feat: add AGENTS.md for build commands and architecture overview

refactor: remove unused code for HTTP method handling in update management
Merge branch 'main' of https://git.92coco.cn/flik/GoTunnel
2026-03-17 23:54:44 +08:00 · 2026-03-17 23:17:57 +08:00 · 2026-03-17 23:16:32 +08:00 · 2026-03-17 23:16:30 +08:00 · 2026-03-17 23:16:08 +08:00 · 2026-03-10 20:50:40 +08:00
46 changed files with 765 additions and 6576 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,114 @@
 # AGENTS.md
 This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
 ## Build Commands
 ```bash
 # Build server and client binaries
 go build -o server ./cmd/server
 go build -o client ./cmd/client
 # Run server (zero-config, auto-generates token and TLS cert)
 ./server
 ./server -c server.yaml  # with config file
 # Run client
 ./client -s <server>:7000 -t <token> -id <client-id>
 ./client -s <server>:7000 -t <token> -id <client-id> -no-tls  # disable TLS
 # Web UI development (in web/ directory)
 cd web && npm install && npm run dev    # development server
 cd web && npm run build                  # production build (outputs to web/dist/)
 # Cross-platform build (Windows PowerShell)
 .\scripts\build.ps1
 # Cross-platform build (Linux/Mac)
 ./scripts/build.sh all
 ```
 ## Architecture Overview
 GoTunnel is an intranet penetration tool (similar to frp) with **server-centric configuration** - clients require zero configuration and receive mapping rules from the server after authentication.
 ### Core Design
 - **Yamux Multiplexing**: Single TCP connection carries both control (auth, config, heartbeat) and data channels
 - **Binary Protocol**: `[Type(1 byte)][Length(4 bytes)][Payload(JSON)]` - see `pkg/protocol/message.go`
 - **TLS by Default**: Auto-generated self-signed ECDSA P-256 certificates, no manual setup required
 - **Embedded Web UI**: Vue.js SPA embedded in server binary via `//go:embed`
 - **JS Plugin System**: Extensible plugin system using goja JavaScript runtime
 ### Package Structure
 ```
 cmd/server/          # Server entry point
 cmd/client/          # Client entry point
 internal/server/
  ├── tunnel/        # Core tunnel server, client session management
  ├── config/        # YAML configuration loading
  ├── db/            # SQLite storage (ClientStore, JSPluginStore interfaces)
  ├── app/           # Web server, SPA handler
  ├── router/        # REST API endpoints (Swagger documented)
  └── plugin/        # Server-side JS plugin manager
 internal/client/
  └── tunnel/        # Client tunnel logic, auto-reconnect, plugin execution
 pkg/
  ├── protocol/      # Message types and serialization
  ├── crypto/        # TLS certificate generation
  ├── relay/         # Bidirectional data relay (32KB buffers)
  ├── auth/          # JWT authentication
  ├── utils/         # Port availability checking
  ├── version/       # Version info and update checking (Gitea API)
  └── update/        # Shared update logic (download, extract tar.gz/zip)
 web/                 # Vue 3 + TypeScript frontend (Vite + naive-ui)
 scripts/             # Build scripts (build.sh, build.ps1)
 ```
 ### Key Interfaces
 - `ClientStore` (internal/server/db/): Database abstraction for client rules storage
 - `ServerInterface` (internal/server/router/handler/): API handler interface
 ### Proxy Types
 1. **TCP** (default): Direct port forwarding (remote_port → local_ip:local_port)
 2. **UDP**: UDP port forwarding
 3. **HTTP**: HTTP proxy through client network
 4. **HTTPS**: HTTPS proxy through client network
 5. **SOCKS5**: SOCKS5 proxy through client network
 ### Data Flow
 External User → Server Port → Yamux Stream → Client → Local Service
 ### Configuration
 - Server: YAML config + SQLite database for client rules and JS plugins
 - Client: Command-line flags only (server address, token, client ID)
 - Default ports: 7000 (tunnel), 7500 (web console)
 ## API Documentation
 The server provides Swagger-documented REST APIs at `/api/`.
 ### Key Endpoints
 - `POST /api/auth/login` - JWT authentication
 - `GET /api/clients` - List all clients
 - `GET /api/client/{id}` - Get client details
 - `PUT /api/client/{id}` - Update client config
 - `POST /api/client/{id}/push` - Push config to online client
 - `POST /api/client/{id}/plugin/{name}/{action}` - Plugin actions (start/stop/restart/delete)
 - `GET /api/plugins` - List registered plugins
 - `GET /api/update/check/server` - Check server updates
 - `POST /api/update/apply/server` - Apply server update
 ## Update System
 Both server and client support self-update from Gitea releases.
 - Release assets are compressed archives (`.tar.gz` for Linux/Mac, `.zip` for Windows)
 - The `pkg/update/` package handles download, extraction, and binary replacement
 - Updates can be triggered from the Web UI at `/update` page
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -61,13 +61,7 @@ pkg/
  ├── auth/          # JWT authentication
  ├── utils/         # Port availability checking
  ├── version/       # Version info and update checking (Gitea API)
-  ├── update/        # Shared update logic (download, extract tar.gz/zip)
+  └── update/        # Shared update logic (download, extract tar.gz/zip)
  └── plugin/        # Plugin system core
      ├── types.go       # Plugin interfaces
      ├── registry.go    # Plugin registry
      ├── script/        # JS plugin runtime (goja)
      ├── sign/          # Plugin signature verification
      └── store/         # Plugin persistence (SQLite)
 web/                 # Vue 3 + TypeScript frontend (Vite + naive-ui)
 scripts/             # Build scripts (build.sh, build.ps1)
 ```
@@ -75,23 +69,16 @@ scripts/             # Build scripts (build.sh, build.ps1)
 ### Key Interfaces
 - `ClientStore` (internal/server/db/): Database abstraction for client rules storage
 - `JSPluginStore` (internal/server/db/): JS plugin persistence
 - `ServerInterface` (internal/server/router/handler/): API handler interface
 - `ClientPlugin` (pkg/plugin/): Plugin interface for client-side plugins
 ### Proxy Types
 **内置类型** (直接在 tunnel 中处理):
 1. **TCP** (default): Direct port forwarding (remote_port → local_ip:local_port)
 2. **UDP**: UDP port forwarding
 3. **HTTP**: HTTP proxy through client network
 4. **HTTPS**: HTTPS proxy through client network
 5. **SOCKS5**: SOCKS5 proxy through client network
 **JS 插件类型** (通过 goja 运行时):
 - Custom application plugins (file-server, api-server, etc.)
 - Runs on client side with sandbox restrictions
 ### Data Flow
 External User → Server Port → Yamux Stream → Client → Local Service
@@ -102,44 +89,6 @@ External User → Server Port → Yamux Stream → Client → Local Service
 - Client: Command-line flags only (server address, token, client ID)
 - Default ports: 7000 (tunnel), 7500 (web console)
 ## Plugin System
 GoTunnel supports a JavaScript-based plugin system using the goja runtime.
 ### Plugin Architecture
 - **内置协议**: tcp, udp, http, https, socks5 直接在 tunnel 代码中处理
 - **JS Plugins**: 自定义应用插件通过 goja 运行时在客户端执行
 - **Plugin Store**: 从官方商店浏览和安装插件
 - **Signature Verification**: 插件需要签名验证才能运行
 ### JS Plugin Lifecycle
 ```javascript
 function metadata() {
    return {
        name: "plugin-name",
        version: "1.0.0",
        type: "app",
        description: "Plugin description",
        author: "Author"
    };
 }
 function start() { /* called on plugin start */ }
 function handleConn(conn) { /* handle each connection */ }
 function stop() { /* called on plugin stop */ }
 ```
 ### Plugin APIs
 - **Basic**: `log()`, `config()`
 - **Connection**: `conn.Read()`, `conn.Write()`, `conn.Close()`
 - **File System**: `fs.readFile()`, `fs.writeFile()`, `fs.readDir()`, `fs.stat()`, etc.
 - **HTTP**: `http.serve()`, `http.json()`, `http.sendFile()`
 See `PLUGINS.md` for detailed plugin development documentation.
 ## API Documentation
 The server provides Swagger-documented REST APIs at `/api/`.
--- a/PLUGINS.md
+++ b/PLUGINS.md
@@ -1,645 +0,0 @@
 # GoTunnel 插件开发指南
 本文档介绍如何为 GoTunnel 开发 JS 插件。JS 插件基于 [goja](https://github.com/dop251/goja) 运行时，运行在客户端上。
 ## 目录
 - [快速开始](#快速开始)
 - [插件结构](#插件结构)
 - [API 参考](#api-参考)
 - [示例插件](#示例插件)
 - [插件签名](#插件签名)
 - [发布到商店](#发布到商店)
 ---
 ## 快速开始
 ### 最小插件示例
 ```javascript
 // 必须：定义插件元数据
 function metadata() {
    return {
        name: "my-plugin",
        version: "1.0.0",
        type: "app",
        description: "My first plugin",
        author: "Your Name"
    };
 }
 // 可选：插件启动时调用
 function start() {
    log("Plugin started");
 }
 // 必须：处理连接
 function handleConn(conn) {
    // 处理连接逻辑
    conn.Close();
 }
 // 可选：插件停止时调用
 function stop() {
    log("Plugin stopped");
 }
 ```
 ---
 ## 插件结构
 ### 生命周期函数
 | 函数 | 必须 | 说明 |
 |------|------|------|
 | `metadata()` | 否 | 返回插件元数据，不定义则使用默认值 |
 | `start()` | 否 | 插件启动时调用 |
 | `handleConn(conn)` | 是 | 处理每个连接 |
 | `stop()` | 否 | 插件停止时调用 |
 ### 元数据字段
 ```javascript
 function metadata() {
    return {
        name: "plugin-name",      // 插件名称
        version: "1.0.0",         // 版本号
        type: "app",              // 类型: "app" (应用插件)
        description: "描述",      // 插件描述
        author: "作者"            // 作者名称
    };
 }
 ```
 ---
 ## API 参考
 ### 基础 API
 #### `log(message)`
 输出日志信息。
 ```javascript
 log("Hello, World!");
 // 输出: [JS:plugin-name] Hello, World!
 ```
 #### `config(key)`
 获取插件配置值。
 ```javascript
 var port = config("port");
 var host = config("host") || "127.0.0.1";
 ```
 ---
 ### 连接 API (conn)
 `handleConn` 函数接收的 `conn` 对象提供以下方法：
 #### `conn.Read(size)`
 读取数据，返回字节数组，失败返回 `null`。
 ```javascript
 var data = conn.Read(1024);
 if (data) {
    log("Received " + data.length + " bytes");
 }
 ```
 #### `conn.Write(data)`
 写入数据，返回写入的字节数。
 ```javascript
 var written = conn.Write(data);
 log("Wrote " + written + " bytes");
 ```
 #### `conn.Close()`
 关闭连接。
 ```javascript
 conn.Close();
 ```
 ---
 ### 文件系统 API (fs)
 所有文件操作都在沙箱中执行，有路径和大小限制。
 #### `fs.readFile(path)`
 读取文件内容。
 ```javascript
 var result = fs.readFile("/path/to/file.txt");
 if (result.error) {
    log("Error: " + result.error);
 } else {
    log("Content: " + result.data);
 }
 ```
 #### `fs.writeFile(path, content)`
 写入文件内容。
 ```javascript
 var result = fs.writeFile("/path/to/file.txt", "Hello");
 if (result.ok) {
    log("File written");
 } else {
    log("Error: " + result.error);
 }
 ```
 #### `fs.readDir(path)`
 读取目录内容。
 ```javascript
 var result = fs.readDir("/path/to/dir");
 if (!result.error) {
    for (var i = 0; i < result.entries.length; i++) {
        var entry = result.entries[i];
        log(entry.name + " - " + (entry.isDir ? "DIR" : entry.size + " bytes"));
    }
 }
 ```
 #### `fs.stat(path)`
 获取文件信息。
 ```javascript
 var result = fs.stat("/path/to/file");
 if (!result.error) {
    log("Name: " + result.name);
    log("Size: " + result.size);
    log("IsDir: " + result.isDir);
    log("ModTime: " + result.modTime);
 }
 ```
 #### `fs.exists(path)`
 检查文件是否存在。
 ```javascript
 var result = fs.exists("/path/to/file");
 if (result.exists) {
    log("File exists");
 }
 ```
 #### `fs.mkdir(path)`
 创建目录。
 ```javascript
 var result = fs.mkdir("/path/to/new/dir");
 if (result.ok) {
    log("Directory created");
 }
 ```
 #### `fs.remove(path)`
 删除文件或目录。
 ```javascript
 var result = fs.remove("/path/to/file");
 if (result.ok) {
    log("Removed");
 }
 ```
 ---
 ### HTTP API (http)
 用于构建简单的 HTTP 服务。
 #### `http.serve(conn, handler)`
 处理 HTTP 请求。
 ```javascript
 function handleConn(conn) {
    http.serve(conn, function(req) {
        return {
            status: 200,
            contentType: "application/json",
            body: http.json({ message: "Hello", path: req.path })
        };
    });
 }
 ```
 **请求对象 (req):**
 | 字段 | 类型 | 说明 |
 |------|------|------|
 | `method` | string | HTTP 方法 (GET, POST, etc.) |
 | `path` | string | 请求路径 |
 | `body` | string | 请求体 |
 **响应对象:**
 | 字段 | 类型 | 说明 |
 |------|------|------|
 | `status` | number | HTTP 状态码 (默认 200) |
 | `contentType` | string | Content-Type (默认 application/json) |
 | `body` | string | 响应体 |
 #### `http.json(data)`
 将对象序列化为 JSON 字符串。
 ```javascript
 var jsonStr = http.json({ name: "test", value: 123 });
 // 返回: '{"name":"test","value":123}'
 ```
 #### `http.sendFile(conn, filePath)`
 发送文件作为 HTTP 响应。
 ```javascript
 function handleConn(conn) {
    http.sendFile(conn, "/path/to/index.html");
 }
 ```
 ---
 ### 增强 API (Enhanced APIs)
 GoTunnel v2.0+ 提供了更多强大的 API 能力。
 #### `logger` (日志)
 推荐使用结构化日志替代简单的 `log()`。
 - `logger.info(msg)`
 - `logger.warn(msg)`
 - `logger.error(msg)`
 ```javascript
 logger.info("Server started");
 logger.error("Connection failed");
 ```
 #### `config` (配置)
 增强的配置获取方式。
 - `config.get(key)`: 获取配置值
 - `config.getAll()`: 获取所有配置
 ```javascript
 var all = config.getAll();
 var port = config.get("port");
 ```
 #### `storage` (持久化存储)
 简单的 Key-Value 存储，数据保存在客户端本地。
 - `storage.get(key, default)`
 - `storage.set(key, value)`
 - `storage.delete(key)`
 - `storage.keys()`
 ```javascript
 storage.set("last_run", Date.now());
 var last = storage.get("last_run", 0);
 ```
 #### `event` (事件总线)
 插件内部或插件间的事件通信。
 - `event.on(name, callback)`
 - `event.emit(name, data)`
 - `event.off(name)`
 ```javascript
 event.on("user_login", function(user) {
    logger.info("User logged in: " + user);
 });
 event.emit("user_login", "admin");
 ```
 #### `request` (HTTP 请求)
 发起外部 HTTP 请求。
 - `request.get(url)`
 - `request.post(url, contentType, body)`
 ```javascript
 var res = request.get("https://api.ipify.org");
 logger.info("My IP: " + res.body);
 ```
 #### `notify` (通知)
 发送系统通知。
 - `notify.send(title, message)`
 ```javascript
 notify.send("Download Complete", "File saved to disk");
 ```
 ---
 ## 示例插件
 ### Echo 服务
 ```javascript
 function metadata() {
    return {
        name: "echo",
        version: "1.0.0",
        type: "app",
        description: "Echo back received data"
    };
 }
 function handleConn(conn) {
    while (true) {
        var data = conn.Read(4096);
        if (!data || data.length === 0) {
            break;
        }
        conn.Write(data);
    }
    conn.Close();
 }
 ```
 ### HTTP 文件服务器
 ```javascript
 function metadata() {
    return {
        name: "file-server",
        version: "1.0.0",
        type: "app",
        description: "Simple HTTP file server"
    };
 }
 var rootDir = "";
 function start() {
    rootDir = config("root") || "/tmp";
    log("Serving files from: " + rootDir);
 }
 function handleConn(conn) {
    http.serve(conn, function(req) {
        if (req.method === "GET") {
            var filePath = rootDir + req.path;
            if (req.path === "/") {
                filePath = rootDir + "/index.html";
            }
            var stat = fs.stat(filePath);
            if (stat.error) {
                return { status: 404, body: "Not Found" };
            }
            if (stat.isDir) {
                return listDirectory(filePath);
            }
            var file = fs.readFile(filePath);
            if (file.error) {
                return { status: 500, body: file.error };
            }
            return {
                status: 200,
                contentType: "text/html",
                body: file.data
            };
        }
        return { status: 405, body: "Method Not Allowed" };
    });
 }
 function listDirectory(path) {
    var result = fs.readDir(path);
    if (result.error) {
        return { status: 500, body: result.error };
    }
    var html = "<html><body><h1>Directory Listing</h1><ul>";
    for (var i = 0; i < result.entries.length; i++) {
        var e = result.entries[i];
        html += "<li><a href='" + e.name + "'>" + e.name + "</a></li>";
    }
    html += "</ul></body></html>";
    return { status: 200, contentType: "text/html", body: html };
 }
 ```
 ### JSON API 服务
 ```javascript
 function metadata() {
    return {
        name: "api-server",
        version: "1.0.0",
        type: "app",
        description: "JSON API server"
    };
 }
 var counter = 0;
 function handleConn(conn) {
    http.serve(conn, function(req) {
        if (req.path === "/api/status") {
            return {
                status: 200,
                body: http.json({
                    status: "ok",
                    counter: counter++,
                    timestamp: Date.now()
                })
            };
        }
        if (req.path === "/api/echo" && req.method === "POST") {
            return {
                status: 200,
                body: http.json({
                    received: req.body
                })
            };
        }
        return {
            status: 404,
            body: http.json({ error: "Not Found" })
        };
    });
 }
 ```
 ---
 ## 插件签名
 为了安全，JS 插件需要官方签名才能运行。
 ### 签名格式
 签名文件 (`.sig`) 包含 Base64 编码的签名数据：
 ```json
 {
  "payload": {
    "name": "plugin-name",
    "version": "1.0.0",
    "checksum": "sha256-hash",
    "key_id": "official-v1"
  },
  "signature": "base64-signature"
 }
 ```
 ### 获取签名
 1. 提交插件到官方仓库
 2. 通过审核后获得签名
 3. 将 `.js` 和 `.sig` 文件一起分发
 ---
 ## 发布到商店
 ### 商店 JSON 格式
 插件商店使用 `store.json` 文件索引所有插件：
 ```json
 [
  {
    "name": "echo",
    "version": "1.0.0",
    "type": "app",
    "description": "Echo service plugin",
    "author": "GoTunnel",
    "icon": "https://example.com/icon.png",
    "download_url": "https://example.com/plugins/echo.js"
  }
 ]
 ```
 ### 提交流程
 1. Fork 官方插件仓库
 2. 添加插件文件到 `plugins/` 目录
 3. 更新 `store.json`
 4. 提交 Pull Request
 5. 等待审核和签名
 ---
 ## 沙箱限制
 为了安全，JS 插件运行在沙箱环境中：
 | 限制项 | 默认值 |
 |--------|--------|
 | 最大读取文件大小 | 10 MB |
 | 最大写入文件大小 | 10 MB |
 | 允许读取路径 | 插件数据目录 |
 | 允许写入路径 | 插件数据目录 |
 ---
 ## 调试技巧
 ### 日志输出
 使用 `log()` 函数输出调试信息：
 ```javascript
 log("Debug: variable = " + JSON.stringify(variable));
 ```
 ### 错误处理
 始终检查 API 返回的错误：
 ```javascript
 var result = fs.readFile(path);
 if (result.error) {
    log("Error reading file: " + result.error);
    return;
 }
 ```
 ### 配置测试
 在 Web 控制台的插件管理页面安装并配置插件，或通过 API 安装：
 ```bash
 # 安装 JS 插件到客户端
 POST /api/client/{id}/plugin/js/install
 Content-Type: application/json
 {
  "plugin_name": "my-plugin",
  "source": "function metadata() {...}",
  "rule_name": "my-rule",
  "remote_port": 8080,
  "config": {"debug": "true"},
  "auto_start": true
 }
 ```
 ---
 ## 常见问题
 **Q: 插件无法加载？**
 A: 检查签名文件是否存在且有效。
 **Q: 文件操作失败？**
 A: 确认路径在沙箱允许范围内。
 **Q: 如何获取客户端 IP？**
 A: 目前 API 不支持，计划在后续版本添加。
 ---
 ## 更新日志
 ### v1.0.0
 - 初始版本
 - 支持基础 API: log, config
 - 支持连接 API: Read, Write, Close
 - 支持文件系统 API: fs.*
 - 支持 HTTP API: http.*
--- a/cmd/client/main.go
+++ b/cmd/client/main.go
@@ -7,7 +7,6 @@ import (
 	"github.com/gotunnel/internal/client/config"
 	"github.com/gotunnel/internal/client/tunnel"
 	"github.com/gotunnel/pkg/crypto"
 	"github.com/gotunnel/pkg/plugin"
 	"github.com/gotunnel/pkg/version"
 )
@@ -68,14 +67,5 @@ func main() {
 		log.Printf("[Client] TLS enabled")
 	}
 	// 初始化插件注册表（用于 JS 插件）
 	registry := plugin.NewRegistry()
 	client.SetPluginRegistry(registry)
 	// 初始化版本存储
 	if err := client.InitVersionStore(); err != nil {
 		log.Printf("[Client] Warning: failed to init version store: %v", err)
 	}
 	client.Run()
 }
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -26,7 +26,6 @@ import (
 	"github.com/gotunnel/internal/server/db"
 	"github.com/gotunnel/internal/server/tunnel"
 	"github.com/gotunnel/pkg/crypto"
 	"github.com/gotunnel/pkg/plugin"
 	"github.com/gotunnel/pkg/version"
 )
@@ -80,11 +79,8 @@ func main() {
 		log.Printf("[Server] TLS enabled")
 	}
-	// 初始化插件系统（用于客户端 JS 插件管理）
+	// 设置流量存储，用于记录流量统计
-	registry := plugin.NewRegistry()
+	server.SetTrafficStore(clientStore)
 	server.SetPluginRegistry(registry)
 	server.SetJSPluginStore(clientStore) // 设置 JS 插件存储，用于客户端重连时恢复插件
 	server.SetTrafficStore(clientStore)  // 设置流量存储，用于记录流量统计
 	// 启动 Web 控制台
 	if cfg.Server.Web.Enabled {
--- a/go.mod
+++ b/go.mod
@@ -3,13 +3,13 @@ module github.com/gotunnel
 go 1.24.0
 require (
 	github.com/dop251/goja v0.0.0-20251201205617-2bb4c724c0f9
 	github.com/gin-gonic/gin v1.11.0
 	github.com/go-playground/validator/v10 v10.30.1
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/hashicorp/yamux v0.1.1
 	github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018
 	github.com/shirou/gopsutil/v3 v3.24.5
 	github.com/swaggo/files v1.0.1
 	github.com/swaggo/gin-swagger v1.6.1
@@ -24,7 +24,6 @@ require (
 	github.com/bytedance/sonic v1.14.2 // indirect
 	github.com/bytedance/sonic/loader v0.4.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/dlclark/regexp2 v1.11.4 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
 	github.com/gen2brain/shm v0.1.0 // indirect
@@ -42,14 +41,11 @@ require (
 	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.1 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
 	github.com/jezek/xgb v1.1.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,5 @@
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
 github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
 github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
 github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
 github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
@@ -14,10 +12,6 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
 github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dop251/goja v0.0.0-20251201205617-2bb4c724c0f9 h1:3uSSOd6mVlwcX3k5OYOpiDqFgRmaE2dBfLvVIFWWHrw=
 github.com/dop251/goja v0.0.0-20251201205617-2bb4c724c0f9/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
@@ -67,8 +61,6 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
 github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
 github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
 github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
@@ -224,8 +216,6 @@ google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/internal/client/tunnel/client.go
+++ b/internal/client/tunnel/client.go
@@ -11,13 +11,9 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"sync"
 	"time"
 	"github.com/gotunnel/pkg/plugin"
 	"github.com/gotunnel/pkg/plugin/script"
 	"github.com/gotunnel/pkg/plugin/sign"
 	"github.com/gotunnel/pkg/protocol"
 	"github.com/gotunnel/pkg/relay"
 	"github.com/gotunnel/pkg/update"
@@ -38,21 +34,17 @@ const (
 // Client 隧道客户端
 type Client struct {
-	ServerAddr     string
+	ServerAddr string
-	Token          string
+	Token      string
-	ID             string
+	ID         string
-	Name           string // 客户端名称（主机名）
+	Name       string // 客户端名称（主机名）
-	TLSEnabled     bool
+	TLSEnabled bool
-	TLSConfig      *tls.Config
+	TLSConfig  *tls.Config
-	DataDir        string // 数据目录
+	DataDir    string // 数据目录
-	session        *yamux.Session
+	session    *yamux.Session
-	rules          []protocol.ProxyRule
+	rules      []protocol.ProxyRule
-	mu             sync.RWMutex
+	mu         sync.RWMutex
-	pluginRegistry *plugin.Registry
+	logger     *Logger // 日志收集器
 	runningPlugins map[string]plugin.ClientPlugin
 	versionStore   *PluginVersionStore
 	pluginMu       sync.RWMutex
 	logger         *Logger // 日志收集器
 }
 // NewClient 创建客户端
@@ -93,30 +85,20 @@ func NewClient(serverAddr, token, id string) *Client {
 	}
 	return &Client{
-		ServerAddr:     serverAddr,
+		ServerAddr: serverAddr,
-		Token:          token,
+		Token:      token,
-		ID:             id,
+		ID:         id,
-		Name:           hostname,
+		Name:       hostname,
-		DataDir:        dataDir,
+		DataDir:    dataDir,
-		runningPlugins: make(map[string]plugin.ClientPlugin),
+		logger:     logger,
 		logger:         logger,
 	}
 }
 // InitVersionStore 初始化版本存储
 func (c *Client) InitVersionStore() error {
 	store, err := NewPluginVersionStore(c.DataDir)
 	if err != nil {
 		return err
 	}
 	c.versionStore = store
 	return nil
 }
 // SetPluginRegistry 设置插件注册表
 func (c *Client) SetPluginRegistry(registry *plugin.Registry) {
 	c.pluginRegistry = registry
 }
 // logf 安全地记录日志（同时输出到标准日志和日志收集器）
 func (c *Client) logf(format string, args ...interface{}) {
@@ -261,31 +243,14 @@ func (c *Client) handleStream(stream net.Conn) {
 		c.handleProxyConnect(stream, msg)
 	case protocol.MsgTypeUDPData:
 		c.handleUDPData(stream, msg)
 	case protocol.MsgTypePluginConfig:
 		defer stream.Close()
 		c.handlePluginConfig(msg)
 	case protocol.MsgTypeClientPluginStart:
 		c.handleClientPluginStart(stream, msg)
 	case protocol.MsgTypeClientPluginStop:
 		c.handleClientPluginStop(stream, msg)
 	case protocol.MsgTypeClientPluginConn:
 		c.handleClientPluginConn(stream, msg)
 	case protocol.MsgTypeJSPluginInstall:
 		c.handleJSPluginInstall(stream, msg)
 	case protocol.MsgTypeClientRestart:
 		c.handleClientRestart(stream, msg)
 	case protocol.MsgTypePluginConfigUpdate:
 		c.handlePluginConfigUpdate(stream, msg)
 	case protocol.MsgTypeUpdateDownload:
 		c.handleUpdateDownload(stream, msg)
 	case protocol.MsgTypeLogRequest:
 		go c.handleLogRequest(stream, msg)
 	case protocol.MsgTypeLogStop:
 		c.handleLogStop(stream, msg)
 	case protocol.MsgTypePluginStatusQuery:
 		c.handlePluginStatusQuery(stream, msg)
 	case protocol.MsgTypePluginAPIRequest:
 		c.handlePluginAPIRequest(stream, msg)
 	case protocol.MsgTypeSystemStatsRequest:
 		c.handleSystemStatsRequest(stream, msg)
 	case protocol.MsgTypeScreenshotRequest:
@@ -451,312 +416,14 @@ func (c *Client) findRuleByPort(port int) *protocol.ProxyRule {
 	return nil
 }
 // handlePluginConfig 处理插件配置同步
 func (c *Client) handlePluginConfig(msg *protocol.Message) {
 	var cfg protocol.PluginConfigSync
 	if err := msg.ParsePayload(&cfg); err != nil {
 		c.logErrorf("Parse plugin config error: %v", err)
 		return
 	}
 	c.logf("Received config for plugin: %s", cfg.PluginName)
 	// 应用配置到插件
 	if c.pluginRegistry != nil {
 		handler, err := c.pluginRegistry.GetClient(cfg.PluginName)
 		if err != nil {
 			c.logWarnf("Plugin %s not found: %v", cfg.PluginName, err)
 			return
 		}
 		if err := handler.Init(cfg.Config); err != nil {
 			c.logErrorf("Plugin %s init error: %v", cfg.PluginName, err)
 			return
 		}
 		c.logf("Plugin %s config applied", cfg.PluginName)
 	}
 }
 // handleClientPluginStart 处理客户端插件启动请求
 func (c *Client) handleClientPluginStart(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 	var req protocol.ClientPluginStartRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		c.sendPluginStatus(stream, req.PluginName, req.RuleName, false, "", err.Error())
 		return
 	}
 	c.logf("Starting plugin %s for rule %s", req.PluginName, req.RuleName)
 	// 获取插件
 	if c.pluginRegistry == nil {
 		c.sendPluginStatus(stream, req.PluginName, req.RuleName, false, "", "plugin registry not set")
 		return
 	}
 	handler, err := c.pluginRegistry.GetClient(req.PluginName)
 	if err != nil {
 		c.sendPluginStatus(stream, req.PluginName, req.RuleName, false, "", err.Error())
 		return
 	}
 	// 初始化并启动
 	if err := handler.Init(req.Config); err != nil {
 		c.sendPluginStatus(stream, req.PluginName, req.RuleName, false, "", err.Error())
 		return
 	}
 	localAddr, err := handler.Start()
 	if err != nil {
 		c.sendPluginStatus(stream, req.PluginName, req.RuleName, false, "", err.Error())
 		return
 	}
 	// 保存运行中的插件
 	key := req.PluginName + ":" + req.RuleName
 	c.pluginMu.Lock()
 	c.runningPlugins[key] = handler
 	c.pluginMu.Unlock()
 	c.logf("Plugin %s started at %s", req.PluginName, localAddr)
 	c.sendPluginStatus(stream, req.PluginName, req.RuleName, true, localAddr, "")
 }
 // sendPluginStatus 发送插件状态响应
 func (c *Client) sendPluginStatus(stream net.Conn, pluginName, ruleName string, running bool, localAddr, errMsg string) {
 	resp := protocol.ClientPluginStatusResponse{
 		PluginName: pluginName,
 		RuleName:   ruleName,
 		Running:    running,
 		LocalAddr:  localAddr,
 		Error:      errMsg,
 	}
 	msg, _ := protocol.NewMessage(protocol.MsgTypeClientPluginStatus, resp)
 	protocol.WriteMessage(stream, msg)
 }
 // handleClientPluginConn 处理客户端插件连接
 func (c *Client) handleClientPluginConn(stream net.Conn, msg *protocol.Message) {
 	var req protocol.ClientPluginConnRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		stream.Close()
 		return
 	}
 	c.pluginMu.RLock()
 	var handler plugin.ClientPlugin
 	var ok bool
 	// 优先使用 PluginID 查找
 	if req.PluginID != "" {
 		handler, ok = c.runningPlugins[req.PluginID]
 	}
 	// 如果没找到，回退到 pluginName:ruleName
 	if !ok {
 		key := req.PluginName + ":" + req.RuleName
 		handler, ok = c.runningPlugins[key]
 	}
 	c.pluginMu.RUnlock()
 	if !ok {
 		c.logWarnf("Plugin %s (ID: %s) not running", req.PluginName, req.PluginID)
 		stream.Close()
 		return
 	}
 	// 让插件处理连接
 	handler.HandleConn(stream)
 }
 // handleJSPluginInstall 处理 JS 插件安装请求
 func (c *Client) handleJSPluginInstall(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 	var req protocol.JSPluginInstallRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		c.sendJSPluginResult(stream, "", false, err.Error())
 		return
 	}
 	c.logf("Installing JS plugin: %s (ID: %s)", req.PluginName, req.PluginID)
 	// 使用 PluginID 作为 key（如果有），否则回退到 pluginName:ruleName
 	key := req.PluginID
 	if key == "" {
 		key = req.PluginName + ":" + req.RuleName
 	}
 	// 如果插件已经在运行，先停止它
 	c.pluginMu.Lock()
 	if existingHandler, ok := c.runningPlugins[key]; ok {
 		c.logf("Stopping existing plugin %s before reinstall", key)
 		if err := existingHandler.Stop(); err != nil {
 			c.logErrorf("Stop existing plugin error: %v", err)
 		}
 		delete(c.runningPlugins, key)
 	}
 	c.pluginMu.Unlock()
 	// 验证官方签名
 	if err := c.verifyJSPluginSignature(req.PluginName, req.Source, req.Signature); err != nil {
 		c.logErrorf("JS plugin %s signature verification failed: %v", req.PluginName, err)
 		c.sendJSPluginResult(stream, req.PluginName, false, "signature verification failed: "+err.Error())
 		return
 	}
 	c.logf("JS plugin %s signature verified", req.PluginName)
 	// 创建 JS 插件
 	jsPlugin, err := script.NewJSPlugin(req.PluginName, req.Source)
 	if err != nil {
 		c.sendJSPluginResult(stream, req.PluginName, false, err.Error())
 		return
 	}
 	// 注册到 registry
 	if c.pluginRegistry != nil {
 		c.pluginRegistry.RegisterClient(jsPlugin)
 	}
 	c.logf("JS plugin %s installed", req.PluginName)
 	// 保存版本信息（防止降级攻击）
 	if c.versionStore != nil {
 		signed, _ := sign.DecodeSignedPlugin(req.Signature)
 		if signed != nil {
 			c.versionStore.SetVersion(req.PluginName, signed.Payload.Version)
 		}
 	}
 	// 先启动插件，再发送安装结果
 	// 这样服务端收到结果后启动监听器时，客户端插件已经准备好了
 	if req.AutoStart {
 		c.startJSPlugin(jsPlugin, req)
 	}
 	c.sendJSPluginResult(stream, req.PluginName, true, "")
 }
 // sendJSPluginResult 发送 JS 插件安装结果
 func (c *Client) sendJSPluginResult(stream net.Conn, name string, success bool, errMsg string) {
 	result := protocol.JSPluginInstallResult{
 		PluginName: name,
 		Success:    success,
 		Error:      errMsg,
 	}
 	msg, _ := protocol.NewMessage(protocol.MsgTypeJSPluginResult, result)
 	protocol.WriteMessage(stream, msg)
 }
 // startJSPlugin 启动 JS 插件
 func (c *Client) startJSPlugin(handler plugin.ClientPlugin, req protocol.JSPluginInstallRequest) {
 	if err := handler.Init(req.Config); err != nil {
 		c.logErrorf("JS plugin %s init error: %v", req.PluginName, err)
 		return
 	}
 	localAddr, err := handler.Start()
 	if err != nil {
 		c.logErrorf("JS plugin %s start error: %v", req.PluginName, err)
 		return
 	}
 	// 使用 PluginID 作为 key（如果有），否则回退到 pluginName:ruleName
 	key := req.PluginID
 	if key == "" {
 		key = req.PluginName + ":" + req.RuleName
 	}
 	c.pluginMu.Lock()
 	c.runningPlugins[key] = handler
 	c.pluginMu.Unlock()
 	c.logf("JS plugin %s (ID: %s) started at %s", req.PluginName, req.PluginID, localAddr)
 }
 // verifyJSPluginSignature 验证 JS 插件签名
 func (c *Client) verifyJSPluginSignature(pluginName, source, signature string) error {
 	if signature == "" {
 		return fmt.Errorf("missing signature")
 	}
 	// 解码签名
 	signed, err := sign.DecodeSignedPlugin(signature)
 	if err != nil {
 		return fmt.Errorf("decode signature: %w", err)
 	}
 	// 根据 KeyID 获取对应公钥
 	pubKey, err := sign.GetPublicKeyByID(signed.Payload.KeyID)
 	if err != nil {
 		return fmt.Errorf("get public key: %w", err)
 	}
 	// 验证插件名称匹配
 	if signed.Payload.Name != pluginName {
 		return fmt.Errorf("plugin name mismatch: expected %s, got %s",
 			pluginName, signed.Payload.Name)
 	}
 	// 验证签名和源码哈希
 	if err := sign.VerifyPlugin(pubKey, signed, source); err != nil {
 		return err
 	}
 	// 检查版本降级攻击
 	if c.versionStore != nil {
 		currentVer := c.versionStore.GetVersion(pluginName)
 		if currentVer != "" {
 			cmp := sign.CompareVersions(signed.Payload.Version, currentVer)
 			if cmp < 0 {
 				return fmt.Errorf("version downgrade rejected: %s < %s",
 					signed.Payload.Version, currentVer)
 			}
 		}
 	}
 	return nil
 }
 // handleClientPluginStop 处理客户端插件停止请求
 func (c *Client) handleClientPluginStop(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 	var req protocol.ClientPluginStopRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		c.sendPluginStatus(stream, req.PluginName, req.RuleName, true, "", err.Error())
 		return
 	}
 	c.pluginMu.Lock()
 	var handler plugin.ClientPlugin
 	var key string
 	var ok bool
 	// 优先使用 PluginID 查找
 	if req.PluginID != "" {
 		handler, ok = c.runningPlugins[req.PluginID]
 		if ok {
 			key = req.PluginID
 		}
 	}
 	// 如果没找到，回退到 pluginName:ruleName
 	if !ok {
 		key = req.PluginName + ":" + req.RuleName
 		handler, ok = c.runningPlugins[key]
 	}
 	if ok {
 		if err := handler.Stop(); err != nil {
 			c.logErrorf("Plugin %s stop error: %v", key, err)
 		}
 		delete(c.runningPlugins, key)
 	}
 	c.pluginMu.Unlock()
 	c.logf("Plugin %s stopped", key)
 	c.sendPluginStatus(stream, req.PluginName, req.RuleName, false, "", "")
 }
 // handleClientRestart 处理客户端重启请求
 func (c *Client) handleClientRestart(stream net.Conn, msg *protocol.Message) {
@@ -776,99 +443,13 @@ func (c *Client) handleClientRestart(stream net.Conn, msg *protocol.Message) {
 	protocol.WriteMessage(stream, respMsg)
 	// 停止所有运行中的插件
 	c.pluginMu.Lock()
 	for key, handler := range c.runningPlugins {
 		c.logf("Stopping plugin %s for restart", key)
 		handler.Stop()
 	}
 	c.runningPlugins = make(map[string]plugin.ClientPlugin)
 	c.pluginMu.Unlock()
 	// 关闭会话（会触发重连）
 	if c.session != nil {
 		c.session.Close()
 	}
 }
 // handlePluginConfigUpdate 处理插件配置更新请求
 func (c *Client) handlePluginConfigUpdate(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 	var req protocol.PluginConfigUpdateRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		c.sendPluginConfigUpdateResult(stream, req.PluginName, req.RuleName, false, err.Error())
 		return
 	}
 	c.pluginMu.RLock()
 	var handler plugin.ClientPlugin
 	var key string
 	var ok bool
 	// 优先使用 PluginID 查找
 	if req.PluginID != "" {
 		handler, ok = c.runningPlugins[req.PluginID]
 		if ok {
 			key = req.PluginID
 		}
 	}
 	// 如果没找到，回退到 pluginName:ruleName
 	if !ok {
 		key = req.PluginName + ":" + req.RuleName
 		handler, ok = c.runningPlugins[key]
 	}
 	c.pluginMu.RUnlock()
 	c.logf("Config update for plugin %s", key)
 	if !ok {
 		c.sendPluginConfigUpdateResult(stream, req.PluginName, req.RuleName, false, "plugin not running")
 		return
 	}
 	if req.Restart {
 		// 停止并重启插件
 		c.pluginMu.Lock()
 		if err := handler.Stop(); err != nil {
 			c.logErrorf("Plugin %s stop error: %v", key, err)
 		}
 		delete(c.runningPlugins, key)
 		c.pluginMu.Unlock()
 		// 重新初始化和启动
 		if err := handler.Init(req.Config); err != nil {
 			c.sendPluginConfigUpdateResult(stream, req.PluginName, req.RuleName, false, err.Error())
 			return
 		}
 		localAddr, err := handler.Start()
 		if err != nil {
 			c.sendPluginConfigUpdateResult(stream, req.PluginName, req.RuleName, false, err.Error())
 			return
 		}
 		c.pluginMu.Lock()
 		c.runningPlugins[key] = handler
 		c.pluginMu.Unlock()
 		c.logf("Plugin %s restarted at %s with new config", key, localAddr)
 	}
 	c.sendPluginConfigUpdateResult(stream, req.PluginName, req.RuleName, true, "")
 }
 // sendPluginConfigUpdateResult 发送插件配置更新结果
 func (c *Client) sendPluginConfigUpdateResult(stream net.Conn, pluginName, ruleName string, success bool, errMsg string) {
 	result := protocol.PluginConfigUpdateResponse{
 		PluginName: pluginName,
 		RuleName:   ruleName,
 		Success:    success,
 		Error:      errMsg,
 	}
 	msg, _ := protocol.NewMessage(protocol.MsgTypePluginConfigUpdate, result)
 	protocol.WriteMessage(stream, msg)
 }
 // handleUpdateDownload 处理更新下载请求
 func (c *Client) handleUpdateDownload(stream net.Conn, msg *protocol.Message) {
@@ -957,9 +538,6 @@ func (c *Client) performSelfUpdate(downloadURL string) error {
 		c.logf("Will install to fallback path: %s", targetPath)
 	}
 	// 停止所有插件
 	c.stopAllPlugins()
 	if fallbackDir == "" {
 		// 原地替换：备份 → 复制 → 清理
 		backupPath := currentPath + ".bak"
@@ -1030,16 +608,6 @@ func (c *Client) checkUpdatePermissions(execPath string) error {
 	return nil
 }
 // stopAllPlugins 停止所有运行中的插件
 func (c *Client) stopAllPlugins() {
 	c.pluginMu.Lock()
 	for key, handler := range c.runningPlugins {
 		c.logf("Stopping plugin %s for update", key)
 		handler.Stop()
 	}
 	c.runningPlugins = make(map[string]plugin.ClientPlugin)
 	c.pluginMu.Unlock()
 }
 // performWindowsClientUpdate Windows 平台更新
 func performWindowsClientUpdate(newFile, currentPath, serverAddr, token, id string) error {
@@ -1092,33 +660,6 @@ func restartClientProcess(path, serverAddr, token, id string) {
 	os.Exit(0)
 }
 // handlePluginStatusQuery 处理插件状态查询
 func (c *Client) handlePluginStatusQuery(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 	c.pluginMu.RLock()
 	plugins := make([]protocol.PluginStatusEntry, 0, len(c.runningPlugins))
 	for key, handler := range c.runningPlugins {
 		// 从插件的 Metadata 获取真正的插件名称
 		pluginName := handler.Metadata().Name
 		// 如果 Metadata 没有名称，回退到从 key 解析
 		if pluginName == "" {
 			parts := strings.SplitN(key, ":", 2)
 			pluginName = parts[0]
 		}
 		plugins = append(plugins, protocol.PluginStatusEntry{
 			PluginName: pluginName,
 			Running:    true,
 		})
 	}
 	c.pluginMu.RUnlock()
 	resp := protocol.PluginStatusQueryResponse{
 		Plugins: plugins,
 	}
 	respMsg, _ := protocol.NewMessage(protocol.MsgTypePluginStatusQueryResp, resp)
 	protocol.WriteMessage(stream, respMsg)
 }
 // handleLogRequest 处理日志请求
 func (c *Client) handleLogRequest(stream net.Conn, msg *protocol.Message) {
@@ -1196,72 +737,7 @@ func (c *Client) handleLogStop(stream net.Conn, msg *protocol.Message) {
 	c.logger.Unsubscribe(req.SessionID)
 }
 // handlePluginAPIRequest 处理插件 API 请求
 func (c *Client) handlePluginAPIRequest(stream net.Conn, msg *protocol.Message) {
 	defer stream.Close()
 	var req protocol.PluginAPIRequest
 	if err := msg.ParsePayload(&req); err != nil {
 		c.sendPluginAPIResponse(stream, 400, nil, "", "invalid request: "+err.Error())
 		return
 	}
 	c.logf("Plugin API request: %s %s for plugin %s (ID: %s)", req.Method, req.Path, req.PluginName, req.PluginID)
 	// 查找运行中的插件
 	c.pluginMu.RLock()
 	var handler plugin.ClientPlugin
 	// 优先使用 PluginID 查找
 	if req.PluginID != "" {
 		handler = c.runningPlugins[req.PluginID]
 	}
 	// 如果没找到，尝试通过 PluginName 匹配（向后兼容）
 	if handler == nil && req.PluginName != "" {
 		for key, p := range c.runningPlugins {
 			// key 可能是 PluginID 或 "pluginName:ruleName" 格式
 			if strings.HasPrefix(key, req.PluginName+":") {
 				handler = p
 				break
 			}
 		}
 	}
 	c.pluginMu.RUnlock()
 	if handler == nil {
 		c.sendPluginAPIResponse(stream, 404, nil, "", "plugin not running: "+req.PluginName)
 		return
 	}
 	// 类型断言为 JSPlugin
 	jsPlugin, ok := handler.(*script.JSPlugin)
 	if !ok {
 		c.sendPluginAPIResponse(stream, 500, nil, "", "plugin does not support API routing")
 		return
 	}
 	// 调用插件的 API 处理函数
 	status, headers, body, err := jsPlugin.HandleAPIRequest(req.Method, req.Path, req.Query, req.Headers, req.Body)
 	if err != nil {
 		c.sendPluginAPIResponse(stream, 500, nil, "", err.Error())
 		return
 	}
 	c.sendPluginAPIResponse(stream, status, headers, body, "")
 }
 // sendPluginAPIResponse 发送插件 API 响应
 func (c *Client) sendPluginAPIResponse(stream net.Conn, status int, headers map[string]string, body, errMsg string) {
 	resp := protocol.PluginAPIResponse{
 		Status:  status,
 		Headers: headers,
 		Body:    body,
 		Error:   errMsg,
 	}
 	msg, _ := protocol.NewMessage(protocol.MsgTypePluginAPIResponse, resp)
 	protocol.WriteMessage(stream, msg)
 }
 // handleSystemStatsRequest 处理系统状态请求
 func (c *Client) handleSystemStatsRequest(stream net.Conn, msg *protocol.Message) {
--- a/internal/server/app/app.go
+++ b/internal/server/app/app.go
@@ -16,23 +16,21 @@ var staticFiles embed.FS
 // WebServer Web控制台服务
 type WebServer struct {
-	ClientStore   db.ClientStore
+	ClientStore  db.ClientStore
-	Server        router.ServerInterface
+	Server       router.ServerInterface
-	Config        *config.ServerConfig
+	Config       *config.ServerConfig
-	ConfigPath    string
+	ConfigPath   string
-	JSPluginStore db.JSPluginStore
+	TrafficStore db.TrafficStore
 	TrafficStore  db.TrafficStore
 }
 // NewWebServer 创建Web服务
 func NewWebServer(cs db.ClientStore, srv router.ServerInterface, cfg *config.ServerConfig, cfgPath string, store db.Store) *WebServer {
 	return &WebServer{
-		ClientStore:   cs,
+		ClientStore:  cs,
-		Server:        srv,
+		Server:       srv,
-		Config:        cfg,
+		Config:       cfg,
-		ConfigPath:    cfgPath,
+		ConfigPath:   cfgPath,
-		JSPluginStore: store,
+		TrafficStore: store,
 		TrafficStore:  store,
 	}
 }
@@ -107,11 +105,6 @@ func (w *WebServer) SaveConfig() error {
 	return config.SaveServerConfig(w.ConfigPath, w.Config)
 }
 // GetJSPluginStore 获取 JS 插件存储
 func (w *WebServer) GetJSPluginStore() db.JSPluginStore {
 	return w.JSPluginStore
 }
 // GetTrafficStore 获取流量存储
 func (w *WebServer) GetTrafficStore() db.TrafficStore {
 	return w.TrafficStore
--- a/internal/server/config/config.go
+++ b/internal/server/config/config.go
@@ -13,33 +13,16 @@ type ServerConfig struct {
 	Server ServerSettings `yaml:"server"`
 }
 // PluginStoreSettings 插件仓库设置
 type PluginStoreSettings struct {
 	URL string `yaml:"url"` // 插件仓库 URL，为空则使用默认值
 }
 // 默认插件仓库 URL
 const DefaultPluginStoreURL = "https://git.92coco.cn/flik/GoTunnel-Plugins/raw/branch/main/store.json"
 // GetPluginStoreURL 获取插件仓库 URL
 func (s *PluginStoreSettings) GetPluginStoreURL() string {
 	if s.URL != "" {
 		return s.URL
 	}
 	return DefaultPluginStoreURL
 }
 // ServerSettings 服务端设置
 type ServerSettings struct {
-	BindAddr         string              `yaml:"bind_addr"`
+	BindAddr         string      `yaml:"bind_addr"`
-	BindPort         int                 `yaml:"bind_port"`
+	BindPort         int         `yaml:"bind_port"`
-	Token            string              `yaml:"token"`
+	Token            string      `yaml:"token"`
-	HeartbeatSec     int                 `yaml:"heartbeat_sec"`
+	HeartbeatSec     int         `yaml:"heartbeat_sec"`
-	HeartbeatTimeout int                 `yaml:"heartbeat_timeout"`
+	HeartbeatTimeout int         `yaml:"heartbeat_timeout"`
-	DBPath           string              `yaml:"db_path"`
+	DBPath           string      `yaml:"db_path"`
-	TLSDisabled      bool                `yaml:"tls_disabled"`
+	TLSDisabled      bool        `yaml:"tls_disabled"`
-	Web              WebSettings         `yaml:"web"`
+	Web              WebSettings `yaml:"web"`
 	PluginStore      PluginStoreSettings `yaml:"plugin_store"`
 }
 // WebSettings Web控制台设置
--- a/internal/server/db/install_token.go
+++ b/internal/server/db/install_token.go
@@ -0,0 +1,45 @@
 package db
 // CreateInstallToken 创建安装token
 func (s *SQLiteStore) CreateInstallToken(token *InstallToken) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	_, err := s.db.Exec(`INSERT INTO install_tokens (token, client_id, created_at, used) VALUES (?, ?, ?, ?)`,
 		token.Token, token.ClientID, token.CreatedAt, 0)
 	return err
 }
 // GetInstallToken 获取安装token
 func (s *SQLiteStore) GetInstallToken(token string) (*InstallToken, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	var t InstallToken
 	var used int
 	err := s.db.QueryRow(`SELECT token, client_id, created_at, used FROM install_tokens WHERE token = ?`, token).
 		Scan(&t.Token, &t.ClientID, &t.CreatedAt, &used)
 	if err != nil {
 		return nil, err
 	}
 	t.Used = used == 1
 	return &t, nil
 }
 // MarkTokenUsed 标记token已使用
 func (s *SQLiteStore) MarkTokenUsed(token string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	_, err := s.db.Exec(`UPDATE install_tokens SET used = 1 WHERE token = ?`, token)
 	return err
 }
 // DeleteExpiredTokens 删除过期token
 func (s *SQLiteStore) DeleteExpiredTokens(expireTime int64) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	_, err := s.db.Exec(`DELETE FROM install_tokens WHERE created_at < ?`, expireTime)
 	return err
 }
--- a/internal/server/db/interface.go
+++ b/internal/server/db/interface.go
@@ -2,52 +2,11 @@ package db
 import "github.com/gotunnel/pkg/protocol"
 // ConfigField 配置字段定义
 type ConfigField struct {
 	Key         string   `json:"key"`
 	Label       string   `json:"label"`
 	Type        string   `json:"type"`
 	Default     string   `json:"default,omitempty"`
 	Required    bool     `json:"required,omitempty"`
 	Options     []string `json:"options,omitempty"`
 	Description string   `json:"description,omitempty"`
 }
 // ClientPlugin 客户端已安装的插件
 type ClientPlugin struct {
 	ID           string            `json:"id"`                      // 插件实例唯一 ID
 	Name         string            `json:"name"`
 	Version      string            `json:"version"`
 	Enabled      bool              `json:"enabled"`
 	Running      bool              `json:"running"`                 // 运行状态
 	Config       map[string]string `json:"config,omitempty"`        // 插件配置
 	RemotePort   int               `json:"remote_port,omitempty"`   // 远程监听端口
 	ConfigSchema []ConfigField     `json:"config_schema,omitempty"` // 配置模式
 	AuthEnabled  bool              `json:"auth_enabled,omitempty"`  // 是否启用认证
 	AuthUsername string            `json:"auth_username,omitempty"` // 认证用户名
 	AuthPassword string            `json:"auth_password,omitempty"` // 认证密码
 }
 // Client 客户端数据
 type Client struct {
 	ID       string               `json:"id"`
 	Nickname string               `json:"nickname,omitempty"`
 	Rules    []protocol.ProxyRule `json:"rules"`
 	Plugins  []ClientPlugin       `json:"plugins,omitempty"` // 已安装的插件
 }
 // JSPlugin JS 插件数据
 type JSPlugin struct {
 	Name        string            `json:"name"`
 	Source      string            `json:"source"`
 	Signature   string            `json:"signature"` // 官方签名 (Base64)
 	Description string            `json:"description"`
 	Author      string            `json:"author"`
 	Version     string            `json:"version,omitempty"`
 	AutoPush    []string          `json:"auto_push"`
 	Config      map[string]string `json:"config"`
 	AutoStart   bool              `json:"auto_start"`
 	Enabled     bool              `json:"enabled"`
 }
 // ClientStore 客户端存储接口
@@ -62,20 +21,9 @@ type ClientStore interface {
 	Close() error
 }
 // JSPluginStore JS 插件存储接口
 type JSPluginStore interface {
 	GetAllJSPlugins() ([]JSPlugin, error)
 	GetJSPlugin(name string) (*JSPlugin, error)
 	SaveJSPlugin(p *JSPlugin) error
 	DeleteJSPlugin(name string) error
 	SetJSPluginEnabled(name string, enabled bool) error
 	UpdateJSPluginConfig(name string, config map[string]string) error
 }
 // Store 统一存储接口
 type Store interface {
 	ClientStore
 	JSPluginStore
 	TrafficStore
 	Close() error
 }
@@ -94,3 +42,19 @@ type TrafficStore interface {
 	Get24HourTraffic() (inbound, outbound int64, err error)
 	GetHourlyTraffic(hours int) ([]TrafficRecord, error)
 }
 // InstallToken 安装token
 type InstallToken struct {
 	Token     string `json:"token"`
 	ClientID  string `json:"client_id"`
 	CreatedAt int64  `json:"created_at"`
 	Used      bool   `json:"used"`
 }
 // InstallTokenStore 安装token存储接口
 type InstallTokenStore interface {
 	CreateInstallToken(token *InstallToken) error
 	GetInstallToken(token string) (*InstallToken, error)
 	MarkTokenUsed(token string) error
 	DeleteExpiredTokens(expireTime int64) error
 }
--- a/internal/server/db/sqlite.go
+++ b/internal/server/db/sqlite.go
@@ -40,8 +40,7 @@ func (s *SQLiteStore) init() error {
 		CREATE TABLE IF NOT EXISTS clients (
 			id TEXT PRIMARY KEY,
 			nickname TEXT NOT NULL DEFAULT '',
-			rules TEXT NOT NULL DEFAULT '[]',
+			rules TEXT NOT NULL DEFAULT '[]'
 			plugins TEXT NOT NULL DEFAULT '[]'
 		)
 	`)
 	if err != nil {
@@ -50,36 +49,6 @@ func (s *SQLiteStore) init() error {
 	// 迁移：添加 nickname 列
 	s.db.Exec(`ALTER TABLE clients ADD COLUMN nickname TEXT NOT NULL DEFAULT ''`)
 	// 迁移：添加 plugins 列
 	s.db.Exec(`ALTER TABLE clients ADD COLUMN plugins TEXT NOT NULL DEFAULT '[]'`)
 	// 创建 JS 插件表
 	_, err = s.db.Exec(`
 		CREATE TABLE IF NOT EXISTS js_plugins (
 			name TEXT PRIMARY KEY,
 			source TEXT NOT NULL,
 			signature TEXT NOT NULL DEFAULT '',
 			description TEXT,
 			author TEXT,
 			version TEXT DEFAULT '',
 			auto_push TEXT NOT NULL DEFAULT '[]',
 			config TEXT NOT NULL DEFAULT '{}',
 			auto_start INTEGER DEFAULT 1,
 			enabled INTEGER DEFAULT 1,
 			created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 			updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 		)
 	`)
 	if err != nil {
 		return err
 	}
 	// 迁移：添加 signature 列
 	s.db.Exec(`ALTER TABLE js_plugins ADD COLUMN signature TEXT NOT NULL DEFAULT ''`)
 	// 迁移：添加 version 列
 	s.db.Exec(`ALTER TABLE js_plugins ADD COLUMN version TEXT DEFAULT ''`)
 	// 迁移：添加 updated_at 列
 	s.db.Exec(`ALTER TABLE js_plugins ADD COLUMN updated_at DATETIME DEFAULT CURRENT_TIMESTAMP`)
 	// 创建流量统计表
 	_, err = s.db.Exec(`
@@ -108,6 +77,19 @@ func (s *SQLiteStore) init() error {
 	// 初始化总流量记录
 	s.db.Exec(`INSERT OR IGNORE INTO traffic_total (id, inbound, outbound) VALUES (1, 0, 0)`)
 	// 创建安装token表
 	_, err = s.db.Exec(`
 		CREATE TABLE IF NOT EXISTS install_tokens (
 			token TEXT PRIMARY KEY,
 			client_id TEXT NOT NULL,
 			created_at INTEGER NOT NULL,
 			used INTEGER NOT NULL DEFAULT 0
 		)
 	`)
 	if err != nil {
 		return err
 	}
 	return nil
 }
@@ -121,7 +103,7 @@ func (s *SQLiteStore) GetAllClients() ([]Client, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	rows, err := s.db.Query(`SELECT id, nickname, rules, plugins FROM clients`)
+	rows, err := s.db.Query(`SELECT id, nickname, rules FROM clients`)
 	if err != nil {
 		return nil, err
 	}
@@ -130,16 +112,13 @@ func (s *SQLiteStore) GetAllClients() ([]Client, error) {
 	var clients []Client
 	for rows.Next() {
 		var c Client
-		var rulesJSON, pluginsJSON string
+		var rulesJSON string
-		if err := rows.Scan(&c.ID, &c.Nickname, &rulesJSON, &pluginsJSON); err != nil {
+		if err := rows.Scan(&c.ID, &c.Nickname, &rulesJSON); err != nil {
 			return nil, err
 		}
 		if err := json.Unmarshal([]byte(rulesJSON), &c.Rules); err != nil {
 			c.Rules = []protocol.ProxyRule{}
 		}
 		if err := json.Unmarshal([]byte(pluginsJSON), &c.Plugins); err != nil {
 			c.Plugins = []ClientPlugin{}
 		}
 		clients = append(clients, c)
 	}
 	return clients, nil
@@ -151,17 +130,14 @@ func (s *SQLiteStore) GetClient(id string) (*Client, error) {
 	defer s.mu.RUnlock()
 	var c Client
-	var rulesJSON, pluginsJSON string
+	var rulesJSON string
-	err := s.db.QueryRow(`SELECT id, nickname, rules, plugins FROM clients WHERE id = ?`, id).Scan(&c.ID, &c.Nickname, &rulesJSON, &pluginsJSON)
+	err := s.db.QueryRow(`SELECT id, nickname, rules FROM clients WHERE id = ?`, id).Scan(&c.ID, &c.Nickname, &rulesJSON)
 	if err != nil {
 		return nil, err
 	}
 	if err := json.Unmarshal([]byte(rulesJSON), &c.Rules); err != nil {
 		c.Rules = []protocol.ProxyRule{}
 	}
 	if err := json.Unmarshal([]byte(pluginsJSON), &c.Plugins); err != nil {
 		c.Plugins = []ClientPlugin{}
 	}
 	return &c, nil
 }
@@ -174,12 +150,8 @@ func (s *SQLiteStore) CreateClient(c *Client) error {
 	if err != nil {
 		return err
 	}
-	pluginsJSON, err := json.Marshal(c.Plugins)
+	_, err = s.db.Exec(`INSERT INTO clients (id, nickname, rules) VALUES (?, ?, ?)`,
-	if err != nil {
+		c.ID, c.Nickname, string(rulesJSON))
 		return err
 	}
 	_, err = s.db.Exec(`INSERT INTO clients (id, nickname, rules, plugins) VALUES (?, ?, ?, ?)`,
 		c.ID, c.Nickname, string(rulesJSON), string(pluginsJSON))
 	return err
 }
@@ -192,12 +164,8 @@ func (s *SQLiteStore) UpdateClient(c *Client) error {
 	if err != nil {
 		return err
 	}
-	pluginsJSON, err := json.Marshal(c.Plugins)
+	_, err = s.db.Exec(`UPDATE clients SET nickname = ?, rules = ? WHERE id = ?`,
-	if err != nil {
+		c.Nickname, string(rulesJSON), c.ID)
 		return err
 	}
 	_, err = s.db.Exec(`UPDATE clients SET nickname = ?, rules = ?, plugins = ? WHERE id = ?`,
 		c.Nickname, string(rulesJSON), string(pluginsJSON), c.ID)
 	return err
 }
@@ -229,121 +197,6 @@ func (s *SQLiteStore) GetClientRules(id string) ([]protocol.ProxyRule, error) {
 	return c.Rules, nil
 }
 // ========== JS 插件存储方法 ==========
 // GetAllJSPlugins 获取所有 JS 插件
 func (s *SQLiteStore) GetAllJSPlugins() ([]JSPlugin, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	rows, err := s.db.Query(`
 		SELECT name, source, signature, description, author, version, auto_push, config, auto_start, enabled
 		FROM js_plugins
 	`)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	var plugins []JSPlugin
 	for rows.Next() {
 		var p JSPlugin
 		var autoPushJSON, configJSON string
 		var version sql.NullString
 		var autoStart, enabled int
 		err := rows.Scan(&p.Name, &p.Source, &p.Signature, &p.Description, &p.Author,
 			&version, &autoPushJSON, &configJSON, &autoStart, &enabled)
 		if err != nil {
 			return nil, err
 		}
 		p.Version = version.String
 		json.Unmarshal([]byte(autoPushJSON), &p.AutoPush)
 		json.Unmarshal([]byte(configJSON), &p.Config)
 		p.AutoStart = autoStart == 1
 		p.Enabled = enabled == 1
 		plugins = append(plugins, p)
 	}
 	return plugins, nil
 }
 // GetJSPlugin 获取单个 JS 插件
 func (s *SQLiteStore) GetJSPlugin(name string) (*JSPlugin, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	var p JSPlugin
 	var autoPushJSON, configJSON string
 	var version sql.NullString
 	var autoStart, enabled int
 	err := s.db.QueryRow(`
 		SELECT name, source, signature, description, author, version, auto_push, config, auto_start, enabled
 		FROM js_plugins WHERE name = ?
 	`, name).Scan(&p.Name, &p.Source, &p.Signature, &p.Description, &p.Author,
 		&version, &autoPushJSON, &configJSON, &autoStart, &enabled)
 	if err != nil {
 		return nil, err
 	}
 	p.Version = version.String
 	json.Unmarshal([]byte(autoPushJSON), &p.AutoPush)
 	json.Unmarshal([]byte(configJSON), &p.Config)
 	p.AutoStart = autoStart == 1
 	p.Enabled = enabled == 1
 	return &p, nil
 }
 // SaveJSPlugin 保存 JS 插件
 func (s *SQLiteStore) SaveJSPlugin(p *JSPlugin) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	autoPushJSON, _ := json.Marshal(p.AutoPush)
 	configJSON, _ := json.Marshal(p.Config)
 	autoStart, enabled := 0, 0
 	if p.AutoStart {
 		autoStart = 1
 	}
 	if p.Enabled {
 		enabled = 1
 	}
 	_, err := s.db.Exec(`
 		INSERT OR REPLACE INTO js_plugins
 		(name, source, signature, description, author, version, auto_push, config, auto_start, enabled, updated_at)
 		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
 	`, p.Name, p.Source, p.Signature, p.Description, p.Author, p.Version,
 		string(autoPushJSON), string(configJSON), autoStart, enabled)
 	return err
 }
 // DeleteJSPlugin 删除 JS 插件
 func (s *SQLiteStore) DeleteJSPlugin(name string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	_, err := s.db.Exec(`DELETE FROM js_plugins WHERE name = ?`, name)
 	return err
 }
 // SetJSPluginEnabled 设置 JS 插件启用状态
 func (s *SQLiteStore) SetJSPluginEnabled(name string, enabled bool) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	val := 0
 	if enabled {
 		val = 1
 	}
 	_, err := s.db.Exec(`UPDATE js_plugins SET enabled = ?, updated_at = CURRENT_TIMESTAMP WHERE name = ?`, val, name)
 	return err
 }
 // UpdateJSPluginConfig 更新 JS 插件配置
 func (s *SQLiteStore) UpdateJSPluginConfig(name string, config map[string]string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	configJSON, _ := json.Marshal(config)
 	_, err := s.db.Exec(`UPDATE js_plugins SET config = ?, updated_at = CURRENT_TIMESTAMP WHERE name = ?`, string(configJSON), name)
 	return err
 }
 // ========== 流量统计方法 ==========
 // getHourTimestamp 获取当前小时的时间戳
--- a/internal/server/plugin/manager.go
+++ b/internal/server/plugin/manager.go
@@ -1,34 +0,0 @@
 package plugin
 import (
 	"sync"
 	"github.com/gotunnel/pkg/plugin"
 )
 // Manager 服务端 plugin 管理器
 type Manager struct {
 	registry *plugin.Registry
 	mu       sync.RWMutex
 }
 // NewManager 创建 plugin 管理器
 func NewManager() (*Manager, error) {
 	registry := plugin.NewRegistry()
 	m := &Manager{
 		registry: registry,
 	}
 	return m, nil
 }
 // ListPlugins 返回所有插件
 func (m *Manager) ListPlugins() []plugin.Info {
 	return m.registry.List()
 }
 // GetRegistry 返回插件注册表
 func (m *Manager) GetRegistry() *plugin.Registry {
 	return m.registry
 }
--- a/internal/server/router/dto/client.go
+++ b/internal/server/router/dto/client.go
@@ -1,7 +1,6 @@
 package dto
 import (
 	"github.com/gotunnel/internal/server/db"
 	"github.com/gotunnel/pkg/protocol"
 )
@@ -17,7 +16,6 @@ type CreateClientRequest struct {
 type UpdateClientRequest struct {
 	Nickname string               `json:"nickname" binding:"max=128" example:"My Client"`
 	Rules    []protocol.ProxyRule `json:"rules"`
 	Plugins  []db.ClientPlugin    `json:"plugins"`
 }
 // ClientResponse 客户端详情响应
@@ -26,7 +24,6 @@ type ClientResponse struct {
 	ID         string               `json:"id" example:"client-001"`
 	Nickname   string               `json:"nickname,omitempty" example:"My Client"`
 	Rules      []protocol.ProxyRule `json:"rules"`
 	Plugins    []db.ClientPlugin    `json:"plugins,omitempty"`
 	Online     bool                 `json:"online" example:"true"`
 	LastPing   string               `json:"last_ping,omitempty" example:"2025-01-02T10:30:00Z"`
 	RemoteAddr string               `json:"remote_addr,omitempty" example:"192.168.1.100:54321"`
@@ -47,17 +44,3 @@ type ClientListItem struct {
 	OS         string `json:"os,omitempty" example:"linux"`
 	Arch       string `json:"arch,omitempty" example:"amd64"`
 }
 // InstallPluginsRequest 安装插件到客户端请求
 // @Description 安装插件到指定客户端
 type InstallPluginsRequest struct {
 	Plugins []string `json:"plugins" binding:"required,min=1,dive,required" example:"socks5,http-proxy"`
 }
 // ClientPluginActionRequest 客户端插件操作请求
 // @Description 对客户端插件执行操作
 type ClientPluginActionRequest struct {
 	RuleName string            `json:"rule_name"`
 	Config   map[string]string `json:"config,omitempty"`
 	Restart  bool              `json:"restart"`
 }
--- a/internal/server/router/dto/plugin.go
+++ b/internal/server/router/dto/plugin.go
@@ -1,119 +0,0 @@
 package dto
 // PluginConfigRequest 更新插件配置请求
 // @Description 更新客户端插件配置
 type PluginConfigRequest struct {
 	Config map[string]string `json:"config" binding:"required"`
 }
 // PluginConfigResponse 插件配置响应
 // @Description 插件配置详情
 type PluginConfigResponse struct {
 	PluginName string        `json:"plugin_name"`
 	Schema     []ConfigField `json:"schema"`
 	Config     map[string]string `json:"config"`
 }
 // ConfigField 配置字段定义
 // @Description 配置表单字段
 type ConfigField struct {
 	Key         string   `json:"key"`
 	Label       string   `json:"label"`
 	Type        string   `json:"type"`
 	Default     string   `json:"default,omitempty"`
 	Required    bool     `json:"required,omitempty"`
 	Options     []string `json:"options,omitempty"`
 	Description string   `json:"description,omitempty"`
 }
 // RuleSchema 规则表单模式
 // @Description 代理规则的配置模式
 type RuleSchema struct {
 	NeedsLocalAddr bool          `json:"needs_local_addr"`
 	ExtraFields    []ConfigField `json:"extra_fields,omitempty"`
 }
 // PluginInfo 插件信息
 // @Description 服务端插件信息
 type PluginInfo struct {
 	Name        string      `json:"name"`
 	Version     string      `json:"version"`
 	Type        string      `json:"type"`
 	Description string      `json:"description"`
 	Source      string      `json:"source"`
 	Icon        string      `json:"icon,omitempty"`
 	Enabled     bool        `json:"enabled"`
 	RuleSchema  *RuleSchema `json:"rule_schema,omitempty"`
 }
 // JSPluginCreateRequest 创建 JS 插件请求
 // @Description 创建新的 JS 插件
 type JSPluginCreateRequest struct {
 	Name        string            `json:"name" binding:"required,min=1,max=64"`
 	Source      string            `json:"source" binding:"required"`
 	Signature   string            `json:"signature"`
 	Description string            `json:"description" binding:"max=500"`
 	Author      string            `json:"author" binding:"max=64"`
 	Config      map[string]string `json:"config"`
 	AutoStart   bool              `json:"auto_start"`
 }
 // JSPluginUpdateRequest 更新 JS 插件请求
 // @Description 更新 JS 插件
 type JSPluginUpdateRequest struct {
 	Source      string            `json:"source"`
 	Signature   string            `json:"signature"`
 	Description string            `json:"description" binding:"max=500"`
 	Author      string            `json:"author" binding:"max=64"`
 	Config      map[string]string `json:"config"`
 	AutoStart   bool              `json:"auto_start"`
 	Enabled     bool              `json:"enabled"`
 }
 // JSPluginInstallRequest JS 插件安装请求
 // @Description 安装 JS 插件到客户端
 type JSPluginInstallRequest struct {
 	PluginName string            `json:"plugin_name" binding:"required"`
 	Source     string            `json:"source" binding:"required"`
 	Signature  string            `json:"signature"`
 	RuleName   string            `json:"rule_name"`
 	RemotePort int               `json:"remote_port"`
 	Config     map[string]string `json:"config"`
 	AutoStart  bool              `json:"auto_start"`
 }
 // StorePluginInfo 扩展商店插件信息
 // @Description 插件商店中的插件信息
 type StorePluginInfo struct {
 	Name         string        `json:"name"`
 	Version      string        `json:"version"`
 	Type         string        `json:"type"`
 	Description  string        `json:"description"`
 	Author       string        `json:"author"`
 	Icon         string        `json:"icon,omitempty"`
 	DownloadURL  string        `json:"download_url,omitempty"`
 	SignatureURL string        `json:"signature_url,omitempty"`
 	ConfigSchema []ConfigField `json:"config_schema,omitempty"`
 }
 // StoreInstallRequest 从商店安装插件请求
 // @Description 从插件商店安装插件到客户端
 type StoreInstallRequest struct {
 	PluginName   string        `json:"plugin_name" binding:"required"`
 	Version      string        `json:"version"`
 	DownloadURL  string        `json:"download_url" binding:"required,url"`
 	SignatureURL string        `json:"signature_url" binding:"required,url"`
 	ClientID     string        `json:"client_id" binding:"required"`
 	RemotePort   int           `json:"remote_port"`
 	ConfigSchema []ConfigField `json:"config_schema,omitempty"`
 	// HTTP Basic Auth 配置
 	AuthEnabled  bool   `json:"auth_enabled,omitempty"`
 	AuthUsername string `json:"auth_username,omitempty"`
 	AuthPassword string `json:"auth_password,omitempty"`
 }
 // JSPluginPushRequest 推送 JS 插件到客户端请求
 // @Description 推送 JS 插件到指定客户端
 type JSPluginPushRequest struct {
 	RemotePort int `json:"remote_port"`
 }
--- a/internal/server/router/handler/client.go
+++ b/internal/server/router/handler/client.go
@@ -6,7 +6,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/gotunnel/internal/server/db"
 	"github.com/gotunnel/internal/server/router/dto"
 	"github.com/gotunnel/pkg/protocol"
 )
 // ClientHandler 客户端处理器
@@ -117,34 +116,6 @@ func (h *ClientHandler) Get(c *gin.Context) {
 	online, lastPing, remoteAddr, clientName, clientOS, clientArch, clientVersion := h.app.GetServer().GetClientStatus(clientID)
 	// 复制插件列表
 	plugins := make([]db.ClientPlugin, len(client.Plugins))
 	copy(plugins, client.Plugins)
 	// 如果客户端在线，获取实时插件运行状态
 	if online {
 		if statusList, err := h.app.GetServer().GetClientPluginStatus(clientID); err == nil {
 			// 创建运行中插件的映射
 			runningPlugins := make(map[string]bool)
 			for _, s := range statusList {
 				runningPlugins[s.PluginName] = s.Running
 			}
 			// 更新插件状态
 			for i := range plugins {
 				if running, ok := runningPlugins[plugins[i].Name]; ok {
 					plugins[i].Running = running
 				} else {
 					plugins[i].Running = false
 				}
 			}
 		}
 	} else {
 		// 客户端离线时，所有插件都标记为未运行
 		for i := range plugins {
 			plugins[i].Running = false
 		}
 	}
 	// 如果客户端在线且有名称，优先使用在线名称
 	nickname := client.Nickname
 	if online && clientName != "" && nickname == "" {
@@ -155,7 +126,6 @@ func (h *ClientHandler) Get(c *gin.Context) {
 		ID:         client.ID,
 		Nickname:   nickname,
 		Rules:      client.Rules,
 		Plugins:    plugins,
 		Online:     online,
 		LastPing:   lastPing,
 		RemoteAddr: remoteAddr,
@@ -196,9 +166,6 @@ func (h *ClientHandler) Update(c *gin.Context) {
 	client.Nickname = req.Nickname
 	client.Rules = req.Rules
 	if req.Plugins != nil {
 		client.Plugins = req.Plugins
 	}
 	if err := h.app.GetClientStore().UpdateClient(client); err != nil {
 		InternalError(c, err.Error())
@@ -301,159 +268,12 @@ func (h *ClientHandler) Restart(c *gin.Context) {
 	SuccessWithMessage(c, gin.H{"status": "ok"}, "client restart initiated")
 }
 // InstallPlugins 安装插件到客户端
 // @Summary 安装插件
 // @Description 将指定插件安装到客户端
 // @Tags 客户端
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param id path string true "客户端ID"
 // @Param request body dto.InstallPluginsRequest true "插件列表"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Router /api/client/{id}/install-plugins [post]
 func (h *ClientHandler) InstallPlugins(c *gin.Context) {
 	clientID := c.Param("id")
 	if !h.app.GetServer().IsClientOnline(clientID) {
 		ClientNotOnline(c)
 		return
 	}
 	var req dto.InstallPluginsRequest
 	if !BindJSON(c, &req) {
 		return
 	}
 	if err := h.app.GetServer().InstallPluginsToClient(clientID, req.Plugins); err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	Success(c, gin.H{"status": "ok"})
 }
 // PluginAction 客户端插件操作
 // @Summary 插件操作
 // @Description 对客户端插件执行操作(start/stop/restart/config/delete)
 // @Tags 客户端
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param id path string true "客户端ID"
 // @Param pluginID path string true "插件实例ID"
 // @Param action path string true "操作类型" Enums(start, stop, restart, config, delete)
 // @Param request body dto.ClientPluginActionRequest false "操作参数"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Router /api/client/{id}/plugin/{pluginID}/{action} [post]
 func (h *ClientHandler) PluginAction(c *gin.Context) {
 	clientID := c.Param("id")
 	pluginID := c.Param("pluginID")
 	action := c.Param("action")
 	var req dto.ClientPluginActionRequest
 	c.ShouldBindJSON(&req) // 忽略错误，使用默认值
 	// 通过 pluginID 查找插件信息
 	client, err := h.app.GetClientStore().GetClient(clientID)
 	if err != nil {
 		NotFound(c, "client not found")
 		return
 	}
 	var pluginName string
 	for _, p := range client.Plugins {
 		if p.ID == pluginID {
 			pluginName = p.Name
 			break
 		}
 	}
 	if pluginName == "" {
 		NotFound(c, "plugin not found")
 		return
 	}
 	if req.RuleName == "" {
 		req.RuleName = pluginName
 	}
 	switch action {
 	case "start":
 		err = h.app.GetServer().StartClientPlugin(clientID, pluginID, pluginName, req.RuleName)
 	case "stop":
 		err = h.app.GetServer().StopClientPlugin(clientID, pluginID, pluginName, req.RuleName)
 	case "restart":
 		err = h.app.GetServer().RestartClientPlugin(clientID, pluginID, pluginName, req.RuleName)
 	case "config":
 		if req.Config == nil {
 			BadRequest(c, "config required")
 			return
 		}
 		err = h.app.GetServer().UpdateClientPluginConfig(clientID, pluginID, pluginName, req.RuleName, req.Config, req.Restart)
 	case "delete":
 		err = h.deleteClientPlugin(clientID, pluginID)
 	default:
 		BadRequest(c, "unknown action: "+action)
 		return
 	}
 	if err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	Success(c, gin.H{
 		"status":    "ok",
 		"action":    action,
 		"plugin_id": pluginID,
 		"plugin":    pluginName,
 	})
 }
 func (h *ClientHandler) deleteClientPlugin(clientID, pluginID string) error {
 	client, err := h.app.GetClientStore().GetClient(clientID)
 	if err != nil {
 		return fmt.Errorf("client not found")
 	}
 	var newPlugins []db.ClientPlugin
 	var pluginName string
 	var pluginPort int
 	found := false
 	for _, p := range client.Plugins {
 		if p.ID == pluginID {
 			found = true
 			pluginName = p.Name
 			pluginPort = p.RemotePort
 			continue
 		}
 		newPlugins = append(newPlugins, p)
 	}
 	if !found {
 		return fmt.Errorf("plugin %s not found", pluginID)
 	}
 	// 删除插件管理的代理规则
 	var newRules []protocol.ProxyRule
 	for _, r := range client.Rules {
 		if r.PluginManaged && r.Name == pluginName {
 			continue // 跳过此插件的规则
 		}
 		newRules = append(newRules, r)
 	}
 	// 停止端口监听器
 	if pluginPort > 0 {
 		h.app.GetServer().StopPluginRule(clientID, pluginPort)
 	}
 	client.Plugins = newPlugins
 	client.Rules = newRules
 	return h.app.GetClientStore().UpdateClient(client)
 }
 // GetSystemStats 获取客户端系统状态
 func (h *ClientHandler) GetSystemStats(c *gin.Context) {
--- a/internal/server/router/handler/config.go
+++ b/internal/server/router/handler/config.go
@@ -47,9 +47,6 @@ func (h *ConfigHandler) Get(c *gin.Context) {
 			Username: cfg.Server.Web.Username,
 			Password: "****",
 		},
 		PluginStore: dto.PluginStoreConfigInfo{
 			URL: cfg.Server.PluginStore.URL,
 		},
 	}
 	Success(c, resp)
@@ -103,11 +100,6 @@ func (h *ConfigHandler) Update(c *gin.Context) {
 		cfg.Server.Web.Password = req.Web.Password
 	}
 	// 更新 PluginStore 配置
 	if req.PluginStore != nil {
 		cfg.Server.PluginStore.URL = req.PluginStore.URL
 	}
 	if err := h.app.SaveConfig(); err != nil {
 		InternalError(c, err.Error())
 		return
--- a/internal/server/router/handler/install.go
+++ b/internal/server/router/handler/install.go
@@ -0,0 +1,108 @@
 package handler
 import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
 	"net/http"
 	"time"
 	"github.com/gin-gonic/gin"
 	"github.com/gotunnel/internal/server/db"
 )
 // InstallHandler 安装处理器
 type InstallHandler struct {
 	app AppInterface
 }
 // NewInstallHandler 创建安装处理器
 func NewInstallHandler(app AppInterface) *InstallHandler {
 	return &InstallHandler{app: app}
 }
 // GenerateInstallCommandRequest 生成安装命令请求
 type GenerateInstallCommandRequest struct {
 	ClientID string `json:"client_id" binding:"required"`
 }
 // InstallCommandResponse 安装命令响应
 type InstallCommandResponse struct {
 	Token       string            `json:"token"`
 	Commands    map[string]string `json:"commands"`
 	ExpiresAt   int64             `json:"expires_at"`
 	ServerAddr  string            `json:"server_addr"`
 }
 // GenerateInstallCommand 生成安装命令
 // @Summary 生成客户端安装命令
 // @Tags install
 // @Accept json
 // @Produce json
 // @Param body body GenerateInstallCommandRequest true "客户端ID"
 // @Success 200 {object} InstallCommandResponse
 // @Router /api/install/generate [post]
 func (h *InstallHandler) GenerateInstallCommand(c *gin.Context) {
 	var req GenerateInstallCommandRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 	// 生成随机token
 	tokenBytes := make([]byte, 32)
 	if _, err := rand.Read(tokenBytes); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "生成token失败"})
 		return
 	}
 	token := hex.EncodeToString(tokenBytes)
 	// 保存到数据库
 	now := time.Now().Unix()
 	installToken := &db.InstallToken{
 		Token:     token,
 		ClientID:  req.ClientID,
 		CreatedAt: now,
 		Used:      false,
 	}
 	store, ok := h.app.GetClientStore().(db.InstallTokenStore)
 	if !ok {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "存储不支持安装token"})
 		return
 	}
 	if err := store.CreateInstallToken(installToken); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "保存token失败"})
 		return
 	}
 	// 获取服务器地址
 	serverAddr := fmt.Sprintf("%s:%d", h.app.GetConfig().Server.BindAddr, h.app.GetServer().GetBindPort())
 	if h.app.GetConfig().Server.BindAddr == "" || h.app.GetConfig().Server.BindAddr == "0.0.0.0" {
 		serverAddr = fmt.Sprintf("your-server-ip:%d", h.app.GetServer().GetBindPort())
 	}
 	// 生成安装命令
 	expiresAt := now + 3600 // 1小时过期
 	tlsFlag := ""
 	if h.app.GetConfig().Server.TLSDisabled {
 		tlsFlag = " -no-tls"
 	}
 	commands := map[string]string{
 		"linux": fmt.Sprintf("curl -fsSL https://raw.githubusercontent.com/gotunnel/gotunnel/main/scripts/install.sh | bash -s -- -s %s -t %s -id %s%s",
 			serverAddr, token, req.ClientID, tlsFlag),
 		"macos": fmt.Sprintf("curl -fsSL https://raw.githubusercontent.com/gotunnel/gotunnel/main/scripts/install.sh | bash -s -- -s %s -t %s -id %s%s",
 			serverAddr, token, req.ClientID, tlsFlag),
 		"windows": fmt.Sprintf("powershell -c \"irm https://raw.githubusercontent.com/gotunnel/gotunnel/main/scripts/install.ps1 | iex; Install-GoTunnel -Server '%s' -Token '%s' -ClientID '%s'%s\"",
 			serverAddr, token, req.ClientID, tlsFlag),
 	}
 	c.JSON(http.StatusOK, InstallCommandResponse{
 		Token:      token,
 		Commands:   commands,
 		ExpiresAt:  expiresAt,
 		ServerAddr: serverAddr,
 	})
 }
--- a/internal/server/router/handler/interfaces.go
+++ b/internal/server/router/handler/interfaces.go
@@ -13,7 +13,6 @@ type AppInterface interface {
 	GetConfig() *config.ServerConfig
 	GetConfigPath() string
 	SaveConfig() error
 	GetJSPluginStore() db.JSPluginStore
 	GetTrafficStore() db.TrafficStore
 }
@@ -35,32 +34,13 @@ type ServerInterface interface {
 	GetBindPort() int
 	PushConfigToClient(clientID string) error
 	DisconnectClient(clientID string) error
 	GetPluginList() []PluginInfo
 	EnablePlugin(name string) error
 	DisablePlugin(name string) error
 	InstallPluginsToClient(clientID string, plugins []string) error
 	GetPluginConfigSchema(name string) ([]ConfigField, error)
 	SyncPluginConfigToClient(clientID string, pluginName string, config map[string]string) error
 	InstallJSPluginToClient(clientID string, req JSPluginInstallRequest) error
 	RestartClient(clientID string) error
 	StartClientPlugin(clientID, pluginID, pluginName, ruleName string) error
 	StopClientPlugin(clientID, pluginID, pluginName, ruleName string) error
 	RestartClientPlugin(clientID, pluginID, pluginName, ruleName string) error
 	UpdateClientPluginConfig(clientID, pluginID, pluginName, ruleName string, config map[string]string, restart bool) error
 	SendUpdateToClient(clientID, downloadURL string) error
 	// 日志流
 	StartClientLogStream(clientID, sessionID string, lines int, follow bool, level string) (<-chan protocol.LogEntry, error)
 	StopClientLogStream(sessionID string)
 	// 插件状态查询
 	GetClientPluginStatus(clientID string) ([]protocol.PluginStatusEntry, error)
 	// 插件规则管理
 	StartPluginRule(clientID string, rule protocol.ProxyRule) error
 	StopPluginRule(clientID string, remotePort int) error
 	// 端口检查
 	IsPortAvailable(port int, excludeClientID string) bool
 	// 插件 API 代理
 	ProxyPluginAPIRequest(clientID string, req protocol.PluginAPIRequest) (*protocol.PluginAPIResponse, error)
 	// 系统状态
 	// 系统状态
 	GetClientSystemStats(clientID string) (*protocol.SystemStatsResponse, error)
 	// 截图
@@ -68,44 +48,3 @@ type ServerInterface interface {
 	// Shell 执行
 	ExecuteClientShell(clientID, command string, timeout int) (*protocol.ShellExecuteResponse, error)
 }
 // ConfigField 配置字段
 type ConfigField struct {
 	Key         string   `json:"key"`
 	Label       string   `json:"label"`
 	Type        string   `json:"type"`
 	Default     string   `json:"default,omitempty"`
 	Required    bool     `json:"required,omitempty"`
 	Options     []string `json:"options,omitempty"`
 	Description string   `json:"description,omitempty"`
 }
 // RuleSchema 规则表单模式
 type RuleSchema struct {
 	NeedsLocalAddr bool          `json:"needs_local_addr"`
 	ExtraFields    []ConfigField `json:"extra_fields,omitempty"`
 }
 // PluginInfo 插件信息
 type PluginInfo struct {
 	Name        string      `json:"name"`
 	Version     string      `json:"version"`
 	Type        string      `json:"type"`
 	Description string      `json:"description"`
 	Source      string      `json:"source"`
 	Icon        string      `json:"icon,omitempty"`
 	Enabled     bool        `json:"enabled"`
 	RuleSchema  *RuleSchema `json:"rule_schema,omitempty"`
 }
 // JSPluginInstallRequest JS 插件安装请求
 type JSPluginInstallRequest struct {
 	PluginID   string            `json:"plugin_id"`
 	PluginName string            `json:"plugin_name"`
 	Source     string            `json:"source"`
 	Signature  string            `json:"signature"`
 	RuleName   string            `json:"rule_name"`
 	RemotePort int               `json:"remote_port"`
 	Config     map[string]string `json:"config"`
 	AutoStart  bool              `json:"auto_start"`
 }
--- a/internal/server/router/handler/js_plugin.go
+++ b/internal/server/router/handler/js_plugin.go
@@ -1,219 +0,0 @@
 package handler
 import (
 	"github.com/gin-gonic/gin"
 	"github.com/gotunnel/internal/server/db"
 	// removed router import
 	"github.com/gotunnel/internal/server/router/dto"
 )
 // JSPluginHandler JS 插件处理器
 type JSPluginHandler struct {
 	app AppInterface
 }
 // NewJSPluginHandler 创建 JS 插件处理器
 func NewJSPluginHandler(app AppInterface) *JSPluginHandler {
 	return &JSPluginHandler{app: app}
 }
 // List 获取 JS 插件列表
 // @Summary 获取所有 JS 插件
 // @Description 返回所有注册的 JS 插件
 // @Tags JS插件
 // @Produce json
 // @Security Bearer
 // @Success 200 {object} Response{data=[]db.JSPlugin}
 // @Router /api/js-plugins [get]
 func (h *JSPluginHandler) List(c *gin.Context) {
 	plugins, err := h.app.GetJSPluginStore().GetAllJSPlugins()
 	if err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	if plugins == nil {
 		plugins = []db.JSPlugin{}
 	}
 	Success(c, plugins)
 }
 // Create 创建 JS 插件
 // @Summary 创建 JS 插件
 // @Description 创建新的 JS 插件
 // @Tags JS插件
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param request body dto.JSPluginCreateRequest true "插件信息"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Router /api/js-plugins [post]
 func (h *JSPluginHandler) Create(c *gin.Context) {
 	var req dto.JSPluginCreateRequest
 	if !BindJSON(c, &req) {
 		return
 	}
 	plugin := &db.JSPlugin{
 		Name:        req.Name,
 		Source:      req.Source,
 		Signature:   req.Signature,
 		Description: req.Description,
 		Author:      req.Author,
 		Config:      req.Config,
 		AutoStart:   req.AutoStart,
 		Enabled:     true,
 	}
 	if err := h.app.GetJSPluginStore().SaveJSPlugin(plugin); err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	Success(c, gin.H{"status": "ok"})
 }
 // Get 获取单个 JS 插件
 // @Summary 获取 JS 插件详情
 // @Description 获取指定 JS 插件的详细信息
 // @Tags JS插件
 // @Produce json
 // @Security Bearer
 // @Param name path string true "插件名称"
 // @Success 200 {object} Response{data=db.JSPlugin}
 // @Failure 404 {object} Response
 // @Router /api/js-plugin/{name} [get]
 func (h *JSPluginHandler) Get(c *gin.Context) {
 	name := c.Param("name")
 	plugin, err := h.app.GetJSPluginStore().GetJSPlugin(name)
 	if err != nil {
 		NotFound(c, "plugin not found")
 		return
 	}
 	Success(c, plugin)
 }
 // Update 更新 JS 插件
 // @Summary 更新 JS 插件
 // @Description 更新指定 JS 插件的信息
 // @Tags JS插件
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param name path string true "插件名称"
 // @Param request body dto.JSPluginUpdateRequest true "更新内容"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Router /api/js-plugin/{name} [put]
 func (h *JSPluginHandler) Update(c *gin.Context) {
 	name := c.Param("name")
 	var req dto.JSPluginUpdateRequest
 	if !BindJSON(c, &req) {
 		return
 	}
 	plugin := &db.JSPlugin{
 		Name:        name,
 		Source:      req.Source,
 		Signature:   req.Signature,
 		Description: req.Description,
 		Author:      req.Author,
 		Config:      req.Config,
 		AutoStart:   req.AutoStart,
 		Enabled:     req.Enabled,
 	}
 	if err := h.app.GetJSPluginStore().SaveJSPlugin(plugin); err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	Success(c, gin.H{"status": "ok"})
 }
 // Delete 删除 JS 插件
 // @Summary 删除 JS 插件
 // @Description 删除指定的 JS 插件
 // @Tags JS插件
 // @Produce json
 // @Security Bearer
 // @Param name path string true "插件名称"
 // @Success 200 {object} Response
 // @Router /api/js-plugin/{name} [delete]
 func (h *JSPluginHandler) Delete(c *gin.Context) {
 	name := c.Param("name")
 	if err := h.app.GetJSPluginStore().DeleteJSPlugin(name); err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	Success(c, gin.H{"status": "ok"})
 }
 // PushToClient 推送 JS 插件到客户端
 // @Summary 推送插件到客户端
 // @Description 将 JS 插件推送到指定客户端
 // @Tags JS插件
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param name path string true "插件名称"
 // @Param clientID path string true "客户端ID"
 // @Param request body dto.JSPluginPushRequest false "推送配置"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Failure 404 {object} Response
 // @Router /api/js-plugin/{name}/push/{clientID} [post]
 func (h *JSPluginHandler) PushToClient(c *gin.Context) {
 	pluginName := c.Param("name")
 	clientID := c.Param("clientID")
 	// 解析请求体（可选）
 	var pushReq dto.JSPluginPushRequest
 	c.ShouldBindJSON(&pushReq) // 忽略错误，允许空请求体
 	// 检查客户端是否在线
 	if !h.app.GetServer().IsClientOnline(clientID) {
 		ClientNotOnline(c)
 		return
 	}
 	// 获取插件
 	plugin, err := h.app.GetJSPluginStore().GetJSPlugin(pluginName)
 	if err != nil {
 		NotFound(c, "plugin not found")
 		return
 	}
 	if !plugin.Enabled {
 		Error(c, 400, CodePluginDisabled, "plugin is disabled")
 		return
 	}
 	// 推送到客户端
 	req := JSPluginInstallRequest{
 		PluginName: plugin.Name,
 		Source:     plugin.Source,
 		Signature:  plugin.Signature,
 		RuleName:   plugin.Name,
 		RemotePort: pushReq.RemotePort,
 		Config:     plugin.Config,
 		AutoStart:  plugin.AutoStart,
 	}
 	if err := h.app.GetServer().InstallJSPluginToClient(clientID, req); err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	Success(c, gin.H{
 		"status":      "ok",
 		"plugin":      pluginName,
 		"client":      clientID,
 		"remote_port": pushReq.RemotePort,
 	})
 }
--- a/internal/server/router/handler/plugin.go
+++ b/internal/server/router/handler/plugin.go
@@ -1,416 +0,0 @@
 package handler
 import (
 	"fmt"
 	"github.com/gin-gonic/gin"
 	"github.com/gotunnel/internal/server/db"
 	"github.com/gotunnel/internal/server/router/dto"
 	"github.com/gotunnel/pkg/plugin"
 )
 // PluginHandler 插件处理器
 type PluginHandler struct {
 	app AppInterface
 }
 // NewPluginHandler 创建插件处理器
 func NewPluginHandler(app AppInterface) *PluginHandler {
 	return &PluginHandler{app: app}
 }
 // List 获取插件列表
 // @Summary 获取所有插件
 // @Description 返回服务端所有注册的插件
 // @Tags 插件
 // @Produce json
 // @Security Bearer
 // @Success 200 {object} Response{data=[]dto.PluginInfo}
 // @Router /api/plugins [get]
 func (h *PluginHandler) List(c *gin.Context) {
 	plugins := h.app.GetServer().GetPluginList()
 	result := make([]dto.PluginInfo, len(plugins))
 	for i, p := range plugins {
 		result[i] = dto.PluginInfo{
 			Name:        p.Name,
 			Version:     p.Version,
 			Type:        p.Type,
 			Description: p.Description,
 			Source:      p.Source,
 			Icon:        p.Icon,
 			Enabled:     p.Enabled,
 		}
 		if p.RuleSchema != nil {
 			result[i].RuleSchema = &dto.RuleSchema{
 				NeedsLocalAddr: p.RuleSchema.NeedsLocalAddr,
 				ExtraFields:    convertRouterConfigFields(p.RuleSchema.ExtraFields),
 			}
 		}
 	}
 	Success(c, result)
 }
 // Enable 启用插件
 // @Summary 启用插件
 // @Description 启用指定插件
 // @Tags 插件
 // @Produce json
 // @Security Bearer
 // @Param name path string true "插件名称"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Router /api/plugin/{name}/enable [post]
 func (h *PluginHandler) Enable(c *gin.Context) {
 	name := c.Param("name")
 	if err := h.app.GetServer().EnablePlugin(name); err != nil {
 		BadRequest(c, err.Error())
 		return
 	}
 	Success(c, gin.H{"status": "ok"})
 }
 // Disable 禁用插件
 // @Summary 禁用插件
 // @Description 禁用指定插件
 // @Tags 插件
 // @Produce json
 // @Security Bearer
 // @Param name path string true "插件名称"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Router /api/plugin/{name}/disable [post]
 func (h *PluginHandler) Disable(c *gin.Context) {
 	name := c.Param("name")
 	if err := h.app.GetServer().DisablePlugin(name); err != nil {
 		BadRequest(c, err.Error())
 		return
 	}
 	Success(c, gin.H{"status": "ok"})
 }
 // GetRuleSchemas 获取规则配置模式
 // @Summary 获取规则模式
 // @Description 返回所有协议类型的配置模式
 // @Tags 插件
 // @Produce json
 // @Security Bearer
 // @Success 200 {object} Response{data=map[string]dto.RuleSchema}
 // @Router /api/rule-schemas [get]
 func (h *PluginHandler) GetRuleSchemas(c *gin.Context) {
 	// 获取内置协议模式
 	schemas := make(map[string]dto.RuleSchema)
 	for name, schema := range plugin.BuiltinRuleSchemas() {
 		schemas[name] = dto.RuleSchema{
 			NeedsLocalAddr: schema.NeedsLocalAddr,
 			ExtraFields:    convertConfigFields(schema.ExtraFields),
 		}
 	}
 	// 添加已注册插件的模式
 	plugins := h.app.GetServer().GetPluginList()
 	for _, p := range plugins {
 		if p.RuleSchema != nil {
 			schemas[p.Name] = dto.RuleSchema{
 				NeedsLocalAddr: p.RuleSchema.NeedsLocalAddr,
 				ExtraFields:    convertRouterConfigFields(p.RuleSchema.ExtraFields),
 			}
 		}
 	}
 	Success(c, schemas)
 }
 // GetClientConfig 获取客户端插件配置
 // @Summary 获取客户端插件配置
 // @Description 获取客户端上指定插件的配置
 // @Tags 插件
 // @Produce json
 // @Security Bearer
 // @Param clientID path string true "客户端ID"
 // @Param pluginName path string true "插件名称"
 // @Success 200 {object} Response{data=dto.PluginConfigResponse}
 // @Failure 404 {object} Response
 // @Router /api/client-plugin/{clientID}/{pluginName}/config [get]
 func (h *PluginHandler) GetClientConfig(c *gin.Context) {
 	clientID := c.Param("clientID")
 	pluginName := c.Param("pluginName")
 	client, err := h.app.GetClientStore().GetClient(clientID)
 	if err != nil {
 		NotFound(c, "client not found")
 		return
 	}
 	// 查找客户端的插件
 	var clientPlugin *db.ClientPlugin
 	for i, p := range client.Plugins {
 		if p.Name == pluginName {
 			clientPlugin = &client.Plugins[i]
 			break
 		}
 	}
 	if clientPlugin == nil {
 		NotFound(c, "plugin not installed on client")
 		return
 	}
 	var schemaFields []dto.ConfigField
 	// 优先使用客户端插件保存的 ConfigSchema
 	if len(clientPlugin.ConfigSchema) > 0 {
 		for _, f := range clientPlugin.ConfigSchema {
 			schemaFields = append(schemaFields, dto.ConfigField{
 				Key:         f.Key,
 				Label:       f.Label,
 				Type:        f.Type,
 				Default:     f.Default,
 				Required:    f.Required,
 				Options:     f.Options,
 				Description: f.Description,
 			})
 		}
 	} else {
 		// 尝试从内置插件获取配置模式
 		schema, err := h.app.GetServer().GetPluginConfigSchema(pluginName)
 		if err != nil {
 			// 如果内置插件中找不到，尝试从 JS 插件获取
 			jsPlugin, jsErr := h.app.GetJSPluginStore().GetJSPlugin(pluginName)
 			if jsErr == nil {
 				// 使用 JS 插件的 config 作为动态 schema
 				for key := range jsPlugin.Config {
 					schemaFields = append(schemaFields, dto.ConfigField{
 						Key:   key,
 						Label: key,
 						Type:  "string",
 					})
 				}
 			}
 		} else {
 			schemaFields = convertRouterConfigFields(schema)
 		}
 	}
 	// 添加 remote_port 作为系统配置字段（始终显示）
 	schemaFields = append([]dto.ConfigField{{
 		Key:         "remote_port",
 		Label:       "远程端口",
 		Type:        "number",
 		Description: "服务端监听端口，修改后需重启插件生效",
 	}}, schemaFields...)
 	// 添加 Auth 配置字段
 	schemaFields = append(schemaFields, dto.ConfigField{
 		Key:         "auth_enabled",
 		Label:       "启用认证",
 		Type:        "bool",
 		Description: "启用 HTTP Basic Auth 保护",
 	}, dto.ConfigField{
 		Key:         "auth_username",
 		Label:       "认证用户名",
 		Type:        "string",
 		Description: "HTTP Basic Auth 用户名",
 	}, dto.ConfigField{
 		Key:         "auth_password",
 		Label:       "认证密码",
 		Type:        "password",
 		Description: "HTTP Basic Auth 密码",
 	})
 	// 构建配置值
 	config := clientPlugin.Config
 	if config == nil {
 		config = make(map[string]string)
 	}
 	// 将 remote_port 加入配置
 	if clientPlugin.RemotePort > 0 {
 		config["remote_port"] = fmt.Sprintf("%d", clientPlugin.RemotePort)
 	}
 	// 将 Auth 配置加入
 	if clientPlugin.AuthEnabled {
 		config["auth_enabled"] = "true"
 	} else {
 		config["auth_enabled"] = "false"
 	}
 	config["auth_username"] = clientPlugin.AuthUsername
 	config["auth_password"] = clientPlugin.AuthPassword
 	Success(c, dto.PluginConfigResponse{
 		PluginName: pluginName,
 		Schema:     schemaFields,
 		Config:     config,
 	})
 }
 // UpdateClientConfig 更新客户端插件配置
 // @Summary 更新客户端插件配置
 // @Description 更新客户端上指定插件的配置
 // @Tags 插件
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param clientID path string true "客户端ID"
 // @Param pluginName path string true "插件名称"
 // @Param request body dto.PluginConfigRequest true "配置内容"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Failure 404 {object} Response
 // @Router /api/client-plugin/{clientID}/{pluginName}/config [put]
 func (h *PluginHandler) UpdateClientConfig(c *gin.Context) {
 	clientID := c.Param("clientID")
 	pluginName := c.Param("pluginName")
 	var req dto.PluginConfigRequest
 	if !BindJSON(c, &req) {
 		return
 	}
 	client, err := h.app.GetClientStore().GetClient(clientID)
 	if err != nil {
 		NotFound(c, "client not found")
 		return
 	}
 	// 更新插件配置
 	found := false
 	portChanged := false
 	authChanged := false
 	var oldPort, newPort int
 	for i, p := range client.Plugins {
 		if p.Name == pluginName {
 			oldPort = client.Plugins[i].RemotePort
 			// 提取 remote_port 并单独处理
 			if portStr, ok := req.Config["remote_port"]; ok {
 				fmt.Sscanf(portStr, "%d", &newPort)
 				if newPort > 0 && newPort != oldPort {
 					// 检查新端口是否可用
 					if !h.app.GetServer().IsPortAvailable(newPort, clientID) {
 						BadRequest(c, fmt.Sprintf("port %d is already in use", newPort))
 						return
 					}
 					client.Plugins[i].RemotePort = newPort
 					portChanged = true
 				}
 				delete(req.Config, "remote_port") // 不保存到 Config map
 			}
 			// 提取 Auth 配置并单独处理
 			if authEnabledStr, ok := req.Config["auth_enabled"]; ok {
 				newAuthEnabled := authEnabledStr == "true"
 				if newAuthEnabled != client.Plugins[i].AuthEnabled {
 					client.Plugins[i].AuthEnabled = newAuthEnabled
 					authChanged = true
 				}
 				delete(req.Config, "auth_enabled")
 			}
 			if authUsername, ok := req.Config["auth_username"]; ok {
 				if authUsername != client.Plugins[i].AuthUsername {
 					client.Plugins[i].AuthUsername = authUsername
 					authChanged = true
 				}
 				delete(req.Config, "auth_username")
 			}
 			if authPassword, ok := req.Config["auth_password"]; ok {
 				if authPassword != client.Plugins[i].AuthPassword {
 					client.Plugins[i].AuthPassword = authPassword
 					authChanged = true
 				}
 				delete(req.Config, "auth_password")
 			}
 			client.Plugins[i].Config = req.Config
 			found = true
 			break
 		}
 	}
 	if !found {
 		NotFound(c, "plugin not installed on client")
 		return
 	}
 	// 如果端口变更，同步更新代理规则
 	if portChanged {
 		for i, r := range client.Rules {
 			if r.Name == pluginName && r.PluginManaged {
 				client.Rules[i].RemotePort = newPort
 				break
 			}
 		}
 		// 停止旧端口监听器
 		if oldPort > 0 {
 			h.app.GetServer().StopPluginRule(clientID, oldPort)
 		}
 	}
 	// 如果 Auth 配置变更，同步更新代理规则
 	if authChanged {
 		for i, p := range client.Plugins {
 			if p.Name == pluginName {
 				for j, r := range client.Rules {
 					if r.Name == pluginName && r.PluginManaged {
 						client.Rules[j].AuthEnabled = client.Plugins[i].AuthEnabled
 						client.Rules[j].AuthUsername = client.Plugins[i].AuthUsername
 						client.Rules[j].AuthPassword = client.Plugins[i].AuthPassword
 						break
 					}
 				}
 				break
 			}
 		}
 	}
 	// 保存到数据库
 	if err := h.app.GetClientStore().UpdateClient(client); err != nil {
 		InternalError(c, err.Error())
 		return
 	}
 	// 如果客户端在线，同步配置
 	if h.app.GetServer().IsClientOnline(clientID) {
 		if err := h.app.GetServer().SyncPluginConfigToClient(clientID, pluginName, req.Config); err != nil {
 			PartialSuccess(c, gin.H{"status": "partial", "port_changed": portChanged}, "config saved but sync failed: "+err.Error())
 			return
 		}
 	}
 	Success(c, gin.H{"status": "ok", "port_changed": portChanged})
 }
 // convertConfigFields 转换插件配置字段到 DTO
 func convertConfigFields(fields []plugin.ConfigField) []dto.ConfigField {
 	result := make([]dto.ConfigField, len(fields))
 	for i, f := range fields {
 		result[i] = dto.ConfigField{
 			Key:         f.Key,
 			Label:       f.Label,
 			Type:        string(f.Type),
 			Default:     f.Default,
 			Required:    f.Required,
 			Options:     f.Options,
 			Description: f.Description,
 		}
 	}
 	return result
 }
 // convertRouterConfigFields 转换 ConfigField 到 dto.ConfigField
 func convertRouterConfigFields(fields []ConfigField) []dto.ConfigField {
 	result := make([]dto.ConfigField, len(fields))
 	for i, f := range fields {
 		result[i] = dto.ConfigField{
 			Key:         f.Key,
 			Label:       f.Label,
 			Type:        f.Type,
 			Default:     f.Default,
 			Required:    f.Required,
 			Options:     f.Options,
 			Description: f.Description,
 		}
 	}
 	return result
 }
--- a/internal/server/router/handler/plugin_api.go
+++ b/internal/server/router/handler/plugin_api.go
@@ -1,139 +0,0 @@
 package handler
 import (
 	"io"
 	"net/http"
 	"strings"
 	"time"
 	"github.com/gin-gonic/gin"
 	"github.com/gotunnel/pkg/protocol"
 )
 // PluginAPIHandler 插件 API 代理处理器
 type PluginAPIHandler struct {
 	app AppInterface
 }
 // NewPluginAPIHandler 创建插件 API 代理处理器
 func NewPluginAPIHandler(app AppInterface) *PluginAPIHandler {
 	return &PluginAPIHandler{app: app}
 }
 // ProxyRequest 代理请求到客户端插件
 // @Summary 代理插件 API 请求
 // @Description 将请求代理到客户端的 JS 插件处理
 // @Tags 插件 API
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param id path string true "客户端 ID"
 // @Param pluginID path string true "插件实例 ID"
 // @Param route path string true "插件路由"
 // @Success 200 {object} object
 // @Failure 404 {object} Response
 // @Failure 502 {object} Response
 // @Router /api/client/{id}/plugin-api/{pluginID}/{route} [get]
 func (h *PluginAPIHandler) ProxyRequest(c *gin.Context) {
 	clientID := c.Param("id")
 	pluginID := c.Param("pluginID")
 	route := c.Param("route")
 	// 确保路由以 / 开头
 	if !strings.HasPrefix(route, "/") {
 		route = "/" + route
 	}
 	// 检查客户端是否在线
 	if !h.app.GetServer().IsClientOnline(clientID) {
 		ClientNotOnline(c)
 		return
 	}
 	// 读取请求体
 	var body string
 	if c.Request.Body != nil {
 		bodyBytes, _ := io.ReadAll(c.Request.Body)
 		body = string(bodyBytes)
 	}
 	// 构建请求头
 	headers := make(map[string]string)
 	for key, values := range c.Request.Header {
 		if len(values) > 0 {
 			headers[key] = values[0]
 		}
 	}
 	// 构建 API 请求
 	apiReq := protocol.PluginAPIRequest{
 		PluginID: pluginID,
 		Method:   c.Request.Method,
 		Path:     route,
 		Query:    c.Request.URL.RawQuery,
 		Headers:  headers,
 		Body:     body,
 	}
 	// 发送请求到客户端
 	resp, err := h.app.GetServer().ProxyPluginAPIRequest(clientID, apiReq)
 	if err != nil {
 		BadGateway(c, "Plugin request failed: "+err.Error())
 		return
 	}
 	// 检查错误
 	if resp.Error != "" {
 		c.JSON(http.StatusBadGateway, gin.H{
 			"code":    502,
 			"message": resp.Error,
 		})
 		return
 	}
 	// 设置响应头
 	for key, value := range resp.Headers {
 		c.Header(key, value)
 	}
 	// 返回响应
 	c.String(resp.Status, resp.Body)
 }
 // ProxyPluginAPIRequest 接口方法声明 - 添加到 ServerInterface
 type PluginAPIProxyInterface interface {
 	ProxyPluginAPIRequest(clientID string, req protocol.PluginAPIRequest) (*protocol.PluginAPIResponse, error)
 }
 // AuthConfig 认证配置
 type AuthConfig struct {
 	Type     string `json:"type"`      // none, basic, token
 	Username string `json:"username"`  // Basic Auth 用户名
 	Password string `json:"password"`  // Basic Auth 密码
 	Token    string `json:"token"`     // Token 认证
 }
 // BasicAuthMiddleware 创建 Basic Auth 中间件
 func BasicAuthMiddleware(username, password string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		user, pass, ok := c.Request.BasicAuth()
 		if !ok || user != username || pass != password {
 			c.Header("WWW-Authenticate", `Basic realm="Plugin"`)
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
 				"code":    401,
 				"message": "Unauthorized",
 			})
 			return
 		}
 		c.Next()
 	}
 }
 // WithTimeout 带超时的请求处理
 func WithTimeout(timeout time.Duration, handler gin.HandlerFunc) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		// 设置请求超时
 		c.Request = c.Request.WithContext(c.Request.Context())
 		handler(c)
 	}
 }
--- a/internal/server/router/handler/store.go
+++ b/internal/server/router/handler/store.go
@@ -1,292 +0,0 @@
 package handler
 import (
 	"fmt"
 	"io"
 	"net/http"
 	"time"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/gotunnel/internal/server/db"
 	"github.com/gotunnel/internal/server/router/dto"
 	"github.com/gotunnel/pkg/protocol"
 )
 // StoreHandler 插件商店处理器
 type StoreHandler struct {
 	app AppInterface
 }
 // NewStoreHandler 创建插件商店处理器
 func NewStoreHandler(app AppInterface) *StoreHandler {
 	return &StoreHandler{app: app}
 }
 // ListPlugins 获取商店插件列表
 // @Summary 获取商店插件
 // @Description 从远程插件商店获取可用插件列表
 // @Tags 插件商店
 // @Produce json
 // @Security Bearer
 // @Success 200 {object} Response{data=object{plugins=[]dto.StorePluginInfo}}
 // @Failure 502 {object} Response
 // @Router /api/store/plugins [get]
 func (h *StoreHandler) ListPlugins(c *gin.Context) {
 	cfg := h.app.GetConfig()
 	storeURL := cfg.Server.PluginStore.GetPluginStoreURL()
 	// 从远程 URL 获取插件列表
 	client := &http.Client{Timeout: 10 * time.Second}
 	resp, err := client.Get(storeURL)
 	if err != nil {
 		BadGateway(c, "Failed to fetch store: "+err.Error())
 		return
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		BadGateway(c, "Store returned error")
 		return
 	}
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		InternalError(c, "Failed to read response")
 		return
 	}
 	// 直接返回原始 JSON（已经是数组格式）
 	c.Header("Content-Type", "application/json")
 	c.Writer.Write([]byte(`{"code":0,"data":{"plugins":`))
 	c.Writer.Write(body)
 	c.Writer.Write([]byte(`}}`))
 }
 // Install 从商店安装插件到客户端
 // @Summary 安装商店插件
 // @Description 从插件商店下载并安装插件到指定客户端
 // @Tags 插件商店
 // @Accept json
 // @Produce json
 // @Security Bearer
 // @Param request body dto.StoreInstallRequest true "安装请求"
 // @Success 200 {object} Response
 // @Failure 400 {object} Response
 // @Failure 502 {object} Response
 // @Router /api/store/install [post]
 func (h *StoreHandler) Install(c *gin.Context) {
 	var req dto.StoreInstallRequest
 	if !BindJSON(c, &req) {
 		return
 	}
 	// 检查客户端是否在线
 	if !h.app.GetServer().IsClientOnline(req.ClientID) {
 		ClientNotOnline(c)
 		return
 	}
 	// 下载插件
 	client := &http.Client{Timeout: 30 * time.Second}
 	resp, err := client.Get(req.DownloadURL)
 	if err != nil {
 		BadGateway(c, "Failed to download plugin: "+err.Error())
 		return
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		BadGateway(c, "Plugin download failed with status: "+resp.Status)
 		return
 	}
 	source, err := io.ReadAll(resp.Body)
 	if err != nil {
 		InternalError(c, "Failed to read plugin: "+err.Error())
 		return
 	}
 	// 下载签名文件
 	sigResp, err := client.Get(req.SignatureURL)
 	if err != nil {
 		BadGateway(c, "Failed to download signature: "+err.Error())
 		return
 	}
 	defer sigResp.Body.Close()
 	if sigResp.StatusCode != http.StatusOK {
 		BadGateway(c, "Signature download failed with status: "+sigResp.Status)
 		return
 	}
 	signature, err := io.ReadAll(sigResp.Body)
 	if err != nil {
 		InternalError(c, "Failed to read signature: "+err.Error())
 		return
 	}
 	// 检查插件是否已存在，决定使用已有 ID 还是生成新 ID
 	pluginID := ""
 	dbClient, err := h.app.GetClientStore().GetClient(req.ClientID)
 	if err == nil {
 		for _, p := range dbClient.Plugins {
 			if p.Name == req.PluginName && p.ID != "" {
 				pluginID = p.ID
 				break
 			}
 		}
 	}
 	if pluginID == "" {
 		pluginID = uuid.New().String()
 	}
 	// 安装到客户端
 	installReq := JSPluginInstallRequest{
 		PluginID:   pluginID,
 		PluginName: req.PluginName,
 		Source:     string(source),
 		Signature:  string(signature),
 		RuleName:   req.PluginName,
 		RemotePort: req.RemotePort,
 		AutoStart:  true,
 	}
 	if err := h.app.GetServer().InstallJSPluginToClient(req.ClientID, installReq); err != nil {
 		InternalError(c, "Failed to install plugin: "+err.Error())
 		return
 	}
 	// 将插件保存到 JSPluginStore（用于客户端重连时恢复）
 	jsPlugin := &db.JSPlugin{
 		Name:      req.PluginName,
 		Source:    string(source),
 		Signature: string(signature),
 		AutoStart: true,
 		Enabled:   true,
 	}
 	// 尝试保存，忽略错误（可能已存在）
 	h.app.GetJSPluginStore().SaveJSPlugin(jsPlugin)
 	// 将插件信息保存到客户端记录
 	// 重新获取 dbClient（可能已被修改）
 	dbClient, err = h.app.GetClientStore().GetClient(req.ClientID)
 	if err == nil {
 		// 检查插件是否已存在（通过名称匹配）
 		pluginExists := false
 		for i, p := range dbClient.Plugins {
 			if p.Name == req.PluginName {
 				dbClient.Plugins[i].Enabled = true
 				dbClient.Plugins[i].RemotePort = req.RemotePort
 				dbClient.Plugins[i].AuthEnabled = req.AuthEnabled
 				dbClient.Plugins[i].AuthUsername = req.AuthUsername
 				dbClient.Plugins[i].AuthPassword = req.AuthPassword
 				// 确保有 ID
 				if dbClient.Plugins[i].ID == "" {
 					dbClient.Plugins[i].ID = pluginID
 				}
 				pluginExists = true
 				break
 			}
 		}
 		if !pluginExists {
 			version := req.Version
 			if version == "" {
 				version = "1.0.0"
 			}
 			// 转换 ConfigSchema
 			var configSchema []db.ConfigField
 			for _, f := range req.ConfigSchema {
 				configSchema = append(configSchema, db.ConfigField{
 					Key:         f.Key,
 					Label:       f.Label,
 					Type:        f.Type,
 					Default:     f.Default,
 					Required:    f.Required,
 					Options:     f.Options,
 					Description: f.Description,
 				})
 			}
 			dbClient.Plugins = append(dbClient.Plugins, db.ClientPlugin{
 				ID:           pluginID,
 				Name:         req.PluginName,
 				Version:      version,
 				Enabled:      true,
 				RemotePort:   req.RemotePort,
 				ConfigSchema: configSchema,
 				AuthEnabled:  req.AuthEnabled,
 				AuthUsername: req.AuthUsername,
 				AuthPassword: req.AuthPassword,
 			})
 		}
 		// 自动创建代理规则（如果指定了端口）
 		if req.RemotePort > 0 {
 			// 检查端口是否可用
 			if !h.app.GetServer().IsPortAvailable(req.RemotePort, req.ClientID) {
 				InternalError(c, fmt.Sprintf("port %d is already in use", req.RemotePort))
 				return
 			}
 			ruleExists := false
 			for i, r := range dbClient.Rules {
 				if r.Name == req.PluginName {
 					// 更新现有规则
 					dbClient.Rules[i].Type = req.PluginName
 					dbClient.Rules[i].RemotePort = req.RemotePort
 					dbClient.Rules[i].Enabled = boolPtr(true)
 					dbClient.Rules[i].PluginID = pluginID
 					dbClient.Rules[i].AuthEnabled = req.AuthEnabled
 					dbClient.Rules[i].AuthUsername = req.AuthUsername
 					dbClient.Rules[i].AuthPassword = req.AuthPassword
 					dbClient.Rules[i].PluginManaged = true
 					ruleExists = true
 					break
 				}
 			}
 			if !ruleExists {
 				// 创建新规则
 				dbClient.Rules = append(dbClient.Rules, protocol.ProxyRule{
 					Name:          req.PluginName,
 					Type:          req.PluginName,
 					RemotePort:    req.RemotePort,
 					Enabled:       boolPtr(true),
 					PluginID:      pluginID,
 					AuthEnabled:   req.AuthEnabled,
 					AuthUsername:  req.AuthUsername,
 					AuthPassword:  req.AuthPassword,
 					PluginManaged: true,
 				})
 			}
 		}
 		h.app.GetClientStore().UpdateClient(dbClient)
 	}
 	// 启动服务端监听器（让外部用户可以通过 RemotePort 访问插件）
 	if req.RemotePort > 0 {
 		pluginRule := protocol.ProxyRule{
 			Name:         req.PluginName,
 			Type:         req.PluginName, // 使用插件名作为类型，让 isClientPlugin 识别
 			RemotePort:   req.RemotePort,
 			Enabled:      boolPtr(true),
 			PluginID:     pluginID,
 			AuthEnabled:  req.AuthEnabled,
 			AuthUsername: req.AuthUsername,
 			AuthPassword: req.AuthPassword,
 		}
 		// 启动监听器（忽略错误，可能端口已被占用）
 		h.app.GetServer().StartPluginRule(req.ClientID, pluginRule)
 	}
 	Success(c, gin.H{
 		"status":    "ok",
 		"plugin":    req.PluginName,
 		"plugin_id": pluginID,
 		"client":    req.ClientID,
 	})
 }
 // boolPtr 返回 bool 值的指针
 func boolPtr(b bool) *bool {
 	return &b
 }
--- a/internal/server/router/router.go
+++ b/internal/server/router/router.go
@@ -67,8 +67,6 @@ func (r *GinRouter) SetupRoutes(app handler.AppInterface, jwtAuth *auth.JWTAuth,
 		api.POST("/client/:id/push", clientHandler.PushConfig)
 		api.POST("/client/:id/disconnect", clientHandler.Disconnect)
 		api.POST("/client/:id/restart", clientHandler.Restart)
 		api.POST("/client/:id/install-plugins", clientHandler.InstallPlugins)
 		api.POST("/client/:id/plugin/:pluginID/:action", clientHandler.PluginAction)
 		api.GET("/client/:id/system-stats", clientHandler.GetSystemStats)
 		api.GET("/client/:id/screenshot", clientHandler.GetScreenshot)
 		api.POST("/client/:id/shell", clientHandler.ExecuteShell)
@@ -79,29 +77,6 @@ func (r *GinRouter) SetupRoutes(app handler.AppInterface, jwtAuth *auth.JWTAuth,
 		api.PUT("/config", configHandler.Update)
 		api.POST("/config/reload", configHandler.Reload)
 		// 插件管理
 		pluginHandler := handler.NewPluginHandler(app)
 		api.GET("/plugins", pluginHandler.List)
 		api.POST("/plugin/:name/enable", pluginHandler.Enable)
 		api.POST("/plugin/:name/disable", pluginHandler.Disable)
 		api.GET("/rule-schemas", pluginHandler.GetRuleSchemas)
 		api.GET("/client-plugin/:clientID/:pluginName/config", pluginHandler.GetClientConfig)
 		api.PUT("/client-plugin/:clientID/:pluginName/config", pluginHandler.UpdateClientConfig)
 		// JS 插件管理
 		jsPluginHandler := handler.NewJSPluginHandler(app)
 		api.GET("/js-plugins", jsPluginHandler.List)
 		api.POST("/js-plugins", jsPluginHandler.Create)
 		api.GET("/js-plugin/:name", jsPluginHandler.Get)
 		api.PUT("/js-plugin/:name", jsPluginHandler.Update)
 		api.DELETE("/js-plugin/:name", jsPluginHandler.Delete)
 		api.POST("/js-plugin/:name/push/:clientID", jsPluginHandler.PushToClient)
 		// 插件商店
 		storeHandler := handler.NewStoreHandler(app)
 		api.GET("/store/plugins", storeHandler.ListPlugins)
 		api.POST("/store/install", storeHandler.Install)
 		// 更新管理
 		updateHandler := handler.NewUpdateHandler(app)
 		api.GET("/update/check/server", updateHandler.CheckServer)
@@ -118,9 +93,9 @@ func (r *GinRouter) SetupRoutes(app handler.AppInterface, jwtAuth *auth.JWTAuth,
 		api.GET("/traffic/stats", trafficHandler.GetStats)
 		api.GET("/traffic/hourly", trafficHandler.GetHourly)
-		// 插件 API 代理 (通过 Web API 访问客户端插件)
+		// 安装命令生成
-		pluginAPIHandler := handler.NewPluginAPIHandler(app)
+		installHandler := handler.NewInstallHandler(app)
-		api.Any("/client/:id/plugin-api/:pluginID/*route", pluginAPIHandler.ProxyRequest)
+		api.POST("/install/generate", installHandler.GenerateInstallCommand)
 	}
 }
@@ -200,10 +175,6 @@ func isStaticAsset(path string) bool {
 // Re-export types from handler package for backward compatibility
 type (
-	ServerInterface        = handler.ServerInterface
+	ServerInterface = handler.ServerInterface
-	AppInterface           = handler.AppInterface
+	AppInterface    = handler.AppInterface
 	ConfigField            = handler.ConfigField
 	RuleSchema             = handler.RuleSchema
 	PluginInfo             = handler.PluginInfo
 	JSPluginInstallRequest = handler.JSPluginInstallRequest
 )
--- a/internal/server/tunnel/server.go
+++ b/internal/server/tunnel/server.go
--- a/pkg/plugin/audit/audit.go
+++ b/pkg/plugin/audit/audit.go
@@ -1,154 +0,0 @@
 package audit
 import (
 	"encoding/json"
 	"log"
 	"os"
 	"path/filepath"
 	"sync"
 	"time"
 )
 // EventType 审计事件类型
 type EventType string
 const (
 	EventPluginInstall   EventType = "plugin_install"
 	EventPluginUninstall EventType = "plugin_uninstall"
 	EventPluginStart     EventType = "plugin_start"
 	EventPluginStop      EventType = "plugin_stop"
 	EventPluginVerify    EventType = "plugin_verify"
 	EventPluginReject    EventType = "plugin_reject"
 	EventConfigChange    EventType = "config_change"
 )
 // Event 审计事件
 type Event struct {
 	Timestamp  time.Time         `json:"timestamp"`
 	Type       EventType         `json:"type"`
 	PluginName string            `json:"plugin_name,omitempty"`
 	Version    string            `json:"version,omitempty"`
 	ClientID   string            `json:"client_id,omitempty"`
 	Success    bool              `json:"success"`
 	Message    string            `json:"message,omitempty"`
 	Details    map[string]string `json:"details,omitempty"`
 }
 // Logger 审计日志记录器
 type Logger struct {
 	path    string
 	file    *os.File
 	mu      sync.Mutex
 	enabled bool
 }
 var (
 	defaultLogger *Logger
 	loggerOnce    sync.Once
 )
 // NewLogger 创建审计日志记录器
 func NewLogger(dataDir string) (*Logger, error) {
 	path := filepath.Join(dataDir, "audit.log")
 	dir := filepath.Dir(path)
 	if err := os.MkdirAll(dir, 0755); err != nil {
 		return nil, err
 	}
 	file, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
 	if err != nil {
 		return nil, err
 	}
 	return &Logger{path: path, file: file, enabled: true}, nil
 }
 // InitDefault 初始化默认日志记录器
 func InitDefault(dataDir string) error {
 	var err error
 	loggerOnce.Do(func() {
 		defaultLogger, err = NewLogger(dataDir)
 	})
 	return err
 }
 // Log 记录审计事件
 func (l *Logger) Log(event Event) {
 	if l == nil || !l.enabled {
 		return
 	}
 	event.Timestamp = time.Now()
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	data, err := json.Marshal(event)
 	if err != nil {
 		log.Printf("[Audit] Marshal error: %v", err)
 		return
 	}
 	if _, err := l.file.Write(append(data, '\n')); err != nil {
 		log.Printf("[Audit] Write error: %v", err)
 	}
 }
 // Close 关闭日志文件
 func (l *Logger) Close() error {
 	if l == nil || l.file == nil {
 		return nil
 	}
 	return l.file.Close()
 }
 // LogEvent 使用默认记录器记录事件
 func LogEvent(event Event) {
 	if defaultLogger != nil {
 		defaultLogger.Log(event)
 	}
 }
 // LogPluginInstall 记录插件安装事件
 func LogPluginInstall(pluginName, version, clientID string, success bool, msg string) {
 	LogEvent(Event{
 		Type:       EventPluginInstall,
 		PluginName: pluginName,
 		Version:    version,
 		ClientID:   clientID,
 		Success:    success,
 		Message:    msg,
 	})
 }
 // LogPluginVerify 记录插件验证事件
 func LogPluginVerify(pluginName, version string, success bool, msg string) {
 	LogEvent(Event{
 		Type:       EventPluginVerify,
 		PluginName: pluginName,
 		Version:    version,
 		Success:    success,
 		Message:    msg,
 	})
 }
 // LogPluginReject 记录插件拒绝事件
 func LogPluginReject(pluginName, version, reason string) {
 	LogEvent(Event{
 		Type:       EventPluginReject,
 		PluginName: pluginName,
 		Version:    version,
 		Success:    false,
 		Message:    reason,
 	})
 }
 // LogWithDetails 记录带详情的事件
 func LogWithDetails(eventType EventType, pluginName string, success bool, msg string, details map[string]string) {
 	LogEvent(Event{
 		Type:       eventType,
 		PluginName: pluginName,
 		Success:    success,
 		Message:    msg,
 		Details:    details,
 	})
 }
--- a/pkg/plugin/registry.go
+++ b/pkg/plugin/registry.go
@@ -1,134 +0,0 @@
 package plugin
 import (
 	"context"
 	"fmt"
 	"sync"
 )
 // Registry 管理可用的 plugins (仅客户端插件)
 type Registry struct {
 	clientPlugins map[string]ClientPlugin // 客户端插件
 	enabled       map[string]bool         // 启用状态
 	mu            sync.RWMutex
 }
 // NewRegistry 创建 plugin 注册表
 func NewRegistry() *Registry {
 	return &Registry{
 		clientPlugins: make(map[string]ClientPlugin),
 		enabled:       make(map[string]bool),
 	}
 }
 // RegisterClient 注册客户端插件
 func (r *Registry) RegisterClient(handler ClientPlugin) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	meta := handler.Metadata()
 	if meta.Name == "" {
 		return fmt.Errorf("plugin name cannot be empty")
 	}
 	if _, exists := r.clientPlugins[meta.Name]; exists {
 		return fmt.Errorf("client plugin %s already registered", meta.Name)
 	}
 	r.clientPlugins[meta.Name] = handler
 	r.enabled[meta.Name] = true
 	return nil
 }
 // GetClient 返回客户端插件
 func (r *Registry) GetClient(name string) (ClientPlugin, error) {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	if handler, ok := r.clientPlugins[name]; ok {
 		if !r.enabled[name] {
 			return nil, fmt.Errorf("client plugin %s is disabled", name)
 		}
 		return handler, nil
 	}
 	return nil, fmt.Errorf("client plugin %s not found", name)
 }
 // List 返回所有可用的 plugins
 func (r *Registry) List() []Info {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	var plugins []Info
 	for name, handler := range r.clientPlugins {
 		plugins = append(plugins, Info{
 			Metadata: handler.Metadata(),
 			Loaded:   true,
 			Enabled:  r.enabled[name],
 		})
 	}
 	return plugins
 }
 // Has 检查 plugin 是否存在
 func (r *Registry) Has(name string) bool {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	_, ok := r.clientPlugins[name]
 	return ok
 }
 // Close 关闭所有 plugins
 func (r *Registry) Close(ctx context.Context) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	var lastErr error
 	for name, handler := range r.clientPlugins {
 		if err := handler.Stop(); err != nil {
 			lastErr = fmt.Errorf("failed to stop client plugin %s: %w", name, err)
 		}
 	}
 	return lastErr
 }
 // Enable 启用插件
 func (r *Registry) Enable(name string) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	if !r.has(name) {
 		return fmt.Errorf("plugin %s not found", name)
 	}
 	r.enabled[name] = true
 	return nil
 }
 // Disable 禁用插件
 func (r *Registry) Disable(name string) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	if !r.has(name) {
 		return fmt.Errorf("plugin %s not found", name)
 	}
 	r.enabled[name] = false
 	return nil
 }
 // has 内部检查（无锁）
 func (r *Registry) has(name string) bool {
 	_, ok := r.clientPlugins[name]
 	return ok
 }
 // IsEnabled 检查插件是否启用
 func (r *Registry) IsEnabled(name string) bool {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	return r.enabled[name]
 }
--- a/pkg/plugin/schema.go
+++ b/pkg/plugin/schema.go
@@ -1,109 +0,0 @@
 package plugin
 // 内置协议类型配置模式
 // BuiltinRuleSchemas 返回所有内置协议类型的配置模式
 func BuiltinRuleSchemas() map[string]RuleSchema {
 	return map[string]RuleSchema{
 		"tcp": {
 			NeedsLocalAddr: true,
 			ExtraFields:    nil,
 		},
 		"udp": {
 			NeedsLocalAddr: true,
 			ExtraFields:    nil,
 		},
 		"http": {
 			NeedsLocalAddr: false,
 			ExtraFields: []ConfigField{
 				{
 					Key:         "auth_enabled",
 					Label:       "启用认证",
 					Type:        ConfigFieldBool,
 					Default:     "false",
 					Description: "是否启用 HTTP Basic 认证",
 				},
 				{
 					Key:         "username",
 					Label:       "用户名",
 					Type:        ConfigFieldString,
 					Description: "HTTP 代理认证用户名",
 				},
 				{
 					Key:         "password",
 					Label:       "密码",
 					Type:        ConfigFieldPassword,
 					Description: "HTTP 代理认证密码",
 				},
 			},
 		},
 		"https": {
 			NeedsLocalAddr: false,
 			ExtraFields: []ConfigField{
 				{
 					Key:         "auth_enabled",
 					Label:       "启用认证",
 					Type:        ConfigFieldBool,
 					Default:     "false",
 					Description: "是否启用 HTTPS 代理认证",
 				},
 				{
 					Key:         "username",
 					Label:       "用户名",
 					Type:        ConfigFieldString,
 					Description: "HTTPS 代理认证用户名",
 				},
 				{
 					Key:         "password",
 					Label:       "密码",
 					Type:        ConfigFieldPassword,
 					Description: "HTTPS 代理认证密码",
 				},
 			},
 		},
 		"socks5": {
 			NeedsLocalAddr: false,
 			ExtraFields: []ConfigField{
 				{
 					Key:         "auth_enabled",
 					Label:       "启用认证",
 					Type:        ConfigFieldBool,
 					Default:     "false",
 					Description: "是否启用 SOCKS5 用户名/密码认证",
 				},
 				{
 					Key:         "username",
 					Label:       "用户名",
 					Type:        ConfigFieldString,
 					Description: "SOCKS5 认证用户名",
 				},
 				{
 					Key:         "password",
 					Label:       "密码",
 					Type:        ConfigFieldPassword,
 					Description: "SOCKS5 认证密码",
 				},
 			},
 		},
 	}
 }
 // GetRuleSchema 获取指定协议类型的配置模式
 func GetRuleSchema(proxyType string) *RuleSchema {
 	schemas := BuiltinRuleSchemas()
 	if schema, ok := schemas[proxyType]; ok {
 		return &schema
 	}
 	return nil
 }
 // IsBuiltinType 检查是否为内置协议类型
 func IsBuiltinType(proxyType string) bool {
 	builtinTypes := []string{"tcp", "udp", "http", "https"}
 	for _, t := range builtinTypes {
 		if t == proxyType {
 			return true
 		}
 	}
 	return false
 }
--- a/pkg/plugin/script/js.go
+++ b/pkg/plugin/script/js.go
@@ -1,913 +0,0 @@
 package script
 import (
 	"bufio"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
 	"github.com/dop251/goja"
 	"github.com/gotunnel/pkg/plugin"
 )
 // JSPlugin JavaScript 脚本插件
 type JSPlugin struct {
 	name           string
 	source         string
 	vm             *goja.Runtime
 	metadata       plugin.Metadata
 	config         map[string]string
 	sandbox        *Sandbox
 	running        bool
 	mu             sync.Mutex
 	eventListeners map[string][]func(goja.Value)
 	storagePath    string
 	apiHandlers    map[string]map[string]goja.Callable // method -> path -> handler
 }
 // NewJSPlugin 从 JS 源码创建插件
 func NewJSPlugin(name, source string) (*JSPlugin, error) {
 	p := &JSPlugin{
 		name:           name,
 		source:         source,
 		vm:             goja.New(),
 		sandbox:        DefaultSandbox(),
 		eventListeners: make(map[string][]func(goja.Value)),
 		storagePath:    filepath.Join("plugin_data", name+".json"),
 		apiHandlers:    make(map[string]map[string]goja.Callable),
 	}
 	// 确保存储目录存在
 	os.MkdirAll("plugin_data", 0755)
 	if err := p.init(); err != nil {
 		return nil, err
 	}
 	return p, nil
 }
 // SetSandbox 设置沙箱配置
 func (p *JSPlugin) SetSandbox(sandbox *Sandbox) {
 	p.sandbox = sandbox
 }
 // init 初始化 JS 运行时
 func (p *JSPlugin) init() error {
 	// 设置栈深度限制（防止递归攻击）
 	if p.sandbox.MaxStackDepth > 0 {
 		p.vm.SetMaxCallStackSize(p.sandbox.MaxStackDepth)
 	}
 	// 注入基础 API
 	p.vm.Set("log", p.jsLog)
 	// Config API (兼容旧的 config() 调用，同时支持 config.get/getAll)
 	p.vm.Set("config", p.jsGetConfig)
 	if configObj := p.vm.Get("config"); configObj != nil {
 		obj := configObj.ToObject(p.vm)
 		obj.Set("get", p.jsGetConfig)
 		obj.Set("getAll", p.jsGetAllConfig)
 	}
 	// 注入增强 API
 	p.vm.Set("logger", p.createLoggerAPI())
 	p.vm.Set("storage", p.createStorageAPI())
 	p.vm.Set("event", p.createEventAPI())
 	p.vm.Set("request", p.createRequestAPI())
 	p.vm.Set("notify", p.createNotifyAPI())
 	// 注入文件 API
 	p.vm.Set("fs", p.createFsAPI())
 	// 注入 HTTP API
 	p.vm.Set("http", p.createHttpAPI())
 	// 注入路由 API
 	p.vm.Set("api", p.createRouteAPI())
 	// 执行脚本
 	_, err := p.vm.RunString(p.source)
 	if err != nil {
 		return fmt.Errorf("run script: %w", err)
 	}
 	// 获取元数据
 	if err := p.loadMetadata(); err != nil {
 		return err
 	}
 	return nil
 }
 // loadMetadata 从 JS 获取元数据
 func (p *JSPlugin) loadMetadata() error {
 	fn, ok := goja.AssertFunction(p.vm.Get("metadata"))
 	if !ok {
 		// 使用默认元数据
 		p.metadata = plugin.Metadata{
 			Name:   p.name,
 			Type:   plugin.PluginTypeApp,
 			Source: plugin.PluginSourceScript,
 			RunAt:  plugin.SideClient,
 		}
 		return nil
 	}
 	result, err := fn(goja.Undefined())
 	if err != nil {
 		return err
 	}
 	obj := result.ToObject(p.vm)
 	p.metadata = plugin.Metadata{
 		Name:        getString(obj, "name", p.name),
 		Version:     getString(obj, "version", "1.0.0"),
 		Type:        plugin.PluginType(getString(obj, "type", "app")),
 		Source:      plugin.PluginSourceScript,
 		RunAt:       plugin.Side(getString(obj, "run_at", "client")),
 		Description: getString(obj, "description", ""),
 		Author:      getString(obj, "author", ""),
 	}
 	return nil
 }
 // Metadata 返回插件元数据
 func (p *JSPlugin) Metadata() plugin.Metadata {
 	return p.metadata
 }
 // Init 初始化插件配置
 func (p *JSPlugin) Init(config map[string]string) error {
 	p.config = config
 	// 根据 root_path 配置设置沙箱允许的路径
 	if rootPath := config["root_path"]; rootPath != "" {
 		absPath, err := filepath.Abs(rootPath)
 		if err == nil {
 			p.sandbox.AllowedPaths = append(p.sandbox.AllowedPaths, absPath)
 			p.sandbox.WritablePaths = append(p.sandbox.WritablePaths, absPath)
 		}
 	} else {
 		// 如果没有配置 root_path，默认允许访问当前目录
 		cwd, err := os.Getwd()
 		if err == nil {
 			p.sandbox.AllowedPaths = append(p.sandbox.AllowedPaths, cwd)
 			p.sandbox.WritablePaths = append(p.sandbox.WritablePaths, cwd)
 		}
 	}
 	return nil
 }
 // Start 启动插件
 func (p *JSPlugin) Start() (string, error) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	if p.running {
 		return "", nil
 	}
 	fn, ok := goja.AssertFunction(p.vm.Get("start"))
 	if ok {
 		_, err := fn(goja.Undefined())
 		if err != nil {
 			return "", err
 		}
 	}
 	p.running = true
 	return "script-plugin", nil
 }
 // HandleConn 处理连接
 func (p *JSPlugin) HandleConn(conn net.Conn) error {
 	defer conn.Close()
 	// goja Runtime 不是线程安全的，需要加锁
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	// 创建连接包装器
 	jsConn := newJSConn(conn)
 	fn, ok := goja.AssertFunction(p.vm.Get("handleConn"))
 	if !ok {
 		return fmt.Errorf("handleConn not defined")
 	}
 	_, err := fn(goja.Undefined(), p.vm.ToValue(jsConn))
 	return err
 }
 // Stop 停止插件
 func (p *JSPlugin) Stop() error {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	if !p.running {
 		return nil
 	}
 	fn, ok := goja.AssertFunction(p.vm.Get("stop"))
 	if ok {
 		fn(goja.Undefined())
 	}
 	p.running = false
 	return nil
 }
 // jsLog JS 日志函数
 func (p *JSPlugin) jsLog(msg string) {
 	fmt.Printf("[JS:%s] %s\n", p.name, msg)
 }
 // jsGetConfig 获取配置
 func (p *JSPlugin) jsGetConfig(key string) string {
 	if p.config == nil {
 		return ""
 	}
 	return p.config[key]
 }
 // getString 从 JS 对象获取字符串
 func getString(obj *goja.Object, key, def string) string {
 	v := obj.Get(key)
 	if v == nil || goja.IsUndefined(v) {
 		return def
 	}
 	return v.String()
 }
 // jsConn JS 连接包装器
 type jsConn struct {
 	conn net.Conn
 }
 func newJSConn(conn net.Conn) *jsConn {
 	return &jsConn{conn: conn}
 }
 func (c *jsConn) Read(size int) []byte {
 	buf := make([]byte, size)
 	n, err := c.conn.Read(buf)
 	if err != nil {
 		return nil
 	}
 	return buf[:n]
 }
 func (c *jsConn) Write(data []byte) int {
 	n, _ := c.conn.Write(data)
 	return n
 }
 func (c *jsConn) Close() {
 	c.conn.Close()
 }
 // =============================================================================
 // 文件系统 API
 // =============================================================================
 // createFsAPI 创建文件系统 API
 func (p *JSPlugin) createFsAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"readFile":  p.fsReadFile,
 		"writeFile": p.fsWriteFile,
 		"readDir":   p.fsReadDir,
 		"stat":      p.fsStat,
 		"exists":    p.fsExists,
 		"mkdir":     p.fsMkdir,
 		"remove":    p.fsRemove,
 	}
 }
 func (p *JSPlugin) fsReadFile(path string) map[string]interface{} {
 	if err := p.sandbox.ValidateReadPath(path); err != nil {
 		return map[string]interface{}{"error": err.Error(), "data": ""}
 	}
 	info, err := os.Stat(path)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "data": ""}
 	}
 	if info.Size() > p.sandbox.MaxReadSize {
 		return map[string]interface{}{"error": "file too large", "data": ""}
 	}
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "data": ""}
 	}
 	return map[string]interface{}{"error": "", "data": string(data)}
 }
 func (p *JSPlugin) fsWriteFile(path, content string) map[string]interface{} {
 	if err := p.sandbox.ValidateWritePath(path); err != nil {
 		return map[string]interface{}{"error": err.Error(), "ok": false}
 	}
 	if int64(len(content)) > p.sandbox.MaxWriteSize {
 		return map[string]interface{}{"error": "content too large", "ok": false}
 	}
 	err := os.WriteFile(path, []byte(content), 0644)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "ok": false}
 	}
 	return map[string]interface{}{"error": "", "ok": true}
 }
 func (p *JSPlugin) fsReadDir(path string) map[string]interface{} {
 	if err := p.sandbox.ValidateReadPath(path); err != nil {
 		return map[string]interface{}{"error": err.Error(), "entries": nil}
 	}
 	entries, err := os.ReadDir(path)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "entries": nil}
 	}
 	var result []map[string]interface{}
 	for _, e := range entries {
 		info, _ := e.Info()
 		result = append(result, map[string]interface{}{
 			"name":  e.Name(),
 			"isDir": e.IsDir(),
 			"size":  info.Size(),
 		})
 	}
 	return map[string]interface{}{"error": "", "entries": result}
 }
 func (p *JSPlugin) fsStat(path string) map[string]interface{} {
 	if err := p.sandbox.ValidateReadPath(path); err != nil {
 		return map[string]interface{}{"error": err.Error()}
 	}
 	info, err := os.Stat(path)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error()}
 	}
 	return map[string]interface{}{
 		"error":   "",
 		"name":    info.Name(),
 		"size":    info.Size(),
 		"isDir":   info.IsDir(),
 		"modTime": info.ModTime().Unix(),
 	}
 }
 func (p *JSPlugin) fsExists(path string) map[string]interface{} {
 	if err := p.sandbox.ValidateReadPath(path); err != nil {
 		return map[string]interface{}{"error": err.Error(), "exists": false}
 	}
 	_, err := os.Stat(path)
 	return map[string]interface{}{"error": "", "exists": err == nil}
 }
 func (p *JSPlugin) fsMkdir(path string) map[string]interface{} {
 	if err := p.sandbox.ValidateWritePath(path); err != nil {
 		return map[string]interface{}{"error": err.Error(), "ok": false}
 	}
 	err := os.MkdirAll(path, 0755)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "ok": false}
 	}
 	return map[string]interface{}{"error": "", "ok": true}
 }
 func (p *JSPlugin) fsRemove(path string) map[string]interface{} {
 	if err := p.sandbox.ValidateWritePath(path); err != nil {
 		return map[string]interface{}{"error": err.Error(), "ok": false}
 	}
 	err := os.RemoveAll(path)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "ok": false}
 	}
 	return map[string]interface{}{"error": "", "ok": true}
 }
 // =============================================================================
 // HTTP 服务 API
 // =============================================================================
 // createHttpAPI 创建 HTTP API
 func (p *JSPlugin) createHttpAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"serve":    p.httpServe,
 		"json":     p.httpJSON,
 		"sendFile": p.httpSendFile,
 	}
 }
 // httpServe 启动 HTTP 服务处理连接
 func (p *JSPlugin) httpServe(connObj interface{}, handler goja.Callable) {
 	// 从 jsConn 包装器中提取原始 net.Conn
 	var conn net.Conn
 	if jc, ok := connObj.(*jsConn); ok {
 		conn = jc.conn
 	} else if nc, ok := connObj.(net.Conn); ok {
 		conn = nc
 	} else {
 		fmt.Printf("[JS:%s] httpServe: invalid conn type: %T\n", p.name, connObj)
 		return
 	}
 	// 注意：不要在这里关闭连接，HandleConn 会负责关闭
 	// Use bufio to read the request properly
 	reader := bufio.NewReader(conn)
 	for {
 		// 1. Read Request Line
 		line, err := reader.ReadString('\n')
 		if err != nil {
 			if err != io.EOF {
 				fmt.Printf("[JS:%s] httpServe read error: %v\n", p.name, err)
 			}
 			return
 		}
 		line = strings.TrimSpace(line)
 		if line == "" {
 			continue
 		}
 		parts := strings.Split(line, " ")
 		if len(parts) < 2 {
 			fmt.Printf("[JS:%s] Invalid request line: %s\n", p.name, line)
 			return
 		}
 		method := parts[0]
 		path := parts[1]
 		fmt.Printf("[JS:%s] Request: %s %s\n", p.name, method, path)
 		// 2. Read Headers
 		headers := make(map[string]string)
 		contentLength := 0
 		for {
 			hLine, err := reader.ReadString('\n')
 			if err != nil {
 				break
 			}
 			hLine = strings.TrimSpace(hLine)
 			if hLine == "" {
 				break
 			}
 			if idx := strings.Index(hLine, ":"); idx > 0 {
 				key := strings.TrimSpace(hLine[:idx])
 				val := strings.TrimSpace(hLine[idx+1:])
 				headers[strings.ToLower(key)] = val
 				if strings.ToLower(key) == "content-length" {
 					contentLength, _ = strconv.Atoi(val)
 				}
 			}
 		}
 		// 3. Read Body
 		body := ""
 		if contentLength > 0 {
 			bodyBuf := make([]byte, contentLength)
 			if _, err := io.ReadFull(reader, bodyBuf); err == nil {
 				body = string(bodyBuf)
 			}
 		}
 		req := map[string]interface{}{
 			"method":  method,
 			"path":    path,
 			"headers": headers,
 			"body":    body,
 		}
 		// 调用 JS handler 函数
 		result, err := handler(goja.Undefined(), p.vm.ToValue(req))
 		if err != nil {
 			fmt.Printf("[JS:%s] HTTP handler error: %v\n", p.name, err)
 			conn.Write([]byte("HTTP/1.1 500 Internal Server Error\r\nConnection: close\r\n\r\n"))
 			return
 		}
 		// 将结果转换为 map
 		if result == nil || goja.IsUndefined(result) || goja.IsNull(result) {
 			conn.Write([]byte("HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n"))
 			continue
 		}
 		resp := make(map[string]interface{})
 		respObj := result.ToObject(p.vm)
 		for _, key := range respObj.Keys() {
 			val := respObj.Get(key)
 			resp[key] = val.Export()
 		}
 		writeHTTPResponse(conn, resp)
 	}
 }
 func (p *JSPlugin) httpJSON(data interface{}) string {
 	b, _ := json.Marshal(data)
 	return string(b)
 }
 func (p *JSPlugin) httpSendFile(connObj interface{}, filePath string) {
 	// 从 jsConn 包装器中提取原始 net.Conn
 	var conn net.Conn
 	if jc, ok := connObj.(*jsConn); ok {
 		conn = jc.conn
 	} else if nc, ok := connObj.(net.Conn); ok {
 		conn = nc
 	} else {
 		fmt.Printf("[JS:%s] httpSendFile: invalid conn type: %T\n", p.name, connObj)
 		return
 	}
 	f, err := os.Open(filePath)
 	if err != nil {
 		conn.Write([]byte("HTTP/1.1 404 Not Found\r\n\r\n"))
 		return
 	}
 	defer f.Close()
 	info, _ := f.Stat()
 	contentType := getContentType(filePath)
 	header := fmt.Sprintf("HTTP/1.1 200 OK\r\nContent-Type: %s\r\nContent-Length: %d\r\n\r\n",
 		contentType, info.Size())
 	conn.Write([]byte(header))
 	io.Copy(conn, f)
 }
 // parseHTTPRequest is deprecated, logic moved to httpServe
 func parseHTTPRequest(data []byte) map[string]interface{} {
 	return nil
 }
 // writeHTTPResponse 写入 HTTP 响应
 func writeHTTPResponse(conn net.Conn, resp map[string]interface{}) {
 	status := 200
 	if s, ok := resp["status"].(int); ok {
 		status = s
 	}
 	body := ""
 	if b, ok := resp["body"].(string); ok {
 		body = b
 	}
 	contentType := "application/json"
 	if ct, ok := resp["contentType"].(string); ok {
 		contentType = ct
 	}
 	header := fmt.Sprintf("HTTP/1.1 %d OK\r\nContent-Type: %s\r\nContent-Length: %d\r\n\r\n",
 		status, contentType, len(body))
 	conn.Write([]byte(header + body))
 }
 func indexOf(s, substr string) int {
 	for i := 0; i <= len(s)-len(substr); i++ {
 		if s[i:i+len(substr)] == substr {
 			return i
 		}
 	}
 	return -1
 }
 func getContentType(path string) string {
 	ext := filepath.Ext(path)
 	types := map[string]string{
 		".html": "text/html",
 		".css":  "text/css",
 		".js":   "application/javascript",
 		".json": "application/json",
 		".png":  "image/png",
 		".jpg":  "image/jpeg",
 		".gif":  "image/gif",
 		".txt":  "text/plain",
 	}
 	if ct, ok := types[ext]; ok {
 		return ct
 	}
 	return "application/octet-stream"
 }
 // =============================================================================
 // Logger API
 // =============================================================================
 func (p *JSPlugin) createLoggerAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"info":  func(msg string) { fmt.Printf("[JS:%s][INFO] %s\n", p.name, msg) },
 		"warn":  func(msg string) { fmt.Printf("[JS:%s][WARN] %s\n", p.name, msg) },
 		"error": func(msg string) { fmt.Printf("[JS:%s][ERROR] %s\n", p.name, msg) },
 	}
 }
 // =============================================================================
 // Config API Enhancements
 // =============================================================================
 func (p *JSPlugin) jsGetAllConfig() map[string]string {
 	if p.config == nil {
 		return map[string]string{}
 	}
 	return p.config
 }
 // =============================================================================
 // Storage API
 // =============================================================================
 func (p *JSPlugin) createStorageAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"get":    p.storageGet,
 		"set":    p.storageSet,
 		"delete": p.storageDelete,
 		"keys":   p.storageKeys,
 	}
 }
 func (p *JSPlugin) loadStorage() map[string]interface{} {
 	data := make(map[string]interface{})
 	if _, err := os.Stat(p.storagePath); err == nil {
 		content, _ := os.ReadFile(p.storagePath)
 		json.Unmarshal(content, &data)
 	}
 	return data
 }
 func (p *JSPlugin) saveStorage(data map[string]interface{}) {
 	content, _ := json.MarshalIndent(data, "", "  ")
 	os.WriteFile(p.storagePath, content, 0644)
 }
 func (p *JSPlugin) storageGet(key string, def interface{}) interface{} {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	data := p.loadStorage()
 	if v, ok := data[key]; ok {
 		return v
 	}
 	return def
 }
 func (p *JSPlugin) storageSet(key string, value interface{}) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	data := p.loadStorage()
 	data[key] = value
 	p.saveStorage(data)
 }
 func (p *JSPlugin) storageDelete(key string) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	data := p.loadStorage()
 	delete(data, key)
 	p.saveStorage(data)
 }
 func (p *JSPlugin) storageKeys() []string {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	data := p.loadStorage()
 	keys := make([]string, 0, len(data))
 	for k := range data {
 		keys = append(keys, k)
 	}
 	return keys
 }
 // =============================================================================
 // Event API
 // =============================================================================
 func (p *JSPlugin) createEventAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"on":   p.eventOn,
 		"emit": p.eventEmit,
 		"off":  p.eventOff,
 	}
 }
 func (p *JSPlugin) eventOn(event string, callback func(goja.Value)) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	p.eventListeners[event] = append(p.eventListeners[event], callback)
 }
 func (p *JSPlugin) eventEmit(event string, data interface{}) {
 	p.mu.Lock()
 	listeners := p.eventListeners[event]
 	p.mu.Unlock() // 释放锁以允许回调中操作
 	val := p.vm.ToValue(data)
 	for _, cb := range listeners {
 		cb(val)
 	}
 }
 func (p *JSPlugin) eventOff(event string) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	delete(p.eventListeners, event)
 }
 // =============================================================================
 // Request API (HTTP Client)
 // =============================================================================
 func (p *JSPlugin) createRequestAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"get":  p.requestGet,
 		"post": p.requestPost,
 	}
 }
 func (p *JSPlugin) requestGet(url string) map[string]interface{} {
 	resp, err := http.Get(url)
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "status": 0}
 	}
 	defer resp.Body.Close()
 	body, _ := io.ReadAll(resp.Body)
 	return map[string]interface{}{
 		"status": resp.StatusCode,
 		"body":   string(body),
 		"error":  "",
 	}
 }
 func (p *JSPlugin) requestPost(url string, contentType, data string) map[string]interface{} {
 	resp, err := http.Post(url, contentType, strings.NewReader(data))
 	if err != nil {
 		return map[string]interface{}{"error": err.Error(), "status": 0}
 	}
 	defer resp.Body.Close()
 	body, _ := io.ReadAll(resp.Body)
 	return map[string]interface{}{
 		"status": resp.StatusCode,
 		"body":   string(body),
 		"error":  "",
 	}
 }
 // =============================================================================
 // Notify API
 // =============================================================================
 func (p *JSPlugin) createNotifyAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"send": func(title, msg string) {
 			// 目前仅打印到日志，后续对接系统通知
 			fmt.Printf("[NOTIFY][%s] %s: %s\n", p.name, title, msg)
 		},
 	}
 }
 // =============================================================================
 // Route API (用于 Web API 代理)
 // =============================================================================
 func (p *JSPlugin) createRouteAPI() map[string]interface{} {
 	return map[string]interface{}{
 		"handle": p.apiHandle,
 		"get":    func(path string, handler goja.Callable) { p.apiRegister("GET", path, handler) },
 		"post":   func(path string, handler goja.Callable) { p.apiRegister("POST", path, handler) },
 		"put":    func(path string, handler goja.Callable) { p.apiRegister("PUT", path, handler) },
 		"delete": func(path string, handler goja.Callable) { p.apiRegister("DELETE", path, handler) },
 	}
 }
 // apiHandle 注册 API 路由处理函数
 func (p *JSPlugin) apiHandle(method, path string, handler goja.Callable) {
 	p.apiRegister(method, path, handler)
 }
 // apiRegister 注册 API 路由
 func (p *JSPlugin) apiRegister(method, path string, handler goja.Callable) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	if p.apiHandlers[method] == nil {
 		p.apiHandlers[method] = make(map[string]goja.Callable)
 	}
 	p.apiHandlers[method][path] = handler
 	fmt.Printf("[JS:%s] Registered API: %s %s\n", p.name, method, path)
 }
 // HandleAPIRequest 处理 API 请求
 func (p *JSPlugin) HandleAPIRequest(method, path, query string, headers map[string]string, body string) (int, map[string]string, string, error) {
 	p.mu.Lock()
 	handlers := p.apiHandlers[method]
 	p.mu.Unlock()
 	if handlers == nil {
 		return 404, nil, `{"error":"method not allowed"}`, nil
 	}
 	// 查找匹配的路由
 	var handler goja.Callable
 	var matchedPath string
 	for registeredPath, h := range handlers {
 		if matchRoute(registeredPath, path) {
 			handler = h
 			matchedPath = registeredPath
 			break
 		}
 	}
 	if handler == nil {
 		return 404, nil, `{"error":"route not found"}`, nil
 	}
 	// 构建请求对象
 	reqObj := map[string]interface{}{
 		"method":  method,
 		"path":    path,
 		"pattern": matchedPath,
 		"query":   query,
 		"headers": headers,
 		"body":    body,
 		"params":  extractParams(matchedPath, path),
 	}
 	// 调用处理函数
 	result, err := handler(goja.Undefined(), p.vm.ToValue(reqObj))
 	if err != nil {
 		return 500, nil, fmt.Sprintf(`{"error":"%s"}`, err.Error()), nil
 	}
 	// 解析响应
 	if result == nil || goja.IsUndefined(result) || goja.IsNull(result) {
 		return 200, nil, "", nil
 	}
 	respObj := result.ToObject(p.vm)
 	status := 200
 	if s := respObj.Get("status"); s != nil && !goja.IsUndefined(s) {
 		status = int(s.ToInteger())
 	}
 	respHeaders := make(map[string]string)
 	if h := respObj.Get("headers"); h != nil && !goja.IsUndefined(h) {
 		hObj := h.ToObject(p.vm)
 		for _, key := range hObj.Keys() {
 			respHeaders[key] = hObj.Get(key).String()
 		}
 	}
 	respBody := ""
 	if b := respObj.Get("body"); b != nil && !goja.IsUndefined(b) {
 		respBody = b.String()
 	}
 	return status, respHeaders, respBody, nil
 }
 // matchRoute 匹配路由 (支持简单的路径参数)
 func matchRoute(pattern, path string) bool {
 	patternParts := strings.Split(strings.Trim(pattern, "/"), "/")
 	pathParts := strings.Split(strings.Trim(path, "/"), "/")
 	if len(patternParts) != len(pathParts) {
 		return false
 	}
 	for i, part := range patternParts {
 		if strings.HasPrefix(part, ":") {
 			continue // 路径参数，匹配任意值
 		}
 		if part != pathParts[i] {
 			return false
 		}
 	}
 	return true
 }
 // extractParams 提取路径参数
 func extractParams(pattern, path string) map[string]string {
 	params := make(map[string]string)
 	patternParts := strings.Split(strings.Trim(pattern, "/"), "/")
 	pathParts := strings.Split(strings.Trim(path, "/"), "/")
 	for i, part := range patternParts {
 		if strings.HasPrefix(part, ":") && i < len(pathParts) {
 			paramName := strings.TrimPrefix(part, ":")
 			params[paramName] = pathParts[i]
 		}
 	}
 	return params
 }
--- a/pkg/plugin/script/sandbox.go
+++ b/pkg/plugin/script/sandbox.go
@@ -1,161 +0,0 @@
 package script
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 )
 // Sandbox 插件沙箱配置
 type Sandbox struct {
 	// 允许访问的路径列表（绝对路径）
 	AllowedPaths []string
 	// 允许写入的路径列表（必须是 AllowedPaths 的子集）
 	WritablePaths []string
 	// 禁止访问的路径（黑名单，优先级高于白名单）
 	DeniedPaths []string
 	// 是否允许网络访问
 	AllowNetwork bool
 	// 最大文件读取大小 (bytes)
 	MaxReadSize int64
 	// 最大文件写入大小 (bytes)
 	MaxWriteSize int64
 	// 最大内存使用量 (bytes)，0 表示不限制
 	MaxMemory int64
 	// 最大调用栈深度
 	MaxStackDepth int
 }
 // DefaultSandbox 返回默认沙箱配置（最小权限）
 func DefaultSandbox() *Sandbox {
 	return &Sandbox{
 		AllowedPaths:  []string{},
 		WritablePaths: []string{},
 		DeniedPaths:   defaultDeniedPaths(),
 		AllowNetwork:  false,
 		MaxReadSize:   10 * 1024 * 1024, // 10MB
 		MaxWriteSize:  1 * 1024 * 1024,  // 1MB
 		MaxMemory:     64 * 1024 * 1024, // 64MB
 		MaxStackDepth: 1000,             // 最大调用栈深度
 	}
 }
 // defaultDeniedPaths 返回默认禁止访问的路径
 func defaultDeniedPaths() []string {
 	home, _ := os.UserHomeDir()
 	denied := []string{
 		"/etc/passwd",
 		"/etc/shadow",
 		"/etc/sudoers",
 		"/root",
 		"/.ssh",
 		"/.gnupg",
 		"/.aws",
 		"/.kube",
 		"/proc",
 		"/sys",
 	}
 	if home != "" {
 		denied = append(denied,
 			filepath.Join(home, ".ssh"),
 			filepath.Join(home, ".gnupg"),
 			filepath.Join(home, ".aws"),
 			filepath.Join(home, ".kube"),
 			filepath.Join(home, ".config"),
 			filepath.Join(home, ".local"),
 		)
 	}
 	return denied
 }
 // ValidateReadPath 验证读取路径是否允许
 func (s *Sandbox) ValidateReadPath(path string) error {
 	return s.validatePath(path, false)
 }
 // ValidateWritePath 验证写入路径是否允许
 func (s *Sandbox) ValidateWritePath(path string) error {
 	return s.validatePath(path, true)
 }
 func (s *Sandbox) validatePath(path string, write bool) error {
 	// 清理路径，防止路径遍历攻击
 	cleanPath, err := s.cleanPath(path)
 	if err != nil {
 		return err
 	}
 	// 检查黑名单（优先级最高）
 	if s.isDenied(cleanPath) {
 		return fmt.Errorf("access denied: path is in denied list")
 	}
 	// 检查白名单
 	allowedList := s.AllowedPaths
 	if write {
 		allowedList = s.WritablePaths
 	}
 	if len(allowedList) == 0 {
 		return fmt.Errorf("access denied: no paths allowed")
 	}
 	if !s.isAllowed(cleanPath, allowedList) {
 		if write {
 			return fmt.Errorf("access denied: path not in writable list")
 		}
 		return fmt.Errorf("access denied: path not in allowed list")
 	}
 	return nil
 }
 // cleanPath 清理并验证路径
 func (s *Sandbox) cleanPath(path string) (string, error) {
 	// 转换为绝对路径
 	absPath, err := filepath.Abs(path)
 	if err != nil {
 		return "", fmt.Errorf("invalid path: %w", err)
 	}
 	// 清理路径（解析 .. 和 .）
 	cleanPath := filepath.Clean(absPath)
 	// 检查符号链接（防止通过符号链接绕过限制）
 	realPath, err := filepath.EvalSymlinks(cleanPath)
 	if err != nil {
 		// 文件可能不存在，使用清理后的路径
 		if !os.IsNotExist(err) {
 			return "", fmt.Errorf("invalid path: %w", err)
 		}
 		realPath = cleanPath
 	}
 	// 再次检查路径遍历
 	if strings.Contains(realPath, "..") {
 		return "", fmt.Errorf("path traversal detected")
 	}
 	return realPath, nil
 }
 // isDenied 检查路径是否在黑名单中
 func (s *Sandbox) isDenied(path string) bool {
 	for _, denied := range s.DeniedPaths {
 		if strings.HasPrefix(path, denied) || path == denied {
 			return true
 		}
 	}
 	return false
 }
 // isAllowed 检查路径是否在白名单中
 func (s *Sandbox) isAllowed(path string, allowedList []string) bool {
 	for _, allowed := range allowedList {
 		if strings.HasPrefix(path, allowed) || path == allowed {
 			return true
 		}
 	}
 	return false
 }
--- a/pkg/plugin/sign/official.go
+++ b/pkg/plugin/sign/official.go
@@ -1,31 +0,0 @@
 package sign
 import (
 	"crypto/ed25519"
 	"sync"
 )
 // 官方固定公钥（客户端内置）
 const OfficialPublicKeyBase64 = "0A0xRthj0wgPg8X8GJZ6/EnNpAUw5v7O//XLty+P5Yw="
 var (
 	officialPubKey     ed25519.PublicKey
 	officialPubKeyOnce sync.Once
 	officialPubKeyErr  error
 )
 // initOfficialKey 初始化官方公钥
 func initOfficialKey() {
 	officialPubKey, officialPubKeyErr = DecodePublicKey(OfficialPublicKeyBase64)
 }
 // GetOfficialPublicKey 获取官方公钥
 func GetOfficialPublicKey() (ed25519.PublicKey, error) {
 	officialPubKeyOnce.Do(initOfficialKey)
 	return officialPubKey, officialPubKeyErr
 }
 // GetPublicKeyByID 根据 ID 获取公钥（兼容旧接口，忽略 keyID）
 func GetPublicKeyByID(keyID string) (ed25519.PublicKey, error) {
 	return GetOfficialPublicKey()
 }
--- a/pkg/plugin/sign/payload.go
+++ b/pkg/plugin/sign/payload.go
@@ -1,107 +0,0 @@
 package sign
 import (
 	"crypto/ed25519"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"strings"
 	"time"
 )
 // PluginPayload 插件签名载荷
 type PluginPayload struct {
 	Name       string `json:"name"`        // 插件名称
 	Version    string `json:"version"`     // 版本号
 	SourceHash string `json:"source_hash"` // 源码 SHA256
 	KeyID      string `json:"key_id"`      // 签名密钥 ID
 	Timestamp  int64  `json:"timestamp"`   // 签名时间戳
 }
 // SignedPlugin 已签名的插件
 type SignedPlugin struct {
 	Payload   PluginPayload `json:"payload"`
 	Signature string        `json:"signature"` // Base64 签名
 }
 // NormalizeSource 规范化源码（统一换行符）
 func NormalizeSource(source string) string {
 	// 统一换行符为 LF
 	normalized := strings.ReplaceAll(source, "\r\n", "\n")
 	normalized = strings.ReplaceAll(normalized, "\r", "\n")
 	// 去除尾部空白
 	normalized = strings.TrimRight(normalized, " \t\n")
 	return normalized
 }
 // HashSource 计算源码哈希
 func HashSource(source string) string {
 	normalized := NormalizeSource(source)
 	hash := sha256.Sum256([]byte(normalized))
 	return hex.EncodeToString(hash[:])
 }
 // CreatePayload 创建签名载荷
 func CreatePayload(name, version, source, keyID string) *PluginPayload {
 	return &PluginPayload{
 		Name:       name,
 		Version:    version,
 		SourceHash: HashSource(source),
 		KeyID:      keyID,
 		Timestamp:  time.Now().Unix(),
 	}
 }
 // SignPlugin 签名插件
 func SignPlugin(priv ed25519.PrivateKey, payload *PluginPayload) (*SignedPlugin, error) {
 	// 序列化载荷
 	data, err := json.Marshal(payload)
 	if err != nil {
 		return nil, fmt.Errorf("marshal payload: %w", err)
 	}
 	// 签名
 	sig := SignBase64(priv, data)
 	return &SignedPlugin{
 		Payload:   *payload,
 		Signature: sig,
 	}, nil
 }
 // VerifyPlugin 验证插件签名
 func VerifyPlugin(pub ed25519.PublicKey, signed *SignedPlugin, source string) error {
 	// 验证源码哈希
 	expectedHash := HashSource(source)
 	if signed.Payload.SourceHash != expectedHash {
 		return fmt.Errorf("source hash mismatch")
 	}
 	// 序列化载荷
 	data, err := json.Marshal(signed.Payload)
 	if err != nil {
 		return fmt.Errorf("marshal payload: %w", err)
 	}
 	// 验证签名
 	return VerifyBase64(pub, data, signed.Signature)
 }
 // EncodeSignedPlugin 编码已签名插件为 JSON
 func EncodeSignedPlugin(sp *SignedPlugin) (string, error) {
 	data, err := json.Marshal(sp)
 	if err != nil {
 		return "", err
 	}
 	return string(data), nil
 }
 // DecodeSignedPlugin 从 JSON 解码已签名插件
 func DecodeSignedPlugin(data string) (*SignedPlugin, error) {
 	var sp SignedPlugin
 	if err := json.Unmarshal([]byte(data), &sp); err != nil {
 		return nil, err
 	}
 	return &sp, nil
 }
--- a/pkg/plugin/sign/sign.go
+++ b/pkg/plugin/sign/sign.go
@@ -1,92 +0,0 @@
 package sign
 import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/base64"
 	"errors"
 	"fmt"
 )
 var (
 	ErrInvalidSignature  = errors.New("invalid signature")
 	ErrInvalidPublicKey  = errors.New("invalid public key")
 	ErrInvalidPrivateKey = errors.New("invalid private key")
 )
 // KeyPair Ed25519 密钥对
 type KeyPair struct {
 	PublicKey  ed25519.PublicKey
 	PrivateKey ed25519.PrivateKey
 }
 // GenerateKeyPair 生成新的密钥对
 func GenerateKeyPair() (*KeyPair, error) {
 	pub, priv, err := ed25519.GenerateKey(rand.Reader)
 	if err != nil {
 		return nil, fmt.Errorf("generate key: %w", err)
 	}
 	return &KeyPair{PublicKey: pub, PrivateKey: priv}, nil
 }
 // Sign 使用私钥签名数据
 func Sign(privateKey ed25519.PrivateKey, data []byte) []byte {
 	return ed25519.Sign(privateKey, data)
 }
 // Verify 使用公钥验证签名
 func Verify(publicKey ed25519.PublicKey, data, signature []byte) bool {
 	return ed25519.Verify(publicKey, data, signature)
 }
 // SignBase64 签名并返回 Base64 编码
 func SignBase64(privateKey ed25519.PrivateKey, data []byte) string {
 	sig := Sign(privateKey, data)
 	return base64.StdEncoding.EncodeToString(sig)
 }
 // VerifyBase64 验证 Base64 编码的签名
 func VerifyBase64(publicKey ed25519.PublicKey, data []byte, sigB64 string) error {
 	sig, err := base64.StdEncoding.DecodeString(sigB64)
 	if err != nil {
 		return fmt.Errorf("decode signature: %w", err)
 	}
 	if !Verify(publicKey, data, sig) {
 		return ErrInvalidSignature
 	}
 	return nil
 }
 // EncodePublicKey 编码公钥为 Base64
 func EncodePublicKey(pub ed25519.PublicKey) string {
 	return base64.StdEncoding.EncodeToString(pub)
 }
 // DecodePublicKey 从 Base64 解码公钥
 func DecodePublicKey(s string) (ed25519.PublicKey, error) {
 	data, err := base64.StdEncoding.DecodeString(s)
 	if err != nil {
 		return nil, err
 	}
 	if len(data) != ed25519.PublicKeySize {
 		return nil, ErrInvalidPublicKey
 	}
 	return ed25519.PublicKey(data), nil
 }
 // EncodePrivateKey 编码私钥为 Base64
 func EncodePrivateKey(priv ed25519.PrivateKey) string {
 	return base64.StdEncoding.EncodeToString(priv)
 }
 // DecodePrivateKey 从 Base64 解码私钥
 func DecodePrivateKey(s string) (ed25519.PrivateKey, error) {
 	data, err := base64.StdEncoding.DecodeString(s)
 	if err != nil {
 		return nil, err
 	}
 	if len(data) != ed25519.PrivateKeySize {
 		return nil, ErrInvalidPrivateKey
 	}
 	return ed25519.PrivateKey(data), nil
 }
--- a/pkg/plugin/sign/version.go
+++ b/pkg/plugin/sign/version.go
@@ -1,47 +0,0 @@
 package sign
 import (
 	"strconv"
 	"strings"
 )
 // CompareVersions 比较两个版本号
 // 返回: -1 (v1 < v2), 0 (v1 == v2), 1 (v1 > v2)
 func CompareVersions(v1, v2 string) int {
 	parts1 := parseVersion(v1)
 	parts2 := parseVersion(v2)
 	maxLen := len(parts1)
 	if len(parts2) > maxLen {
 		maxLen = len(parts2)
 	}
 	for i := 0; i < maxLen; i++ {
 		var p1, p2 int
 		if i < len(parts1) {
 			p1 = parts1[i]
 		}
 		if i < len(parts2) {
 			p2 = parts2[i]
 		}
 		if p1 < p2 {
 			return -1
 		}
 		if p1 > p2 {
 			return 1
 		}
 	}
 	return 0
 }
 func parseVersion(v string) []int {
 	v = strings.TrimPrefix(v, "v")
 	parts := strings.Split(v, ".")
 	result := make([]int, len(parts))
 	for i, p := range parts {
 		n, _ := strconv.Atoi(p)
 		result[i] = n
 	}
 	return result
 }
--- a/pkg/plugin/types.go
+++ b/pkg/plugin/types.go
@@ -1,110 +0,0 @@
 package plugin
 import (
 	"net"
 	"time"
 )
 // =============================================================================
 // 基础类型
 // =============================================================================
 // Side 运行侧
 type Side string
 const (
 	SideClient Side = "client"
 )
 // PluginType 插件类别
 type PluginType string
 const (
 	PluginTypeProxy PluginType = "proxy" // 代理协议 (SOCKS5 等)
 	PluginTypeApp   PluginType = "app"   // 应用服务 (VNC, Echo 等)
 )
 // PluginSource 插件来源
 type PluginSource string
 const (
 	PluginSourceBuiltin PluginSource = "builtin" // 内置编译
 	PluginSourceScript  PluginSource = "script"  // 脚本插件
 )
 // =============================================================================
 // 配置相关
 // =============================================================================
 // ConfigFieldType 配置字段类型
 type ConfigFieldType string
 const (
 	ConfigFieldString   ConfigFieldType = "string"
 	ConfigFieldNumber   ConfigFieldType = "number"
 	ConfigFieldBool     ConfigFieldType = "bool"
 	ConfigFieldSelect   ConfigFieldType = "select"
 	ConfigFieldPassword ConfigFieldType = "password"
 )
 // ConfigField 配置字段定义
 type ConfigField struct {
 	Key         string          `json:"key"`
 	Label       string          `json:"label"`
 	Type        ConfigFieldType `json:"type"`
 	Default     string          `json:"default,omitempty"`
 	Required    bool            `json:"required,omitempty"`
 	Options     []string        `json:"options,omitempty"`
 	Description string          `json:"description,omitempty"`
 }
 // RuleSchema 规则表单模式
 type RuleSchema struct {
 	NeedsLocalAddr bool          `json:"needs_local_addr"`
 	ExtraFields    []ConfigField `json:"extra_fields,omitempty"`
 }
 // =============================================================================
 // 元数据
 // =============================================================================
 // Metadata 插件元数据
 type Metadata struct {
 	Name         string        `json:"name"`
 	Version      string        `json:"version"`
 	Type         PluginType    `json:"type"`
 	Source       PluginSource  `json:"source"`
 	RunAt        Side          `json:"run_at"`
 	Description  string        `json:"description"`
 	Author       string        `json:"author,omitempty"`
 	ConfigSchema []ConfigField `json:"config_schema,omitempty"`
 	RuleSchema   *RuleSchema   `json:"rule_schema,omitempty"`
 }
 // Info 插件运行时信息
 type Info struct {
 	Metadata Metadata  `json:"metadata"`
 	Loaded   bool      `json:"loaded"`
 	Enabled  bool      `json:"enabled"`
 	LoadedAt time.Time `json:"loaded_at,omitempty"`
 	Error    string    `json:"error,omitempty"`
 }
 // =============================================================================
 // 核心接口
 // =============================================================================
 // Dialer 网络拨号接口
 type Dialer interface {
 	Dial(network, address string) (net.Conn, error)
 }
 // ClientPlugin 客户端插件接口
 // 运行在客户端，提供本地服务
 type ClientPlugin interface {
 	Metadata() Metadata
 	Init(config map[string]string) error
 	Start() (localAddr string, err error)
 	HandleConn(conn net.Conn) error
 	Stop() error
 }
--- a/pkg/protocol/message.go
+++ b/pkg/protocol/message.go
@@ -26,34 +26,11 @@ const (
 	MsgTypeProxyConnect uint8 = 9  // 代理连接请求 (SOCKS5/HTTP)
 	MsgTypeProxyResult  uint8 = 10 // 代理连接结果
 	// Plugin 相关消息
 	MsgTypePluginList     uint8 = 20 // 请求/响应可用 plugins
 	MsgTypePluginDownload uint8 = 21 // 请求下载 plugin
 	MsgTypePluginData     uint8 = 22 // Plugin 二进制数据（分块）
 	MsgTypePluginReady    uint8 = 23 // Plugin 加载确认
 	// UDP 相关消息
 	MsgTypeUDPData uint8 = 30 // UDP 数据包
 	// 插件安装消息
 	MsgTypeInstallPlugins uint8 = 24 // 服务端推送安装插件列表
 	MsgTypePluginConfig   uint8 = 25 // 插件配置同步
 	// 客户端插件消息
 	MsgTypeClientPluginStart     uint8 = 40 // 启动客户端插件
 	MsgTypeClientPluginStop      uint8 = 41 // 停止客户端插件
 	MsgTypeClientPluginStatus    uint8 = 42 // 客户端插件状态
 	MsgTypeClientPluginConn      uint8 = 43 // 客户端插件连接请求
 	MsgTypePluginStatusQuery     uint8 = 44 // 查询所有插件状态
 	MsgTypePluginStatusQueryResp uint8 = 45 // 插件状态查询响应
 	// JS 插件动态安装
 	MsgTypeJSPluginInstall uint8 = 50 // 安装 JS 插件
 	MsgTypeJSPluginResult  uint8 = 51 // 安装结果
 	// 客户端控制消息
-	MsgTypeClientRestart      uint8 = 60 // 重启客户端
+	MsgTypeClientRestart uint8 = 60 // 重启客户端
 	MsgTypePluginConfigUpdate uint8 = 61 // 更新插件配置
 	// 更新相关消息
 	MsgTypeUpdateCheck    uint8 = 70 // 检查更新请求
@@ -68,10 +45,6 @@ const (
 	MsgTypeLogData    uint8 = 81 // 日志数据
 	MsgTypeLogStop    uint8 = 82 // 停止日志流
 	// 插件 API 路由消息
 	MsgTypePluginAPIRequest  uint8 = 90 // 插件 API 请求
 	MsgTypePluginAPIResponse uint8 = 91 // 插件 API 响应
 	// 系统状态消息
 	MsgTypeSystemStatsRequest  uint8 = 100 // 请求系统状态
 	MsgTypeSystemStatsResponse uint8 = 101 // 系统状态响应
@@ -111,22 +84,17 @@ type AuthResponse struct {
 // ProxyRule 代理规则
 type ProxyRule struct {
 	Name       string `json:"name" yaml:"name"`
-	Type       string `json:"type" yaml:"type"`                 // 内置: tcp, udp, http, https, websocket; 插件: socks5 等
+	Type       string `json:"type" yaml:"type"`                 // tcp, udp, http, https, socks5
 	LocalIP    string `json:"local_ip" yaml:"local_ip"`         // tcp/udp 模式使用
 	LocalPort  int    `json:"local_port" yaml:"local_port"`     // tcp/udp 模式使用
 	RemotePort int    `json:"remote_port" yaml:"remote_port"`   // 服务端监听端口
 	Enabled    *bool  `json:"enabled,omitempty" yaml:"enabled"` // 是否启用，默认为 true
-	// Plugin 支持字段
+	// HTTP Basic Auth 字段
 	PluginID      string            `json:"plugin_id,omitempty" yaml:"plugin_id"` // 插件实例ID
 	PluginName    string            `json:"plugin_name,omitempty" yaml:"plugin_name"`
 	PluginVersion string            `json:"plugin_version,omitempty" yaml:"plugin_version"`
 	PluginConfig  map[string]string `json:"plugin_config,omitempty" yaml:"plugin_config"`
 	// HTTP Basic Auth 字段 (用于独立端口模式)
 	AuthEnabled  bool   `json:"auth_enabled,omitempty" yaml:"auth_enabled"`
 	AuthUsername string `json:"auth_username,omitempty" yaml:"auth_username"`
 	AuthPassword string `json:"auth_password,omitempty" yaml:"auth_password"`
-	// 插件管理标记 - 由插件自动创建的规则，不允许手动编辑/删除
+	// 端口状态: "listening", "failed: <error message>", ""
-	PluginManaged bool `json:"plugin_managed,omitempty" yaml:"plugin_managed"`
+	PortStatus string `json:"port_status,omitempty" yaml:"-"`
 }
 // IsEnabled 检查规则是否启用，默认为 true
@@ -164,60 +132,6 @@ type ProxyConnectResult struct {
 	Message string `json:"message,omitempty"`
 }
 // PluginMetadata Plugin 元数据（协议层）
 type PluginMetadata struct {
 	Name        string `json:"name"`
 	Version     string `json:"version"`
 	Checksum    string `json:"checksum"`
 	Size        int64  `json:"size"`
 	Description string `json:"description,omitempty"`
 }
 // PluginListRequest 请求可用 plugins
 type PluginListRequest struct {
 	ClientVersion string `json:"client_version"`
 }
 // PluginListResponse 返回可用 plugins
 type PluginListResponse struct {
 	Plugins []PluginMetadata `json:"plugins"`
 }
 // PluginDownloadRequest 请求下载 plugin
 type PluginDownloadRequest struct {
 	Name    string `json:"name"`
 	Version string `json:"version"`
 }
 // PluginDataChunk Plugin 二进制数据块
 type PluginDataChunk struct {
 	Name        string `json:"name"`
 	Version     string `json:"version"`
 	ChunkIndex  int    `json:"chunk_index"`
 	TotalChunks int    `json:"total_chunks"`
 	Data        []byte `json:"data"`
 	Checksum    string `json:"checksum,omitempty"`
 }
 // PluginReadyNotification Plugin 加载确认
 type PluginReadyNotification struct {
 	Name    string `json:"name"`
 	Version string `json:"version"`
 	Success bool   `json:"success"`
 	Error   string `json:"error,omitempty"`
 }
 // InstallPluginsRequest 安装插件请求
 type InstallPluginsRequest struct {
 	Plugins []string `json:"plugins"` // 要安装的插件名称列表
 }
 // PluginConfigSync 插件配置同步
 type PluginConfigSync struct {
 	PluginName string            `json:"plugin_name"` // 插件名称
 	Config     map[string]string `json:"config"`      // 配置内容
 }
 // UDPPacket UDP 数据包
 type UDPPacket struct {
 	RemotePort int    `json:"remote_port"` // 服务端监听端口
@@ -225,67 +139,6 @@ type UDPPacket struct {
 	Data       []byte `json:"data"`        // UDP 数据
 }
 // ClientPluginStartRequest 启动客户端插件请求
 type ClientPluginStartRequest struct {
 	PluginName string            `json:"plugin_name"` // 插件名称
 	RuleName   string            `json:"rule_name"`   // 规则名称
 	RemotePort int               `json:"remote_port"` // 服务端监听端口
 	Config     map[string]string `json:"config"`      // 插件配置
 }
 // ClientPluginStopRequest 停止客户端插件请求
 type ClientPluginStopRequest struct {
 	PluginID   string `json:"plugin_id,omitempty"` // 插件ID（优先使用）
 	PluginName string `json:"plugin_name"`         // 插件名称
 	RuleName   string `json:"rule_name"`           // 规则名称
 }
 // ClientPluginStatusResponse 客户端插件状态响应
 type ClientPluginStatusResponse struct {
 	PluginName string `json:"plugin_name"` // 插件名称
 	RuleName   string `json:"rule_name"`   // 规则名称
 	Running    bool   `json:"running"`     // 是否运行中
 	LocalAddr  string `json:"local_addr"`  // 本地监听地址
 	Error      string `json:"error"`       // 错误信息
 }
 // ClientPluginConnRequest 客户端插件连接请求
 type ClientPluginConnRequest struct {
 	PluginID   string `json:"plugin_id,omitempty"` // 插件ID（优先使用）
 	PluginName string `json:"plugin_name"`         // 插件名称
 	RuleName   string `json:"rule_name"`           // 规则名称
 }
 // PluginStatusEntry 单个插件状态
 type PluginStatusEntry struct {
 	PluginName string `json:"plugin_name"` // 插件名称
 	Running    bool   `json:"running"`     // 是否运行中
 }
 // PluginStatusQueryResponse 插件状态查询响应
 type PluginStatusQueryResponse struct {
 	Plugins []PluginStatusEntry `json:"plugins"` // 所有插件状态
 }
 // JSPluginInstallRequest JS 插件安装请求
 type JSPluginInstallRequest struct {
 	PluginID   string            `json:"plugin_id"`   // 插件实例唯一 ID
 	PluginName string            `json:"plugin_name"` // 插件名称
 	Source     string            `json:"source"`      // JS 源码
 	Signature  string            `json:"signature"`   // 官方签名 (Base64)
 	RuleName   string            `json:"rule_name"`   // 规则名称
 	RemotePort int               `json:"remote_port"` // 服务端监听端口
 	Config     map[string]string `json:"config"`      // 插件配置
 	AutoStart  bool              `json:"auto_start"`  // 是否自动启动
 }
 // JSPluginInstallResult JS 插件安装结果
 type JSPluginInstallResult struct {
 	PluginName string `json:"plugin_name"`
 	Success    bool   `json:"success"`
 	Error      string `json:"error,omitempty"`
 }
 // ClientRestartRequest 客户端重启请求
 type ClientRestartRequest struct {
 	Reason string `json:"reason,omitempty"` // 重启原因
@@ -297,23 +150,6 @@ type ClientRestartResponse struct {
 	Message string `json:"message,omitempty"`
 }
 // PluginConfigUpdateRequest 插件配置更新请求
 type PluginConfigUpdateRequest struct {
 	PluginID   string            `json:"plugin_id,omitempty"` // 插件ID（优先使用）
 	PluginName string            `json:"plugin_name"`         // 插件名称
 	RuleName   string            `json:"rule_name"`           // 规则名称
 	Config     map[string]string `json:"config"`              // 新配置
 	Restart    bool              `json:"restart"`             // 是否重启插件
 }
 // PluginConfigUpdateResponse 插件配置更新响应
 type PluginConfigUpdateResponse struct {
 	PluginName string `json:"plugin_name"`
 	RuleName   string `json:"rule_name"`
 	Success    bool   `json:"success"`
 	Error      string `json:"error,omitempty"`
 }
 // UpdateCheckRequest 更新检查请求
 type UpdateCheckRequest struct {
 	Component string `json:"component"` // "server" 或 "client"
@@ -367,7 +203,7 @@ type LogEntry struct {
 	Timestamp int64  `json:"ts"`    // Unix 时间戳 (毫秒)
 	Level     string `json:"level"` // 日志级别: debug, info, warn, error
 	Message   string `json:"msg"`   // 日志消息
-	Source    string `json:"src"`   // 来源: client, plugin:<name>
+	Source    string `json:"src"`   // 来源: client
 }
 // LogData 日志数据
@@ -382,25 +218,6 @@ type LogStopRequest struct {
 	SessionID string `json:"session_id"` // 会话 ID
 }
 // PluginAPIRequest 插件 API 请求
 type PluginAPIRequest struct {
 	PluginID   string            `json:"plugin_id"`   // 插件实例唯一 ID
 	PluginName string            `json:"plugin_name"` // 插件名称 (向后兼容)
 	Method     string            `json:"method"`      // HTTP 方法: GET, POST, PUT, DELETE
 	Path       string            `json:"path"`        // 路由路径
 	Query      string            `json:"query"`       // 查询参数
 	Headers    map[string]string `json:"headers"`     // 请求头
 	Body       string            `json:"body"`        // 请求体
 }
 // PluginAPIResponse 插件 API 响应
 type PluginAPIResponse struct {
 	Status  int               `json:"status"`  // HTTP 状态码
 	Headers map[string]string `json:"headers"` // 响应头
 	Body    string            `json:"body"`    // 响应体
 	Error   string            `json:"error"`   // 错误信息
 }
 // WriteMessage 写入消息到 writer
 func WriteMessage(w io.Writer, msg *Message) error {
 	header := make([]byte, HeaderSize)
--- a/pkg/proxy/http.go
+++ b/pkg/proxy/http.go
@@ -2,6 +2,8 @@ package proxy
 import (
 	"bufio"
 	"encoding/base64"
 	"errors"
 	"io"
 	"net"
 	"net/http"
@@ -12,13 +14,15 @@ import (
 // HTTPServer HTTP 代理服务
 type HTTPServer struct {
-	dialer  Dialer
+	dialer   Dialer
-	onStats func(in, out int64) // 流量统计回调
+	onStats  func(in, out int64) // 流量统计回调
 	username string
 	password string
 }
 // NewHTTPServer 创建 HTTP 代理服务
-func NewHTTPServer(dialer Dialer, onStats func(in, out int64)) *HTTPServer {
+func NewHTTPServer(dialer Dialer, onStats func(in, out int64), username, password string) *HTTPServer {
-	return &HTTPServer{dialer: dialer, onStats: onStats}
+	return &HTTPServer{dialer: dialer, onStats: onStats, username: username, password: password}
 }
 // HandleConn 处理 HTTP 代理连接
@@ -31,12 +35,45 @@ func (h *HTTPServer) HandleConn(conn net.Conn) error {
 		return err
 	}
 	// 检查认证
 	if h.username != "" && h.password != "" {
 		if !h.checkAuth(req) {
 			conn.Write([]byte("HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm=\"proxy\"\r\n\r\n"))
 			return errors.New("authentication required")
 		}
 	}
 	if req.Method == http.MethodConnect {
 		return h.handleConnect(conn, req)
 	}
 	return h.handleHTTP(conn, req, reader)
 }
 // checkAuth 检查 Proxy-Authorization 头
 func (h *HTTPServer) checkAuth(req *http.Request) bool {
 	auth := req.Header.Get("Proxy-Authorization")
 	if auth == "" {
 		return false
 	}
 	const prefix = "Basic "
 	if !strings.HasPrefix(auth, prefix) {
 		return false
 	}
 	decoded, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
 	if err != nil {
 		return false
 	}
 	credentials := strings.SplitN(string(decoded), ":", 2)
 	if len(credentials) != 2 {
 		return false
 	}
 	return credentials[0] == h.username && credentials[1] == h.password
 }
 // handleConnect 处理 CONNECT 方法 (HTTPS)
 func (h *HTTPServer) handleConnect(conn net.Conn, req *http.Request) error {
 	target := req.Host
--- a/pkg/proxy/server.go
+++ b/pkg/proxy/server.go
@@ -14,10 +14,10 @@ type Server struct {
 }
 // NewServer 创建代理服务器
-func NewServer(typ string, dialer Dialer, onStats func(in, out int64)) *Server {
+func NewServer(typ string, dialer Dialer, onStats func(in, out int64), username, password string) *Server {
 	return &Server{
-		socks5: NewSOCKS5Server(dialer, onStats),
+		socks5: NewSOCKS5Server(dialer, onStats, username, password),
-		http:   NewHTTPServer(dialer, onStats),
+		http:   NewHTTPServer(dialer, onStats, username, password),
 		typ:    typ,
 	}
 }
--- a/pkg/proxy/socks5.go
+++ b/pkg/proxy/socks5.go
@@ -13,6 +13,7 @@ import (
 const (
 	socks5Version = 0x05
 	noAuth        = 0x00
 	userPassAuth  = 0x02
 	cmdConnect    = 0x01
 	atypIPv4      = 0x01
 	atypDomain    = 0x03
@@ -21,8 +22,10 @@ const (
 // SOCKS5Server SOCKS5 代理服务
 type SOCKS5Server struct {
-	dialer  Dialer
+	dialer   Dialer
-	onStats func(in, out int64) // 流量统计回调
+	onStats  func(in, out int64) // 流量统计回调
 	username string
 	password string
 }
 // Dialer 连接拨号器接口
@@ -31,8 +34,8 @@ type Dialer interface {
 }
 // NewSOCKS5Server 创建 SOCKS5 服务
-func NewSOCKS5Server(dialer Dialer, onStats func(in, out int64)) *SOCKS5Server {
+func NewSOCKS5Server(dialer Dialer, onStats func(in, out int64), username, password string) *SOCKS5Server {
-	return &SOCKS5Server{dialer: dialer, onStats: onStats}
+	return &SOCKS5Server{dialer: dialer, onStats: onStats, username: username, password: password}
 }
 // HandleConn 处理 SOCKS5 连接
@@ -85,11 +88,54 @@ func (s *SOCKS5Server) handshake(conn net.Conn) error {
 		return err
 	}
-	// 响应：使用无认证
+	// 如果配置了用户名密码，要求认证
 	if s.username != "" && s.password != "" {
 		_, err := conn.Write([]byte{socks5Version, userPassAuth})
 		if err != nil {
 			return err
 		}
 		return s.authenticate(conn)
 	}
 	// 无认证
 	_, err := conn.Write([]byte{socks5Version, noAuth})
 	return err
 }
 // authenticate 处理用户名密码认证
 func (s *SOCKS5Server) authenticate(conn net.Conn) error {
 	buf := make([]byte, 2)
 	if _, err := io.ReadFull(conn, buf); err != nil {
 		return err
 	}
 	if buf[0] != 0x01 {
 		return errors.New("unsupported auth version")
 	}
 	ulen := int(buf[1])
 	username := make([]byte, ulen)
 	if _, err := io.ReadFull(conn, username); err != nil {
 		return err
 	}
 	plen := make([]byte, 1)
 	if _, err := io.ReadFull(conn, plen); err != nil {
 		return err
 	}
 	password := make([]byte, plen[0])
 	if _, err := io.ReadFull(conn, password); err != nil {
 		return err
 	}
 	if string(username) == s.username && string(password) == s.password {
 		conn.Write([]byte{0x01, 0x00}) // 认证成功
 		return nil
 	}
 	conn.Write([]byte{0x01, 0x01}) // 认证失败
 	return errors.New("authentication failed")
 }
 // readRequest 读取请求
 func (s *SOCKS5Server) readRequest(conn net.Conn) (string, error) {
 	buf := make([]byte, 4)
--- a/test_config.yaml
+++ b/test_config.yaml
@@ -1,3 +0,0 @@
 server: "127.0.0.1:7000"
 token: "testtoken"
 id: "testclient"
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -1217,7 +1217,6 @@
      "integrity": "sha512-ne4A0IpG3+2ETuREInjPNhUGis1SFjv1d5asp8MzEAGtOZeTeHVDOYqOgqfhvseqg/iXty2hjBf1zAOb7RNiNw==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "undici-types": "~7.16.0"
      }
@@ -1518,7 +1517,6 @@
        }
      ],
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.9.0",
        "caniuse-lite": "^1.0.30001759",
@@ -2296,7 +2294,6 @@
      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -2323,7 +2320,6 @@
        }
      ],
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "nanoid": "^3.3.11",
        "picocolors": "^1.1.1",
@@ -2444,7 +2440,6 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "devOptional": true,
      "license": "Apache-2.0",
      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -2497,7 +2492,6 @@
      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "esbuild": "^0.27.0",
        "fdir": "^6.5.0",
@@ -2579,7 +2573,6 @@
      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.27.tgz",
      "integrity": "sha512-aJ/UtoEyFySPBGarREmN4z6qNKpbEguYHMmXSiOGk69czc+zhs0NF6tEFrY8TZKAl8N/LYAkd4JHVd5E/AsSmw==",
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "@vue/compiler-dom": "3.5.27",
        "@vue/compiler-sfc": "3.5.27",
--- a/web/src/api/index.ts
+++ b/web/src/api/index.ts
@@ -1,5 +1,5 @@
 import { get, post, put, del, getToken } from '../config/axios'
-import type { ClientConfig, ClientStatus, ClientDetail, ServerStatus, PluginInfo, StorePluginInfo, PluginConfigResponse, JSPlugin, RuleSchemasMap, LogEntry, LogStreamOptions, ConfigField } from '../types'
+import type { ClientConfig, ClientStatus, ClientDetail, ServerStatus, LogEntry, LogStreamOptions, InstallCommandResponse } from '../types'
 // 重新导出 token 管理方法
 export { getToken, setToken, removeToken } from '../config/axios'
@@ -24,91 +24,6 @@ export const reloadConfig = () => post('/config/reload')
 export const pushConfigToClient = (id: string) => post(`/client/${id}/push`)
 export const disconnectClient = (id: string) => post(`/client/${id}/disconnect`)
 export const restartClient = (id: string) => post(`/client/${id}/restart`)
 export const installPluginsToClient = (id: string, plugins: string[]) =>
  post(`/client/${id}/install-plugins`, { plugins })
 // 规则配置模式
 export const getRuleSchemas = () => get<RuleSchemasMap>('/rule-schemas')
 // 客户端插件控制（使用 pluginID）
 export const startClientPlugin = (clientId: string, pluginId: string, ruleName: string) =>
  post(`/client/${clientId}/plugin/${pluginId}/start`, { rule_name: ruleName })
 export const stopClientPlugin = (clientId: string, pluginId: string, ruleName: string) =>
  post(`/client/${clientId}/plugin/${pluginId}/stop`, { rule_name: ruleName })
 export const restartClientPlugin = (clientId: string, pluginId: string, ruleName: string) =>
  post(`/client/${clientId}/plugin/${pluginId}/restart`, { rule_name: ruleName })
 export const deleteClientPlugin = (clientId: string, pluginId: string) =>
  post(`/client/${clientId}/plugin/${pluginId}/delete`)
 export const updateClientPluginConfigWithRestart = (clientId: string, pluginId: string, ruleName: string, config: Record<string, string>, restart: boolean) =>
  post(`/client/${clientId}/plugin/${pluginId}/config`, { rule_name: ruleName, config, restart })
 // 插件管理
 export const getPlugins = () => get<PluginInfo[]>('/plugins')
 export const enablePlugin = (name: string) => post(`/plugin/${name}/enable`)
 export const disablePlugin = (name: string) => post(`/plugin/${name}/disable`)
 // 扩展商店
 export const getStorePlugins = () => get<{ plugins: StorePluginInfo[] }>('/store/plugins')
 export const installStorePlugin = (
  pluginName: string,
  downloadUrl: string,
  signatureUrl: string,
  clientId: string,
  remotePort?: number,
  version?: string,
  configSchema?: ConfigField[],
  authEnabled?: boolean,
  authUsername?: string,
  authPassword?: string
 ) =>
  post('/store/install', {
    plugin_name: pluginName,
    version: version || '',
    download_url: downloadUrl,
    signature_url: signatureUrl,
    client_id: clientId,
    remote_port: remotePort || 0,
    config_schema: configSchema || [],
    auth_enabled: authEnabled || false,
    auth_username: authUsername || '',
    auth_password: authPassword || ''
  })
 // 客户端插件配置
 export const getClientPluginConfig = (clientId: string, pluginName: string) =>
  get<PluginConfigResponse>(`/client-plugin/${clientId}/${pluginName}/config`)
 export const updateClientPluginConfig = (clientId: string, pluginName: string, config: Record<string, string>) =>
  put(`/client-plugin/${clientId}/${pluginName}/config`, { config })
 // JS 插件管理
 export const getJSPlugins = () => get<JSPlugin[]>('/js-plugins')
 export const createJSPlugin = (plugin: JSPlugin) => post('/js-plugins', plugin)
 export const getJSPlugin = (name: string) => get<JSPlugin>(`/js-plugin/${name}`)
 export const updateJSPlugin = (name: string, plugin: JSPlugin) => put(`/js-plugin/${name}`, plugin)
 export const deleteJSPlugin = (name: string) => del(`/js-plugin/${name}`)
 export const pushJSPluginToClient = (pluginName: string, clientId: string, remotePort?: number) =>
  post(`/js-plugin/${pluginName}/push/${clientId}`, { remote_port: remotePort || 0 })
 export const updateJSPluginConfig = (name: string, config: Record<string, string>) =>
  put(`/js-plugin/${name}/config`, { config })
 export const setJSPluginEnabled = (name: string, enabled: boolean) =>
  post(`/js-plugin/${name}/${enabled ? 'enable' : 'disable'}`)
 // 插件 API 代理（通过 pluginID 调用插件自定义 API）
 export const callPluginAPI = <T = any>(clientId: string, pluginId: string, method: string, route: string, body?: any) => {
  const path = `/client/${clientId}/plugin-api/${pluginId}${route.startsWith('/') ? route : '/' + route}`
  switch (method.toUpperCase()) {
    case 'GET':
      return get<T>(path)
    case 'POST':
      return post<T>(path, body)
    case 'PUT':
      return put<T>(path, body)
    case 'DELETE':
      return del<T>(path)
    default:
      return get<T>(path)
  }
 }
 // 更新管理
 export interface UpdateInfo {
@@ -265,3 +180,7 @@ export interface UpdateServerConfigRequest {
 export const getServerConfig = () => get<ServerConfigResponse>('/config')
 export const updateServerConfig = (config: UpdateServerConfigRequest) => put('/config', config)
 // 安装命令生成
 export const generateInstallCommand = (clientId: string) =>
  post<InstallCommandResponse>('/install/generate', { client_id: clientId })
--- a/web/src/types/index.ts
+++ b/web/src/types/index.ts
@@ -6,43 +6,6 @@ export interface ProxyRule {
  remote_port: number
  type?: string
  enabled?: boolean
  plugin_config?: Record<string, string>
  plugin_managed?: boolean // 插件管理标记 - 由插件自动创建的规则
 }
 // 客户端已安装的插件
 export interface ClientPlugin {
  id: string           // 插件实例唯一 ID
  name: string
  version: string
  enabled: boolean
  running: boolean
  config?: Record<string, string>
  remote_port?: number // 远程监听端口
 }
 // 插件配置字段
 export interface ConfigField {
  key: string
  label: string
  type: 'string' | 'number' | 'bool' | 'select' | 'password'
  default?: string
  required?: boolean
  options?: string[]
  description?: string
 }
 // 规则表单模式
 export interface RuleSchema {
  needs_local_addr: boolean
  extra_fields?: ConfigField[]
 }
 // 插件配置响应
 export interface PluginConfigResponse {
  plugin_name: string
  schema: ConfigField[]
  config: Record<string, string>
 }
 // 客户端配置
@@ -50,7 +13,6 @@ export interface ClientConfig {
  id: string
  nickname?: string
  rules: ProxyRule[]
  plugins?: ClientPlugin[]
 }
 // 客户端状态
@@ -70,7 +32,6 @@ export interface ClientDetail {
  id: string
  nickname?: string
  rules: ProxyRule[]
  plugins?: ClientPlugin[]
  online: boolean
  last_ping?: string
  remote_addr?: string
@@ -88,64 +49,12 @@ export interface ServerStatus {
  client_count: number
 }
 // 插件类型
 export const PluginType = {
  Proxy: 'proxy',
  App: 'app',
  Service: 'service',
  Tool: 'tool'
 } as const
 export type PluginTypeValue = typeof PluginType[keyof typeof PluginType]
 // 插件信息
 export interface PluginInfo {
  name: string
  version: string
  type: string
  description: string
  source: string
  icon?: string
  enabled: boolean
  rule_schema?: RuleSchema
 }
 // 扩展商店插件信息
 export interface StorePluginInfo {
  name: string
  version: string
  type: string
  description: string
  author: string
  icon?: string
  download_url?: string
  signature_url?: string
  config_schema?: ConfigField[]
 }
 // JS 插件信息
 export interface JSPlugin {
  name: string
  source: string
  signature?: string
  description: string
  author: string
  version?: string
  auto_push: string[]
  config: Record<string, string>
  auto_start: boolean
  enabled: boolean
 }
 // 规则配置模式集合
 export type RuleSchemasMap = Record<string, RuleSchema>
 // 日志条目
 export interface LogEntry {
  ts: number      // Unix 时间戳 (毫秒)
  level: string   // 日志级别: debug, info, warn, error
  msg: string     // 日志消息
-  src: string     // 来源: client, plugin:<name>
+  src: string     // 来源: client
 }
 // 日志流选项
@@ -154,3 +63,15 @@ export interface LogStreamOptions {
  follow?: boolean // 是否持续推送
  level?: string   // 日志级别过滤
 }
 // 安装命令响应
 export interface InstallCommandResponse {
  token: string
  commands: {
    linux: string
    macos: string
    windows: string
  }
  expires_at: number
  server_addr: string
 }
--- a/web/src/views/ClientView.vue
+++ b/web/src/views/ClientView.vue
@@ -3,8 +3,7 @@ import { ref, onMounted, onUnmounted } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import {
  ArrowBackOutline, CreateOutline, TrashOutline,
-  PushOutline, AddOutline, StorefrontOutline,
+  PushOutline, AddOutline, RefreshOutline,
  ExtensionPuzzleOutline, SettingsOutline, RefreshOutline,
  PlayOutline
 } from '@vicons/ionicons5'
 import GlassModal from '../components/GlassModal.vue'
@@ -14,13 +13,11 @@ import { useToast } from '../composables/useToast'
 import { useConfirm } from '../composables/useConfirm'
 import {
  getClient, updateClient, deleteClient, pushConfigToClient, disconnectClient, restartClient,
  getClientPluginConfig, updateClientPluginConfig,
  getStorePlugins, installStorePlugin, getRuleSchemas, startClientPlugin, restartClientPlugin, stopClientPlugin, deleteClientPlugin,
  checkClientUpdate, applyClientUpdate, getClientSystemStats, getVersionInfo,
  getClientScreenshot, executeClientShell,
  type UpdateInfo, type SystemStats, type ScreenshotData
 } from '../api'
-import type { ProxyRule, ClientPlugin, ConfigField, StorePluginInfo, RuleSchemasMap } from '../types'
+import type { ProxyRule } from '../types'
 import InlineLogPanel from '../components/InlineLogPanel.vue'
 const route = useRoute()
@@ -35,7 +32,6 @@ const lastPing = ref('')
 const remoteAddr = ref('')
 const nickname = ref('')
 const rules = ref<ProxyRule[]>([])
 const clientPlugins = ref<ClientPlugin[]>([])
 const loading = ref(false)
 const clientOs = ref('')
 const clientArch = ref('')
@@ -65,17 +61,6 @@ const serverVersion = ref('')
  const shellHistory = ref<string[]>([])
  const historyIndex = ref(-1)
 // Rule Schemas
 const pluginRuleSchemas = ref<RuleSchemasMap>({})
 const loadRuleSchemas = async () => {
  try {
    const { data } = await getRuleSchemas()
    pluginRuleSchemas.value = data || {}
  } catch (e) {
    console.error('Failed to load rule schemas', e)
  }
 }
 // Built-in Types (Added WebSocket)
 const builtinTypes = [
  { label: 'TCP', value: 'tcp' },
@@ -96,20 +81,13 @@ const defaultRule = {
  local_port: 80,
  remote_port: 0,
  type: 'tcp',
-  enabled: true,
+  enabled: true
  plugin_config: {} as Record<string, string>
 }
 const ruleForm = ref<ProxyRule>({ ...defaultRule })
 // Helper: Check if type needs local addr
-const needsLocalAddr = (type: string) => {
+const needsLocalAddr = () => {
-  const schema = pluginRuleSchemas.value[type]
+  return true
  return schema?.needs_local_addr ?? true
 }
 const getExtraFields = (type: string): ConfigField[] => {
  const schema = pluginRuleSchemas.value[type]
  return schema?.extra_fields || []
 }
 // 加载服务端版本
@@ -177,7 +155,6 @@ const loadClient = async () => {
    remoteAddr.value = data.remote_addr || ''
    nickname.value = data.nickname || ''
    rules.value = data.rules || []
    clientPlugins.value = data.plugins || []
    clientOs.value = data.os || ''
    clientArch.value = data.arch || ''
    clientVersion.value = data.version || ''
@@ -368,7 +345,6 @@ const openCreateRule = () => {
 }
 const openEditRule = (rule: ProxyRule) => {
  if (rule.plugin_managed) return
  ruleModalType.value = 'edit'
  ruleForm.value = JSON.parse(JSON.stringify(rule))
  showRuleModal.value = true
@@ -416,7 +392,7 @@ const handleRuleSubmit = async () => {
    message.error('请输入有效的远程端口 (1-65535)')
    return
  }
-  if (needsLocalAddr(ruleForm.value.type || 'tcp')) {
+  if (needsLocalAddr()) {
    if (!ruleForm.value.local_ip) {
      message.error('请输入本地IP')
      return
@@ -444,126 +420,6 @@ const handleRuleSubmit = async () => {
  showRuleModal.value = false
 }
 // Store & Plugin Logic
 const showStoreModal = ref(false)
 const storePlugins = ref<StorePluginInfo[]>([])
 const storeLoading = ref(false)
 const storeInstalling = ref<string | null>(null)
 const showInstallConfigModal = ref(false)
 const installPlugin = ref<StorePluginInfo | null>(null)
 const installRemotePort = ref<number | null>(8080)
 const installAuthEnabled = ref(false)
 const installAuthUsername = ref('')
 const installAuthPassword = ref('')
 const openStoreModal = async () => {
  showStoreModal.value = true
  storeLoading.value = true
  try {
    const { data } = await getStorePlugins()
    storePlugins.value = (data.plugins || []).filter((p: any) => p.download_url)
  } catch (e) {
    message.error('加载商店失败')
  } finally {
    storeLoading.value = false
  }
 }
 const handleInstallStorePlugin = (plugin: StorePluginInfo) => {
  installPlugin.value = plugin
  installRemotePort.value = 8080
  showInstallConfigModal.value = true
 }
 const confirmInstallPlugin = async () => {
  if (!installPlugin.value) return
  storeInstalling.value = installPlugin.value.name
  try {
    await installStorePlugin(
      installPlugin.value.name,
      installPlugin.value.download_url || '',
      installPlugin.value.signature_url || '',
      clientId,
      installRemotePort.value || 8080,
      installPlugin.value.version,
      installPlugin.value.config_schema,
      installAuthEnabled.value,
      installAuthUsername.value,
      installAuthPassword.value
    )
    message.success(`已安装 ${installPlugin.value.name}`)
    showInstallConfigModal.value = false
    showStoreModal.value = false
    await loadClient()
  } catch (e: any) {
    message.error(e.response?.data || '安装失败')
  } finally {
    storeInstalling.value = null
  }
 }
 // Plugin Actions
 const handleOpenPlugin = (plugin: ClientPlugin) => {
  if (!plugin.remote_port) return
  const hostname = window.location.hostname
  const url = `http://${hostname}:${plugin.remote_port}`
  window.open(url, '_blank')
 }
 const toggleClientPlugin = async (plugin: ClientPlugin) => {
  const newEnabled = !plugin.enabled
  const updatedPlugins = clientPlugins.value.map(p =>
    p.id === plugin.id ? { ...p, enabled: newEnabled } : p
  )
  try {
    await updateClient(clientId, {
      id: clientId,
      nickname: nickname.value,
      rules: rules.value,
      plugins: updatedPlugins
    })
    plugin.enabled = newEnabled
    message.success(newEnabled ? `已启用 ${plugin.name}` : `已禁用 ${plugin.name}`)
  } catch (e) {
    message.error('操作失败')
  }
 }
 // Plugin Config Modal
 const showConfigModal = ref(false)
 const configPluginName = ref('')
 const configSchema = ref<ConfigField[]>([])
 const configValues = ref<Record<string, string>>({})
 const configLoading = ref(false)
 const openConfigModal = async (plugin: ClientPlugin) => {
  configPluginName.value = plugin.name
  configLoading.value = true
  showConfigModal.value = true
  try {
    const { data } = await getClientPluginConfig(clientId, plugin.name)
    configSchema.value = data.schema || []
    configValues.value = { ...data.config }
    configSchema.value.forEach(f => {
      if (f.default && !configValues.value[f.key]) {
        configValues.value[f.key] = f.default
      }
    })
  } catch (e) {
    message.error('加载配置失败')
    showConfigModal.value = false
  } finally {
    configLoading.value = false
  }
 }
 const savePluginConfig = async () => {
   try {
    await updateClientPluginConfig(clientId, configPluginName.value, configValues.value)
    message.success('配置已保存')
    showConfigModal.value = false
    loadClient()
  } catch (e: any) {
    message.error(e.response?.data || '保存失败')
  }
 }
 // Standard Client Actions
 const confirmDelete = () => {
    dialog.warning({
@@ -597,7 +453,6 @@ const handleRestartClient = () => {
 const pollTimer = ref<number | null>(null)
 onMounted(() => {
  loadRuleSchemas()
  loadServerVersion()
  loadClient()
  // 启动自动轮询，每 5 秒刷新一次
@@ -611,39 +466,11 @@ onUnmounted(() => {
    clearInterval(pollTimer.value)
    pollTimer.value = null
  }
  if (screenshotTimer.value) {
    clearInterval(screenshotTimer.value)
    screenshotTimer.value = null
  }
 })
 // Plugin Menu
 const activePluginMenu = ref('')
 const togglePluginMenu = (pluginId: string) => {
  activePluginMenu.value = activePluginMenu.value === pluginId ? '' : pluginId
 }
 // Plugin Status Actions
 const handleStartPlugin = async (plugin: ClientPlugin) => {
    const rule = rules.value.find(r => r.type === plugin.name)
    const ruleName = rule?.name || plugin.name
    try { await startClientPlugin(clientId, plugin.id, ruleName); message.success('已启动'); plugin.running = true } catch(e:any){ message.error(e.message) }
 }
 const handleRestartPlugin = async (plugin: ClientPlugin) => {
    const rule = rules.value.find(r => r.type === plugin.name)
    const ruleName = rule?.name || plugin.name
    try { await restartClientPlugin(clientId, plugin.id, ruleName); message.success('已重启'); plugin.running = true } catch(e:any){ message.error(e.message)}
 }
 const handleStopPlugin = async (plugin: ClientPlugin) => {
    const rule = rules.value.find(r => r.type === plugin.name)
    const ruleName = rule?.name || plugin.name
    try { await stopClientPlugin(clientId, plugin.id, ruleName); message.success('已停止'); plugin.running = false } catch(e:any){ message.error(e.message)}
 }
 const handleDeletePlugin = (plugin: ClientPlugin) => {
    dialog.warning({
        title: '确认删除', content: `确定要删除插件 ${plugin.name} 吗？`,
        positiveText: '删除', negativeText: '取消',
        onPositiveClick: async () => {
             await deleteClientPlugin(clientId, plugin.id); message.success('已删除'); loadClient()
        }
    })
 }
 </script>
 <template>
@@ -737,10 +564,6 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
                <span class="mini-stat-value">{{ rules.length }}</span>
                <span class="mini-stat-label">规则数</span>
              </div>
              <div class="mini-stat">
                <span class="mini-stat-value">{{ clientPlugins.length }}</span>
                <span class="mini-stat-label">插件数</span>
              </div>
            </div>
          </div>
@@ -876,7 +699,7 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
                  <span class="rule-name">{{ rule.name }}</span>
                  <span><GlassTag :type="rule.type==='websocket'?'info':'default'">{{ (rule.type || 'tcp').toUpperCase() }}</GlassTag></span>
                  <span class="rule-mapping">
-                    {{ needsLocalAddr(rule.type||'tcp') ? `${rule.local_ip}:${rule.local_port}` : '-' }}
+                    {{ needsLocalAddr() ? `${rule.local_ip}:${rule.local_port}` : '-' }}
                    →
                    :{{ rule.remote_port }}
                  </span>
@@ -884,64 +707,14 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
                    <GlassSwitch :model-value="rule.enabled !== false" @update:model-value="(v: boolean) => { rule.enabled = v; saveRules(rules) }" size="small" />
                  </span>
                  <span class="rule-actions">
-                    <GlassTag v-if="rule.plugin_managed" type="info" title="此规则由插件管理">插件托管</GlassTag>
+                    <button class="icon-btn" @click="openEditRule(rule)">编辑</button>
-                    <template v-else>
+                    <button class="icon-btn danger" @click="handleDeleteRule(rule)">删除</button>
                      <button class="icon-btn" @click="openEditRule(rule)">编辑</button>
                      <button class="icon-btn danger" @click="handleDeleteRule(rule)">删除</button>
                    </template>
                  </span>
                </div>
              </div>
            </div>
          </div>
          <!-- Plugins Card -->
          <div class="glass-card">
            <div class="card-header">
              <h3>已安装扩展</h3>
              <button class="glass-btn small" @click="openStoreModal">
                <StorefrontOutline class="btn-icon" />
                插件商店
              </button>
            </div>
            <div class="card-body">
              <div v-if="clientPlugins.length === 0" class="empty-state">
                <p>暂无安装的扩展</p>
              </div>
              <div v-else class="plugins-list">
                <div v-for="plugin in clientPlugins" :key="plugin.id" class="plugin-item">
                  <div class="plugin-info">
                    <ExtensionPuzzleOutline class="plugin-icon" />
                    <span class="plugin-name">{{ plugin.name }}</span>
                    <span class="plugin-version">v{{ plugin.version }}</span>
                  </div>
                  <div class="plugin-meta">
                    <span>端口: {{ plugin.remote_port || '-' }}</span>
                    <GlassTag :type="plugin.running ? 'success' : 'default'" round>
                      {{ plugin.running ? '运行中' : '已停止' }}
                    </GlassTag>
                    <GlassSwitch :model-value="plugin.enabled" size="small" @update:model-value="toggleClientPlugin(plugin)" />
                  </div>
                  <div class="plugin-actions">
                    <button v-if="plugin.running && plugin.remote_port" class="icon-btn success" @click="handleOpenPlugin(plugin)">打开</button>
                    <button v-if="!plugin.running" class="icon-btn" @click="handleStartPlugin(plugin)" :disabled="!online || !plugin.enabled">启动</button>
                    <div class="dropdown-wrapper">
                      <button class="icon-btn" @click="togglePluginMenu(plugin.id)">
                        <SettingsOutline class="settings-icon" />
                      </button>
                      <div v-if="activePluginMenu === plugin.id" class="dropdown-menu">
                        <button @click="handleRestartPlugin(plugin); activePluginMenu = ''" :disabled="!plugin.running">重启</button>
                        <button @click="openConfigModal(plugin); activePluginMenu = ''">配置</button>
                        <button @click="handleStopPlugin(plugin); activePluginMenu = ''" :disabled="!plugin.running">停止</button>
                        <button class="danger" @click="handleDeletePlugin(plugin); activePluginMenu = ''">删除</button>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </div>
          <!-- Inline Log Panel -->
          <div class="glass-card">
            <InlineLogPanel :client-id="clientId" />
@@ -962,7 +735,7 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
          <option v-for="t in builtinTypes" :key="t.value" :value="t.value">{{ t.label }}</option>
        </select>
      </div>
-      <template v-if="needsLocalAddr(ruleForm.type || 'tcp')">
+      <template v-if="needsLocalAddr()">
        <div class="form-group">
          <label class="form-label">本地IP</label>
          <input v-model="ruleForm.local_ip" class="form-input" placeholder="127.0.0.1" />
@@ -976,43 +749,12 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
        <label class="form-label">远程端口</label>
        <input v-model.number="ruleForm.remote_port" type="number" class="form-input" min="1" max="65535" />
      </div>
      <template v-for="field in getExtraFields(ruleForm.type || '')" :key="field.key">
        <div class="form-group">
          <label class="form-label">{{ field.label }}</label>
          <input v-if="field.type==='string'" v-model="ruleForm.plugin_config![field.key]" class="form-input" />
          <input v-if="field.type==='password'" type="password" v-model="ruleForm.plugin_config![field.key]" class="form-input" />
          <label v-if="field.type==='bool'" class="form-toggle">
            <input type="checkbox" :checked="ruleForm.plugin_config![field.key]==='true'" @change="(e: Event) => ruleForm.plugin_config![field.key] = String((e.target as HTMLInputElement).checked)" />
            <span>启用</span>
          </label>
        </div>
      </template>
      <template #footer>
        <button class="glass-btn" @click="showRuleModal = false">取消</button>
        <button class="glass-btn primary" @click="handleRuleSubmit">保存</button>
      </template>
    </GlassModal>
    <!-- Config Modal -->
    <GlassModal :show="showConfigModal" :title="`${configPluginName} 配置`" @close="showConfigModal = false">
      <div v-if="configLoading" class="loading-state">加载中...</div>
      <template v-else>
        <div v-for="field in configSchema" :key="field.key" class="form-group">
          <label class="form-label">{{ field.label }}</label>
          <input v-if="field.type==='string'" v-model="configValues[field.key]" class="form-input" />
          <input v-if="field.type==='password'" type="password" v-model="configValues[field.key]" class="form-input" />
          <input v-if="field.type==='number'" type="number" :value="Number(configValues[field.key])" @input="(e: Event) => configValues[field.key] = (e.target as HTMLInputElement).value" class="form-input" />
          <label v-if="field.type==='bool'" class="form-toggle">
            <input type="checkbox" :checked="configValues[field.key]==='true'" @change="(e: Event) => configValues[field.key] = String((e.target as HTMLInputElement).checked)" />
            <span>启用</span>
          </label>
        </div>
      </template>
      <template #footer>
        <button class="glass-btn" @click="showConfigModal = false">取消</button>
        <button class="glass-btn primary" @click="savePluginConfig">保存</button>
      </template>
    </GlassModal>
    <!-- Rename Modal -->
    <GlassModal :show="showRenameModal" title="重命名客户端" width="400px" @close="showRenameModal = false">
@@ -1025,35 +767,6 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
        <button class="glass-btn primary" @click="saveRename">保存</button>
      </template>
    </GlassModal>
    <!-- Store Modal -->
    <GlassModal :show="showStoreModal" title="插件商店" width="600px" @close="showStoreModal = false">
      <div v-if="storeLoading" class="loading-state">加载中...</div>
      <div v-else class="store-grid">
        <div v-for="plugin in storePlugins" :key="plugin.name" class="store-plugin-card">
          <div class="store-plugin-header">
            <span class="store-plugin-name">{{ plugin.name }}</span>
            <GlassTag>v{{ plugin.version }}</GlassTag>
          </div>
          <p class="store-plugin-desc">{{ plugin.description }}</p>
          <button class="glass-btn primary small full" @click="handleInstallStorePlugin(plugin)">
            安装
          </button>
        </div>
      </div>
    </GlassModal>
    <!-- Install Config Modal -->
    <GlassModal :show="showInstallConfigModal" title="安装配置" width="400px" @close="showInstallConfigModal = false">
      <div class="form-group">
        <label class="form-label">远程端口</label>
        <input v-model.number="installRemotePort" type="number" class="form-input" min="1" max="65535" />
      </div>
      <template #footer>
        <button class="glass-btn" @click="showInstallConfigModal = false">取消</button>
        <button class="glass-btn primary" @click="confirmInstallPlugin">确认安装</button>
      </template>
    </GlassModal>
  </div>
 </template>
@@ -1481,92 +1194,6 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
  background: rgba(0, 186, 124, 0.15);
 }
 /* Plugins List */
 .plugins-list {
  display: flex;
  flex-direction: column;
  gap: 12px;
 }
 .plugin-item {
  background: var(--color-bg-elevated);
  border-radius: 10px;
  padding: 16px;
  display: flex;
  flex-direction: column;
  gap: 12px;
 }
 .plugin-info {
  display: flex;
  align-items: center;
  gap: 10px;
 }
 .plugin-name {
  font-weight: 600;
  color: var(--color-text-primary);
  font-size: 14px;
 }
 .plugin-version {
  font-size: 12px;
  color: var(--color-text-muted);
 }
 .plugin-meta {
  display: flex;
  align-items: center;
  gap: 12px;
  font-size: 12px;
  color: var(--color-text-secondary);
 }
 .plugin-actions {
  display: flex;
  gap: 8px;
  margin-top: 4px;
 }
 /* Store Plugin Card */
 .store-plugin-card {
  background: var(--color-bg-elevated);
  border-radius: 10px;
  padding: 16px;
  border: 1px solid var(--color-border-light);
 }
 .store-plugin-header {
  display: flex;
  align-items: center;
  justify-content: space-between;
  margin-bottom: 8px;
 }
 .store-plugin-name {
  font-weight: 600;
  color: var(--color-text-primary);
  font-size: 14px;
 }
 .store-plugin-desc {
  color: var(--color-text-secondary);
  font-size: 12px;
  margin: 0 0 12px 0;
  line-height: 1.5;
 }
 /* Store Grid */
 .store-grid {
  display: grid;
  grid-template-columns: repeat(2, 1fr);
  gap: 12px;
 }
@media (max-width: 500px) {
  .store-grid { grid-template-columns: 1fr; }
 }
 /* Form Styles */
 .form-group {
  margin-bottom: 16px;
@@ -1709,12 +1336,6 @@ const handleDeletePlugin = (plugin: ClientPlugin) => {
  height: 14px;
 }
 .plugin-icon {
  width: 18px;
  height: 18px;
  color: var(--color-accent);
 }
 .settings-icon {
  width: 16px;
  height: 16px;
--- a/web/src/views/ClientsView.vue
+++ b/web/src/views/ClientsView.vue
@@ -1,12 +1,16 @@
 <script setup lang="ts">
 import { ref, onMounted, computed } from 'vue'
 import { useRouter } from 'vue-router'
-import { getClients } from '../api'
+import { getClients, generateInstallCommand } from '../api'
-import type { ClientStatus } from '../types'
+import type { ClientStatus, InstallCommandResponse } from '../types'
 const router = useRouter()
 const clients = ref<ClientStatus[]>([])
 const loading = ref(true)
 const showInstallModal = ref(false)
 const installData = ref<InstallCommandResponse | null>(null)
 const installClientId = ref('')
 const generatingInstall = ref(false)
 const loadClients = async () => {
  loading.value = true
@@ -26,6 +30,29 @@ const viewClient = (id: string) => {
  router.push(`/client/${id}`)
 }
 const openInstallModal = async () => {
  installClientId.value = `client-${Date.now()}`
  generatingInstall.value = true
  try {
    const { data } = await generateInstallCommand(installClientId.value)
    installData.value = data
    showInstallModal.value = true
  } catch (e) {
    console.error('Failed to generate install command', e)
  } finally {
    generatingInstall.value = false
  }
 }
 const copyCommand = (cmd: string) => {
  navigator.clipboard.writeText(cmd)
 }
 const closeInstallModal = () => {
  showInstallModal.value = false
  installData.value = null
 }
 onMounted(loadClients)
 </script>
@@ -65,7 +92,12 @@ onMounted(loadClients)
      <div class="glass-card">
        <div class="card-header">
          <h3>客户端列表</h3>
-          <button class="glass-btn small" @click="loadClients">刷新</button>
+          <div style="display: flex; gap: 8px;">
            <button class="glass-btn small" @click="openInstallModal" :disabled="generatingInstall">
              {{ generatingInstall ? '生成中...' : '安装命令' }}
            </button>
            <button class="glass-btn small" @click="loadClients">刷新</button>
          </div>
        </div>
        <div class="card-body">
          <div v-if="loading" class="loading-state">加载中...</div>
@@ -101,6 +133,42 @@ onMounted(loadClients)
        </div>
      </div>
    </div>
    <!-- Install Command Modal -->
    <div v-if="showInstallModal" class="modal-overlay" @click="closeInstallModal">
      <div class="modal-content" @click.stop>
        <div class="modal-header">
          <h3>客户端安装命令</h3>
          <button class="close-btn" @click="closeInstallModal">×</button>
        </div>
        <div class="modal-body" v-if="installData">
          <p class="install-hint">选择您的操作系统，复制命令并在目标机器上执行：</p>
          <div class="install-section">
            <h4>Linux</h4>
            <div class="command-box">
              <code>{{ installData.commands.linux }}</code>
              <button class="copy-btn" @click="copyCommand(installData.commands.linux)">复制</button>
            </div>
          </div>
          <div class="install-section">
            <h4>macOS</h4>
            <div class="command-box">
              <code>{{ installData.commands.macos }}</code>
              <button class="copy-btn" @click="copyCommand(installData.commands.macos)">复制</button>
            </div>
          </div>
          <div class="install-section">
            <h4>Windows</h4>
            <div class="command-box">
              <code>{{ installData.commands.windows }}</code>
              <button class="copy-btn" @click="copyCommand(installData.commands.windows)">复制</button>
            </div>
          </div>
          <p class="token-info">客户端ID: <strong>{{ installClientId }}</strong></p>
          <p class="token-warning">⚠️ 此命令包含一次性token，使用后需重新生成</p>
        </div>
      </div>
    </div>
  </div>
 </template>
@@ -427,4 +495,117 @@ onMounted(loadClients)
    transform: scale(1.1);
  }
 }
 /* Install Modal */
 .modal-overlay {
  position: fixed;
  inset: 0;
  background: rgba(0, 0, 0, 0.7);
  display: flex;
  align-items: center;
  justify-content: center;
  z-index: 1000;
 }
 .modal-content {
  background: var(--glass-bg);
  backdrop-filter: blur(20px);
  border: 1px solid var(--glass-border);
  border-radius: 16px;
  max-width: 800px;
  width: 90%;
  max-height: 80vh;
  overflow-y: auto;
 }
 .modal-header {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 20px 24px;
  border-bottom: 1px solid var(--glass-border);
 }
 .modal-header h3 {
  margin: 0;
  font-size: 18px;
 }
 .close-btn {
  background: none;
  border: none;
  font-size: 28px;
  cursor: pointer;
  color: var(--color-text-secondary);
  line-height: 1;
 }
 .modal-body {
  padding: 24px;
 }
 .install-hint {
  margin-bottom: 20px;
  color: var(--color-text-secondary);
 }
 .install-section {
  margin-bottom: 20px;
 }
 .install-section h4 {
  margin: 0 0 8px 0;
  font-size: 14px;
  color: var(--color-text-primary);
 }
 .command-box {
  display: flex;
  gap: 8px;
  background: rgba(0, 0, 0, 0.3);
  padding: 12px;
  border-radius: 8px;
  border: 1px solid var(--glass-border);
 }
 .command-box code {
  flex: 1;
  font-family: monospace;
  font-size: 12px;
  word-break: break-all;
  color: var(--color-text-primary);
 }
 .copy-btn {
  background: var(--glass-bg);
  border: 1px solid var(--glass-border);
  border-radius: 6px;
  padding: 6px 12px;
  font-size: 12px;
  cursor: pointer;
  color: var(--color-text-primary);
  white-space: nowrap;
 }
 .copy-btn:hover {
  background: var(--glass-bg-hover);
 }
 .token-info {
  margin-top: 20px;
  padding: 12px;
  background: rgba(59, 130, 246, 0.1);
  border-radius: 8px;
  font-size: 13px;
 }
 .token-warning {
  margin-top: 12px;
  padding: 12px;
  background: rgba(245, 158, 11, 0.1);
  border-radius: 8px;
  font-size: 13px;
  color: #f59e0b;
 }
 </style>
Author	SHA1	Message	Date
Flik	937536e422	feat: add AGENTS.md for build commands and architecture overview All checks were successful Build Multi-Platform Binaries / build-frontend (push) Successful in 27s Details Build Multi-Platform Binaries / build-binaries (amd64, linux, client, true) (push) Successful in 1m16s Details Build Multi-Platform Binaries / build-binaries (amd64, darwin, server, false) (push) Successful in 1m34s Details Build Multi-Platform Binaries / build-binaries (amd64, windows, client, true) (push) Successful in 1m8s Details Build Multi-Platform Binaries / build-binaries (amd64, linux, server, true) (push) Successful in 1m51s Details Build Multi-Platform Binaries / build-binaries (arm, 7, linux, client, true) (push) Successful in 1m6s Details Build Multi-Platform Binaries / build-binaries (amd64, windows, server, true) (push) Successful in 1m40s Details Build Multi-Platform Binaries / build-binaries (arm64, darwin, server, false) (push) Successful in 1m44s Details Build Multi-Platform Binaries / build-binaries (arm, 7, linux, server, true) (push) Successful in 2m4s Details Build Multi-Platform Binaries / build-binaries (arm64, linux, client, true) (push) Successful in 1m3s Details Build Multi-Platform Binaries / build-binaries (arm64, linux, server, true) (push) Successful in 1m51s Details Build Multi-Platform Binaries / build-binaries (arm64, windows, server, false) (push) Successful in 1m23s Details	2026-03-17 23:54:44 +08:00
Flik	838bde28f0	refactor: remove unused code for HTTP method handling in update management Some checks failed Build Multi-Platform Binaries / build-frontend (push) Failing after 14s Details Build Multi-Platform Binaries / build-binaries (amd64, darwin, server, false) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, linux, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, linux, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, windows, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, windows, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm, 7, linux, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm, 7, linux, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, darwin, server, false) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, linux, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, linux, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, windows, server, false) (push) Has been skipped Details	2026-03-17 23:17:57 +08:00
Flik	743b91f3bf	Merge branch 'main' of https://git.92coco.cn/flik/GoTunnel Some checks failed Build Multi-Platform Binaries / build-frontend (push) Failing after 16s Details Build Multi-Platform Binaries / build-binaries (amd64, darwin, server, false) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, linux, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, linux, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, windows, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (amd64, windows, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm, 7, linux, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm, 7, linux, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, darwin, server, false) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, linux, client, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, linux, server, true) (push) Has been skipped Details Build Multi-Platform Binaries / build-binaries (arm64, windows, server, false) (push) Has been skipped Details	2026-03-17 23:16:32 +08:00
Flik	5a03d9e1f1	feat: remove unused plugin version comparison and types, refactor proxy server to support authentication - Deleted version comparison logic from `pkg/plugin/sign/version.go`. - Removed unused types and constants from `pkg/plugin/types.go`. - Updated `pkg/protocol/message.go` to remove plugin-related message types. - Enhanced `pkg/proxy/http.go` and `pkg/proxy/socks5.go` to include username/password authentication for HTTP and SOCKS5 proxies. - Modified `pkg/proxy/server.go` to pass authentication parameters to server constructors. - Added new API endpoint to generate installation commands with a token for clients. - Created database functions to manage installation tokens in `internal/server/db/install_token.go`. - Implemented the installation command generation logic in `internal/server/router/handler/install.go`. - Updated web frontend to support installation command generation and display in `web/src/views/ClientsView.vue`.	2026-03-17 23:16:30 +08:00
Flik	dcfd2f4466	chore: remove test configuration file	2026-03-17 23:16:08 +08:00
flik	f13dc2451c	删除 frps	2026-03-10 20:50:40 +08:00
flik	1c71a7633b	上传文件至「/」	2026-03-10 17:03:42 +08:00