- Drop the '+ add probe' toggle button; the add/edit form is now
always shown, resetting to a blank add state after save/cancel.
- Single nowrap row: name, host:port (flex 6), interval (flex 1),
auto-join switch, node multi-select (flex 2), select-all-nodes
button (disabled with no agent nodes), save/cancel.
- Remove the region input from the task editor (region value is
still kept in the draft and in the save payload, so editing an
existing task never wipes its region; grouping display unchanged).
- i18n: drop probeTasks.add / probeTasks.region (13 locales),
add probeTasks.selectAllNodes (13 locales, key sets in sync).
The internal/web/locale/translation/ files (en-US, fa-IR, zh-CN) are
not production data — the panel embeds internal/web/translation —
but they ARE test fixtures: locale_lazy_test.go embeds this package's
own translation/ directory (//go:embed translation) and asserts lazy
parsing against hello/greet keys in exactly these three languages.
Deleting them broke the locale package's test setup
('pattern translation: no matching files found'), which the full Go
run caught. The 'zero references' check missed the test's relative
embed pattern because it grepped for the full locale/translation path.
Restored byte-identical to 5a9c983; locale package tests pass again.
Probe settings page (settings#probe) is now a tab container with three
second-level sub-pages, following the same antd Tabs pattern the other
settings tabs use for in-section grouping, in this order:
- status: status-page settings (the former public-status-page form),
tab and heading renamed from public-status-page to status-page
settings (new pages.settings.probe.statusPageTitle key, all 13
locales);
- latency: latency probing task manager (ProbeTasksPanel), with its
batch-add module removed (see below);
- notify: notifications, moved unchanged from the public-page tab
(PublicPageTab, theme-store section) into ProbeNotifyTab.
Per-node probe metadata (ProbeMetaSection) no longer lives on the
probe settings page: it moved into the node edit dialog's
public-status-page section (NodeFormModal), where it is edited in
place per node — the component was already designed for that
embedding (own endpoints, immediate save, outside the node form).
The dialog's 'moved to probe settings' placeholder goes away with
it. The global probe settings stay where they were (status tab).
Batch-add removal (latency page): the batch card, its frontend state
and handlers (parseTargets, onBatchAdd), the POST
/panel/api/agent/probe-tasks/batch endpoint (route, form type,
handler), its dedicated TestProbeTasksBatch test, and the six
probeTasks.batch* locale keys are all deleted. The endpoint's only
production caller was the removed module; the single-task add/edit
flow, the target list and all other task endpoints are untouched.
Orphaned locale keys removed across all 13 locales (settingsTitle,
metaTitle, metaNodePlaceholder, movedHint, goSettings, plus the six
batch keys); the 13-locale key sets stay identical, enforced by the
i18n-dead-keys test. Backend APIs, setting keys, TG/webhook channel
logic and theme-store content are unchanged.
1. Drop the dormant api_tokens table on startup: initModels now runs
dropApiTokensTable (GORM Migrator, string table name since the model is
gone). No-ops on fresh databases, where AutoMigrate never creates it;
covers databases carried over from V2.7.0 whose install row was already
deleted by hand. Covered by TestDropApiTokensTable_DropsLegacyTable.
2. Delete provably dead Nord/PIA integration: service/integration/nord.go
and pia.go (+ pia_test.go), the whole internal/pia package (only pia.go
imported it), the nord/pia setting keys and getters, the HasNordSecret
view field, and the frontend model/schema fields; openapigen regenerated
(generated diff is exactly the hasNordSecret removal). Evidence: zero
production callers for NordService/PiaService, no controller routes, no
jobs, no frontend UI, no openapi exposure; panel egress is a separate
netproxy mechanism and does not consume them. maxResponseSize moves to
warp.go, which is its remaining user (it was declared in nord.go).
3. Delete unreferenced internal/web/locale/translation/ (3 files):
the runtime loads internal/web/translation (web.go embed + locale.go
disk fallback); zero references to the locale/translation path.
4. gofmt-align the AllSetting SubPort block (pre-existing drift).
5. Docs: architecture.md token table row, API-tokens troubleshooting
row, api_token.go tree entry, setting/api gateway token comments, the
mtls 'API token optional' phrase, and the integration provider list
(now warp.go only); the 4 api-tokens.mdx pages plus their meta.json
entries; the per-node apiToken prose in nodes.mdx (4 languages, title
and anchor slugs updated in pairs; frontmatter re-parsed clean).
Deliberately NOT changed: install-agent.sh RELEASE_BASE stays V2.7.0
(agent installs keep pulling from V2.7.0); install-master.sh LUI_URL
V2.7.0 -> V2.7.1 is left to the release commit; no forced first-login
password change.
Kept as live, with evidence: WARP (hourly WarpIpJob in web.go),
mtproto (live inbound protocol + sidecar manager + traffic job),
xray_version (NodeList UI fallback when singboxVersion is absent),
session.apiAuthUserKey (spa_test login simulation + GetLoginUser
production fast path).
The public page is an SPA: browsers show the theme package's static
<title> on first paint (a CFSM-era package still says
CF-Server-Monitor) and only switch to the configured title once the
theme JS fetches /api/me. Serve the configured title in the shell
itself so the first paint is already correct.
serveProbeThemeFile now rewrites the first <title> of index.html
with the site_name probe setting — the same setting /api/me's
site_name comes from, so the injected title and the JS rewrite can
never disagree. Theme files on disk are untouched, so any upstream
theme package works unmodified. With no site name configured the
bytes pass through unchanged (no empty title injected). The title
is HTML-escaped and spliced in place, so a $ in the title is safe.
Caching is unchanged and already correct: index.html is served
no-cache with a strong ETag over the final (injected) bytes, so a
title change lands on the next revalidation; hashed assets stay
immutable and pass through byte-identical.
Delete the whole ApiToken stack from the panel: the api_tokens table
model and seed/migrate/normalize paths, the Bearer auth and
admin/monitor scope chain in the panel API (session login is now the
only panel API credential), the settings token-management endpoints,
the CLI -getApiToken bootstrap command, and the SecurityTab token
management UI plus its models/schemas/i18n keys. Regenerate the
frontend OpenAPI files (31 -> 26 schemas).
Agent side untouched: agent runtime, agent version (A2.6.0),
install-agent.sh, subscription/probe paths and node behavior are
unchanged. The /panel/api/agent group never went through checkAPIAuth
and is unaffected.
Also drop provably dead weight found in the same pass: the unimported
internal/xray/geodata package and its generated schemas, the retired
SPA shell routes (/groups, /xray, /outbound, /routing, /api-docs;
unregistered paths still reach the shell via the NoRoute fallback),
the never-set SettingController.xrayService field, and the CSRF
api_authed exemption whose only setter was the deleted Bearer branch.
Deliberately NOT dropped: the api_tokens table itself (left dormant
and empty in existing databases; a DROP migration needs a separate
decision) and the session apiAuthUserKey helper (test-only use remains).
Agent code changed in the rename batch (lui-agent binary, LUI_ env prefix, /etc/l-ui paths and services), so the agent line moves 2.5.0 -> 2.6.0 and its default-expectation tests move with it; panel version is injected at build time (V2.7.0). install-agent.sh RELEASE_BASE and install-master.sh LUI_URL move V2.6.0 -> V2.7.0. Repo name settled as rogue/l-ui (user decision 2026-10-24); the rename-batch placeholder warnings in docs/release.md, selfupdate.go and install-master.sh are closed by the Gitea rename that precedes publishing this release.
NodeView gains agentOs from AgentNode.ProbeOS (overlaid ahead of
the telemetry early-exit, like ProbeOnly). NodeList gates both
badge sites (list column + detail) on !isWindowsAgentOS(agentOs).
Backend requestAgentUpdate refuses Windows rows up front instead
of recording an intent that would only age out.
ProbeOS is reliable here: the frozen A2.2.1 Windows agent reports
probeFacts.os 'Windows 10' on register and heartbeat (see the
legacy-Windows contract test) and the panel persists it to
probe_os. Empty ProbeOS fails open on both sides. No fake
version, no per-node freeze switch, no Windows agent change, no
new win asset. The one-click action button itself is unchanged;
clicking it on a Windows row now errors clearly instead of
recording a dangling intent.
- i18n dead-keys: delete 64 keys unreferenced in frontend/Go sources
(menu donate/docs, old index config actions, the whole removed
traditional-node/mTLS node form incl. its mtls subtree, xray
Outbounds/Balancers) from all 13 locales; 1536 -> 1472 keys each.
Verified repo-wide: only stale prebuilt binaries still embed them.
- probe TestMetricHistoryMinuteFold: replace wall-clock base with a
fixed 120 s-aligned instant; an odd-minute base split the 120 s fold
into two buckets (want 1, got 2) on ~half of all runs.
Deleting a panel node left its agent_nodes rows and probe.db rows
behind, so deleted nodes kept showing as ghosts and their probe
latency stayed attributed to leftover rows (TYYUN case). Delete now
removes agent rows bound by agent_nodes.node_id inside the existing
panel transaction, then drops each agent's probe rows (meta, traffic,
both history tiers, ping records and ping assignments) and the
public-page snapshot. Agents link by node_id, probe rows by agent row
id: matching probe rows on the node id would strike another node's
data (Oracle-JP: node 33, agent row 20).
Agent posts an empty beacon over a tcp4-forced connection every
5 minutes (plus once at startup); panel files the observed source
as SeenIPv4 only when it is a public IPv4 literal, never touching
the reported telemetry address, so 1:1 NAT nodes stop falling back
to their private address in share links.
After an agent restart the tracked sing-box handle is lost while
the old core survives reparented holding the inbound ports, so
every apply died on bind, rollback died the same way, and the
agent retried forever. startSingboxLocked now scans /proc for
processes whose argv carries run -c <exact live config path>
(excluding the tracked pid) and stops them SIGTERM-then-SIGKILL
before starting, covering the apply, rollback, and
unchanged-but-not-running paths. The exact-path match never
touches cores on other config files; Linux only.
Agent display version now comes from the agent line's own source
(config.agentDisplayVersion injection + defaultAgentDisplayVersion
constant, currently A2.3.0) instead of being derived from the panel's
displayVersion. Masters resolve the agent line's latest from each
release's agent-version.txt marker (selfupdate.ResolveLatestAgentTarget,
legacy tag derivation as fallback for pre-marker releases): update
intents target the marker under the panel tag, panel-only releases
produce no intent, and the nodes page badges agent rows against
their own line via PanelUpdateInfo.displayLatestAgentVersion.
Windows agent frozen at A2.2.1: release discipline in docs/release.md
+ scripts/release-build.sh (agent assets reused verbatim when the
agent code is unchanged, marker always emitted, no Windows exe),
install-agent.ps1 pinned at V2.4.0, and the A2.2.1 protocol shapes
locked by TestAgentLegacyWindows221Contract.
Agent update tests now derive their targets from the live agent
line instead of a hardcoded A2.0.x the line has passed.
country/country_auto in buildProbeNodeView now come from a local
MMDB lookup of the node's public address (held v4, held v6, seen
v4, seen v6) instead of the pin alone / a hardcoded empty string.
Layered data: local file in the data folder wins, embedded factory
snapshot is the fallback, no database means the pre-flag empty
shape. A weekly job conditionally downloads a fresher copy,
validates it, atomically replaces the local file and hot-swaps the
reader; no URL configured (geoipCountryDefaultURL / the
geoip_country_url setting) means the updater stays silent. No
address ever leaves the master.
New entry cmd/xui-agent links only the agent dependency closure
(internal/agent + config/logger/selfupdate/xray/util leaves), a
drop-in replacement for the dual-mode binary's agent subcommand:
same invocation (xui-agent agent -config ...), same agent.json and
state files, same wire protocol.
selfupdate gains AgentAssetName (x-ui-agent-linux-<arch>); the
agent's one-click update now downloads the agent asset instead of
the panel binary. Pre-split agents keep fetching the panel asset —
the two forms are interchangeable at the install path.
buildProbeNodeView now sources its 'name' from probeDisplayName:
the node's public remark (probe_meta.public_remark) when non-empty
after trimming, else the node name as before. Contract field name
unchanged, theme packages untouched, both audiences (anonymous and
admin frames share the builder); the panel's internal node list is
a different surface and keeps the plain node name.
Tests: display-name unit cases (remark / empty / whitespace) and
view-level assertions for both audiences; the public contract
test's seeded expectation updated to the remark (its fixture sets
public_remark='shown publicly' on node 'PubNode').
Unit unification: GB entries converted at 1e9 while every byte
formatter is binary (1024^3), so a 3000 GB limit rendered 2.73 TB
instead of 2.93 TB. calBytes and the form's limit conversion now
use 1024^3. Stored traffic_limits (bytes, typed x1e9) are rescaled
x1.073741824 exactly once at store open, guarded by the
probe_setting mark gb_1024_migrated_v1; calibration values are
stored in GB (no rescale — only their conversion changed) and
price/sort/reset-day are unitless.
One-shot calibration: the form's cal fields are deltas to apply
now. probe.MergeCalDelta folds a non-zero submitted value into the
stored standing correction and keeps the standing value on a
zero/absent submission; putMeta merges against the stored row
(SaveMeta/UpsertMeta keep plain replace — the notify sweep relies
on it). GET no longer echoes the standing correction into the form,
and the frontend keeps the cal inputs as local state that starts
empty and clears on successful save, so a later unrelated save
resubmits nothing.
Tests: calBytes(3000)=3000x2^30; migration 3.0e12 -> 3000x2^30 with
no second rescale on reopen; one-shot flow (save delta, save
unrelated with zero cal -> calibrated traffic unmoved, second delta
accumulates once). Existing TestTrafficCalibrationAppliedAndFloored
expectation updated to the binary figure. No vitest covers
ProbeMetaSection (disclosed in the report).
displayUpdateFields returned avail=false whenever the running
build's display version could not be compared (the VV2.1.0
double-letter builds), so the panel swallowed a real update prompt
and the native updater refused to run. displayUpdateFieldsFor now
takes the current display/raw versions as inputs and, when the
display comparison cannot judge, compares the latest tag against
the raw base version with the same tolerant display parser —
unparseable raw base yields false. (Not isNewerVersion: on this
fork's uppercase-V tags it degrades to string inequality, which
would phantom-report an update on form difference alone.)
Parseable display versions keep the segment rule untouched.
Regression tests cover the VV scenario in both raw forms.
NodeService.Probe now checks for a bound agent first: agent-managed
nodes synthesize the result from agent_nodes.last_seen (MAX over
bound agents, ms) — fresh within the same 180s window the heartbeat
job expires by = online with the heartbeat age as latency; stale or
never-seen = offline with LatencyMs -1. No dial, and LastError is
never written for agent nodes (the stored dial error from the
placeholder address https://agent:2053 is also healed on next ⚡,
since the synthesized patch carries an empty error through
UpdateHeartbeat). Traditional-node dial path unchanged; verdict is a
pure function with unit tests.
Frontend: the ⚡ tooltip/menu used t('pages.nodes.probe'), which
since the probe-metadata work resolves to the status-page SECTION
object, so i18next fell back to rendering the raw key. The existing
pages.nodes.testConnection key (present in all 13 locales) is the
right label — point the three usages at it. No new i18n keys.
LazyProc.Call must-finds and panics on a missing export; the trimmed
Tianyi cloud-PC image has no FreeMibIfTable2 in iphlpapi.dll, which
killed the agent on its first collection after a successful register.
Optional procs (GetSystemTimes/GlobalMemoryStatusEx/GetIfTable2Ex+
FreeMibIfTable2 as one gated pair) now resolve through sourceGate
(Find once, missing = source disabled with one warning); the iface
pair is gated together so a missing free proc never leaks the
system table. collectMetrics additionally runs every source through
guardedCall so any residual panic zeroes that source alone.
Pure gate/guard logic lives in probe_guard.go (no build tag) with
Linux-runnable regression tests.
Scope B (Windows agent):
- probe.go split into shared core + probe_linux.go (verbatim Linux
sampler, build-tagged) + probe_windows.go (Win32 sampler: GetSystemTimes
CPU diff, GlobalMemoryStatusEx, fixed-drive df totals, GetIfTable2
counted set, MachineGuid boot identity, registry facts; load and
TCP/UDP counts stay zero - x/sys v0.47.0 exports no wrapper)
- update intents are acknowledged and skipped on Windows (the release
assets are Linux binaries; Windows nodes update via install-agent.ps1)
- cmd/xui-agent-windows: SCM service host (svc.Run + mgr install/
uninstall/start/stop) mirroring main.go's agent lifecycle wiring
- install-agent.ps1: downloads the exe, writes probeOnly agent.json,
registers and starts the service, rerun-safe
Scope C (version display):
- config.GetAgentDisplayVersion (and the master getter) compose from
the bare number so a V-form injection no longer doubles the letter
(AV2.1.0 -> A2.1.0)
- node list view repairs stored AV-prefixed reports at assembly so
deployed agents read uniformly without an update
Scope D (production fix):
- share-link reality sni: when the inbound has a sing-box fragment,
sni is the fragment's tls.server_name - the only name the sing-box
REALITY server serves. The previous rule picked a uniformly random
serverNames entry per generation, which xray tolerated but sing-box
refuses as an invalid connection. sid keeps its random pick: the
converter carries the whole shortIds list into the fragment, so
every listed sid is served.
agent_nodes gains probe_only; getConfig always serves the flag and withholds the sing-box payload (null config, empty hash) for flagged nodes while probe tasks, fast interval, stat iface and update intents ride as usual. The agent gates both core branches when the local agent.json preset or the master flag is on, retires a running core once (best-effort tail flush, switchover bookkeeping untouched so turning the flag off self-heals through the existing hash-current-but-not-running path), and makes the traffic cycle an explicit no-op. Panel: node create/update accept probeOnly, the node view overlays it from the binding, the node form gains a switch (carried into the generated install command), the list shows a probe-only tag in the core-version cell, and install-agent.sh --probe-only writes the preset, skips the core download/self-check and inherits the flag on no-arg reruns.
- 0: sing-box gen overrides fragment listen/port from the inbound row
(empty listen -> "::"), Update/Add recompute the stored fragment;
non-loopback E2E against the real core binary.
- 1: agent fetches the sing-box core from the Gitea release when
missing, self-checks it, and only then latches the switch.
- 2: node list shows the sing-box core version (heartbeat field,
persisted on the node row), xray version as fallback.
- 3: public-page fallback returns 404 to anonymous visitors when the
page is disabled.
- 4: settings restart hint bar removed, dead i18n keys cleaned.
- 5: two PUT calls missing JSON headers fixed (audit: only those two),
batch probe-task creation endpoint + UI.
- 6: cf-probe retirement card and coverage pipeline removed.
- 7: generated vless links no longer carry spx (panel export + sub);
parser still accepts spx; golden fixtures updated.
- probe batch: dedicated probe settings tab (public-page settings,
tasks, per-node meta), retention_days editable, per-node traffic
calibration + stat-interface pinning, runtime metrics split into a
lightweight fast report (default 3s, 1-60s adjustable).
- 8: sing-box core processes start with GOMEMLIMIT=32MiB, GOGC=50.
- 9: dead /getTwoFactorEnable docs entries removed (frontend call and
contract entry already gone at base; verified by grep).
Muse