 1, Name: "app_name", Value: "flux", Time: 1755147963000}
 	db.Where("id = ?", 1).FirstOrCreate(&appNameConfig)
-	now := time.Now().UnixMilli()
-	for name, value := range map[string]string{
-		"is_commercial":     "false",
-		"hide_footer_brand": "false",
-	} {
-		cfg := model.ViteConfig{Name: name, Value: value, Time: now}
-		db.Where("name = ?", name).FirstOrCreate(&cfg)
-	}
 }
 
 // ─── User Queries ────────────────────────────────────────────────────
@@ -608,23 +600,6 @@ func (r *Repository) UpsertConfig(name, value string, now int64) error {
 	}).Create(&model.ViteConfig{Name: name, Value: value, Time: now}).Error
 }
 
-func (r *Repository) UpsertConfigs(values map[string]string, now int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	return r.db.Transaction(func(tx *gorm.DB) error {
-		for name, value := range values {
-			if err := tx.Clauses(clause.OnConflict{
-				Columns:   []clause.Column{{Name: "name"}},
-				DoUpdates: clause.AssignmentColumns([]string{"value", "time"}),
-			}).Create(&model.ViteConfig{Name: name, Value: value, Time: now}).Error; err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-}
-
 // ─── Announcement Queries ────────────────────────────────────────────
 
 func (r *Repository) GetAnnouncement() (*model.Announcement, error) {
@@ -1992,7 +1967,7 @@ func (r *Repository) ExportAll() (*model.BackupData, error) {
 	if err != nil {
 		return nil, fmt.Errorf("export configs failed: %w", err)
 	}
-	backup.Configs = FilterBackupConfigs(configs)
+	backup.Configs = FilterSensitiveConfigs(configs)
 
 	return backup, nil
 }
@@ -2072,7 +2047,7 @@ func (r *Repository) ExportPartial(types []string) (*model.BackupData, error) {
 		if err != nil {
 			return nil, fmt.Errorf("export configs failed: %w", err)
 		}
-		backup.Configs = FilterBackupConfigs(v)
+		backup.Configs = FilterSensitiveConfigs(v)
 	}
 	return backup, nil
 }
@@ -2864,7 +2839,7 @@ func importPermissions(tx *gorm.DB, permissions []model.PermissionBackup, _ int6
 }
 
 func importConfigs(tx *gorm.DB, configs map[string]string, now int64) (int, error) {
-	configs = FilterBackupConfigs(configs)
+	configs = FilterSensitiveConfigs(configs)
 	count := 0
 	for name, value := range configs {
 		err := tx.Clauses(clause.OnConflict{

go-backend/internal/store/repo/repository_backup_test.go

@@ -97,10 +97,6 @@ func TestExportAllOmitsSensitiveConfigs(t *testing.T) {
 	seedConfig(t, r, "cloudflare_site_key", "site-key")
 	seedConfig(t, r, "jwt_secret", "jwt-secret")
 	seedConfig(t, r, "license_key", "license-secret")
-	seedConfig(t, r, "license_expiry", "2030-01-02T00:00:00.000Z")
-	seedConfig(t, r, "license_machine_id", "machine-id")
-	seedConfig(t, r, "is_commercial", "true")
-	seedConfig(t, r, "machine_fingerprint", "machine-fingerprint")
 	seedConfig(t, r, "cloudflare_secret_key", "cloudflare-secret")
 
 	for _, tc := range []struct {
@@ -121,7 +117,7 @@ func TestExportAllOmitsSensitiveConfigs(t *testing.T) {
 			if backup.Configs["cloudflare_site_key"] != "site-key" {
 				t.Fatalf("expected public config in export, got %+v", backup.Configs)
 			}
-			for _, key := range []string{"jwt_secret", "license_key", "license_expiry", "license_machine_id", "is_commercial", "machine_fingerprint", "cloudflare_secret_key"} {
+			for _, key := range []string{"jwt_secret", "license_key", "cloudflare_secret_key"} {
 				if _, ok := backup.Configs[key]; ok {
 					t.Fatalf("expected %s to be omitted from export, got %+v", key, backup.Configs)
 				}
@@ -140,20 +136,12 @@ func TestImportIgnoresSensitiveConfigs(t *testing.T) {
 	seedConfig(t, r, "app_name", "before")
 	seedConfig(t, r, "jwt_secret", "jwt-before")
 	seedConfig(t, r, "license_key", "license-before")
-	seedConfig(t, r, "license_expiry", "expiry-before")
-	seedConfig(t, r, "license_machine_id", "machine-before")
-	seedConfig(t, r, "is_commercial", "true")
-	seedConfig(t, r, "machine_fingerprint", "fingerprint-before")
 	seedConfig(t, r, "cloudflare_secret_key", "cloudflare-before")
 
 	backup := &model.BackupData{Configs: map[string]string{
 		"app_name":              "after",
 		"jwt_secret":            "jwt-after",
 		"license_key":           "license-after",
-		"license_expiry":        "expiry-after",
-		"license_machine_id":    "machine-after",
-		"is_commercial":         "false",
-		"machine_fingerprint":   "fingerprint-after",
 		"cloudflare_secret_key": "cloudflare-after",
 	}}
 
@@ -168,10 +156,6 @@ func TestImportIgnoresSensitiveConfigs(t *testing.T) {
 	assertConfigValue(t, r, "app_name", "after")
 	assertConfigValue(t, r, "jwt_secret", "jwt-before")
 	assertConfigValue(t, r, "license_key", "license-before")
-	assertConfigValue(t, r, "license_expiry", "expiry-before")
-	assertConfigValue(t, r, "license_machine_id", "machine-before")
-	assertConfigValue(t, r, "is_commercial", "true")
-	assertConfigValue(t, r, "machine_fingerprint", "fingerprint-before")
 	assertConfigValue(t, r, "cloudflare_secret_key", "cloudflare-before")
 }
 

go-gost/x/config/config.go

@@ -3,7 +3,6 @@ package config
 import (
 	"encoding/json"
 	"io"
-	"reflect"
 	"sync"
 	"time"
 
@@ -31,87 +30,9 @@ func Global() *Config {
 	globalMux.RLock()
 	defer globalMux.RUnlock()
 
-	return cloneConfig(global)
-}
-
-// cloneConfig returns a detached snapshot of the runtime config. Runtime
-// commands mutate slices, pointers and metadata maps, so a shallow struct copy
-// is not sufficient once readers and persistence run concurrently.
-func cloneConfig(c *Config) *Config {
-	if c == nil {
-		return nil
-	}
-	v := cloneConfigValue(reflect.ValueOf(c))
-	if !v.IsValid() || v.IsNil() {
-		return nil
-	}
-	return v.Interface().(*Config)
-}
-
-func cloneConfigValue(v reflect.Value) reflect.Value {
-	if !v.IsValid() {
-		return reflect.Value{}
-	}
-
-	switch v.Kind() {
-	case reflect.Interface:
-		if v.IsNil() {
-			return reflect.Zero(v.Type())
-		}
-		cloned := cloneConfigValue(v.Elem())
-		out := reflect.New(v.Type()).Elem()
-		if cloned.IsValid() && cloned.Type().AssignableTo(v.Type()) {
-			out.Set(cloned)
-		} else if cloned.IsValid() && cloned.Type().Implements(v.Type()) {
-			out.Set(cloned)
-		} else if cloned.IsValid() {
-			out.Set(cloned)
-		}
-		return out
-	case reflect.Pointer:
-		if v.IsNil() {
-			return reflect.Zero(v.Type())
-		}
-		out := reflect.New(v.Type().Elem())
-		out.Elem().Set(cloneConfigValue(v.Elem()))
-		return out
-	case reflect.Map:
-		if v.IsNil() {
-			return reflect.Zero(v.Type())
-		}
-		out := reflect.MakeMapWithSize(v.Type(), v.Len())
-		iter := v.MapRange()
-		for iter.Next() {
-			out.SetMapIndex(cloneConfigValue(iter.Key()), cloneConfigValue(iter.Value()))
-		}
-		return out
-	case reflect.Slice:
-		if v.IsNil() {
-			return reflect.Zero(v.Type())
-		}
-		out := reflect.MakeSlice(v.Type(), v.Len(), v.Len())
-		for i := 0; i < v.Len(); i++ {
-			out.Index(i).Set(cloneConfigValue(v.Index(i)))
-		}
-		return out
-	case reflect.Array:
-		out := reflect.New(v.Type()).Elem()
-		for i := 0; i < v.Len(); i++ {
-			out.Index(i).Set(cloneConfigValue(v.Index(i)))
-		}
-		return out
-	case reflect.Struct:
-		out := reflect.New(v.Type()).Elem()
-		out.Set(v)
-		for i := 0; i < v.NumField(); i++ {
-			if out.Field(i).CanSet() && v.Field(i).CanInterface() {
-				out.Field(i).Set(cloneConfigValue(v.Field(i)))
-			}
-		}
-		return out
-	default:
-		return v
-	}
+	cfg := &Config{}
+	*cfg = *global
+	return cfg
 }
 
 func Set(c *Config) {

go-gost/x/config/config_concurrency_test.go

@@ -1,121 +0,0 @@
-package config
-
-import (
-	"encoding/json"
-	"path/filepath"
-	"sync"
-	"testing"
-)
-
-func TestGlobalReturnsDetachedSnapshot(t *testing.T) {
-	original := Global()
-	t.Cleanup(func() { Set(original) })
-
-	Set(&Config{Services: []*ServiceConfig{{
-		Name:     "snapshot-service",
-		Metadata: map[string]any{"paused": false},
-		Handler: &HandlerConfig{
-			Type:     "relay",
-			Metadata: map[string]any{"retries": 2},
-		},
-	}}})
-
-	snapshot := Global()
-	snapshot.Services[0].Name = "changed"
-	snapshot.Services[0].Metadata["paused"] = true
-	snapshot.Services[0].Handler.Metadata["retries"] = 9
-
-	current := Global()
-	if current.Services[0].Name != "snapshot-service" {
-		t.Fatalf("snapshot mutated global service name: %q", current.Services[0].Name)
-	}
-	if paused, _ := current.Services[0].Metadata["paused"].(bool); paused {
-		t.Fatalf("snapshot mutated global service metadata")
-	}
-	if retries, _ := current.Services[0].Handler.Metadata["retries"].(int); retries != 2 {
-		t.Fatalf("snapshot mutated nested handler metadata: %v", current.Services[0].Handler.Metadata["retries"])
-	}
-}
-
-func TestConcurrentGlobalSnapshotAndUpdate(t *testing.T) {
-	original := Global()
-	t.Cleanup(func() { Set(original) })
-
-	Set(&Config{Services: []*ServiceConfig{{
-		Name:     "concurrent-service",
-		Metadata: map[string]any{"generation": 0},
-	}}})
-
-	var wg sync.WaitGroup
-	for worker := 0; worker < 4; worker++ {
-		wg.Add(1)
-		go func(worker int) {
-			defer wg.Done()
-			for i := 0; i < 500; i++ {
-				if err := OnUpdate(func(c *Config) error {
-					c.Services[0] = &ServiceConfig{
-						Name:     "concurrent-service",
-						Metadata: map[string]any{"generation": worker*500 + i},
-					}
-					return nil
-				}); err != nil {
-					t.Errorf("OnUpdate: %v", err)
-					return
-				}
-			}
-		}(worker)
-	}
-
-	for i := 0; i < 2000; i++ {
-		if _, err := json.Marshal(Global()); err != nil {
-			t.Fatalf("marshal snapshot: %v", err)
-		}
-	}
-	wg.Wait()
-}
-
-func TestConcurrentPersistProducesValidConfig(t *testing.T) {
-	original := Global()
-	originalPath := PersistPath()
-	persistMu.Lock()
-	originalEnabled := persistEnable
-	persistMu.Unlock()
-	t.Cleanup(func() {
-		Set(original)
-		SetPersistPath(originalPath)
-		persistMu.Lock()
-		persistEnable = originalEnabled
-		persistMu.Unlock()
-	})
-
-	path := filepath.Join(t.TempDir(), "gost.json")
-	SetPersistPath(path)
-	EnablePersist()
-	Set(&Config{Services: []*ServiceConfig{{Name: "persist-service"}}})
-
-	var wg sync.WaitGroup
-	for worker := 0; worker < 4; worker++ {
-		wg.Add(1)
-		go func(worker int) {
-			defer wg.Done()
-			for i := 0; i < 50; i++ {
-				if err := OnUpdate(func(c *Config) error {
-					c.Services[0].Metadata = map[string]any{"generation": worker*50 + i}
-					return nil
-				}); err != nil {
-					t.Errorf("persist update: %v", err)
-					return
-				}
-			}
-		}(worker)
-	}
-	wg.Wait()
-
-	var persisted Config
-	if err := persisted.ReadFile(path); err != nil {
-		t.Fatalf("read persisted config: %v", err)
-	}
-	if len(persisted.Services) != 1 || persisted.Services[0] == nil || persisted.Services[0].Name != "persist-service" {
-		t.Fatalf("unexpected persisted services: %#v", persisted.Services)
-	}
-}

go-gost/x/config/persist.go

@@ -42,9 +42,9 @@ func EnablePersist() {
 // persist writes the current global config to the configured file atomically.
 func persist() error {
 	persistMu.Lock()
-	defer persistMu.Unlock()
 	path := persistPath
 	enabled := persistEnable
+	persistMu.Unlock()
 
 	if !enabled || path == "" {
 		return nil

go-gost/x/socket/command_dispatch_test.go

@@ -1,117 +0,0 @@
-package socket
-
-import (
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	coreservice "github.com/go-gost/core/service"
-	"github.com/go-gost/x/config"
-	"github.com/go-gost/x/registry"
-)
-
-type blockingCommandService struct {
-	started     chan struct{}
-	release     chan struct{}
-	startedOnce sync.Once
-}
-
-func (s *blockingCommandService) Serve() error   { return nil }
-func (s *blockingCommandService) Addr() net.Addr { return nil }
-func (s *blockingCommandService) Close() error {
-	s.startedOnce.Do(func() { close(s.started) })
-	<-s.release
-	return nil
-}
-
-func TestMutationCommandsAreSerialized(t *testing.T) {
-	mutations := []string{
-		"AddService", "UpdateService", "DeleteService", "PauseService", "ResumeService",
-		"AddChains", "UpdateChains", "DeleteChains",
-		"AddLimiters", "UpdateLimiters", "DeleteLimiters",
-		"AddCLimiters", "UpdateCLimiters", "DeleteCLimiters",
-		"SetProtocol", "UpgradeAgent", "RollbackAgent", "reload",
-	}
-	for _, command := range mutations {
-		if !isMutationCommand(command) {
-			t.Fatalf("expected %s to use the serialized mutation queue", command)
-		}
-	}
-}
-
-func TestReadOnlyCommandsRemainBoundedAsync(t *testing.T) {
-	for _, command := range []string{"TcpPing", "UdpPing", "ServiceMonitorCheck"} {
-		if isMutationCommand(command) {
-			t.Fatalf("expected %s to remain a read-only command", command)
-		}
-	}
-}
-
-func TestCommandResponseTypePreservesRequestContract(t *testing.T) {
-	if got := commandResponseType("UpdateService"); got != "UpdateServiceResponse" {
-		t.Fatalf("unexpected response type: %s", got)
-	}
-	if got := commandResponseType(""); got != "UnknownCommandResponse" {
-		t.Fatalf("unexpected empty command response type: %s", got)
-	}
-}
-
-func TestMutationQueueExecutesCommandsInArrivalOrder(t *testing.T) {
-	originalConfig := config.Global()
-	t.Cleanup(func() { config.Set(originalConfig) })
-
-	firstName := "mutation_queue_first_tdd"
-	secondName := "mutation_queue_second_tdd"
-	first := &blockingCommandService{started: make(chan struct{}), release: make(chan struct{})}
-	second := &blockingCommandService{started: make(chan struct{}), release: make(chan struct{})}
-	for _, name := range []string{firstName, secondName} {
-		registry.ServiceRegistry().Unregister(name)
-	}
-	t.Cleanup(func() {
-		select {
-		case <-first.release:
-		default:
-			close(first.release)
-		}
-		select {
-		case <-second.release:
-		default:
-			close(second.release)
-		}
-		registry.ServiceRegistry().Unregister(firstName)
-		registry.ServiceRegistry().Unregister(secondName)
-	})
-	if err := registry.ServiceRegistry().Register(firstName, coreservice.Service(first)); err != nil {
-		t.Fatalf("register first service: %v", err)
-	}
-	if err := registry.ServiceRegistry().Register(secondName, coreservice.Service(second)); err != nil {
-		t.Fatalf("register second service: %v", err)
-	}
-	config.Set(&config.Config{Services: []*config.ServiceConfig{{Name: firstName}, {Name: secondName}}})
-
-	reporter := NewWebSocketReporter("", "mutation-queue-test-secret")
-	go reporter.runMutationCommands()
-	t.Cleanup(reporter.Stop)
-	reporter.dispatchCommand(CommandMessage{Type: "DeleteService", Data: map[string]any{"services": []string{firstName}}})
-	reporter.dispatchCommand(CommandMessage{Type: "DeleteService", Data: map[string]any{"services": []string{secondName}}})
-
-	select {
-	case <-first.started:
-	case <-time.After(time.Second):
-		t.Fatal("first mutation did not start")
-	}
-	select {
-	case <-second.started:
-		t.Fatal("second mutation started before first mutation completed")
-	case <-time.After(100 * time.Millisecond):
-	}
-
-	close(first.release)
-	select {
-	case <-second.started:
-	case <-time.After(time.Second):
-		t.Fatal("second mutation did not start after first mutation completed")
-	}
-	close(second.release)
-}

go-gost/x/socket/service.go

@@ -15,11 +15,6 @@ import (
 	xservice "github.com/go-gost/x/service"
 )
 
-type serviceReplacement struct {
-	config    config.ServiceConfig
-	oldConfig *config.ServiceConfig
-}
-
 func createServices(req createServicesRequest) error {
 
 	if len(req.Data) == 0 {
@@ -100,11 +95,11 @@ func updateServices(req updateServicesRequest) error {
 		req.Data[i].Name = name
 	}
 
-	// 第二阶段：逐个更新服务（Upsert模式：存在则更新，不存在则创建）。
-	// 配置变更命令由 WebSocket reporter 串行调度，但这里仍保留完整回滚，
-	// 避免新配置解析或监听失败后旧服务永久消失。
-	originalConfig := config.Global()
-	changedServices := make([]serviceReplacement, 0, len(req.Data))
+	// 第二阶段：逐个更新服务（Upsert模式：存在则更新，不存在则创建）
+	changedServices := make([]struct {
+		config  config.ServiceConfig
+		service service.Service
+	}, 0, len(req.Data))
 	for i := range req.Data {
 		serviceConfig := &req.Data[i]
 		name := serviceConfig.Name
@@ -112,48 +107,33 @@ func updateServices(req updateServicesRequest) error {
 			continue
 		}
 
-		var oldConfig *config.ServiceConfig
-		if originalConfig != nil {
-			for _, current := range originalConfig.Services {
-				if current != nil && strings.TrimSpace(current.Name) == name {
-					oldConfig = current
-					break
-				}
-			}
-		}
+		// 1. 获取旧服务
+		old := registry.ServiceRegistry().Get(name)
 
-		// 1. 关闭并移除旧服务（如果存在）。同名监听必须先释放端口，
-		// 才能创建新 listener。
-		if registry.ServiceRegistry().Get(name) != nil {
+		// 2. 关闭旧服务 (如果存在)
+		if old != nil {
+			// 3. 从注册表移除旧服务；registry 会负责关闭旧服务。
 			registry.ServiceRegistry().Unregister(name)
 		}
 
-		// 2. 解析新服务配置。
+		// 4. 解析新服务配置
 		svc, err := parser.ParseService(serviceConfig)
 		if err != nil {
-			rollbackErr := restoreServiceRuntime(name, oldConfig)
-			rollbackErr = errors.Join(rollbackErr, rollbackServiceReplacements(changedServices))
-			if rollbackErr != nil {
-				return fmt.Errorf("create service %s failed: %v; restore previous service failed: %w", name, err, rollbackErr)
-			}
 			return errors.New("create service " + name + " failed: " + err.Error())
 		}
+		changedServices = append(changedServices, struct {
+			config  config.ServiceConfig
+			service service.Service
+		}{*serviceConfig, svc})
 
-		// 3. 注册并启动新服务。
+		// 5. 注册新服务
 		if err := registry.ServiceRegistry().Register(name, svc); err != nil {
 			svc.Close()
-			rollbackErr := restoreServiceRuntime(name, oldConfig)
-			rollbackErr = errors.Join(rollbackErr, rollbackServiceReplacements(changedServices))
-			if rollbackErr != nil {
-				return fmt.Errorf("service %s already exists; restore previous service failed: %w", name, rollbackErr)
-			}
 			return errors.New("service " + name + " already exists")
 		}
+
+		// 6. 启动新服务
 		go svc.Serve()
-		changedServices = append(changedServices, serviceReplacement{
-			config:    *serviceConfig,
-			oldConfig: oldConfig,
-		})
 	}
 	if len(changedServices) == 0 {
 		return nil
@@ -178,56 +158,12 @@ func updateServices(req updateServicesRequest) error {
 		}
 		return nil
 	}); err != nil {
-		config.Set(originalConfig)
-		if rollbackErr := rollbackServiceReplacements(changedServices); rollbackErr != nil {
-			return fmt.Errorf("%w; restore previous services failed: %v", err, rollbackErr)
-		}
 		return err
 	}
 
 	return nil
 }
 
-func restoreServiceRuntime(name string, serviceConfig *config.ServiceConfig) error {
-	name = strings.TrimSpace(name)
-	if name == "" || serviceConfig == nil {
-		return nil
-	}
-	if registry.ServiceRegistry().Get(name) != nil {
-		registry.ServiceRegistry().Unregister(name)
-	}
-
-	cfgCopy := *serviceConfig
-	cfgCopy.Name = name
-	svc, err := parser.ParseService(&cfgCopy)
-	if err != nil {
-		return err
-	}
-	if err := registry.ServiceRegistry().Register(name, svc); err != nil {
-		svc.Close()
-		return err
-	}
-	go svc.Serve()
-	return nil
-}
-
-func rollbackServiceReplacements(replacements []serviceReplacement) error {
-	var rollbackErr error
-	for i := len(replacements) - 1; i >= 0; i-- {
-		name := strings.TrimSpace(replacements[i].config.Name)
-		if name == "" {
-			continue
-		}
-		if registry.ServiceRegistry().Get(name) != nil {
-			registry.ServiceRegistry().Unregister(name)
-		}
-		if err := restoreServiceRuntime(name, replacements[i].oldConfig); err != nil {
-			rollbackErr = errors.Join(rollbackErr, fmt.Errorf("restore service %s: %w", name, err))
-		}
-	}
-	return rollbackErr
-}
-
 func serviceConfigUnchanged(name string, next config.ServiceConfig) bool {
 	cfg := config.Global()
 	if cfg == nil {

go-gost/x/socket/service_test.go

@@ -7,8 +7,6 @@ import (
 	corelogger "github.com/go-gost/core/logger"
 	"github.com/go-gost/core/service"
 	"github.com/go-gost/x/config"
-	_ "github.com/go-gost/x/handler/auto"
-	_ "github.com/go-gost/x/listener/tcp"
 	xlogger "github.com/go-gost/x/logger"
 	"github.com/go-gost/x/registry"
 )
@@ -17,43 +15,6 @@ type recordingService struct {
 	closed int
 }
 
-func TestUpdateServicesParseFailureRestoresPreviousRuntime(t *testing.T) {
-	corelogger.SetDefault(xlogger.Nop())
-
-	name := "restore_after_failed_update_tdd"
-	existing := &recordingService{}
-	registry.ServiceRegistry().Unregister(name)
-	t.Cleanup(func() { registry.ServiceRegistry().Unregister(name) })
-	if err := registry.ServiceRegistry().Register(name, service.Service(existing)); err != nil {
-		t.Fatalf("register existing service: %v", err)
-	}
-
-	originalConfig := config.Global()
-	t.Cleanup(func() { config.Set(originalConfig) })
-	serviceConfig := config.ServiceConfig{Name: name, Addr: "127.0.0.1:0"}
-	config.Set(&config.Config{Services: []*config.ServiceConfig{&serviceConfig}})
-
-	invalid := serviceConfig
-	invalid.Listener = &config.ListenerConfig{Type: "listener-does-not-exist"}
-	if err := updateServices(updateServicesRequest{Data: []config.ServiceConfig{invalid}}); err == nil {
-		t.Fatalf("expected invalid service update to fail")
-	}
-	if existing.closed != 1 {
-		t.Fatalf("expected old runtime to be closed once, got %d", existing.closed)
-	}
-	if registry.ServiceRegistry().Get(name) == nil {
-		t.Fatalf("expected previous runtime to be restored")
-	}
-
-	cfg := config.Global()
-	if len(cfg.Services) != 1 || cfg.Services[0] == nil || cfg.Services[0].Name != name {
-		t.Fatalf("expected previous config to remain, got %#v", cfg.Services)
-	}
-	if cfg.Services[0].Listener != nil {
-		t.Fatalf("expected previous listener config to remain unchanged")
-	}
-}
-
 func (s *recordingService) Serve() error   { return nil }
 func (s *recordingService) Addr() net.Addr { return nil }
 func (s *recordingService) Close() error {

go-gost/x/socket/websocket_reporter.go

@@ -16,7 +16,6 @@ import (
 	"os"
 	"os/exec"
 	"runtime"
-	"runtime/debug"
 	"strconv"
 	"strings"
 	"sync"
@@ -153,8 +152,6 @@ const (
 	maxBackoff                  = 2 * time.Minute  // 重连最大退避
 	defaultMetricReportInterval = 5 * time.Second
 	maxConcurrentTCPPings       = 8
-	maxConcurrentReadCommands   = 16
-	maxQueuedMutationCommands   = 256
 )
 
 type WebSocketReporter struct {
@@ -177,8 +174,6 @@ type WebSocketReporter struct {
 	connMutex         sync.Mutex        // 连接状态锁
 	aesCrypto         *crypto.AESCrypto // AES加密器
 	tcpPingSem        chan struct{}     // 限制诊断探测并发，避免离线目标耗尽连接
-	readCommandSem    chan struct{}     // 限制只读命令并发，避免诊断请求耗尽资源
-	mutationQueue     chan CommandMessage
 }
 
 var wsDial = func(dialer *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
@@ -209,8 +204,6 @@ func NewWebSocketReporter(serverURL string, secret string) *WebSocketReporter {
 		connecting:     false,
 		aesCrypto:      aesCrypto,
 		tcpPingSem:     make(chan struct{}, maxConcurrentTCPPings),
-		readCommandSem: make(chan struct{}, maxConcurrentReadCommands),
-		mutationQueue:  make(chan CommandMessage, maxQueuedMutationCommands),
 	}
 }
 
@@ -238,7 +231,6 @@ func (w *WebSocketReporter) releaseTCPPingSlot() {
 
 // Start 启动WebSocket报告器
 func (w *WebSocketReporter) Start() {
-	go w.runMutationCommands()
 	go w.run()
 }
 
@@ -785,7 +777,8 @@ func (w *WebSocketReporter) handleReceivedMessage(messageType int, message []byt
 			}
 
 			if cmdMsg.Type != "call" {
-				w.dispatchCommand(cmdMsg)
+				// 所有命令统一异步执行，避免阻塞消息接收循环
+				go w.routeCommand(cmdMsg)
 			}
 		} else {
 			// 处理普通消息
@@ -796,7 +789,8 @@ func (w *WebSocketReporter) handleReceivedMessage(messageType int, message []byt
 				return
 			}
 			if cmdMsg.Type != "call" {
-				w.dispatchCommand(cmdMsg)
+				// 所有命令统一异步执行，避免阻塞消息接收循环
+				go w.routeCommand(cmdMsg)
 			}
 		}
 
@@ -805,86 +799,6 @@ func (w *WebSocketReporter) handleReceivedMessage(messageType int, message []byt
 	}
 }
 
-// dispatchCommand keeps all runtime mutations ordered while allowing bounded
-// concurrency for read-only diagnostics. Mutations share process-wide
-// registries and configuration, so running them concurrently can corrupt the
-// persisted config or interleave service lifecycle operations.
-func (w *WebSocketReporter) dispatchCommand(cmd CommandMessage) {
-	if isMutationCommand(cmd.Type) {
-		select {
-		case w.mutationQueue <- cmd:
-		case <-w.ctx.Done():
-			w.sendCommandFailure(cmd, "Agent is shutting down")
-		default:
-			w.sendCommandFailure(cmd, "运行时配置命令队列已满，请稍后重试")
-		}
-		return
-	}
-
-	select {
-	case w.readCommandSem <- struct{}{}:
-		go func() {
-			defer func() { <-w.readCommandSem }()
-			w.routeCommandSafely(cmd)
-		}()
-	case <-w.ctx.Done():
-		w.sendCommandFailure(cmd, "Agent is shutting down")
-	default:
-		w.sendCommandFailure(cmd, "只读命令并发过多，请稍后重试")
-	}
-}
-
-func (w *WebSocketReporter) runMutationCommands() {
-	for {
-		select {
-		case <-w.ctx.Done():
-			return
-		case cmd := <-w.mutationQueue:
-			w.routeCommandSafely(cmd)
-		}
-	}
-}
-
-func (w *WebSocketReporter) routeCommandSafely(cmd CommandMessage) {
-	defer func() {
-		if recovered := recover(); recovered != nil {
-			fmt.Printf("❌ 命令处理 panic: type=%s panic=%v\n%s", cmd.Type, recovered, debug.Stack())
-			w.sendCommandFailure(cmd, fmt.Sprintf("命令处理异常: %v", recovered))
-		}
-	}()
-	w.routeCommand(cmd)
-}
-
-func (w *WebSocketReporter) sendCommandFailure(cmd CommandMessage, message string) {
-	w.sendResponse(CommandResponse{
-		Type:      commandResponseType(cmd.Type),
-		Success:   false,
-		Message:   message,
-		RequestId: cmd.RequestId,
-	})
-}
-
-func commandResponseType(commandType string) string {
-	commandType = strings.TrimSpace(commandType)
-	if commandType == "" {
-		return "UnknownCommandResponse"
-	}
-	return commandType + "Response"
-}
-
-func isMutationCommand(commandType string) bool {
-	switch strings.ToLower(strings.TrimSpace(commandType)) {
-	case "addservice", "updateservice", "deleteservice", "pauseservice", "resumeservice",
-		"addchains", "updatechains", "deletechains",
-		"addlimiters", "updatelimiters", "deletelimiters",
-		"addclimiters", "updateclimiters", "deleteclimiters",
-		"setprotocol", "upgradeagent", "rollbackagent", "reload":
-		return true
-	default:
-		return false
-	}
-}
-
 // routeCommand 路由命令到对应的处理函数
 func (w *WebSocketReporter) routeCommand(cmd CommandMessage) {
 	jsonBytes, errs := json.Marshal(cmd)

install.sh

@@ -405,7 +405,6 @@ After=network.target
 [Service]
 WorkingDirectory=$INSTALL_DIR
 ExecStart=$INSTALL_DIR/flux_agent
-Environment=GODEBUG=disablethp=1
 Restart=on-failure
 StandardOutput=null
 StandardError=null

panel_install.sh

@@ -16,9 +16,6 @@ PINNED_VERSION=""
 # 镜像加速配置（可由面板传入或交互式询问）
 PROXY_ENABLED="${PROXY_ENABLED:-}"
 PROXY_URL="${PROXY_URL:-}"
-DEFAULT_PANEL_BACKEND_CONTAINER="flux-panel-backend"
-DEFAULT_PANEL_POSTGRES_CONTAINER="flux-panel-postgres"
-PANEL_SCRIPT_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")"
 
 # 镜像加速
 maybe_proxy_url() {
@@ -307,8 +304,8 @@ get_env_var() {
 get_current_db_type() {
   local db_type database_url
 
-  db_type=$(get_env_var "DB_TYPE" || true)
-  database_url=$(get_env_var "DATABASE_URL" || true)
+  db_type=$(get_env_var "DB_TYPE")
+  database_url=$(get_env_var "DATABASE_URL")
 
   if [[ "$db_type" == "sqlite" ]]; then
     echo "sqlite"
@@ -319,289 +316,13 @@ get_current_db_type() {
   fi
 }
 
-get_container_compose_label() {
-  local container="$1"
-  local label="$2"
-  local value
-
-  value=$(docker inspect -f "{{ index .Config.Labels \"$label\" }}" "$container" 2>/dev/null || true)
-  if [[ "$value" == "<no value>" ]]; then
-    value=""
-  fi
-  printf '%s' "$value"
-}
-
-resolve_panel_deployment() {
-  local backend_container="${PANEL_BACKEND_CONTAINER:-$DEFAULT_PANEL_BACKEND_CONTAINER}"
-  local requested_dir="${PANEL_DEPLOY_DIR:-}"
-  local label_dir label_project deploy_dir project_name
-
-  label_dir=$(get_container_compose_label "$backend_container" "com.docker.compose.project.working_dir")
-  label_project=$(get_container_compose_label "$backend_container" "com.docker.compose.project")
-
-  if [[ -n "$requested_dir" ]]; then
-    deploy_dir="$requested_dir"
-  elif [[ -n "$label_dir" ]]; then
-    deploy_dir="$label_dir"
-  elif [[ -f ".env" && -f "docker-compose.yml" ]]; then
-    deploy_dir=$(pwd -P)
-  else
-    echo "❌ 无法识别面板部署目录：未找到容器 Compose 标签，当前目录也没有完整部署配置"
-    return 1
-  fi
-
-  if [[ ! -d "$deploy_dir" ]]; then
-    echo "❌ 面板部署目录不存在：$deploy_dir"
-    return 1
-  fi
-  deploy_dir=$(cd "$deploy_dir" && pwd -P)
-  if [[ -n "$label_dir" && -d "$label_dir" ]]; then
-    label_dir=$(cd "$label_dir" && pwd -P)
-  fi
-  if [[ -n "$requested_dir" && -n "$label_dir" && "$deploy_dir" != "$label_dir" ]]; then
-    echo "❌ 指定部署目录与运行中容器标签不一致：$deploy_dir != $label_dir"
-    return 1
-  fi
-
-  project_name="${COMPOSE_PROJECT_NAME:-}"
-  if [[ -z "$project_name" && -n "$label_project" ]]; then
-    project_name="$label_project"
-  fi
-  if [[ -n "$project_name" && ! "$project_name" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then
-    echo "❌ Compose 项目名不合法：$project_name"
-    return 1
-  fi
-
-  PANEL_DEPLOY_DIR="$deploy_dir"
-  PANEL_BACKEND_CONTAINER="$backend_container"
-  PANEL_POSTGRES_CONTAINER="${PANEL_POSTGRES_CONTAINER:-$DEFAULT_PANEL_POSTGRES_CONTAINER}"
-  PANEL_COMPOSE_PROJECT="$project_name"
-  export PANEL_DEPLOY_DIR PANEL_BACKEND_CONTAINER PANEL_POSTGRES_CONTAINER PANEL_COMPOSE_PROJECT
-  if [[ -n "$project_name" ]]; then
-    COMPOSE_PROJECT_NAME="$project_name"
-    export COMPOSE_PROJECT_NAME
-  fi
-
-  cd "$PANEL_DEPLOY_DIR"
-  echo "📁 部署目录：$PANEL_DEPLOY_DIR"
-  if [[ -n "$PANEL_COMPOSE_PROJECT" ]]; then
-    echo "📦 Compose 项目：$PANEL_COMPOSE_PROJECT"
-  fi
-}
-
-run_panel_compose() {
-  $DOCKER_CMD "$@"
-}
-
-validate_panel_update_environment() {
-  local key value backend_port frontend_port configured_db_type db_type database_url postgres_password
-
-  if [[ ! -f ".env" ]]; then
-    echo "❌ 部署目录缺少 .env，更新终止"
-    return 1
-  fi
-  if [[ ! -f "docker-compose.yml" ]]; then
-    echo "❌ 部署目录缺少 docker-compose.yml，更新终止"
-    return 1
-  fi
-
-  for key in JWT_SECRET BACKEND_PORT FRONTEND_PORT; do
-    value=$(get_env_var "$key" || true)
-    if [[ -z "${value//[[:space:]]/}" ]]; then
-      echo "❌ .env 中 $key 缺失或为空，更新终止"
-      return 1
-    fi
-  done
-
-  backend_port=$(get_env_var "BACKEND_PORT" || true)
-  frontend_port=$(get_env_var "FRONTEND_PORT" || true)
-  if [[ ! "$backend_port" =~ ^[0-9]+$ || "$backend_port" -lt 1 || "$backend_port" -gt 65535 ]]; then
-    echo "❌ BACKEND_PORT 不是有效端口：$backend_port"
-    return 1
-  fi
-  if [[ ! "$frontend_port" =~ ^[0-9]+$ || "$frontend_port" -lt 1 || "$frontend_port" -gt 65535 ]]; then
-    echo "❌ FRONTEND_PORT 不是有效端口：$frontend_port"
-    return 1
-  fi
-
-  configured_db_type=$(get_env_var "DB_TYPE" || true)
-  if [[ -n "$configured_db_type" && "$configured_db_type" != "sqlite" && "$configured_db_type" != "postgres" ]]; then
-    echo "❌ DB_TYPE 仅支持 sqlite 或 postgres：$configured_db_type"
-    return 1
-  fi
-  db_type=$(get_current_db_type)
-  if [[ "$db_type" == "postgres" ]]; then
-    database_url=$(get_env_var "DATABASE_URL" || true)
-    postgres_password=$(get_env_var "POSTGRES_PASSWORD" || true)
-    if [[ -z "${database_url//[[:space:]]/}" || -z "${postgres_password//[[:space:]]/}" ]]; then
-      echo "❌ PostgreSQL 模式要求 DATABASE_URL 和 POSTGRES_PASSWORD 均非空"
-      return 1
-    fi
-  fi
-
-  if ! run_panel_compose -f docker-compose.yml config -q; then
-    echo "❌ 当前 Compose 配置校验失败，更新终止"
-    return 1
-  fi
-}
-
-download_panel_update_compose() {
-  local compose_url="$1"
-
-  UPDATE_COMPOSE_CANDIDATE=$(mktemp "$PANEL_DEPLOY_DIR/.docker-compose.yml.update.XXXXXX")
-  if ! curl -fL -o "$UPDATE_COMPOSE_CANDIDATE" "$compose_url"; then
-    rm -f "$UPDATE_COMPOSE_CANDIDATE"
-    UPDATE_COMPOSE_CANDIDATE=""
-    echo "❌ 下载最新 Compose 配置失败，更新终止"
-    return 1
-  fi
-  if [[ ! -s "$UPDATE_COMPOSE_CANDIDATE" ]]; then
-    rm -f "$UPDATE_COMPOSE_CANDIDATE"
-    UPDATE_COMPOSE_CANDIDATE=""
-    echo "❌ 下载的 Compose 配置为空，更新终止"
-    return 1
-  fi
-}
-
-validate_panel_update_compose() {
-  if ! FLUX_VERSION="$LATEST_VERSION" run_panel_compose -f "$UPDATE_COMPOSE_CANDIDATE" config -q; then
-    echo "❌ 新 Compose 配置校验失败，更新终止"
-    return 1
-  fi
-}
-
-backup_sqlite_for_update() (
-  local destination="$1"
-  local running paused="false"
-
-  cleanup_paused_backend() {
-    if [[ "$paused" == "true" ]]; then
-      docker unpause "$PANEL_BACKEND_CONTAINER" >/dev/null 2>&1 || true
-    fi
-  }
-  trap cleanup_paused_backend EXIT
-
-  running=$(docker inspect -f '{{.State.Running}}' "$PANEL_BACKEND_CONTAINER" 2>/dev/null || true)
-  if [[ "$running" == "true" ]]; then
-    if ! docker pause "$PANEL_BACKEND_CONTAINER" >/dev/null; then
-      echo "❌ 暂停后端以创建一致性 SQLite 备份失败"
-      return 1
-    fi
-    paused="true"
-  fi
-
-  mkdir -p "$destination"
-  if ! docker cp "$PANEL_BACKEND_CONTAINER:/app/data/." "$destination"; then
-    echo "❌ SQLite 数据备份失败"
-    return 1
-  fi
-
-  if [[ "$paused" == "true" ]] && ! docker unpause "$PANEL_BACKEND_CONTAINER" >/dev/null; then
-    echo "❌ SQLite 备份完成，但恢复后端运行失败"
-    return 1
-  fi
-  paused="false"
-)
-
-backup_postgres_for_update() {
-  local destination="$1"
-  local postgres_db postgres_user
-
-  postgres_db=$(get_env_var "POSTGRES_DB" || true)
-  postgres_user=$(get_env_var "POSTGRES_USER" || true)
-  postgres_db=${postgres_db:-flux_panel}
-  postgres_user=${postgres_user:-flux_panel}
-
-  if ! docker exec "$PANEL_POSTGRES_CONTAINER" pg_dump -U "$postgres_user" "$postgres_db" > "$destination"; then
-    rm -f "$destination"
-    echo "❌ PostgreSQL 数据备份失败"
-    return 1
-  fi
-}
-
-create_panel_update_backup() {
-  local db_type="$1"
-  local timestamp
-
-  timestamp=$(date '+%Y%m%d-%H%M%S')
-  if ! (umask 077 && mkdir -p "$PANEL_DEPLOY_DIR/backups"); then
-    echo "❌ 创建更新备份目录失败"
-    return 1
-  fi
-  UPDATE_BACKUP_DIR=$(umask 077 && mktemp -d "$PANEL_DEPLOY_DIR/backups/panel-update-$timestamp.XXXXXX") || {
-    echo "❌ 创建更新备份目录失败"
-    return 1
-  }
-  if ! cp -p .env docker-compose.yml "$UPDATE_BACKUP_DIR/"; then
-    echo "❌ 备份面板配置失败"
-    return 1
-  fi
-
-  if [[ "$db_type" == "postgres" ]]; then
-    backup_postgres_for_update "$UPDATE_BACKUP_DIR/postgres.sql" || return 1
-  else
-    backup_sqlite_for_update "$UPDATE_BACKUP_DIR/sqlite" || return 1
-  fi
-  echo "💾 更新备份：$UPDATE_BACKUP_DIR"
-}
-
-pull_panel_update_images() {
-  local db_type="$1"
-
-  if [[ "$db_type" == "postgres" ]]; then
-    FLUX_VERSION="$LATEST_VERSION" run_panel_compose -f "$UPDATE_COMPOSE_CANDIDATE" pull backend frontend postgres
-  else
-    FLUX_VERSION="$LATEST_VERSION" run_panel_compose -f "$UPDATE_COMPOSE_CANDIDATE" pull backend frontend
-  fi
-}
-
-activate_panel_update_files() {
-  if ! chmod 0644 "$UPDATE_COMPOSE_CANDIDATE" || ! mv "$UPDATE_COMPOSE_CANDIDATE" docker-compose.yml; then
-    echo "❌ 替换 Compose 配置失败"
-    return 1
-  fi
-  UPDATE_COMPOSE_CANDIDATE=""
-  if ! upsert_env_var ".env" "FLUX_VERSION" "$LATEST_VERSION"; then
-    echo "❌ 更新版本配置失败"
-    return 1
-  fi
-}
-
-start_panel_after_update() {
-  local db_type="$1"
-
-  if [[ "$db_type" == "postgres" ]]; then
-    run_panel_compose up -d postgres || return 1
-    wait_for_postgres_healthy || return 1
-  fi
-  run_panel_compose up -d --force-recreate --remove-orphans backend frontend || return 1
-  wait_for_backend_healthy
-}
-
-rollback_panel_update() {
-  local db_type="$1"
-
-  echo "↩️ 正在恢复更新前配置..."
-  if ! cp -p "$UPDATE_BACKUP_DIR/.env" .env || ! cp -p "$UPDATE_BACKUP_DIR/docker-compose.yml" docker-compose.yml; then
-    echo "❌ 配置回滚失败，请从 $UPDATE_BACKUP_DIR 手动恢复"
-    return 1
-  fi
-  if [[ "$db_type" == "postgres" ]]; then
-    run_panel_compose up -d postgres || return 1
-    wait_for_postgres_healthy || return 1
-  fi
-  run_panel_compose up -d --force-recreate --remove-orphans backend frontend || return 1
-  wait_for_backend_healthy
-}
-
 wait_for_postgres_healthy() {
   local pg_health
-  local postgres_container="${PANEL_POSTGRES_CONTAINER:-$DEFAULT_PANEL_POSTGRES_CONTAINER}"
 
   echo "🔍 检查 PostgreSQL 服务状态..."
   for i in {1..90}; do
-    if docker ps --format "{{.Names}}" | grep -Fxq "$postgres_container"; then
-      pg_health=$(docker inspect -f '{{.State.Health.Status}}' "$postgres_container" 2>/dev/null || echo "unknown")
+    if docker ps --format "{{.Names}}" | grep -q "^flux-panel-postgres$"; then
+      pg_health=$(docker inspect -f '{{.State.Health.Status}}' flux-panel-postgres 2>/dev/null || echo "unknown")
       if [[ "$pg_health" == "healthy" ]]; then
         echo "✅ PostgreSQL 服务健康检查通过"
         return 0
@@ -614,7 +335,7 @@ wait_for_postgres_healthy() {
 
     if [ $i -eq 90 ]; then
       echo "❌ PostgreSQL 启动超时（90秒）"
-      echo "🔍 当前状态：$(docker inspect -f '{{.State.Health.Status}}' "$postgres_container" 2>/dev/null || echo '容器不存在')"
+      echo "🔍 当前状态：$(docker inspect -f '{{.State.Health.Status}}' flux-panel-postgres 2>/dev/null || echo '容器不存在')"
       return 1
     fi
 
@@ -627,12 +348,11 @@ wait_for_postgres_healthy() {
 
 wait_for_backend_healthy() {
   local backend_health
-  local backend_container="${PANEL_BACKEND_CONTAINER:-$DEFAULT_PANEL_BACKEND_CONTAINER}"
 
   echo "🔍 检查后端服务状态..."
   for i in {1..90}; do
-    if docker ps --format "{{.Names}}" | grep -Fxq "$backend_container"; then
-      backend_health=$(docker inspect -f '{{.State.Health.Status}}' "$backend_container" 2>/dev/null || echo "unknown")
+    if docker ps --format "{{.Names}}" | grep -q "^flux-panel-backend$"; then
+      backend_health=$(docker inspect -f '{{.State.Health.Status}}' flux-panel-backend 2>/dev/null || echo "unknown")
       if [[ "$backend_health" == "healthy" ]]; then
         echo "✅ 后端服务健康检查通过"
         return 0
@@ -645,7 +365,7 @@ wait_for_backend_healthy() {
 
     if [ $i -eq 90 ]; then
       echo "❌ 后端服务启动超时（90秒）"
-      echo "🔍 当前状态：$(docker inspect -f '{{.State.Health.Status}}' "$backend_container" 2>/dev/null || echo '容器不存在')"
+      echo "🔍 当前状态：$(docker inspect -f '{{.State.Health.Status}}' flux-panel-backend 2>/dev/null || echo '容器不存在')"
       return 1
     fi
 
@@ -660,8 +380,9 @@ wait_for_backend_healthy() {
 delete_self() {
   echo ""
   echo "🗑️ 操作已完成，正在清理脚本文件..."
+  SCRIPT_PATH="$(readlink -f "$0" 2>/dev/null || realpath "$0" 2>/dev/null || echo "$0")"
   sleep 1
-  rm -f "$PANEL_SCRIPT_PATH" && echo "✅ 脚本文件已删除" || echo "❌ 删除脚本文件失败"
+  rm -f "$SCRIPT_PATH" && echo "✅ 脚本文件已删除" || echo "❌ 删除脚本文件失败"
 }
 
 
@@ -765,11 +486,12 @@ EOF
 # 更新功能
 update_panel() {
   echo "🔄 开始更新面板..."
-  check_docker
-  resolve_panel_deployment || return 1
   ask_proxy_config
-  validate_panel_update_environment || return 1
+  check_docker
 
+  if [[ ! -f ".env" ]]; then
+    echo "⚠️ 未找到 .env，默认按 SQLite 模式更新"
+  fi
   CURRENT_DB_TYPE=$(get_current_db_type)
   echo "🗄️ 当前数据库类型：$CURRENT_DB_TYPE"
 
@@ -780,45 +502,52 @@ update_panel() {
   }
   echo "🆕 最新版本：$LATEST_VERSION"
   set_compose_urls_by_version "$LATEST_VERSION"
+  upsert_env_var ".env" "FLUX_VERSION" "$LATEST_VERSION"
 
   echo "🔽 下载最新配置文件..."
   DOCKER_COMPOSE_URL=$(get_docker_compose_url)
   echo "📡 选择配置文件：$(basename "$DOCKER_COMPOSE_URL")"
-  download_panel_update_compose "$DOCKER_COMPOSE_URL" || return 1
-  if ! validate_panel_update_compose; then
-    rm -f "$UPDATE_COMPOSE_CANDIDATE"
-    UPDATE_COMPOSE_CANDIDATE=""
-    return 1
+  curl -L -o docker-compose.yml "$DOCKER_COMPOSE_URL"
+  echo "✅ 下载完成"
+
+  # 自动检测并配置 IPv6 支持
+  if check_ipv6_support; then
+    echo "🚀 系统支持 IPv6，自动启用 IPv6 配置..."
+    configure_docker_ipv6
   fi
 
-  echo "💾 备份当前配置和数据库..."
-  if ! create_panel_update_backup "$CURRENT_DB_TYPE"; then
-    rm -f "$UPDATE_COMPOSE_CANDIDATE"
-    UPDATE_COMPOSE_CANDIDATE=""
-    return 1
-  fi
+  # 先发送 SIGTERM 信号，让应用优雅关闭
+  docker stop -t 30 flux-panel-backend 2>/dev/null || true
+  docker stop -t 10 vite-frontend 2>/dev/null || true
+  
+  # 等待 WAL 文件同步
+  echo "⏳ 等待数据同步..."
+  sleep 5
+  
+  # 然后再完全停止
+  $DOCKER_CMD down
 
   echo "⬇️ 拉取最新镜像..."
-  if ! pull_panel_update_images "$CURRENT_DB_TYPE"; then
-    rm -f "$UPDATE_COMPOSE_CANDIDATE"
-    UPDATE_COMPOSE_CANDIDATE=""
-    echo "❌ 镜像拉取失败，现有服务保持运行"
-    return 1
+  if [[ "$CURRENT_DB_TYPE" == "postgres" ]]; then
+    $DOCKER_CMD pull backend frontend postgres
+  else
+    $DOCKER_CMD pull backend frontend
   fi
 
-  if ! activate_panel_update_files; then
-    rollback_panel_update "$CURRENT_DB_TYPE" || true
-    return 1
+  echo "🚀 启动更新后的服务..."
+  if [[ "$CURRENT_DB_TYPE" == "postgres" ]]; then
+    $DOCKER_CMD up -d postgres
+    wait_for_postgres_healthy
+    $DOCKER_CMD up -d backend frontend
+  else
+    $DOCKER_CMD up -d backend frontend
   fi
 
-  echo "🚀 原地重建更新后的服务..."
-  if ! start_panel_after_update "$CURRENT_DB_TYPE"; then
-    echo "🛑 新版本启动失败"
-    if rollback_panel_update "$CURRENT_DB_TYPE"; then
-      echo "✅ 已恢复更新前版本"
-    else
-      echo "❌ 自动回滚失败，请从 $UPDATE_BACKUP_DIR 手动恢复"
-    fi
+  # 等待服务启动
+  echo "⏳ 等待服务启动..."
+
+  if ! wait_for_backend_healthy; then
+    echo "🛑 更新终止"
     return 1
   fi
 

test-install-scripts-alpine.sh

@@ -1,86 +0,0 @@
-#!/bin/sh
-set -eu
-
-# Run only in a disposable Alpine container: this exercises real OpenRC services.
-# docker run --rm -v "$PWD:/workspace:ro" alpine:3.22 sh /workspace/test-install-scripts-alpine.sh
-[ -f /etc/alpine-release ] && [ "$(id -u)" = 0 ] || {
-  echo "Run this test as root in a disposable Alpine container." >&2
-  exit 1
-}
-
-ROOT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-INSTALL_SCRIPT=${1:-"$ROOT_DIR/install.sh"}
-TEST_DIR=$(mktemp -d)
-export TEST_DIR
-
-cleanup() {
-  rc-service flux_agent stop >/dev/null 2>&1 || true
-  rc-update del flux_agent default >/dev/null 2>&1 || true
-  rm -f /etc/init.d/flux_agent
-  rm -rf "$TEST_DIR"
-}
-trap cleanup EXIT
-
-# Docker supplies the network; an empty interfaces file lets OpenRC register
-# that dependency without changing the container's network configuration.
-apk add --no-cache openrc
-mkdir -p /run/openrc /etc/network
-touch /run/openrc/softlevel /etc/network/interfaces
-rc-service networking start
-
-# Fail immediately if any path accidentally calls systemd on Alpine.
-mkdir -p "$TEST_DIR/bin"
-cat > "$TEST_DIR/bin/systemctl" <<'EOF'
-#!/bin/sh
-touch "$TEST_DIR/systemctl-called"
-exit 1
-EOF
-chmod +x "$TEST_DIR/bin/systemctl"
-export PATH="$TEST_DIR/bin:$PATH"
-
-cat > "$TEST_DIR/agent" <<'EOF'
-#!/bin/sh
-if [ "${1:-}" = -V ]; then
-  echo "Alpine installer test agent"
-  exit 0
-fi
-pwd > ../working-directory
-exec sleep 300
-EOF
-
-# Keep the installer bootstrap, service detection and all lifecycle operations.
-# Substitute only the network download and optional tcpkill dependency.
-sed '/^# 执行主函数$/,$d' "$INSTALL_SCRIPT" > "$TEST_DIR/install.sh"
-cat >> "$TEST_DIR/install.sh" <<'EOF'
-INSTALL_DIR="$TEST_DIR/flux_agent"
-ensure_download_url_initialized() {
-  ensure_alpine_runtime_dependencies || return 1
-  DOWNLOAD_URL="file://$TEST_DIR/agent"
-}
-check_and_install_tcpkill() { :; }
-main
-EOF
-chmod +x "$TEST_DIR/install.sh"
-cp "$TEST_DIR/install.sh" "$TEST_DIR/manage.sh"
-PROXY_ENABLED=false "$TEST_DIR/install.sh" -a http://127.0.0.1:9 -s alpine-test
-
-rc-service flux_agent status
-test -L /etc/runlevels/default/flux_agent
-test "$(cat "$TEST_DIR/working-directory")" = "$TEST_DIR/flux_agent"
-test -s "$TEST_DIR/flux_agent/config.json"
-rc-service flux_agent restart
-rc-service flux_agent status
-
-# Update must retain config and restart through OpenRC.
-cp "$TEST_DIR/flux_agent/config.json" "$TEST_DIR/config-before-update.json"
-cp "$TEST_DIR/manage.sh" "$TEST_DIR/update.sh"
-printf '2\n' | PROXY_ENABLED=false "$TEST_DIR/update.sh"
-cmp "$TEST_DIR/config-before-update.json" "$TEST_DIR/flux_agent/config.json"
-rc-service flux_agent status
-
-printf '3\ny\n' | "$TEST_DIR/manage.sh"
-test ! -e /etc/init.d/flux_agent
-test ! -e /etc/runlevels/default/flux_agent
-test ! -e "$TEST_DIR/flux_agent"
-test ! -e "$TEST_DIR/systemctl-called"
-echo "Alpine installer lifecycle tests passed"

test-install-scripts-proxy.sh

@@ -277,8 +277,6 @@ EOF
   local expected=$'{\n  "addr": "panel\\"addr",\n  "secret": "sec\\\\ret\\"1"\n}'
 
   assert_equals "$expected" "$actual" "install_flux_agent should JSON-escape config values"
-  grep -Fqx 'Environment=GODEBUG=disablethp=1' "$FLUX_AGENT_SYSTEMD_SERVICE_FILE" || \
-    fail "systemd service should disable transparent huge pages for the Go heap"
 )
 
 test_install_script_bootstraps_bash_for_alpine() (
@@ -558,7 +556,6 @@ test_update_panel_asks_for_proxy_config() (
   load_script_without_main "$ROOT_DIR/panel_install.sh"
 
   local ask_called="0"
-  local calls=""
 
   ask_proxy_config() {
     ask_called="1"
@@ -571,15 +568,6 @@ test_update_panel_asks_for_proxy_config() (
     DOCKER_CMD="true"
   }
 
-  resolve_panel_deployment() {
-    calls+=" resolve"
-    PANEL_DEPLOY_DIR=$(mktemp -d)
-  }
-
-  validate_panel_update_environment() {
-    calls+=" validate-current"
-  }
-
   get_current_db_type() {
     echo "sqlite"
   }
@@ -588,33 +576,13 @@ test_update_panel_asks_for_proxy_config() (
     echo "v-test"
   }
 
-  download_panel_update_compose() {
-    calls+=" download"
-    UPDATE_COMPOSE_CANDIDATE="candidate"
-  }
-
-  validate_panel_update_compose() {
-    calls+=" validate-new"
-  }
-
-  create_panel_update_backup() {
-    calls+=" backup"
-    UPDATE_BACKUP_DIR="backup"
-  }
-
-  pull_panel_update_images() {
-    calls+=" pull"
-  }
-
-  activate_panel_update_files() {
-    calls+=" activate"
-  }
-
-  start_panel_after_update() {
-    calls+=" start"
-  }
-
+  upsert_env_var() { :; }
   check_ipv6_support() { return 1; }
+  configure_docker_ipv6() { :; }
+  docker() { return 0; }
+  wait_for_backend_healthy() { return 0; }
+  sleep() { :; }
+  curl() { :; }
 
   update_panel >/dev/null
 
@@ -623,75 +591,6 @@ test_update_panel_asks_for_proxy_config() (
     "https://github.com/${REPO}/releases/download/v-test/docker-compose-v4.yml" \
     "$DOCKER_COMPOSEV4_URL" \
     "update_panel should honor the prompted proxy choice"
-  assert_equals \
-    " resolve validate-current download validate-new backup pull activate start" \
-    "$calls" \
-    "update_panel should validate, back up, and pull before activating the update"
-)
-
-test_resolve_panel_deployment_uses_container_labels() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  local expected_dir
-  expected_dir=$(mktemp -d)
-  expected_dir=$(cd "$expected_dir" && pwd -P)
-  printf 'JWT_SECRET=test\nBACKEND_PORT=6365\nFRONTEND_PORT=6366\nDB_TYPE=sqlite\n' > "$expected_dir/.env"
-  printf 'services: {}\n' > "$expected_dir/docker-compose.yml"
-
-  unset PANEL_DEPLOY_DIR COMPOSE_PROJECT_NAME
-  docker() {
-    if [[ "$1" == "inspect" && "$2" == "-f" ]]; then
-      case "$3" in
-        *working_dir*) printf '%s\n' "$expected_dir" ;;
-        *) printf '%s\n' "flvx-panel" ;;
-      esac
-    fi
-  }
-
-  resolve_panel_deployment >/dev/null
-
-  assert_equals "$expected_dir" "$PANEL_DEPLOY_DIR" "update should discover the Compose working directory from container labels"
-  assert_equals "flvx-panel" "$COMPOSE_PROJECT_NAME" "update should preserve the existing Compose project name"
-  assert_equals "$expected_dir" "$(pwd -P)" "update should run from the discovered deployment directory"
-)
-
-test_validate_panel_update_environment_rejects_empty_required_values() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  local deploy_dir rc="0"
-  deploy_dir=$(mktemp -d)
-  printf 'JWT_SECRET=\nBACKEND_PORT=6365\nFRONTEND_PORT=6366\nDB_TYPE=sqlite\n' > "$deploy_dir/.env"
-  printf 'services: {}\n' > "$deploy_dir/docker-compose.yml"
-  cd "$deploy_dir"
-  DOCKER_CMD="true"
-
-  validate_panel_update_environment >/dev/null || rc="$?"
-
-  assert_equals "1" "$rc" "update should reject an empty JWT secret before touching the running service"
-)
-
-test_backup_sqlite_for_update_pauses_copies_and_unpauses() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/panel_install.sh"
-
-  local destination calls log_path
-  destination=$(mktemp -d)/sqlite
-  log_path=$(mktemp)
-  PANEL_BACKEND_CONTAINER="flux-panel-backend"
-  docker() {
-    if [[ "$1" == "inspect" ]]; then
-      printf 'true\n'
-      return 0
-    fi
-    printf ' %s' "$1" >> "$log_path"
-  }
-
-  backup_sqlite_for_update "$destination" >/dev/null
-  calls=$(cat "$log_path")
-
-  assert_equals " pause cp unpause" "$calls" "SQLite backup should pause writes, copy the database volume, then resume the backend"
 )
 
 test_panel_install_script_accepts_proxy_url_env_without_prompt() (
@@ -762,9 +661,6 @@ test_install_script_accepts_proxy_url_env_without_prompt
 test_panel_install_script_can_disable_proxy
 test_panel_install_script_recomputes_compose_urls_after_prompt
 test_update_panel_asks_for_proxy_config
-test_resolve_panel_deployment_uses_container_labels
-test_validate_panel_update_environment_rejects_empty_required_values
-test_backup_sqlite_for_update_pauses_copies_and_unpauses
 test_panel_install_script_uses_default_proxy
 test_panel_install_script_accepts_proxy_url_env_without_prompt
 test_panel_install_script_defaults_proxy_on_eof

vite-frontend/Dockerfile

@@ -1,10 +1,10 @@
 # 多阶段构建 - 构建阶段
-FROM --platform=$BUILDPLATFORM node:22-alpine AS builder
+FROM node:22-alpine AS builder
 
 WORKDIR /app
 
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN corepack enable pnpm && pnpm install --frozen-lockfile
+COPY package.json pnpm-lock.yaml* ./
+RUN corepack prepare pnpm@10 --activate && corepack enable pnpm && pnpm install --frozen-lockfile
 
 COPY . .
 RUN pnpm run build
@@ -18,4 +18,4 @@ COPY --from=builder /app/dist /usr/share/nginx/html
 
 EXPOSE 80
 
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"] 

vite-frontend/package.json

@@ -2,7 +2,6 @@
   "name": "flvx",
   "private": true,
   "version": "0.0.0",
-  "packageManager": "pnpm@10.28.1",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -82,5 +81,12 @@
     "vite": "npm:rolldown-vite@^7.3.1",
     "vite-plugin-pwa": "^1.1.0",
     "vite-tsconfig-paths": "^6.0.5"
+  },
+  "pnpm": {
+    "overrides": {
+      "@babel/plugin-transform-modules-systemjs": "7.29.4",
+      "fast-uri": "3.1.2",
+      "serialize-javascript": "7.0.5"
+    }
   }
 }

vite-frontend/pnpm-workspace.yaml

@@ -1,10 +1,2 @@
-packages:
-  - '.'
-
-overrides:
-  '@babel/plugin-transform-modules-systemjs': 7.29.4
-  fast-uri: 3.1.2
-  serialize-javascript: 7.0.5
-
 allowBuilds:
   '@tailwindcss/oxide': true

vite-frontend/src/App.tsx

@@ -28,7 +28,6 @@ import { isLoggedIn } from "@/utils/auth";
 import { siteConfig, updateSiteConfig } from "@/config/site";
 import { useH5Mode } from "@/hooks/useH5Mode";
 import { SESSION_UPDATED_EVENT } from "@/utils/session";
-import { useThemeContext } from "@/themes/context";
 
 const ProtectedRoute = ({
   children,
@@ -80,7 +79,6 @@ const LoginRoute = () => {
 function App() {
   const location = useLocation();
   const navigate = useNavigate();
-  const { effectiveMode } = useThemeContext();
 
   // 全局登录状态监听，当检测到未登录且不在首页时，跳转到首页
   useEffect(() => {
@@ -100,10 +98,7 @@ function App() {
   // 处理自定义背景图片
   useEffect(() => {
     const updateBg = () => {
-      const customBg =
-        (effectiveMode === "dark"
-          ? siteConfig.app_bg_image_dark
-          : siteConfig.app_bg_image_light) || siteConfig.app_bg_image;
+      const customBg = siteConfig.app_bg_image;
 
       if (customBg) {
         if (customBg === "theme") {
@@ -154,7 +149,7 @@ function App() {
     return () => {
       window.removeEventListener("site-config-updated", updateBg);
     };
-  }, [effectiveMode]);
+  }, []);
 
   // 立即设置页面标题（使用已从缓存读取的配置）
   useEffect(() => {

vite-frontend/src/config/site.ts

@@ -14,16 +14,10 @@ const PUBLIC_BRAND_CONFIG_KEYS = [
   "app_logo",
   "app_favicon",
   "app_bg_image",
-  "app_bg_image_light",
-  "app_bg_image_dark",
-  "is_commercial",
-  "hide_footer_brand",
 ] as const;
 const SENSITIVE_CONFIG_KEYS = new Set([
   "jwt_secret",
   "license_key",
-  "license_machine_id",
-  "machine_fingerprint",
   "cloudflare_secret_key",
 ]);
 const GITHUB_REPO =
@@ -55,30 +49,6 @@ const readCachedConfigs = (keys: readonly string[]) => {
   return { cachedConfigs, hasCachedData };
 };
 
-const readAllCachedSafeConfigs = () => {
-  const cachedConfigs: Record<string, string> = {};
-
-  Object.keys(localStorage).forEach((storageKey) => {
-    if (!storageKey.startsWith(CACHE_PREFIX)) {
-      return;
-    }
-
-    const key = storageKey.slice(CACHE_PREFIX.length).trim().toLowerCase();
-
-    if (!key || SENSITIVE_CONFIG_KEYS.has(key)) {
-      return;
-    }
-
-    const value = localStorage.getItem(storageKey);
-
-    if (value !== null) {
-      cachedConfigs[key] = value;
-    }
-  });
-
-  return cachedConfigs;
-};
-
 const fetchPublicBrandConfigs = async (): Promise<Record<string, string>> => {
   const publicConfigMap: Record<string, string> = {};
 
@@ -116,8 +86,6 @@ const getInitialConfig = () => {
       app_logo: "",
       app_favicon: "",
       app_bg_image: "",
-      app_bg_image_light: "",
-      app_bg_image_dark: "",
       is_commercial: false,
       hide_footer_brand: false,
     };
@@ -131,10 +99,6 @@ const getInitialConfig = () => {
     localStorage.getItem(CACHE_PREFIX + "app_favicon") || "";
   const cachedAppBgImage =
     localStorage.getItem(CACHE_PREFIX + "app_bg_image") || "";
-  const cachedAppBgImageLight =
-    localStorage.getItem(CACHE_PREFIX + "app_bg_image_light") || "";
-  const cachedAppBgImageDark =
-    localStorage.getItem(CACHE_PREFIX + "app_bg_image_dark") || "";
   const isCommercial =
     localStorage.getItem(CACHE_PREFIX + "is_commercial") === "true";
   const hideFooterBrand =
@@ -142,17 +106,15 @@ const getInitialConfig = () => {
 
   if (cachedAppName) {
     return {
-      name: isCommercial ? cachedAppName : "FLVX",
+      name: cachedAppName,
       version: VERSION,
       app_version: APP_VERSION,
       github_repo: GITHUB_REPO,
-      app_logo: isCommercial ? cachedAppLogo : "",
-      app_favicon: isCommercial ? cachedAppFavicon : "",
+      app_logo: cachedAppLogo,
+      app_favicon: cachedAppFavicon,
       app_bg_image: cachedAppBgImage,
-      app_bg_image_light: cachedAppBgImageLight,
-      app_bg_image_dark: cachedAppBgImageDark,
       is_commercial: isCommercial,
-      hide_footer_brand: isCommercial && hideFooterBrand,
+      hide_footer_brand: hideFooterBrand,
     };
   }
 
@@ -161,13 +123,11 @@ const getInitialConfig = () => {
     version: VERSION,
     app_version: APP_VERSION,
     github_repo: GITHUB_REPO,
-    app_logo: isCommercial ? cachedAppLogo : "",
-    app_favicon: isCommercial ? cachedAppFavicon : "",
+    app_logo: cachedAppLogo,
+    app_favicon: cachedAppFavicon,
     app_bg_image: cachedAppBgImage,
-    app_bg_image_light: cachedAppBgImageLight,
-    app_bg_image_dark: cachedAppBgImageDark,
     is_commercial: isCommercial,
-    hide_footer_brand: isCommercial && hideFooterBrand,
+    hide_footer_brand: hideFooterBrand,
   };
 };
 
@@ -246,24 +206,20 @@ export const getCachedConfig = async (key: string): Promise<string | null> => {
 
 // 获取所有配置（优先从缓存）
 export const getCachedConfigs = async (): Promise<Record<string, string>> => {
-  const {
-    cachedConfigs: publicCachedConfigs,
-    hasCachedData: hasPublicCachedData,
-  } = readCachedConfigs(PUBLIC_BRAND_CONFIG_KEYS);
+  const { cachedConfigs, hasCachedData } = readCachedConfigs(
+    PUBLIC_BRAND_CONFIG_KEYS,
+  );
 
   if (!isLoggedIn()) {
     const publicConfigs = await fetchPublicBrandConfigs();
 
     if (Object.keys(publicConfigs).length > 0) {
-      return { ...publicCachedConfigs, ...publicConfigs };
+      return { ...cachedConfigs, ...publicConfigs };
     }
 
-    return publicCachedConfigs;
+    return cachedConfigs;
   }
 
-  const cachedConfigs = readAllCachedSafeConfigs();
-  const hasCachedData = Object.keys(cachedConfigs).length > 0;
-
   // 从API获取最新配置
   try {
     const response = await getConfigs();
@@ -293,20 +249,14 @@ export const getCachedConfigs = async (): Promise<Record<string, string>> => {
       return cachedConfigs;
     }
 
-    const publicConfigs = await fetchPublicBrandConfigs();
-
-    return { ...publicCachedConfigs, ...publicConfigs };
+    return await fetchPublicBrandConfigs();
   } catch {
     // API失败时返回缓存的数据
     if (hasCachedData) {
       return cachedConfigs;
     }
 
-    const publicConfigs = await fetchPublicBrandConfigs();
-
-    return hasPublicCachedData
-      ? { ...publicCachedConfigs, ...publicConfigs }
-      : publicConfigs;
+    return await fetchPublicBrandConfigs();
   }
 };
 
@@ -394,21 +344,7 @@ export const updateSiteConfig = async (configMap?: Record<string, string>) => {
     resolvedConfigMap,
     "app_bg_image",
   );
-  const hasAppBgImageLight = Object.prototype.hasOwnProperty.call(
-    resolvedConfigMap,
-    "app_bg_image_light",
-  );
-  const hasAppBgImageDark = Object.prototype.hasOwnProperty.call(
-    resolvedConfigMap,
-    "app_bg_image_dark",
-  );
 
-  const resolvedCommercial = Object.prototype.hasOwnProperty.call(
-    resolvedConfigMap,
-    "is_commercial",
-  )
-    ? resolvedConfigMap.is_commercial === "true"
-    : siteConfig.is_commercial;
   const appName = hasAppName
     ? String(resolvedConfigMap.app_name || "").trim()
     : siteConfig.name;
@@ -421,32 +357,16 @@ export const updateSiteConfig = async (configMap?: Record<string, string>) => {
   const appBgImage = hasAppBgImage
     ? String(resolvedConfigMap.app_bg_image || "").trim()
     : (siteConfig.app_bg_image || "").trim();
-  const appBgImageLight = hasAppBgImageLight
-    ? String(resolvedConfigMap.app_bg_image_light || "").trim()
-    : (siteConfig.app_bg_image_light || "").trim();
-  const appBgImageDark = hasAppBgImageDark
-    ? String(resolvedConfigMap.app_bg_image_dark || "").trim()
-    : (siteConfig.app_bg_image_dark || "").trim();
 
-  siteConfig.name = resolvedCommercial && appName ? appName : "FLVX";
-  siteConfig.app_logo = resolvedCommercial ? appLogo : "";
-  siteConfig.app_favicon = resolvedCommercial ? appFavicon : "";
+  if (appName && appName !== siteConfig.name) {
+    siteConfig.name = appName;
+  }
+
+  siteConfig.app_logo = appLogo;
+  siteConfig.app_favicon = appFavicon;
   siteConfig.app_bg_image = appBgImage;
-  siteConfig.app_bg_image_light = appBgImageLight;
-  siteConfig.app_bg_image_dark = appBgImageDark;
-  if (
-    Object.prototype.hasOwnProperty.call(resolvedConfigMap, "is_commercial")
-  ) {
-    siteConfig.is_commercial = resolvedCommercial;
-  }
-  if (
-    Object.prototype.hasOwnProperty.call(resolvedConfigMap, "hide_footer_brand")
-  ) {
-    siteConfig.hide_footer_brand =
-      resolvedCommercial && resolvedConfigMap.hide_footer_brand === "true";
-  } else if (!resolvedCommercial) {
-    siteConfig.hide_footer_brand = false;
-  }
+  siteConfig.is_commercial = resolvedConfigMap.is_commercial === "true";
+  siteConfig.hide_footer_brand = resolvedConfigMap.hide_footer_brand === "true";
 
   if (typeof document !== "undefined") {
     document.title = siteConfig.name;

vite-frontend/src/pages/config.tsx

@@ -90,8 +90,6 @@ interface ConfigItem {
   dependsValue?: string; // 依赖的配置项值
 }
 
-type BgImageKey = "app_bg_image" | "app_bg_image_light" | "app_bg_image_dark";
-
 const BRAND_PREVIEW_KEYS = ["app_logo", "app_favicon"] as const;
 
 type BrandPreviewKey = (typeof BRAND_PREVIEW_KEYS)[number];
@@ -109,9 +107,9 @@ const toBrandAssetKind = (key: BrandPreviewKey): BrandAssetKind => {
 const CONFIG_ITEMS: ConfigItem[] = [
   {
     key: "app_bg_image",
-    label: "背景壁纸",
+    label: "自定义背景",
     description:
-      "默认背景用于未单独设置壁纸的模式。可分别上传亮色和暗色壁纸，保存后随外观模式自动切换。",
+      "上传自定义背景图片（建议使用深色/浅色均可看清的图片，或使用半透明模糊效果）",
     type: "bg_image",
   },
   {
@@ -265,15 +263,9 @@ const getInitialConfigs = (): Record<string, string> => {
     "panel_domain",
     "app_logo",
     "app_favicon",
-    "app_bg_image",
-    "app_bg_image_light",
-    "app_bg_image_dark",
     "github_proxy_enabled",
     "github_proxy_url",
     "allow_local_remote_addr",
-    "is_commercial",
-    "license_expiry",
-    "hide_footer_brand",
   ];
   const initialConfigs: Record<string, string> = {};
 
@@ -317,12 +309,8 @@ export default function ConfigPage() {
 
   const logoFileInputRef = useRef<HTMLInputElement>(null);
   const faviconFileInputRef = useRef<HTMLInputElement>(null);
-  const bgImageFileInputRefs = useRef<
-    Partial<Record<BgImageKey, HTMLInputElement>>
-  >({});
-  const [bgImageUploading, setBgImageUploading] = useState<BgImageKey | null>(
-    null,
-  );
+  const bgImageFileInputRef = useRef<HTMLInputElement>(null);
+  const [bgImageUploading, setBgImageUploading] = useState(false);
 
   const [announcement, setAnnouncement] = useState<AnnouncementData>({
     content: "",
@@ -698,14 +686,7 @@ export default function ConfigPage() {
 
         if (
           changedKeys.some((key) =>
-            [
-              "app_name",
-              "app_logo",
-              "app_favicon",
-              "app_bg_image",
-              "app_bg_image_light",
-              "app_bg_image_dark",
-            ].includes(key),
+            ["app_name", "app_logo", "app_favicon"].includes(key),
           )
         ) {
           await updateSiteConfig(configs);
@@ -816,7 +797,6 @@ export default function ConfigPage() {
 
   const handleBgImageUpload = async (
     e: React.ChangeEvent<HTMLInputElement>,
-    key: BgImageKey,
   ) => {
     const file = e.target.files?.[0];
 
@@ -828,7 +808,7 @@ export default function ConfigPage() {
       return;
     }
 
-    setBgImageUploading(key);
+    setBgImageUploading(true);
     try {
       const compressedImage = await new Promise<string>((resolve, reject) => {
         const reader = new FileReader();
@@ -878,19 +858,18 @@ export default function ConfigPage() {
         reader.readAsDataURL(file);
       });
 
-      handleConfigChange(key, compressedImage);
-      toast.success("壁纸上传成功，保存配置后生效");
+      handleConfigChange("app_bg_image", compressedImage);
+      toast.success("自定义背景上传成功");
     } catch (error) {
       toast.error(error instanceof Error ? error.message : "图片处理失败");
     } finally {
-      setBgImageUploading(null);
+      setBgImageUploading(false);
       e.target.value = "";
     }
   };
 
-  const renderBgImageUploader = (key: BgImageKey, label: string) => {
-    const bgImage = configs[key] || "";
-    const isDefault = key === "app_bg_image";
+  const renderBgImageUploader = () => {
+    const bgImage = configs["app_bg_image"] || "";
     const isImage =
       bgImage.startsWith("http") ||
       bgImage.startsWith("data:") ||
@@ -900,64 +879,47 @@ export default function ConfigPage() {
     const isSolidColor = bgImage && !isImage && !isTheme;
 
     return (
-      <div className="flex flex-col gap-3 w-full rounded-xl border border-divider p-4">
-        <div>
-          <p className="text-sm font-medium text-gray-700 dark:text-gray-300">
-            {label}
-          </p>
-          {!isDefault && !bgImage && (
-            <p className="text-xs text-gray-500 dark:text-gray-400 mt-1">
-              未单独设置，使用默认背景
-            </p>
-          )}
-        </div>
+      <div className="flex flex-col gap-4 w-full">
         <div className="flex flex-wrap items-center gap-4">
           <input
-            ref={(node) => {
-              if (node) bgImageFileInputRefs.current[key] = node;
-            }}
+            ref={bgImageFileInputRef}
             accept="image/*"
             className="hidden"
             type="file"
-            onChange={(event) => void handleBgImageUpload(event, key)}
+            onChange={handleBgImageUpload}
           />
           <Button
             color="primary"
-            isDisabled={bgImageUploading !== null && bgImageUploading !== key}
-            isLoading={bgImageUploading === key}
+            isLoading={bgImageUploading}
             variant="flat"
-            onPress={() => bgImageFileInputRefs.current[key]?.click()}
+            onPress={() => bgImageFileInputRef.current?.click()}
           >
             上传图片
           </Button>
-          {isDefault && (
-            <Button
-              color="secondary"
-              isDisabled={bgImageUploading !== null || isTheme}
-              variant="flat"
-              onPress={() => handleConfigChange(key, "theme")}
-            >
-              自适应纯色 (跟随深色模式)
-            </Button>
-          )}
-          {isDefault && (
-            <Button
-              color="default"
-              isDisabled={bgImageUploading !== null || bgImage === "#ffffff"}
-              variant="flat"
-              onPress={() => handleConfigChange(key, "#ffffff")}
-            >
-              白色纯色
-            </Button>
-          )}
+          <Button
+            color="secondary"
+            isDisabled={bgImageUploading || isTheme}
+            variant="flat"
+            onPress={() => handleConfigChange("app_bg_image", "theme")}
+          >
+            自适应纯色 (跟随深色模式)
+          </Button>
+          <Button
+            color="default"
+            isDisabled={bgImageUploading || bgImage === "#ffffff"}
+            variant="flat"
+            onPress={() => handleConfigChange("app_bg_image", "#ffffff")}
+          >
+            白色纯色
+          </Button>
           {bgImage && (
             <Button
               color="danger"
-              isDisabled={bgImageUploading !== null}
+              isDisabled={bgImageUploading}
               variant="flat"
-              onPress={() => handleConfigChange(key, "")}
+              onPress={() => handleConfigChange("app_bg_image", "")}
             >
-              {isDefault ? "恢复内置背景" : "清除专属壁纸"}
+              恢复默认
             </Button>
           )}
         </div>
@@ -965,7 +927,7 @@ export default function ConfigPage() {
         {bgImage && isImage && (
           <div className="relative rounded-xl overflow-hidden border border-divider">
             <img
-              alt={`${label}预览`}
+              alt="背景预览"
               className="w-full max-h-48 object-cover opacity-80"
               src={bgImage}
             />
@@ -1153,15 +1115,7 @@ export default function ConfigPage() {
 
     switch (item.type) {
       case "bg_image":
-        return (
-          <div className="grid grid-cols-1 lg:grid-cols-2 gap-4">
-            <div className="lg:col-span-2">
-              {renderBgImageUploader("app_bg_image", "默认背景")}
-            </div>
-            {renderBgImageUploader("app_bg_image_light", "☀️ 亮色模式壁纸")}
-            {renderBgImageUploader("app_bg_image_dark", "🌙 暗色模式壁纸")}
-          </div>
-        );
+        return renderBgImageUploader();
 
       case "input": {
         if (isBrandPreviewKey(item.key)) {