probe-only node mode: master flag + agent gate + panel switch (V2.1.0 A)

agent_nodes gains probe_only; getConfig always serves the flag and withholds the sing-box payload (null config, empty hash) for flagged nodes while probe tasks, fast interval, stat iface and update intents ride as usual. The agent gates both core branches when the local agent.json preset or the master flag is on, retires a running core once (best-effort tail flush, switchover bookkeeping untouched so turning the flag off self-heals through the existing hash-current-but-not-running path), and makes the traffic cycle an explicit no-op. Panel: node create/update accept probeOnly, the node view overlays it from the binding, the node form gains a switch (carried into the generated install command), the list shows a probe-only tag in the core-version cell, and install-agent.sh --probe-only writes the preset, skips the core download/self-check and inherits the flag on no-arg reruns.

frontend/src/pages/nodes/NodeFormModal.tsx

@@ -50,6 +50,7 @@ function defaultValues(): NodeFormValues {
     basePath: '/',
     apiToken: '',
     hasStoredToken: false,
+    probeOnly: false,
     enable: true,
     allowPrivateAddress: false,
     tlsVerifyMode: 'verify',
@@ -83,6 +84,9 @@ export default function NodeFormModal({
   const [testResult, setTestResult] = useState<ProbeResult | null>(null);
   const [agentToken, setAgentToken] = useState<string | null>(null);
   const [agentNodeName, setAgentNodeName] = useState('');
+  // Whether the just-created agent node was flagged probe-only, so the
+  // install command below can carry the matching --probe-only flag.
+  const [agentProbeOnly, setAgentProbeOnly] = useState(false);
   const [agentMasterUrl, setAgentMasterUrl] = useState('');
   // Edit mode (item 19): the stored install material for an existing agent
   // node, fetched from the master; null until loaded / for non-agent nodes.
@@ -100,6 +104,7 @@ export default function NodeFormModal({
   const inboundSyncMode = useWatch({ control: methods.control, name: 'inboundSyncMode' }) ?? 'all';
   const nodeType = useWatch({ control: methods.control, name: 'nodeType' }) ?? 'traditional';
   const isAgent = nodeType === 'agent';
+  const probeOnly = useWatch({ control: methods.control, name: 'probeOnly' }) ?? false;
   const { data: outboundGroups } = useOutboundTagGroups({ excludeBlackhole: true });
 
   // Outbounds and balancers share one picker (like the panel-outbound selector);
@@ -178,10 +183,13 @@ export default function NodeFormModal({
     const base =
       `bash <(curl -fL https://git.881218.xyz/rogue/3x-ui-agent/raw/branch/main/install-agent.sh)` +
       ` --master ${editMasterUrl}`;
-    return shownInstall.hasToken
+    const cmd = shownInstall.hasToken
       ? `${base} --token ${shownInstall.token} --name ${shownInstall.name}`
       : `${base} --name ${shownInstall.name}`;
-  }, [shownInstall, editMasterUrl]);
+    // The toggle is the source of truth for the re-displayed command:
+    // flipping it rewrites the command the operator would re-run.
+    return probeOnly ? `${cmd} --probe-only` : cmd;
+  }, [shownInstall, editMasterUrl, probeOnly]);
 
   const title = useMemo(
     () => (mode === 'edit' ? t('pages.nodes.editNode') : t('pages.nodes.addNode')),
@@ -211,6 +219,9 @@ export default function NodeFormModal({
       inboundTags: values.inboundSyncMode === 'selected' ? values.inboundTags : [],
       outboundTag: values.outboundTag || '',
     };
+    // Probe-only (V2.1.0) is an agent-node concept; traditional
+    // payloads stay byte-identical to before.
+    if (agentMode) payload.probeOnly = values.probeOnly ?? false;
     if (token) payload.apiToken = token;
     return payload;
   }
@@ -296,6 +307,7 @@ export default function NodeFormModal({
         if (agentMode && mode === 'add' && obj?.agentToken) {
           setAgentToken(obj.agentToken);
           setAgentNodeName(result.data.name.trim());
+          setAgentProbeOnly(result.data.probeOnly ?? false);
           // Default the master URL to the address this panel is being
           // viewed through — origin AND base path. Dropping the base
           // path made the agent's registration 404. User can edit it.
@@ -318,7 +330,7 @@ export default function NodeFormModal({
   // one would produce a command that can never register, so withhold it
   // (and say why) instead of letting the user copy a dead command.
   const installCmd = agentMasterUrl
-    ? `bash <(curl -fL https://git.881218.xyz/rogue/3x-ui-agent/raw/branch/main/install-agent.sh) --master ${agentMasterUrl} --token ${agentToken ?? ''} --name ${agentNodeName}`
+    ? `bash <(curl -fL https://git.881218.xyz/rogue/3x-ui-agent/raw/branch/main/install-agent.sh) --master ${agentMasterUrl} --token ${agentToken ?? ''} --name ${agentNodeName}${agentProbeOnly ? ' --probe-only' : ''}`
     : '';
 
   return (
@@ -430,11 +442,21 @@ export default function NodeFormModal({
             )}
             {isAgent && (
               <Row gutter={16}>
-                <Col xs={24}>
+                <Col xs={24} md={12}>
                   <FormField label={t('pages.nodes.enable')} name="enable" valueProp="checked">
                     <Switch />
                   </FormField>
                 </Col>
+                <Col xs={24} md={12}>
+                  <FormField
+                    label={t('pages.nodes.probeOnly')}
+                    name="probeOnly"
+                    valueProp="checked"
+                    tooltip={t('pages.nodes.probeOnlyHint')}
+                  >
+                    <Switch />
+                  </FormField>
+                </Col>
               </Row>
             )}
 

frontend/src/pages/nodes/NodeList.tsx

@@ -495,12 +495,20 @@ export default function NodeList({
       {
         // Core version (V2.0.1 ②): agent rows run sing-box and show
         // its version; traditional rows keep showing the xray one.
+        // Probe-only agent rows (V2.1.0) run no core by design: the
+        // cell says so instead of a bare '-', which reads as a fault.
         title: t('pages.nodes.coreVersion'),
         dataIndex: 'xrayVersion',
         align: 'center',
         render: (_value, record) =>
           record.nodeType === 'agent'
-            ? record.singboxVersion || record.xrayVersion || '-'
+            ? record.probeOnly
+              ? (
+                  <Tag color="cyan" style={{ margin: 0 }}>
+                    {t('pages.nodes.probeOnly')}
+                  </Tag>
+                )
+              : record.singboxVersion || record.xrayVersion || '-'
             : record.xrayVersion || '-',
       },
       {

frontend/src/schemas/node.ts

@@ -56,6 +56,9 @@ export const NodeRecordSchema = z
     // P7: node kind, annotated by the backend for nodes registered by an
     // agent. Absent/traditional for classic panel-to-panel nodes.
     nodeType: z.enum(['traditional', 'agent']).optional(),
+    // V2.1.0: probe-only agent nodes run no core, only the probe
+    // channels. Annotated by the backend from the bound agent row.
+    probeOnly: z.boolean().optional(),
     // P13: host IPv4/IPv6 an agent reports with its heartbeat telemetry.
     // Rendered as plain text in the address column for agent rows.
     ipv4: z.string().optional(),
@@ -101,6 +104,8 @@ export const NodeFormSchema = z
     // Agent nodes use an agent token instead of a panel API token.
     apiToken: z.string().trim(),
     hasStoredToken: z.boolean().optional().default(false),
+    // V2.1.0: probe-only toggle for agent nodes (see NodeRecordSchema).
+    probeOnly: z.boolean().optional().default(false),
     enable: z.boolean(),
     allowPrivateAddress: z.boolean(),
     tlsVerifyMode: z.enum(['verify', 'skip', 'pin', 'mtls']),