feat: add best exit selection

README.md

@@ -1,6 +1,6 @@
 # FLVX
 
-> **联系我们**: [Telegram群组](https://t.me/flvxchannel)
+> **联系我们**: [Telegram群组](https://t.me/flvxpanel)
 
 
 ## 特性

docker-compose-v4.yml

@@ -15,15 +15,10 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       SERVER_ADDR: :6365
       TZ: Asia/Shanghai
-      FLUX_VERSION: ${FLUX_VERSION:-dev}
-      PANEL_DEPLOY_DIR: /opt/flvx-panel
-      PANEL_BACKEND_CONTAINER: flux-panel-backend
     ports:
       - "${BACKEND_PORT}:6365"
     volumes:
       - sqlite_data:/app/data
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./:/opt/flvx-panel
     networks:
       - gost-network
     stop_grace_period: 30s

docker-compose-v6.yml

@@ -15,15 +15,10 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       SERVER_ADDR: :6365
       TZ: Asia/Shanghai
-      FLUX_VERSION: ${FLUX_VERSION:-dev}
-      PANEL_DEPLOY_DIR: /opt/flvx-panel
-      PANEL_BACKEND_CONTAINER: flux-panel-backend
     ports:
       - "${BACKEND_PORT}:6365"
     volumes:
       - sqlite_data:/app/data
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./:/opt/flvx-panel
     networks:
       - gost-network
     stop_grace_period: 30s

docs/superpowers/plans/2026-05-01-best-exit-current-display.md

@@ -1,892 +0,0 @@
-# Best Exit Current Display Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Show the currently applied `best` exit selection in the tunnel list information, including per-entry/per-final-hop details for multi-owner tunnels.
-
-**Architecture:** Add a backend-only display layer that snapshots `bestExitManager` state and attaches `bestExitState` to existing `tunnelList`/`tunnelGet` responses. Render that state in the existing tunnel table/grid topology area using compact text and a native `title` detail tooltip. No routing, scoring, persistence, polling, or runtime update behavior changes.
-
-**Tech Stack:** Go `net/http` handlers + existing repository methods, React/TypeScript in `vite-frontend/src/pages/tunnel.tsx`, Tailwind/shadcn bridge components already in the file.
-
----
-
-## File Structure
-
-- Create `go-backend/internal/http/handler/tunnel_best_exit_display.go`: response DTOs, manager snapshot method, tunnel-response parsing helpers, and `Handler.attachBestExitStates`.
-- Create `go-backend/internal/http/handler/tunnel_best_exit_display_test.go`: backend display-state unit tests.
-- Modify `go-backend/internal/http/handler/handler.go`: call `h.attachBestExitStatesOrLog(items)` in `tunnelList`.
-- Modify `go-backend/internal/http/handler/mutations.go`: call `h.attachBestExitStatesOrLog(items)` before returning a single tunnel in `tunnelGet`.
-- Modify `vite-frontend/src/pages/tunnel.tsx`: add `bestExitState` types, map API state, helper render functions, and table/grid display.
-
----
-
-### Task 1: Backend Snapshot And Display-State Tests
-
-**Files:**
-- Create: `go-backend/internal/http/handler/tunnel_best_exit_display_test.go`
-
-- [ ] **Step 1: Write failing backend display tests**
-
-Create `go-backend/internal/http/handler/tunnel_best_exit_display_test.go`:
-
-```go
-package handler
-
-import (
-	"testing"
-	"time"
-)
-
-func TestBestExitDecisionSnapshotIsDefensiveCopy(t *testing.T) {
-	m := newBestExitManager()
-	key := bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}
-	now := time.Unix(100, 0)
-	score := scoreBestExitCandidate(10, chainNodeRecord{NodeID: 30, NodeName: "exit-a"}, 10, 0, 20, 0)
-
-	m.observeScores(key, []bestExitCandidateScore{score}, now)
-	snapshot, ok := m.snapshot(key)
-	if !ok {
-		t.Fatalf("expected snapshot")
-	}
-	if snapshot.AppliedExitNodeID != 30 || snapshot.UpdatedAt != now.UnixMilli() {
-		t.Fatalf("unexpected snapshot: %+v", snapshot)
-	}
-	if len(snapshot.Scores) != 1 {
-		t.Fatalf("expected one score in snapshot, got %+v", snapshot.Scores)
-	}
-	snapshot.Scores[0].ExitNodeID = 99
-
-	again, ok := m.snapshot(key)
-	if !ok {
-		t.Fatalf("expected second snapshot")
-	}
-	if again.Scores[0].ExitNodeID != 30 {
-		t.Fatalf("snapshot score mutation leaked into manager state: %+v", again.Scores)
-	}
-}
-
-func TestBuildBestExitDisplayStateForDirectMultiEntryOwners(t *testing.T) {
-	m := newBestExitManager()
-	now := time.Unix(100, 0)
-	m.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}, 30, now)
-	m.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 11}, 31, now.Add(time.Second))
-
-	tunnel := map[string]interface{}{
-		"id": int64(77),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-			{"nodeId": int64(11)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{},
-	}
-	names := map[int64]string{10: "入口 A", 11: "入口 B", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, m, testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected best exit state")
-	}
-	if !state.Enabled || state.Summary != "多个出口" || state.Status != "applied" {
-		t.Fatalf("unexpected state summary: %+v", state)
-	}
-	if state.UpdatedAt != now.Add(time.Second).UnixMilli() {
-		t.Fatalf("expected latest updatedAt, got %d", state.UpdatedAt)
-	}
-	if len(state.Items) != 2 {
-		t.Fatalf("expected two owner items, got %+v", state.Items)
-	}
-	if state.Items[0].OwnerRole != "entry" || state.Items[0].OwnerNodeName != "入口 A" || state.Items[0].ExitNodeName != "香港节点" {
-		t.Fatalf("unexpected first item: %+v", state.Items[0])
-	}
-	if state.Items[1].OwnerRole != "entry" || state.Items[1].OwnerNodeName != "入口 B" || state.Items[1].ExitNodeName != "日本节点" {
-		t.Fatalf("unexpected second item: %+v", state.Items[1])
-	}
-}
-
-func TestBuildBestExitDisplayStateForFinalChainHopOwners(t *testing.T) {
-	m := newBestExitManager()
-	now := time.Unix(200, 0)
-	m.setApplied(bestExitOwnerKey{TunnelID: 88, OwnerNodeID: 20}, 30, now)
-	m.setApplied(bestExitOwnerKey{TunnelID: 88, OwnerNodeID: 21}, 30, now.Add(time.Second))
-
-	tunnel := map[string]interface{}{
-		"id": int64(88),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{
-			{{"nodeId": int64(15), "inx": int64(0)}},
-			{{"nodeId": int64(20), "inx": int64(1)}, {"nodeId": int64(21), "inx": int64(1)}},
-		},
-	}
-	names := map[int64]string{20: "中转 M1", 21: "中转 M2", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, m, testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected best exit state")
-	}
-	if state.Summary != "香港节点" || state.Status != "applied" {
-		t.Fatalf("expected single-exit summary, got %+v", state)
-	}
-	if len(state.Items) != 2 {
-		t.Fatalf("expected two final-hop owner items, got %+v", state.Items)
-	}
-	if state.Items[0].OwnerRole != "chain" || state.Items[0].OwnerNodeName != "中转 M1" || state.Items[0].ExitNodeName != "香港节点" {
-		t.Fatalf("unexpected first chain owner item: %+v", state.Items[0])
-	}
-	if state.Items[1].OwnerRole != "chain" || state.Items[1].OwnerNodeName != "中转 M2" || state.Items[1].ExitNodeName != "香港节点" {
-		t.Fatalf("unexpected second chain owner item: %+v", state.Items[1])
-	}
-}
-
-func TestBuildBestExitDisplayStateWaitingWhenNoAppliedDecisionExists(t *testing.T) {
-	tunnel := map[string]interface{}{
-		"id": int64(77),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{},
-	}
-	names := map[int64]string{10: "入口 A", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, newBestExitManager(), testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected waiting best exit state")
-	}
-	if state.Summary != "等待探测" || state.Status != "waiting" {
-		t.Fatalf("expected waiting state, got %+v", state)
-	}
-	if len(state.Items) != 1 || state.Items[0].ExitNodeID != 0 || state.Items[0].ExitNodeName != "等待探测" {
-		t.Fatalf("unexpected waiting item: %+v", state.Items)
-	}
-}
-
-func TestBuildBestExitDisplayStateSkipsNonBestAndSingleExitTunnels(t *testing.T) {
-	nonBest := map[string]interface{}{
-		"id":       int64(77),
-		"inNodeId": []map[string]interface{}{{"nodeId": int64(10)}},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": "round"},
-			{"nodeId": int64(31), "strategy": "round"},
-		},
-	}
-	if state, ok := buildBestExitDisplayState(nonBest, newBestExitManager(), testBestExitNameLookup(nil)); ok || state != nil {
-		t.Fatalf("expected non-best tunnel to skip state, got %+v", state)
-	}
-
-	singleExit := map[string]interface{}{
-		"id":       int64(78),
-		"inNodeId": []map[string]interface{}{{"nodeId": int64(10)}},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-		},
-	}
-	if state, ok := buildBestExitDisplayState(singleExit, newBestExitManager(), testBestExitNameLookup(nil)); ok || state != nil {
-		t.Fatalf("expected single-exit tunnel to skip state, got %+v", state)
-	}
-}
-
-func testBestExitNameLookup(names map[int64]string) bestExitNodeNameLookup {
-	return func(nodeID int64) (string, bool) {
-		name := names[nodeID]
-		return name, name != ""
-	}
-}
-```
-
-- [ ] **Step 2: Run backend display tests to verify failure**
-
-Run from `go-backend`:
-
-```bash
-go test ./internal/http/handler -run 'TestBestExitDecisionSnapshot|TestBuildBestExitDisplayState' -count=1
-```
-
-Expected: FAIL with undefined `snapshot`, `buildBestExitDisplayState`, and `bestExitNodeNameLookup`.
-
----
-
-### Task 2: Backend Display State Implementation
-
-**Files:**
-- Create: `go-backend/internal/http/handler/tunnel_best_exit_display.go`
-- Modify: `go-backend/internal/http/handler/tunnel_best_exit.go`
-- Test: `go-backend/internal/http/handler/tunnel_best_exit_display_test.go`
-
-- [ ] **Step 1: Implement display state and snapshot helpers**
-
-Create `go-backend/internal/http/handler/tunnel_best_exit_display.go`:
-
-```go
-package handler
-
-import (
-	"log"
-	"strings"
-)
-
-const (
-	bestExitDisplayStatusApplied = "applied"
-	bestExitDisplayStatusWaiting = "waiting"
-	bestExitDisplaySummaryMulti  = "多个出口"
-	bestExitDisplaySummaryWait   = "等待探测"
-	bestExitUnknownExitName      = "未知出口"
-	bestExitUnknownEntryName     = "未知入口"
-	bestExitUnknownChainName     = "未知中转"
-)
-
-type bestExitDecisionSnapshot struct {
-	AppliedExitNodeID int64
-	UpdatedAt         int64
-	Reason            string
-	Scores            []bestExitCandidateScore
-}
-
-type bestExitDisplayState struct {
-	Enabled   bool                  `json:"enabled"`
-	Summary   string                `json:"summary"`
-	Status    string                `json:"status"`
-	UpdatedAt int64                 `json:"updatedAt,omitempty"`
-	Reason    string                `json:"reason,omitempty"`
-	Items     []bestExitDisplayItem `json:"items"`
-}
-
-type bestExitDisplayItem struct {
-	OwnerNodeID   int64  `json:"ownerNodeId"`
-	OwnerNodeName string `json:"ownerNodeName"`
-	OwnerRole     string `json:"ownerRole"`
-	ExitNodeID    int64  `json:"exitNodeId,omitempty"`
-	ExitNodeName  string `json:"exitNodeName"`
-	UpdatedAt     int64  `json:"updatedAt,omitempty"`
-	Reason        string `json:"reason,omitempty"`
-}
-
-type bestExitNodeNameLookup func(nodeID int64) (string, bool)
-
-func (m *bestExitManager) snapshot(key bestExitOwnerKey) (bestExitDecisionSnapshot, bool) {
-	if m == nil {
-		return bestExitDecisionSnapshot{}, false
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	d := m.decisions[key]
-	if d == nil {
-		return bestExitDecisionSnapshot{}, false
-	}
-	updatedAt := int64(0)
-	if !d.LastSwitchAt.IsZero() {
-		updatedAt = d.LastSwitchAt.UnixMilli()
-	}
-	return bestExitDecisionSnapshot{
-		AppliedExitNodeID: d.AppliedExitNodeID,
-		UpdatedAt:         updatedAt,
-		Reason:            d.LastReason,
-		Scores:            cloneBestExitScores(d.Scores),
-	}, true
-}
-
-func (h *Handler) attachBestExitStates(items []map[string]interface{}) {
-	if h == nil || len(items) == 0 {
-		return
-	}
-	lookup := h.bestExitNodeNameLookup()
-	for _, item := range items {
-		state, ok := buildBestExitDisplayState(item, h.bestExit, lookup)
-		if !ok {
-			delete(item, "bestExitState")
-			continue
-		}
-		item["bestExitState"] = state
-	}
-}
-
-func (h *Handler) bestExitNodeNameLookup() bestExitNodeNameLookup {
-	cache := map[int64]string{}
-	return func(nodeID int64) (string, bool) {
-		if nodeID <= 0 || h == nil {
-			return "", false
-		}
-		if name, ok := cache[nodeID]; ok {
-			return name, name != ""
-		}
-		node, err := h.getNodeRecord(nodeID)
-		if err != nil || node == nil {
-			cache[nodeID] = ""
-			return "", false
-		}
-		name := strings.TrimSpace(node.Name)
-		cache[nodeID] = name
-		return name, name != ""
-	}
-}
-
-func buildBestExitDisplayState(tunnel map[string]interface{}, manager *bestExitManager, lookup bestExitNodeNameLookup) (*bestExitDisplayState, bool) {
-	if tunnel == nil {
-		return nil, false
-	}
-	tunnelID := asInt64(tunnel["id"], 0)
-	outNodes := bestExitDisplayMapSlice(tunnel["outNodeId"])
-	if tunnelID <= 0 || len(outNodes) <= 1 {
-		return nil, false
-	}
-	if !isBestTunnelStrategy(asString(outNodes[0]["strategy"])) {
-		return nil, false
-	}
-
-	owners, ownerRole := bestExitDisplayOwners(tunnel)
-	state := &bestExitDisplayState{
-		Enabled: true,
-		Summary: bestExitDisplaySummaryWait,
-		Status:  bestExitDisplayStatusWaiting,
-		Items:   make([]bestExitDisplayItem, 0, len(owners)),
-	}
-
-	exitsByID := map[int64]map[string]interface{}{}
-	for _, exit := range outNodes {
-		if id := asInt64(exit["nodeId"], 0); id > 0 {
-			exitsByID[id] = exit
-		}
-	}
-	appliedExitIDs := map[int64]string{}
-	appliedCount := 0
-	latestUpdatedAt := int64(0)
-	latestReason := ""
-	for _, owner := range owners {
-		ownerNodeID := asInt64(owner["nodeId"], 0)
-		if ownerNodeID <= 0 {
-			continue
-		}
-		item := bestExitDisplayItem{
-			OwnerNodeID:   ownerNodeID,
-			OwnerNodeName: bestExitDisplayNodeName(owner, ownerNodeID, lookup, bestExitUnknownOwnerName(ownerRole)),
-			OwnerRole:     ownerRole,
-			ExitNodeName:  bestExitDisplaySummaryWait,
-			Reason:        bestExitDisplayStatusWaiting,
-		}
-		if snapshot, ok := manager.snapshot(bestExitOwnerKey{TunnelID: tunnelID, OwnerNodeID: ownerNodeID}); ok && snapshot.AppliedExitNodeID > 0 {
-			item.ExitNodeID = snapshot.AppliedExitNodeID
-			item.ExitNodeName = bestExitDisplayNodeName(exitsByID[snapshot.AppliedExitNodeID], snapshot.AppliedExitNodeID, lookup, bestExitUnknownExitName)
-			item.UpdatedAt = snapshot.UpdatedAt
-			item.Reason = snapshot.Reason
-			appliedExitIDs[item.ExitNodeID] = item.ExitNodeName
-			appliedCount++
-			if snapshot.UpdatedAt > latestUpdatedAt {
-				latestUpdatedAt = snapshot.UpdatedAt
-				latestReason = snapshot.Reason
-			}
-		}
-		state.Items = append(state.Items, item)
-	}
-
-	if appliedCount == 0 {
-		return state, true
-	}
-	state.Status = bestExitDisplayStatusApplied
-	state.UpdatedAt = latestUpdatedAt
-	state.Reason = latestReason
-	if len(appliedExitIDs) == 1 {
-		for _, name := range appliedExitIDs {
-			state.Summary = name
-		}
-	} else {
-		state.Summary = bestExitDisplaySummaryMulti
-	}
-	return state, true
-}
-
-func bestExitDisplayOwners(tunnel map[string]interface{}) ([]map[string]interface{}, string) {
-	chainGroups := bestExitDisplayChainGroups(tunnel["chainNodes"])
-	if len(chainGroups) > 0 {
-		return chainGroups[len(chainGroups)-1], "chain"
-	}
-	return bestExitDisplayMapSlice(tunnel["inNodeId"]), "entry"
-}
-
-func bestExitDisplayMapSlice(v interface{}) []map[string]interface{} {
-	switch arr := v.(type) {
-	case []map[string]interface{}:
-		return arr
-	case []interface{}:
-		out := make([]map[string]interface{}, 0, len(arr))
-		for _, item := range arr {
-			if m, ok := item.(map[string]interface{}); ok {
-				out = append(out, m)
-			}
-		}
-		return out
-	default:
-		return nil
-	}
-}
-
-func bestExitDisplayChainGroups(v interface{}) [][]map[string]interface{} {
-	switch groups := v.(type) {
-	case [][]map[string]interface{}:
-		return groups
-	case []interface{}:
-		out := make([][]map[string]interface{}, 0, len(groups))
-		for _, group := range groups {
-			items := bestExitDisplayMapSlice(group)
-			if len(items) > 0 {
-				out = append(out, items)
-			}
-		}
-		return out
-	default:
-		return nil
-	}
-}
-
-func bestExitDisplayNodeName(source map[string]interface{}, nodeID int64, lookup bestExitNodeNameLookup, fallback string) string {
-	if source != nil {
-		for _, key := range []string{"nodeName", "name"} {
-			if name := strings.TrimSpace(asString(source[key])); name != "" {
-				return name
-			}
-		}
-	}
-	if lookup != nil {
-		if name, ok := lookup(nodeID); ok && strings.TrimSpace(name) != "" {
-			return strings.TrimSpace(name)
-		}
-	}
-	return fallback
-}
-
-func bestExitUnknownOwnerName(role string) string {
-	if role == "chain" {
-		return bestExitUnknownChainName
-	}
-	return bestExitUnknownEntryName
-}
-
-func (h *Handler) attachBestExitStatesOrLog(items []map[string]interface{}) {
-	defer func() {
-		if recovered := recover(); recovered != nil {
-			log.Printf("best_exit: attach display state failed: %v", recovered)
-		}
-	}()
-	h.attachBestExitStates(items)
-}
-```
-
-- [ ] **Step 2: Replace direct attach calls with panic-safe wrapper**
-
-Keep `attachBestExitStates` for tests, and use `attachBestExitStatesOrLog` from handlers in Task 3. This step only creates the function above; no handler wiring yet.
-
-- [ ] **Step 3: Run backend display tests**
-
-Run from `go-backend`:
-
-```bash
-go test ./internal/http/handler -run 'TestBestExitDecisionSnapshot|TestBuildBestExitDisplayState' -count=1
-```
-
-Expected: PASS.
-
-- [ ] **Step 4: Run gofmt**
-
-```bash
-gofmt -w internal/http/handler/tunnel_best_exit_display.go internal/http/handler/tunnel_best_exit_display_test.go
-```
-
-- [ ] **Step 5: Commit backend display implementation**
-
-```bash
-git add go-backend/internal/http/handler/tunnel_best_exit_display.go go-backend/internal/http/handler/tunnel_best_exit_display_test.go
-git commit -m "feat: build best exit display state"
-```
-
----
-
-### Task 3: Attach Best-Exit State To Tunnel List And Get Responses
-
-**Files:**
-- Modify: `go-backend/internal/http/handler/handler.go`
-- Modify: `go-backend/internal/http/handler/mutations.go`
-- Test: `go-backend/internal/http/handler/tunnel_best_exit_display_test.go`
-
-- [ ] **Step 1: Write failing handler attach tests**
-
-Append to `go-backend/internal/http/handler/tunnel_best_exit_display_test.go`:
-
-```go
-func TestAttachBestExitStatesAddsStateToBestTunnelOnly(t *testing.T) {
-	h := &Handler{bestExit: newBestExitManager()}
-	now := time.Unix(300, 0)
-	h.bestExit.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}, 30, now)
-
-	items := []map[string]interface{}{
-		{
-			"id":       int64(77),
-			"inNodeId": []map[string]interface{}{{"nodeId": int64(10)}},
-			"outNodeId": []map[string]interface{}{
-				{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-				{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-			},
-		},
-		{
-			"id":       int64(78),
-			"inNodeId": []map[string]interface{}{{"nodeId": int64(12)}},
-			"outNodeId": []map[string]interface{}{
-				{"nodeId": int64(40), "strategy": "round"},
-				{"nodeId": int64(41), "strategy": "round"},
-			},
-		},
-	}
-
-	h.attachBestExitStates(items)
-	state, ok := items[0]["bestExitState"].(*bestExitDisplayState)
-	if !ok {
-		t.Fatalf("expected bestExitState on best tunnel, got %#v", items[0]["bestExitState"])
-	}
-	if state.Summary != bestExitUnknownExitName || state.Items[0].ExitNodeID != 30 {
-		t.Fatalf("unexpected state with fallback names: %+v", state)
-	}
-	if _, exists := items[1]["bestExitState"]; exists {
-		t.Fatalf("non-best tunnel should not have bestExitState: %+v", items[1])
-	}
-}
-```
-
-- [ ] **Step 2: Run attach test to verify failure**
-
-Run from `go-backend`:
-
-```bash
-go test ./internal/http/handler -run TestAttachBestExitStatesAddsStateToBestTunnelOnly -count=1
-```
-
-Expected: PASS.
-
-- [ ] **Step 3: Wire tunnel list response**
-
-In `go-backend/internal/http/handler/handler.go`, change `tunnelList` from:
-
-```go
-	items, err := h.repo.ListTunnels()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	response.WriteJSON(w, response.OK(items))
-```
-
-to:
-
-```go
-	items, err := h.repo.ListTunnels()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	h.attachBestExitStatesOrLog(items)
-	response.WriteJSON(w, response.OK(items))
-```
-
-- [ ] **Step 4: Wire single tunnel response**
-
-In `go-backend/internal/http/handler/mutations.go`, change `tunnelGet` from:
-
-```go
-	items, err := h.repo.ListTunnels()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	for _, it := range items {
-		if asInt64(it["id"], 0) == id {
-			response.WriteJSON(w, response.OK(it))
-			return
-		}
-	}
-```
-
-to:
-
-```go
-	items, err := h.repo.ListTunnels()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	h.attachBestExitStatesOrLog(items)
-	for _, it := range items {
-		if asInt64(it["id"], 0) == id {
-			response.WriteJSON(w, response.OK(it))
-			return
-		}
-	}
-```
-
-- [ ] **Step 5: Run focused backend tests**
-
-Run from `go-backend`:
-
-```bash
-go test ./internal/http/handler -run 'TestBestExitDecisionSnapshot|TestBuildBestExitDisplayState|TestAttachBestExitStatesAddsStateToBestTunnelOnly' -count=1
-```
-
-Expected: PASS.
-
-- [ ] **Step 6: Run gofmt**
-
-```bash
-gofmt -w internal/http/handler/handler.go internal/http/handler/mutations.go internal/http/handler/tunnel_best_exit_display.go internal/http/handler/tunnel_best_exit_display_test.go
-```
-
-- [ ] **Step 7: Commit response wiring**
-
-```bash
-git add go-backend/internal/http/handler/handler.go go-backend/internal/http/handler/mutations.go go-backend/internal/http/handler/tunnel_best_exit_display.go go-backend/internal/http/handler/tunnel_best_exit_display_test.go
-git commit -m "feat: expose best exit display state"
-```
-
----
-
-### Task 4: Frontend Tunnel List Display
-
-**Files:**
-- Modify: `vite-frontend/src/pages/tunnel.tsx`
-
-- [ ] **Step 1: Add TypeScript types**
-
-In `vite-frontend/src/pages/tunnel.tsx`, add these interfaces after `interface ChainTunnel`:
-
-```ts
-interface BestExitStateItem {
-  ownerNodeId: number;
-  ownerNodeName: string;
-  ownerRole: "entry" | "chain";
-  exitNodeId?: number;
-  exitNodeName: string;
-  updatedAt?: number;
-  reason?: string;
-}
-
-interface BestExitState {
-  enabled: boolean;
-  summary: string;
-  status: "applied" | "waiting";
-  updatedAt?: number;
-  reason?: string;
-  items: BestExitStateItem[];
-}
-```
-
-Then add the optional field to `interface Tunnel`:
-
-```ts
-  bestExitState?: BestExitState | null;
-```
-
-- [ ] **Step 2: Preserve API state during mapping**
-
-In `mapTunnelApiItems`, add `bestExitState` to the returned object:
-
-```ts
-    bestExitState:
-      tunnel.bestExitState && typeof tunnel.bestExitState === "object"
-        ? {
-            ...tunnel.bestExitState,
-            items: Array.isArray(tunnel.bestExitState.items)
-              ? tunnel.bestExitState.items
-              : [],
-          }
-        : null,
-```
-
-The mapped object should include this field before `createdTime` or immediately after it.
-
-- [ ] **Step 3: Add render helpers**
-
-Add these helper functions after `mapTunnelApiItems` and before `export default function TunnelPage()`:
-
-```tsx
-const bestExitOwnerRoleText = (role: BestExitStateItem["ownerRole"]) => {
-  return role === "chain" ? "中转" : "入口";
-};
-
-const bestExitDetailTitle = (state?: BestExitState | null) => {
-  if (!state?.enabled || !state.items?.length) {
-    return "";
-  }
-  return state.items
-    .map((item) => {
-      const ownerName = item.ownerNodeName || `${bestExitOwnerRoleText(item.ownerRole)} ${item.ownerNodeId}`;
-      const exitName = item.exitNodeName || "等待探测";
-      return `${ownerName} -> ${exitName}`;
-    })
-    .join("\n");
-};
-
-const renderBestExitState = (state?: BestExitState | null) => {
-  if (!state?.enabled) {
-    return null;
-  }
-  const title = bestExitDetailTitle(state);
-  const isWaiting = state.status === "waiting";
-
-  return (
-    <div
-      className={`mt-1 text-[11px] leading-4 ${
-        isWaiting
-          ? "text-default-500"
-          : "text-emerald-700 dark:text-emerald-300"
-      }`}
-      title={title || undefined}
-    >
-      最优出口：{state.summary || "等待探测"}
-    </div>
-  );
-};
-```
-
-- [ ] **Step 4: Render in table topology cell**
-
-In the table topology `<TableCell>` around line 1674, change the cell content from:
-
-```tsx
-                        <div className="flex items-center gap-1.5 text-xs">
-                          <span className="font-semibold text-primary-700 dark:text-primary-400">
-                            {tunnel.inNodeId?.length || 0}入口
-                          </span>
-                          <span className="text-default-400">→</span>
-                          <span className="font-semibold text-secondary-700 dark:text-secondary-400">
-                            {tunnel.type === 2
-                              ? tunnel.chainNodes?.length || 0
-                              : 0}
-                            跳
-                          </span>
-                          <span className="text-default-400">→</span>
-                          <span className="font-semibold text-success-700 dark:text-success-400">
-                            {tunnel.type === 2
-                              ? tunnel.outNodeId?.length || 0
-                              : tunnel.inNodeId?.length || 0}
-                            出口
-                          </span>
-                        </div>
-```
-
-to:
-
-```tsx
-                        <div>
-                          <div className="flex items-center gap-1.5 text-xs">
-                            <span className="font-semibold text-primary-700 dark:text-primary-400">
-                              {tunnel.inNodeId?.length || 0}入口
-                            </span>
-                            <span className="text-default-400">→</span>
-                            <span className="font-semibold text-secondary-700 dark:text-secondary-400">
-                              {tunnel.type === 2
-                                ? tunnel.chainNodes?.length || 0
-                                : 0}
-                              跳
-                            </span>
-                            <span className="text-default-400">→</span>
-                            <span className="font-semibold text-success-700 dark:text-success-400">
-                              {tunnel.type === 2
-                                ? tunnel.outNodeId?.length || 0
-                                : tunnel.inNodeId?.length || 0}
-                              出口
-                            </span>
-                          </div>
-                          {renderBestExitState(tunnel.bestExitState)}
-                        </div>
-```
-
-- [ ] **Step 5: Render in grid card topology section**
-
-In the grid card topology section, after the closing `</div>` for the topology row at the end of the block containing `出口` and before the enclosing border section closes, add:
-
-```tsx
-                                <div className="text-center">
-                                  {renderBestExitState(tunnel.bestExitState)}
-                                </div>
-```
-
-The result should put the best-exit summary under the entry -> hop -> exit row inside the topology section.
-
-- [ ] **Step 6: Run frontend build**
-
-Run from `vite-frontend`:
-
-```bash
-pnpm run build
-```
-
-Expected: PASS with `tsc && vite build` completing successfully.
-
-- [ ] **Step 7: Commit frontend display**
-
-```bash
-git add vite-frontend/src/pages/tunnel.tsx
-git commit -m "feat: show current best exit in tunnel list"
-```
-
----
-
-### Task 5: Full Verification And Review
-
-**Files:**
-- Verify only.
-
-- [ ] **Step 1: Run backend tests**
-
-Run from `go-backend`:
-
-```bash
-go test ./...
-```
-
-Expected: PASS.
-
-- [ ] **Step 2: Run frontend build**
-
-Run from `vite-frontend`:
-
-```bash
-pnpm run build
-```
-
-Expected: PASS.
-
-- [ ] **Step 3: Inspect final diff**
-
-Run from repository root:
-
-```bash
-git diff --stat origin/main...HEAD
-git diff -- go-backend/internal/http/handler/tunnel_best_exit_display.go go-backend/internal/http/handler/tunnel_best_exit_display_test.go go-backend/internal/http/handler/handler.go go-backend/internal/http/handler/mutations.go vite-frontend/src/pages/tunnel.tsx
-```
-
-Expected: Diff only adds best-exit display state, response attachment, frontend list display, and tests. It must not change best-exit scoring, switching, runtime chain update, or agent code.
-
-- [ ] **Step 4: Request final code review**
-
-Ask a reviewer to check:
-
-```text
-Review the best-exit current display implementation. Confirm it only exposes current in-memory best-exit state in tunnel list/get responses and renders it in the tunnel list. Verify it does not change routing, scoring, switching, persistence, or polling behavior.
-```
-
-Expected: No blocking findings.
-
----
-
-## Self-Review
-
-- Spec coverage: Backend response state is Task 2 and Task 3; direct vs final-hop owner semantics are covered by Task 1 tests; frontend list/grid display is Task 4; no polling and no routing changes are preserved by Task 5 review instructions.
-- Placeholder scan: The plan contains concrete files, function names, code blocks, commands, and expected outcomes.
-- Type consistency: `BestExitState`, `BestExitStateItem`, `bestExitDisplayState`, `bestExitDisplayItem`, `bestExitDecisionSnapshot`, and `bestExitNodeNameLookup` are defined before use and names match across tasks.

docs/superpowers/specs/2026-05-01-best-exit-current-display-design.md

@@ -1,156 +0,0 @@
-# Best Exit Current Selection Display Design
-
-## Goal
-
-When a tunnel uses the `best` multi-exit strategy, show the currently applied best exit in the tunnel list information. Users should be able to see which exit is currently selected without opening logs or diagnosing the tunnel manually.
-
-The display is informational only. It must not change routing, scoring, switching behavior, or the saved tunnel configuration.
-
-## Current Context
-
-- `3.0.0-beta6` adds `best` as a multi-exit strategy.
-- Runtime selection is stored in the backend `bestExitManager` in memory, keyed by `TunnelID + OwnerNodeID`.
-- Direct multi-entry tunnels make one independent best-exit decision per entry node.
-- Tunnels with intermediate chain hops make one independent best-exit decision per final-hop chain node before the exits.
-- `tunnelList` and `tunnelGet` currently return `repo.ListTunnels()` output directly, so frontend tunnel data only includes configured exits from the database, not the currently applied runtime choice.
-- The frontend tunnel page maps API items in `vite-frontend/src/pages/tunnel.tsx` and renders list information from that data.
-
-## User Decisions
-
-- Show the current best-exit choice in the tunnel list information.
-- Use a summary plus detail model for multiple owners.
-- Follow the existing tunnel list refresh cadence; do not add polling or a realtime stream in this phase.
-- Work text-only; no visual companion is needed.
-
-## Approach
-
-Extend the existing tunnel list/detail response with a lightweight runtime state object for `best` tunnels, then render that state beside the tunnel's exit/strategy information in the existing frontend list UI.
-
-This keeps the display close to the data users already inspect and avoids a separate API or extra frontend request.
-
-## Backend Design
-
-### Response Shape
-
-Add a `bestExitState` object to each tunnel item returned by `tunnelList` and `tunnelGet` when the tunnel has a multi-exit group whose strategy is `best`.
-
-Response shape:
-
-```json
-{
-  "enabled": true,
-  "summary": "香港节点",
-  "status": "applied",
-  "updatedAt": 1777584000000,
-  "reason": "current exit remains best",
-  "items": [
-    {
-      "ownerNodeId": 10,
-      "ownerNodeName": "入口 A",
-      "ownerRole": "entry",
-      "exitNodeId": 30,
-      "exitNodeName": "香港节点",
-      "updatedAt": 1777584000000,
-      "reason": "current exit remains best"
-    }
-  ]
-}
-```
-
-If the tunnel is not using `best`, omit `bestExitState` or set it to `null`.
-
-### Owner Semantics
-
-The display must match the routing model:
-
-- If there are no middle chain hops, each entry node is an owner.
-- If there are middle chain hops, each node in the final middle-hop group is an owner.
-
-Each owner can have a different current best exit. The UI must not imply that a multi-owner tunnel has one global best exit when the owners differ.
-
-### Summary Rules
-
-- If all owners currently apply the same exit, `summary` is that exit node name.
-- If owners apply different exits, `summary` is `多个出口`.
-- If no applied decision exists yet, `summary` is `等待探测`.
-- If the tunnel has only one exit, `bestExitState` is not needed because there is no dynamic choice.
-
-### State Source
-
-Use the in-memory `bestExitManager` as the source of currently applied decisions.
-
-Add a read-only snapshot method that returns defensive copies of decision state without exposing mutable internal slices. The handler should convert node IDs to display names from the existing tunnel response data first, then fall back to `h.getNodeRecord` only when the current response does not contain the node.
-
-The feature should not persist current choices to the database in this phase. A panel restart may reset the displayed runtime state to `等待探测` until the prober initializes it again from the current saved first exit.
-
-## Frontend Design
-
-Extend the tunnel item type with optional `bestExitState`.
-
-In the tunnel list, only render the current best-exit display when:
-
-- `bestExitState.enabled === true`, or
-- the tunnel has an exit group with `strategy === "best"` and the backend returns a waiting state.
-
-Display format:
-
-- Single applied exit: `最优出口：香港节点`
-- Multiple applied exits: `最优出口：多个出口`
-- Waiting: `最优出口：等待探测`
-
-For multiple owners, render the summary as compact secondary text in the topology/list information cell and set its native `title` attribute to newline-separated detail rows. This avoids adding a new UI dependency or a custom popover. Detail rows should use:
-
-```text
-入口 A -> 香港节点
-入口 B -> 日本节点
-```
-
-For tunnels with middle chain hops, label owners as chain nodes when useful:
-
-```text
-中转 M1 -> 香港节点
-中转 M2 -> 日本节点
-```
-
-Do not add a new periodic refresh. The display updates when the existing tunnel list is refreshed.
-
-## Error Handling
-
-- If the manager has no decision for an owner, show that owner as `等待探测`.
-- If an exit node ID no longer exists in the current tunnel response, show `未知出口` for that item and keep the list usable.
-- If an owner node ID no longer exists, show `未知入口` or `未知中转` based on the owner role.
-- If the backend cannot compute state for one tunnel, omit `bestExitState` for that tunnel and log the error; do not fail the whole tunnel list response.
-
-## Testing
-
-Backend tests:
-
-- `bestExitManager` snapshot returns applied exit IDs without exposing mutable manager state.
-- Direct multi-entry `best` tunnel produces one display item per entry owner.
-- Middle-hop tunnel produces one display item per final-hop owner.
-- Summary is the single exit name when all owners choose the same exit.
-- Summary is `多个出口` when owners choose different exits.
-- Summary is `等待探测` when no applied decision exists.
-- Non-`best` tunnels do not receive `bestExitState`.
-
-Frontend verification:
-
-- Tunnel list renders `最优出口：<name>` for a single applied exit.
-- Tunnel list renders `最优出口：多个出口` plus owner details for multiple applied exits.
-- Tunnel list renders `最优出口：等待探测` for waiting state.
-- `pnpm run build` passes.
-
-Verification commands:
-
-```bash
-(cd go-backend && go test ./...)
-(cd vite-frontend && pnpm run build)
-```
-
-## Non-Goals
-
-- Do not add a new realtime stream or polling loop.
-- Do not add a detailed best-exit scoring dashboard.
-- Do not persist current best-exit choices to the database.
-- Do not change switching thresholds, probing targets, or runtime chain update behavior.
-- Do not change existing non-`best` tunnel display behavior.

docs/superpowers/specs/2026-05-01-custom-best-exit-probe-target-design.md

@@ -1,180 +0,0 @@
-# Custom Best-Exit Probe Target Design
-
-Date: 2026-05-01
-Status: Approved design
-
-## Goal
-
-Allow each tunnel to define the TCP target used for exit-side quality probing instead of always probing `www.bing.com:443`.
-
-The custom target must be used consistently by:
-
-- `best` exit scoring: each exit probes the configured target to measure exit-to-public quality.
-- Tunnel quality monitoring: the existing exit-side quality check probes the same configured target.
-
-If a tunnel does not configure a target, behavior remains compatible with today: `www.bing.com:443`.
-
-## Non-Goals
-
-- Do not add HTTP/HTTPS request probing in this phase. The probe remains TCP host/port measurement.
-- Do not add a global default target setting in this phase.
-- Do not require existing tunnels to be edited or migrated manually.
-- Do not change the `best` switching thresholds, confirmation rounds, cooldowns, or runtime chain ordering semantics.
-- Do not add frontend test infrastructure.
-
-## User-Facing Behavior
-
-Each tunnel form gets a compact quality target section:
-
-- Host input, placeholder `www.bing.com`.
-- Port input, placeholder `443`.
-- Helper text: this target is used for tunnel quality detection and `best` optimal-exit scoring; leaving it empty uses `www.bing.com:443`.
-
-Tunnel list/get responses include the configured target so edit forms can round-trip it. The UI displays the effective target near quality/best-exit information as `测试目标：host:port`.
-
-## Data Model
-
-Add nullable/default-compatible fields to `model.Tunnel`:
-
-- `ProbeTargetHost string` mapped to `probe_target_host`, `type:text`, default `''`.
-- `ProbeTargetPort int` mapped to `probe_target_port`, default `0`.
-
-Effective target resolution:
-
-- If `ProbeTargetHost` is non-empty and `ProbeTargetPort` is valid, use it.
-- Otherwise use `www.bing.com:443`.
-
-The existing `TunnelQuality` persisted fields `exit_to_bing_latency` and `exit_to_bing_loss` remain unchanged for compatibility. They will semantically mean exit-to-configured-test-target after this change. API/UI labels should avoid saying `Bing` for new displays.
-
-## Validation
-
-On create/update:
-
-- Empty host and empty/zero port are allowed and mean default target.
-- If either host or port is set, validate both as a pair.
-- Host is trimmed and must not contain URL scheme, path, query, or whitespace.
-- Host can be a domain, IPv4, or IPv6 literal. Bracketed IPv6 input should be normalized by removing surrounding brackets.
-- Port must be an integer from `1` to `65535`.
-- Do not perform network probing during save; external network failures must not block configuration changes.
-
-Errors should be specific, for example:
-
-- `测试目标 Host 不能为空`
-- `测试目标端口必须是 1-65535`
-- `测试目标 Host 不能包含协议或路径`
-
-## Backend Flow
-
-Introduce a small value/helper near the tunnel quality and best-exit code:
-
-```go
-type tunnelProbeTarget struct {
-    Host string
-    Port int
-}
-```
-
-Helpers:
-
-- `defaultTunnelProbeTarget() tunnelProbeTarget` returns `www.bing.com:443`.
-- `normalizeTunnelProbeTarget(host string, port int) (tunnelProbeTarget, bool, error)` validates user input; the boolean indicates whether the user explicitly configured a target.
-- `effectiveTunnelProbeTarget(tunnel *model.Tunnel) tunnelProbeTarget` returns configured target or default.
-
-Use the effective target in `tunnelQualityProber.probeTunnel`:
-
-- Type 1 and unknown tunnel fallback probes entry node to effective target instead of hardcoded Bing.
-- Type 2 probes the selected/current exit node to effective target instead of hardcoded Bing.
-- `probeBestExitOwners` receives the effective target and passes it into best-exit owner scoring.
-
-Use the effective target in `evaluateBestExitOwner`:
-
-- Owner-to-exit measurement stays unchanged.
-- Exit-to-public measurement probes `target.Host:target.Port` instead of `bestExitPublicTargetHost:bestExitPublicTargetPort`.
-- The per-round public probe cache key must include node ID plus target host and port so future extensions cannot reuse measurements across different targets.
-
-## API Shape
-
-Tunnel list/get data includes:
-
-```json
-{
-  "probeTargetHost": "example.com",
-  "probeTargetPort": 443
-}
-```
-
-For old/default tunnels, return empty host and `0` to represent `use default`. The edit form must preserve default-as-empty unless the user explicitly saves a custom target.
-
-Quality monitoring response includes effective target display metadata:
-
-```json
-{
-  "probeTargetHost": "www.bing.com",
-  "probeTargetPort": 443
-}
-```
-
-Existing `exitToBingLatency` and `exitToBingLoss` keys stay to avoid breaking frontend and external consumers.
-
-## Frontend Flow
-
-Extend `ChainTunnel` only if needed for node-level data; the target belongs to the tunnel, so `Tunnel` and `TunnelForm` get:
-
-- `probeTargetHost?: string`
-- `probeTargetPort?: number`
-
-On edit:
-
-- Populate form fields from tunnel response.
-- Empty or zero means default target.
-
-On submit:
-
-- Trim host.
-- Convert blank port to `0`.
-- Send `probeTargetHost` and `probeTargetPort` with create/update payload.
-
-Display:
-
-- In the form helper, show default target behavior.
-- In quality/best-exit display areas, avoid `Bing` wording; prefer `测试目标` or the concrete `host:port`.
-
-## Error Handling
-
-- Invalid target input returns a normal API error envelope with a specific message.
-- Probe failures use existing quality error paths and best-exit scoring failure entries.
-- If all exit-to-target probes fail, best-exit behavior remains the same as today when all Bing probes fail: no valid best decision is applied from that round.
-
-## Testing
-
-Backend tests:
-
-- Normalize default target when host/port are empty.
-- Reject partial host/port configuration and invalid port ranges.
-- Reject host values with URL scheme/path/whitespace.
-- Create/update tunnel persists `probeTargetHost` and `probeTargetPort`.
-- `ListTunnels` returns target fields.
-- `tunnelQualityProber` uses configured target instead of `www.bing.com:443`.
-- `best` scoring uses configured target for exit-to-target probes.
-- Empty target preserves old default `www.bing.com:443` behavior.
-
-Frontend verification:
-
-- `pnpm run build` passes.
-- Manual UI check: create/edit tunnel with blank target and custom target, confirm payload and round-trip display.
-
-## Rollout And Compatibility
-
-- Existing tunnels continue using `www.bing.com:443` because empty target resolves to default.
-- SQLite/PostgreSQL schema changes are handled by existing auto-migration.
-- Historical `TunnelQuality` rows keep existing columns and are not rewritten.
-- No runtime agent change is required; the panel already performs these quality probes through existing node ping APIs.
-
-## Open Decisions
-
-None. User-approved decisions:
-
-- Per-tunnel fields are `host + port`.
-- The target applies to both `best` scoring and tunnel quality monitoring.
-- Probe type remains TCP host/port.
-- Empty target defaults to `www.bing.com:443`.

go-backend/Dockerfile

@@ -9,14 +9,10 @@ ARG TARGETOS
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} env ${TARGETARCH:+GOARCH=${TARGETARCH}} go build -o /out/paneld ./cmd/paneld
 
-FROM docker:27-cli AS dockercli
-
 FROM debian:bookworm-slim
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /out/paneld /app/paneld
-COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker
-COPY --from=dockercli /usr/local/libexec/docker/cli-plugins/docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose
 
 ENV SERVER_ADDR=:6365
 EXPOSE 6365

go-backend/internal/http/handler/control_plane.go

@@ -978,7 +978,6 @@ func (h *Handler) prepareTunnelDiagnosis(tunnelID int64) (string, string, []diag
 
 	ipPreference := h.repo.GetTunnelIPPreference(tunnelID)
 	protocol := strings.ToLower(strings.TrimSpace(tunnel.Protocol))
-	probeTarget := effectiveTunnelProbeTargetValues(tunnel.ProbeTargetHost, tunnel.ProbeTargetPort)
 	inNodes, chainHops, outNodes := splitChainNodeGroups(chainRows)
 	workItems := make([]diagnosisWorkItem, 0, len(chainRows)*2)
 
@@ -988,8 +987,8 @@ func (h *Handler) prepareTunnelDiagnosis(tunnelID int64) (string, string, []diag
 			description := fmt.Sprintf("入口(%s)->外网", inNode.NodeName)
 			workItems = append(workItems, diagnosisWorkItem{
 				fromNodeID:  inNode.NodeID,
-				targetIP:    probeTarget.Host,
-				targetPort:  probeTarget.Port,
+				targetIP:    "www.bing.com",
+				targetPort:  443,
 				description: description,
 				protocol:    "tcp",
 				metadata: map[string]interface{}{
@@ -1080,8 +1079,8 @@ func (h *Handler) prepareTunnelDiagnosis(tunnelID int64) (string, string, []diag
 			description := fmt.Sprintf("出口(%s)->外网", outNode.NodeName)
 			workItems = append(workItems, diagnosisWorkItem{
 				fromNodeID:  outNode.NodeID,
-				targetIP:    probeTarget.Host,
-				targetPort:  probeTarget.Port,
+				targetIP:    "www.bing.com",
+				targetPort:  443,
 				description: description,
 				protocol:    "tcp",
 				metadata: map[string]interface{}{
@@ -1094,8 +1093,8 @@ func (h *Handler) prepareTunnelDiagnosis(tunnelID int64) (string, string, []diag
 			description := fmt.Sprintf("入口(%s)->外网", inNode.NodeName)
 			workItems = append(workItems, diagnosisWorkItem{
 				fromNodeID:  inNode.NodeID,
-				targetIP:    probeTarget.Host,
-				targetPort:  probeTarget.Port,
+				targetIP:    "www.bing.com",
+				targetPort:  443,
 				description: description,
 				protocol:    "tcp",
 				metadata: map[string]interface{}{

go-backend/internal/http/handler/handler.go

@@ -46,7 +46,6 @@ type Handler struct {
 	jobsWG      sync.WaitGroup
 
 	upgradeMu                sync.Mutex
-	systemUpgradeMu          sync.Mutex
 	pendingUpgradeRedeploy   map[int64]struct{}
 	nodeOnlineRedeployAt     map[int64]time.Time
 	nodeOnlineRedeployQueued map[int64]struct{}
@@ -157,9 +156,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/config/update", h.updateConfigs)
 	mux.HandleFunc("/api/v1/config/update-single", h.updateSingleConfig)
 	mux.HandleFunc("/api/v1/system/storage", h.storageSummary)
-	mux.HandleFunc("/api/v1/system/version", h.systemVersion)
-	mux.HandleFunc("/api/v1/system/check-updates", h.systemCheckUpdates)
-	mux.HandleFunc("/api/v1/system/upgrade", h.systemUpgrade)
 	mux.HandleFunc("/api/v1/license/activate", h.licenseActivate)
 	mux.HandleFunc("/api/v1/backup/export", h.backupExport)
 	mux.HandleFunc("/api/v1/backup/import", h.backupImport)
@@ -479,7 +475,6 @@ func (h *Handler) tunnelList(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	h.attachBestExitStates(items)
 	response.WriteJSON(w, response.OK(items))
 }
 

go-backend/internal/http/handler/monitoring.go

@@ -234,22 +234,8 @@ func (h *Handler) monitorTunnelQualityHandler(w http.ResponseWriter, r *http.Req
 		return
 	}
 
-	targetsByTunnelID := map[int64]tunnelProbeTarget{}
-	if tunnels, listErr := h.repo.ListTunnels(); listErr == nil {
-		for _, item := range tunnels {
-			id := asInt64(item["id"], 0)
-			if id > 0 {
-				targetsByTunnelID[id] = effectiveTunnelProbeTargetValues(asString(item["probeTargetHost"]), asInt(item["probeTargetPort"], 0))
-			}
-		}
-	}
-
 	snapshots := make([]tunnelQualitySnapshot, 0, len(qualities))
 	for _, q := range qualities {
-		target := targetsByTunnelID[q.TunnelID]
-		if target.Host == "" {
-			target = defaultTunnelProbeTarget()
-		}
 		snapshots = append(snapshots, tunnelQualitySnapshot{
 			TunnelID:           q.TunnelID,
 			EntryToExitLatency: q.EntryToExitLatency,
@@ -260,8 +246,6 @@ func (h *Handler) monitorTunnelQualityHandler(w http.ResponseWriter, r *http.Req
 			ErrorMessage:       q.ErrorMessage,
 			Timestamp:          q.Timestamp,
 			ChainDetails:       q.ChainDetails,
-			ProbeTargetHost:    target.Host,
-			ProbeTargetPort:    target.Port,
 		})
 	}
 	response.WriteJSON(w, response.OK(snapshots))

go-backend/internal/http/handler/mutations.go

@@ -607,17 +607,6 @@ func (h *Handler) tunnelCreate(w http.ResponseWriter, r *http.Request) {
 	trafficRatio := asFloat(req["trafficRatio"], 1.0)
 	inIP := asString(req["inIp"])
 	ipPreference := asString(req["ipPreference"])
-	probeTarget, probeTargetConfigured, err := parseTunnelProbeTargetFromRequest(req)
-	if err != nil {
-		response.WriteJSON(w, response.ErrDefault(err.Error()))
-		return
-	}
-	probeTargetHost := ""
-	probeTargetPort := 0
-	if probeTargetConfigured {
-		probeTargetHost = probeTarget.Host
-		probeTargetPort = probeTarget.Port
-	}
 	now := time.Now().UnixMilli()
 	inx := h.repo.NextIndex("tunnel")
 	localDomain := h.federationLocalDomain()
@@ -696,19 +685,17 @@ func (h *Handler) tunnelCreate(w http.ResponseWriter, r *http.Request) {
 		tunnelProtocol = strings.TrimSpace(runtimeState.InNodes[0].Protocol)
 	}
 	tunnel := model.Tunnel{
-		Name:            name,
-		TrafficRatio:    trafficRatio,
-		Type:            typeVal,
-		Protocol:        tunnelProtocol,
-		Flow:            flow,
-		CreatedTime:     now,
-		UpdatedTime:     now,
-		Status:          status,
-		InIP:            tunnelInIP,
-		Inx:             inx,
-		IPPreference:    ipPreference,
-		ProbeTargetHost: probeTargetHost,
-		ProbeTargetPort: probeTargetPort,
+		Name:         name,
+		TrafficRatio: trafficRatio,
+		Type:         typeVal,
+		Protocol:     tunnelProtocol,
+		Flow:         flow,
+		CreatedTime:  now,
+		UpdatedTime:  now,
+		Status:       status,
+		InIP:         tunnelInIP,
+		Inx:          inx,
+		IPPreference: ipPreference,
 	}
 	if err := tx.Create(&tunnel).Error; err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
@@ -855,7 +842,6 @@ func (h *Handler) tunnelGet(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	h.attachBestExitStates(items)
 	for _, it := range items {
 		if asInt64(it["id"], 0) == id {
 			response.WriteJSON(w, response.OK(it))
@@ -884,30 +870,9 @@ func (h *Handler) tunnelUpdate(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("隧道ID不能为空"))
 		return
 	}
-	typeVal := asInt(req["type"], 1)
-	ipPreference := asString(req["ipPreference"])
-	_, hasProbeTargetHost := req["probeTargetHost"]
-	_, hasProbeTargetPort := req["probeTargetPort"]
-	probeTargetFieldsPresent := hasProbeTargetHost || hasProbeTargetPort
-	probeTargetHost := ""
-	probeTargetPort := 0
-	if probeTargetFieldsPresent {
-		probeTarget, probeTargetConfigured, err := parseTunnelProbeTargetFromRequest(req)
-		if err != nil {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		if probeTargetConfigured {
-			probeTargetHost = probeTarget.Host
-			probeTargetPort = probeTarget.Port
-		}
-	}
 	oldEntryNodeIDs, _ := h.tunnelEntryNodeIDs(id)
+	typeVal := asInt(req["type"], 1)
 	oldTunnel, _ := h.getTunnelRecord(id)
-	if !probeTargetFieldsPresent && oldTunnel != nil {
-		probeTargetHost = oldTunnel.ProbeTargetHost
-		probeTargetPort = oldTunnel.ProbeTargetPort
-	}
 	oldChainRows, _ := h.listChainNodesForTunnel(id)
 	if oldTunnel != nil && oldTunnel.Type == 2 && typeVal != 2 {
 		h.cleanupTunnelRuntime(id)
@@ -915,6 +880,7 @@ func (h *Handler) tunnelUpdate(w http.ResponseWriter, r *http.Request) {
 	h.cleanupFederationRuntime(id)
 
 	now := time.Now().UnixMilli()
+	ipPreference := asString(req["ipPreference"])
 	localDomain := h.federationLocalDomain()
 
 	runtimeState, err := h.prepareTunnelCreateState(h.repo.DB(), req, typeVal, id)
@@ -961,8 +927,6 @@ func (h *Handler) tunnelUpdate(w http.ResponseWriter, r *http.Request) {
 		inIp,
 		ipPreference,
 		updateProtocol,
-		probeTargetHost,
-		probeTargetPort,
 		now,
 	); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))

go-backend/internal/http/handler/system_upgrade.go

@@ -1,592 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"time"
-
-	"go-backend/internal/http/response"
-)
-
-const (
-	panelDeployDirEnv                 = "PANEL_DEPLOY_DIR"
-	panelBackendContainerEnv          = "PANEL_BACKEND_CONTAINER"
-	defaultPanelDeployDir             = "/opt/flvx-panel"
-	defaultPanelBackendName           = "flux-panel-backend"
-	dockerSocketPath                  = "/var/run/docker.sock"
-	maxSystemUpgradeComposeAssetBytes = 1 << 20
-	systemUpgradeMessage              = "升级 helper 已启动，面板服务将短暂重启"
-	systemUpgradeConflictError        = "已有面板升级任务执行中"
-)
-
-var safeBackendContainerPattern = regexp.MustCompile(`^[A-Za-z0-9_.-]+$`)
-var enableIPv6ComposePattern = regexp.MustCompile(`(?im)^\s*enable_ipv6\s*:\s*['"]?true['"]?\s*(?:#.*)?$`)
-var systemUpgradeReleaseBaseURL = githubHTMLBase
-
-type systemUpgradeExecutor struct {
-	deployDir        string
-	backendContainer string
-}
-
-type systemUpgradeCapabilityData struct {
-	Capable          bool     `json:"capable"`
-	Reasons          []string `json:"reasons"`
-	DeployDir        string   `json:"deployDir"`
-	BackendContainer string   `json:"backendContainer"`
-}
-
-type systemUpgradeReleaseData struct {
-	Version     string `json:"version"`
-	Name        string `json:"name"`
-	PublishedAt string `json:"publishedAt"`
-	Prerelease  bool   `json:"prerelease"`
-	Channel     string `json:"channel"`
-}
-
-type systemUpgradeVersionData struct {
-	CurrentVersion string                      `json:"currentVersion"`
-	LatestVersion  string                      `json:"latestVersion"`
-	HasUpdate      bool                        `json:"hasUpdate"`
-	Channel        string                      `json:"channel"`
-	Reason         string                      `json:"reason,omitempty"`
-	Capability     systemUpgradeCapabilityData `json:"capability"`
-}
-
-type systemUpgradeCheckData struct {
-	CurrentVersion string                      `json:"currentVersion"`
-	LatestVersion  string                      `json:"latestVersion"`
-	HasUpdate      bool                        `json:"hasUpdate"`
-	Channel        string                      `json:"channel"`
-	Capability     systemUpgradeCapabilityData `json:"capability"`
-	Releases       []systemUpgradeReleaseData  `json:"releases"`
-}
-
-type systemUpgradeRunData struct {
-	Version         string `json:"version"`
-	Channel         string `json:"channel"`
-	ComposeAsset    string `json:"composeAsset"`
-	HelperContainer string `json:"helperContainer"`
-	BackendImageID  string `json:"backendImageId"`
-	Message         string `json:"message"`
-}
-
-type systemUpgradeRequest struct {
-	Version string `json:"version"`
-	Channel string `json:"channel"`
-}
-
-func newSystemUpgradeExecutor() *systemUpgradeExecutor {
-	deployDir := strings.TrimSpace(os.Getenv(panelDeployDirEnv))
-	if deployDir == "" {
-		deployDir = defaultPanelDeployDir
-	}
-	backendContainer := strings.TrimSpace(os.Getenv(panelBackendContainerEnv))
-	if backendContainer == "" {
-		backendContainer = defaultPanelBackendName
-	}
-	return &systemUpgradeExecutor{deployDir: deployDir, backendContainer: backendContainer}
-}
-
-func currentPanelVersion() string {
-	version := strings.TrimSpace(os.Getenv("FLUX_VERSION"))
-	if version == "" {
-		return "dev"
-	}
-	return version
-}
-
-func validateBackendContainerName(value string) error {
-	if value == "" {
-		return fmt.Errorf("backend container name is empty")
-	}
-	if !safeBackendContainerPattern.MatchString(value) {
-		return fmt.Errorf("unsafe backend container name: %s", value)
-	}
-	return nil
-}
-
-func validateUpgradeVersion(value string) error {
-	if strings.TrimSpace(value) == "" {
-		return fmt.Errorf("upgrade version is empty")
-	}
-	for _, r := range value {
-		if r < 0x20 || r == 0x7f {
-			return fmt.Errorf("unsafe upgrade version: contains control character")
-		}
-	}
-	return nil
-}
-
-func (e *systemUpgradeExecutor) composePath() string {
-	return filepath.Join(e.deployDir, "docker-compose.yml")
-}
-func (e *systemUpgradeExecutor) envPath() string { return filepath.Join(e.deployDir, ".env") }
-
-func (e *systemUpgradeExecutor) capability(ctx context.Context) systemUpgradeCapabilityData {
-	reasons := make([]string, 0)
-	if !filepath.IsAbs(e.deployDir) {
-		reasons = append(reasons, "部署目录必须是绝对路径")
-	}
-	if err := validateBackendContainerName(e.backendContainer); err != nil {
-		reasons = append(reasons, err.Error())
-	}
-	if out, err := exec.CommandContext(ctx, "docker", "--version").CombinedOutput(); err != nil {
-		reasons = append(reasons, fmt.Sprintf("docker CLI不可用: %v: %s", err, strings.TrimSpace(string(out))))
-	}
-	if info, err := os.Stat(dockerSocketPath); err != nil {
-		reasons = append(reasons, "docker socket不可用: "+err.Error())
-	} else if info.IsDir() {
-		reasons = append(reasons, "docker socket路径不是文件")
-	}
-	if info, err := os.Stat(e.composePath()); err != nil {
-		reasons = append(reasons, "部署docker-compose.yml不可用: "+err.Error())
-	} else if info.IsDir() {
-		reasons = append(reasons, "部署docker-compose.yml不是文件")
-	}
-	if info, err := os.Stat(e.envPath()); err != nil {
-		reasons = append(reasons, "部署.env不可用: "+err.Error())
-	} else if info.IsDir() {
-		reasons = append(reasons, "部署.env不是文件")
-	}
-	if out, err := exec.CommandContext(ctx, "docker", "compose", "version").CombinedOutput(); err != nil {
-		reasons = append(reasons, fmt.Sprintf("docker compose不可用: %v: %s", err, strings.TrimSpace(string(out))))
-	}
-	if _, err := e.currentBackendImage(ctx); err != nil {
-		reasons = append(reasons, err.Error())
-	}
-
-	return systemUpgradeCapabilityData{
-		Capable:          len(reasons) == 0,
-		Reasons:          reasons,
-		DeployDir:        e.deployDir,
-		BackendContainer: e.backendContainer,
-	}
-}
-
-func (e *systemUpgradeExecutor) selectComposeAsset(current []byte) string {
-	if enableIPv6ComposePattern.Match(current) {
-		return "docker-compose-v6.yml"
-	}
-	return "docker-compose-v4.yml"
-}
-
-func (e *systemUpgradeExecutor) helperScript() string {
-	return `set -eu
-LOGFILE="$PANEL_DEPLOY_DIR/upgrade.log"
-log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOGFILE"; }
-
-cd "$PANEL_DEPLOY_DIR"
-echo "" > "$LOGFILE"
-log "开始面板升级"
-log "工作目录: $(pwd)"
-
-if [ ! -f docker-compose.yml ]; then
-  log "错误: docker-compose.yml 不存在"
-  exit 1
-fi
-if [ ! -f .env ]; then
-  log "错误: .env 不存在"
-  exit 1
-fi
-
-log "拉取新镜像..."
-if ! docker compose pull backend frontend 2>&1 | tee -a "$LOGFILE"; then
-  log "错误: 拉取镜像失败"
-  exit 1
-fi
-
-log "等待旧容器释放资源..."
-sleep 3
-
-log "重启服务（force-recreate）..."
-if ! docker compose up -d --force-recreate --remove-orphans backend frontend 2>&1 | tee -a "$LOGFILE"; then
-  log "错误: 重启服务失败"
-  exit 1
-fi
-
-log "升级完成"
-`
-}
-
-func (e *systemUpgradeExecutor) buildHelperRunArgs(imageID, helperName string) ([]string, error) {
-	if err := validateBackendContainerName(e.backendContainer); err != nil {
-		return nil, err
-	}
-	return []string{
-		"run", "-d", "--rm", "--name", helperName,
-		"--volumes-from", e.backendContainer,
-		"-v", dockerSocketPath + ":" + dockerSocketPath,
-		"-e", panelDeployDirEnv + "=" + e.deployDir,
-		"--entrypoint", "/bin/sh", imageID,
-		"-c", e.helperScript(),
-	}, nil
-}
-
-func (e *systemUpgradeExecutor) updateEnvVersion(envPath, version string) error {
-	if err := validateUpgradeVersion(version); err != nil {
-		return err
-	}
-	mode, err := fileModeOrDefault(envPath, 0o600)
-	if err != nil {
-		return err
-	}
-	data, err := os.ReadFile(envPath)
-	if err != nil {
-		return err
-	}
-	lines := strings.Split(string(data), "\n")
-	replaced := false
-	for i, line := range lines {
-		if strings.HasPrefix(line, "FLUX_VERSION=") {
-			lines[i] = "FLUX_VERSION=" + version
-			replaced = true
-		}
-	}
-	if !replaced {
-		trimmed := strings.TrimRight(strings.Join(lines, "\n"), "\n")
-		if trimmed == "" {
-			trimmed = "FLUX_VERSION=" + version
-		} else {
-			trimmed += "\nFLUX_VERSION=" + version
-		}
-		return writeFileWithMode(envPath, []byte(trimmed+"\n"), mode)
-	}
-	content := strings.TrimRight(strings.Join(lines, "\n"), "\n") + "\n"
-	return writeFileWithMode(envPath, []byte(content), mode)
-}
-
-func (e *systemUpgradeExecutor) backupFile(path string) (string, error) {
-	mode, err := fileModeOrDefault(path, 0o600)
-	if err != nil {
-		return "", err
-	}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return "", err
-	}
-	backupPath := path + ".upgrade.bak"
-	if err := writeFileWithMode(backupPath, data, mode); err != nil {
-		return "", err
-	}
-	return backupPath, nil
-}
-
-func (e *systemUpgradeExecutor) restoreBackup(path string) error {
-	backupPath := path + ".upgrade.bak"
-	mode, err := fileModeOrDefault(backupPath, 0o600)
-	if err != nil {
-		return err
-	}
-	data, err := os.ReadFile(backupPath)
-	if err != nil {
-		return err
-	}
-	return writeFileWithMode(path, data, mode)
-}
-
-func (e *systemUpgradeExecutor) restoreUpgradeBackups(paths ...string) error {
-	var errs []string
-	for _, path := range paths {
-		if err := e.restoreBackup(path); err != nil {
-			errs = append(errs, fmt.Sprintf("%s: %v", path, err))
-		}
-	}
-	if len(errs) > 0 {
-		return fmt.Errorf("%s", strings.Join(errs, "; "))
-	}
-	return nil
-}
-
-func (e *systemUpgradeExecutor) replaceCompose(path string, data []byte) error {
-	if len(bytes.TrimSpace(data)) == 0 {
-		return fmt.Errorf("compose asset is empty")
-	}
-	mode, err := fileModeOrDefault(path, 0o644)
-	if err != nil {
-		return err
-	}
-	return writeFileWithMode(path, data, mode)
-}
-
-func fileModeOrDefault(path string, fallback os.FileMode) (os.FileMode, error) {
-	info, err := os.Stat(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return fallback, nil
-		}
-		return 0, err
-	}
-	return info.Mode().Perm(), nil
-}
-
-func writeFileWithMode(path string, data []byte, mode os.FileMode) error {
-	if err := os.WriteFile(path, data, mode); err != nil {
-		return err
-	}
-	return os.Chmod(path, mode)
-}
-
-func (e *systemUpgradeExecutor) currentBackendImage(ctx context.Context) (string, error) {
-	if err := validateBackendContainerName(e.backendContainer); err != nil {
-		return "", err
-	}
-	out, err := exec.CommandContext(ctx, "docker", "inspect", "-f", "{{.Image}}", e.backendContainer).CombinedOutput()
-	if err != nil {
-		return "", fmt.Errorf("inspect backend image failed: %v: %s", err, strings.TrimSpace(string(out)))
-	}
-	imageID := strings.TrimSpace(string(out))
-	if imageID == "" {
-		return "", fmt.Errorf("backend image id is empty")
-	}
-	return imageID, nil
-}
-
-func (e *systemUpgradeExecutor) startHelper(ctx context.Context, imageID, helperName string) (string, error) {
-	args, err := e.buildHelperRunArgs(imageID, helperName)
-	if err != nil {
-		return "", err
-	}
-	out, err := exec.CommandContext(ctx, "docker", args...).CombinedOutput()
-	if err != nil {
-		return "", fmt.Errorf("start helper failed: %v: %s", err, strings.TrimSpace(string(out)))
-	}
-	containerID := strings.TrimSpace(string(out))
-	if containerID == "" {
-		containerID = helperName
-	}
-	return containerID, nil
-}
-
-func (h *Handler) downloadReleaseAsset(version, filename string) ([]byte, error) {
-	url := fmt.Sprintf("%s/%s/releases/download/%s/%s", strings.TrimRight(systemUpgradeReleaseBaseURL, "/"), githubRepo, version, filename)
-	client := &http.Client{Timeout: 60 * time.Second}
-	resp, err := client.Get(url)
-	if err != nil {
-		return nil, fmt.Errorf("下载%s失败: %v", filename, err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
-		return nil, fmt.Errorf("下载%s返回 %d: %s", filename, resp.StatusCode, strings.TrimSpace(string(body)))
-	}
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxSystemUpgradeComposeAssetBytes+1))
-	if err != nil {
-		return nil, fmt.Errorf("读取%s失败: %v", filename, err)
-	}
-	if len(body) > maxSystemUpgradeComposeAssetBytes {
-		return nil, fmt.Errorf("下载%s过大", filename)
-	}
-	if len(bytes.TrimSpace(body)) == 0 {
-		return nil, fmt.Errorf("下载%s内容为空", filename)
-	}
-	return body, nil
-}
-
-func releasesForChannel(releases []githubRelease, channel string) []systemUpgradeReleaseData {
-	channel = normalizeReleaseChannel(channel)
-	items := make([]systemUpgradeReleaseData, 0, len(releases))
-	for _, r := range releases {
-		if r.Draft {
-			continue
-		}
-		tag := strings.TrimSpace(r.TagName)
-		if tag == "" {
-			continue
-		}
-		itemChannel := releaseChannelFromTag(tag)
-		if itemChannel != channel {
-			continue
-		}
-		items = append(items, systemUpgradeReleaseData{
-			Version:     tag,
-			Name:        r.Name,
-			PublishedAt: r.PublishedAt,
-			Prerelease:  itemChannel == releaseChannelDev,
-			Channel:     itemChannel,
-		})
-	}
-	return items
-}
-
-func decodeSystemUpgradeRequest(r *http.Request, req *systemUpgradeRequest) error {
-	defer r.Body.Close()
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		return err
-	}
-	if len(bytes.TrimSpace(body)) == 0 {
-		return nil
-	}
-	decoder := json.NewDecoder(bytes.NewReader(body))
-	decoder.DisallowUnknownFields()
-	return decoder.Decode(req)
-}
-
-func systemUpgradeVersionResponse(current, channel, latest string, lookupErr error, capability systemUpgradeCapabilityData) systemUpgradeVersionData {
-	data := systemUpgradeVersionData{
-		CurrentVersion: current,
-		LatestVersion:  latest,
-		HasUpdate:      latest != "" && latest != current,
-		Channel:        channel,
-		Capability:     capability,
-	}
-	if lookupErr != nil {
-		data.LatestVersion = ""
-		data.HasUpdate = false
-		data.Reason = lookupErr.Error()
-	}
-	return data
-}
-
-func (h *Handler) systemVersion(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	channel := releaseChannelStable
-	current := currentPanelVersion()
-	exec := newSystemUpgradeExecutor()
-	capability := exec.capability(r.Context())
-	latest, err := resolveLatestReleaseByChannel(channel)
-	response.WriteJSON(w, response.OK(systemUpgradeVersionResponse(current, channel, latest, err, capability)))
-}
-
-func (h *Handler) systemCheckUpdates(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req systemUpgradeRequest
-	if err := decodeSystemUpgradeRequest(r, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	channel := normalizeReleaseChannel(req.Channel)
-	current := currentPanelVersion()
-	exec := newSystemUpgradeExecutor()
-	capability := exec.capability(r.Context())
-
-	githubReleases, err := fetchGitHubReleases(50)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: %v", err)))
-		return
-	}
-	releases := releasesForChannel(githubReleases, channel)
-	latest := ""
-	if len(releases) > 0 {
-		latest = releases[0].Version
-	}
-	response.WriteJSON(w, response.OK(systemUpgradeCheckData{
-		CurrentVersion: current,
-		LatestVersion:  latest,
-		HasUpdate:      latest != "" && latest != current,
-		Channel:        channel,
-		Capability:     capability,
-		Releases:       releases,
-	}))
-}
-
-func (h *Handler) systemUpgrade(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.systemUpgradeMu.TryLock() {
-		response.WriteJSON(w, response.ErrDefault(systemUpgradeConflictError))
-		return
-	}
-	defer h.systemUpgradeMu.Unlock()
-
-	var req systemUpgradeRequest
-	if err := decodeSystemUpgradeRequest(r, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	channel := normalizeReleaseChannel(req.Channel)
-	version := strings.TrimSpace(req.Version)
-	if version == "" {
-		var err error
-		version, err = resolveLatestReleaseByChannel(channel)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新%s失败: %v", releaseChannelLabel(channel), err)))
-			return
-		}
-	}
-
-	exec := newSystemUpgradeExecutor()
-	capability := exec.capability(r.Context())
-	if !capability.Capable {
-		response.WriteJSON(w, response.ErrDefault("当前环境不支持面板自升级: "+strings.Join(capability.Reasons, "; ")))
-		return
-	}
-	imageID, err := exec.currentBackendImage(r.Context())
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	composePath := exec.composePath()
-	envPath := exec.envPath()
-	composeData, err := os.ReadFile(composePath)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, "读取compose失败: "+err.Error()))
-		return
-	}
-	composeAsset := exec.selectComposeAsset(composeData)
-	newCompose, err := h.downloadReleaseAsset(version, composeAsset)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if _, err := exec.backupFile(composePath); err != nil {
-		response.WriteJSON(w, response.Err(-2, "备份compose失败: "+err.Error()))
-		return
-	}
-	if _, err := exec.backupFile(envPath); err != nil {
-		response.WriteJSON(w, response.Err(-2, "备份.env失败: "+err.Error()))
-		return
-	}
-	if err := exec.replaceCompose(composePath, newCompose); err != nil {
-		if restoreErr := exec.restoreUpgradeBackups(composePath, envPath); restoreErr != nil {
-			err = fmt.Errorf("%v; 回滚失败: %v", err, restoreErr)
-		}
-		response.WriteJSON(w, response.Err(-2, "替换compose失败: "+err.Error()))
-		return
-	}
-	if err := exec.updateEnvVersion(envPath, version); err != nil {
-		if restoreErr := exec.restoreUpgradeBackups(composePath, envPath); restoreErr != nil {
-			err = fmt.Errorf("%v; 回滚失败: %v", err, restoreErr)
-		}
-		response.WriteJSON(w, response.Err(-2, "更新版本配置失败: "+err.Error()))
-		return
-	}
-	helperName := fmt.Sprintf("flvx-upgrade-helper-%d", time.Now().Unix())
-	helperContainer, err := exec.startHelper(r.Context(), imageID, helperName)
-	if err != nil {
-		if restoreErr := exec.restoreUpgradeBackups(composePath, envPath); restoreErr != nil {
-			err = fmt.Errorf("%v; 回滚失败: %v", err, restoreErr)
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(systemUpgradeRunData{
-		Version:         version,
-		Channel:         channel,
-		ComposeAsset:    composeAsset,
-		HelperContainer: helperContainer,
-		BackendImageID:  imageID,
-		Message:         systemUpgradeMessage,
-	}))
-}

go-backend/internal/http/handler/system_upgrade_test.go

@@ -1,398 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func TestSelectComposeAssetUsesIPv6Template(t *testing.T) {
-	exec := &systemUpgradeExecutor{deployDir: "/opt/flvx-panel", backendContainer: "flux-panel-backend"}
-	compose := []byte("networks:\n  gost-network:\n    enable_ipv6: true\n")
-
-	if got := exec.selectComposeAsset(compose); got != "docker-compose-v6.yml" {
-		t.Fatalf("selectComposeAsset() = %q, want %q", got, "docker-compose-v6.yml")
-	}
-}
-
-func TestDownloadReleaseAssetUsesDirectReleaseURL(t *testing.T) {
-	var gotPath string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		_, _ = w.Write([]byte("services:\n  backend:\n    image: test\n"))
-	}))
-	defer server.Close()
-
-	originalBase := systemUpgradeReleaseBaseURL
-	systemUpgradeReleaseBaseURL = server.URL
-	t.Cleanup(func() { systemUpgradeReleaseBaseURL = originalBase })
-
-	h := &Handler{}
-	data, err := h.downloadReleaseAsset("2.1.9", "docker-compose-v4.yml")
-	if err != nil {
-		t.Fatalf("downloadReleaseAsset() error = %v", err)
-	}
-	if !strings.Contains(string(data), "backend") {
-		t.Fatalf("downloadReleaseAsset() data = %q, want compose data", string(data))
-	}
-
-	wantPath := "/" + githubRepo + "/releases/download/2.1.9/docker-compose-v4.yml"
-	if gotPath != wantPath {
-		t.Fatalf("download path = %q, want %q", gotPath, wantPath)
-	}
-}
-
-func TestDownloadReleaseAssetRejectsOversizedBody(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_, _ = w.Write(bytes.Repeat([]byte("a"), maxSystemUpgradeComposeAssetBytes+1))
-	}))
-	defer server.Close()
-
-	originalBase := systemUpgradeReleaseBaseURL
-	systemUpgradeReleaseBaseURL = server.URL
-	t.Cleanup(func() { systemUpgradeReleaseBaseURL = originalBase })
-
-	h := &Handler{}
-	_, err := h.downloadReleaseAsset("2.1.9", "docker-compose-v4.yml")
-	if err == nil || !strings.Contains(err.Error(), "过大") {
-		t.Fatalf("downloadReleaseAsset() error = %v, want oversized error", err)
-	}
-}
-
-func TestSelectComposeAssetUsesIPv6TemplateForYAMLVariants(t *testing.T) {
-	exec := &systemUpgradeExecutor{deployDir: "/opt/flvx-panel", backendContainer: "flux-panel-backend"}
-	for _, compose := range [][]byte{
-		[]byte("networks:\n  gost-network:\n    enable_ipv6:true\n"),
-		[]byte("networks:\n  gost-network:\n    enable_ipv6: True\n"),
-		[]byte("networks:\n  gost-network:\n    enable_ipv6: \"true\"\n"),
-		[]byte("networks:\n  gost-network:\n    enable_ipv6: 'true'\n"),
-		[]byte("networks:\n  gost-network:\n    enable_ipv6: true # comment\n"),
-	} {
-		if got := exec.selectComposeAsset(compose); got != "docker-compose-v6.yml" {
-			t.Fatalf("selectComposeAsset(%q) = %q, want %q", string(compose), got, "docker-compose-v6.yml")
-		}
-	}
-}
-
-func TestSelectComposeAssetFallsBackToIPv4Template(t *testing.T) {
-	exec := &systemUpgradeExecutor{deployDir: "/opt/flvx-panel", backendContainer: "flux-panel-backend"}
-	compose := []byte("services:\n  backend:\n    image: test\n")
-
-	if got := exec.selectComposeAsset(compose); got != "docker-compose-v4.yml" {
-		t.Fatalf("selectComposeAsset() = %q, want %q", got, "docker-compose-v4.yml")
-	}
-}
-
-func TestUpdateEnvVersionReplacesExistingValue(t *testing.T) {
-	dir := t.TempDir()
-	envPath := filepath.Join(dir, ".env")
-	if err := os.WriteFile(envPath, []byte("FLUX_VERSION=2.1.8\nJWT_SECRET=test\n"), 0o644); err != nil {
-		t.Fatalf("WriteFile() error = %v", err)
-	}
-
-	exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-	if err := exec.updateEnvVersion(envPath, "2.1.9"); err != nil {
-		t.Fatalf("updateEnvVersion() error = %v", err)
-	}
-
-	data, err := os.ReadFile(envPath)
-	if err != nil {
-		t.Fatalf("ReadFile() error = %v", err)
-	}
-
-	want := "FLUX_VERSION=2.1.9\nJWT_SECRET=test\n"
-	if string(data) != want {
-		t.Fatalf("env content = %q, want %q", string(data), want)
-	}
-}
-
-func TestUpdateEnvVersionAppendsMissingValue(t *testing.T) {
-	dir := t.TempDir()
-	envPath := filepath.Join(dir, ".env")
-	if err := os.WriteFile(envPath, []byte("JWT_SECRET=test\n"), 0o644); err != nil {
-		t.Fatalf("WriteFile() error = %v", err)
-	}
-
-	exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-	if err := exec.updateEnvVersion(envPath, "2.1.9"); err != nil {
-		t.Fatalf("updateEnvVersion() error = %v", err)
-	}
-
-	data, err := os.ReadFile(envPath)
-	if err != nil {
-		t.Fatalf("ReadFile() error = %v", err)
-	}
-
-	want := "JWT_SECRET=test\nFLUX_VERSION=2.1.9\n"
-	if string(data) != want {
-		t.Fatalf("env content = %q, want %q", string(data), want)
-	}
-}
-
-func TestUpdateEnvVersionRejectsUnsafeValue(t *testing.T) {
-	for _, version := range []string{"", "2.1.9\nJWT_SECRET=bad", "2.1.9\rbad", "2.1.9\x00bad", "2.1.9\x1fbad"} {
-		t.Run(version, func(t *testing.T) {
-			dir := t.TempDir()
-			envPath := filepath.Join(dir, ".env")
-			original := []byte("JWT_SECRET=test\n")
-			if err := os.WriteFile(envPath, original, 0o644); err != nil {
-				t.Fatalf("WriteFile() error = %v", err)
-			}
-
-			exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-			if err := exec.updateEnvVersion(envPath, version); err == nil {
-				t.Fatal("expected unsafe version to fail validation")
-			}
-
-			data, err := os.ReadFile(envPath)
-			if err != nil {
-				t.Fatalf("ReadFile() error = %v", err)
-			}
-			if string(data) != string(original) {
-				t.Fatalf("env content changed to %q, want %q", string(data), string(original))
-			}
-		})
-	}
-}
-
-func TestUpdateEnvVersionAcceptsVersionLabels(t *testing.T) {
-	for _, version := range []string{"2.1.9", "2.1.9-beta14", "v-test"} {
-		t.Run(version, func(t *testing.T) {
-			dir := t.TempDir()
-			envPath := filepath.Join(dir, ".env")
-			if err := os.WriteFile(envPath, []byte("JWT_SECRET=test\n"), 0o644); err != nil {
-				t.Fatalf("WriteFile() error = %v", err)
-			}
-
-			exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-			if err := exec.updateEnvVersion(envPath, version); err != nil {
-				t.Fatalf("updateEnvVersion() error = %v", err)
-			}
-		})
-	}
-}
-
-func TestUpdateEnvVersionPreservesFileMode(t *testing.T) {
-	dir := t.TempDir()
-	envPath := filepath.Join(dir, ".env")
-	if err := os.WriteFile(envPath, []byte("FLUX_VERSION=2.1.8\nJWT_SECRET=test\n"), 0o600); err != nil {
-		t.Fatalf("WriteFile() error = %v", err)
-	}
-
-	exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-	if err := exec.updateEnvVersion(envPath, "2.1.9"); err != nil {
-		t.Fatalf("updateEnvVersion() error = %v", err)
-	}
-
-	info, err := os.Stat(envPath)
-	if err != nil {
-		t.Fatalf("Stat() error = %v", err)
-	}
-	if got := info.Mode().Perm(); got != 0o600 {
-		t.Fatalf("env mode = %o, want 0600", got)
-	}
-}
-
-func TestValidateBackendContainerNameRejectsUnsafeValue(t *testing.T) {
-	if err := validateBackendContainerName("flux-panel-backend;rm -rf /"); err == nil {
-		t.Fatal("expected unsafe container name to fail validation")
-	}
-}
-
-func TestBuildHelperRunArgsUsesDetachedContainer(t *testing.T) {
-	exec := &systemUpgradeExecutor{deployDir: "/opt/flvx-panel", backendContainer: "flux-panel-backend"}
-	args, err := exec.buildHelperRunArgs("sha256:abc", "flvx-upgrade-helper")
-	if err != nil {
-		t.Fatalf("buildHelperRunArgs() error = %v", err)
-	}
-	want := []string{
-		"run", "-d", "--rm", "--name", "flvx-upgrade-helper",
-		"--volumes-from", "flux-panel-backend",
-		"-v", "/var/run/docker.sock:/var/run/docker.sock",
-		"-e", "PANEL_DEPLOY_DIR=/opt/flvx-panel",
-		"--entrypoint", "/bin/sh", "sha256:abc",
-		"-c", exec.helperScript(),
-	}
-
-	if !reflect.DeepEqual(args, want) {
-		t.Fatalf("buildHelperRunArgs() = %#v, want %#v", args, want)
-	}
-}
-
-func TestBuildHelperRunArgsRejectsUnsafeBackendContainer(t *testing.T) {
-	exec := &systemUpgradeExecutor{deployDir: "/opt/flvx-panel", backendContainer: "flux-panel-backend;rm -rf /"}
-	if _, err := exec.buildHelperRunArgs("sha256:abc", "flvx-upgrade-helper"); err == nil {
-		t.Fatal("expected unsafe backend container name to fail validation")
-	}
-}
-
-func TestSystemVersionRejectsWrongMethod(t *testing.T) {
-	h := &Handler{}
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/system/version", nil)
-	rr := httptest.NewRecorder()
-
-	h.systemVersion(rr, req)
-
-	if !strings.Contains(rr.Body.String(), "请求失败") {
-		t.Fatalf("expected wrong-method response, got %s", rr.Body.String())
-	}
-}
-
-func TestSystemUpgradeRejectsConcurrentRequests(t *testing.T) {
-	h := &Handler{}
-	h.systemUpgradeMu.Lock()
-	defer h.systemUpgradeMu.Unlock()
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/system/upgrade", strings.NewReader(`{"channel":"stable"}`))
-	rr := httptest.NewRecorder()
-
-	h.systemUpgrade(rr, req)
-
-	if !strings.Contains(rr.Body.String(), systemUpgradeConflictError) {
-		t.Fatalf("expected conflict message, got %s", rr.Body.String())
-	}
-}
-
-func TestSystemUpgradeFailsFastBeforeMutatingFiles(t *testing.T) {
-	dir := t.TempDir()
-	composePath := filepath.Join(dir, "docker-compose.yml")
-	envPath := filepath.Join(dir, ".env")
-	if err := os.WriteFile(composePath, []byte("services:\n  backend:\n    image: test\n"), 0o644); err != nil {
-		t.Fatalf("WriteFile() compose error = %v", err)
-	}
-	if err := os.WriteFile(envPath, []byte("FLUX_VERSION=2.1.8\nJWT_SECRET=test\n"), 0o600); err != nil {
-		t.Fatalf("WriteFile() env error = %v", err)
-	}
-
-	fakeDockerDir := t.TempDir()
-	fakeDockerPath := filepath.Join(fakeDockerDir, "docker")
-	fakeDockerScript := "#!/bin/sh\ncase \"$1\" in\n  --version)\n    echo 'Docker version 27.0.0'\n    exit 0\n    ;;&\n  compose)\n    if [ \"$2\" = version ]; then\n      echo 'Docker Compose version v2.33.0'\n      exit 0\n    fi\n    exit 0\n    ;;&\n  inspect)\n    echo 'No such object: flux-panel-backend' >&2\n    exit 1\n    ;;&\n  *)\n    exit 0\n    ;;&\n esac\n"
-	if err := os.WriteFile(fakeDockerPath, []byte(fakeDockerScript), 0o755); err != nil {
-		t.Fatalf("WriteFile() fake docker error = %v", err)
-	}
-	t.Setenv("PATH", fakeDockerDir+string(os.PathListSeparator)+os.Getenv("PATH"))
-	t.Setenv(panelDeployDirEnv, dir)
-	t.Setenv(panelBackendContainerEnv, "flux-panel-backend")
-
-	h := &Handler{}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/system/upgrade", strings.NewReader(`{"channel":"stable"}`))
-	rr := httptest.NewRecorder()
-
-	h.systemUpgrade(rr, req)
-
-	if !strings.Contains(rr.Body.String(), "当前环境不支持面板自升级") {
-		t.Fatalf("expected fail-fast capability error, got %s", rr.Body.String())
-	}
-	if _, err := os.Stat(composePath + ".upgrade.bak"); !os.IsNotExist(err) {
-		t.Fatalf("expected no compose backup, got err=%v", err)
-	}
-	if _, err := os.Stat(envPath + ".upgrade.bak"); !os.IsNotExist(err) {
-		t.Fatalf("expected no env backup, got err=%v", err)
-	}
-	composeData, err := os.ReadFile(composePath)
-	if err != nil {
-		t.Fatalf("ReadFile() compose error = %v", err)
-	}
-	if string(composeData) != "services:\n  backend:\n    image: test\n" {
-		t.Fatalf("compose mutated unexpectedly: %q", string(composeData))
-	}
-	envData, err := os.ReadFile(envPath)
-	if err != nil {
-		t.Fatalf("ReadFile() env error = %v", err)
-	}
-	if string(envData) != "FLUX_VERSION=2.1.8\nJWT_SECRET=test\n" {
-		t.Fatalf("env mutated unexpectedly: %q", string(envData))
-	}
-}
-
-func TestUpgradeBackupUsesStablePathAndRestoreRestoresOriginal(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "docker-compose.yml")
-	if err := os.WriteFile(path, []byte("original"), 0o644); err != nil {
-		t.Fatalf("WriteFile() error = %v", err)
-	}
-
-	exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-	backupPath, err := exec.backupFile(path)
-	if err != nil {
-		t.Fatalf("backupFile() error = %v", err)
-	}
-	if backupPath != path+".upgrade.bak" {
-		t.Fatalf("backup path = %q, want %q", backupPath, path+".upgrade.bak")
-	}
-	if err := os.WriteFile(path, []byte("mutated"), 0o644); err != nil {
-		t.Fatalf("WriteFile() error = %v", err)
-	}
-
-	if err := exec.restoreBackup(path); err != nil {
-		t.Fatalf("restoreBackup() error = %v", err)
-	}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("ReadFile() error = %v", err)
-	}
-	if string(data) != "original" {
-		t.Fatalf("restored content = %q, want original", string(data))
-	}
-}
-
-func TestRestoreBackupPreservesOriginalFileMode(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, ".env")
-	if err := os.WriteFile(path, []byte("FLUX_VERSION=2.1.8\nJWT_SECRET=test\n"), 0o600); err != nil {
-		t.Fatalf("WriteFile() error = %v", err)
-	}
-
-	exec := &systemUpgradeExecutor{deployDir: dir, backendContainer: "flux-panel-backend"}
-	if _, err := exec.backupFile(path); err != nil {
-		t.Fatalf("backupFile() error = %v", err)
-	}
-	if err := os.Remove(path); err != nil {
-		t.Fatalf("Remove() error = %v", err)
-	}
-	if err := exec.restoreBackup(path); err != nil {
-		t.Fatalf("restoreBackup() error = %v", err)
-	}
-
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf("Stat() error = %v", err)
-	}
-	if got := info.Mode().Perm(); got != 0o600 {
-		t.Fatalf("restored mode = %o, want 0600", got)
-	}
-}
-
-func TestDecodeSystemUpgradeRequestRejectsTruncatedJSON(t *testing.T) {
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/system/check-updates", strings.NewReader(`{"channel":"stable"`))
-	var payload systemUpgradeRequest
-
-	if err := decodeSystemUpgradeRequest(req, &payload); err == nil {
-		t.Fatal("expected truncated JSON to be rejected")
-	}
-}
-
-func TestDecodeSystemUpgradeRequestAllowsEmptyBody(t *testing.T) {
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/system/check-updates", strings.NewReader(""))
-	var payload systemUpgradeRequest
-
-	if err := decodeSystemUpgradeRequest(req, &payload); err != nil {
-		t.Fatalf("expected empty body to be accepted, got %v", err)
-	}
-}
-
-func TestSystemUpgradeVersionDataSurfacesLookupFailureReason(t *testing.T) {
-	data, err := json.Marshal(systemUpgradeVersionData{Reason: "GitHub unavailable"})
-	if err != nil {
-		t.Fatalf("Marshal() error = %v", err)
-	}
-	if !strings.Contains(string(data), `"reason":"GitHub unavailable"`) {
-		t.Fatalf("expected reason field in JSON, got %s", string(data))
-	}
-}

go-backend/internal/http/handler/tunnel_best_exit.go

@@ -57,12 +57,6 @@ type bestExitProbeResult struct {
 	err     error
 }
 
-type bestExitProbeCacheKey struct {
-	NodeID int64
-	Host   string
-	Port   int
-}
-
 type bestExitDecision struct {
 	AppliedExitNodeID          int64
 	PendingExitNodeID          int64
@@ -144,7 +138,7 @@ func sortBestExitScores(scores []bestExitCandidateScore) {
 	})
 }
 
-func evaluateBestExitOwner(owner chainNodeRecord, exits []chainNodeRecord, nodes map[int64]*nodeRecord, ipPreference string, options diagnosisExecOptions, target tunnelProbeTarget, ping bestExitProbeFunc) []bestExitCandidateScore {
+func evaluateBestExitOwner(owner chainNodeRecord, exits []chainNodeRecord, nodes map[int64]*nodeRecord, ipPreference string, options diagnosisExecOptions, ping bestExitProbeFunc) []bestExitCandidateScore {
 	scores := make([]bestExitCandidateScore, 0, len(exits))
 	if owner.NodeID <= 0 || len(exits) == 0 || ping == nil {
 		return scores
@@ -166,7 +160,7 @@ func evaluateBestExitOwner(owner chainNodeRecord, exits []chainNodeRecord, nodes
 			scores = append(scores, failedBestExitCandidate(owner.NodeID, exit, ownerErr.Error()))
 			continue
 		}
-		publicLatency, publicLoss, publicErr := ping(exit.NodeID, target.Host, target.Port, options)
+		publicLatency, publicLoss, publicErr := ping(exit.NodeID, bestExitPublicTargetHost, bestExitPublicTargetPort, options)
 		if publicErr != nil {
 			scores = append(scores, failedBestExitCandidate(owner.NodeID, exit, publicErr.Error()))
 			continue
@@ -199,15 +193,17 @@ func resolveBestExitProbeTarget(fromNode, targetNode *nodeRecord, preferredPort
 }
 
 func newBestExitRoundPinger(base bestExitProbeFunc) bestExitProbeFunc {
-	cache := make(map[bestExitProbeCacheKey]bestExitProbeResult)
+	cache := make(map[int64]bestExitProbeResult)
 	return func(nodeID int64, ip string, port int, options diagnosisExecOptions) (float64, float64, error) {
-		key := bestExitProbeCacheKey{NodeID: nodeID, Host: ip, Port: port}
-		if cached, ok := cache[key]; ok {
-			return cached.latency, cached.loss, cached.err
+		if ip == bestExitPublicTargetHost && port == bestExitPublicTargetPort {
+			if cached, ok := cache[nodeID]; ok {
+				return cached.latency, cached.loss, cached.err
+			}
+			lat, loss, err := base(nodeID, ip, port, options)
+			cache[nodeID] = bestExitProbeResult{latency: lat, loss: loss, err: err}
+			return lat, loss, err
 		}
-		lat, loss, err := base(nodeID, ip, port, options)
-		cache[key] = bestExitProbeResult{latency: lat, loss: loss, err: err}
-		return lat, loss, err
+		return base(nodeID, ip, port, options)
 	}
 }
 

go-backend/internal/http/handler/tunnel_best_exit_display.go

@@ -1,248 +0,0 @@
-package handler
-
-import (
-	"strings"
-)
-
-const (
-	bestExitDisplayStatusApplied = "applied"
-	bestExitDisplayStatusWaiting = "waiting"
-	bestExitDisplaySummaryMulti  = "多个出口"
-	bestExitDisplaySummaryWait   = "等待探测"
-	bestExitUnknownExitName      = "未知出口"
-	bestExitUnknownEntryName     = "未知入口"
-	bestExitUnknownChainName     = "未知中转"
-)
-
-type bestExitDecisionSnapshot struct {
-	AppliedExitNodeID int64
-	UpdatedAt         int64
-	Reason            string
-	Scores            []bestExitCandidateScore
-}
-
-type bestExitDisplayState struct {
-	Enabled   bool                  `json:"enabled"`
-	Summary   string                `json:"summary"`
-	Status    string                `json:"status"`
-	UpdatedAt int64                 `json:"updatedAt,omitempty"`
-	Reason    string                `json:"reason,omitempty"`
-	Items     []bestExitDisplayItem `json:"items"`
-}
-
-type bestExitDisplayItem struct {
-	OwnerNodeID   int64  `json:"ownerNodeId"`
-	OwnerNodeName string `json:"ownerNodeName"`
-	OwnerRole     string `json:"ownerRole"`
-	ExitNodeID    int64  `json:"exitNodeId,omitempty"`
-	ExitNodeName  string `json:"exitNodeName"`
-	UpdatedAt     int64  `json:"updatedAt,omitempty"`
-	Reason        string `json:"reason,omitempty"`
-}
-
-type bestExitNodeNameLookup func(nodeID int64) (string, bool)
-
-func (m *bestExitManager) snapshot(key bestExitOwnerKey) (bestExitDecisionSnapshot, bool) {
-	if m == nil {
-		return bestExitDecisionSnapshot{}, false
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	d := m.decisions[key]
-	if d == nil {
-		return bestExitDecisionSnapshot{}, false
-	}
-	updatedAt := int64(0)
-	if !d.LastSwitchAt.IsZero() {
-		updatedAt = d.LastSwitchAt.UnixMilli()
-	}
-	return bestExitDecisionSnapshot{
-		AppliedExitNodeID: d.AppliedExitNodeID,
-		UpdatedAt:         updatedAt,
-		Reason:            d.LastReason,
-		Scores:            cloneBestExitScores(d.Scores),
-	}, true
-}
-
-func (h *Handler) attachBestExitStates(items []map[string]interface{}) {
-	if h == nil || len(items) == 0 {
-		return
-	}
-	lookup := h.bestExitNodeNameLookup()
-	for _, item := range items {
-		state, ok := buildBestExitDisplayState(item, h.bestExit, lookup)
-		if !ok {
-			delete(item, "bestExitState")
-			continue
-		}
-		item["bestExitState"] = state
-	}
-}
-
-func (h *Handler) bestExitNodeNameLookup() bestExitNodeNameLookup {
-	cache := map[int64]string{}
-	return func(nodeID int64) (string, bool) {
-		if nodeID <= 0 || h == nil {
-			return "", false
-		}
-		if name, ok := cache[nodeID]; ok {
-			return name, name != ""
-		}
-		node, err := h.getNodeRecord(nodeID)
-		if err != nil || node == nil {
-			cache[nodeID] = ""
-			return "", false
-		}
-		name := strings.TrimSpace(node.Name)
-		cache[nodeID] = name
-		return name, name != ""
-	}
-}
-
-func buildBestExitDisplayState(tunnel map[string]interface{}, manager *bestExitManager, lookup bestExitNodeNameLookup) (*bestExitDisplayState, bool) {
-	if tunnel == nil {
-		return nil, false
-	}
-	tunnelID := asInt64(tunnel["id"], 0)
-	outNodes := bestExitDisplayMapSlice(tunnel["outNodeId"])
-	if tunnelID <= 0 || len(outNodes) <= 1 {
-		return nil, false
-	}
-	if !isBestTunnelStrategy(asString(outNodes[0]["strategy"])) {
-		return nil, false
-	}
-
-	owners, ownerRole := bestExitDisplayOwners(tunnel)
-	state := &bestExitDisplayState{
-		Enabled: true,
-		Summary: bestExitDisplaySummaryWait,
-		Status:  bestExitDisplayStatusWaiting,
-		Items:   make([]bestExitDisplayItem, 0, len(owners)),
-	}
-
-	exitsByID := map[int64]map[string]interface{}{}
-	for _, exit := range outNodes {
-		if id := asInt64(exit["nodeId"], 0); id > 0 {
-			exitsByID[id] = exit
-		}
-	}
-	appliedExitIDs := map[int64]string{}
-	appliedCount := 0
-	latestUpdatedAt := int64(0)
-	latestReason := ""
-	for _, owner := range owners {
-		ownerNodeID := asInt64(owner["nodeId"], 0)
-		if ownerNodeID <= 0 {
-			continue
-		}
-		item := bestExitDisplayItem{
-			OwnerNodeID:   ownerNodeID,
-			OwnerNodeName: bestExitDisplayNodeName(owner, ownerNodeID, lookup, bestExitUnknownOwnerName(ownerRole)),
-			OwnerRole:     ownerRole,
-			ExitNodeName:  bestExitDisplaySummaryWait,
-			Reason:        bestExitDisplayStatusWaiting,
-		}
-		if snapshot, ok := manager.snapshot(bestExitOwnerKey{TunnelID: tunnelID, OwnerNodeID: ownerNodeID}); ok && snapshot.AppliedExitNodeID > 0 {
-			exit, ok := exitsByID[snapshot.AppliedExitNodeID]
-			if !ok {
-				state.Items = append(state.Items, item)
-				continue
-			}
-			item.ExitNodeID = snapshot.AppliedExitNodeID
-			item.ExitNodeName = bestExitDisplayNodeName(exit, snapshot.AppliedExitNodeID, lookup, bestExitUnknownExitName)
-			item.UpdatedAt = snapshot.UpdatedAt
-			item.Reason = snapshot.Reason
-			appliedExitIDs[item.ExitNodeID] = item.ExitNodeName
-			appliedCount++
-			if snapshot.UpdatedAt > latestUpdatedAt {
-				latestUpdatedAt = snapshot.UpdatedAt
-				latestReason = snapshot.Reason
-			}
-		}
-		state.Items = append(state.Items, item)
-	}
-
-	if appliedCount == 0 {
-		return state, true
-	}
-	if appliedCount < len(state.Items) {
-		return state, true
-	}
-	state.Status = bestExitDisplayStatusApplied
-	state.UpdatedAt = latestUpdatedAt
-	state.Reason = latestReason
-	if len(appliedExitIDs) == 1 {
-		for _, name := range appliedExitIDs {
-			state.Summary = name
-		}
-	} else {
-		state.Summary = bestExitDisplaySummaryMulti
-	}
-	return state, true
-}
-
-func bestExitDisplayOwners(tunnel map[string]interface{}) ([]map[string]interface{}, string) {
-	chainGroups := bestExitDisplayChainGroups(tunnel["chainNodes"])
-	if len(chainGroups) > 0 {
-		return chainGroups[len(chainGroups)-1], "chain"
-	}
-	return bestExitDisplayMapSlice(tunnel["inNodeId"]), "entry"
-}
-
-func bestExitDisplayMapSlice(v interface{}) []map[string]interface{} {
-	switch arr := v.(type) {
-	case []map[string]interface{}:
-		return arr
-	case []interface{}:
-		out := make([]map[string]interface{}, 0, len(arr))
-		for _, item := range arr {
-			if m, ok := item.(map[string]interface{}); ok {
-				out = append(out, m)
-			}
-		}
-		return out
-	default:
-		return nil
-	}
-}
-
-func bestExitDisplayChainGroups(v interface{}) [][]map[string]interface{} {
-	switch groups := v.(type) {
-	case [][]map[string]interface{}:
-		return groups
-	case []interface{}:
-		out := make([][]map[string]interface{}, 0, len(groups))
-		for _, group := range groups {
-			items := bestExitDisplayMapSlice(group)
-			if len(items) > 0 {
-				out = append(out, items)
-			}
-		}
-		return out
-	default:
-		return nil
-	}
-}
-
-func bestExitDisplayNodeName(source map[string]interface{}, nodeID int64, lookup bestExitNodeNameLookup, fallback string) string {
-	if source != nil {
-		for _, key := range []string{"nodeName", "name"} {
-			if name := strings.TrimSpace(asString(source[key])); name != "" {
-				return name
-			}
-		}
-	}
-	if lookup != nil {
-		if name, ok := lookup(nodeID); ok && strings.TrimSpace(name) != "" {
-			return strings.TrimSpace(name)
-		}
-	}
-	return fallback
-}
-
-func bestExitUnknownOwnerName(role string) string {
-	if role == "chain" {
-		return bestExitUnknownChainName
-	}
-	return bestExitUnknownEntryName
-}

go-backend/internal/http/handler/tunnel_best_exit_display_test.go

@@ -1,383 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestBestExitDecisionSnapshotIsDefensiveCopy(t *testing.T) {
-	m := newBestExitManager()
-	key := bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}
-	now := time.Unix(100, 0)
-	score := scoreBestExitCandidate(10, chainNodeRecord{NodeID: 30, NodeName: "exit-a"}, 10, 0, 20, 0)
-
-	m.observeScores(key, []bestExitCandidateScore{score}, now)
-	snapshot, ok := m.snapshot(key)
-	if !ok {
-		t.Fatalf("expected snapshot")
-	}
-	if snapshot.AppliedExitNodeID != 30 || snapshot.UpdatedAt != now.UnixMilli() {
-		t.Fatalf("unexpected snapshot: %+v", snapshot)
-	}
-	if len(snapshot.Scores) != 1 {
-		t.Fatalf("expected one score in snapshot, got %+v", snapshot.Scores)
-	}
-	snapshot.Scores[0].ExitNodeID = 99
-
-	again, ok := m.snapshot(key)
-	if !ok {
-		t.Fatalf("expected second snapshot")
-	}
-	if again.Scores[0].ExitNodeID != 30 {
-		t.Fatalf("snapshot score mutation leaked into manager state: %+v", again.Scores)
-	}
-}
-
-func TestBuildBestExitDisplayStateForDirectMultiEntryOwners(t *testing.T) {
-	m := newBestExitManager()
-	now := time.Unix(100, 0)
-	m.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}, 30, now)
-	m.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 11}, 31, now.Add(time.Second))
-
-	tunnel := map[string]interface{}{
-		"id": int64(77),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-			{"nodeId": int64(11)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{},
-	}
-	names := map[int64]string{10: "入口 A", 11: "入口 B", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, m, testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected best exit state")
-	}
-	if !state.Enabled || state.Summary != "多个出口" || state.Status != "applied" {
-		t.Fatalf("unexpected state summary: %+v", state)
-	}
-	if state.UpdatedAt != now.Add(time.Second).UnixMilli() {
-		t.Fatalf("expected latest updatedAt, got %d", state.UpdatedAt)
-	}
-	if len(state.Items) != 2 {
-		t.Fatalf("expected two owner items, got %+v", state.Items)
-	}
-	if state.Items[0].OwnerRole != "entry" || state.Items[0].OwnerNodeName != "入口 A" || state.Items[0].ExitNodeName != "香港节点" {
-		t.Fatalf("unexpected first item: %+v", state.Items[0])
-	}
-	if state.Items[1].OwnerRole != "entry" || state.Items[1].OwnerNodeName != "入口 B" || state.Items[1].ExitNodeName != "日本节点" {
-		t.Fatalf("unexpected second item: %+v", state.Items[1])
-	}
-}
-
-func TestBuildBestExitDisplayStateForFinalChainHopOwners(t *testing.T) {
-	m := newBestExitManager()
-	now := time.Unix(200, 0)
-	m.setApplied(bestExitOwnerKey{TunnelID: 88, OwnerNodeID: 20}, 30, now)
-	m.setApplied(bestExitOwnerKey{TunnelID: 88, OwnerNodeID: 21}, 30, now.Add(time.Second))
-
-	tunnel := map[string]interface{}{
-		"id": int64(88),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{
-			{{"nodeId": int64(15), "inx": int64(0)}},
-			{{"nodeId": int64(20), "inx": int64(1)}, {"nodeId": int64(21), "inx": int64(1)}},
-		},
-	}
-	names := map[int64]string{20: "中转 M1", 21: "中转 M2", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, m, testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected best exit state")
-	}
-	if state.Summary != "香港节点" || state.Status != "applied" {
-		t.Fatalf("expected single-exit summary, got %+v", state)
-	}
-	if len(state.Items) != 2 {
-		t.Fatalf("expected two final-hop owner items, got %+v", state.Items)
-	}
-	if state.Items[0].OwnerRole != "chain" || state.Items[0].OwnerNodeName != "中转 M1" || state.Items[0].ExitNodeName != "香港节点" {
-		t.Fatalf("unexpected first chain owner item: %+v", state.Items[0])
-	}
-	if state.Items[1].OwnerRole != "chain" || state.Items[1].OwnerNodeName != "中转 M2" || state.Items[1].ExitNodeName != "香港节点" {
-		t.Fatalf("unexpected second chain owner item: %+v", state.Items[1])
-	}
-}
-
-func TestBuildBestExitDisplayStateWaitingWhenNoAppliedDecisionExists(t *testing.T) {
-	tunnel := map[string]interface{}{
-		"id": int64(77),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{},
-	}
-	names := map[int64]string{10: "入口 A", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, newBestExitManager(), testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected waiting best exit state")
-	}
-	if state.Summary != "等待探测" || state.Status != "waiting" {
-		t.Fatalf("expected waiting state, got %+v", state)
-	}
-	if len(state.Items) != 1 || state.Items[0].ExitNodeID != 0 || state.Items[0].ExitNodeName != "等待探测" {
-		t.Fatalf("unexpected waiting item: %+v", state.Items)
-	}
-}
-
-func TestBuildBestExitDisplayStateKeepsTopLevelWaitingWhenSomeOwnersPending(t *testing.T) {
-	m := newBestExitManager()
-	now := time.Unix(400, 0)
-	m.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}, 30, now)
-
-	tunnel := map[string]interface{}{
-		"id": int64(77),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-			{"nodeId": int64(11)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{},
-	}
-	names := map[int64]string{10: "入口 A", 11: "入口 B", 30: "香港节点", 31: "日本节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, m, testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected best exit state")
-	}
-	if state.Status != bestExitDisplayStatusWaiting || state.Summary != bestExitDisplaySummaryWait {
-		t.Fatalf("expected top-level waiting for partial owner state, got %+v", state)
-	}
-	if len(state.Items) != 2 {
-		t.Fatalf("expected two owner items, got %+v", state.Items)
-	}
-	if state.Items[0].ExitNodeID != 30 || state.Items[0].ExitNodeName != "香港节点" {
-		t.Fatalf("expected first owner applied details to remain visible, got %+v", state.Items[0])
-	}
-	if state.Items[1].ExitNodeID != 0 || state.Items[1].ExitNodeName != bestExitDisplaySummaryWait {
-		t.Fatalf("expected second owner waiting details, got %+v", state.Items[1])
-	}
-}
-
-func TestBuildBestExitDisplayStateIgnoresAppliedExitRemovedFromTunnel(t *testing.T) {
-	m := newBestExitManager()
-	now := time.Unix(500, 0)
-	m.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}, 99, now)
-
-	tunnel := map[string]interface{}{
-		"id": int64(77),
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": int64(10)},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-			{"nodeId": int64(31), "strategy": tunnelStrategyBest},
-		},
-		"chainNodes": [][]map[string]interface{}{},
-	}
-	names := map[int64]string{10: "入口 A", 30: "香港节点", 31: "日本节点", 99: "已删除节点"}
-
-	state, ok := buildBestExitDisplayState(tunnel, m, testBestExitNameLookup(names))
-	if !ok {
-		t.Fatalf("expected best exit state")
-	}
-	if state.Status != bestExitDisplayStatusWaiting || state.Summary != bestExitDisplaySummaryWait {
-		t.Fatalf("expected waiting state for stale applied exit, got %+v", state)
-	}
-	if len(state.Items) != 1 {
-		t.Fatalf("expected one item, got %+v", state.Items)
-	}
-	if state.Items[0].ExitNodeID != 0 || state.Items[0].ExitNodeName != bestExitDisplaySummaryWait {
-		t.Fatalf("expected stale exit to be ignored, got %+v", state.Items[0])
-	}
-}
-
-func TestBuildBestExitDisplayStateSkipsNonBestAndSingleExitTunnels(t *testing.T) {
-	nonBest := map[string]interface{}{
-		"id":       int64(77),
-		"inNodeId": []map[string]interface{}{{"nodeId": int64(10)}},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": "round"},
-			{"nodeId": int64(31), "strategy": "round"},
-		},
-	}
-	if state, ok := buildBestExitDisplayState(nonBest, newBestExitManager(), testBestExitNameLookup(nil)); ok || state != nil {
-		t.Fatalf("expected non-best tunnel to skip state, got %+v", state)
-	}
-
-	singleExit := map[string]interface{}{
-		"id":       int64(78),
-		"inNodeId": []map[string]interface{}{{"nodeId": int64(10)}},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": int64(30), "strategy": tunnelStrategyBest},
-		},
-	}
-	if state, ok := buildBestExitDisplayState(singleExit, newBestExitManager(), testBestExitNameLookup(nil)); ok || state != nil {
-		t.Fatalf("expected single-exit tunnel to skip state, got %+v", state)
-	}
-}
-
-func TestTunnelListAttachesBestExitStateOnlyForEligibleTunnels(t *testing.T) {
-	h := setupBestExitTunnelHandler(t)
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-	res := httptest.NewRecorder()
-	h.tunnelList(res, req)
-
-	var payload struct {
-		Code int              `json:"code"`
-		Data []map[string]any `json:"data"`
-	}
-	decodeBestExitTunnelResponse(t, res, &payload)
-	if payload.Code != 0 {
-		t.Fatalf("expected success response, got code %d", payload.Code)
-	}
-
-	bestTunnel := findTunnelResponseItem(t, payload.Data, 77)
-	if _, ok := bestTunnel["bestExitState"]; !ok {
-		t.Fatalf("expected eligible best multi-exit tunnel to include bestExitState: %+v", bestTunnel)
-	}
-
-	singleExitTunnel := findTunnelResponseItem(t, payload.Data, 78)
-	if _, ok := singleExitTunnel["bestExitState"]; ok {
-		t.Fatalf("expected single-exit tunnel to omit bestExitState: %+v", singleExitTunnel)
-	}
-
-	nonBestTunnel := findTunnelResponseItem(t, payload.Data, 79)
-	if _, ok := nonBestTunnel["bestExitState"]; ok {
-		t.Fatalf("expected non-best tunnel to omit bestExitState: %+v", nonBestTunnel)
-	}
-}
-
-func TestTunnelGetAttachesBestExitStateToSelectedTunnel(t *testing.T) {
-	h := setupBestExitTunnelHandler(t)
-
-	body := bytes.NewReader([]byte(`{"id":77}`))
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/get", body)
-	res := httptest.NewRecorder()
-	h.tunnelGet(res, req)
-
-	var payload struct {
-		Code int            `json:"code"`
-		Data map[string]any `json:"data"`
-	}
-	decodeBestExitTunnelResponse(t, res, &payload)
-	if payload.Code != 0 {
-		t.Fatalf("expected success response, got code %d", payload.Code)
-	}
-	if _, ok := payload.Data["bestExitState"]; !ok {
-		t.Fatalf("expected selected best multi-exit tunnel to include bestExitState: %+v", payload.Data)
-	}
-}
-
-func setupBestExitTunnelHandler(t *testing.T) *Handler {
-	t.Helper()
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-	h := New(r, "secret")
-	now := time.Now().UnixMilli()
-
-	insertNode := func(id int64, name string) {
-		t.Helper()
-		if err := r.DB().Exec(`
-			INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, id, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-	}
-	insertNode(10, "entry-a")
-	insertNode(30, "exit-a")
-	insertNode(31, "exit-b")
-	insertNode(32, "exit-c")
-
-	insertTunnel := func(id int64, name string) {
-		t.Helper()
-		if err := r.DB().Exec(`
-			INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, inx, ip_preference)
-			VALUES(?, ?, 1, 1, 'tls', 1, ?, ?, 1, ?, '')
-		`, id, name, now, now, id).Error; err != nil {
-			t.Fatalf("insert tunnel %s: %v", name, err)
-		}
-	}
-	insertTunnel(77, "best-multi")
-	insertTunnel(78, "best-single")
-	insertTunnel(79, "round-multi")
-
-	insertChain := func(tunnelID int64, chainType string, nodeID int64, strategy string, inx int64) {
-		t.Helper()
-		if err := r.DB().Exec(`
-			INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-			VALUES(?, ?, ?, 30001, ?, ?, 'tls')
-		`, tunnelID, chainType, nodeID, strategy, inx).Error; err != nil {
-			t.Fatalf("insert chain tunnel %d/%s/%d: %v", tunnelID, chainType, nodeID, err)
-		}
-	}
-	insertChain(77, "1", 10, "round", 1)
-	insertChain(77, "3", 30, tunnelStrategyBest, 1)
-	insertChain(77, "3", 31, tunnelStrategyBest, 2)
-	insertChain(78, "1", 10, "round", 1)
-	insertChain(78, "3", 30, tunnelStrategyBest, 1)
-	insertChain(79, "1", 10, "round", 1)
-	insertChain(79, "3", 31, "round", 1)
-	insertChain(79, "3", 32, "round", 2)
-
-	h.bestExit.setApplied(bestExitOwnerKey{TunnelID: 77, OwnerNodeID: 10}, 30, time.UnixMilli(now))
-	return h
-}
-
-func decodeBestExitTunnelResponse(t *testing.T, res *httptest.ResponseRecorder, v any) {
-	t.Helper()
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected HTTP %d, got %d", http.StatusOK, res.Code)
-	}
-	if err := json.NewDecoder(res.Body).Decode(v); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-}
-
-func findTunnelResponseItem(t *testing.T, items []map[string]any, id float64) map[string]any {
-	t.Helper()
-	for _, item := range items {
-		if item["id"] == id {
-			return item
-		}
-	}
-	t.Fatalf("tunnel %.0f not found in response: %+v", id, items)
-	return nil
-}
-
-func testBestExitNameLookup(names map[int64]string) bestExitNodeNameLookup {
-	return func(nodeID int64) (string, bool) {
-		name := names[nodeID]
-		return name, name != ""
-	}
-}

go-backend/internal/http/handler/tunnel_best_exit_test.go

@@ -2,9 +2,6 @@ package handler
 
 import (
 	"errors"
-	"fmt"
-	"slices"
-	"strings"
 	"testing"
 	"time"
 )
@@ -192,7 +189,7 @@ func TestBestExitEnsureAppliedDoesNotOverrideExistingAppliedExit(t *testing.T) {
 	}
 }
 
-func TestBestExitRoundPingerCachesByNodeHostAndPort(t *testing.T) {
+func TestBestExitRoundPingerCachesPublicProbeOnly(t *testing.T) {
 	publicCalls := 0
 	ownerCalls := 0
 	pinger := newBestExitRoundPinger(func(nodeID int64, ip string, port int, _ diagnosisExecOptions) (float64, float64, error) {
@@ -223,8 +220,8 @@ func TestBestExitRoundPingerCachesByNodeHostAndPort(t *testing.T) {
 	if _, _, err := pinger(10, "10.0.0.30", 30030, diagnosisExecOptions{}); err != nil {
 		t.Fatalf("unexpected repeated owner ping err=%v", err)
 	}
-	if ownerCalls != 1 {
-		t.Fatalf("expected owner-to-exit probes cached by target, got %d calls", ownerCalls)
+	if ownerCalls != 2 {
+		t.Fatalf("expected owner-to-exit probes not cached, got %d calls", ownerCalls)
 	}
 }
 
@@ -378,7 +375,7 @@ func TestEvaluateBestExitOwnerScoresAllCandidates(t *testing.T) {
 		}
 	}
 
-	scores := evaluateBestExitOwner(owner, exits, nodes, "", diagnosisExecOptions{}, defaultTunnelProbeTarget(), pinger)
+	scores := evaluateBestExitOwner(owner, exits, nodes, "", diagnosisExecOptions{}, pinger)
 	if len(scores) != 2 {
 		t.Fatalf("expected two scores, got %+v", scores)
 	}
@@ -387,34 +384,6 @@ func TestEvaluateBestExitOwnerScoresAllCandidates(t *testing.T) {
 	}
 }
 
-func TestEvaluateBestExitOwnerUsesConfiguredPublicProbeTarget(t *testing.T) {
-	owner := chainNodeRecord{NodeID: 10, NodeName: "entry-a"}
-	exits := []chainNodeRecord{{NodeID: 30, NodeName: "exit-a", Port: 30001}}
-	nodes := map[int64]*nodeRecord{
-		10: {ID: 10, Name: "entry-a", ServerIP: "10.0.0.10", ServerIPv4: "10.0.0.10"},
-		30: {ID: 30, Name: "exit-a", ServerIP: "10.0.0.30", ServerIPv4: "10.0.0.30"},
-	}
-	target := tunnelProbeTarget{Host: "speed.example.com", Port: 8443}
-	var calls []string
-	ping := func(nodeID int64, ip string, port int, options diagnosisExecOptions) (float64, float64, error) {
-		calls = append(calls, fmt.Sprintf("%d|%s|%d", nodeID, ip, port))
-		return 10, 0, nil
-	}
-
-	scores := evaluateBestExitOwner(owner, exits, nodes, "", diagnosisExecOptions{}, target, ping)
-	if len(scores) != 1 || !scores[0].Success {
-		t.Fatalf("expected successful score, got %+v", scores)
-	}
-	if !slices.Contains(calls, "30|speed.example.com|8443") {
-		t.Fatalf("expected exit public probe to use configured target, calls=%+v", calls)
-	}
-	for _, call := range calls {
-		if strings.Contains(call, defaultTunnelProbeTargetHost) {
-			t.Fatalf("did not expect default target call when custom target configured: %+v", calls)
-		}
-	}
-}
-
 func TestEvaluateBestExitOwnerMarksCandidateFailedWhenOwnerToExitFails(t *testing.T) {
 	owner := chainNodeRecord{NodeID: 10, NodeName: "entry"}
 	exits := []chainNodeRecord{{NodeID: 30, NodeName: "exit-a", Port: 30030}}
@@ -426,7 +395,7 @@ func TestEvaluateBestExitOwnerMarksCandidateFailedWhenOwnerToExitFails(t *testin
 		return 0, 100, errBestExitProbeForTest
 	}
 
-	scores := evaluateBestExitOwner(owner, exits, nodes, "", diagnosisExecOptions{}, defaultTunnelProbeTarget(), pinger)
+	scores := evaluateBestExitOwner(owner, exits, nodes, "", diagnosisExecOptions{}, pinger)
 	if len(scores) != 1 || scores[0].Success {
 		t.Fatalf("expected failed candidate, got %+v", scores)
 	}
@@ -444,7 +413,7 @@ func TestEvaluateBestExitOwnerMarksCandidateFailedWhenTargetResolutionFails(t *t
 		return 0, 100, nil
 	}
 
-	scores := evaluateBestExitOwner(owner, exits, nodes, "v4", diagnosisExecOptions{}, defaultTunnelProbeTarget(), pinger)
+	scores := evaluateBestExitOwner(owner, exits, nodes, "v4", diagnosisExecOptions{}, pinger)
 	if len(scores) != 1 || scores[0].Success {
 		t.Fatalf("expected failed candidate, got %+v", scores)
 	}

go-backend/internal/http/handler/tunnel_probe_target.go

@@ -1,222 +0,0 @@
-package handler
-
-import (
-	"errors"
-	"fmt"
-	"net/netip"
-	"strconv"
-	"strings"
-
-	"go-backend/internal/store/model"
-)
-
-const (
-	defaultTunnelProbeTargetHost = "www.bing.com"
-	defaultTunnelProbeTargetPort = 443
-)
-
-type tunnelProbeTarget struct {
-	Host string
-	Port int
-}
-
-func defaultTunnelProbeTarget() tunnelProbeTarget {
-	return tunnelProbeTarget{Host: defaultTunnelProbeTargetHost, Port: defaultTunnelProbeTargetPort}
-}
-
-func normalizeTunnelProbeTarget(host string, port int) (tunnelProbeTarget, bool, error) {
-	host = strings.TrimSpace(host)
-	if host == "" && port == 0 {
-		return defaultTunnelProbeTarget(), false, nil
-	}
-	if host == "" {
-		return tunnelProbeTarget{}, false, errors.New("测试目标 Host 不能为空")
-	}
-	if port <= 0 || port > 65535 {
-		return tunnelProbeTarget{}, false, errors.New("测试目标端口必须是 1-65535")
-	}
-	if strings.Contains(host, "://") || strings.ContainsAny(host, "/?#") || strings.ContainsAny(host, " \t\r\n") || isTunnelProbeTargetSchemeLikeHost(host) {
-		return tunnelProbeTarget{}, false, errors.New("测试目标 Host 不能包含协议或路径")
-	}
-	if normalized, ok := normalizeTunnelProbeTargetHost(host); ok {
-		host = normalized
-	} else {
-		return tunnelProbeTarget{}, false, errors.New("测试目标 Host 格式无效")
-	}
-
-	return tunnelProbeTarget{Host: host, Port: port}, true, nil
-}
-
-func normalizeTunnelProbeTargetHost(host string) (string, bool) {
-	if strings.HasPrefix(host, "[") || strings.HasSuffix(host, "]") {
-		if !strings.HasPrefix(host, "[") || !strings.HasSuffix(host, "]") {
-			return "", false
-		}
-		inner := strings.TrimPrefix(strings.TrimSuffix(host, "]"), "[")
-		addr, err := netip.ParseAddr(inner)
-		if err != nil || !addr.Is6() {
-			return "", false
-		}
-		return inner, true
-	}
-
-	if addr, err := netip.ParseAddr(host); err == nil {
-		return addr.String(), true
-	}
-	if strings.Contains(host, ":") || isTunnelProbeTargetIPv4Like(host) {
-		return "", false
-	}
-	if !isValidTunnelProbeTargetHost(host) {
-		return "", false
-	}
-	return host, true
-}
-
-func isValidTunnelProbeTargetHost(host string) bool {
-	if host == "" || len(host) > 253 {
-		return false
-	}
-	for _, label := range strings.Split(host, ".") {
-		if len(label) == 0 || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
-			return false
-		}
-		for _, r := range label {
-			if !isASCIILetter(r) && !isASCIIDigit(r) && r != '-' {
-				return false
-			}
-		}
-	}
-	return true
-}
-
-func isTunnelProbeTargetIPv4Like(host string) bool {
-	if host == "" {
-		return false
-	}
-	for _, r := range host {
-		if !isASCIIDigit(r) && r != '.' {
-			return false
-		}
-	}
-	return strings.Contains(host, ".")
-}
-
-func isTunnelProbeTargetSchemeLikeHost(host string) bool {
-	if _, err := netip.ParseAddr(host); err == nil {
-		return false
-	}
-
-	colon := strings.IndexByte(host, ':')
-	if colon <= 0 {
-		return false
-	}
-	for i, r := range host[:colon] {
-		if i == 0 {
-			if !isASCIILetter(r) {
-				return false
-			}
-			continue
-		}
-		if !isASCIILetter(r) && !isASCIIDigit(r) && r != '+' && r != '-' && r != '.' {
-			return false
-		}
-	}
-	return true
-}
-
-func isASCIILetter(r rune) bool {
-	return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z')
-}
-
-func isASCIIDigit(r rune) bool {
-	return r >= '0' && r <= '9'
-}
-
-func parseTunnelProbeTargetFromRequest(req map[string]interface{}) (tunnelProbeTarget, bool, error) {
-	if req == nil {
-		return defaultTunnelProbeTarget(), false, nil
-	}
-	rawHost, hasHost := req["probeTargetHost"]
-	rawPort, hasPort := req["probeTargetPort"]
-	if !hasHost && !hasPort {
-		return defaultTunnelProbeTarget(), false, nil
-	}
-	host, err := parseTunnelProbeTargetHostValue(rawHost)
-	if err != nil {
-		return tunnelProbeTarget{}, false, err
-	}
-	port, err := parseTunnelProbeTargetPortValue(rawPort)
-	if err != nil {
-		return tunnelProbeTarget{}, false, err
-	}
-	return normalizeTunnelProbeTarget(host, port)
-}
-
-func parseTunnelProbeTargetHostValue(raw interface{}) (string, error) {
-	if raw == nil {
-		return "", nil
-	}
-	host, ok := raw.(string)
-	if !ok {
-		return "", errors.New("测试目标 Host 格式无效")
-	}
-	if host != strings.TrimSpace(host) {
-		return "", errors.New("测试目标 Host 不能包含协议或路径")
-	}
-	return host, nil
-}
-
-func parseTunnelProbeTargetPortValue(raw interface{}) (int, error) {
-	if raw == nil {
-		return 0, nil
-	}
-	switch v := raw.(type) {
-	case float64:
-		if v != float64(int64(v)) {
-			return 0, errors.New("测试目标端口必须是整数")
-		}
-		return int(v), nil
-	case string:
-		if v == "" {
-			return 0, nil
-		}
-		if v != strings.TrimSpace(v) {
-			return 0, errors.New("测试目标端口必须是整数")
-		}
-		port, err := strconv.Atoi(v)
-		if err != nil {
-			return 0, errors.New("测试目标端口必须是整数")
-		}
-		return port, nil
-	case int:
-		return v, nil
-	case int32:
-		return int(v), nil
-	case int64:
-		return int(v), nil
-	default:
-		return 0, errors.New("测试目标端口必须是整数")
-	}
-}
-
-func effectiveTunnelProbeTarget(tunnel *model.Tunnel) tunnelProbeTarget {
-	if tunnel == nil {
-		return defaultTunnelProbeTarget()
-	}
-	return effectiveTunnelProbeTargetValues(tunnel.ProbeTargetHost, tunnel.ProbeTargetPort)
-}
-
-func effectiveTunnelProbeTargetValues(host string, port int) tunnelProbeTarget {
-	target, configured, err := normalizeTunnelProbeTarget(host, port)
-	if err != nil || !configured {
-		return defaultTunnelProbeTarget()
-	}
-	return target
-}
-
-func formatTunnelProbeTarget(target tunnelProbeTarget) string {
-	if addr, err := netip.ParseAddr(target.Host); err == nil && addr.Is6() {
-		return fmt.Sprintf("[%s]:%d", target.Host, target.Port)
-	}
-	return fmt.Sprintf("%s:%d", target.Host, target.Port)
-}

go-backend/internal/http/handler/tunnel_probe_target_api_test.go

@@ -1,305 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestTunnelCreatePersistsProbeTargetAndListReturnsConfiguredValue(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	body := bytes.NewReader([]byte(`{
-		"name":"custom-target",
-		"type":1,
-		"flow":1,
-		"trafficRatio":1,
-		"status":1,
-		"inNodeId":[{"nodeId":10,"protocol":"tls"}],
-		"probeTargetHost":"speed.example.com",
-		"probeTargetPort":8443
-	}`))
-
-	res := httptest.NewRecorder()
-	h.tunnelCreate(res, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/create", body))
-	assertProbeTargetSuccess(t, res)
-
-	listRes := httptest.NewRecorder()
-	h.tunnelList(listRes, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil))
-	var payload struct {
-		Code int              `json:"code"`
-		Data []map[string]any `json:"data"`
-	}
-	decodeProbeTargetResponse(t, listRes, &payload)
-	if payload.Code != 0 {
-		t.Fatalf("expected success, got code %d", payload.Code)
-	}
-	item := payload.Data[0]
-	if item["probeTargetHost"] != "speed.example.com" || item["probeTargetPort"] != float64(8443) {
-		t.Fatalf("unexpected probe target in list response: %+v", item)
-	}
-}
-
-func TestTunnelUpdatePersistsDefaultProbeTargetAsEmpty(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	seedProbeTargetTunnel(t, h, 77, "existing", "old.example.com", 9443)
-	body := bytes.NewReader([]byte(`{
-		"id":77,
-		"name":"existing",
-		"type":1,
-		"flow":1,
-		"trafficRatio":1,
-		"status":1,
-		"inNodeId":[{"nodeId":10,"protocol":"tls"}],
-		"probeTargetHost":"",
-		"probeTargetPort":0
-	}`))
-
-	res := httptest.NewRecorder()
-	h.tunnelUpdate(res, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", body))
-	assertProbeTargetSuccess(t, res)
-
-	items, err := h.repo.ListTunnels()
-	if err != nil {
-		t.Fatalf("list tunnels: %v", err)
-	}
-	item := findProbeTargetTunnelItem(t, items, 77)
-	if item["probeTargetHost"] != "" || item["probeTargetPort"] != 0 {
-		t.Fatalf("expected default target to round-trip as empty/0, got %+v", item)
-	}
-}
-
-func TestTunnelUpdateWithoutProbeTargetFieldsPreservesExistingTarget(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	seedProbeTargetTunnel(t, h, 79, "existing", "old.example.com", 9443)
-	body := bytes.NewReader([]byte(`{
-		"id":79,
-		"name":"existing",
-		"type":1,
-		"flow":1,
-		"trafficRatio":1,
-		"status":1,
-		"inNodeId":[{"nodeId":10,"protocol":"tls"}]
-	}`))
-
-	res := httptest.NewRecorder()
-	h.tunnelUpdate(res, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", body))
-	assertProbeTargetSuccess(t, res)
-
-	items, err := h.repo.ListTunnels()
-	if err != nil {
-		t.Fatalf("list tunnels: %v", err)
-	}
-	item := findProbeTargetTunnelItem(t, items, 79)
-	if item["probeTargetHost"] != "old.example.com" || item["probeTargetPort"] != 9443 {
-		t.Fatalf("expected omitted probe target fields to preserve existing target, got %+v", item)
-	}
-}
-
-func TestTunnelUpdateRejectsInvalidProbeTargetWithoutClearingExistingTarget(t *testing.T) {
-	tests := []struct {
-		name        string
-		probeFields string
-	}{
-		{name: "non numeric port", probeFields: `,"probeTargetPort":"abc"`},
-		{name: "fractional port", probeFields: `,"probeTargetPort":443.5`},
-		{name: "whitespace host", probeFields: `,"probeTargetHost":"   "`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			h := setupProbeTargetTunnelHandler(t)
-			seedProbeTargetTunnel(t, h, 80, "existing", "old.example.com", 9443)
-			body := bytes.NewReader([]byte(`{
-				"id":80,
-				"name":"existing",
-				"type":1,
-				"flow":1,
-				"trafficRatio":1,
-				"status":1,
-				"inNodeId":[{"nodeId":10,"protocol":"tls"}]
-			` + tt.probeFields + `}`))
-
-			res := httptest.NewRecorder()
-			h.tunnelUpdate(res, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", body))
-			var payload struct {
-				Code int    `json:"code"`
-				Msg  string `json:"msg"`
-			}
-			decodeProbeTargetResponse(t, res, &payload)
-			if payload.Code == 0 || payload.Msg == "" {
-				t.Fatalf("expected validation failure, got %+v", payload)
-			}
-
-			items, err := h.repo.ListTunnels()
-			if err != nil {
-				t.Fatalf("list tunnels: %v", err)
-			}
-			item := findProbeTargetTunnelItem(t, items, 80)
-			if item["probeTargetHost"] != "old.example.com" || item["probeTargetPort"] != 9443 {
-				t.Fatalf("expected invalid probe target to preserve existing target, got %+v", item)
-			}
-		})
-	}
-}
-
-func TestTunnelCreateRejectsInvalidProbeTarget(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	body := bytes.NewReader([]byte(`{
-		"name":"bad-target",
-		"type":1,
-		"flow":1,
-		"trafficRatio":1,
-		"status":1,
-		"inNodeId":[{"nodeId":10,"protocol":"tls"}],
-		"probeTargetHost":"https://example.com",
-		"probeTargetPort":443
-	}`))
-
-	res := httptest.NewRecorder()
-	h.tunnelCreate(res, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/create", body))
-	var payload struct {
-		Code int    `json:"code"`
-		Msg  string `json:"msg"`
-	}
-	decodeProbeTargetResponse(t, res, &payload)
-	if payload.Code == 0 || payload.Msg == "" {
-		t.Fatalf("expected validation failure, got %+v", payload)
-	}
-}
-
-func TestTunnelUpdateInvalidProbeTargetDoesNotCleanFederationBindings(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	seedProbeTargetTunnel(t, h, 88, "existing", "old.example.com", 9443)
-	seedProbeTargetFederationBinding(t, h, 88)
-	body := bytes.NewReader([]byte(`{
-		"id":88,
-		"name":"existing",
-		"type":1,
-		"flow":1,
-		"trafficRatio":1,
-		"status":1,
-		"inNodeId":[{"nodeId":10,"protocol":"tls"}],
-		"probeTargetHost":"https://example.com",
-		"probeTargetPort":443
-	}`))
-
-	res := httptest.NewRecorder()
-	h.tunnelUpdate(res, httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", body))
-	var payload struct {
-		Code int    `json:"code"`
-		Msg  string `json:"msg"`
-	}
-	decodeProbeTargetResponse(t, res, &payload)
-	if payload.Code == 0 || payload.Msg == "" {
-		t.Fatalf("expected validation failure, got %+v", payload)
-	}
-
-	bindings, err := h.repo.ListActiveFederationTunnelBindingsByTunnel(88)
-	if err != nil {
-		t.Fatalf("list federation bindings: %v", err)
-	}
-	if len(bindings) != 1 {
-		t.Fatalf("expected federation binding to remain after invalid update, got %d", len(bindings))
-	}
-}
-
-func TestTunnelDiagnosisUsesConfiguredProbeTarget(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	seedProbeTargetTunnel(t, h, 90, "diagnosis-target", "speed.example.com", 8443)
-
-	_, _, workItems, err := h.prepareTunnelDiagnosis(90)
-	if err != nil {
-		t.Fatalf("prepare tunnel diagnosis: %v", err)
-	}
-	if len(workItems) != 1 {
-		t.Fatalf("expected one diagnosis item, got %d", len(workItems))
-	}
-	if workItems[0].targetIP != "speed.example.com" || workItems[0].targetPort != 8443 {
-		t.Fatalf("expected custom diagnosis target speed.example.com:8443, got %s:%d", workItems[0].targetIP, workItems[0].targetPort)
-	}
-}
-
-func setupProbeTargetTunnelHandler(t *testing.T) *Handler {
-	t.Helper()
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-	h := New(r, "secret")
-	now := time.Now().UnixMilli()
-	if err := r.DB().Exec(`
-		INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(10, 'entry-a', 'entry-secret', '10.0.0.1', '10.0.0.1', '', '30000-30010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	return h
-}
-
-func seedProbeTargetTunnel(t *testing.T, h *Handler, id int64, name string, host string, port int) {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	if err := h.repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, inx, ip_preference, probe_target_host, probe_target_port)
-		VALUES(?, ?, 1, 1, 'tls', 1, ?, ?, 1, ?, '', ?, ?)
-	`, id, name, now, now, id, host, port).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	if err := h.repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, '1', 10, 30001, 'round', 1, 'tls')
-	`, id).Error; err != nil {
-		t.Fatalf("insert chain: %v", err)
-	}
-}
-
-func seedProbeTargetFederationBinding(t *testing.T, h *Handler, tunnelID int64) {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	if err := h.repo.DB().Exec(`
-		INSERT INTO federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx, remote_url, resource_key, remote_binding_id, allocated_port, status, created_time, updated_time)
-		VALUES(?, 10, 1, 0, 'http://peer.example', ?, 'remote-binding', 30001, 1, ?, ?)
-	`, tunnelID, "probe-target-test-binding", now, now).Error; err != nil {
-		t.Fatalf("insert federation binding: %v", err)
-	}
-}
-
-func assertProbeTargetSuccess(t *testing.T, res *httptest.ResponseRecorder) {
-	t.Helper()
-	var payload struct {
-		Code int    `json:"code"`
-		Msg  string `json:"msg"`
-	}
-	decodeProbeTargetResponse(t, res, &payload)
-	if payload.Code != 0 {
-		t.Fatalf("expected success, got %+v", payload)
-	}
-}
-
-func decodeProbeTargetResponse(t *testing.T, res *httptest.ResponseRecorder, v any) {
-	t.Helper()
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected HTTP %d, got %d", http.StatusOK, res.Code)
-	}
-	if err := json.NewDecoder(res.Body).Decode(v); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-}
-
-func findProbeTargetTunnelItem(t *testing.T, items []map[string]interface{}, id int64) map[string]interface{} {
-	t.Helper()
-	for _, item := range items {
-		if asInt64(item["id"], 0) == id {
-			return item
-		}
-	}
-	t.Fatalf("tunnel %d not found: %+v", id, items)
-	return nil
-}

go-backend/internal/http/handler/tunnel_probe_target_test.go

@@ -1,120 +0,0 @@
-package handler
-
-import "testing"
-
-func TestNormalizeTunnelProbeTargetDefaultsWhenEmpty(t *testing.T) {
-	target, configured, err := normalizeTunnelProbeTarget("", 0)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if configured {
-		t.Fatalf("expected empty input to be default, not configured")
-	}
-	if target.Host != defaultTunnelProbeTargetHost || target.Port != defaultTunnelProbeTargetPort {
-		t.Fatalf("unexpected default target: %+v", target)
-	}
-}
-
-func TestNormalizeTunnelProbeTargetAcceptsHostPortAndIPv6(t *testing.T) {
-	target, configured, err := normalizeTunnelProbeTarget(" [2001:db8::1] ", 8443)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !configured {
-		t.Fatalf("expected explicit target")
-	}
-	if target.Host != "2001:db8::1" || target.Port != 8443 {
-		t.Fatalf("unexpected normalized target: %+v", target)
-	}
-	if got := formatTunnelProbeTarget(target); got != "[2001:db8::1]:8443" {
-		t.Fatalf("unexpected formatted target: %s", got)
-	}
-}
-
-func TestNormalizeTunnelProbeTargetRejectsPartialAndInvalidInputs(t *testing.T) {
-	tests := []struct {
-		name string
-		host string
-		port int
-	}{
-		{name: "missing host", host: "", port: 443},
-		{name: "missing port", host: "example.com", port: 0},
-		{name: "port too high", host: "example.com", port: 70000},
-		{name: "scheme", host: "https://example.com", port: 443},
-		{name: "path", host: "example.com/ping", port: 443},
-		{name: "space", host: "example .com", port: 443},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if _, _, err := normalizeTunnelProbeTarget(tt.host, tt.port); err == nil {
-				t.Fatalf("expected validation error")
-			}
-		})
-	}
-}
-
-func TestNormalizeTunnelProbeTargetRejectsSchemePrefixButAllowsIPv6(t *testing.T) {
-	for _, host := range []string{"https:example.com", "mailto:ops@example.com"} {
-		if _, _, err := normalizeTunnelProbeTarget(host, 443); err == nil {
-			t.Fatalf("expected scheme-like host %q to be rejected", host)
-		}
-	}
-
-	for _, host := range []string{"2001:db8::1", "[2001:db8::1]"} {
-		target, configured, err := normalizeTunnelProbeTarget(host, 443)
-		if err != nil {
-			t.Fatalf("expected IPv6 host %q to be accepted: %v", host, err)
-		}
-		if !configured || target.Host != "2001:db8::1" {
-			t.Fatalf("unexpected IPv6 normalization for %q: %+v configured=%v", host, target, configured)
-		}
-	}
-}
-
-func TestNormalizeTunnelProbeTargetValidatesHostShape(t *testing.T) {
-	validHosts := []string{
-		"example.com",
-		"localhost",
-		"api-1.example.co.uk",
-		"192.0.2.10",
-		"2001:db8::1",
-		"[2001:db8::1]",
-	}
-	for _, host := range validHosts {
-		if _, _, err := normalizeTunnelProbeTarget(host, 443); err != nil {
-			t.Fatalf("expected valid host %q: %v", host, err)
-		}
-	}
-
-	invalidHosts := []string{
-		"1:2:3",
-		"[2001:db8::1",
-		"2001:db8::1]",
-		"[example.com]",
-		"example..com",
-		"-example.com",
-		"example-.com",
-		"exa_mple.com",
-		"999.1.1.1",
-	}
-	for _, host := range invalidHosts {
-		if _, _, err := normalizeTunnelProbeTarget(host, 443); err == nil {
-			t.Fatalf("expected invalid host %q to be rejected", host)
-		}
-	}
-}
-
-func TestParseTunnelProbeTargetFromRequest(t *testing.T) {
-	req := map[string]interface{}{
-		"probeTargetHost": "speed.example.com",
-		"probeTargetPort": float64(1443),
-	}
-	target, configured, err := parseTunnelProbeTargetFromRequest(req)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !configured || target.Host != "speed.example.com" || target.Port != 1443 {
-		t.Fatalf("unexpected request target: %+v configured=%v", target, configured)
-	}
-}

go-backend/internal/http/handler/tunnel_quality_prober.go

@@ -42,8 +42,6 @@ type tunnelQualitySnapshot struct {
 	ErrorMessage       string  `json:"errorMessage,omitempty"`
 	Timestamp          int64   `json:"timestamp"`
 	ChainDetails       string  `json:"chainDetails,omitempty"`
-	ProbeTargetHost    string  `json:"probeTargetHost,omitempty"`
-	ProbeTargetPort    int     `json:"probeTargetPort,omitempty"`
 
 	// internal fields for db reporting
 	lastDBWrite int64 `json:"-"`
@@ -59,7 +57,6 @@ type tunnelQualityProber struct {
 	interval  time.Duration
 	lastPrune int64
 	probing   int32 // atomic flag: 1 = probeAll running, 0 = idle
-	probeNode bestExitProbeFunc
 }
 
 // newTunnelQualityProber creates a new prober (not yet running).
@@ -229,9 +226,6 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 		p.storeResult(snap)
 		return
 	}
-	probeTarget := effectiveTunnelProbeTargetValues(tunnel.ProbeTargetHost, tunnel.ProbeTargetPort)
-	snap.ProbeTargetHost = probeTarget.Host
-	snap.ProbeTargetPort = probeTarget.Port
 
 	chainRows, err := h.listChainNodesForTunnel(tunnelID)
 	if err != nil || len(chainRows) == 0 {
@@ -248,13 +242,13 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 		pingTimeoutMS:  tunnelQualityPingTimeoutMs,
 		timeoutMessage: "探测超时",
 	}
-	p.probeBestExitOwners(tunnelID, inNodes, midNodesGrouped, outNodes, ipPreference, options, probeTarget)
+	p.probeBestExitOwners(tunnelID, inNodes, midNodesGrouped, outNodes, ipPreference, options)
 
 	switch tunnel.Type {
 	case 1:
-		// Port forwarding: entry → public probe target only.
+		// Port forwarding: entry → Bing only
 		if len(inNodes) > 0 {
-			lat, loss, err := p.pingNode(inNodes[0].NodeID, probeTarget.Host, probeTarget.Port, options)
+			lat, loss, err := p.tcpPingNode(inNodes[0].NodeID, "www.bing.com", 443, options)
 			if err == nil {
 				snap.ExitToBingLatency = lat
 				snap.ExitToBingLoss = loss
@@ -316,7 +310,7 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 				hop.TargetIP = targetIP
 				hop.TargetPort = targetPort
 
-				lat, loss, err := p.pingNode(source.NodeID, targetIP, targetPort, options)
+				lat, loss, err := p.tcpPingNode(source.NodeID, targetIP, targetPort, options)
 				if err == nil {
 					hop.Latency = lat
 					hop.Loss = loss
@@ -352,7 +346,7 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 
 		// Exit → Bing
 		if len(outNodes) > 0 {
-			lat, loss, err := p.pingNode(outNodes[0].NodeID, probeTarget.Host, probeTarget.Port, options)
+			lat, loss, err := p.tcpPingNode(outNodes[0].NodeID, "www.bing.com", 443, options)
 			if err == nil {
 				snap.ExitToBingLatency = lat
 				snap.ExitToBingLoss = loss
@@ -366,9 +360,9 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 
 		snap.Success = probeOK
 	default:
-		// Unknown type: entry → public probe target.
+		// Unknown type: entry → Bing
 		if len(inNodes) > 0 {
-			lat, loss, err := p.pingNode(inNodes[0].NodeID, probeTarget.Host, probeTarget.Port, options)
+			lat, loss, err := p.tcpPingNode(inNodes[0].NodeID, "www.bing.com", 443, options)
 			if err == nil {
 				snap.ExitToBingLatency = lat
 				snap.ExitToBingLoss = loss
@@ -382,7 +376,7 @@ func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
 	p.storeResult(snap)
 }
 
-func (p *tunnelQualityProber) probeBestExitOwners(tunnelID int64, inNodes []chainNodeRecord, chainHops [][]chainNodeRecord, outNodes []chainNodeRecord, ipPreference string, options diagnosisExecOptions, probeTarget tunnelProbeTarget) {
+func (p *tunnelQualityProber) probeBestExitOwners(tunnelID int64, inNodes []chainNodeRecord, chainHops [][]chainNodeRecord, outNodes []chainNodeRecord, ipPreference string, options diagnosisExecOptions) {
 	if p == nil || p.handler == nil || p.handler.bestExit == nil || len(outNodes) <= 1 {
 		return
 	}
@@ -406,14 +400,14 @@ func (p *tunnelQualityProber) probeBestExitOwners(tunnelID int64, inNodes []chai
 	}
 	// This best-exit decision cache is per decision round; the display-oriented
 	// tunnel quality snapshot may still collect its own first-exit public probe.
-	roundPinger := newBestExitRoundPinger(p.pingNode)
+	roundPinger := newBestExitRoundPinger(p.tcpPingNode)
 	for _, owner := range owners {
 		if nodeMap[owner.NodeID] == nil {
 			continue
 		}
 		key := bestExitOwnerKey{TunnelID: tunnelID, OwnerNodeID: owner.NodeID}
 		p.handler.bestExit.ensureApplied(key, outNodes[0].NodeID, time.Now())
-		scores := evaluateBestExitOwner(owner, outNodes, nodeMap, ipPreference, options, probeTarget, roundPinger)
+		scores := evaluateBestExitOwner(owner, outNodes, nodeMap, ipPreference, options, roundPinger)
 		decision := p.handler.bestExit.observeScores(key, scores, time.Now())
 		if decision.Switch {
 			now := time.Now()
@@ -427,13 +421,6 @@ func (p *tunnelQualityProber) probeBestExitOwners(tunnelID int64, inNodes []chai
 	}
 }
 
-func (p *tunnelQualityProber) pingNode(nodeID int64, ip string, port int, options diagnosisExecOptions) (float64, float64, error) {
-	if p != nil && p.probeNode != nil {
-		return p.probeNode(nodeID, ip, port, options)
-	}
-	return p.tcpPingNode(nodeID, ip, port, options)
-}
-
 func (p *tunnelQualityProber) tcpPingNode(nodeID int64, ip string, port int, options diagnosisExecOptions) (latency float64, loss float64, err error) {
 	h := p.handler
 	if h == nil {

go-backend/internal/http/handler/tunnel_quality_prober_test.go

@@ -1,69 +0,0 @@
-package handler
-
-import (
-	"fmt"
-	"slices"
-	"testing"
-	"time"
-)
-
-func TestTunnelQualityProberUsesConfiguredProbeTarget(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	seedProbeTargetTunnel(t, h, 77, "quality-target", "speed.example.com", 8443)
-	if err := h.repo.DB().Exec(`
-		INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(30, 'exit-a', 'exit-secret', '10.0.0.30', '10.0.0.30', '', '30000-30010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
-	`, time.Now().UnixMilli(), time.Now().UnixMilli()).Error; err != nil {
-		t.Fatalf("insert exit node: %v", err)
-	}
-	if err := h.repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(77, '3', 30, 30001, 'round', 1, 'tls')
-	`).Error; err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	p := newTunnelQualityProber(h)
-	var calls []string
-	p.probeNode = func(nodeID int64, ip string, port int, options diagnosisExecOptions) (float64, float64, error) {
-		calls = append(calls, fmt.Sprintf("%d|%s|%d", nodeID, ip, port))
-		return 10, 0, nil
-	}
-	p.probeTunnel(77)
-
-	if !slices.Contains(calls, "10|speed.example.com|8443") {
-		t.Fatalf("expected type 1 public probe from entry to configured target, calls=%+v", calls)
-	}
-	if slices.Contains(calls, "30|speed.example.com|8443") {
-		t.Fatalf("did not expect type 1 public probe from exit node, calls=%+v", calls)
-	}
-	snaps := p.GetAll()
-	if len(snaps) != 1 {
-		t.Fatalf("expected one quality snapshot, got %+v", snaps)
-	}
-	if snaps[0].ProbeTargetHost != "speed.example.com" || snaps[0].ProbeTargetPort != 8443 {
-		t.Fatalf("unexpected snapshot target metadata: %+v", snaps[0])
-	}
-}
-
-func TestTunnelQualityProberStoresProbeTargetWhenChainIncomplete(t *testing.T) {
-	h := setupProbeTargetTunnelHandler(t)
-	seedProbeTargetTunnel(t, h, 78, "quality-target-incomplete", "speed.example.com", 8443)
-	if err := h.repo.DB().Exec(`DELETE FROM chain_tunnel WHERE tunnel_id = ?`, 78).Error; err != nil {
-		t.Fatalf("delete chain rows: %v", err)
-	}
-
-	p := newTunnelQualityProber(h)
-	p.probeTunnel(78)
-
-	snaps := p.GetAll()
-	if len(snaps) != 1 {
-		t.Fatalf("expected one quality snapshot, got %+v", snaps)
-	}
-	if snaps[0].ErrorMessage == "" {
-		t.Fatalf("expected incomplete chain error, got %+v", snaps[0])
-	}
-	if snaps[0].ProbeTargetHost != "speed.example.com" || snaps[0].ProbeTargetPort != 8443 {
-		t.Fatalf("unexpected snapshot target metadata: %+v", snaps[0])
-	}
-}

go-backend/internal/store/model/model.go

@@ -119,20 +119,18 @@ type StatisticsFlow struct {
 func (StatisticsFlow) TableName() string { return "statistics_flow" }
 
 type Tunnel struct {
-	ID              int64          `gorm:"primaryKey;autoIncrement"`
-	Name            string         `gorm:"type:varchar(100);not null"`
-	TrafficRatio    float64        `gorm:"column:traffic_ratio;not null;default:1.0"`
-	Type            int            `gorm:"not null"`
-	Protocol        string         `gorm:"type:varchar(10);not null;default:'tls'"`
-	Flow            int64          `gorm:"not null"`
-	CreatedTime     int64          `gorm:"column:created_time;not null"`
-	UpdatedTime     int64          `gorm:"column:updated_time;not null"`
-	Status          int            `gorm:"not null"`
-	InIP            sql.NullString `gorm:"column:in_ip;type:text"`
-	Inx             int            `gorm:"not null;default:0"`
-	IPPreference    string         `gorm:"column:ip_preference;type:varchar(10);not null;default:''"`
-	ProbeTargetHost string         `gorm:"column:probe_target_host;type:text;not null;default:''"`
-	ProbeTargetPort int            `gorm:"column:probe_target_port;not null;default:0"`
+	ID           int64          `gorm:"primaryKey;autoIncrement"`
+	Name         string         `gorm:"type:varchar(100);not null"`
+	TrafficRatio float64        `gorm:"column:traffic_ratio;not null;default:1.0"`
+	Type         int            `gorm:"not null"`
+	Protocol     string         `gorm:"type:varchar(10);not null;default:'tls'"`
+	Flow         int64          `gorm:"not null"`
+	CreatedTime  int64          `gorm:"column:created_time;not null"`
+	UpdatedTime  int64          `gorm:"column:updated_time;not null"`
+	Status       int            `gorm:"not null"`
+	InIP         sql.NullString `gorm:"column:in_ip;type:text"`
+	Inx          int            `gorm:"not null;default:0"`
+	IPPreference string         `gorm:"column:ip_preference;type:varchar(10);not null;default:''"`
 }
 
 func (Tunnel) TableName() string { return "tunnel" }
@@ -405,21 +403,19 @@ type NodeBackup struct {
 }
 
 type TunnelBackup struct {
-	ID              int64               `json:"id"`
-	Name            string              `json:"name"`
-	TrafficRatio    float64             `json:"trafficRatio"`
-	Type            int                 `json:"type"`
-	Protocol        string              `json:"protocol"`
-	Flow            int64               `json:"flow"`
-	CreatedTime     int64               `json:"createdTime"`
-	UpdatedTime     int64               `json:"updatedTime"`
-	Status          int                 `json:"status"`
-	InIP            string              `json:"inIp,omitempty"`
-	Inx             int                 `json:"inx"`
-	IPPreference    string              `json:"ipPreference,omitempty"`
-	ProbeTargetHost string              `json:"probeTargetHost,omitempty"`
-	ProbeTargetPort int                 `json:"probeTargetPort,omitempty"`
-	ChainTunnels    []ChainTunnelBackup `json:"chainTunnels,omitempty"`
+	ID           int64               `json:"id"`
+	Name         string              `json:"name"`
+	TrafficRatio float64             `json:"trafficRatio"`
+	Type         int                 `json:"type"`
+	Protocol     string              `json:"protocol"`
+	Flow         int64               `json:"flow"`
+	CreatedTime  int64               `json:"createdTime"`
+	UpdatedTime  int64               `json:"updatedTime"`
+	Status       int                 `json:"status"`
+	InIP         string              `json:"inIp,omitempty"`
+	Inx          int                 `json:"inx"`
+	IPPreference string              `json:"ipPreference,omitempty"`
+	ChainTunnels []ChainTunnelBackup `json:"chainTunnels,omitempty"`
 }
 
 type ChainTunnelBackup struct {
@@ -557,14 +553,12 @@ type ForwardRecord struct {
 
 // TunnelRecord is a minimal tunnel view used by control plane.
 type TunnelRecord struct {
-	ID              int64
-	Type            int
-	Status          int
-	Flow            int64
-	TrafficRatio    float64
-	Protocol        string
-	ProbeTargetHost string
-	ProbeTargetPort int
+	ID           int64
+	Type         int
+	Status       int
+	Flow         int64
+	TrafficRatio float64
+	Protocol     string
 }
 
 type UserQuotaView struct {

go-backend/internal/store/repo/repository.go

@@ -304,7 +304,6 @@ func autoMigrateAll(db *gorm.DB) error {
 	m := db.Migrator()
 	hasNode := m.HasTable(&model.Node{})
 	hasTunnel := m.HasTable(&model.Tunnel{})
-	hasForward := m.HasTable(&model.Forward{})
 
 	for _, item := range models {
 		if hasNode {
@@ -317,11 +316,6 @@ func autoMigrateAll(db *gorm.DB) error {
 				continue
 			}
 		}
-		if hasForward {
-			if _, ok := item.(*model.Forward); ok {
-				continue
-			}
-		}
 		if err := db.AutoMigrate(item); err != nil {
 			return err
 		}
@@ -391,7 +385,7 @@ func prepareSQLiteLegacyColumns(db *gorm.DB) error {
 	}
 
 	if m.HasTable(&model.Tunnel{}) {
-		for _, field := range []string{"Inx", "IPPreference", "ProbeTargetHost", "ProbeTargetPort"} {
+		for _, field := range []string{"Inx", "IPPreference"} {
 			if m.HasColumn(&model.Tunnel{}, field) {
 				continue
 			}
@@ -402,7 +396,7 @@ func prepareSQLiteLegacyColumns(db *gorm.DB) error {
 	}
 
 	if m.HasTable(&model.Forward{}) {
-		for _, field := range []string{"MaxConn", "IPMaxConn", "IPSpeedID", "ProxyProtocol"} {
+		for _, field := range []string{"ProxyProtocol"} {
 			if m.HasColumn(&model.Forward{}, field) {
 				continue
 			}
@@ -1147,13 +1141,11 @@ func (r *Repository) ListTunnels() ([]map[string]interface{}, error) {
 			"id": t.ID, "inx": t.Inx, "name": t.Name,
 			"type": t.Type, "flow": t.Flow, "trafficRatio": t.TrafficRatio,
 			"status": t.Status, "createdTime": t.CreatedTime,
-			"inIp":            nullableString(t.InIP),
-			"ipPreference":    t.IPPreference,
-			"probeTargetHost": t.ProbeTargetHost,
-			"probeTargetPort": t.ProbeTargetPort,
-			"inNodeId":        make([]map[string]interface{}, 0),
-			"outNodeId":       make([]map[string]interface{}, 0),
-			"chainNodes":      make([][]map[string]interface{}, 0),
+			"inIp":         nullableString(t.InIP),
+			"ipPreference": t.IPPreference,
+			"inNodeId":     make([]map[string]interface{}, 0),
+			"outNodeId":    make([]map[string]interface{}, 0),
+			"chainNodes":   make([][]map[string]interface{}, 0),
 		}
 		orderedIDs = append(orderedIDs, t.ID)
 	}
@@ -2069,7 +2061,6 @@ func (r *Repository) exportTunnels() ([]model.TunnelBackup, error) {
 			Type: t.Type, Protocol: t.Protocol, Flow: t.Flow,
 			CreatedTime: t.CreatedTime, UpdatedTime: t.UpdatedTime,
 			Status: t.Status, Inx: t.Inx, IPPreference: t.IPPreference,
-			ProbeTargetHost: t.ProbeTargetHost, ProbeTargetPort: t.ProbeTargetPort,
 		}
 		if t.InIP.Valid {
 			b.InIP = t.InIP.String
@@ -2465,25 +2456,23 @@ func importTunnels(tx *gorm.DB, tunnels []model.TunnelBackup, now int64) (int, e
 	count := 0
 	for _, t := range tunnels {
 		item := model.Tunnel{
-			ID:              t.ID,
-			Name:            t.Name,
-			TrafficRatio:    t.TrafficRatio,
-			Type:            t.Type,
-			Protocol:        t.Protocol,
-			Flow:            t.Flow,
-			CreatedTime:     t.CreatedTime,
-			UpdatedTime:     now,
-			Status:          t.Status,
-			InIP:            sql.NullString{String: t.InIP, Valid: true},
-			Inx:             t.Inx,
-			IPPreference:    t.IPPreference,
-			ProbeTargetHost: t.ProbeTargetHost,
-			ProbeTargetPort: t.ProbeTargetPort,
+			ID:           t.ID,
+			Name:         t.Name,
+			TrafficRatio: t.TrafficRatio,
+			Type:         t.Type,
+			Protocol:     t.Protocol,
+			Flow:         t.Flow,
+			CreatedTime:  t.CreatedTime,
+			UpdatedTime:  now,
+			Status:       t.Status,
+			InIP:         sql.NullString{String: t.InIP, Valid: true},
+			Inx:          t.Inx,
+			IPPreference: t.IPPreference,
 		}
 		err := tx.Clauses(clause.OnConflict{
 			Columns: []clause.Column{{Name: "id"}},
 			DoUpdates: clause.AssignmentColumns([]string{
-				"name", "traffic_ratio", "type", "protocol", "flow", "updated_time", "status", "in_ip", "inx", "ip_preference", "probe_target_host", "probe_target_port",
+				"name", "traffic_ratio", "type", "protocol", "flow", "updated_time", "status", "in_ip", "inx", "ip_preference",
 			}),
 		}).Create(&item).Error
 		if err != nil {

go-backend/internal/store/repo/repository_backup_test.go

@@ -1,59 +0,0 @@
-package repo
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestBackupRoundTripsTunnelProbeTarget(t *testing.T) {
-	source, err := Open(filepath.Join(t.TempDir(), "source.db"))
-	if err != nil {
-		t.Fatalf("open source repo: %v", err)
-	}
-	defer source.Close()
-
-	now := time.Now().UnixMilli()
-	if err := source.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, probe_target_host, probe_target_port)
-		VALUES(20, 'backup-target', 1, 2, 'tls', 1, ?, ?, 1, '', 1, 'speed.example.com', 8443)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert source tunnel: %v", err)
-	}
-
-	backup, err := source.ExportAll()
-	if err != nil {
-		t.Fatalf("export backup: %v", err)
-	}
-	if len(backup.Tunnels) != 1 {
-		t.Fatalf("expected one exported tunnel, got %d", len(backup.Tunnels))
-	}
-	if backup.Tunnels[0].ProbeTargetHost != "speed.example.com" || backup.Tunnels[0].ProbeTargetPort != 8443 {
-		t.Fatalf("unexpected exported probe target: %+v", backup.Tunnels[0])
-	}
-
-	dest, err := Open(filepath.Join(t.TempDir(), "dest.db"))
-	if err != nil {
-		t.Fatalf("open dest repo: %v", err)
-	}
-	defer dest.Close()
-
-	result, err := dest.Import(backup, []string{"tunnels"})
-	if err != nil {
-		t.Fatalf("import backup: %v", err)
-	}
-	if result.TunnelsImported != 1 {
-		t.Fatalf("expected one imported tunnel, got %d", result.TunnelsImported)
-	}
-
-	items, err := dest.ListTunnels()
-	if err != nil {
-		t.Fatalf("list imported tunnels: %v", err)
-	}
-	if len(items) != 1 {
-		t.Fatalf("expected one imported tunnel item, got %d", len(items))
-	}
-	if items[0]["probeTargetHost"] != "speed.example.com" || items[0]["probeTargetPort"] != 8443 {
-		t.Fatalf("unexpected imported probe target: %+v", items[0])
-	}
-}

go-backend/internal/store/repo/repository_flow.go

@@ -253,14 +253,12 @@ func (r *Repository) GetTunnelRecord(tunnelID int64) (*model.TunnelRecord, error
 		return nil, err
 	}
 	tr := model.TunnelRecord{
-		ID:              t.ID,
-		Type:            t.Type,
-		Status:          t.Status,
-		Flow:            t.Flow,
-		TrafficRatio:    t.TrafficRatio,
-		Protocol:        t.Protocol,
-		ProbeTargetHost: t.ProbeTargetHost,
-		ProbeTargetPort: t.ProbeTargetPort,
+		ID:           t.ID,
+		Type:         t.Type,
+		Status:       t.Status,
+		Flow:         t.Flow,
+		TrafficRatio: t.TrafficRatio,
+		Protocol:     t.Protocol,
 	}
 	if tr.Flow <= 0 {
 		tr.Flow = 1

go-backend/internal/store/repo/repository_flow_batch_test.go

@@ -111,33 +111,6 @@ func TestGetFlowUploadForwardMetasKeepsForwardsWhenTunnelRowMissing(t *testing.T
 	}
 }
 
-func TestGetTunnelRecordIncludesProbeTarget(t *testing.T) {
-	r, err := Open(filepath.Join(t.TempDir(), "tunnel-record-probe-target.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, probe_target_host, probe_target_port)
-		VALUES(1, 't1', 1, 2, 'tls', 1, ?, ?, 1, NULL, 0, 'speed.example.com', 8443)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	record, err := r.GetTunnelRecord(1)
-	if err != nil {
-		t.Fatalf("get tunnel record: %v", err)
-	}
-	if record == nil {
-		t.Fatalf("expected tunnel record")
-	}
-	if record.ProbeTargetHost != "speed.example.com" || record.ProbeTargetPort != 8443 {
-		t.Fatalf("unexpected probe target on record: %#v", record)
-	}
-}
-
 func TestAddUserQuotaUsageBatchReturnsNormalizedViews(t *testing.T) {
 	r, err := Open(filepath.Join(t.TempDir(), "quota-batch.db"))
 	if err != nil {

go-backend/internal/store/repo/repository_migrate_test.go

@@ -3,7 +3,6 @@ package repo
 import (
 	"database/sql"
 	"errors"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -59,126 +58,6 @@ func TestPrepareSQLiteLegacyColumnsAddsNodeMetadataColumns(t *testing.T) {
 	}
 }
 
-func TestOpenBackfillsSQLiteLegacyTunnelProbeTargetColumns(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "legacy.db")
-	db, err := gorm.Open(gsqlite.Open(dbPath), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open legacy sqlite: %v", err)
-	}
-
-	if err := db.Exec(`
-		CREATE TABLE tunnel (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			traffic_ratio REAL NOT NULL DEFAULT 1.0,
-			type INTEGER NOT NULL,
-			protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
-			flow INTEGER NOT NULL,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER NOT NULL,
-			status INTEGER NOT NULL,
-			in_ip TEXT
-		)
-	`).Error; err != nil {
-		t.Fatalf("create legacy tunnel table: %v", err)
-	}
-	if err := db.Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip)
-		VALUES(1, 'legacy-tunnel', 1, 1, 'tls', 1, 1, 1, 1, '')
-	`).Error; err != nil {
-		t.Fatalf("insert legacy tunnel: %v", err)
-	}
-	if sqlDB, _ := db.DB(); sqlDB != nil {
-		_ = sqlDB.Close()
-	}
-
-	r, err := Open(dbPath)
-	if err != nil {
-		t.Fatalf("open migrated sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	m := r.DB().Migrator()
-	for _, field := range []string{"ProbeTargetHost", "ProbeTargetPort"} {
-		if !m.HasColumn(&model.Tunnel{}, field) {
-			t.Fatalf("expected tunnel.%s column to exist", field)
-		}
-	}
-
-	var host string
-	var port int
-	if err := r.DB().Raw(`SELECT probe_target_host, probe_target_port FROM tunnel WHERE id = 1`).Row().Scan(&host, &port); err != nil {
-		t.Fatalf("query probe target defaults: %v", err)
-	}
-	if host != "" || port != 0 {
-		t.Fatalf("expected default probe target empty/0, got %q/%d", host, port)
-	}
-}
-
-func TestOpenBackfillsSQLiteLegacyForwardColumns(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "legacy-forward.db")
-	db, err := gorm.Open(gsqlite.Open(dbPath), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open legacy sqlite: %v", err)
-	}
-
-	if err := db.Exec(`
-		CREATE TABLE forward (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			user_id INTEGER NOT NULL,
-			user_name VARCHAR(100) NOT NULL,
-			name VARCHAR(100) NOT NULL,
-			tunnel_id INTEGER NOT NULL,
-			remote_addr TEXT NOT NULL,
-			strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
-			in_flow INTEGER NOT NULL DEFAULT 0,
-			out_flow INTEGER NOT NULL DEFAULT 0,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER NOT NULL,
-			status INTEGER NOT NULL,
-			inx INTEGER NOT NULL DEFAULT 0,
-			speed_id INTEGER
-		)
-	`).Error; err != nil {
-		t.Fatalf("create legacy forward table: %v", err)
-	}
-	if err := db.Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx, speed_id)
-		VALUES(1, 2, 'legacy-user', 'legacy-forward', 3, '127.0.0.1:9000', 'fifo', 0, 0, 1, 1, 1, 0, NULL)
-	`).Error; err != nil {
-		t.Fatalf("insert legacy forward: %v", err)
-	}
-	if sqlDB, _ := db.DB(); sqlDB != nil {
-		_ = sqlDB.Close()
-	}
-
-	r, err := Open(dbPath)
-	if err != nil {
-		t.Fatalf("open migrated sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	m := r.DB().Migrator()
-	for _, field := range []string{"MaxConn", "IPMaxConn", "IPSpeedID", "ProxyProtocol"} {
-		if !m.HasColumn(&model.Forward{}, field) {
-			t.Fatalf("expected forward.%s column to exist", field)
-		}
-	}
-
-	var maxConn, ipMaxConn, proxyProtocol int
-	var ipSpeedID sql.NullInt64
-	if err := r.DB().Raw(`SELECT max_conn, ip_max_conn, ip_speed_id, proxy_protocol FROM forward WHERE id = 1`).Row().Scan(&maxConn, &ipMaxConn, &ipSpeedID, &proxyProtocol); err != nil {
-		t.Fatalf("query forward defaults: %v", err)
-	}
-	if maxConn != 0 || ipMaxConn != 0 || ipSpeedID.Valid || proxyProtocol != 0 {
-		t.Fatalf("expected default forward columns 0/0/NULL/0, got max_conn=%d ip_max_conn=%d ip_speed_id=%+v proxy_protocol=%d", maxConn, ipMaxConn, ipSpeedID, proxyProtocol)
-	}
-}
-
 func TestMigrateSchemaRunsPostgresIDRepairEvenAtCurrentVersion(t *testing.T) {
 	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
 		Logger: logger.Default.LogMode(logger.Silent),

go-backend/internal/store/repo/repository_mutations.go

@@ -397,24 +397,22 @@ func (r *Repository) UpdateTunnelOrder(tunnelID int64, inx int, now int64) {
 		Updates(map[string]interface{}{"inx": inx, "updated_time": now}).Error
 }
 
-func (r *Repository) UpdateTunnelTx(tx *gorm.DB, tunnelID int64, name string, typeVal int, flow int64, trafficRatio float64, status int, inIP, ipPreference string, protocol string, probeTargetHost string, probeTargetPort int, now int64) error {
+func (r *Repository) UpdateTunnelTx(tx *gorm.DB, tunnelID int64, name string, typeVal int, flow int64, trafficRatio float64, status int, inIP, ipPreference string, protocol string, now int64) error {
 	if tx == nil {
 		return errors.New("database unavailable")
 	}
 	return tx.Model(&model.Tunnel{}).
 		Where("id = ?", tunnelID).
 		Updates(map[string]interface{}{
-			"name":              name,
-			"type":              typeVal,
-			"flow":              flow,
-			"traffic_ratio":     trafficRatio,
-			"status":            status,
-			"in_ip":             nullStringFromInterface(inIP),
-			"ip_preference":     ipPreference,
-			"protocol":          protocol,
-			"probe_target_host": probeTargetHost,
-			"probe_target_port": probeTargetPort,
-			"updated_time":      now,
+			"name":          name,
+			"type":          typeVal,
+			"flow":          flow,
+			"traffic_ratio": trafficRatio,
+			"status":        status,
+			"in_ip":         nullStringFromInterface(inIP),
+			"ip_preference": ipPreference,
+			"protocol":      protocol,
+			"updated_time":  now,
 		}).Error
 }
 
@@ -1328,22 +1326,20 @@ func (r *Repository) BatchUpdateForwardStatus(ids []int64, status int) (int, int
 	return s, f
 }
 
-func (r *Repository) CreateTunnelTx(tx *gorm.DB, name string, trafficRatio float64, typeVal int, flow int64, now int64, status int, inIP interface{}, inx int, ipPreference string, probeTargetHost string, probeTargetPort int) (int64, error) {
+func (r *Repository) CreateTunnelTx(tx *gorm.DB, name string, trafficRatio float64, typeVal int, flow int64, now int64, status int, inIP interface{}, inx int, ipPreference string) (int64, error) {
 	inIPVal := nullStringFromInterface(inIP)
 	tunnel := model.Tunnel{
-		Name:            name,
-		TrafficRatio:    trafficRatio,
-		Type:            typeVal,
-		Protocol:        "tls",
-		Flow:            flow,
-		CreatedTime:     now,
-		UpdatedTime:     now,
-		Status:          status,
-		InIP:            inIPVal,
-		Inx:             inx,
-		IPPreference:    ipPreference,
-		ProbeTargetHost: probeTargetHost,
-		ProbeTargetPort: probeTargetPort,
+		Name:         name,
+		TrafficRatio: trafficRatio,
+		Type:         typeVal,
+		Protocol:     "tls",
+		Flow:         flow,
+		CreatedTime:  now,
+		UpdatedTime:  now,
+		Status:       status,
+		InIP:         inIPVal,
+		Inx:          inx,
+		IPPreference: ipPreference,
 	}
 	if err := tx.Create(&tunnel).Error; err != nil {
 		return 0, err

go-gost/x/socket/websocket_reporter.go

@@ -158,9 +158,6 @@ type WebSocketReporter struct {
 	addr              string // 保存服务器地址
 	secret            string // 保存密钥
 	version           string // 保存版本号
-	http              int
-	tls               int
-	socks             int
 	preferredWSScheme string
 	conn              *websocket.Conn
 	curBackoff        time.Duration // 当前重连退避间隔
@@ -299,9 +296,9 @@ func (w *WebSocketReporter) connect() error {
 		Socks  int    `json:"socks"`
 	}
 
-	cfg := LocalConfig{Http: w.http, Tls: w.tls, Socks: w.socks}
+	var cfg LocalConfig
 	if b, err := os.ReadFile("config.json"); err == nil {
-		_ = json.Unmarshal(b, &cfg)
+		json.Unmarshal(b, &cfg)
 	}
 
 	candidates := buildWebSocketCandidates(w.addr, w.secret, w.version, cfg.Http, cfg.Tls, cfg.Socks, w.preferredWSScheme)
@@ -1372,7 +1369,7 @@ func (w *WebSocketReporter) handleUpgradeAgent(data interface{}) error {
 	// 执行重启脚本
 	// 使用 systemd-run 在独立的 transient unit 中运行重启脚本，
 	// 避免 systemctl stop 杀死 flux_agent cgroup 内所有进程（包括此脚本自身）导致 mv 未执行。
-	script := buildAgentRestartScript(tmpPath, binaryPath)
+	script := fmt.Sprintf("sleep 1 && systemctl stop flux_agent && mv %s %s && systemctl start flux_agent", tmpPath, binaryPath)
 	cmd := exec.Command("systemd-run", "--quiet", "/bin/sh", "-c", script)
 	if err := cmd.Start(); err != nil {
 		os.Remove(tmpPath)
@@ -1406,14 +1403,6 @@ func (w *WebSocketReporter) handleRollbackAgent(data interface{}) error {
 	return nil
 }
 
-func buildAgentRestartScript(tmpPath, binaryPath string) string {
-	return fmt.Sprintf(
-		"sleep 1 && systemctl stop flux_agent && legacy_service='' && for service_file in /etc/systemd/system/gost.service /lib/systemd/system/gost.service /usr/lib/systemd/system/gost.service; do if [ -f \"$service_file\" ] && grep -Fq \"WorkingDirectory=/etc/gost\" \"$service_file\" && (grep -Fq \"ExecStart=/etc/gost/gost\" \"$service_file\" || (grep -Fq \"ExecStart=/usr/local/bin/gost\" \"$service_file\" && [ -f /etc/gost/config.json ] && [ -f /etc/gost/gost.json ])); then legacy_service=\"$service_file\"; break; fi; done && if [ -n \"$legacy_service\" ]; then (systemctl stop gost 2>/dev/null || true) && (systemctl disable gost 2>/dev/null || true) && rm -f /usr/local/bin/gost /etc/gost/gost \"$legacy_service\" && (systemctl daemon-reload 2>/dev/null || true); fi && mv %s %s && systemctl start flux_agent",
-		tmpPath,
-		binaryPath,
-	)
-}
-
 // updateLocalConfigJSON 将 http/tls/socks 写入工作目录下的 config.json
 func updateLocalConfigJSON(httpVal int, tlsVal int, socksVal int) error {
 	path := "config.json"
@@ -1661,16 +1650,13 @@ func StartWebSocketReporterWithConfig(addr string, secret string, http int, tls
 	candidates := buildWebSocketCandidates(addr, secret, version, http, tls, socks, "")
 	fullURL := candidates[0]
 
-	fmt.Printf("🔗 WebSocket连接URL: %s\n", sanitizeWebSocketURL(fullURL))
+	fmt.Printf("🔗 WebSocket连接URL: %s\n", fullURL)
 
 	reporter := NewWebSocketReporter(fullURL, secret)
-	// 保存 addr, secret, version 和协议能力供重连时使用
+	// 保存 addr, secret, version 供重连时使用
 	reporter.addr = addr
 	reporter.secret = secret
 	reporter.version = version
-	reporter.http = http
-	reporter.tls = tls
-	reporter.socks = socks
 	reporter.Start()
 	return reporter
 }

go-gost/x/socket/websocket_reporter_test.go

@@ -1,45 +1,15 @@
 package socket
 
 import (
-	"bytes"
 	"errors"
 	"io"
 	"net/http"
-	"os"
-	"runtime"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/gorilla/websocket"
 )
 
-func captureStdout(t *testing.T, fn func()) string {
-	t.Helper()
-
-	orig := os.Stdout
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatalf("create stdout pipe: %v", err)
-	}
-	os.Stdout = w
-	defer func() {
-		os.Stdout = orig
-		_ = w.Close()
-		_ = r.Close()
-	}()
-
-	fn()
-
-	_ = w.Close()
-
-	var buf bytes.Buffer
-	if _, err := io.Copy(&buf, r); err != nil {
-		t.Fatalf("read stdout: %v", err)
-	}
-	return buf.String()
-}
-
 func TestBuildWebSocketCandidatesSecureFirst(t *testing.T) {
 	candidates := buildWebSocketCandidates("panel.example.com:443", "abc", "2.0.2", 1, 0, 1, "")
 
@@ -163,103 +133,3 @@ func TestFormatWebSocketDialErrorIncludesHTTPStatus(t *testing.T) {
 		t.Fatalf("expected response body in message, got %s", msg)
 	}
 }
-
-func TestAgentUpgradeRestartScriptStopsLegacyGostService(t *testing.T) {
-	script := buildAgentRestartScript("/tmp/flux_agent.new", "/etc/flux_agent/flux_agent")
-
-	if !strings.Contains(script, "systemctl stop flux_agent") {
-		t.Fatalf("expected script to stop flux_agent, got %s", script)
-	}
-	if !strings.Contains(script, "mv /tmp/flux_agent.new /etc/flux_agent/flux_agent") {
-		t.Fatalf("expected script to replace the flux_agent binary, got %s", script)
-	}
-	if !strings.Contains(script, "systemctl stop gost") {
-		t.Fatalf("expected script to stop the legacy gost service, got %s", script)
-	}
-	if !strings.Contains(script, "systemctl disable gost") {
-		t.Fatalf("expected script to disable the legacy gost service, got %s", script)
-	}
-	if !strings.Contains(script, "rm -f /usr/local/bin/gost") {
-		t.Fatalf("expected script to remove the legacy gost binary, got %s", script)
-	}
-	if !strings.Contains(script, "WorkingDirectory=/etc/gost") {
-		t.Fatalf("expected script to scope cleanup to the legacy FLVX gost service definition, got %s", script)
-	}
-	if !strings.Contains(script, "systemctl start flux_agent") {
-		t.Fatalf("expected script to restart flux_agent, got %s", script)
-	}
-	if strings.Contains(script, "systemctl stop flux_agent && systemctl stop gost 2>/dev/null || true") {
-		t.Fatalf("expected legacy gost cleanup fallback to be scoped, got %s", script)
-	}
-	if runtime.GOARCH == "" {
-		t.Fatalf("unexpected empty runtime arch")
-	}
-}
-
-func TestStartWebSocketReporterWithConfigPreservesProtocolDefaultsWithoutConfigFile(t *testing.T) {
-	origDial := wsDial
-	defer func() { wsDial = origDial }()
-
-	origWD, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("get working directory: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origWD)
-	})
-	if err := os.Chdir(t.TempDir()); err != nil {
-		t.Fatalf("change working directory: %v", err)
-	}
-
-	urls := make(chan string, 1)
-	wsDial = func(_ *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
-		select {
-		case urls <- rawURL:
-		default:
-		}
-		return nil, nil, errors.New("dial failed")
-	}
-
-	reporter := StartWebSocketReporterWithConfig("panel.example.com:443", "abc", 1, 0, 1, "2.0.2")
-	defer reporter.Stop()
-
-	select {
-	case rawURL := <-urls:
-		if !strings.Contains(rawURL, "http=1&tls=0&socks=1") {
-			t.Fatalf("expected reconnect URL to preserve startup protocol values, got %s", rawURL)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("timed out waiting for websocket dial")
-	}
-}
-
-func TestStartWebSocketReporterWithConfigLogsSanitizedURL(t *testing.T) {
-	origDial := wsDial
-	defer func() { wsDial = origDial }()
-
-	ready := make(chan struct{}, 1)
-	wsDial = func(_ *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
-		select {
-		case ready <- struct{}{}:
-		default:
-		}
-		return nil, nil, errors.New("dial failed")
-	}
-
-	output := captureStdout(t, func() {
-		reporter := StartWebSocketReporterWithConfig("panel.example.com:443", "abc123", 1, 0, 1, "2.0.2")
-		select {
-		case <-ready:
-		case <-time.After(2 * time.Second):
-			t.Fatal("timed out waiting for websocket dial")
-		}
-		reporter.Stop()
-	})
-
-	if strings.Contains(output, "secret=abc123") {
-		t.Fatalf("expected logged websocket URL to mask the node secret, got %s", output)
-	}
-	if !strings.Contains(output, "secret=%2A%2A%2A") {
-		t.Fatalf("expected logged websocket URL to include masked secret, got %s", output)
-	}
-}

install.sh

@@ -24,11 +24,6 @@ get_architecture() {
 
 # 安装目录
 INSTALL_DIR="/etc/flux_agent"
-LEGACY_GOST_BINARY="/usr/local/bin/gost"
-LEGACY_GOST_CONFIG_DIR="/etc/gost"
-LEGACY_GOST_SERVICE_FILE_ETC="/etc/systemd/system/gost.service"
-LEGACY_GOST_SERVICE_FILE_LIB="/lib/systemd/system/gost.service"
-LEGACY_GOST_SERVICE_FILE_USR_LIB="/usr/lib/systemd/system/gost.service"
 
 # 镜像加速配置（可由面板传入或交互式询问）
 PROXY_ENABLED="${PROXY_ENABLED:-}"
@@ -239,69 +234,6 @@ check_and_install_tcpkill() {
   return 0
 }
 
-json_escape() {
-  local value="$1"
-  value=${value//\\/\\\\}
-  value=${value//\"/\\\"}
-  value=${value//$'\n'/\\n}
-  value=${value//$'\r'/\\r}
-  value=${value//$'\t'/\\t}
-  printf '%s' "$value"
-}
-
-write_flux_agent_config() {
-  local path="$1"
-  printf '{\n  "addr": "%s",\n  "secret": "%s"\n}\n' \
-    "$(json_escape "$SERVER_ADDR")" \
-    "$(json_escape "$SECRET")" > "$path"
-}
-
-cleanup_legacy_gost_installation() {
-  local matched_service_files=()
-  local service_file=""
-  local removed_service_file="0"
-
-  for service_file in "$LEGACY_GOST_SERVICE_FILE_ETC" "$LEGACY_GOST_SERVICE_FILE_LIB" "$LEGACY_GOST_SERVICE_FILE_USR_LIB"; do
-    if [[ ! -f "$service_file" ]]; then
-      continue
-    fi
-    if ! grep -Fq "WorkingDirectory=$LEGACY_GOST_CONFIG_DIR" "$service_file"; then
-      continue
-    fi
-    if grep -Fq "ExecStart=$LEGACY_GOST_CONFIG_DIR/gost" "$service_file" || \
-      (grep -Fq "ExecStart=$LEGACY_GOST_BINARY" "$service_file" && [[ -f "$LEGACY_GOST_CONFIG_DIR/config.json" && -f "$LEGACY_GOST_CONFIG_DIR/gost.json" ]]); then
-      matched_service_files+=("$service_file")
-    fi
-  done
-
-  if [[ ${#matched_service_files[@]} -eq 0 ]]; then
-    return 0
-  fi
-
-  if systemctl list-units --full -all 2>/dev/null | grep -Fq "gost.service"; then
-    systemctl stop gost 2>/dev/null || true
-    systemctl disable gost 2>/dev/null || true
-  fi
-
-  for service_file in "${matched_service_files[@]}"; do
-    if [[ -f "$service_file" ]]; then
-      rm -f "$service_file"
-      removed_service_file="1"
-    fi
-  done
-
-  if [[ -f "$LEGACY_GOST_BINARY" ]]; then
-    rm -f "$LEGACY_GOST_BINARY"
-  fi
-  if [[ -f "$LEGACY_GOST_CONFIG_DIR/gost" ]]; then
-    rm -f "$LEGACY_GOST_CONFIG_DIR/gost"
-  fi
-
-  if [[ "$removed_service_file" == "1" ]]; then
-    systemctl daemon-reload 2>/dev/null || true
-  fi
-}
-
 
 # 获取用户输入的配置参数
 get_config_params() {
@@ -347,8 +279,6 @@ install_flux_agent() {
 
   mkdir -p "$INSTALL_DIR"
 
-  local tmp_binary="$INSTALL_DIR/flux_agent.new"
-
   # 停止并禁用已有服务
   if systemctl list-units --full -all | grep -Fq "flux_agent.service"; then
     echo "🔍 检测到已存在的flux_agent服务"
@@ -356,17 +286,16 @@ install_flux_agent() {
     systemctl disable flux_agent 2>/dev/null && echo "🚫 禁用自启"
   fi
 
+  # 删除旧文件
+  [[ -f "$INSTALL_DIR/flux_agent" ]] && echo "🧹 删除旧文件 flux_agent" && rm -f "$INSTALL_DIR/flux_agent"
+
   # 下载 flux_agent
   echo "⬇️ 下载 flux_agent 中..."
-  rm -f "$tmp_binary"
-  curl -L "$DOWNLOAD_URL" -o "$tmp_binary"
-  if [[ ! -f "$tmp_binary" || ! -s "$tmp_binary" ]]; then
-    rm -f "$tmp_binary"
+  curl -L "$DOWNLOAD_URL" -o "$INSTALL_DIR/flux_agent"
+  if [[ ! -f "$INSTALL_DIR/flux_agent" || ! -s "$INSTALL_DIR/flux_agent" ]]; then
     echo "❌ 下载失败，请检查网络或下载链接。"
     exit 1
   fi
-  cleanup_legacy_gost_installation
-  mv "$tmp_binary" "$INSTALL_DIR/flux_agent"
   chmod +x "$INSTALL_DIR/flux_agent"
   echo "✅ 下载完成"
 
@@ -376,7 +305,12 @@ install_flux_agent() {
   # 写入 config.json (安装时总是创建新的)
   CONFIG_FILE="$INSTALL_DIR/config.json"
   echo "📄 创建新配置: config.json"
-  write_flux_agent_config "$CONFIG_FILE"
+  cat > "$CONFIG_FILE" <<EOF
+{
+  "addr": "$SERVER_ADDR",
+  "secret": "$SECRET"
+}
+EOF
 
   # 写入 gost.json
   GOST_CONFIG="$INSTALL_DIR/gost.json"
@@ -446,13 +380,11 @@ update_flux_agent() {
   
   # 先下载新版本
   echo "⬇️ 下载最新版本..."
-  rm -f "$INSTALL_DIR/flux_agent.new"
   curl -L "$DOWNLOAD_URL" -o "$INSTALL_DIR/flux_agent.new"
   if [[ ! -f "$INSTALL_DIR/flux_agent.new" || ! -s "$INSTALL_DIR/flux_agent.new" ]]; then
     echo "❌ 下载失败。"
     return 1
   fi
-  cleanup_legacy_gost_installation
 
   # 停止服务
   if systemctl list-units --full -all | grep -Fq "flux_agent.service"; then

test-install-scripts-proxy.sh

@@ -98,7 +98,6 @@ EOF
   chmod +x "$INSTALL_DIR/flux_agent"
 
   local ask_called="0"
-  local cleanup_called="0"
 
   ask_proxy_config() {
     ask_called="1"
@@ -106,10 +105,6 @@ EOF
     DOWNLOAD_URL=""
   }
 
-  cleanup_legacy_gost_installation() {
-    cleanup_called="1"
-  }
-
   check_and_install_tcpkill() { :; }
 
   systemctl() {
@@ -138,7 +133,6 @@ EOF
   update_flux_agent >/dev/null
 
   assert_equals "1" "$ask_called" "update_flux_agent should ask for proxy config before downloading"
-  assert_equals "1" "$cleanup_called" "update_flux_agent should clean up legacy gost before restarting the agent"
   assert_equals "$(build_download_url)" "$DOWNLOAD_URL" "update_flux_agent should honor the prompted proxy choice"
 )
 
@@ -161,198 +155,6 @@ test_update_flux_agent_skips_proxy_prompt_when_not_installed() (
   assert_equals "0" "$ask_called" "update_flux_agent should not prompt for proxy config when the agent is missing"
 )
 
-test_install_flux_agent_preserves_legacy_gost_when_download_fails() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  cat > "$INSTALL_DIR/flux_agent" <<'EOF'
-#!/bin/bash
-echo "old version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent"
-  SERVER_ADDR="panel.example.com:443"
-  SECRET="secret"
-  DOWNLOAD_URL="https://example.com/gost"
-
-  local cleanup_called="0"
-  local rc="0"
-
-  ask_proxy_config() { :; }
-  ensure_download_url_initialized() { :; }
-  get_config_params() { :; }
-  check_and_install_tcpkill() { :; }
-  cleanup_legacy_gost_installation() {
-    cleanup_called="1"
-  }
-  systemctl() { return 0; }
-  curl() { return 0; }
-
-  ( install_flux_agent >/dev/null ) || rc="$?"
-
-  assert_equals "1" "$rc" "install_flux_agent should fail when the download artifact is missing"
-  assert_equals "0" "$cleanup_called" "install_flux_agent should preserve legacy gost when download fails"
-  [[ -f "$INSTALL_DIR/flux_agent" ]] || fail "install_flux_agent should keep the existing flux_agent binary when download fails"
-)
-
-test_update_flux_agent_preserves_legacy_gost_when_download_fails() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  cat > "$INSTALL_DIR/flux_agent" <<'EOF'
-#!/bin/bash
-echo "old version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent"
-  cat > "$INSTALL_DIR/flux_agent.new" <<'EOF'
-#!/bin/bash
-echo "stale version"
-EOF
-  chmod +x "$INSTALL_DIR/flux_agent.new"
-
-  local cleanup_called="0"
-  local rc="0"
-
-  ask_proxy_config() {
-    PROXY_ENABLED="false"
-    DOWNLOAD_URL="https://example.com/gost"
-  }
-  check_and_install_tcpkill() { :; }
-  cleanup_legacy_gost_installation() {
-    cleanup_called="1"
-  }
-  systemctl() { return 0; }
-  curl() { return 0; }
-
-  update_flux_agent >/dev/null || rc="$?"
-
-  assert_equals "1" "$rc" "update_flux_agent should fail when the download artifact is missing"
-  assert_equals "0" "$cleanup_called" "update_flux_agent should preserve legacy gost when download fails"
-  [[ ! -f "$INSTALL_DIR/flux_agent.new" ]] || fail "update_flux_agent should remove stale download artifacts before retrying"
-)
-
-test_install_flux_agent_writes_json_safe_config() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  INSTALL_DIR=$(mktemp -d)
-  SERVER_ADDR='panel"addr'
-  SECRET='sec\ret"1'
-  DOWNLOAD_URL="https://example.com/gost"
-
-  ask_proxy_config() { :; }
-  ensure_download_url_initialized() { :; }
-  get_config_params() { :; }
-  check_and_install_tcpkill() { :; }
-  cleanup_legacy_gost_installation() { :; }
-  systemctl() { return 0; }
-  curl() {
-    local output=""
-    while [[ $# -gt 0 ]]; do
-      if [[ "$1" == "-o" ]]; then
-        output="$2"
-        shift 2
-        continue
-      fi
-      shift
-    done
-
-    cat > "$output" <<'EOF'
-#!/bin/bash
-echo "new version"
-EOF
-    chmod +x "$output"
-  }
-
-  ( install_flux_agent >/dev/null 2>/dev/null ) || true
-
-  local actual
-  actual=$(<"$INSTALL_DIR/config.json")
-  local expected=$'{\n  "addr": "panel\\"addr",\n  "secret": "sec\\\\ret\\"1"\n}'
-
-  assert_equals "$expected" "$actual" "install_flux_agent should JSON-escape config values"
-)
-
-test_cleanup_legacy_gost_installation_removes_service_and_binary() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  LEGACY_GOST_BINARY=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_ETC=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_LIB=$(mktemp -u)
-  LEGACY_GOST_SERVICE_FILE_USR_LIB=$(mktemp -u)
-  LEGACY_GOST_CONFIG_DIR=$(mktemp -d)
-  cat > "$LEGACY_GOST_SERVICE_FILE_ETC" <<EOF
-[Unit]
-Description=Gost Proxy Service
-
-[Service]
-WorkingDirectory=$LEGACY_GOST_CONFIG_DIR
-ExecStart=$LEGACY_GOST_CONFIG_DIR/gost
-EOF
-  : > "$LEGACY_GOST_CONFIG_DIR/config.json"
-  : > "$LEGACY_GOST_CONFIG_DIR/gost.json"
-
-  local systemctl_calls=""
-
-  systemctl() {
-    systemctl_calls+=$'\n'"$*"
-    if [[ "$1" == "list-units" ]]; then
-      printf 'gost.service loaded active running\n'
-    fi
-    return 0
-  }
-
-  cleanup_legacy_gost_installation >/dev/null
-
-  if [[ -e "$LEGACY_GOST_BINARY" ]]; then
-    fail "cleanup_legacy_gost_installation should remove the legacy gost binary"
-  fi
-  if [[ -e "$LEGACY_GOST_SERVICE_FILE_ETC" ]]; then
-    fail "cleanup_legacy_gost_installation should remove the legacy gost service file"
-  fi
-  [[ "$systemctl_calls" == *"stop gost"* ]] || fail "cleanup_legacy_gost_installation should stop the legacy gost service"
-  [[ "$systemctl_calls" == *"disable gost"* ]] || fail "cleanup_legacy_gost_installation should disable the legacy gost service"
-  [[ "$systemctl_calls" == *"daemon-reload"* ]] || fail "cleanup_legacy_gost_installation should reload systemd after removing the legacy service"
-)
-
-test_cleanup_legacy_gost_installation_preserves_unrelated_gost() (
-  set -euo pipefail
-  load_script_without_main "$ROOT_DIR/install.sh"
-
-  LEGACY_GOST_BINARY=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_ETC=$(mktemp)
-  LEGACY_GOST_SERVICE_FILE_LIB=$(mktemp -u)
-  LEGACY_GOST_SERVICE_FILE_USR_LIB=$(mktemp -u)
-  LEGACY_GOST_CONFIG_DIR=$(mktemp -d)
-  cat > "$LEGACY_GOST_SERVICE_FILE_ETC" <<'EOF'
-[Unit]
-Description=Unrelated Gost Service
-
-[Service]
-WorkingDirectory=/srv/custom-gost
-ExecStart=/usr/local/bin/gost -C /srv/custom-gost/gost.yaml
-EOF
-
-  local systemctl_calls=""
-
-  systemctl() {
-    systemctl_calls+=$'\n'"$*"
-    if [[ "$1" == "list-units" ]]; then
-      printf 'gost.service loaded active running\n'
-    fi
-    return 0
-  }
-
-  cleanup_legacy_gost_installation >/dev/null
-
-  [[ -e "$LEGACY_GOST_BINARY" ]] || fail "cleanup_legacy_gost_installation should preserve unrelated gost binaries"
-  [[ -e "$LEGACY_GOST_SERVICE_FILE_ETC" ]] || fail "cleanup_legacy_gost_installation should preserve unrelated gost service files"
-  [[ "$systemctl_calls" != *"stop gost"* ]] || fail "cleanup_legacy_gost_installation should not stop unrelated gost services"
-  [[ "$systemctl_calls" != *"disable gost"* ]] || fail "cleanup_legacy_gost_installation should not disable unrelated gost services"
-)
-
 test_install_script_accepts_proxy_url_env_without_prompt() (
   set -euo pipefail
   load_script_without_main "$ROOT_DIR/install.sh"
@@ -501,11 +303,6 @@ test_install_script_asks_for_proxy_config
 test_install_script_recomputes_download_url_after_prompt
 test_update_flux_agent_asks_for_proxy_config
 test_update_flux_agent_skips_proxy_prompt_when_not_installed
-test_install_flux_agent_preserves_legacy_gost_when_download_fails
-test_update_flux_agent_preserves_legacy_gost_when_download_fails
-test_install_flux_agent_writes_json_safe_config
-test_cleanup_legacy_gost_installation_removes_service_and_binary
-test_cleanup_legacy_gost_installation_preserves_unrelated_gost
 test_install_script_accepts_proxy_url_env_without_prompt
 test_panel_install_script_can_disable_proxy
 test_panel_install_script_recomputes_compose_urls_after_prompt

vite-frontend/Dockerfile

@@ -1,10 +1,10 @@
 # 多阶段构建 - 构建阶段
-FROM node:22-alpine AS builder
+FROM node:20.19.0 AS builder
 
 WORKDIR /app
 
 COPY package.json pnpm-lock.yaml* ./
-RUN corepack enable pnpm && pnpm config set onlyBuiltDependencies '["@tailwindcss/oxide"]' && pnpm install --frozen-lockfile
+RUN corepack enable pnpm && pnpm install --frozen-lockfile
 
 COPY . .
 RUN pnpm run build

vite-frontend/src/api/index.ts

@@ -42,9 +42,6 @@ import type {
   MonitorAccessApiData,
   TunnelQualityApiItem,
   StorageSummaryApiData,
-  SystemUpgradeCheckApiData,
-  SystemUpgradeRunApiData,
-  SystemUpgradeVersionApiData,
 } from "./types";
 
 import axios from "axios";
@@ -261,24 +258,6 @@ export const updateConfig = (name: string, value: string) =>
 export const getStorageSummary = () =>
   Network.get<StorageSummaryApiData>("/system/storage");
 
-export const getSystemUpgradeVersion = () =>
-  Network.post<SystemUpgradeVersionApiData>("/system/version");
-
-export const checkSystemUpgrade = (channel: ReleaseChannel = "stable") =>
-  Network.post<SystemUpgradeCheckApiData>("/system/check-updates", {
-    channel,
-  });
-
-export const runSystemUpgrade = (
-  version?: string,
-  channel: ReleaseChannel = "stable",
-) =>
-  Network.post<SystemUpgradeRunApiData>(
-    "/system/upgrade",
-    { version: version || "", channel },
-    { timeout: 60 * 1000 },
-  );
-
 export const activateLicense = (licenseKey: string) =>
   Network.post("/license/activate", { license_key: licenseKey });
 

vite-frontend/src/api/types.ts

@@ -48,8 +48,6 @@ export interface TunnelApiItem {
   trafficRatio?: number;
   inIp?: string;
   ipPreference?: string;
-  probeTargetHost?: string;
-  probeTargetPort?: number;
   inNodeId?: TunnelChainNodePayload[];
   outNodeId?: TunnelChainNodePayload[];
   chainNodes?: TunnelChainNodePayload[][];
@@ -200,14 +198,6 @@ export interface NodeReleaseApiItem {
   channel: "stable" | "dev";
 }
 
-export interface SystemUpgradeReleaseApiItem {
-  version: string;
-  name: string;
-  publishedAt: string;
-  prerelease: boolean;
-  channel: "stable" | "dev";
-}
-
 export interface UserPackageInfoApiData {
   userInfo: {
     flow: number;
@@ -338,8 +328,6 @@ export interface TunnelMutationPayload {
   trafficRatio?: number;
   inIp?: string;
   ipPreference?: string;
-  probeTargetHost?: string;
-  probeTargetPort?: number;
   inNodeId?: TunnelChainNodePayload[];
   outNodeId?: TunnelChainNodePayload[];
   chainNodes?: TunnelChainNodePayload[][];
@@ -492,35 +480,6 @@ export interface StorageSummaryApiData {
   databaseSizeText: string;
 }
 
-export interface SystemUpgradeCapabilityApiData {
-  capable: boolean;
-  reasons: string[];
-  deployDir: string;
-  backendContainer: string;
-}
-
-export interface SystemUpgradeVersionApiData {
-  currentVersion: string;
-  latestVersion: string;
-  hasUpdate: boolean;
-  channel: "stable" | "dev";
-  reason?: string;
-  capability: SystemUpgradeCapabilityApiData;
-}
-
-export interface SystemUpgradeCheckApiData extends SystemUpgradeVersionApiData {
-  releases: SystemUpgradeReleaseApiItem[];
-}
-
-export interface SystemUpgradeRunApiData {
-  version: string;
-  channel: "stable" | "dev";
-  composeAsset: string;
-  helperContainer: string;
-  backendImageId: string;
-  message: string;
-}
-
 export interface MonitorNodeApiItem {
   id: number;
   inx: number;
@@ -566,8 +525,6 @@ export interface TunnelQualityApiItem {
   exitToBingLatency: number;
   entryToExitLoss: number;
   exitToBingLoss: number;
-  probeTargetHost?: string;
-  probeTargetPort?: number;
   success: boolean;
   errorMessage?: string;
   timestamp: number;

vite-frontend/src/pages/config.tsx

@@ -1,10 +1,3 @@
-import type {
-  SystemUpgradeCheckApiData,
-  SystemUpgradeRunApiData,
-  SystemUpgradeReleaseApiItem,
-  SystemUpgradeVersionApiData,
-} from "@/api/types";
-
 import { useState, useEffect, useRef } from "react";
 import { useNavigate } from "react-router-dom";
 import { AnimatePresence, motion } from "framer-motion";
@@ -34,9 +27,6 @@ import {
   getAnnouncement,
   updateAnnouncement,
   getStorageSummary,
-  getSystemUpgradeVersion,
-  checkSystemUpgrade,
-  runSystemUpgrade,
   type AnnouncementData,
 } from "@/api";
 import { BackIcon, SettingsIcon } from "@/components/icons";
@@ -302,19 +292,6 @@ export default function ConfigPage() {
   const [updateChannel, setUpdateChannel] = useState<UpdateReleaseChannel>(
     getUpdateReleaseChannel(),
   );
-  const [systemUpgradeInfo, setSystemUpgradeInfo] =
-    useState<SystemUpgradeVersionApiData | null>(null);
-  const [systemUpgradeChecking, setSystemUpgradeChecking] = useState(false);
-  const [systemUpgradeExecuting, setSystemUpgradeExecuting] = useState(false);
-  const [systemUpgradeLoading, setSystemUpgradeLoading] = useState(true);
-  const [systemUpgradeModalOpen, setSystemUpgradeModalOpen] = useState(false);
-  const [systemUpgradeReleases, setSystemUpgradeReleases] = useState<
-    SystemUpgradeReleaseApiItem[]
-  >([]);
-  const [systemUpgradeCheckedChannel, setSystemUpgradeCheckedChannel] =
-    useState<UpdateReleaseChannel | null>(null);
-  const [systemUpgradeSelectedVersion, setSystemUpgradeSelectedVersion] =
-    useState("");
   const [previewLoadFailed, setPreviewLoadFailed] = useState<
     Partial<Record<BrandPreviewKey, boolean>>
   >({});
@@ -322,26 +299,6 @@ export default function ConfigPage() {
     Partial<Record<BrandPreviewKey, boolean>>
   >({});
   const [storageSummary, setStorageSummary] = useState("加载中...");
-  const systemUpgradeReleasesMatchChannel =
-    systemUpgradeCheckedChannel === updateChannel;
-  const systemUpgradeHasConfirmedUpdate = Boolean(
-    systemUpgradeInfo?.hasUpdate &&
-      systemUpgradeReleasesMatchChannel &&
-      systemUpgradeReleases.length > 0,
-  );
-  const canTriggerSystemUpgrade = Boolean(
-    !systemUpgradeLoading &&
-      !systemUpgradeChecking &&
-      !systemUpgradeExecuting &&
-      systemUpgradeInfo?.capability.capable !== false,
-  );
-  const canOpenSystemUpgradeModal = Boolean(
-    systemUpgradeInfo?.capability.capable &&
-      systemUpgradeHasConfirmedUpdate &&
-      !systemUpgradeLoading &&
-      !systemUpgradeChecking &&
-      !systemUpgradeExecuting,
-  );
 
   const canGoBack =
     typeof window !== "undefined" &&
@@ -416,38 +373,11 @@ export default function ConfigPage() {
     }
   };
 
-  const loadSystemUpgradeInfo = async (channel = updateChannel) => {
-    setSystemUpgradeLoading(true);
-    try {
-      const response = await getSystemUpgradeVersion();
-
-      if (response.code === 0 && response.data) {
-        setSystemUpgradeInfo({
-          ...response.data,
-          channel,
-          hasUpdate:
-            response.data.channel === channel ? response.data.hasUpdate : false,
-          latestVersion:
-            response.data.channel === channel
-              ? response.data.latestVersion
-              : "",
-        });
-      } else {
-        setSystemUpgradeInfo(null);
-      }
-    } catch {
-      setSystemUpgradeInfo(null);
-    } finally {
-      setSystemUpgradeLoading(false);
-    }
-  };
-
   useEffect(() => {
     const timer = setTimeout(() => {
       loadConfigs(initialConfigs);
       loadAnnouncement();
       loadStorageSummary();
-      void loadSystemUpgradeInfo();
     }, 100);
 
     return () => clearTimeout(timer);
@@ -487,94 +417,11 @@ export default function ConfigPage() {
   const handleUpdateChannelChange = (channel: UpdateReleaseChannel) => {
     setUpdateChannel(channel);
     setUpdateReleaseChannel(channel);
-    setSystemUpgradeSelectedVersion("");
-    setSystemUpgradeReleases([]);
-    setSystemUpgradeCheckedChannel(null);
-    void loadSystemUpgradeInfo(channel);
     toast.success(
       `更新通道已切换为${channel === "stable" ? "稳定版" : "开发版"}`,
     );
   };
 
-  const handleCheckSystemUpgrade = async () => {
-    const channel = updateChannel;
-
-    setSystemUpgradeChecking(true);
-    try {
-      const response = await checkSystemUpgrade(channel);
-
-      if (response.code === 0 && response.data) {
-        const data = response.data as SystemUpgradeCheckApiData;
-
-        setSystemUpgradeInfo(data);
-        setSystemUpgradeReleases(data.releases || []);
-        setSystemUpgradeCheckedChannel(channel);
-        setSystemUpgradeSelectedVersion("");
-        if (data.latestVersion && !data.hasUpdate) {
-          toast.success("当前已是最新版本");
-
-          return false;
-        }
-        toast.success(
-          data.latestVersion
-            ? `已检查到最新版本 ${data.latestVersion}`
-            : "未获取到可用版本",
-        );
-
-        return Boolean(
-          data.capability.capable && data.hasUpdate && data.releases?.length,
-        );
-      } else {
-        setSystemUpgradeReleases([]);
-        setSystemUpgradeCheckedChannel(null);
-        toast.error(response.msg || "检查更新失败");
-      }
-    } catch {
-      setSystemUpgradeReleases([]);
-      setSystemUpgradeCheckedChannel(null);
-      toast.error("检查更新失败，请重试");
-    } finally {
-      setSystemUpgradeChecking(false);
-    }
-
-    return false;
-  };
-
-  const handleOpenSystemUpgradeModal = async () => {
-    if (!canOpenSystemUpgradeModal) {
-      const checked = await handleCheckSystemUpgrade();
-
-      if (!checked) {
-        return;
-      }
-    }
-    setSystemUpgradeModalOpen(true);
-  };
-
-  const handleConfirmSystemUpgrade = async () => {
-    setSystemUpgradeExecuting(true);
-    try {
-      const response = await runSystemUpgrade(
-        systemUpgradeSelectedVersion || undefined,
-        updateChannel,
-      );
-
-      if (response.code === 0 && response.data) {
-        const data = response.data as SystemUpgradeRunApiData;
-
-        setSystemUpgradeModalOpen(false);
-        setSystemUpgradeSelectedVersion("");
-        toast.success(data.message || "升级已触发，请稍后刷新页面");
-      } else {
-        toast.error(response.msg || "面板升级失败");
-      }
-    } catch {
-      toast.error("面板升级失败，请重试");
-    } finally {
-      setSystemUpgradeExecuting(false);
-    }
-  };
-
   const handleActivateLicense = async () => {
     if (!licenseKeyInput.trim()) {
       toast.error("请输入有效的商业授权码");
@@ -1482,7 +1329,6 @@ export default function ConfigPage() {
             </div>
 
             <Select
-              aria-label="更新通道"
               selectedKeys={[updateChannel]}
               size="md"
               variant="bordered"
@@ -1521,164 +1367,6 @@ export default function ConfigPage() {
             </div>
           </div>
 
-          <Divider className="my-2" />
-
-          <div className="space-y-4 rounded-xl border border-divider bg-default-50/60 p-4 dark:bg-default-100/10">
-            <div className="space-y-1">
-              <p className="text-sm font-medium text-gray-700 dark:text-gray-300">
-                面板自升级
-              </p>
-              <p className="text-xs text-gray-500 dark:text-gray-400">
-                检查当前版本、可用发布并在容器环境中触发面板升级。
-              </p>
-            </div>
-
-            {systemUpgradeLoading ? (
-              <div className="flex items-center gap-2 rounded-lg border border-divider bg-background px-4 py-3 text-sm text-default-500">
-                <Spinner size="sm" />
-                正在加载升级状态...
-              </div>
-            ) : (
-              <div className="space-y-4 rounded-lg border border-divider bg-background px-4 py-4 text-sm text-default-700 dark:text-default-300">
-                <div className="grid gap-3 md:grid-cols-2">
-                  <div>
-                    <p className="text-xs text-default-500">当前版本</p>
-                    <p className="mt-1 font-medium">
-                      {systemUpgradeInfo?.currentVersion || "未获取到版本信息"}
-                    </p>
-                  </div>
-                  <div>
-                    <p className="text-xs text-default-500">最新版本</p>
-                    <p className="mt-1 font-medium">
-                      {systemUpgradeInfo?.latestVersion || "未获取到可用版本"}
-                    </p>
-                  </div>
-                  <div>
-                    <p className="text-xs text-default-500">当前通道</p>
-                    <p className="mt-1 font-medium">
-                      {systemUpgradeInfo?.channel === "dev"
-                        ? "开发版"
-                        : systemUpgradeInfo?.channel === "stable"
-                          ? "稳定版"
-                          : updateChannel === "dev"
-                            ? "开发版"
-                            : "稳定版"}
-                    </p>
-                  </div>
-                  <div>
-                    <p className="text-xs text-default-500">升级能力</p>
-                    <p className="mt-1 font-medium">
-                      {systemUpgradeInfo?.capability.capable
-                        ? "可升级"
-                        : "当前不可升级"}
-                    </p>
-                  </div>
-                </div>
-
-                <div className="grid gap-3 md:grid-cols-2">
-                  <div>
-                    <p className="text-xs text-default-500">部署目录</p>
-                    <p className="mt-1 break-all font-medium">
-                      {systemUpgradeInfo?.capability.deployDir ||
-                        "未获取到部署目录"}
-                    </p>
-                  </div>
-                  <div>
-                    <p className="text-xs text-default-500">后端容器</p>
-                    <p className="mt-1 break-all font-medium">
-                      {systemUpgradeInfo?.capability.backendContainer ||
-                        "未获取到容器信息"}
-                    </p>
-                  </div>
-                </div>
-
-                {!systemUpgradeInfo?.capability.capable && (
-                  <div className="rounded-lg border border-warning-200 bg-warning-50 px-4 py-3 text-warning-800 dark:border-warning-900/40 dark:bg-warning-950/30 dark:text-warning-200">
-                    <p className="text-xs font-medium">当前无法升级</p>
-                    <ul className="mt-2 list-disc space-y-1 pl-4 text-xs">
-                      {(systemUpgradeInfo?.capability.reasons?.length
-                        ? systemUpgradeInfo.capability.reasons
-                        : ["暂未获取到不可升级原因"]
-                      ).map((reason) => (
-                        <li key={reason}>{reason}</li>
-                      ))}
-                    </ul>
-                  </div>
-                )}
-
-                <div className="space-y-3">
-                  <div className="flex flex-col gap-1">
-                    <p className="text-sm font-medium text-gray-700 dark:text-gray-300">
-                      可用发布版本
-                    </p>
-                    <p className="text-xs text-gray-500 dark:text-gray-400">
-                      选择指定版本后执行升级；留空则使用当前通道下最新可用版本。
-                    </p>
-                  </div>
-
-                  <Select
-                    aria-label="目标版本"
-                    isDisabled={
-                      !systemUpgradeReleasesMatchChannel ||
-                      systemUpgradeReleases.length === 0 ||
-                      systemUpgradeExecuting
-                    }
-                    placeholder={
-                      systemUpgradeReleasesMatchChannel &&
-                      systemUpgradeReleases.length > 0
-                        ? "留空时自动选择最新版本"
-                        : "请先检查当前通道更新"
-                    }
-                    selectedKeys={
-                      systemUpgradeSelectedVersion
-                        ? [systemUpgradeSelectedVersion]
-                        : []
-                    }
-                    size="md"
-                    variant="bordered"
-                    onSelectionChange={(keys) => {
-                      const selected = Array.from(keys)[0] as
-                        | string
-                        | undefined;
-
-                      setSystemUpgradeSelectedVersion(selected || "");
-                    }}
-                  >
-                    {(systemUpgradeReleasesMatchChannel
-                      ? systemUpgradeReleases
-                      : []
-                    ).map((release) => (
-                      <SelectItem
-                        key={release.version}
-                        description={release.publishedAt || "暂无发布时间"}
-                      >
-                        {release.name || release.version}
-                      </SelectItem>
-                    ))}
-                  </Select>
-                </div>
-              </div>
-            )}
-
-            <div className="flex flex-col gap-3 pt-1 sm:flex-row sm:justify-end">
-              <Button
-                isLoading={systemUpgradeChecking}
-                variant="flat"
-                onPress={handleCheckSystemUpgrade}
-              >
-                检查更新
-              </Button>
-              <Button
-                color="primary"
-                isDisabled={!canTriggerSystemUpgrade}
-                isLoading={systemUpgradeExecuting}
-                onPress={handleOpenSystemUpgradeModal}
-              >
-                立即升级
-              </Button>
-            </div>
-          </div>
-
           <div className="flex justify-end pt-6 border-t border-divider/50 mt-4">
             <Button
               color="primary"
@@ -1918,64 +1606,6 @@ export default function ConfigPage() {
         </ModalContent>
       </Modal>
 
-      <Modal
-        backdrop="blur"
-        classNames={{
-          base: "!w-[calc(100%-32px)] !mx-auto sm:!w-full rounded-2xl overflow-hidden",
-        }}
-        isOpen={systemUpgradeModalOpen}
-        onOpenChange={(open) => {
-          if (!systemUpgradeExecuting) {
-            setSystemUpgradeModalOpen(open);
-          }
-        }}
-      >
-        <ModalContent>
-          {(onClose) => (
-            <>
-              <ModalHeader>确认面板升级</ModalHeader>
-              <ModalBody>
-                <div className="space-y-3 text-sm text-default-700 dark:text-default-300">
-                  <p>
-                    升级过程需要访问 Docker
-                    Socket，并会在短时间内中断当前面板服务。
-                  </p>
-                  <p>
-                    请确认已经允许面板管理容器与宿主机 Docker
-                    交互，并且可以接受升级期间的临时不可用。
-                  </p>
-                  <div className="space-y-2 rounded-lg border border-warning-200 bg-warning-50 px-4 py-3 text-warning-800 dark:border-warning-900/40 dark:bg-warning-950/30 dark:text-warning-200">
-                    <p className="text-xs font-medium">升级前请确认</p>
-                    <ul className="list-disc space-y-1 pl-4 text-xs">
-                      <li>Docker Socket 可用且挂载权限正常。</li>
-                      <li>当前面板允许短暂停止和重启。</li>
-                      <li>已选择正确的更新通道与目标版本。</li>
-                    </ul>
-                  </div>
-                </div>
-              </ModalBody>
-              <ModalFooter>
-                <Button
-                  isDisabled={systemUpgradeExecuting}
-                  variant="light"
-                  onPress={onClose}
-                >
-                  取消
-                </Button>
-                <Button
-                  color="primary"
-                  isDisabled={systemUpgradeExecuting}
-                  isLoading={systemUpgradeExecuting}
-                  onPress={handleConfirmSystemUpgrade}
-                >
-                  确认升级
-                </Button>
-              </ModalFooter>
-            </>
-          )}
-        </ModalContent>
-      </Modal>
-
       {/* Floating Save Button (FAB) */}
       <AnimatePresence>
         {hasChanges && (

vite-frontend/src/pages/node.tsx

@@ -2582,16 +2582,11 @@ export default function NodePage() {
               />
 
               {/* 高级配置 */}
-              <Accordion className="px-0" variant="light">
+              <Accordion variant="bordered">
                 <AccordionItem
                   key="advanced"
                   aria-label="高级配置"
-                  className="border-b-0 [&_[data-slot=accordion-trigger]]:no-underline [&_[data-slot=accordion-trigger]]:hover:no-underline"
-                  title={
-                    <span className="text-small text-default-500 font-medium">
-                      高级配置
-                    </span>
-                  }
+                  title="高级配置"
                 >
                   <div className="space-y-4 pb-2">
                     <Input
@@ -2688,10 +2683,10 @@ export default function NodePage() {
                         />
                       )}
                       <div
-                        className={`grid grid-cols-1 sm:grid-cols-3 gap-3 bg-content1/30 dark:bg-content1/20 p-3 rounded-md border border-divider ${protocolDisabled ? "opacity-70" : ""}`}
+                        className={`grid grid-cols-1 sm:grid-cols-3 gap-3 bg-default-50 dark:bg-default-100 p-3 rounded-md border border-default-200 dark:border-default-100/30 ${protocolDisabled ? "opacity-70" : ""}`}
                       >
                         {/* HTTP tile */}
-                        <div className="px-3 py-3 rounded-lg bg-content1/55 dark:bg-content1/35 border border-divider hover:border-primary-200 dark:hover:border-primary-500/30 transition-colors">
+                        <div className="px-3 py-3 rounded-lg bg-white dark:bg-default-50 border border-default-200 dark:border-default-100/30 hover:border-primary-200 transition-colors">
                           <div className="flex items-center gap-2 mb-2">
                             <svg
                               aria-hidden="true"
@@ -2732,7 +2727,7 @@ export default function NodePage() {
                         </div>
 
                         {/* TLS tile */}
-                        <div className="px-3 py-3 rounded-lg bg-content1/55 dark:bg-content1/35 border border-divider hover:border-primary-200 dark:hover:border-primary-500/30 transition-colors">
+                        <div className="px-3 py-3 rounded-lg bg-white dark:bg-default-50 border border-default-200 dark:border-default-100/30 hover:border-primary-200 transition-colors">
                           <div className="flex items-center gap-2 mb-2">
                             <svg
                               aria-hidden="true"
@@ -2776,7 +2771,7 @@ export default function NodePage() {
                         </div>
 
                         {/* SOCKS tile */}
-                        <div className="px-3 py-3 rounded-lg bg-content1/55 dark:bg-content1/35 border border-divider hover:border-primary-200 dark:hover:border-primary-500/30 transition-colors">
+                        <div className="px-3 py-3 rounded-lg bg-white dark:bg-default-50 border border-default-200 dark:border-default-100/30 hover:border-primary-200 transition-colors">
                           <div className="flex items-center gap-2 mb-2">
                             <svg
                               aria-hidden="true"

vite-frontend/src/pages/node/tunnel-monitor-view.tsx

@@ -63,19 +63,6 @@ const MONITOR_TUNNEL_QUALITY_ENABLED_CONFIG_KEY =
   "monitor_tunnel_quality_enabled";
 const MONITOR_TUNNEL_QUALITY_ENABLED_EVENT =
   "monitorTunnelQualityEnabledChanged";
-const DEFAULT_PROBE_TARGET_LABEL = "www.bing.com:443";
-
-const probeTargetLabel = (quality?: TunnelQualityApiItem | null) => {
-  if (!quality?.probeTargetHost || !quality.probeTargetPort) {
-    return DEFAULT_PROBE_TARGET_LABEL;
-  }
-
-  const host = quality.probeTargetHost.includes(":")
-    ? `[${quality.probeTargetHost}]`
-    : quality.probeTargetHost;
-
-  return `${host}:${quality.probeTargetPort}`;
-};
 
 const formatTimestamp = (ts: number, rangeMs?: number): string => {
   const date = new Date(ts);
@@ -190,7 +177,7 @@ function UptimeHistoryBar({
           }
 
           const displayLatency = latency >= 0 ? `${latency.toFixed(0)}ms` : "-";
-          const tooltip = `${timeStr} | ${displayLatency} | ${statusText} | 测试目标: ${probeTargetLabel(q)}`;
+          const tooltip = `${timeStr} | ${displayLatency} | ${statusText}`;
 
           return (
             <div
@@ -318,7 +305,7 @@ const QualityChartCard = React.memo(function QualityChartCard({
                       name === "entryToExit"
                         ? "入口→出口"
                         : name === "exitToBing"
-                          ? "出口→测试目标"
+                          ? "出口→Bing"
                           : name;
 
                     return [`${n.toFixed(1)}ms`, label];
@@ -1014,12 +1001,9 @@ export function TunnelMonitorView({
           </Card>
           <Card className="border border-divider/60 shadow-sm hover:shadow-md transition-shadow bg-gradient-to-br from-background to-default-50/50">
             <CardBody className="py-3 px-4 flex flex-col items-center justify-center min-h-[5rem]">
-              <span
-                className="text-[11px] text-default-500 mb-1.5 flex items-center gap-1"
-                title={probeTargetLabel(quality)}
-              >
+              <span className="text-[11px] text-default-500 mb-1.5 flex items-center gap-1">
                 <Globe className="w-3 h-3" />
-                出口 → 测试目标 延迟
+                出口 → Bing 延迟
               </span>
               <LatencyDisplay
                 loading={qualityLoading}
@@ -1043,11 +1027,8 @@ export function TunnelMonitorView({
           </Card>
           <Card className="border border-divider/60 shadow-sm hover:shadow-md transition-shadow bg-gradient-to-br from-background to-default-50/50">
             <CardBody className="py-3 px-4 flex flex-col items-center justify-center min-h-[5rem]">
-              <span
-                className="text-[11px] text-default-500 mb-1.5"
-                title={probeTargetLabel(quality)}
-              >
-                出口 → 测试目标 丢包
+              <span className="text-[11px] text-default-500 mb-1.5">
+                出口 → Bing 丢包
               </span>
               <span
                 className={`text-sm font-semibold font-mono ${(quality?.exitToBingLoss ?? 0) > 0 ? "text-warning" : ""}`}
@@ -1073,9 +1054,6 @@ export function TunnelMonitorView({
               <span>实时隧道质量检测已关闭</span>
             </>
           )}
-          <span className="text-default-400">
-            · 测试目标: {probeTargetLabel(quality)}
-          </span>
           {quality?.timestamp && (
             <span className="text-default-400">
               · 最近更新:{" "}
@@ -1170,7 +1148,6 @@ export function TunnelMonitorView({
           {tunnels.map((tunnel) => {
             const quality = qualityMap[tunnel.id];
             const isEnabled = tunnel.status === 1;
-            const targetLabel = probeTargetLabel(quality);
 
             return (
               <Card
@@ -1226,13 +1203,7 @@ export function TunnelMonitorView({
                     <div className="space-y-1">
                       <div className="text-[10px] text-default-500 flex items-center gap-1">
                         <Globe className="w-3 h-3" />
-                        出口→测试目标
-                      </div>
-                      <div
-                        aria-label={`测试目标 ${targetLabel}`}
-                        className="text-[10px] text-default-400 truncate"
-                      >
-                        {targetLabel}
+                        出口→Bing
                       </div>
                       <UptimeHistoryBar
                         history={qualityHistoryMap[tunnel.id]}
@@ -1288,14 +1259,13 @@ export function TunnelMonitorView({
               <TableColumn>状态</TableColumn>
               <TableColumn>名称</TableColumn>
               <TableColumn>入口→出口</TableColumn>
-              <TableColumn>出口→测试目标</TableColumn>
+              <TableColumn>出口→Bing</TableColumn>
               <TableColumn>更新时间</TableColumn>
             </TableHeader>
             <TableBody emptyContent="暂无隧道">
               {tunnels.map((tunnel) => {
                 const quality = qualityMap[tunnel.id];
                 const isEnabled = tunnel.status === 1;
-                const targetLabel = probeTargetLabel(quality);
 
                 return (
                   <TableRow
@@ -1325,19 +1295,11 @@ export function TunnelMonitorView({
                       />
                     </TableCell>
                     <TableCell>
-                      <div
-                        aria-label={`出口到测试目标 ${targetLabel}`}
-                        className="space-y-1"
-                      >
-                        <UptimeHistoryBar
-                          history={qualityHistoryMap[tunnel.id]}
-                          latestValue={quality?.exitToBingLatency}
-                          type="exitToBing"
-                        />
-                        <span className="block max-w-[160px] truncate text-[10px] text-default-400">
-                          {targetLabel}
-                        </span>
-                      </div>
+                      <UptimeHistoryBar
+                        history={qualityHistoryMap[tunnel.id]}
+                        latestValue={quality?.exitToBingLatency}
+                        type="exitToBing"
+                      />
                     </TableCell>
                     <TableCell>
                       {quality?.timestamp ? (

vite-frontend/src/pages/tunnel.tsx

@@ -46,7 +46,6 @@ import { Alert } from "@/shadcn-bridge/heroui/alert";
 import { Checkbox } from "@/shadcn-bridge/heroui/checkbox";
 import { Progress } from "@/shadcn-bridge/heroui/progress";
 import { Radio, RadioGroup } from "@/shadcn-bridge/heroui/radio";
-import { Accordion, AccordionItem } from "@/shadcn-bridge/heroui/accordion";
 import {
   Table,
   TableHeader,
@@ -98,25 +97,6 @@ interface ChainTunnel {
   connectIp?: string; // 连接IP（多IP节点指定连接地址）
 }
 
-interface BestExitStateItem {
-  ownerNodeId: number;
-  ownerNodeName: string;
-  ownerRole: "entry" | "chain" | string;
-  exitNodeId?: number;
-  exitNodeName: string;
-  updatedAt?: number;
-  reason?: string;
-}
-
-interface BestExitState {
-  enabled: boolean;
-  summary: string;
-  status: "applied" | "waiting" | string;
-  updatedAt?: number;
-  reason?: string;
-  items: BestExitStateItem[];
-}
-
 interface Tunnel {
   id: number;
   inx?: number;
@@ -131,21 +111,10 @@ interface Tunnel {
   flow: number; // 1: 单向, 2: 双向
   trafficRatio: number;
   ipPreference?: string;
-  probeTargetHost?: string;
-  probeTargetPort?: number;
-  bestExitState?: BestExitState;
   status: number;
   createdTime: string;
 }
 
-const DEFAULT_PROBE_TARGET_HOST = "www.bing.com";
-const DEFAULT_PROBE_TARGET_PORT = 443;
-
-const getTunnelDiagnosisTarget = (tunnel: Tunnel) => ({
-  targetIp: tunnel.probeTargetHost || DEFAULT_PROBE_TARGET_HOST,
-  targetPort: tunnel.probeTargetPort || DEFAULT_PROBE_TARGET_PORT,
-});
-
 interface Node {
   id: number;
   name: string;
@@ -167,8 +136,6 @@ interface TunnelForm {
   trafficRatio: number;
   inIp: string; // 入口IP
   ipPreference: string;
-  probeTargetHost?: string;
-  probeTargetPort?: number;
   status: number;
 }
 
@@ -198,131 +165,19 @@ const DEFAULT_TUNNEL_DELETE_ACTION: TunnelDeleteAction = "replace";
 
 const TUNNEL_ORDER_KEY = "tunnel-order";
 
-const isObjectRecord = (value: unknown): value is Record<string, unknown> =>
-  !!value && typeof value === "object" && !Array.isArray(value);
-
-const toSafeString = (value: unknown): string => {
-  if (typeof value === "string") return value;
-  if (typeof value === "number" && Number.isFinite(value)) return String(value);
-
-  return "";
-};
-
-const toSafeNumber = (value: unknown): number | undefined => {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value !== "string" || !value.trim()) return undefined;
-
-  const parsed = Number(value);
-
-  return Number.isFinite(parsed) ? parsed : undefined;
-};
-
-const normalizeBestExitStateItem = (
-  value: unknown,
-): BestExitStateItem | undefined => {
-  if (!isObjectRecord(value)) return undefined;
-
-  const ownerNodeId = toSafeNumber(value.ownerNodeId);
-
-  if (ownerNodeId === undefined) return undefined;
-
-  const exitNodeId = toSafeNumber(value.exitNodeId);
-  const updatedAt = toSafeNumber(value.updatedAt);
-  const reason = toSafeString(value.reason);
-
-  return {
-    ownerNodeId,
-    ownerNodeName: toSafeString(value.ownerNodeName),
-    ownerRole: toSafeString(value.ownerRole),
-    ...(exitNodeId !== undefined ? { exitNodeId } : {}),
-    exitNodeName: toSafeString(value.exitNodeName),
-    ...(updatedAt !== undefined ? { updatedAt } : {}),
-    ...(reason ? { reason } : {}),
-  };
-};
-
-const normalizeBestExitState = (value: unknown): BestExitState | undefined => {
-  if (!isObjectRecord(value) || value.enabled !== true) return undefined;
-
-  const updatedAt = toSafeNumber(value.updatedAt);
-  const reason = toSafeString(value.reason);
-  const items = Array.isArray(value.items)
-    ? value.items.flatMap((item) => {
-        const normalized = normalizeBestExitStateItem(item);
-
-        return normalized ? [normalized] : [];
-      })
-    : [];
-
-  return {
-    enabled: true,
-    summary: toSafeString(value.summary),
-    status: toSafeString(value.status),
-    ...(updatedAt !== undefined ? { updatedAt } : {}),
-    ...(reason ? { reason } : {}),
-    items,
-  };
-};
-
-const bestExitOwnerRoleText = (role?: string) => {
-  if (role === "chain") return "中转";
-
-  return "入口";
-};
-
-const bestExitDetailTitle = (state?: BestExitState) => {
-  if (!state?.items?.length) return undefined;
-
-  return state.items
-    .map(
-      (item) =>
-        `${bestExitOwnerRoleText(item.ownerRole)} ${item.ownerNodeName || item.ownerNodeId} -> ${item.exitNodeName || "等待探测"}`,
-    )
-    .join("\n");
-};
-
-const renderBestExitState = (state?: BestExitState) => {
-  if (!state?.enabled) return null;
-
-  const isWaiting = state.status === "waiting";
-  const summaryText = state.summary || "等待探测";
-  const displaySummary =
-    isWaiting && !summaryText.includes("等待")
-      ? `等待探测 · ${summaryText}`
-      : summaryText;
-  const className = isWaiting
-    ? "border-warning-200/70 bg-warning-50/50 text-warning-700 dark:border-warning-300/20 dark:bg-warning-900/20 dark:text-warning-300"
-    : "border-success-200/60 bg-success-50/40 text-success-700 dark:border-success-300/20 dark:bg-success-900/20 dark:text-success-300";
-
-  return (
-    <span
-      className={`inline-flex max-w-full items-center rounded border px-1.5 py-0.5 text-[11px] leading-4 ${className}`}
-      title={bestExitDetailTitle(state)}
-    >
-      <span className="min-w-0 truncate">最优出口：{displaySummary}</span>
-    </span>
-  );
-};
-
 const mapTunnelApiItems = (items: any[]): Tunnel[] => {
-  return (items || []).map((tunnel) => {
-    const { bestExitState: rawBestExitState, ...tunnelFields } = tunnel;
-    const bestExitState = normalizeBestExitState(rawBestExitState);
-
-    return {
-      ...tunnelFields,
-      ...(bestExitState ? { bestExitState } : {}),
-      inx: tunnel.inx ?? 0,
-      inNodeId: Array.isArray(tunnel.inNodeId) ? tunnel.inNodeId : [],
-      outNodeId: Array.isArray(tunnel.outNodeId) ? tunnel.outNodeId : [],
-      chainNodes: Array.isArray(tunnel.chainNodes) ? tunnel.chainNodes : [],
-      inIp: tunnel.inIp || "",
-      flow: tunnel.flow ?? 1,
-      trafficRatio: tunnel.trafficRatio ?? 1,
-      status: typeof tunnel.status === "number" ? tunnel.status : 0,
-      createdTime: tunnel.createdTime || "",
-    };
-  });
+  return (items || []).map((tunnel) => ({
+    ...tunnel,
+    inx: tunnel.inx ?? 0,
+    inNodeId: Array.isArray(tunnel.inNodeId) ? tunnel.inNodeId : [],
+    outNodeId: Array.isArray(tunnel.outNodeId) ? tunnel.outNodeId : [],
+    chainNodes: Array.isArray(tunnel.chainNodes) ? tunnel.chainNodes : [],
+    inIp: tunnel.inIp || "",
+    flow: tunnel.flow ?? 1,
+    trafficRatio: tunnel.trafficRatio ?? 1,
+    status: typeof tunnel.status === "number" ? tunnel.status : 0,
+    createdTime: tunnel.createdTime || "",
+  }));
 };
 
 export default function TunnelPage() {
@@ -600,8 +455,6 @@ export default function TunnelPage() {
             .join("\n")
         : "",
       ipPreference: tunnel.ipPreference || "",
-      probeTargetHost: tunnel.probeTargetHost || "",
-      probeTargetPort: tunnel.probeTargetPort || 0,
       status: tunnel.status,
     });
     setErrors({});
@@ -878,18 +731,12 @@ export default function TunnelPage() {
         .map((ip) => ip.trim())
         .filter((ip) => ip)
         .join(",");
-      const probeTargetHost = (form.probeTargetHost || "").trim();
-      const probeTargetPort = probeTargetHost
-        ? Number(form.probeTargetPort || 0)
-        : 0;
 
       const data = {
         ...form,
         inIp: inIpString,
         outNodeId: cleanedOutNodeId,
         chainNodes: cleanedChainNodes,
-        probeTargetHost,
-        probeTargetPort,
       };
 
       const response = isEdit
@@ -914,7 +761,6 @@ export default function TunnelPage() {
   const handleDiagnose = async (tunnel: Tunnel) => {
     diagnosisAbortRef.current?.abort();
     const abortController = new AbortController();
-    const diagnosisTarget = getTunnelDiagnosisTarget(tunnel);
 
     diagnosisAbortRef.current = abortController;
 
@@ -1056,7 +902,6 @@ export default function TunnelPage() {
               tunnelType: tunnel.type,
               description: "诊断失败",
               message: response.msg || "诊断过程中发生错误",
-              ...diagnosisTarget,
             }),
           );
           setDiagnosisProgress({
@@ -1088,7 +933,6 @@ export default function TunnelPage() {
           tunnelType: tunnel.type,
           description: "网络错误",
           message: "无法连接到服务器",
-          ...diagnosisTarget,
         }),
       );
       setDiagnosisProgress({
@@ -1792,9 +1636,6 @@ export default function TunnelPage() {
                     tunnel.type === 1
                       ? "text-[10px] h-5 bg-primary-100 text-primary-800 border-primary-300 dark:bg-primary-900/45 dark:text-primary-200 dark:border-primary-700"
                       : "text-[10px] h-5 bg-success-100 text-success-800 border-success-300 dark:bg-success-900/35 dark:text-success-200 dark:border-success-700";
-                  const bestExitStateContent = renderBestExitState(
-                    tunnel.bestExitState,
-                  );
 
                   return (
                     <TableRow key={tunnel.id}>
@@ -1831,27 +1672,24 @@ export default function TunnelPage() {
                         </Chip>
                       </TableCell>
                       <TableCell>
-                        <div className="flex min-w-0 flex-col gap-1.5">
-                          <div className="flex items-center gap-1.5 text-xs">
-                            <span className="font-semibold text-primary-700 dark:text-primary-400">
-                              {tunnel.inNodeId?.length || 0}入口
-                            </span>
-                            <span className="text-default-400">→</span>
-                            <span className="font-semibold text-secondary-700 dark:text-secondary-400">
-                              {tunnel.type === 2
-                                ? tunnel.chainNodes?.length || 0
-                                : 0}
-                              跳
-                            </span>
-                            <span className="text-default-400">→</span>
-                            <span className="font-semibold text-success-700 dark:text-success-400">
-                              {tunnel.type === 2
-                                ? tunnel.outNodeId?.length || 0
-                                : tunnel.inNodeId?.length || 0}
-                              出口
-                            </span>
-                          </div>
-                          {bestExitStateContent}
+                        <div className="flex items-center gap-1.5 text-xs">
+                          <span className="font-semibold text-primary-700 dark:text-primary-400">
+                            {tunnel.inNodeId?.length || 0}入口
+                          </span>
+                          <span className="text-default-400">→</span>
+                          <span className="font-semibold text-secondary-700 dark:text-secondary-400">
+                            {tunnel.type === 2
+                              ? tunnel.chainNodes?.length || 0
+                              : 0}
+                            跳
+                          </span>
+                          <span className="text-default-400">→</span>
+                          <span className="font-semibold text-success-700 dark:text-success-400">
+                            {tunnel.type === 2
+                              ? tunnel.outNodeId?.length || 0
+                              : tunnel.inNodeId?.length || 0}
+                            出口
+                          </span>
                         </div>
                       </TableCell>
                       <TableCell>
@@ -1920,9 +1758,6 @@ export default function TunnelPage() {
                     tunnel.type === 1
                       ? "text-xs bg-primary-100 text-primary-800 border-primary-300 dark:bg-primary-900/45 dark:text-primary-200 dark:border-primary-700"
                       : "text-xs bg-success-100 text-success-800 border-success-300 dark:bg-success-900/35 dark:text-success-200 dark:border-success-700";
-                  const bestExitStateContent = renderBestExitState(
-                    tunnel.bestExitState,
-                  );
 
                   return (
                     <SortableItem key={tunnel.id} id={tunnel.id}>
@@ -2073,11 +1908,6 @@ export default function TunnelPage() {
                                     </span>
                                   </div>
                                 </div>
-                                {bestExitStateContent && (
-                                  <div className="mt-2 flex min-w-0 justify-center">
-                                    {bestExitStateContent}
-                                  </div>
-                                )}
                               </div>
 
                               {/* 流量配置 */}
@@ -2271,6 +2101,85 @@ export default function TunnelPage() {
                     <SelectItem key="2">隧道转发</SelectItem>
                   </Select>
 
+                  <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    <Select
+                      errorMessage={errors.flow}
+                      isInvalid={!!errors.flow}
+                      label="流量计算"
+                      placeholder="请选择流量计算方式"
+                      selectedKeys={[form.flow.toString()]}
+                      variant="bordered"
+                      onSelectionChange={(keys) => {
+                        const selectedKey = Array.from(keys)[0] as string;
+
+                        if (selectedKey) {
+                          setForm((prev) => ({
+                            ...prev,
+                            flow: parseInt(selectedKey),
+                          }));
+                        }
+                      }}
+                    >
+                      <SelectItem key="1">单向计算（仅上传）</SelectItem>
+                      <SelectItem key="2">双向计算（上传+下载）</SelectItem>
+                    </Select>
+
+                    <Input
+                      errorMessage={errors.trafficRatio}
+                      isInvalid={!!errors.trafficRatio}
+                      label="流量倍率"
+                      max={100}
+                      min={0.01}
+                      placeholder="例如：0.5 或 1 或 2"
+                      step="any"
+                      type="number"
+                      value={form.trafficRatio.toString()}
+                      variant="bordered"
+                      onChange={(e) =>
+                        setForm((prev) => ({
+                          ...prev,
+                          trafficRatio: parseFloat(e.target.value) || 0,
+                        }))
+                      }
+                    />
+                  </div>
+
+                  <Textarea
+                    description="入口IP由系统自动从入口节点采集，无需手动填写。支持多个IP，每行一个地址，留空则使用入口节点IP"
+                    errorMessage={errors.inIp}
+                    isInvalid={!!errors.inIp}
+                    label="入口IP"
+                    maxRows={5}
+                    minRows={3}
+                    placeholder="一行一个IP地址或域名，例如:&#10;192.168.1.100&#10;example.com"
+                    value={form.inIp}
+                    variant="bordered"
+                    onChange={(e) =>
+                      setForm((prev) => ({ ...prev, inIp: e.target.value }))
+                    }
+                  />
+
+                  {form.type === 2 && (
+                    <Select
+                      description="当节点同时拥有IPv4和IPv6地址时，选择隧道连接使用的地址类型"
+                      label="隧道连接地址偏好"
+                      placeholder="自动选择"
+                      selectedKeys={[form.ipPreference || ""]}
+                      variant="bordered"
+                      onSelectionChange={(keys) => {
+                        const selectedKey = Array.from(keys)[0] as string;
+
+                        setForm((prev) => ({
+                          ...prev,
+                          ipPreference: selectedKey || "",
+                        }));
+                      }}
+                    >
+                      <SelectItem key="v4">优先IPv4</SelectItem>
+                      <SelectItem key="v6">优先IPv6</SelectItem>
+                    </Select>
+                  )}
+
                   <Divider />
                   <h3 className="text-lg font-semibold">入口配置</h3>
 
@@ -3078,154 +2987,6 @@ export default function TunnelPage() {
                       })()}
                     </>
                   )}
-
-                  <Accordion className="px-0" variant="light">
-                    <AccordionItem
-                      key="advanced"
-                      aria-label="高级设置"
-                      className="border-b-0 [&_[data-slot=accordion-trigger]]:no-underline [&_[data-slot=accordion-trigger]]:hover:no-underline"
-                      title={
-                        <span className="text-small text-default-500 font-medium">
-                          高级设置
-                        </span>
-                      }
-                    >
-                      <div className="space-y-4 pb-2">
-                        <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-                          <Select
-                            errorMessage={errors.flow}
-                            isInvalid={!!errors.flow}
-                            label="流量计算"
-                            placeholder="请选择流量计算方式"
-                            selectedKeys={[form.flow.toString()]}
-                            variant="bordered"
-                            onSelectionChange={(keys) => {
-                              const selectedKey = Array.from(keys)[0] as string;
-
-                              if (selectedKey) {
-                                setForm((prev) => ({
-                                  ...prev,
-                                  flow: parseInt(selectedKey),
-                                }));
-                              }
-                            }}
-                          >
-                            <SelectItem key="1">单向计算（仅上传）</SelectItem>
-                            <SelectItem key="2">
-                              双向计算（上传+下载）
-                            </SelectItem>
-                          </Select>
-
-                          <Input
-                            errorMessage={errors.trafficRatio}
-                            isInvalid={!!errors.trafficRatio}
-                            label="流量倍率"
-                            max={100}
-                            min={0.01}
-                            placeholder="例如：0.5 或 1 或 2"
-                            step="any"
-                            type="number"
-                            value={form.trafficRatio.toString()}
-                            variant="bordered"
-                            onChange={(e) =>
-                              setForm((prev) => ({
-                                ...prev,
-                                trafficRatio: parseFloat(e.target.value) || 0,
-                              }))
-                            }
-                          />
-                        </div>
-
-                        <Textarea
-                          description="入口IP由系统自动从入口节点采集，无需手动填写。支持多个IP，每行一个地址，留空则使用入口节点IP"
-                          errorMessage={errors.inIp}
-                          isInvalid={!!errors.inIp}
-                          label="入口IP"
-                          maxRows={5}
-                          minRows={3}
-                          placeholder="一行一个IP地址或域名，例如:&#10;192.168.1.100&#10;example.com"
-                          value={form.inIp}
-                          variant="bordered"
-                          onChange={(e) =>
-                            setForm((prev) => ({
-                              ...prev,
-                              inIp: e.target.value,
-                            }))
-                          }
-                        />
-
-                        {form.type === 2 && (
-                          <Select
-                            description="当节点同时拥有IPv4和IPv6地址时，选择隧道连接使用的地址类型"
-                            label="隧道连接地址偏好"
-                            placeholder="自动选择"
-                            selectedKeys={[form.ipPreference || ""]}
-                            variant="bordered"
-                            onSelectionChange={(keys) => {
-                              const selectedKey = Array.from(keys)[0] as string;
-
-                              setForm((prev) => ({
-                                ...prev,
-                                ipPreference: selectedKey || "",
-                              }));
-                            }}
-                          >
-                            <SelectItem key="v4">优先IPv4</SelectItem>
-                            <SelectItem key="v6">优先IPv6</SelectItem>
-                          </Select>
-                        )}
-
-                        <div>
-                          <div className="text-sm font-medium">
-                            质量检测目标
-                          </div>
-                          <p className="text-xs text-default-500 mt-0.5">
-                            用于实时隧道质量检测、诊断目标和 best
-                            最优出口评分，留空使用 www.bing.com:443
-                          </p>
-                        </div>
-                        <div className="grid grid-cols-1 md:grid-cols-[1fr_140px] gap-3">
-                          <Input
-                            errorMessage={errors.probeTargetHost}
-                            isInvalid={!!errors.probeTargetHost}
-                            label="Host"
-                            placeholder="www.bing.com"
-                            value={form.probeTargetHost || ""}
-                            variant="bordered"
-                            onChange={(e) =>
-                              setForm((prev) => ({
-                                ...prev,
-                                probeTargetHost: e.target.value,
-                              }))
-                            }
-                          />
-                          <Input
-                            errorMessage={errors.probeTargetPort}
-                            isInvalid={!!errors.probeTargetPort}
-                            label="Port"
-                            max={65535}
-                            min={1}
-                            placeholder="443"
-                            type="number"
-                            value={
-                              form.probeTargetPort
-                                ? String(form.probeTargetPort)
-                                : ""
-                            }
-                            variant="bordered"
-                            onChange={(e) =>
-                              setForm((prev) => ({
-                                ...prev,
-                                probeTargetPort: e.target.value
-                                  ? Number(e.target.value)
-                                  : 0,
-                              }))
-                            }
-                          />
-                        </div>
-                      </div>
-                    </AccordionItem>
-                  </Accordion>
                 </div>
               </ModalBody>
               <ModalFooter>

vite-frontend/src/pages/tunnel/diagnosis.ts

@@ -27,8 +27,6 @@ export interface DiagnosisFallbackInput {
   tunnelType: number;
   description: string;
   message: string;
-  targetIp?: string;
-  targetPort?: number;
 }
 
 export const buildDiagnosisFallbackResult = ({
@@ -36,8 +34,6 @@ export const buildDiagnosisFallbackResult = ({
   tunnelType,
   description,
   message,
-  targetIp = "-",
-  targetPort = 443,
 }: DiagnosisFallbackInput): DiagnosisResult => {
   return {
     tunnelName,
@@ -49,8 +45,8 @@ export const buildDiagnosisFallbackResult = ({
         description,
         nodeName: "-",
         nodeId: "-",
-        targetIp,
-        targetPort,
+        targetIp: "-",
+        targetPort: 443,
         message,
       },
     ],

vite-frontend/src/pages/tunnel/form.ts

@@ -8,8 +8,6 @@ interface TunnelFormInput {
   inNodeId: TunnelChainNode[];
   outNodeId?: TunnelChainNode[];
   trafficRatio: number;
-  probeTargetHost?: string;
-  probeTargetPort?: number;
 }
 
 interface TunnelNodeInput {
@@ -17,96 +15,6 @@ interface TunnelNodeInput {
   status: number;
 }
 
-const isValidProbeIPv4 = (host: string) => {
-  const parts = host.split(".");
-
-  return (
-    parts.length === 4 &&
-    parts.every((part) => {
-      if (!/^\d+$/.test(part)) {
-        return false;
-      }
-      if (part.length > 1 && part.startsWith("0")) {
-        return false;
-      }
-
-      const value = Number(part);
-
-      return value >= 0 && value <= 255;
-    })
-  );
-};
-
-const isIPv4LikeProbeHost = (host: string) =>
-  /^[0-9.]+$/.test(host) && host.includes(".");
-
-const isValidProbeIPv6 = (host: string) => {
-  let value = host;
-
-  if (host.startsWith("[") || host.endsWith("]")) {
-    if (!host.startsWith("[") || !host.endsWith("]")) {
-      return false;
-    }
-    value = host.slice(1, -1);
-  }
-
-  if (!value.includes(":") || value.includes("[") || value.includes("]")) {
-    return false;
-  }
-
-  try {
-    const url = new URL(`http://[${value}]`);
-
-    return url.hostname.length > 0;
-  } catch {
-    return false;
-  }
-};
-
-const isSchemeLikeProbeHost = (host: string) => {
-  if (isValidProbeIPv6(host)) {
-    return false;
-  }
-
-  const colonIndex = host.indexOf(":");
-
-  if (colonIndex <= 0) {
-    return false;
-  }
-
-  return /^[A-Za-z][A-Za-z0-9+.-]*$/.test(host.slice(0, colonIndex));
-};
-
-const isValidProbeDomain = (host: string) => {
-  if (!host || host.length > 253) {
-    return false;
-  }
-
-  return host.split(".").every((label) => {
-    if (
-      !label ||
-      label.length > 63 ||
-      label.startsWith("-") ||
-      label.endsWith("-")
-    ) {
-      return false;
-    }
-
-    return /^[A-Za-z0-9-]+$/.test(label);
-  });
-};
-
-const isValidProbeTargetHost = (host: string) => {
-  if (isValidProbeIPv6(host) || isValidProbeIPv4(host)) {
-    return true;
-  }
-  if (host.includes(":") || isIPv4LikeProbeHost(host)) {
-    return false;
-  }
-
-  return isValidProbeDomain(host);
-};
-
 export const createTunnelFormDefaults = () => {
   return {
     name: "",
@@ -118,8 +26,6 @@ export const createTunnelFormDefaults = () => {
     trafficRatio: 1.0,
     inIp: "",
     ipPreference: "",
-    probeTargetHost: "",
-    probeTargetPort: 0,
     status: 1,
   };
 };
@@ -157,31 +63,6 @@ export const validateTunnelForm = (
     errors.trafficRatio = "流量倍率须大于0，支持小数（如 0.5）";
   }
 
-  const rawProbeHost = form.probeTargetHost || "";
-  const probeHost = rawProbeHost.trim();
-  const probePortInput = form.probeTargetPort;
-  const probePort = Number(probePortInput ?? 0);
-  const hasProbeHostInput = rawProbeHost.length > 0;
-  const hasProbePort = probePortInput != null && probePortInput !== 0;
-
-  if (hasProbeHostInput || hasProbePort) {
-    if (!probeHost) {
-      errors.probeTargetHost = "请输入测试目标 Host";
-    } else if (
-      probeHost.includes("://") ||
-      /[\s/?#]/.test(rawProbeHost) ||
-      isSchemeLikeProbeHost(probeHost)
-    ) {
-      errors.probeTargetHost = "Host 不能包含协议、端口、空格或路径";
-    } else if (!isValidProbeTargetHost(probeHost)) {
-      errors.probeTargetHost = "测试目标 Host 格式无效";
-    }
-
-    if (!Number.isInteger(probePort) || probePort < 1 || probePort > 65535) {
-      errors.probeTargetPort = "端口必须是 1-65535";
-    }
-  }
-
   if (form.type === 2) {
     if (!form.outNodeId || form.outNodeId.length === 0) {
       errors.outNodeId = "请至少选择一个出口节点";

vite-frontend/src/shadcn-bridge/heroui/modal.tsx

@@ -160,6 +160,7 @@ export function ModalContent({
       showCloseButton={false}
       {...props}
     >
+      <DialogTitle className="sr-only">Modal Dialog</DialogTitle>
       {renderedChildren}
     </BaseDialogContent>
   );
@@ -172,17 +173,15 @@ export function ModalHeader({
   const context = useModalContext();
 
   return (
-    <DialogTitle asChild>
-      <div
-        className={cn(
-          "text-lg font-semibold",
-          context?.classNames?.header,
-          className,
-        )}
-        data-slot="modal-header"
-        {...props}
-      />
-    </DialogTitle>
+    <div
+      className={cn(
+        "text-lg font-semibold",
+        context?.classNames?.header,
+        className,
+      )}
+      data-slot="modal-header"
+      {...props}
+    />
   );
 }
 

vite-frontend/src/shadcn-bridge/heroui/select.tsx

@@ -23,7 +23,6 @@ interface ClassNameMap {
 }
 
 export interface SelectProps<T = unknown> extends FieldMetaProps {
-  "aria-label"?: string;
   children?: React.ReactNode | ((item: T) => React.ReactNode);
   className?: string;
   classNames?: ClassNameMap;
@@ -147,7 +146,6 @@ function textSizeClass(size: SelectProps["size"]) {
 }
 
 export function Select<T>({
-  "aria-label": ariaLabel,
   children,
   className,
   classNames,
@@ -367,7 +365,6 @@ export function Select<T>({
             aria-controls={`${generatedId}-listbox`}
             aria-expanded={isExpanded}
             aria-haspopup="listbox"
-            aria-label={label ? undefined : ariaLabel}
             className={cn(
               "flex w-full min-w-0 items-center gap-2 overflow-hidden rounded-md border border-input bg-background px-3 py-2 text-left shadow-sm focus:outline-none focus-visible:ring-2 focus-visible:ring-ring",
               isDisabled ? "cursor-not-allowed opacity-60" : "",
@@ -401,7 +398,6 @@ export function Select<T>({
         </div>
       ) : (
         <select
-          aria-label={label ? undefined : ariaLabel}
           className={cn(
             "w-full rounded-md border border-input bg-background px-3 py-2 text-foreground shadow-sm focus:outline-none focus-visible:ring-2 focus-visible:ring-ring dark:[color-scheme:dark]",
             sizeClass(size),