feat: 通道组并入「添加通道」表单，不再单独新建

- 去掉单独的「新建通道组」入口：添加通道表单的目标可以一次填多个
  （10.0.1.11-13:22、10.0.1.11:8080-8082、逗号分隔），预览每个地址分到的连续端口
- 表单新增「通道组」选项：不分组 / 新建通道组 / 已有组；多个目标自动放进新建的组，
  组名默认与通道名称相同；加入组时名称可不填，按「组名 (主机)」命名
- 闲置关闭、最长时长、限速、访问控制、责任人等设置对每个地址都生效，与单个通道一致
- 编辑通道时可以新建通道组并移入；组卡片上「添加地址」打开同一个表单并选好该组
- 编辑通道组只负责改名、责任人和加入已有通道
- 多个目标的连通性测试并发进行并汇总结果；网页表单补上责任人与限速
- 接口：POST /api/tunnels/batch（dry_run 预览、group_id / new_group），
  PUT /api/tunnels/{id} 支持 new_group；移除 /api/groups/preview 及组接口里的批量建通道

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/release-notes.md

@@ -1,33 +0,0 @@
-
-## 下载 · Downloads
-
-### 客户端 · Client
-
-装在能访问内网服务的电脑上，用来创建通道、邀请同事。
-Install it on a machine that can reach your internal services.
-
-| 平台 Platform | 文件 File |
-| --- | --- |
-| macOS（Apple Silicon / Intel） | [PortRelay-{{VERSION}}.dmg]({{DOWNLOAD}}/PortRelay-{{VERSION}}.dmg) |
-| Linux x86_64 | [portrelay-agent-{{VERSION}}-linux-amd64.tar.gz]({{DOWNLOAD}}/portrelay-agent-{{VERSION}}-linux-amd64.tar.gz) |
-| Linux ARM64 | [portrelay-agent-{{VERSION}}-linux-arm64.tar.gz]({{DOWNLOAD}}/portrelay-agent-{{VERSION}}-linux-arm64.tar.gz) |
-| Windows x86_64 | [portrelay-agent-{{VERSION}}-windows-amd64.zip]({{DOWNLOAD}}/portrelay-agent-{{VERSION}}-windows-amd64.zip) |
-
-macOS 是菜单栏 App：打开 dmg，把 PortRelay 拖进「应用程序」。App 未经 Apple 公证，首次打开请在 Finder 里右键选择「打开」。Linux / Windows 是命令行 Agent，运行后在浏览器里打开管理面板。
-On macOS, open the dmg and drag PortRelay to Applications. The app is not notarized, so right-click it and choose Open the first time. On Linux and Windows, run the agent and use the web panel it opens.
-
-### 服务端 · Server (edge gateway)
-
-部署在同事和客户端都能连到的 Linux 机器上。
-Deploy it on a Linux host that both teammates and the client can reach.
-
-| 方式 Method | 文件 File |
-| --- | --- |
-| 二进制 + systemd · x86_64 | [portrelay-server-{{VERSION}}-linux-amd64.tar.gz]({{DOWNLOAD}}/portrelay-server-{{VERSION}}-linux-amd64.tar.gz) |
-| 二进制 + systemd · ARM64 | [portrelay-server-{{VERSION}}-linux-arm64.tar.gz]({{DOWNLOAD}}/portrelay-server-{{VERSION}}-linux-arm64.tar.gz) |
-| Docker | `{{IMAGE}}:{{VERSION}}` |
-
-解压后运行 `sudo ./deploy/install-server.sh ./portrelay-server`，再次运行即可升级。
-Unpack and run `sudo ./deploy/install-server.sh ./portrelay-server`; run it again to upgrade.
-
-校验文件 Checksums：`SHA256SUMS`

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   binaries:
-    name: Server & agent archives
+    name: Server & agent binaries
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -31,22 +31,24 @@ jobs:
             dist/*.zip
 
   macos-app:
-    name: macOS app (dmg)
+    name: macOS app
     runs-on: macos-15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - name: Build universal dmg
+      - name: Build universal app
         run: |
           VERSION=${GITHUB_REF_NAME#v}
           case "$VERSION" in [0-9]*) ;; *) VERSION=0.0.0-${GITHUB_SHA::7} ;; esac
-          UNIVERSAL=1 make dmg VERSION=$VERSION
+          UNIVERSAL=1 VERSION=$VERSION ./build-app.sh
+          mkdir -p dist
+          ditto -c -k --sequesterRsrc --keepParent PortRelay.app "dist/PortRelay-$VERSION-macos-universal.zip"
       - uses: actions/upload-artifact@v4
         with:
           name: macos-app
-          path: dist/*.dmg
+          path: dist/*.zip
 
   docker:
     name: Docker image
@@ -86,32 +88,13 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/checkout@v4
-      # 只取安装包；docker 任务还会上传构建记录，不能一并下载
       - uses: actions/download-artifact@v4
         with:
-          name: binaries
-          path: dist
-      - uses: actions/download-artifact@v4
-        with:
-          name: macos-app
           path: dist
+          merge-multiple: true
       - name: Checksums
         run: cd dist && sha256sum * > SHA256SUMS
-      # 说明 = 标签注释正文（本次更新）+ 下载说明（区分客户端与服务端）+ 自动生成的变更列表
-      - name: Release notes
-        run: |
-          git fetch --force origin "refs/tags/$GITHUB_REF_NAME:refs/tags/$GITHUB_REF_NAME"
-          body=$(git tag -l --format='%(contents:body)' "$GITHUB_REF_NAME")
-          {
-            if [ -n "$body" ]; then printf "## 本次更新 · What's new\n\n%s\n\n" "$body"; fi
-            sed -e "s|{{VERSION}}|${GITHUB_REF_NAME#v}|g" \
-                -e "s|{{DOWNLOAD}}|https://github.com/$GITHUB_REPOSITORY/releases/download/$GITHUB_REF_NAME|g" \
-                -e "s|{{IMAGE}}|ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/portrelay-server|g" \
-                .github/release-notes.md
-          } > "$RUNNER_TEMP/notes.md"
-          cat "$RUNNER_TEMP/notes.md"
       - name: Create release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --notes-file "$RUNNER_TEMP/notes.md" --generate-notes
+        run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --generate-notes

Makefile

@@ -3,21 +3,16 @@
 #   make server      交叉编译 Linux 服务端到 dist/
 #   make agent       编译当前平台的 Agent 到 bin/
 #   make app         构建 macOS 应用 PortRelay.app（需要 Xcode 命令行工具）
-#   make install-app 构建并替换 /Applications/PortRelay.app（正在运行的会先退出，装好后重新打开）
+#   make release     打包所有平台的服务端 / Agent 到 dist/
-#   make dmg         打包 macOS 安装镜像 dist/PortRelay-<版本>.dmg（UNIVERSAL=1 构建通用版本）
-#   make release     打包服务端（Linux）与命令行 Agent（Linux / Windows）到 dist/
 #   make snapshots   离屏渲染 App 界面截图（tools/ui-snapshots/out）
-#   make readme-images 重新生成 README 的全部截图和动图到 docs/images（需要 Google Chrome）
 
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null | sed 's/^v//' || echo dev)
 LDFLAGS := -s -w -X main.version=$(VERSION)
 GOBUILD := CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)"
 
-# 服务端只发布 Linux 版本；macOS 用户用 App，其余平台用命令行 Agent
+PLATFORMS := linux/amd64 linux/arm64 darwin/arm64 darwin/amd64 windows/amd64
-SERVER_PLATFORMS := linux/amd64 linux/arm64
-AGENT_PLATFORMS := linux/amd64 linux/arm64 windows/amd64
 
-.PHONY: all test fmt server agent app install-app dmg release snapshots readme-images clean
+.PHONY: all test fmt server agent app release snapshots clean
 
 all: test agent
 
@@ -39,50 +34,24 @@ agent:
 app:
 	VERSION=$(VERSION) ./build-app.sh
 
-# 正常退出正在运行的 App（会一并停止后台引擎）后替换，装好后按原状态重新打开
-install-app: app
-	@running=; \
-	if pgrep -f /Applications/PortRelay.app/ >/dev/null; then \
-		running=1; osascript -e 'quit app "PortRelay"' >/dev/null; \
-		for i in $$(seq 1 30); do pgrep -f /Applications/PortRelay.app/ >/dev/null || break; sleep 0.5; done; \
-		if pgrep -f /Applications/PortRelay.app/ >/dev/null; then echo "PortRelay 未能退出，已放弃替换"; exit 1; fi; \
-	fi; \
-	rm -rf /Applications/PortRelay.app && ditto PortRelay.app /Applications/PortRelay.app && rm -rf PortRelay.app; \
-	echo "✓ 已安装 /Applications/PortRelay.app ($(VERSION))"; \
-	if [ -n "$$running" ]; then open /Applications/PortRelay.app; fi
-
-# 安装镜像：PortRelay.app 和「应用程序」的快捷方式，打开后拖进去即可
-dmg: app
-	@rm -rf build/dmg && mkdir -p build/dmg dist
-	ditto PortRelay.app build/dmg/PortRelay.app && rm -rf PortRelay.app
-	ln -s /Applications build/dmg/Applications
-	hdiutil create -volname PortRelay -srcfolder build/dmg -fs HFS+ -format UDZO -ov dist/PortRelay-$(VERSION).dmg
-	@rm -rf build/dmg
-
-# 服务端：portrelay-server-<版本>-linux-<架构>.tar.gz（含 deploy/ 安装脚本）
-# 客户端：portrelay-agent-<版本>-<系统>-<架构>.tar.gz / .zip
 release:
-	@rm -rf dist/portrelay-* dist/SHA256SUMS && mkdir -p dist
+	@rm -rf dist && mkdir -p dist
-	@pack() { \
+	@for p in $(PLATFORMS); do \
-		cmd=$$1; os=$$2; arch=$$3; ext=; [ $$os = windows ] && ext=.exe; \
+		os=$${p%/*}; arch=$${p#*/}; ext=; [ $$os = windows ] && ext=.exe; \
-		name=$$cmd-$(VERSION)-$$os-$$arch; mkdir -p dist/$$name; \
+		name=portrelay-$(VERSION)-$$os-$$arch; mkdir -p dist/$$name; \
 		echo "==> $$name"; \
-		GOOS=$$os GOARCH=$$arch $(GOBUILD) -o dist/$$name/$$cmd$$ext ./cmd/$$cmd || return 1; \
+		GOOS=$$os GOARCH=$$arch $(GOBUILD) -o dist/$$name/portrelay-server$$ext ./cmd/portrelay-server || exit 1; \
+		GOOS=$$os GOARCH=$$arch $(GOBUILD) -o dist/$$name/portrelay-agent$$ext ./cmd/portrelay-agent || exit 1; \
 		cp LICENSE README.md README_EN.md dist/$$name/; \
-		if [ $$cmd = portrelay-server ]; then cp -R deploy dist/$$name/; fi; \
+		if [ $$os = linux ]; then cp -R deploy dist/$$name/; fi; \
 		if [ $$os = windows ]; then (cd dist && zip -qr $$name.zip $$name); \
 		else tar -C dist -czf dist/$$name.tar.gz $$name; fi; \
 		rm -rf dist/$$name; \
-	}; \
+	done
-	for p in $(SERVER_PLATFORMS); do pack portrelay-server $${p%/*} $${p#*/} || exit 1; done; \
-	for p in $(AGENT_PLATFORMS); do pack portrelay-agent $${p%/*} $${p#*/} || exit 1; done
 	@cd dist && shasum -a 256 * > SHA256SUMS && cat SHA256SUMS
 
 snapshots:
 	tools/ui-snapshots/render.sh
 
-readme-images:
-	tools/ui-snapshots/readme.sh
-
 clean:
 	rm -rf bin build dist PortRelay.app mac-native/PortRelay tools/ui-snapshots/.build tools/ui-snapshots/out

README.md

@@ -51,18 +51,17 @@ PortRelay 把这件事变成三步：
 **访问控制**
 
 - 三种访问方式：**仅授权链接**（默认，最安全）、IP / 网段白名单（可与授权链接叠加），以及全部放通。
-- 邀请链接可以设置链接有效期、可用设备数、授权后可访问时长（30 分钟、1 小时、2 小时、8 小时、当天有效、通道开启期间，或自定义），以及是否需要审批。
+- 邀请链接可以设置链接有效期、可用设备数、授权后可访问时长（1 小时、2 小时、8 小时、当天有效，或直到通道关闭），以及是否需要审批。
 - 需要审批时，App 会弹出系统通知，一键批准或拒绝；访问者的页面会自动刷新结果。
 - **计时从首次连接开始**：同事拿到授权后不用急着连，开始用的时候才开始计时。
 - 授权到期或被撤销后，**已建立的连接也会立刻断开**；未授权的连接直接被重置（TCP RST）并留下拦截记录。
-- **申请延长**：同事重新打开原来的邀请链接，点「申请延长」，你在 App、菜单栏或网页面板里选好延长多久即可批准。授权还没到期时，从原到期时间往后顺延；已经结束的从批准时算起，结束后 2 小时内都能申请，通道关了也没关系，批准后会自动重新开启。被撤销的授权不能延长。你也可以主动给已授权或刚结束的设备延长。
+- **通道组**：添加通道时目标可以一次填多个（例如 `10.0.1.11-13:22, 10.0.1.11:8080`），每个地址一个通道，自动分配一段连续端口，并放进同一个通道组。组内地址共用一条邀请链接和同一份授权：同事授权一次即可访问整组，撤销一次全组断开。
-- **通道组**：添加通道时目标是一个列表，每行一台主机、多个端口用逗号隔开（也可以直接粘贴一串 IP），每个地址一个通道，自动分配一段连续端口，并放进同一个通道组。组内地址共用一条邀请链接和同一份授权：同事授权一次即可访问整组，撤销一次全组断开。
 
 **通道生命周期**
 
 - **闲置自动关闭**：没有连接、没有有效授权、没有待处理申请，也没有还能使用的邀请链接时开始计时，默认 30 分钟后关闭。
-- 可选的**最长开启时长**，到点无论是否在用都关闭。批准延长时，如果新的授权到期时间更晚，通道会开到授权结束。
+- 可选的**最长开启时长**，到点无论是否在用都关闭。
-- 通道组的闲置按整组计算：任一地址在用，整组都不会因闲置关闭，到时也是整组一起关。每个地址仍然可以单独开关。
+- 通道组内任一地址在用，整组都不算闲置，一起开关、一起关闭。
 - 记录首次连接时间、实际连接时长和每次关闭的原因。
 - 编辑通道不会打断现有连接；更换端口时先绑定新端口再释放旧端口。
 
@@ -82,7 +81,7 @@ PortRelay 把这件事变成三步：
 
 <p align="center">
   <img src="docs/images/live-traffic.gif" alt="通道卡片与实时流量" width="100%">
-  <br><sub>通道卡片：访问地址、待处理的访问与延长申请、实际连接时长，以及近 10 分钟流量（动图为加速演示）</sub>
+  <br><sub>通道卡片：访问地址、授权状态、实际连接时长，以及近 10 分钟流量（动图为加速演示）</sub>
 </p>
 
 <picture>
@@ -104,28 +103,18 @@ PortRelay 把这件事变成三步：
   </tr>
 </table>
 
-**申请延长**：授权快到期或刚结束时，同事再打开同一个链接，就能看到自己的授权状态并申请延长，不用你重新发邀请。
-
-<table>
-  <tr>
-    <td align="center"><img src="docs/images/auth-renew.png" alt="申请延长" width="100%"><br><sub>④ 再次打开链接，申请延长</sub></td>
-    <td align="center"><img src="docs/images/auth-renew-pending.png" alt="等待批准延长" width="100%"><br><sub>⑤ 等待管理员选择时长</sub></td>
-    <td align="center"><img src="docs/images/auth-renew-ok.png" alt="延长已批准" width="100%"><br><sub>⑥ 延长已批准</sub></td>
-  </tr>
-</table>
-
-你这边，通道卡片上会出现「申请延长」。打开「连接与授权」，延长申请排在最前面，点「批准延长」选好时长即可，同事的页面随即显示新的到期时间。这里还列出待审批的访问申请、已授权设备（在线状态与剩余时间）、最近结束的授权和仍然有效的邀请链接，刚结束的设备也可以直接延长。
-
-<p align="center">
-  <img src="docs/images/app-access.png" alt="连接与授权：延长申请、待审批、已授权设备、最近结束" width="80%">
-</p>
-
 **通道组**：组卡片汇总整组的状态与流量，下面逐行列出每个访问地址，可以单独开关、单独邀请或移出组。
 
 <p align="center">
   <img src="docs/images/app-group.png" alt="通道组" width="100%">
 </p>
 
+**连接与授权管理**：待审批的申请、已授权设备（在线状态与剩余时间），以及仍然有效的邀请链接，都在同一处管理。
+
+<p align="center">
+  <img src="docs/images/app-access.png" alt="授权管理" width="80%">
+</p>
+
 <details>
 <summary><b>网页面板与更多截图</b></summary>
 <br>
@@ -163,9 +152,9 @@ PortRelay 把这件事变成三步：
 **方式 A：二进制 + systemd（推荐）**
 
 ```bash
-VERSION=1.1.0   # 见 Releases 页面；ARM64 机器把 amd64 换成 arm64
+VERSION=1.0.0   # 见 Releases 页面
-curl -LO https://github.com/DeepFal/PortRelay/releases/download/v$VERSION/portrelay-server-$VERSION-linux-amd64.tar.gz
+curl -LO https://github.com/DeepFal/PortRelay/releases/download/v$VERSION/portrelay-$VERSION-linux-amd64.tar.gz
-tar xzf portrelay-server-$VERSION-linux-amd64.tar.gz && cd portrelay-server-$VERSION-linux-amd64
+tar xzf portrelay-$VERSION-linux-amd64.tar.gz && cd portrelay-$VERSION-linux-amd64
 sudo ./deploy/install-server.sh ./portrelay-server
 
 # 安装脚本会生成随机 token，记下来填到 Agent 里
@@ -195,7 +184,7 @@ make server        # 产物：dist/portrelay-server-linux-{amd64,arm64}
 
 ### 2. 运行 Agent
 
-**macOS App**：从 [Releases](https://github.com/DeepFal/PortRelay/releases) 下载 `PortRelay-*.dmg`（Apple Silicon 与 Intel 通用），打开后把 PortRelay 拖进“应用程序”。
+**macOS App**：从 [Releases](https://github.com/DeepFal/PortRelay/releases) 下载 `PortRelay-*-macos-universal.zip`，解压后拖进“应用程序”。
 
 > [!NOTE]
 > App 未经 Apple 公证。首次打开时，在 Finder 中右键选择“打开”，或者执行 `xattr -dr com.apple.quarantine /Applications/PortRelay.app`。也可以 `make app` 自行构建。
@@ -210,7 +199,7 @@ make server        # 产物：dist/portrelay-server-linux-{amd64,arm64}
 
 > 举例：Agent 通过 Tailscale 地址 `100.64.0.10` 连网关，同事在办公室局域网里用 `192.168.1.10` 访问。这时“服务器控制地址”填 `100.64.0.10:33000`，“对外访问地址”填 `192.168.1.10`，邀请链接和分享文案都会使用后者。
 
-**Linux / Windows**：下载对应平台的 `portrelay-agent-*` 压缩包，直接运行 Agent，在浏览器打开的面板里完成同样的设置。
+**Linux / Windows**：下载对应平台的压缩包，直接运行 Agent，在浏览器打开的面板里完成同样的设置。
 
 ```bash
 ./portrelay-agent              # 面板：http://127.0.0.1:33080
@@ -219,11 +208,11 @@ make server        # 产物：dist/portrelay-server-linux-{amd64,arm64}
 
 ### 3. 创建通道并邀请同事
 
-1. 点 **添加通道**，填写名称和目标主机、端口（如 `10.0.1.16`、`3306`）。可以先测试一下本机能否连通；网关上的访问端口自动分配。
+1. 点 **添加通道**，填写名称和目标地址（如 `10.0.1.16:3306`）。可以先“探测”一下本机能否连通；端口会自动推荐。
-2. 访问方式保持默认的 **仅授权链接**。保存后会直接弹出邀请设置，选择授权后可访问时长、可用设备数，以及是否需要审批。以后要再发邀请，点通道卡片上的 **邀请**。
+2. 访问方式保持默认的 **仅授权链接**，然后点 **邀请**，选择授权后可访问时长、可用设备数，以及是否需要审批。
 3. 把生成的文案或二维码发给同事。同事打开链接、填写姓名后，就可以用数据库客户端或 SSH 连接 `192.168.1.10:33660`。
 
-需要一次开放多台主机时（比如一组服务器），同样点 **添加通道**，每行填一台主机（端口用逗号隔开，可以直接粘贴一串 IP），表单会预览端口映射并自动放进新建的通道组，闲置关闭、限速、访问控制等设置对每个地址都生效。创建后弹出的邀请对整组有效。之后要加地址，点组卡片上的 **添加地址**；已有通道可以在编辑时选择加入某个组。组的「连接与授权」可以按设备或按地址查看在线连接和接入记录。
+需要一次开放多台主机时（比如一组服务器），同样点 **添加通道**，目标填 `10.0.1.11-13:22`，表单会预览端口映射并自动选上「新建通道组」，闲置关闭、限速、访问控制等设置对每个地址都生效。创建后点 **邀请整组**。之后要加地址，点组卡片上的 **添加地址**；已有通道可以在编辑时选择加入某个组。
 
 ## 配置参考
 
@@ -309,7 +298,6 @@ make agent        # 编译当前平台的 Agent 到 bin/
 make app          # 构建 PortRelay.app（UNIVERSAL=1 ./build-app.sh 构建通用二进制）
 make release      # 打包全部平台的网关与 Agent 到 dist/
 make snapshots    # 离屏渲染 App 各界面截图到 tools/ui-snapshots/out/
-make readme-images  # 重新生成 README 的全部截图和动图到 docs/images/
 ```
 
 ```text
@@ -320,10 +308,10 @@ client/                Agent：配置、隧道、本地 API、闲置关闭、流
 core/                  协议消息、ACL、流量计量与限速
 mac-native/            SwiftUI 菜单栏 App
 deploy/                systemd、Docker Compose 部署示例与安装脚本
-tools/ui-snapshots/    README 截图与动图：App 离屏渲染、网页截图、GIF 合成
+tools/ui-snapshots/    离屏截图工具与 README 动图生成（mkgif）
 ```
 
-README 里的截图和动图都使用模拟数据，改了界面后运行 `make readme-images` 即可全部重新生成（需要 Google Chrome）。App 界面离屏渲染，动图由逐帧画面合成，授权页和网页面板用无头 Chrome 截图。
+README 里的截图和动图都用模拟数据生成：`tools/ui-snapshots/render.sh readme` 渲染截图，`FRAMES=40 tools/ui-snapshots/render.sh gif` 渲染逐帧画面，再用 `go run ./tools/ui-snapshots/mkgif` 合成 GIF。
 
 欢迎提交 Issue 和 Pull Request。提交前请先运行 `make test`。
 

README_EN.md

@@ -54,18 +54,17 @@ PortRelay turns that into three steps:
 **Access control**
 
 - Three access modes: **invite-only** (the default and safest), an IP / CIDR allowlist (which can be combined with invites), and open to all.
-- Each invite link has its own expiry, device limit, access duration once granted (30 min, 1 h, 2 h, 8 h, until end of day, while the tunnel stays open, or a custom length) and an optional approval step.
+- Each invite link has its own expiry, device limit, access duration once granted (1 h, 2 h, 8 h, until end of day, or until the tunnel closes) and an optional approval step.
 - When approval is required, the app shows a system notification and you approve or deny with one click. The requester's page refreshes on its own.
 - **The access clock starts at the first connection**, so a teammate can accept an invite now and use it later.
 - When access expires or is revoked, **existing connections are dropped too**. Unauthorized connections are reset (TCP RST) and logged.
-- **Extensions.** A teammate reopens the original invite link and clicks 申请延长 (Request extension); you approve by picking a duration in the app, the menu bar or the web panel. A grant that is still running is extended from its current expiry. One that has ended starts again from the moment you approve; that works for up to two hours after it ended, even if the tunnel has been closed, and the tunnel reopens on approval. Revoked grants cannot be extended. You can also extend a running or just-ended grant yourself.
+- **Tunnel groups**: the add-tunnel form accepts several targets at once (for example `10.0.1.11-13:22, 10.0.1.11:8080`), creates one tunnel per address on a contiguous block of gateway ports and puts them in one group. A group shares one invite link and one set of grants: a teammate is authorized once for the whole group, and one revoke disconnects them everywhere.
-- **Tunnel groups**: the add-tunnel form takes a list of targets, one host per row with comma-separated ports (a pasted list of IPs is split into rows), creates one tunnel per address on a contiguous block of gateway ports and puts them in one group. A group shares one invite link and one set of grants: a teammate is authorized once for the whole group, and one revoke disconnects them everywhere.
 
 **Tunnel lifecycle**
 
 - **Idle auto-close.** The idle timer starts when a tunnel has no connections, no active grants, no pending requests and no invite links with uses left. By default the tunnel closes after 30 minutes of idle time.
-- An optional **maximum open time** closes the tunnel at a fixed point, whether or not it is in use. If you approve an extension that runs past that point, the tunnel stays open until the grant ends.
+- An optional **maximum open time** closes the tunnel at a fixed point, whether or not it is in use.
-- Idle time is counted per group: while any address is in use, none of them is closed for being idle, and when the group does go idle it closes as a whole. Each address can still be switched on or off on its own.
+- While any address in a group is in use, the whole group counts as in use; members are switched on and off together.
 - PortRelay records the first-connection time, the actual connected time and why each tunnel was closed.
 - Editing a tunnel keeps existing connections. Moving a tunnel binds the new port before releasing the old one.
 
@@ -85,7 +84,7 @@ PortRelay turns that into three steps:
 
 <p align="center">
   <img src="docs/images/live-traffic.gif" alt="Tunnel card with live traffic" width="100%">
-  <br><sub>A tunnel card: access address, pending access and extension requests, connected time and the last 10 minutes of traffic (sped up)</sub>
+  <br><sub>A tunnel card: access address, grants, connected time and the last 10 minutes of traffic (sped up)</sub>
 </p>
 
 <picture>
@@ -107,28 +106,18 @@ PortRelay turns that into three steps:
   </tr>
 </table>
 
-**Extensions.** When access is about to run out or has just ended, the teammate opens the same link again, sees where their access stands and asks for more time. You don't need to send a new invite.
-
-<table>
-  <tr>
-    <td align="center"><img src="docs/images/auth-renew.png" alt="Request an extension" width="100%"><br><sub>④ Reopen the link and request an extension</sub></td>
-    <td align="center"><img src="docs/images/auth-renew-pending.png" alt="Waiting for the extension" width="100%"><br><sub>⑤ Wait while you choose a duration</sub></td>
-    <td align="center"><img src="docs/images/auth-renew-ok.png" alt="Extension approved" width="100%"><br><sub>⑥ Extension approved</sub></td>
-  </tr>
-</table>
-
-On your side, the tunnel card shows 申请延长 (Extension requested). Open 连接与授权 (Connections & access): extension requests are listed first, and you approve one by clicking 批准延长 (Approve) and picking a duration. The teammate's page then shows the new expiry. The same view lists pending access requests, authorized devices (with online state and remaining time), recently ended grants and active invite links, and a device whose access just ended can be extended from there too.
-
-<p align="center">
-  <img src="docs/images/app-access.png" alt="Access management: extension requests, pending requests, authorized devices, recently ended" width="80%">
-</p>
-
 **Tunnel groups.** A group card sums up the state and traffic of the whole group and lists every access address. Each address can be switched, invited or moved out on its own.
 
 <p align="center">
   <img src="docs/images/app-group.png" alt="Tunnel group" width="100%">
 </p>
 
+**Access management.** Pending requests, authorized devices (with online state and remaining time) and active invite links are all managed in one place.
+
+<p align="center">
+  <img src="docs/images/app-access.png" alt="Access management" width="80%">
+</p>
+
 <details>
 <summary><b>Web panel and more screenshots</b></summary>
 <br>
@@ -168,9 +157,9 @@ The gateway must be reachable by **visitors** and by **the agent**. Open TCP `33
 **Option A: binary + systemd (recommended)**
 
 ```bash
-VERSION=1.1.0   # see the Releases page; use arm64 instead of amd64 on ARM hosts
+VERSION=1.0.0   # see the Releases page
-curl -LO https://github.com/DeepFal/PortRelay/releases/download/v$VERSION/portrelay-server-$VERSION-linux-amd64.tar.gz
+curl -LO https://github.com/DeepFal/PortRelay/releases/download/v$VERSION/portrelay-$VERSION-linux-amd64.tar.gz
-tar xzf portrelay-server-$VERSION-linux-amd64.tar.gz && cd portrelay-server-$VERSION-linux-amd64
+tar xzf portrelay-$VERSION-linux-amd64.tar.gz && cd portrelay-$VERSION-linux-amd64
 sudo ./deploy/install-server.sh ./portrelay-server
 
 # The installer generates a random token; you will enter it in the agent
@@ -204,7 +193,7 @@ make server        # dist/portrelay-server-linux-{amd64,arm64}
 
 ### 2. Run the agent
 
-**macOS app.** Download `PortRelay-*.dmg` (universal: Apple Silicon and Intel) from [Releases](https://github.com/DeepFal/PortRelay/releases), open it and drag PortRelay to Applications.
+**macOS app.** Download `PortRelay-*-macos-universal.zip` from [Releases](https://github.com/DeepFal/PortRelay/releases), unzip it and move it to Applications.
 
 > [!NOTE]
 > The app is not notarized. On first launch, right-click it in Finder and choose Open, or run `xattr -dr com.apple.quarantine /Applications/PortRelay.app`. You can also build it yourself with `make app`.
@@ -219,7 +208,7 @@ Open ⚙️ Settings and fill in:
 
 > Example: the agent reaches the gateway over Tailscale at `100.64.0.10`, while teammates in the office use the LAN address `192.168.1.10`. Set the control address to `100.64.0.10:33000` and the public access address to `192.168.1.10`. Invite links and share messages will use the LAN address.
 
-**Linux / Windows.** Download the `portrelay-agent-*` archive for your platform, run the agent, and use the web panel that opens in your browser.
+**Linux / Windows.** Download the archive for your platform, run the agent, and use the web panel that opens in your browser.
 
 ```bash
 ./portrelay-agent              # panel at http://127.0.0.1:33080
@@ -228,11 +217,11 @@ Open ⚙️ Settings and fill in:
 
 ### 3. Create a tunnel and invite someone
 
-1. Click **添加通道** (Add tunnel) and enter a name, a target host and port such as `10.0.1.16` and `3306`. You can probe the target from your machine first; the gateway port is assigned automatically.
+1. Click **添加通道** (Add tunnel) and enter a name and a target such as `10.0.1.16:3306`. You can probe the target from your machine first, and a free port is suggested automatically.
-2. Keep the default access mode, **仅授权链接** (invite-only). After you save, the invite form opens: choose how long access lasts, how many devices may use the link, and whether approval is required. To send another invite later, click **邀请** (Invite) on the tunnel card.
+2. Keep the default access mode, **仅授权链接** (invite-only). Click **邀请** (Invite), then choose how long access lasts, how many devices may use the link, and whether approval is required.
 3. Send the generated message or QR code. Once the teammate has entered their name, they can connect their database client or SSH to `192.168.1.10:33660`.
 
-To open several hosts at once (a set of servers, say), use the same **添加通道** (Add tunnel) form with one host per row (comma-separated ports; you can paste a list of IPs). The form previews the port mapping and puts the addresses in a new tunnel group; idle close, bandwidth and access settings apply to every address. The invite form that opens after creation covers the whole group. To add addresses later, click **添加地址** (Add address) on the group card; an existing tunnel can join a group from its edit form. A group's connections and history can be viewed by device or by address.
+To open several hosts at once (a set of servers, say), use the same **添加通道** (Add tunnel) form and enter `10.0.1.11-13:22` as the target. The form previews the port mapping and selects 新建通道组 (New tunnel group); idle close, bandwidth and access settings apply to every address. Then click **邀请整组** (Invite group). To add addresses later, click **添加地址** (Add address) on the group card; an existing tunnel can join a group from its edit form.
 
 ## Configuration
 
@@ -325,7 +314,6 @@ make agent        # build the agent for this platform into bin/
 make app          # build PortRelay.app (UNIVERSAL=1 ./build-app.sh for a universal binary)
 make release      # package gateway + agent for all platforms into dist/
 make snapshots    # render app screens offscreen into tools/ui-snapshots/out/
-make readme-images  # regenerate every README screenshot and animation in docs/images/
 ```
 
 ```text
@@ -336,10 +324,13 @@ client/                agent: config, tunnels, local API, idle close, traffic st
 core/                  protocol messages, ACL, traffic metering and rate limiting
 mac-native/            SwiftUI menu-bar app
 deploy/                systemd and Docker Compose examples, install script
-tools/ui-snapshots/    README images: offscreen app rendering, web screenshots, GIF encoding
+tools/ui-snapshots/    offscreen screenshot renderer and README GIF builder (mkgif)
 ```
 
-All screenshots and animations in this README use mock data. After a UI change, run `make readme-images` to regenerate them (Google Chrome required). App screens are rendered offscreen, the animation is encoded from rendered frames, and the invite pages and web panel are captured with headless Chrome.
+All screenshots and animations in this README come from mock data:
+- `tools/ui-snapshots/render.sh readme` renders the screenshots;
+- `FRAMES=40 tools/ui-snapshots/render.sh gif` renders the animation frames;
+- `go run ./tools/ui-snapshots/mkgif` encodes the frames as a GIF.
 
 Issues and pull requests are welcome. Please run `make test` before submitting.
 

client/agent.go

@@ -34,7 +34,6 @@ type Agent struct {
 	latestMetrics protocol.MetricsMessage
 	regErrors     map[string]string // tunnelID -> 服务器返回的注册失败原因
 	inviteWaiters map[string]chan protocol.InviteRespMessage
-	extendWaiters map[string]chan protocol.ExtendLeaseRespMessage
 
 	controlWriteMu sync.Mutex
 	controlWriter  *bufio.Writer
@@ -58,7 +57,6 @@ func NewAgent(cm *ConfigManager) *Agent {
 		cm:              cm,
 		regErrors:       make(map[string]string),
 		inviteWaiters:   make(map[string]chan protocol.InviteRespMessage),
-		extendWaiters:   make(map[string]chan protocol.ExtendLeaseRespMessage),
 		usage:           make(map[string]*usageState),
 		idleUnit:        time.Minute,
 		rates:           newRateRecorder(),
@@ -201,18 +199,6 @@ func (a *Agent) trackUsage(now time.Time) {
 			groupBusy[gm.GroupID] = true
 		}
 	}
-	// 等待批准的延长申请：通道（组）保持开启，避免关了又被批准重开
-	renewing := make(map[string]bool)
-	for _, r := range metrics.Renewals {
-		if r.Request == nil {
-			continue
-		}
-		if r.GroupID != "" {
-			groupBusy[r.GroupID] = true
-		} else {
-			renewing[r.TunnelID] = true
-		}
-	}
 	for _, t := range cfg.Tunnels {
 		if m, ok := byID[t.ID]; ok && t.Enabled && t.GroupID != "" && m.Status == "online" && tunnelInUse(m) {
 			groupBusy[t.GroupID] = true
@@ -256,7 +242,7 @@ func (a *Agent) trackUsage(now time.Time) {
 				firstConn = append(firstConn, t.ID)
 			}
 		}
-		u.inUse = tunnelInUse(m) || renewing[t.ID] || (t.GroupID != "" && groupBusy[t.GroupID])
+		u.inUse = tunnelInUse(m) || (t.GroupID != "" && groupBusy[t.GroupID])
 		if u.inUse {
 			u.lastActive = now
 		}
@@ -534,17 +520,6 @@ func (a *Agent) connectAndRun(cfg Config) error {
 				delete(a.inviteWaiters, resp.RequestID)
 			}
 			a.mu.Unlock()
-		case protocol.TypeExtendResp:
-			var resp protocol.ExtendLeaseRespMessage
-			if json.Unmarshal(line, &resp) != nil {
-				continue
-			}
-			a.mu.Lock()
-			if ch, ok := a.extendWaiters[resp.RequestID]; ok {
-				ch <- resp
-				delete(a.extendWaiters, resp.RequestID)
-			}
-			a.mu.Unlock()
 		case protocol.TypeRegisterResp:
 			var resp protocol.RegisterRespMessage
 			if json.Unmarshal(line, &resp) != nil {
@@ -768,24 +743,14 @@ func (a *Agent) wire(t protocol.TunnelConfig) protocol.TunnelConfig {
 	return t
 }
 
-// RemoveTunnel closes a tunnel on the relay server; its devices can still ask for an extension
 func (a *Agent) RemoveTunnel(id string) {
-	a.unregister(id, false)
-}
-
-// DeleteTunnel removes a deleted tunnel from the relay server, renewal records included
-func (a *Agent) DeleteTunnel(id string) {
-	a.unregister(id, true)
-}
-
-func (a *Agent) unregister(id string, deleted bool) {
 	a.mu.Lock()
 	delete(a.regErrors, id)
 	a.mu.Unlock()
 	if !a.IsConnected() {
 		return
 	}
-	_ = a.sendControl(protocol.UnregisterMessage{Type: protocol.TypeUnregister, TunnelID: id, Deleted: deleted})
+	_ = a.sendControl(protocol.UnregisterMessage{Type: protocol.TypeUnregister, TunnelID: id})
 }
 
 // Scope selects what an invite, request or lease applies to: one tunnel, or a whole group
@@ -827,38 +792,6 @@ func (a *Agent) CreateInvite(scope Scope, note string, validMinutes, maxUses int
 	}
 }
 
-// ExtendLease extends a device's access by minutes (approving its renewal requests) and returns
-// the new expiry
-func (a *Agent) ExtendLease(scope Scope, ip string, minutes int) (time.Time, error) {
-	if !a.IsConnected() {
-		return time.Time{}, fmt.Errorf("未连接中继服务器")
-	}
-	reqID := uuid.New().String()
-	ch := make(chan protocol.ExtendLeaseRespMessage, 1)
-	a.mu.Lock()
-	a.extendWaiters[reqID] = ch
-	a.mu.Unlock()
-	defer func() {
-		a.mu.Lock()
-		delete(a.extendWaiters, reqID)
-		a.mu.Unlock()
-	}()
-	if err := a.sendControl(protocol.ExtendLeaseMessage{
-		Type: protocol.TypeExtendLease, RequestID: reqID, TunnelID: scope.TunnelID, GroupID: scope.GroupID, IP: ip, Minutes: minutes,
-	}); err != nil {
-		return time.Time{}, err
-	}
-	select {
-	case resp := <-ch:
-		if !resp.Success {
-			return time.Time{}, fmt.Errorf("%s", resp.Error)
-		}
-		return resp.ExpiresAt, nil
-	case <-time.After(5 * time.Second):
-		return time.Time{}, fmt.Errorf("服务器未响应，请先把服务端更新到支持延长授权的版本")
-	}
-}
-
 // RevokeInvite invalidates an invite link and the leases it granted
 func (a *Agent) RevokeInvite(scope Scope, code string) error {
 	if !a.IsConnected() {
@@ -926,6 +859,5 @@ func (a *Agent) GetLatestMetrics() protocol.MetricsMessage {
 	m.Groups = append([]protocol.GroupMetrics(nil), m.Groups...)
 	m.ActiveConns = append([]protocol.ActiveConnInfo(nil), m.ActiveConns...)
 	m.SecurityEvents = append([]protocol.SecurityEvent(nil), m.SecurityEvents...)
-	m.Renewals = append([]protocol.RenewalInfo(nil), m.Renewals...)
 	return m
 }

client/api.go

@@ -132,19 +132,6 @@ type TunnelWithMetrics struct {
 	EffectiveIdleCloseMinutes int `json:"effective_idle_close_minutes"`
 	// RateHistory 近 10 分钟流量曲线（仅开启中的通道）
 	RateHistory *RateSeries `json:"rate_history,omitempty"`
-	// Renewals 可延长的设备与延长申请（通道关闭后 2 小时内仍有）
-	Renewals []protocol.RenewalInfo `json:"renewals,omitempty"`
-}
-
-// renewalsOf picks the renewals of one tunnel (groupID empty) or one group
-func renewalsOf(all []protocol.RenewalInfo, tunnelID, groupID string) []protocol.RenewalInfo {
-	var out []protocol.RenewalInfo
-	for _, r := range all {
-		if (groupID != "" && r.GroupID == groupID) || (groupID == "" && r.GroupID == "" && r.TunnelID == tunnelID) {
-			out = append(out, r)
-		}
-	}
-	return out
 }
 
 // tunnelsWithMetrics merges config, live metrics and registration errors into one consistent view.
@@ -180,7 +167,6 @@ func (s *APIServer) tunnelsWithMetrics(metrics protocol.MetricsMessage) []Tunnel
 			Metrics:                   tm,
 			Activity:                  s.agent.Activity(t),
 			EffectiveIdleCloseMinutes: IdleCloseMinutes(t),
-			Renewals:                  renewalsOf(metrics.Renewals, t.ID, ""),
 		}
 		if t.Enabled {
 			series := s.agent.RateSeries(t.ID)
@@ -279,7 +265,7 @@ func (s *APIServer) handleTunnelItem(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		s.agent.ConsumeSessionBytes(tunnelID)
-		s.agent.DeleteTunnel(tunnelID)
+		s.agent.RemoveTunnel(tunnelID)
 		jsonResponse(w, http.StatusOK, map[string]string{"status": "deleted"})
 
 	default:
@@ -390,7 +376,6 @@ func shareMessage(inv protocol.Invite, body, link string) string {
 	} else if inv.MaxUses > 1 {
 		b.WriteString(fmt.Sprintf("\n此链接最多 %d 台设备使用，请勿转发。", inv.MaxUses))
 	}
-	b.WriteString("\n授权结束后 2 小时内，可以重新打开此链接申请延长。")
 	return b.String()
 }
 
@@ -401,7 +386,6 @@ func isAccessPath(p string) bool {
 // handleAccess serves the access endpoints shared by tunnels and groups:
 //
 //	POST   leases/revoke            {"ip": "..."}（ip 为空表示撤销全部）
-//	POST   leases/extend            {"ip": "...", "minutes": 60} 延长授权（同时批准该设备的延长申请）
 //	POST   invites                  新建邀请
 //	DELETE invites/{code}           作废邀请
 //	GET    invites/{code}/share     分享文案
@@ -422,26 +406,6 @@ func (s *APIServer) handleAccess(w http.ResponseWriter, r *http.Request, sc Scop
 		}
 		jsonResponse(w, http.StatusOK, map[string]string{"status": "revoked"})
 
-	case len(rest) == 2 && rest[0] == "leases" && rest[1] == "extend" && r.Method == http.MethodPost:
-		var req struct {
-			IP      string `json:"ip"`
-			Minutes int    `json:"minutes"`
-		}
-		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-			jsonError(w, http.StatusBadRequest, "Invalid JSON")
-			return
-		}
-		if req.Minutes < 1 || req.Minutes > protocol.MaxLeaseMinutes {
-			jsonError(w, http.StatusBadRequest, "延长时长须在 1 分钟到 30 天之间")
-			return
-		}
-		exp, err := s.extendAccess(sc, strings.TrimSpace(req.IP), req.Minutes)
-		if err != nil {
-			jsonError(w, http.StatusConflict, err.Error())
-			return
-		}
-		jsonResponse(w, http.StatusOK, map[string]any{"expires_at": exp})
-
 	case rest[0] == "invites":
 		s.handleInvites(w, r, sc, rest[1:])
 
@@ -464,75 +428,6 @@ func (s *APIServer) handleAccess(w http.ResponseWriter, r *http.Request, sc Scop
 	}
 }
 
-// extendAccess extends a device's access in a tunnel or group. Closed tunnels are reopened first
-// (a group reopens all its members), and each is kept open at least until the new expiry.
-func (s *APIServer) extendAccess(sc Scope, ip string, minutes int) (time.Time, error) {
-	if ip == "" {
-		return time.Time{}, fmt.Errorf("缺少设备 IP")
-	}
-	var members []protocol.TunnelConfig
-	if sc.GroupID != "" {
-		members = s.cm.GroupMembers(sc.GroupID)
-	} else if t, ok := s.cm.FindTunnel(sc.TunnelID); ok {
-		members = []protocol.TunnelConfig{t}
-	}
-	if len(members) == 0 {
-		return time.Time{}, fmt.Errorf("通道不存在或组内没有通道")
-	}
-	if !s.canExtend(sc, ip) {
-		return time.Time{}, fmt.Errorf("这台设备没有可延长的授权（访问结束已超过 2 小时或已被撤销）")
-	}
-	on := true
-	for _, t := range members {
-		if !t.Enabled {
-			if _, err := s.setEnabled(t.ID, &on); err != nil {
-				return time.Time{}, err
-			}
-		}
-	}
-	exp, err := s.agent.ExtendLease(sc, ip, minutes)
-	if err != nil {
-		return time.Time{}, err
-	}
-	for _, t := range members {
-		if updated, changed, err := s.cm.ExtendUntil(t.ID, exp); err == nil && changed {
-			s.agent.SyncTunnel(updated, true)
-		}
-	}
-	return exp, nil
-}
-
-// canExtend reports whether ip has a running lease, or an access ended within two hours, in the scope.
-// 先检查再开启通道，避免对没有可延长授权的设备白白打开通道。
-func (s *APIServer) canExtend(sc Scope, ip string) bool {
-	metrics := s.agent.GetLatestMetrics()
-	for _, r := range renewalsOf(metrics.Renewals, sc.TunnelID, sc.GroupID) {
-		if r.IP == ip {
-			return true
-		}
-	}
-	var leases []protocol.DynamicLease
-	if sc.GroupID != "" {
-		for _, g := range metrics.Groups {
-			if g.GroupID == sc.GroupID {
-				leases = g.DynamicLeases
-			}
-		}
-	} else {
-		for _, t := range metrics.Tunnels {
-			if t.TunnelID == sc.TunnelID {
-				leases = t.DynamicLeases
-			}
-		}
-	}
-	for _, l := range leases {
-		if l.IP == ip {
-			return true
-		}
-	}
-	return false
-}
-
 // scopeShare builds the share message for an invite of a tunnel or group
 func (s *APIServer) scopeShare(cfg Config, sc Scope, inv protocol.Invite, link string) string {
 	if sc.GroupID != "" {

client/api_groups.go

@@ -16,8 +16,6 @@ type GroupView struct {
 	Metrics   protocol.GroupMetrics `json:"metrics"`
 	// RateHistory 开启中成员的近 10 分钟流量之和
 	RateHistory *RateSeries `json:"rate_history,omitempty"`
-	// Renewals 可延长的设备与延长申请（组关闭后 2 小时内仍有）
-	Renewals []protocol.RenewalInfo `json:"renewals,omitempty"`
 }
 
 func (s *APIServer) groupsView(metrics protocol.MetricsMessage) []GroupView {
@@ -28,8 +26,7 @@ func (s *APIServer) groupsView(metrics protocol.MetricsMessage) []GroupView {
 	cfg := s.cm.Get()
 	out := make([]GroupView, 0, len(cfg.Groups))
 	for _, g := range cfg.Groups {
-		v := GroupView{TunnelGroup: g, TunnelIDs: make([]string, 0), Metrics: protocol.GroupMetrics{GroupID: g.ID},
+		v := GroupView{TunnelGroup: g, TunnelIDs: make([]string, 0), Metrics: protocol.GroupMetrics{GroupID: g.ID}}
-			Renewals: renewalsOf(metrics.Renewals, "", g.ID)}
 		if m, ok := shared[g.ID]; ok {
 			v.Metrics = m
 		}
@@ -186,7 +183,7 @@ func (s *APIServer) handleGroupItem(w http.ResponseWriter, r *http.Request) {
 			if deleteMembers {
 				s.agent.ConsumeSessionBytes(t.ID)
 				s.agent.dropUsage(t.ID)
-				s.agent.DeleteTunnel(t.ID)
+				s.agent.RemoveTunnel(t.ID)
 			} else if t.Enabled {
 				s.agent.SyncTunnel(t, true)
 			}

client/config.go

@@ -572,25 +572,6 @@ func (cm *ConfigManager) PatchTunnel(id string, patch []byte) (protocol.TunnelCo
 	return cloneTunnel(updated), existing.ListenPort, cm.save()
 }
 
-// ExtendUntil keeps an open tunnel open at least until t: an approved access extension outlasts the
-// tunnel's maximum open time. Returns the tunnel and whether it changed.
-func (cm *ConfigManager) ExtendUntil(id string, t time.Time) (protocol.TunnelConfig, bool, error) {
-	cm.mu.Lock()
-	defer cm.mu.Unlock()
-	for i, tc := range cm.cfg.Tunnels {
-		if tc.ID != id {
-			continue
-		}
-		if !tc.Enabled || tc.ExpiresAt == nil || !tc.ExpiresAt.Before(t) {
-			return cloneTunnel(tc), false, nil
-		}
-		v := t
-		cm.cfg.Tunnels[i].ExpiresAt = &v
-		return cloneTunnel(cm.cfg.Tunnels[i]), true, cm.save()
-	}
-	return protocol.TunnelConfig{}, false, fmt.Errorf("通道 %s 未找到", id)
-}
-
 // RefreshAuthCode generates a new auth code for a tunnel
 func (cm *ConfigManager) RefreshAuthCode(id string) (protocol.TunnelConfig, error) {
 	cm.mu.Lock()

client/renew_test.go

@@ -1,97 +0,0 @@
-package client
-
-import (
-	"encoding/json"
-	"net/http"
-	"testing"
-	"time"
-)
-
-func TestExtendReopensClosedTunnel(t *testing.T) {
-	e := startEnv(t, testToken)
-	waitFor(t, "agent connected", e.agent.IsConnected)
-	echo := startEcho(t)
-	// 最长开启 10 分钟的仅授权链接通道
-	one := e.addTunnels(t, map[string]any{"name": "db", "target": echo, "duration_minutes": 10, "whitelist": []string{}})
-	tn := one.Tunnels[0]
-	waitFor(t, "online", func() bool { return e.tunnel(t, tn.ID).Metrics.Status == "online" })
-
-	_, body := e.call(t, "POST", "/api/tunnels/"+tn.ID+"/invites", map[string]any{"lease_duration": "30m"})
-	var inv struct {
-		Invite struct{ Code string } `json:"invite"`
-	}
-	_ = json.Unmarshal(body, &inv)
-	grantViaInvite(t, e, inv.Invite.Code, "张三")
-	if got, err := echoVia(tn.ListenPort, "hi"); err != nil || got != "hi" {
-		t.Fatalf("granted device cannot connect: %q %v", got, err)
-	}
-
-	// 关闭通道：设备仍可在 2 小时内被延长
-	e.call(t, "POST", "/api/tunnels/"+tn.ID+"/toggle", map[string]bool{"enabled": false})
-	waitFor(t, "renewable after close", func() bool {
-		rs := e.tunnel(t, tn.ID).Renewals
-		return len(rs) == 1 && rs[0].IP == "127.0.0.1" && rs[0].EndedAt != nil
-	})
-
-	status, body := e.call(t, "POST", "/api/tunnels/"+tn.ID+"/leases/extend", map[string]any{"ip": "127.0.0.1", "minutes": 60})
-	if status != http.StatusOK {
-		t.Fatalf("extend: %d %s", status, body)
-	}
-	var out struct {
-		ExpiresAt time.Time `json:"expires_at"`
-	}
-	_ = json.Unmarshal(body, &out)
-	if d := time.Until(out.ExpiresAt); d < 59*time.Minute || d > 61*time.Minute {
-		t.Fatalf("an ended access is extended from now: %v", d)
-	}
-	reopened := e.tunnel(t, tn.ID)
-	if !reopened.Enabled || reopened.ExpiresAt == nil || reopened.ExpiresAt.Before(out.ExpiresAt) {
-		t.Fatalf("the tunnel must reopen and stay open until the extended access ends: %+v", reopened.TunnelConfig)
-	}
-	waitFor(t, "reachable again", func() bool {
-		got, err := echoVia(tn.ListenPort, "x")
-		return err == nil && got == "x"
-	})
-
-	// 没有可延长授权的设备：不打开通道
-	e.call(t, "POST", "/api/tunnels/"+tn.ID+"/toggle", map[string]bool{"enabled": false})
-	if status, _ := e.call(t, "POST", "/api/tunnels/"+tn.ID+"/leases/extend", map[string]any{"ip": "10.1.2.3", "minutes": 30}); status != http.StatusConflict {
-		t.Fatalf("unknown device: %d", status)
-	}
-	if e.tunnel(t, tn.ID).Enabled {
-		t.Fatal("a refused extension must not reopen the tunnel")
-	}
-}
-
-func TestExtendReopensWholeGroup(t *testing.T) {
-	e := startEnv(t, testToken)
-	waitFor(t, "agent connected", e.agent.IsConnected)
-	echo1, echo2 := startEcho(t), startEcho(t)
-	g := e.addTunnels(t, map[string]any{"name": "订单服务", "target": echo1 + ", " + echo2, "new_group": "订单服务"})
-	gid := g.Group.ID
-	waitFor(t, "online", func() bool {
-		return e.tunnel(t, g.Tunnels[0].ID).Metrics.Status == "online" && e.tunnel(t, g.Tunnels[1].ID).Metrics.Status == "online"
-	})
-	_, body := e.call(t, "POST", "/api/groups/"+gid+"/invites", map[string]any{})
-	var inv struct {
-		Invite struct{ Code string } `json:"invite"`
-	}
-	_ = json.Unmarshal(body, &inv)
-	grantViaInvite(t, e, inv.Invite.Code, "小王")
-
-	e.call(t, "POST", "/api/groups/"+gid+"/toggle", map[string]bool{"enabled": false})
-	waitFor(t, "group renewable after close", func() bool { return len(e.group(t, gid).Renewals) == 1 })
-	if status, body := e.call(t, "POST", "/api/groups/"+gid+"/leases/extend", map[string]any{"ip": "127.0.0.1", "minutes": 30}); status != http.StatusOK {
-		t.Fatalf("extend group: %d %s", status, body)
-	}
-	for _, m := range g.Tunnels {
-		if !e.tunnel(t, m.ID).Enabled {
-			t.Fatal("extending a group's access reopens every member")
-		}
-	}
-	waitFor(t, "every member reachable", func() bool {
-		_, err1 := echoVia(g.Tunnels[0].ListenPort, "a")
-		_, err2 := echoVia(g.Tunnels[1].ListenPort, "b")
-		return err1 == nil && err2 == nil
-	})
-}

cmd/portrelay-agent/web/index.html

@@ -240,7 +240,7 @@
     .modal-overlay {
       position: fixed; top: 0; left: 0; right: 0; bottom: 0;
       background: rgba(0, 0, 0, 0.7); backdrop-filter: blur(8px);
-      display: none; align-items: center; justify-content: center; z-index: 1002;
+      display: none; align-items: center; justify-content: center; z-index: 1000;
     }
     .modal-overlay.open { display: flex; }
     .modal-card {
@@ -329,19 +329,6 @@
     .preview-row { font-family: ui-monospace, Menlo, Monaco, Consolas, monospace; font-size: 12px; }
     .plan-box { margin-top: 8px; padding: 8px 10px; border-radius: 6px; background: rgba(148, 163, 184, 0.08); color: var(--text-muted); font-size: 12px; line-height: 1.7; }
     .plan-box .route-endpoint { color: var(--accent, #38bdf8); }
-    .target-row { display: flex; gap: 8px; align-items: center; margin-bottom: 6px; }
-    .target-row input { min-width: 0; }
-    .target-row .t-ports { flex: 0 0 150px; }
-    .target-head { display: flex; gap: 8px; font-size: 11px; color: var(--text-muted); margin-bottom: 4px; }
-    .target-head span:first-child { flex: 1; }
-    .target-head span:last-child { flex: 0 0 182px; }
-    .plan-box .ok { color: var(--success); } .plan-box .bad { color: var(--danger); }
-    .dim-toggle { display: inline-flex; border: 1px solid var(--card-border); border-radius: 6px; overflow: hidden; float: right; }
-    .dim-toggle button { background: none; border: 0; color: var(--text-muted); font-size: 11px; padding: 2px 10px; cursor: pointer; }
-    .dim-toggle button.on { background: rgba(56, 189, 248, 0.18); color: var(--text); }
-    .chip-row { display: flex; gap: 6px; flex-wrap: wrap; }
-    .chip-btn { background: rgba(148, 163, 184, 0.1); border: 1px solid var(--card-border); color: var(--text); font-size: 12px; padding: 4px 10px; border-radius: 6px; cursor: pointer; }
-    .chip-btn.on { background: rgba(56, 189, 248, 0.18); border-color: #38bdf8; color: #38bdf8; font-weight: 600; }
     .add-member { background: none; border: 0; color: var(--text-muted); font-size: 12px; cursor: pointer; padding: 8px 0; }
     .add-member:hover { color: var(--text); }
     @media (max-width: 860px) { .member-name, .member-meta { display: none; } }
@@ -455,25 +442,22 @@
         <input type="hidden" id="tunnelId">
         <div class="input-row">
           <div class="form-group" style="flex: 1;">
-            <label id="tunnelNameLabel">通道名称</label>
+            <label>通道名称 / 备注</label>
-            <input type="text" id="tunnelName" placeholder="如：订单数据库" oninput="schedulePlan()">
+            <input type="text" id="tunnelName" placeholder="例如：MySQL 实习库 或 财务系统 SSH" oninput="schedulePlan()">
           </div>
           <div class="form-group" style="flex: 1;">
             <label>责任人（可选）</label>
-            <input type="text" id="tunnelOwner" placeholder="负责人或团队，如：数据组">
+            <input type="text" id="tunnelOwner" placeholder="例如：张三 / 数据组">
           </div>
         </div>
         <div class="form-group">
-          <label id="tunnelTargetLabel">目标服务（每行一台主机，多个端口用逗号隔开）</label>
+          <label id="tunnelTargetLabel">目标地址（中转机 Mac 可直连的内网目标，可填多个）</label>
-          <div class="target-head" id="targetHead"><span>主机</span><span>端口</span></div>
+          <div class="input-row">
-          <div id="targetRows"></div>
+            <input type="text" id="tunnelTarget" required placeholder="例如：10.0.0.10:3306；多台主机写 10.0.1.11-13:22" oninput="schedulePlan()">
-          <div class="input-row" style="justify-content: space-between; align-items: center;">
+            <button type="button" class="btn-secondary" onclick="probeTarget()">探测测试</button>
-            <button type="button" class="add-member" id="addRowBtn" onclick="addTargetRow()" title="也可以直接粘贴多个地址（每行一个或逗号分隔，可带 :端口），会自动拆成多行">＋ 添加主机</button>
-            <button type="button" class="btn-secondary btn-sm" onclick="probeTarget()">探测测试</button>
           </div>
           <div class="input-hint" id="probeResult"></div>
           <div class="plan-box" id="tunnelPlan" style="display:none;"></div>
-          <div class="input-hint" id="tunnelAddHint"></div>
         </div>
         <div class="form-group" id="tunnelPortWrap">
           <label>对外监听端口 (范围: 33001 - 34000)</label>
@@ -482,7 +466,7 @@
             <button type="button" class="btn-secondary" onclick="autoRecommendPort()">推荐空闲端口</button>
           </div>
         </div>
-        <div class="form-group" id="tunnelGroupWrap">
+        <div class="form-group">
           <label>通道组</label>
           <div class="input-row">
             <select id="tunnelGroup" onchange="onTunnelGroupChange()"></select>
@@ -502,14 +486,12 @@
         </div>
         <div class="form-group">
           <label>最长开启时长（可选，到时无论是否在用都会关闭）</label>
-          <select id="tunnelMaxDuration" onchange="onCustomDuration(this, false)">
+          <select id="tunnelMaxDuration">
             <option value="0" selected>不限制</option>
-            <option value="30">30 分钟</option>
             <option value="120">2 小时</option>
             <option value="480">8 小时</option>
             <option value="1440">1 天</option>
             <option value="10080">7 天</option>
-            <option value="custom">自定义…</option>
           </select>
         </div>
         <div class="form-group">
@@ -529,7 +511,7 @@
             <option value="specific">固定 IP / 网段 + 授权链接</option>
             <option value="all">全部放通 *（不安全）</option>
           </select>
-          <input type="text" id="tunnelWhitelist" style="margin-top: 8px; display: none;" placeholder="IP 或 CIDR 网段，逗号分隔，如 192.168.1.100, 10.0.0.0/24">
+          <input type="text" id="tunnelWhitelist" style="margin-top: 8px; display: none;" placeholder="例如 192.168.1.100, 192.168.1.0/24（逗号分隔）">
           <div class="input-hint" id="accessModeHint"></div>
         </div>
 
@@ -541,32 +523,6 @@
     </div>
   </div>
 
-  <!-- Modal: Extend access（批准延长申请 / 主动延长） -->
-  <div class="modal-overlay" id="extendModal">
-    <div class="modal-card" style="width: 420px;">
-      <div class="modal-header">
-        <h3 id="extendTitle">延长访问</h3>
-        <button class="btn-secondary btn-sm" onclick="closeExtendModal()">✕</button>
-      </div>
-      <div class="input-hint" id="extendHint" style="margin: -8px 0 14px;"></div>
-      <div class="form-group">
-        <label>延长多久</label>
-        <div class="chip-row" id="extendChips"></div>
-        <div class="input-row" style="margin-top: 8px;">
-          <input type="number" id="extendAmount" min="1" placeholder="自定义数量" oninput="updateExtend()">
-          <select id="extendUnit" style="max-width: 100px;" onchange="updateExtend()">
-            <option value="1">分钟</option>
-            <option value="60">小时</option>
-          </select>
-        </div>
-      </div>
-      <div class="modal-footer">
-        <button type="button" class="btn-secondary" onclick="closeExtendModal()">取消</button>
-        <button type="button" class="btn-primary" id="extendConfirm" onclick="confirmExtend()">延长</button>
-      </div>
-    </div>
-  </div>
-
   <!-- Modal: Invite -->
   <div class="modal-overlay" id="inviteModal">
     <div class="modal-card">
@@ -577,7 +533,7 @@
       <div id="inviteForm">
         <div class="form-group">
           <label>备注（发给谁，可选）</label>
-          <input type="text" id="inviteNote" placeholder="如：张三">
+          <input type="text" id="inviteNote" placeholder="例如：张三">
         </div>
         <div class="form-group">
           <label>链接有效期</label>
@@ -597,14 +553,12 @@
         </div>
         <div class="form-group">
           <label>授权后可访问</label>
-          <select id="inviteLease" onchange="onCustomDuration(this, true)">
+          <select id="inviteLease">
-            <option value="30m">30 分钟</option>
             <option value="1h">1 小时</option>
             <option value="2h" selected>2 小时</option>
             <option value="8h">8 小时</option>
             <option value="today">当天有效</option>
             <option value="tunnel">通道开启期间</option>
-            <option value="custom">自定义…</option>
           </select>
           <label style="display:flex; align-items:center; gap:8px; margin-top:10px; font-weight: normal;">
             <input type="checkbox" id="inviteApproval" style="width:auto;"> 同事打开链接后需要我批准才放通
@@ -641,11 +595,11 @@
         <div class="input-hint" style="margin: -8px 0 14px;">组内地址共用邀请与授权：同事授权一次即可访问整组；组内任一地址在用时，整组都不会闲置关闭。</div>
         <div class="form-group">
           <label>通道组名称</label>
-          <input type="text" id="groupName" required placeholder="如：订单服务集群">
+          <input type="text" id="groupName" required placeholder="例如：订单服务集群">
         </div>
         <div class="form-group">
           <label>责任人（可选）</label>
-          <input type="text" id="groupOwner" placeholder="负责人或团队，如：运维组">
+          <input type="text" id="groupOwner" placeholder="例如：张三 / 运维组">
         </div>
         <div class="form-group" id="groupExistingWrap">
           <label>把已有通道加入该组（可选）</label>
@@ -686,7 +640,7 @@
       <form onsubmit="saveSettings(event)">
         <div class="form-group">
           <label>服务器控制地址 (地址:端口)</label>
-          <input type="text" id="settingServerAddr" required placeholder="地址:端口，如 gw.example.com:33000">
+          <input type="text" id="settingServerAddr" required placeholder="例如 gw.example.com:33000">
           <div class="input-hint">边缘网关的地址与控制端口。局域网、VPN、虚拟组网或公网地址均可，只要本机能连通</div>
         </div>
         <div class="form-group">
@@ -747,33 +701,9 @@
     const fmtSecs = secs => {
       secs = Math.max(0, Math.floor(secs || 0));
       const h = Math.floor(secs / 3600), m = Math.floor((secs % 3600) / 60), sec = secs % 60;
-      const pad = n => String(n).padStart(2, '0');
+      return h > 0 ? `${h}小时${m}分` : (m > 0 ? `${m}分${sec}秒` : `${sec}秒`);
-      return h > 0 ? `${h}小时${pad(m)}分` : (m > 0 ? `${m}分${pad(sec)}秒` : `${sec}秒`);
     };
-    const fmtMinutes = m => m >= 1440 && m % 1440 === 0 ? `${m / 1440} 天`
+    const fmtMinutes = m => m >= 1440 && m % 1440 === 0 ? `${m / 1440} 天` : (m >= 60 && m % 60 === 0 ? `${m / 60} 小时` : `${m} 分钟`);
-      : (m >= 60 && m % 60 === 0 ? `${m / 60} 小时` : (m > 60 ? `${Math.floor(m / 60)} 小时 ${m % 60} 分钟` : `${m} 分钟`));
-
-    // 自定义时长：输入数量 + 单位（如 90、90m、1.5h），返回分钟数；取消或无效返回 0
-    function askMinutes() {
-      const v = (prompt('自定义时长（如 90 表示 90 分钟，3h 表示 3 小时）') || '').trim().toLowerCase();
-      const m = /^(\d+(?:\.\d+)?)\s*(h|小时|m|分钟)?$/.exec(v);
-      if (!m) return 0;
-      const minutes = Math.round(parseFloat(m[1]) * (m[2] === 'h' || m[2] === '小时' ? 60 : 1));
-      return minutes >= 5 && minutes <= 43200 ? minutes : 0;
-    }
-
-    // 下拉框选「自定义…」：询问时长并加入为一个选项；lease 为 true 时取值形如 "90m"
-    function onCustomDuration(sel, lease) {
-      if (sel.value !== 'custom') { sel.dataset.prev = sel.value; return; }
-      const m = askMinutes();
-      if (!m) { sel.value = sel.dataset.prev || (lease ? '2h' : '0'); return; }
-      const value = lease ? `${m}m` : String(m);
-      if (![...sel.options].some(o => o.value === value)) {
-        sel.add(new Option(fmtMinutes(m), value), sel.querySelector('option[value="custom"]'));
-      }
-      sel.value = value;
-      sel.dataset.prev = value;
-    }
     const ago = v => (Date.now() - new Date(v)) / 1000;
 
     let totalRateHistory = null;
@@ -836,8 +766,6 @@
       let html = '';
       if (t.max_bandwidth_mb) html += `<span class="chip purple">限速 ${t.max_bandwidth_mb} MB/s</span>`;
       if ((m.pending || []).length) html += `<span class="chip orange" onclick="openDrawer('t:${id}')">🔔 待审批 ${m.pending.length}</span>`;
-      const asks = (t.renewals || []).filter(r => r.request).length;
-      if (asks) html += `<span class="chip orange" onclick="openDrawer('t:${id}')">⏱ 申请延长 ${asks}</span>`;
       if ((m.dynamic_leases || []).length) html += `<span class="chip green" onclick="openDrawer('t:${id}')">已授权 ${m.dynamic_leases.length} 台 ›</span>`;
       return html;
     }
@@ -1136,42 +1064,39 @@
     }
 
     // 新建代理通道；groupId 非空时默认加入该通道组（通道组卡片上的「添加地址」）
-    // 组卡片「添加地址」打开时固定加入的通道组；新建时不需要选择通道组
-    let fixedGroupId = null;
-
     function openCreateModal(groupId) {
-      fixedGroupId = groupId || null;
+      document.getElementById('modalTitle').innerText = '新建代理通道';
-      const g = currentGroups.find(x => x.id === fixedGroupId);
-      document.getElementById('modalTitle').innerText = fixedGroupId ? `添加地址到「${g ? g.name : '通道组'}」` : '新建代理通道';
       document.getElementById('tunnelId').value = '';
       document.getElementById('tunnelName').value = '';
       document.getElementById('tunnelOwner').value = '';
-      document.getElementById('tunnelTargetLabel').innerText = '目标服务（每行一台主机，多个端口用逗号隔开）';
+      document.getElementById('tunnelTarget').value = '';
-      fillTunnelGroupSelect('');
+      document.getElementById('tunnelTargetLabel').innerText = '目标地址（中转机 Mac 可直连的内网目标，可填多个）';
+      document.getElementById('tunnelTarget').placeholder = '例如：10.0.0.10:3306；多台主机写 10.0.1.11-13:22';
       setAccessForm([]);
       setLifecycleForm(30, 0, 0);
+      fillTunnelGroupSelect(groupId || '');
+      document.getElementById('probeResult').innerText = '';
       resetPlan();
-      setTargetRows([{ host: '', ports: '' }]);
+      autoRecommendPort();
       document.getElementById('tunnelModal').classList.add('open');
-      document.querySelector('#targetRows .t-host').focus();
     }
 
     function editTunnel(id) {
       const t = currentTunnels.find(item => item.id === id);
       if (!t) return;
-      fixedGroupId = null;
       document.getElementById('modalTitle').innerText = '编辑代理通道';
       document.getElementById('tunnelId').value = t.id;
       document.getElementById('tunnelName').value = t.name;
       document.getElementById('tunnelOwner').value = t.owner || '';
-      document.getElementById('tunnelTargetLabel').innerText = '目标服务（内网主机与端口）';
+      document.getElementById('tunnelTarget').value = t.target;
-      const hp = splitHostPort(t.target) || [t.target, ''];
+      document.getElementById('tunnelTargetLabel').innerText = '目标地址（中转机 Mac 可直连的内网目标）';
+      document.getElementById('tunnelTarget').placeholder = '例如：10.0.0.10:3306';
       document.getElementById('tunnelPort').value = t.listen_port;
       setAccessForm(t.whitelist || []);
       setLifecycleForm(t.effective_idle_close_minutes ?? 30, t.duration_minutes || 0, t.max_bandwidth_mb || 0);
       fillTunnelGroupSelect(t.group_id || '');
+      document.getElementById('probeResult').innerText = '';
       resetPlan();
-      setTargetRows([{ host: hp[0], ports: hp[1] }]);
       document.getElementById('tunnelModal').classList.add('open');
     }
 
@@ -1189,96 +1114,6 @@
       }
     }
 
-    // ---- 目标列表：每行一台主机 + 一个或多个端口 ----
-    const isEditing = () => !!document.getElementById('tunnelId').value;
-    const listItems = s => s.split(/[\s,，、;；]+/).filter(Boolean);
-
-    // "10.0.1.11:22" / "[fd00::1]:22" → [主机, 端口]；不带端口（含裸 IPv6）返回 null
-    function splitHostPort(item) {
-      const m = /^\[(.+)\]:(.+)$/.exec(item);
-      if (m) return [m[1], m[2]];
-      const parts = item.split(':');
-      return parts.length === 2 && parts[0] && parts[1] ? parts : null;
-    }
-
-    // 粘贴进来的一串目标拆成多行：每项是 "主机" 或 "主机:端口"，同一主机的端口并到一行
-    function parseTargets(text, defaultPorts) {
-      const out = [];
-      for (const item of listItems(text)) {
-        const [host, port] = splitHostPort(item) || [item, ''];
-        const row = out.find(r => r.host === host);
-        if (!row) out.push({ host, ports: port || defaultPorts });
-        else if (port && !listItems(row.ports).includes(port)) row.ports = row.ports ? `${row.ports}, ${port}` : port;
-      }
-      return out;
-    }
-
-    // 拼成 "主机:端口, …" 交给服务端展开；还没填完整的行先跳过
-    function composeTarget(rows) {
-      const out = [];
-      for (const r of rows) {
-        const ports = listItems(r.ports);
-        for (const h of listItems(r.host)) {
-          if (splitHostPort(h)) { out.push(h); continue; }
-          if (!ports.length) continue;
-          const host = h.includes(':') && !h.startsWith('[') ? `[${h}]` : h;
-          ports.forEach(p => out.push(`${host}:${p}`));
-        }
-      }
-      return out.join(', ');
-    }
-
-    function readTargetRows() {
-      return [...document.querySelectorAll('#targetRows .target-row')].map(r => ({
-        host: r.querySelector('.t-host').value.trim(), ports: r.querySelector('.t-ports').value.trim()
-      }));
-    }
-
-    function setTargetRows(rows) {
-      const edit = isEditing();
-      document.getElementById('targetRows').innerHTML = rows.map(r => `
-        <div class="target-row">
-          <input type="text" class="t-host" value="${escapeHtml(r.host)}" placeholder="${edit ? 'IP 或域名' : 'IP 或域名，支持粘贴多行'}" oninput="schedulePlan()" onpaste="onHostPaste(event)">
-          <input type="text" class="t-ports" value="${escapeHtml(r.ports)}" placeholder="${edit ? '如 3306' : '如 22, 3306'}" oninput="schedulePlan()">
-          ${edit ? '' : `<button type="button" class="icon-btn" onclick="removeTargetRow(this)" title="删除这一行" ${rows.length === 1 ? 'disabled' : ''}>⊖</button>`}
-        </div>`).join('');
-      document.getElementById('addRowBtn').style.display = edit ? 'none' : '';
-      document.getElementById('targetHead').style.display = edit ? 'none' : 'flex';
-      schedulePlan();
-    }
-
-    // 新的一行沿用上一行的端口（同一组机器通常开同样的端口）
-    function addTargetRow() {
-      const rows = readTargetRows();
-      rows.push({ host: '', ports: rows.length ? rows[rows.length - 1].ports : '' });
-      setTargetRows(rows);
-      const hosts = document.querySelectorAll('#targetRows .t-host');
-      hosts[hosts.length - 1].focus();
-    }
-
-    function removeTargetRow(btn) {
-      const all = [...document.querySelectorAll('#targetRows .target-row')];
-      const rows = readTargetRows();
-      rows.splice(all.indexOf(btn.closest('.target-row')), 1);
-      setTargetRows(rows.length ? rows : [{ host: '', ports: '' }]);
-    }
-
-    // 一次粘贴多个主机（或 主机:端口）时拆成多行
-    function onHostPaste(e) {
-      if (isEditing()) return;
-      const text = (e.clipboardData || window.clipboardData).getData('text');
-      if (listItems(text).length < 2 && !splitHostPort(text.trim())) return;
-      e.preventDefault();
-      const all = [...document.querySelectorAll('#targetRows .target-row')];
-      const idx = all.indexOf(e.target.closest('.target-row'));
-      const rows = readTargetRows();
-      const parsed = parseTargets(text, rows[idx].ports);
-      // 粘贴到空行时替换这一行，否则插在它后面
-      if (rows[idx].host) rows.splice(idx + 1, 0, ...parsed);
-      else rows.splice(idx, 1, ...parsed);
-      setTargetRows(rows);
-    }
-
     async function probeOne(target) {
       const res = await fetch('/api/probe', {
         method: 'POST',
@@ -1288,62 +1123,71 @@
       return res.json();
     }
 
-    let probeResults = {};
-
     async function probeTarget() {
-      const target = composeTarget(readTargetRows());
+      const target = document.getElementById('tunnelTarget').value.trim();
-      if (!target) { alert('请先填写目标主机和端口'); return; }
+      if (!target) {
-      const targets = isEditing() ? [target] : tunnelPlan.map(t => t.target);
+        alert('请先输入目标地址');
-      if (!targets.length) return;
+        return;
+      }
+      const targets = isBatch() ? tunnelPlan.map(t => t.target) : [target];
       const hint = document.getElementById('probeResult');
       hint.innerText = '探测中...';
       hint.style.color = 'var(--text-muted)';
+      try {
         const results = await Promise.all(targets.map(t => probeOne(t).catch(() => ({ reachable: false, error: '探测请求失败' }))));
-      probeResults = {};
+        const failed = results.map((r, i) => [targets[i], r]).filter(([, r]) => !r.reachable);
-      targets.forEach((t, i) => { probeResults[t] = results[i]; });
+        if (targets.length === 1) {
-      if (isEditing()) {
+          const data = results[0];
-        const r = results[0];
+          hint.innerText = data.reachable ? `✓ 连通性测试通过！延迟: ${data.rtt}` : `✗ 连通失败: ${data.error || '连接超时'}`;
-        hint.innerText = r.reachable ? `✓ 连通性测试通过！延迟: ${r.rtt}` : `✗ 连通失败: ${r.error || '连接超时'}`;
+        } else if (!failed.length) {
-        hint.style.color = r.reachable ? 'var(--success)' : 'var(--danger)';
+          hint.innerText = `✓ 全部 ${targets.length} 个目标连通`;
-        return;
+        } else {
+          const [t, r] = failed[0];
+          hint.innerText = `✗ ${targets.length - failed.length}/${targets.length} 连通；${t} 连通失败: ${r.error || '连接超时'}` + (failed.length > 1 ? `（共 ${failed.length} 个失败）` : '');
+        }
+        hint.style.color = failed.length ? 'var(--danger)' : 'var(--success)';
+      } catch (e) {
+        hint.innerText = '探测请求失败';
+        hint.style.color = 'var(--danger)';
       }
-      hint.innerText = '';
-      renderPlan();
     }
 
-    // ---- 预览将创建的通道（含自动分配的访问端口）；多个地址自动放进通道组 ----
+    // ---- 多个目标：预览将创建的通道，并放进通道组 ----
-    let tunnelPlan = [], tunnelPlanError = null, planTimer = null, plannedTarget = '';
+    let tunnelPlan = [], tunnelPlanError = null, planTimer = null;
 
     function resetPlan() {
       tunnelPlan = [];
       tunnelPlanError = null;
-      probeResults = {};
+      clearTimeout(planTimer);
-      document.getElementById('probeResult').innerText = '';
       renderPlan();
     }
 
+    // 可能填了多个目标（逗号 / 空格分隔，或含范围 "10.0.1.11-13:22"），需要服务端展开
+    function mayBeMulti() {
+      if (document.getElementById('tunnelId').value) return false;
+      const target = document.getElementById('tunnelTarget').value.trim();
+      return target.split(/[\s,，、;；]+/).filter(Boolean).length > 1 || target.includes('-');
+    }
+
     function isBatch() {
-      return !isEditing() && tunnelPlan.length > 1;
+      return mayBeMulti() && tunnelPlan.length > 1;
     }
 
     // 通道组选项：'' 不分组，'__new__' 新建，其余为已有组 ID
     function groupFields() {
-      const name = document.getElementById('tunnelName').value.trim();
-      if (!isEditing()) {
-        // 新建：「添加地址」固定加入该组；多个地址自动新建以名称命名的组；一个地址不分组
-        if (fixedGroupId) return { group_id: fixedGroupId, new_group: '' };
-        return { group_id: '', new_group: isBatch() ? name : '' };
-      }
       const sel = document.getElementById('tunnelGroup').value;
-      if (sel !== '__new__') return { group_id: sel, new_group: '' };
+      if (sel === '__new__') {
-      return { group_id: '', new_group: document.getElementById('tunnelNewGroup').value.trim() || name };
+        const name = document.getElementById('tunnelNewGroup').value.trim() || document.getElementById('tunnelName').value.trim();
+        return { group_id: '', new_group: name };
+      }
+      return { group_id: sel, new_group: '' };
     }
 
     function tunnelPayload(port, whitelist) {
       return {
         name: document.getElementById('tunnelName').value.trim(),
         owner: document.getElementById('tunnelOwner').value.trim(),
-        target: composeTarget(readTargetRows()),
+        target: document.getElementById('tunnelTarget').value.trim(),
         listen_port: port,
         whitelist,
         idle_close_minutes: parseInt(document.getElementById('tunnelIdleClose').value, 10),
@@ -1355,9 +1199,7 @@
 
     function schedulePlan() {
       clearTimeout(planTimer);
-      const target = composeTarget(readTargetRows());
+      if (!mayBeMulti()) { tunnelPlan = []; tunnelPlanError = null; renderPlan(); return; }
-      if (target !== plannedTarget) { probeResults = {}; plannedTarget = target; }
-      if (isEditing() || !target) { tunnelPlan = []; tunnelPlanError = null; renderPlan(); return; }
       planTimer = setTimeout(async () => {
         try {
           const res = await fetch('/api/tunnels/batch', {
@@ -1380,37 +1222,28 @@
     }
 
     function renderPlan() {
-      const batch = isBatch(), edit = isEditing();
+      const batch = isBatch();
-      document.getElementById('tunnelPortWrap').style.display = edit ? 'block' : 'none';
-      document.getElementById('tunnelGroupWrap').style.display = edit ? 'block' : 'none';
-      updateGroupHint();
-      const n = tunnelPlan.length;
-      document.getElementById('tunnelSaveBtn').innerText = fixedGroupId ? (batch ? `添加 ${n} 个地址` : '添加')
-        : (batch ? `创建 ${n} 个通道` : '保存通道');
-
       const box = document.getElementById('tunnelPlan');
-      if (tunnelPlanError) {
+      document.getElementById('tunnelPortWrap').style.display = batch ? 'none' : 'block';
+      // 多个目标必须放进同一个通道组
+      const sel = document.getElementById('tunnelGroup');
+      const none = sel.querySelector('option[value=""]');
+      if (none) none.disabled = batch;
+      if (batch && sel.value === '') { sel.value = '__new__'; onTunnelGroupChange(true); }
+      updateGroupHint();
+      document.getElementById('tunnelSaveBtn').innerText = batch ? `创建 ${tunnelPlan.length} 个通道` : '保存通道';
+      if (mayBeMulti() && tunnelPlanError) {
         box.style.display = 'block';
         box.style.color = 'var(--danger)';
         box.innerText = tunnelPlanError;
         return;
       }
-      if (!tunnelPlan.length) { box.style.display = 'none'; box.innerHTML = ''; return; }
+      if (!batch) { box.style.display = 'none'; box.innerHTML = ''; return; }
-      const shown = tunnelPlan.slice(0, 8);
+      const shown = tunnelPlan.slice(0, 6);
-      const tested = tunnelPlan.filter(m => probeResults[m.target]);
-      const failed = tested.filter(m => !probeResults[m.target].reachable);
-      const status = m => {
-        const r = probeResults[m.target];
-        if (!r) return '';
-        return r.reachable ? ` <span class="ok">✓ ${escapeHtml(r.rtt)}</span>` : ` <span class="bad" title="${escapeHtml(r.error || '连接超时')}">✗ 不通</span>`;
-      };
-      let caption = tunnelPlan.length === 1 ? '访问端口自动分配' : '每个地址一个通道，访问端口自动连续分配';
-      if (tested.length === tunnelPlan.length && !failed.length) caption = tunnelPlan.length === 1 ? '目标连接成功' : `全部 ${tunnelPlan.length} 个目标连接成功`;
-      if (failed.length) caption = `<span class="bad">${failed.length} 个目标连不上，鼠标停在 ✗ 上可查看原因</span>`;
       box.style.display = 'block';
       box.style.color = '';
-      box.innerHTML = shown.map(m => `<div class="preview-row"><span class="route-endpoint">${escapeHtml(publicHost)}:${m.listen_port}</span> <span class="route-arrow">➔</span> <span class="route-target">${escapeHtml(m.target)}</span>${status(m)}</div>`).join('')
+      box.innerHTML = shown.map(m => `<div class="preview-row"><span class="route-endpoint">${escapeHtml(publicHost)}:${m.listen_port}</span> <span class="route-arrow">➔</span> <span class="route-target">${escapeHtml(m.target)}</span></div>`).join('')
-        + `<div>${tunnelPlan.length > shown.length ? `… 共 ${tunnelPlan.length} 个地址，` : ''}${caption}</div>`;
+        + `<div>${tunnelPlan.length > shown.length ? '… ' : ''}共 ${tunnelPlan.length} 个地址，每个地址一个通道，访问端口自动连续分配</div>`;
     }
 
     function fillTunnelGroupSelect(selected) {
@@ -1419,38 +1252,28 @@
         (currentGroups.length ? '<option disabled>──────────</option>' : '') +
         currentGroups.map(g => `<option value="${escapeHtml(g.id)}" ${g.id === selected ? 'selected' : ''}>${escapeHtml(g.name)}</option>`).join('');
       document.getElementById('tunnelNewGroup').value = '';
-      updateGroupHint();
+      onTunnelGroupChange(true);
     }
 
     function updateGroupHint() {
-      const name = document.getElementById('tunnelName').value.trim();
-      const nameInput = document.getElementById('tunnelName');
-      const label = document.getElementById('tunnelNameLabel');
-      if (!isEditing()) {
-        // 新建：不需要选择通道组，只说明结果
-        const g = fixedGroupId ? ((currentGroups.find(x => x.id === fixedGroupId) || {}).name || '通道组') : null;
-        let hint = '';
-        if (g) hint = `新地址加入通道组「${g}」，自动沿用组的邀请和授权，已授权的同事无需重新授权`;
-        else if (isBatch()) hint = `${tunnelPlan.length} 个地址将放进通道组${name ? `「${name}」` : '（以上面填写的名称命名）'}：共用邀请和授权，同事授权一次即可访问全部地址`;
-        document.getElementById('tunnelAddHint').innerText = hint;
-        label.innerText = g ? '通道名称（可选）' : (isBatch() ? '通道组名称' : '通道名称');
-        nameInput.placeholder = g ? `留空则命名为「${g} (主机)」` : (isBatch() ? '如：订单服务集群' : '如：订单数据库');
-        return;
-      }
-      document.getElementById('tunnelAddHint').innerText = '';
-      label.innerText = '通道名称';
-      nameInput.placeholder = '如：订单数据库';
       const sel = document.getElementById('tunnelGroup').value;
+      const isNew = sel === '__new__';
+      const name = document.getElementById('tunnelName').value.trim();
       const newInput = document.getElementById('tunnelNewGroup');
-      newInput.style.display = sel === '__new__' ? 'block' : 'none';
+      newInput.style.display = isNew ? 'block' : 'none';
-      newInput.placeholder = name ? `通道组名称，留空则用「${name}」` : '通道组名称';
+      newInput.placeholder = name ? `组名，默认「${name}」` : '通道组名称';
-      document.getElementById('tunnelGroupHint').innerText = sel === '__new__' ? '新建通道组并移入；之后可在组卡片的「编辑」里把其它通道加入'
+      document.getElementById('tunnelGroupHint').innerText = isBatch()
+        ? '多个地址会放进同一个通道组：共用邀请和授权，同事授权一次即可访问全部地址'
         : (sel ? '组内通道共用邀请和授权，同事授权一次即可访问组内全部地址' : '');
+      // 放进通道组时名称可以不填，按组名命名
+      const g = isNew ? newInput.value.trim() : (currentGroups.find(x => x.id === sel) || {}).name;
+      document.getElementById('tunnelName').placeholder = (!document.getElementById('tunnelId').value && g)
+        ? `可不填，默认「${g} (主机)」` : '例如：MySQL 实习库 或 财务系统 SSH';
     }
 
-    function onTunnelGroupChange() {
+    function onTunnelGroupChange(skipPlan) {
       updateGroupHint();
-      schedulePlan();
+      if (!skipPlan) schedulePlan();
     }
 
     // 闲置自动关闭 / 最长开启时长；旧配置中不在选项里的值临时加入下拉框
@@ -1486,22 +1309,11 @@
       const id = document.getElementById('tunnelId').value;
       const batch = isBatch();
       const sel = document.getElementById('tunnelGroup').value;
-      // 加入已有组时组的授权自动覆盖新地址，不需要再发邀请
+      const port = parseInt(document.getElementById('tunnelPort').value, 10);
-      const joinsExisting = !id && !!fixedGroupId;
+      if (!batch && !(port > 33000 && port <= 34000)) { alert('端口须在 33001-34000 范围内'); return; }
-      const name = document.getElementById('tunnelName').value.trim();
+      if (mayBeMulti() && tunnelPlanError) { alert(tunnelPlanError); return; }
-      const target = composeTarget(readTargetRows());
+      if (!document.getElementById('tunnelName').value.trim() && (id || !sel)) { alert('请填写通道名称'); return; }
-      let port = 0;
+      if (sel === '__new__' && !groupFields().new_group) { alert('请填写通道组名称'); return; }
-      if (id) {
-        port = parseInt(document.getElementById('tunnelPort').value, 10);
-        if (!(port > 33000 && port <= 34000)) { alert('端口须在 33001-34000 范围内'); return; }
-        if (!target) { alert('请填写目标主机和端口'); return; }
-        if (target.includes(',')) { alert('一个通道只对应一个目标端口；要开放更多端口，请用「新建代理通道」'); return; }
-      } else {
-        if (tunnelPlanError) { alert(tunnelPlanError); return; }
-        if (!tunnelPlan.length) { alert('请填写目标主机和端口'); return; }
-      }
-      if (!name && (id || !joinsExisting)) { alert(batch ? '请填写通道组名称' : '请填写通道名称'); return; }
-      if (id && sel === '__new__' && !groupFields().new_group) { alert('请填写通道组名称'); return; }
       const mode = document.getElementById('tunnelAccessMode').value;
       let whitelist = [];
       if (mode === 'all') whitelist = ['*'];
@@ -1510,10 +1322,10 @@
         if (whitelist.length === 0) { alert('请填写允许访问的 IP 或网段，或选择“仅授权链接”'); return; }
         if (whitelist.includes('*')) { alert('如需放通全部，请选择“全部放通 *”'); return; }
       }
-      const payload = tunnelPayload(port, whitelist);
+      const payload = tunnelPayload(batch ? 0 : port, whitelist);
 
       try {
-        // 新建统一走 /api/tunnels/batch：一个或多个地址、新建或加入通道组都在这一个表单里，访问端口自动分配
+        // 新建统一走 /api/tunnels/batch：单个目标、多个目标、新建或加入通道组都在这一个表单里
         const res = await fetch(id ? `/api/tunnels/${encodeURIComponent(id)}` : '/api/tunnels/batch', {
           method: id ? 'PUT' : 'POST',
           headers: { 'Content-Type': 'application/json' },
@@ -1527,6 +1339,7 @@
         closeTunnelModal();
         await fetchTunnels();
         // 新建后直接生成邀请：新建的通道组邀请整组；加入已有组时组的授权自动覆盖新地址，不用再邀请
+        const joinsExisting = sel !== '' && sel !== '__new__';
         if (!id && mode !== 'all' && !joinsExisting) {
           const key = data.group ? 'g:' + data.group.id : 't:' + data.tunnels[0].id;
           setTimeout(() => openInviteModal(key, false), 800);
@@ -1581,19 +1394,19 @@
     }
     function scopeInfo(key) {
       const s = parseScope(key);
-      let name, members, m, renewals;
+      let name, members, m;
       if (s.group) {
         const g = currentGroups.find(x => x.id === s.id);
         if (!g) return null;
-        name = g.name; members = groupMembers(g); m = g.metrics || {}; renewals = g.renewals;
+        name = g.name; members = groupMembers(g); m = g.metrics || {};
       } else {
         const t = currentTunnels.find(x => x.id === s.id);
         if (!t) return null;
-        name = t.name; members = [t]; m = t.metrics || {}; renewals = t.renewals;
+        name = t.name; members = [t]; m = t.metrics || {};
       }
       return {
         group: s.group, name, members, enabled: members.some(t => t.enabled),
-        leases: m.dynamic_leases || [], invites: m.invites || [], pending: m.pending || [], renewals: renewals || [],
+        leases: m.dynamic_leases || [], invites: m.invites || [], pending: m.pending || [],
       };
     }
 
@@ -1616,10 +1429,7 @@
 
     const cardStyle = 'background: rgba(15, 23, 42, 0.7); border: 1px solid var(--card-border); border-radius: 8px; padding: 12px 14px; margin-bottom: 10px; display:flex; justify-content:space-between; align-items:center; gap: 10px;';
     const pad2 = n => String(n).padStart(2, '0');
-    const leaseTitle = d => ({ '1h': '1 小时', '8h': '8 小时', today: '当天有效', tunnel: '通道开启期间' }[d]
+    const leaseTitle = d => ({ '1h': '1 小时', '8h': '8 小时', today: '当天有效', tunnel: '通道开启期间' }[d] || '2 小时');
-      || (/^\d+m$/.test(d || '') ? fmtMinutes(parseInt(d, 10)) : '2 小时'));
-    const fmtClock = v => { const d = new Date(v); const hm = `${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
-      return d.toDateString() === new Date().toDateString() ? hm : `${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${hm}`; };
     const fmtDT = v => {
       const d = new Date(v);
       const hm = `${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
@@ -1629,31 +1439,9 @@
     function renderLeases(key) {
       const info = scopeInfo(key);
       if (!info) return { pending: '', auth: '' };
-      const { leases, pending, invites, renewals } = info;
+      const { leases, pending, invites } = info;
       const k = escapeHtml(key);
       let html = '';
-      const closedTag = info.enabled ? '' : ' <span style="font-size: 11px; color: var(--text-muted);">· 通道已关闭，批准后自动开启</span>';
-      const extendBtn = (r, asking) => `<button class="${asking ? 'btn-primary' : 'btn-secondary'} btn-sm" onclick='openExtendModal(${escapeHtml(JSON.stringify(key))}, ${escapeHtml(JSON.stringify(r.ip))}, ${escapeHtml(JSON.stringify(r.name || ''))}, ${asking})'>${asking ? '批准延长…' : '延长…'}</button>`;
-      const renewDetail = r => [
-        r.request ? `申请于 ${fmtClock(r.request.at)}` : '',
-        r.ended_at ? `访问已于 ${fmtClock(r.ended_at)} 结束` : '',
-        r.renew_before ? `${fmtClock(r.renew_before)} 前可延长` : '',
-        !r.ended_at ? '当前仍有效，批准后在原到期时间上顺延' : '',
-      ].filter(Boolean).join(' · ');
-      const renewCard = r => `
-          <div style="${cardStyle}">
-            <div><b>${escapeHtml(r.name || '未署名')}</b> <code style="color:#38bdf8;">${escapeHtml(r.ip)}</code>${closedTag}
-              <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">${renewDetail(r)}</div></div>
-            <div class="drawer-row-actions">
-              ${r.request ? `<button class="btn-secondary btn-sm" onclick="decideRequest('${k}', '${escapeHtml(r.request.id)}', false)">拒绝</button>` : ''}
-              ${extendBtn(r, !!r.request)}
-            </div>
-          </div>`;
-      const asks = renewals.filter(r => r.request), ended = renewals.filter(r => !r.request && r.ended_at);
-      if (asks.length) {
-        html += `<b style="font-size:13px; display:block; margin: 4px 0 10px; color:#fbbf24;">申请延长 (${asks.length})</b>`;
-        html += asks.map(renewCard).join('');
-      }
 
       if (pending.length) {
         html += `<b style="font-size:13px; display:block; margin: 4px 0 10px; color:#fbbf24;">待审批 (${pending.length})</b>`;
@@ -1691,18 +1479,10 @@
                   <div style="font-size: 12px; color: var(--text-muted); margin-top: 4px;">${l.awaiting_connect
                     ? `已授权，尚未连接 · 首次连接后可访问 ${leaseTitle(l.duration)} · 请在 ${fmtDT(l.expires_at)} 前连接`
                     : `${l.started_at ? '首次连接 ' + fmtDT(l.started_at) + ' · ' : ''}有效期至 ${fmtDT(l.expires_at)} · 剩余约 ${mins} 分钟`}</div></div>
-                <div class="drawer-row-actions">
-                  ${l.awaiting_connect ? '' : extendBtn(l, false)}
                 <button class="btn-danger btn-sm" onclick="revokeLease('${k}', '${escapeHtml(l.ip)}')">撤销</button>
-                </div>
               </div>`;
           }).join('');
 
-      if (ended.length) {
-        html += `<b style="font-size:13px; display:block; margin: 8px 0 10px;">最近结束 · 2 小时内可延长 (${ended.length})</b>`;
-        html += ended.map(renewCard).join('');
-      }
-
       html += `<b style="font-size:13px; display:block; margin: 8px 0 10px;">有效的邀请链接 (${invites.length})</b>`;
       html += invites.length === 0
         ? '<div style="color: var(--text-muted); font-size: 12px; margin-bottom: 14px;">暂无有效的邀请链接</div>'
@@ -1808,63 +1588,6 @@
       document.getElementById('inviteResult').style.display = 'block';
     }
 
-    // ---- 延长访问：批准延长申请或主动延长，确定时长后立即生效；通道已关闭时会自动重新开启 ----
-    let extendTarget = null;
-    const EXTEND_OPTIONS = [[30, '30 分钟'], [60, '1 小时'], [120, '2 小时'], [480, '8 小时']];
-
-    function openExtendModal(key, ip, name, asking) {
-      const info = scopeInfo(key);
-      extendTarget = { key, ip };
-      document.getElementById('extendTitle').innerText = `${asking ? '批准延长' : '延长访问'} · ${name || ip}`;
-      document.getElementById('extendHint').innerText = (info && !info.enabled ? '通道当前已关闭，延长后会自动重新开启。' : '')
-        + '访问还没结束时从原到期时间顺延；已结束时从现在开始计算。';
-      document.getElementById('extendChips').innerHTML = EXTEND_OPTIONS.map(([m, t]) =>
-        `<button type="button" class="chip-btn" data-m="${m}" onclick="setExtendMinutes(${m})">${t}</button>`).join('');
-      setExtendMinutes(60);
-      document.getElementById('extendModal').classList.add('open');
-    }
-
-    function closeExtendModal() {
-      document.getElementById('extendModal').classList.remove('open');
-      extendTarget = null;
-    }
-
-    function setExtendMinutes(m) {
-      const hours = m >= 60 && m % 60 === 0;
-      document.getElementById('extendAmount').value = hours ? m / 60 : m;
-      document.getElementById('extendUnit').value = hours ? '60' : '1';
-      updateExtend();
-    }
-
-    function extendMinutes() {
-      const n = parseInt(document.getElementById('extendAmount').value, 10);
-      const m = n * parseInt(document.getElementById('extendUnit').value, 10);
-      return n > 0 && m <= 43200 ? m : 0;
-    }
-
-    function updateExtend() {
-      const m = extendMinutes();
-      document.querySelectorAll('#extendChips .chip-btn').forEach(b => b.classList.toggle('on', +b.dataset.m === m));
-      const btn = document.getElementById('extendConfirm');
-      btn.disabled = !m;
-      btn.innerText = m ? `延长 ${fmtMinutes(m)}` : '请输入 1 分钟到 30 天';
-    }
-
-    async function confirmExtend() {
-      const m = extendMinutes();
-      if (!extendTarget || !m) return;
-      const btn = document.getElementById('extendConfirm');
-      btn.disabled = true;
-      btn.innerText = '处理中…';
-      const res = await fetch(`${scopeBase(extendTarget.key)}/leases/extend`, {
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ ip: extendTarget.ip, minutes: m })
-      });
-      if (!res.ok) { alert('延长失败: ' + await apiError(res)); updateExtend(); return; }
-      closeExtendModal();
-      await fetchTunnels();
-    }
-
     async function revokeLease(key, ip) {
       if (!confirm(ip ? `撤销 ${ip} 的访问权限？该设备的连接会被立即断开。` : '撤销全部已授权设备？')) return;
       const res = await fetch(`${scopeBase(key)}/leases/revoke`, {
@@ -1875,14 +1598,6 @@
       if (!res.ok) alert('撤销失败: ' + await apiError(res));
     }
 
-    // 通道组的在线连接可以按设备（来源 IP）或按组内地址查看
-    let drawerByAddress = false;
-    function setDrawerDimension(v) {
-      drawerByAddress = v;
-      renderDrawerClients();
-    }
-    const hostOfAddr = a => { const m = /^\[(.+)\]:\d+$/.exec(a) || /^([^:]+):\d+$/.exec(a); return m ? m[1] : a; };
-
     function renderDrawerClients() {
       if (!drawerScope) return;
       const info = scopeInfo(drawerScope);
@@ -1901,45 +1616,15 @@
       // 同一 IP 的连接合并展示
       const groups = {};
       list.forEach(c => {
-        const ip = hostOfAddr(c.client_ip);
+        const m = /^\[(.+)\]:\d+$/.exec(c.client_ip) || /^([^:]+):\d+$/.exec(c.client_ip);
+        const ip = m ? m[1] : c.client_ip;
         (groups[ip] = groups[ip] || []).push(c);
       });
       const leaseNames = new Map(info.leases.map(l => [l.ip, l.name || '']));
       const sum = (arr, k) => arr.reduce((a, c) => a + (c[k] || 0), 0);
       const ips = Object.keys(groups).sort((x, y) => groups[y].length - groups[x].length || x.localeCompare(y));
-      const byAddress = info.group && drawerByAddress;
-      const inUse = new Set(list.map(c => c.tunnel_id)).size;
-      const toggle = info.group ? `<span class="dim-toggle"><button type="button" class="${byAddress ? '' : 'on'}" onclick="setDrawerDimension(false)">按设备</button><button type="button" class="${byAddress ? 'on' : ''}" onclick="setDrawerDimension(true)">按地址</button></span>` : '';
-      const header = `<b style="font-size:13px; display:block; margin-bottom:10px;">在线连接 (${byAddress ? `${inUse}/${info.members.length} 个地址在用` : `${ips.length} 台 · ${list.length} 连接`})${toggle}</b>`;
 
-      if (byAddress) {
+      container.innerHTML = parts.pending + `<b style="font-size:13px; display:block; margin-bottom:10px;">在线连接 (${ips.length} 台 · ${list.length} 连接)</b>` + ips.map(ip => {
-        container.innerHTML = parts.pending + header + info.members.map(t => {
-          const conns = list.filter(c => c.tunnel_id === t.id);
-          const byIp = {};
-          conns.forEach(c => { const ip = hostOfAddr(c.client_ip); (byIp[ip] = byIp[ip] || []).push(c); });
-          const devs = Object.keys(byIp).sort();
-          const kill = cs => escapeHtml(JSON.stringify(cs.map(c => c.conn_id)));
-          return `
-            <div style="background: rgba(15, 23, 42, 0.7); border: 1px solid var(--card-border); border-radius: 8px; padding: 12px 14px; margin-bottom: 10px; ${conns.length ? '' : 'opacity: 0.55;'}">
-              <div style="display: flex; justify-content: space-between; align-items: center; gap: 8px;">
-                <div style="font-size: 13px;">
-                  <code style="color: #38bdf8; font-weight: 600;">${escapeHtml(publicHost)}:${t.listen_port}</code> <span class="route-arrow">➔</span> <code>${escapeHtml(t.target)}</code>
-                  <span style="font-size: 11px; color: var(--text-muted); margin-left: 6px;">${conns.length ? `${devs.length} 台设备 · ${conns.length} 个连接` : (t.enabled ? '无连接' : '已关闭')}</span>
-                </div>
-                ${conns.length ? `<button class="btn-danger btn-sm" onclick='killConns(${kill(conns)})'>全部断开</button>` : ''}
-              </div>
-              ${devs.map(ip => `
-                <div style="display: flex; justify-content: space-between; align-items: center; font-size: 12px; color: var(--text-muted); padding: 6px 0 0;">
-                  <span><code style="color: var(--text);">${escapeHtml(ip)}</code>${leaseNames.get(ip) ? ` <span style="color: #34d399;">${escapeHtml(leaseNames.get(ip))}</span>` : ''}
-                    · ${byIp[ip].length} 个连接 · ↑ ${formatRate(sum(byIp[ip], 'rate_in'))} / ↓ ${formatRate(sum(byIp[ip], 'rate_out'))}</span>
-                  <button class="btn-secondary btn-sm" onclick='killConns(${kill(byIp[ip])})'>断开</button>
-                </div>`).join('')}
-            </div>`;
-        }).join('') + parts.auth;
-        return;
-      }
-
-      container.innerHTML = parts.pending + header + ips.map(ip => {
         const conns = groups[ip];
         const first = conns.map(c => new Date(c.connected_at)).sort((x, y) => x - y)[0];
         const ids = conns.map(c => c.conn_id);
@@ -2023,8 +1708,6 @@
       }
       const m = g.metrics || {}, key = escapeHtml('g:' + g.id);
       if ((m.pending || []).length) parts.push(`<span class="chip orange" onclick="openDrawer('${key}')">🔔 待审批 ${m.pending.length}</span>`);
-      const asks = (g.renewals || []).filter(r => r.request).length;
-      if (asks) parts.push(`<span class="chip orange" onclick="openDrawer('${key}')">⏱ 申请延长 ${asks}</span>`);
       if ((m.dynamic_leases || []).length) parts.push(`<span class="chip green" onclick="openDrawer('${key}')">已授权 ${m.dynamic_leases.length} 台 ›</span>`);
       return parts.join('');
     }

core/protocol/messages.go

@@ -1,11 +1,6 @@
 package protocol
 
-import (
+import "time"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-)
 
 // Message types
 const (
@@ -23,8 +18,6 @@ const (
 	TypeRevokeInvite   = "revoke_invite"
 	TypeDecideRequest  = "decide_request"
 	TypeDeleteGroup    = "delete_group"
-	TypeExtendLease    = "extend_lease"
-	TypeExtendResp     = "extend_lease_resp"
 	TypeMetrics        = "metrics_update"
 	TypePing           = "ping"
 	TypePong           = "pong"
@@ -101,8 +94,6 @@ type RegisterRespMessage struct {
 type UnregisterMessage struct {
 	Type     string `json:"type"`
 	TunnelID string `json:"tunnel_id"`
-	// Deleted 为 true 表示通道被删除：连同可延长的授权记录一起清除；否则只是关闭
-	Deleted bool `json:"deleted,omitempty"`
 }
 
 // UnregisterRespMessage response to unregister
@@ -139,8 +130,7 @@ type DeleteGroupMessage struct {
 	GroupID string `json:"group_id"`
 }
 
-// Lease durations (Invite.LeaseDuration)：通过邀请获得授权后可访问多久。
+// Lease durations (Invite.LeaseDuration)：通过邀请获得授权后可访问多久
-// 除下列取值外，也可以是分钟数，如 "30m"、"90m"（见 LeaseMinutes）。
 const (
 	LeaseDuration1h     = "1h"
 	LeaseDuration2h     = "2h"
@@ -149,75 +139,32 @@ const (
 	LeaseDurationTunnel = "tunnel" // 通道开启期间有效
 )
 
-// 自定义授权时长的范围（分钟）
-const (
-	MinLeaseMinutes = 5
-	MaxLeaseMinutes = 30 * 24 * 60
-)
-
-// LeaseMinutes returns how many minutes a fixed-length lease duration lasts ("" means 2 hours);
-// false for "today", "tunnel" and invalid values
-func LeaseMinutes(d string) (int, bool) {
-	switch d {
-	case "", LeaseDuration2h:
-		return 120, true
-	case LeaseDuration1h:
-		return 60, true
-	case LeaseDuration8h:
-		return 480, true
-	}
-	if !strings.HasSuffix(d, "m") {
-		return 0, false
-	}
-	n, err := strconv.Atoi(strings.TrimSuffix(d, "m"))
-	if err != nil || n < MinLeaseMinutes || n > MaxLeaseMinutes {
-		return 0, false
-	}
-	return n, true
-}
-
-// LeaseDurationOf is the lease duration value for a number of minutes
-func LeaseDurationOf(minutes int) string {
-	return fmt.Sprintf("%dm", minutes)
-}
-
 // ValidLeaseDuration reports whether d is a supported lease duration ("" means default 2h)
 func ValidLeaseDuration(d string) bool {
-	if d == LeaseDurationToday || d == LeaseDurationTunnel {
+	switch d {
+	case "", LeaseDuration1h, LeaseDuration2h, LeaseDuration8h, LeaseDurationToday, LeaseDurationTunnel:
 		return true
 	}
-	_, ok := LeaseMinutes(d)
+	return false
-	return ok
-}
-
-// DescribeMinutes renders a duration in minutes: "30 分钟"、"2 小时"、"1 小时 30 分钟"、"3 天"
-func DescribeMinutes(n int) string {
-	switch {
-	case n >= 1440 && n%1440 == 0:
-		return fmt.Sprintf("%d 天", n/1440)
-	case n >= 60 && n%60 == 0:
-		return fmt.Sprintf("%d 小时", n/60)
-	case n > 60:
-		return fmt.Sprintf("%d 小时 %d 分钟", n/60, n%60)
-	default:
-		return fmt.Sprintf("%d 分钟", n)
-	}
 }
 
 // DescribeLeaseDuration is the human-readable lease duration
 func DescribeLeaseDuration(d string) string {
 	switch d {
+	case LeaseDuration1h:
+		return "1 小时"
+	case LeaseDuration8h:
+		return "8 小时"
 	case LeaseDurationToday:
 		return "当天有效"
 	case LeaseDurationTunnel:
 		return "通道开启期间有效"
-	}
+	default:
-	if n, ok := LeaseMinutes(d); ok {
-		return DescribeMinutes(n)
-	}
 		return "2 小时"
 	}
+}
 
+// DynamicLease is a temporary whitelist entry granted through an invite link
 type DynamicLease struct {
 	IP        string    `json:"ip"`
 	ExpiresAt time.Time `json:"expires_at"`
@@ -261,45 +208,6 @@ type AccessRequest struct {
 	Invite   string    `json:"invite,omitempty"`
 	At       time.Time `json:"at"`
 	Status   string    `json:"status"` // pending / approved / rejected
-	// Renewal 为 true 表示授权已结束（或即将结束）的设备申请延长；由管理员批准时决定延长多久
-	Renewal bool `json:"renewal,omitempty"`
-}
-
-// RenewalInfo is a device whose access can still be extended: it ended less than two hours ago
-// (even if its tunnel has been closed since), or it asked to extend an access that is still running.
-type RenewalInfo struct {
-	TunnelID string `json:"tunnel_id,omitempty"`
-	GroupID  string `json:"group_id,omitempty"`
-	IP       string `json:"ip"`
-	Name     string `json:"name,omitempty"`
-	Invite   string `json:"invite,omitempty"`
-	// EndedAt 访问结束的时间（授权到期或通道关闭）；授权仍有效时为空
-	EndedAt *time.Time `json:"ended_at,omitempty"`
-	// RenewBefore 可以延长的截止时间（结束后 2 小时）
-	RenewBefore *time.Time `json:"renew_before,omitempty"`
-	// Request 该设备待处理的延长申请
-	Request *AccessRequest `json:"request,omitempty"`
-}
-
-// ExtendLeaseMessage extends a device's access by Minutes: a running lease from its expiry, an
-// ended one (within two hours) from now. It approves the pending renewal requests of that device,
-// and is not capped by the tunnel's own maximum open time.
-type ExtendLeaseMessage struct {
-	Type      string `json:"type"`
-	RequestID string `json:"request_id"` // 用于匹配 ExtendLeaseRespMessage
-	TunnelID  string `json:"tunnel_id"`
-	GroupID   string `json:"group_id,omitempty"`
-	IP        string `json:"ip"`
-	Minutes   int    `json:"minutes"`
-}
-
-// ExtendLeaseRespMessage answers ExtendLeaseMessage with the new expiry
-type ExtendLeaseRespMessage struct {
-	Type      string    `json:"type"`
-	RequestID string    `json:"request_id"`
-	Success   bool      `json:"success"`
-	Error     string    `json:"error,omitempty"`
-	ExpiresAt time.Time `json:"expires_at"`
 }
 
 // CreateInviteMessage asks the server to create an invite link
@@ -413,8 +321,6 @@ type MetricsMessage struct {
 	Groups         []GroupMetrics   `json:"groups,omitempty"`
 	ActiveConns    []ActiveConnInfo `json:"active_conns"`
 	SecurityEvents []SecurityEvent  `json:"security_events,omitempty"`
-	// Renewals 可延长的设备与延长申请，包括已关闭的通道
-	Renewals []RenewalInfo `json:"renewals,omitempty"`
 }
 
 // StreamHandshake sent as first line when a data stream is opened

docs/images/invite-flow.svg

@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 210" width="960" height="210" role="img" aria-label="邀请流程：生成邀请链接、同事打开链接填写姓名、可选的管理员审批、首次连接开始计时、到期自动断开，结束后 2 小时内可申请延长">
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 960 210" width="960" height="210" role="img" aria-label="邀请流程：生成邀请链接、同事打开链接填写姓名、可选的管理员审批、首次连接开始计时、到期自动断开">
   <style>
     svg {
       --bg: #f8fafc; --track: #e2e8f0; --ring: #cbd5e1; --base: #ffffff; --text: #0f172a; --sub: #64748b; --accent: #2563eb; --on: #ffffff;
@@ -68,8 +68,8 @@
     <text class="numon" x="665" y="67.5" text-anchor="middle">4</text>
   </g>
   <text class="title" x="665" y="116" text-anchor="middle">首次连接起计时</text>
-  <text class="sub" x="665" y="140" text-anchor="middle">30 分钟 / 2 小时 / 当天</text>
+  <text class="sub" x="665" y="140" text-anchor="middle">2 小时 / 8 小时 / 当天</text>
-  <text class="sub" x="665" y="160" text-anchor="middle">也可以自定义时长</text>
+  <text class="sub" x="665" y="160" text-anchor="middle">或直到通道关闭</text>
   <circle class="ring" cx="850" cy="62" r="20"/>
   <text class="num" x="850" y="67.5" text-anchor="middle">5</text>
   <g class="on5">
@@ -78,5 +78,5 @@
   </g>
   <text class="title" x="850" y="116" text-anchor="middle">到期自动断开</text>
   <text class="sub" x="850" y="140" text-anchor="middle">已建立的连接一并断开</text>
-  <text class="sub" x="850" y="160" text-anchor="middle">2 小时内可申请延长</text>
+  <text class="sub" x="850" y="160" text-anchor="middle">闲置的通道自动关闭</text>
 </svg>

server/manager.go

@@ -240,7 +240,7 @@ func (m *Manager) handleControlMessage(as *agentSession, msgType string, raw []b
 	case protocol.TypeUnregister:
 		var msg protocol.UnregisterMessage
 		if json.Unmarshal(raw, &msg) == nil {
-			m.unregisterTunnel(as, msg.TunnelID, msg.Deleted)
+			m.unregisterTunnel(as, msg.TunnelID)
 			as.send(protocol.UnregisterRespMessage{Type: protocol.TypeUnregisterResp, TunnelID: msg.TunnelID, Success: true})
 		}
 
@@ -274,12 +274,6 @@ func (m *Manager) handleControlMessage(as *agentSession, msgType string, raw []b
 			m.decideRequest(scopeOf(msg.TunnelID, msg.GroupID), msg.RequestID, msg.Approve)
 		}
 
-	case protocol.TypeExtendLease:
-		var msg protocol.ExtendLeaseMessage
-		if json.Unmarshal(raw, &msg) == nil {
-			as.send(m.extendLease(msg))
-		}
-
 	case protocol.TypeDeleteGroup:
 		var msg protocol.DeleteGroupMessage
 		if json.Unmarshal(raw, &msg) == nil && msg.GroupID != "" {
@@ -355,19 +349,14 @@ func (m *Manager) registerTunnel(as *agentSession, cfg protocol.TunnelConfig) pr
 	return registerResp(cfg, nil)
 }
 
-func (m *Manager) unregisterTunnel(as *agentSession, tunnelID string, deleted bool) {
+func (m *Manager) unregisterTunnel(as *agentSession, tunnelID string) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	if m.active != as {
 		return
 	}
-	// 主动关闭通道时，放通、邀请链接与待审批申请一并失效，已授权的设备 2 小时内仍可申请延长；
+	// 主动关闭/删除通道时，放通、邀请链接与待审批申请一并失效（断线重连不会走到这里）
-	// 删除通道则全部清除（断线重连不会走到这里）
+	m.state.forgetScope(tunnelID)
-	if deleted {
-		m.state.dropScope(tunnelID)
-	} else {
-		m.state.closeScope(tunnelID)
-	}
 	if t, exists := m.tunnels[tunnelID]; exists {
 		t.Close()
 		delete(m.portMap, t.ListenPort())
@@ -512,12 +501,8 @@ func scopeExpiresOf(tunnels []*Tunnel) *time.Time {
 // syncAccess makes a tunnel's temporary allowlist match the access state — its own leases plus
 // those of its group — and disconnects clients that are no longer permitted.
 func (m *Manager) syncAccess(t *Tunnel) int {
-	m.state.setName(t.ID(), t.Name())
 	leases := m.state.leaseExpiries(t.ID())
 	if gid := t.GroupID(); gid != "" {
-		if name := t.Snapshot().GroupName; name != "" {
-			m.state.setName(groupScope(gid), name)
-		}
 		for ip, exp := range m.state.leaseExpiries(groupScope(gid)) {
 			if cur, ok := leases[ip]; !ok || exp.After(cur) {
 				leases[ip] = exp
@@ -536,19 +521,19 @@ func (m *Manager) syncScope(scope string) int {
 	return kicked
 }
 
-// forgetGroupIfEmptyLocked closes a group's shared access state once none of its tunnels is open
+// forgetGroupIfEmptyLocked drops a group's shared access state once none of its tunnels is open.
-// (ended devices can still ask for an extension). Caller must hold m.mu.
+// Caller must hold m.mu.
 func (m *Manager) forgetGroupIfEmptyLocked(groupID string) {
 	if groupID == "" || len(m.groupMembersLocked(groupID)) > 0 {
 		return
 	}
-	m.state.closeScope(groupScope(groupID))
+	m.state.forgetScope(groupScope(groupID))
 }
 
-// deleteGroup drops a dissolved group's invites, leases, requests and renewal records
+// deleteGroup drops a dissolved group's invites, leases and requests
 func (m *Manager) deleteGroup(groupID string) {
 	scope := groupScope(groupID)
-	m.state.dropScope(scope)
+	m.state.forgetScope(scope)
 	kicked := m.syncScope(scope)
 	log.Printf("[WebAuth] Tunnel group %s dissolved, disconnected %d client(s)", groupID, kicked)
 }
@@ -584,6 +569,9 @@ func (m *Manager) revokeInvite(scope, code string) {
 
 func (m *Manager) decideRequest(scope, requestID string, approve bool) {
 	tunnels := m.scopeTunnels(scope)
+	if len(tunnels) == 0 {
+		return
+	}
 	r, _, err := m.state.decide(scope, requestID, approve, scopeExpiresOf(tunnels))
 	if err != nil {
 		return
@@ -594,26 +582,6 @@ func (m *Manager) decideRequest(scope, requestID string, approve bool) {
 	log.Printf("[WebAuth] Request from %s (%s) on %s: %s", r.Name, r.IP, m.scopeName(scope), r.Status)
 }
 
-// extendLease extends a device's access (approving its renewal requests); the scope may be
-// closed — the Agent reopens it, and registering re-applies the lease.
-func (m *Manager) extendLease(msg protocol.ExtendLeaseMessage) protocol.ExtendLeaseRespMessage {
-	resp := protocol.ExtendLeaseRespMessage{Type: protocol.TypeExtendResp, RequestID: msg.RequestID}
-	scope := scopeOf(msg.TunnelID, msg.GroupID)
-	if msg.Minutes < 1 || msg.Minutes > protocol.MaxLeaseMinutes || msg.IP == "" {
-		resp.Error = "延长时长须在 1 分钟到 30 天之间"
-		return resp
-	}
-	exp, err := m.state.extendLease(scope, msg.IP, msg.Minutes)
-	if err != nil {
-		resp.Error = err.Error()
-		return resp
-	}
-	m.syncScope(scope)
-	resp.Success, resp.ExpiresAt = true, exp
-	log.Printf("[WebAuth] Extended %s on %s by %s, until %s", msg.IP, m.scopeName(scope), protocol.DescribeMinutes(msg.Minutes), exp.Format("01-02 15:04"))
-	return resp
-}
-
 // onClientConnect starts the countdown of a device's lease on its first connection.
 // 组授权在首次连上组内任意一个通道时开始计时。
 func (m *Manager) onClientConnect(tunnelID, ip string) {
@@ -710,7 +678,6 @@ func (m *Manager) metricsLoop(as *agentSession) {
 			Groups:         groupMetrics,
 			ActiveConns:    allActiveConns,
 			SecurityEvents: secCopy,
-			Renewals:       m.state.renewalList(),
 		})
 	}
 }

server/manager_test.go

@@ -575,9 +575,8 @@ func TestRevokeInviteRemovesItsLeases(t *testing.T) {
 	if hit(cfg.ListenPort) == "OK" {
 		t.Fatal("leases of revoked invite still active")
 	}
-	// 用过它的设备看到「授权已撤销」，不能申请延长
+	if status, _ := httpGet(t, addr, "/i/"+inv.Code, nil); status != 404 {
-	if status, body := httpGet(t, addr, "/i/"+inv.Code, nil); status != 403 || !strings.Contains(body, "授权已撤销") {
+		t.Fatal("revoked invite still usable")
-		t.Fatalf("revoked invite still usable: %d", status)
 	}
 }
 

server/readme_pages_test.go

@@ -1,85 +0,0 @@
-package server
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DeepFal/PortRelay/core/acl"
-	"github.com/DeepFal/PortRelay/core/protocol"
-	"github.com/DeepFal/PortRelay/core/traffic"
-)
-
-// TestReadmePages 用模拟状态生成 README 截图用的授权页 HTML（tools/ui-snapshots/web.sh 调用），平时跳过。
-// 通道只放在内存里，不监听端口；访问者 IP 直接写在请求上。
-func TestReadmePages(t *testing.T) {
-	out := os.Getenv("PORTRELAY_README_PAGES")
-	if out == "" {
-		t.Skip("PORTRELAY_README_PAGES not set")
-	}
-	m := NewManager(33000, 34000, testToken)
-	m.PublicHost = "192.168.1.10"
-	cfg := protocol.TunnelConfig{ID: "mysql", Name: "MySQL 数据库", Target: "10.0.1.16:3306", ListenPort: 33660, Enabled: true}
-	m.mu.Lock()
-	m.tunnels[cfg.ID] = &Tunnel{Config: cfg, whitelist: acl.NewWhitelist(nil), activeConns: map[string]*ActiveClient{},
-		meter: traffic.NewMeter(), closed: make(chan struct{})}
-	m.mu.Unlock()
-
-	do := func(method, path, ip string, form url.Values) *httptest.ResponseRecorder {
-		var body io.Reader
-		if form != nil {
-			body = strings.NewReader(form.Encode())
-		}
-		r := httptest.NewRequest(method, "http://192.168.1.10:33000"+path, body)
-		if form != nil {
-			r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		}
-		r.RemoteAddr = ip + ":52000"
-		w := httptest.NewRecorder()
-		m.handleHTTPRequest(w, r)
-		return w
-	}
-	follow := func(w *httptest.ResponseRecorder, ip string) *httptest.ResponseRecorder {
-		if loc := w.Header().Get("Location"); loc != "" {
-			return do(http.MethodGet, loc, ip, nil)
-		}
-		return w
-	}
-	save := func(name string, w *httptest.ResponseRecorder) {
-		t.Helper()
-		if w.Code != http.StatusOK {
-			t.Fatalf("%s: %d %s", name, w.Code, w.Body)
-		}
-		if err := os.WriteFile(filepath.Join(out, name+".html"), w.Body.Bytes(), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	// ① 打开邀请链接 → ③ 授权成功
-	inv := m.state.createInvite(cfg.ID, "张三", 24*time.Hour, 1, "2h", false)
-	save("auth-form", do(http.MethodGet, "/i/"+inv.Code, "192.168.1.21", nil))
-	save("auth-ok", do(http.MethodPost, "/auth", "192.168.1.21", url.Values{"code": {inv.Code}, "name": {"张三"}}))
-
-	// ② 需要审批
-	ask := m.state.createInvite(cfg.ID, "测试组", 24*time.Hour, 0, "today", true)
-	save("auth-pending", follow(do(http.MethodPost, "/auth", "192.168.1.88", url.Values{"code": {ask.Code}, "name": {"李四"}}), "192.168.1.88"))
-
-	// ④ ⑤ ⑥ 两小时前开始使用、20 分钟前到期，再打开链接申请延长，管理员批准 2 小时
-	ip := "192.168.1.47"
-	rn := m.state.createInvite(cfg.ID, "赵六", 24*time.Hour, 1, "2h", false)
-	do(http.MethodPost, "/auth", ip, url.Values{"code": {rn.Code}, "name": {"赵六"}})
-	m.state.startLease(cfg.ID, ip, nil, time.Now().Add(-140*time.Minute))
-	save("auth-renew", do(http.MethodGet, "/i/"+rn.Code, ip, nil))
-	status := do(http.MethodPost, "/renew", ip, url.Values{"code": {rn.Code}})
-	save("auth-renew-pending", follow(status, ip))
-	if resp := m.extendLease(protocol.ExtendLeaseMessage{TunnelID: cfg.ID, IP: ip, Minutes: 120}); !resp.Success {
-		t.Fatal(resp.Error)
-	}
-	save("auth-renew-ok", follow(status, ip))
-}

server/renew_test.go

@@ -1,245 +0,0 @@
-package server
-
-import (
-	"encoding/json"
-	"io"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DeepFal/PortRelay/core/protocol"
-)
-
-// linkOnly registers a tunnel that only invited devices can reach
-func linkOnly(t *testing.T, a *testAgent, id string) protocol.TunnelConfig {
-	t.Helper()
-	cfg := tunnelCfg(id, freePort(t))
-	cfg.Whitelist = nil
-	if resp := a.register(t, protocol.TypeRegisterTunnel, cfg); !resp.Success {
-		t.Fatal(resp.Error)
-	}
-	return cfg
-}
-
-// grantVia uses an invite from 127.0.0.1 and connects once so the countdown starts
-func grantVia(t *testing.T, m *Manager, addr string, cfg protocol.TunnelConfig, code string) {
-	t.Helper()
-	if status, _, body := postForm(t, addr, code, "张三"); status != 200 {
-		t.Fatalf("grant: %d %s", status, body)
-	}
-	if hit(cfg.ListenPort) != "OK" {
-		t.Fatal("granted device cannot connect")
-	}
-	waitFor(t, func() bool { l := m.state.leaseList(cfg.ID); return len(l) == 1 && !l[0].AwaitingConnect })
-}
-
-// expire moves a lease's end into the past by ago
-func expire(m *Manager, scope, ip string, ago time.Duration) {
-	m.state.mu.Lock()
-	l := m.state.data[scope].Leases[ip]
-	l.ExpiresAt = time.Now().Add(-ago)
-	m.state.data[scope].Leases[ip] = l
-	m.state.mu.Unlock()
-	m.syncScope(scope)
-}
-
-// renew presses「申请延长」and returns the status page path
-func renew(t *testing.T, addr, code string) string {
-	t.Helper()
-	resp, err := noRedirect.PostForm("http://"+addr+"/renew", url.Values{"code": {code}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer resp.Body.Close()
-	b, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode != 303 || !strings.HasPrefix(resp.Header.Get("Location"), "/auth/status?id=") {
-		t.Fatalf("renew: %d %s", resp.StatusCode, b)
-	}
-	return resp.Header.Get("Location")
-}
-
-func (a *testAgent) extend(t *testing.T, tunnelID, ip string, minutes int) protocol.ExtendLeaseRespMessage {
-	t.Helper()
-	a.send(t, protocol.ExtendLeaseMessage{Type: protocol.TypeExtendLease, RequestID: "e1", TunnelID: tunnelID, IP: ip, Minutes: minutes})
-	var resp protocol.ExtendLeaseRespMessage
-	_ = json.Unmarshal(a.next(t), &resp)
-	return resp
-}
-
-func TestRenewAfterExpiry(t *testing.T) {
-	m := newTestManager()
-	addr := startServer(t, m)
-	a := dialAgent(t, addr, testToken)
-	a.expectAuth(t)
-	cfg := linkOnly(t, a, "a")
-	inv := a.createInviteWith(t, "a", 1, "30m")
-	grantVia(t, m, addr, cfg, inv.Code)
-
-	// 授权有效时再打开链接：显示剩余时间与「申请延长」，不会重新授权
-	if _, body := httpGet(t, addr, "/i/"+inv.Code, nil); !strings.Contains(body, "访问已授权") || !strings.Contains(body, "申请延长") {
-		t.Fatalf("running access page: %s", body)
-	}
-
-	expire(m, "a", "127.0.0.1", time.Minute)
-	waitFor(t, func() bool { return hit(cfg.ListenPort) != "OK" })
-	if _, body := httpGet(t, addr, "/i/"+inv.Code, nil); !strings.Contains(body, "访问已结束") || !strings.Contains(body, "申请延长") {
-		t.Fatalf("ended access page: %s", body)
-	}
-	// 用过链接的设备不能再直接授权
-	if status, _, _ := postForm(t, addr, inv.Code, "张三"); status != 409 {
-		t.Fatalf("a returning device must not be re-granted directly, got %d", status)
-	}
-
-	status := renew(t, addr, inv.Code)
-	if _, body := httpGet(t, addr, status, nil); !strings.Contains(body, "等待管理员批准") {
-		t.Fatalf("pending renewal page: %s", body)
-	}
-	if again := renew(t, addr, inv.Code); again != status {
-		t.Fatal("one device should have one pending renewal")
-	}
-	rl := m.state.renewalList()
-	if len(rl) != 1 || rl[0].Request == nil || rl[0].EndedAt == nil || rl[0].TunnelID != "a" || rl[0].Name != "张三" {
-		t.Fatalf("renewal list: %+v", rl)
-	}
-	if p := m.state.pendingList("a"); len(p) != 0 {
-		t.Fatalf("renewals are not first-time requests: %+v", p)
-	}
-
-	resp := a.extend(t, "a", "127.0.0.1", 45)
-	if !resp.Success || time.Until(resp.ExpiresAt) < 44*time.Minute || time.Until(resp.ExpiresAt) > 46*time.Minute {
-		t.Fatalf("extend an ended lease from now: %+v", resp)
-	}
-	if hit(cfg.ListenPort) != "OK" {
-		t.Fatal("extended device cannot connect")
-	}
-	if _, body := httpGet(t, addr, status, nil); !strings.Contains(body, "延长已批准") {
-		t.Fatalf("approved renewal page: %s", body)
-	}
-	if rl := m.state.renewalList(); len(rl) != 0 {
-		t.Fatalf("nothing left to renew: %+v", rl)
-	}
-}
-
-func TestRenewAfterTunnelClosed(t *testing.T) {
-	m := newTestManager()
-	addr := startServer(t, m)
-	a := dialAgent(t, addr, testToken)
-	a.expectAuth(t)
-	cfg := linkOnly(t, a, "a")
-	inv := a.createInvite(t, "a", 1)
-	grantVia(t, m, addr, cfg, inv.Code)
-
-	a.send(t, protocol.UnregisterMessage{Type: protocol.TypeUnregister, TunnelID: "a"})
-	a.next(t)
-	_, body := httpGet(t, addr, "/i/"+inv.Code, nil)
-	if !strings.Contains(body, "访问已结束") || !strings.Contains(body, "通道当前已关闭") || !strings.Contains(body, "目标通道") {
-		t.Fatalf("closed tunnel page: %s", body)
-	}
-	status := renew(t, addr, inv.Code)
-	if _, body := httpGet(t, addr, status, nil); !strings.Contains(body, "等待管理员批准") || !strings.Contains(body, "自动重新开启") {
-		t.Fatalf("pending renewal on a closed tunnel: %s", body)
-	}
-	// 拒绝也不需要通道开启
-	a.send(t, protocol.DecideRequestMessage{Type: protocol.TypeDecideRequest, TunnelID: "a", RequestID: m.state.renewalList()[0].Request.ID, Approve: false})
-	waitFor(t, func() bool {
-		_, b := httpGet(t, addr, status, nil)
-		return strings.Contains(b, "拒绝了您的延长申请")
-	})
-
-	// 再申请一次，批准后 Agent 重新开启通道，授权随注册生效
-	status = renew(t, addr, inv.Code)
-	if resp := a.extend(t, "a", "127.0.0.1", 60); !resp.Success {
-		t.Fatalf("extend while closed: %s", resp.Error)
-	}
-	if _, body := httpGet(t, addr, status, nil); !strings.Contains(body, "正在开启通道") {
-		t.Fatalf("approved while closed: %s", body)
-	}
-	if resp := a.register(t, protocol.TypeRegisterTunnel, cfg); !resp.Success {
-		t.Fatal(resp.Error)
-	}
-	if hit(cfg.ListenPort) != "OK" {
-		t.Fatal("the reopened tunnel must admit the extended device")
-	}
-}
-
-func TestRenewWindowRevokeAndDelete(t *testing.T) {
-	m := newTestManager()
-	addr := startServer(t, m)
-	a := dialAgent(t, addr, testToken)
-	a.expectAuth(t)
-	cfg := linkOnly(t, a, "a")
-	inv := a.createInvite(t, "a", 0)
-	grantVia(t, m, addr, cfg, inv.Code)
-
-	// 结束超过 2 小时：只能重新邀请
-	expire(m, "a", "127.0.0.1", renewWindow+time.Minute)
-	if _, body := httpGet(t, addr, "/i/"+inv.Code, nil); !strings.Contains(body, "超过 2 小时") {
-		t.Fatalf("expired window page: %s", body)
-	}
-	if resp := a.extend(t, "a", "127.0.0.1", 30); resp.Success {
-		t.Fatal("cannot extend after the renewal window")
-	}
-
-	// 撤销的授权不能延长
-	grantTestLease(m, "a", "10.9.9.9", time.Now().Add(time.Hour))
-	a.send(t, protocol.RevokeLeaseMessage{Type: protocol.TypeRevokeLease, TunnelID: "a", IP: "10.9.9.9"})
-	waitFor(t, func() bool { return len(m.state.leaseList("a")) == 0 })
-	if resp := a.extend(t, "a", "10.9.9.9", 30); resp.Success || !strings.Contains(resp.Error, "撤销") {
-		t.Fatalf("revoked access must not be extended: %+v", resp)
-	}
-
-	// 删除通道：连同记录一起清除
-	grantTestLease(m, "a", "10.9.9.8", time.Now().Add(time.Hour))
-	a.send(t, protocol.UnregisterMessage{Type: protocol.TypeUnregister, TunnelID: "a", Deleted: true})
-	a.next(t)
-	if rl := m.state.renewalList(); len(rl) != 0 {
-		t.Fatalf("a deleted tunnel leaves nothing to renew: %+v", rl)
-	}
-	if resp := a.extend(t, "a", "10.9.9.8", 30); resp.Success {
-		t.Fatal("cannot extend on a deleted tunnel")
-	}
-}
-
-func TestExtendRunningLeaseIsNotCappedByTunnelTTL(t *testing.T) {
-	m := newTestManager()
-	addr := startServer(t, m)
-	a := dialAgent(t, addr, testToken)
-	a.expectAuth(t)
-	cfg := tunnelCfg("a", freePort(t))
-	cfg.Whitelist = nil
-	end := time.Now().Add(10 * time.Minute)
-	cfg.ExpiresAt = &end
-	a.register(t, protocol.TypeRegisterTunnel, cfg)
-	inv := a.createInvite(t, "a", 1)
-	grantVia(t, m, addr, cfg, inv.Code)
-	before := m.state.leaseList("a")[0].ExpiresAt
-	if before.After(end.Add(time.Second)) {
-		t.Fatalf("a regular grant is capped by the tunnel TTL: %v > %v", before, end)
-	}
-
-	resp := a.extend(t, "a", "127.0.0.1", 60)
-	if !resp.Success || !resp.ExpiresAt.Equal(before.Add(time.Hour)) {
-		t.Fatalf("a running lease extends from its expiry: %+v (was %v)", resp, before)
-	}
-}
-
-func TestCustomLeaseDurations(t *testing.T) {
-	for d, want := range map[string]int{"30m": 30, "90m": 90, "1h": 60, "": 120, "8h": 480} {
-		if n, ok := protocol.LeaseMinutes(d); !ok || n != want {
-			t.Errorf("LeaseMinutes(%q) = %d, %v", d, n, ok)
-		}
-	}
-	for _, bad := range []string{"3m", "abc", "90", "100000m"} {
-		if protocol.ValidLeaseDuration(bad) {
-			t.Errorf("%q should be invalid", bad)
-		}
-	}
-	if got := protocol.DescribeLeaseDuration("90m"); got != "1 小时 30 分钟" {
-		t.Errorf("describe 90m: %q", got)
-	}
-	now := time.Now()
-	if got := leaseExpiry("45m", nil, now); !got.Equal(now.Add(45 * time.Minute)) {
-		t.Errorf("leaseExpiry 45m: %v", got.Sub(now))
-	}
-}

server/state.go

@@ -25,17 +25,10 @@ const (
 	leaseStartWindow = 24 * time.Hour
 )
 
-// renewWindow 访问结束（授权到期或通道关闭）后多久内还能申请延长；之后清除记录，需要重新邀请
-var renewWindow = 2 * time.Hour
-
 var (
 	errInviteNotFound = errors.New("邀请链接无效或已过期")
 	errInviteUsedUp   = errors.New("该邀请链接的可用设备数已用完，请向管理员索取新的链接")
 	errRequestGone    = errors.New("申请不存在或已过期")
-	errAlreadyUsed    = errors.New("这台设备已经用过该邀请链接，请重新打开链接申请延长")
-	errNothingToRenew = errors.New("访问已结束超过 2 小时，请联系管理员获取新的邀请链接")
-	errRevoked        = errors.New("授权已被管理员撤销，如需继续使用请联系管理员")
-	errNotStarted     = errors.New("授权尚未开始计时（首次连接后才开始），无需延长")
 )
 
 type leaseInfo struct {
@@ -96,27 +89,10 @@ func (s *stateStore) lease(scope, ip string) (leaseInfo, bool) {
 	return leaseInfo{}, false
 }
 
-// leaseRecord remembers a device whose access ended, so it can ask for an extension
-type leaseRecord struct {
-	EndedAt time.Time `json:"ended_at"`
-	Name    string    `json:"name,omitempty"`
-	Invite  string    `json:"invite,omitempty"`
-	// Revoked 为 true 表示被管理员撤销，不能申请延长
-	Revoked bool `json:"revoked,omitempty"`
-}
-
-func (r leaseRecord) renewable(now time.Time) bool {
-	return !r.Revoked && now.Before(r.EndedAt.Add(renewWindow))
-}
-
 type tunnelState struct {
 	Leases   map[string]leaseInfo               `json:"leases,omitempty"`   // ip -> lease
 	Invites  map[string]*protocol.Invite        `json:"invites,omitempty"`  // code -> invite
 	Requests map[string]*protocol.AccessRequest `json:"requests,omitempty"` // id -> request
-	// Ended 访问已结束的设备（ip -> 记录），结束后 renewWindow 内可申请延长；通道关闭后仍保留
-	Ended map[string]leaseRecord `json:"ended,omitempty"`
-	// Name 通道或组最近的名称，通道关闭后用于申请延长页面
-	Name string `json:"name,omitempty"`
 }
 
 // 授权状态的作用范围：单个通道（键为通道 ID，与旧数据兼容）或整个通道组（键为 "group:<组ID>"）
@@ -201,7 +177,7 @@ func (m *Manager) EnableLeasePersistence(path string) error {
 // looksLikeState distinguishes the new format from the legacy one (both are JSON objects of objects)
 func looksLikeState(d map[string]*tunnelState) bool {
 	for _, st := range d {
-		if st == nil || (st.Leases == nil && st.Invites == nil && st.Requests == nil && st.Ended == nil) {
+		if st == nil || (st.Leases == nil && st.Invites == nil && st.Requests == nil) {
 			return false
 		}
 	}
@@ -223,21 +199,9 @@ func (s *stateStore) scopeLocked(id string) *tunnelState {
 	if st.Requests == nil {
 		st.Requests = make(map[string]*protocol.AccessRequest)
 	}
-	if st.Ended == nil {
-		st.Ended = make(map[string]leaseRecord)
-	}
 	return st
 }
 
-// endLeaseLocked turns a lease into an ended record (renewable unless revoked)
-func endLeaseLocked(st *tunnelState, ip string, l leaseInfo, at time.Time, revoked bool) {
-	if st.Ended == nil {
-		st.Ended = make(map[string]leaseRecord)
-	}
-	st.Ended[ip] = leaseRecord{EndedAt: at, Name: l.Name, Invite: l.Invite, Revoked: revoked}
-	delete(st.Leases, ip)
-}
-
 func randomCode(n int) string {
 	const chars = "23456789abcdefghjkmnpqrstuvwxyz"
 	b := make([]byte, n)
@@ -261,25 +225,13 @@ func (s *stateStore) removeLease(scope, ip string) int {
 	if st == nil {
 		return 0
 	}
-	// 被撤销的授权不能再申请延长
-	now := time.Now()
 	n := 0
-	for lip, l := range st.Leases {
+	if ip == "" {
-		if ip == "" || lip == ip {
+		n = len(st.Leases)
-			endLeaseLocked(st, lip, l, now, true)
+		st.Leases = make(map[string]leaseInfo)
-			n++
+	} else if _, ok := st.Leases[ip]; ok {
-		}
+		n = 1
-	}
+		delete(st.Leases, ip)
-	for lip, r := range st.Ended {
-		if ip == "" || lip == ip {
-			r.Revoked = true
-			st.Ended[lip] = r
-		}
-	}
-	for id, r := range st.Requests {
-		if r.Renewal && r.Status == "pending" && (ip == "" || r.IP == ip) {
-			delete(st.Requests, id)
-		}
 	}
 	s.saveLocked()
 	return n
@@ -319,54 +271,8 @@ func (s *stateStore) leaseList(scope string) []protocol.DynamicLease {
 	return out
 }
 
-// closeScope runs when a tunnel, or the last open tunnel of a group, is closed: invites and
+// forgetScope drops all access state of a tunnel or group (explicitly closed, deleted or dissolved)
-// first-time requests become invalid, running leases end — but ended devices are remembered for
+func (s *stateStore) forgetScope(scope string) {
-// renewWindow so they can still ask for an extension.
-func (s *stateStore) closeScope(scope string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	st := s.data[scope]
-	if st == nil {
-		return
-	}
-	now := time.Now()
-	for ip, l := range st.Leases {
-		end := now
-		if l.ExpiresAt.Before(now) {
-			end = l.ExpiresAt
-		}
-		endLeaseLocked(st, ip, l, end, false)
-	}
-	st.Invites = nil
-	for id, r := range st.Requests {
-		if !r.Renewal && r.Status == "pending" {
-			delete(st.Requests, id)
-		}
-	}
-	s.saveLocked()
-}
-
-// scopeDisplayName is the last known name of a scope (for pages shown after it closed)
-func (s *stateStore) scopeDisplayName(scope string) string {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if st := s.data[scope]; st != nil {
-		return st.Name
-	}
-	return ""
-}
-
-// setName records the display name of a scope that has access state
-func (s *stateStore) setName(scope, name string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if st := s.data[scope]; st != nil && name != "" && st.Name != name {
-		st.Name = name
-	}
-}
-
-// dropScope drops all access state of a deleted tunnel or a dissolved group, renewal records included
-func (s *stateStore) dropScope(scope string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if _, ok := s.data[scope]; ok {
@@ -473,13 +379,6 @@ func (s *stateStore) useInviteAndGrant(scope, code, name, ip string, scopeExpire
 	if !ok || !time.Now().Before(inv.ExpiresAt) {
 		return leaseInfo{}, errInviteNotFound
 	}
-	// 已授权的设备再次提交不重新计时；用过链接、授权已结束的设备要申请延长
-	if l, ok := st.Leases[ip]; ok && time.Now().Before(l.ExpiresAt) {
-		return l, nil
-	}
-	if usedByLocked(inv, ip) {
-		return leaseInfo{}, errAlreadyUsed
-	}
 	if !capacityOKLocked(st, inv, ip) {
 		return leaseInfo{}, errInviteUsedUp
 	}
@@ -487,20 +386,10 @@ func (s *stateStore) useInviteAndGrant(scope, code, name, ip string, scopeExpire
 	s.recordUseLocked(st, code, name, ip)
 	l := newLease(name, code, inv.LeaseDuration, scopeExpires, time.Now())
 	st.Leases[ip] = l
-	delete(st.Ended, ip)
 	s.saveLocked()
 	return l, nil
 }
 
-func usedByLocked(inv *protocol.Invite, ip string) bool {
-	for _, u := range inv.Uses {
-		if u.IP == ip {
-			return true
-		}
-	}
-	return false
-}
-
 // revokeInvite removes the invite and the leases it granted; returns the affected IPs
 func (s *stateStore) revokeInvite(scope, code string) []string {
 	s.mu.Lock()
@@ -511,17 +400,10 @@ func (s *stateStore) revokeInvite(scope, code string) []string {
 	}
 	delete(st.Invites, code)
 	var ips []string
-	now := time.Now()
 	for ip, l := range st.Leases {
 		if l.Invite == code {
 			ips = append(ips, ip)
-			endLeaseLocked(st, ip, l, now, true)
+			delete(st.Leases, ip)
-		}
-	}
-	for ip, r := range st.Ended {
-		if r.Invite == code {
-			r.Revoked = true
-			st.Ended[ip] = r
 		}
 	}
 	for id, r := range st.Requests {
@@ -567,15 +449,12 @@ func (s *stateStore) addRequest(scope, code, name, ip string) (protocol.AccessRe
 	}
 	st = s.scopeLocked(scope)
 	for _, r := range st.Requests {
-		if r.IP == ip && r.Status == "pending" && !r.Renewal {
+		if r.IP == ip && r.Status == "pending" {
 			r.Name = name
 			s.saveLocked()
 			return *r, nil
 		}
 	}
-	if usedByLocked(inv, ip) {
-		return protocol.AccessRequest{}, errAlreadyUsed
-	}
 	if !capacityOKLocked(st, inv, ip) {
 		return protocol.AccessRequest{}, errInviteUsedUp
 	}
@@ -628,24 +507,6 @@ func (s *stateStore) decide(scope, id string, approve bool, scopeExpires *time.T
 	if inv, ok := st.Invites[r.Invite]; ok {
 		duration = inv.LeaseDuration
 	}
-	if r.Renewal {
-		// 延长申请通常由 extendLease 按管理员选择的时长批准；这里按邀请的时长（默认 2 小时）处理
-		if !approve {
-			r.Status, r.At = "rejected", time.Now()
-			s.saveLocked()
-			return *r, time.Time{}, nil
-		}
-		minutes, ok := protocol.LeaseMinutes(duration)
-		if !ok {
-			minutes = 120
-		}
-		exp, err := s.extendLocked(st, r.IP, minutes, time.Now())
-		if err != nil {
-			return protocol.AccessRequest{}, time.Time{}, err
-		}
-		s.saveLocked()
-		return *r, exp, nil
-	}
 	l := newLease(r.Name, r.Invite, duration, scopeExpires, time.Now())
 	exp := l.ExpiresAt
 	r.At = time.Now()
@@ -653,7 +514,6 @@ func (s *stateStore) decide(scope, id string, approve bool, scopeExpires *time.T
 		r.Status = "approved"
 		s.recordUseLocked(st, r.Invite, r.Name, r.IP)
 		st.Leases[r.IP] = l
-		delete(st.Ended, r.IP)
 	} else {
 		r.Status = "rejected"
 	}
@@ -668,7 +528,7 @@ func (s *stateStore) pendingList(scope string) []protocol.AccessRequest {
 	var out []protocol.AccessRequest
 	if st := s.data[scope]; st != nil {
 		for _, r := range st.Requests {
-			if r.Status == "pending" && !r.Renewal {
+			if r.Status == "pending" {
 				out = append(out, *r)
 			}
 		}
@@ -677,195 +537,6 @@ func (s *stateStore) pendingList(scope string) []protocol.AccessRequest {
 	return out
 }
 
-// ---- renewals ----
-
-// deviceAccess is what a device that opens an invite link already has in the invite's scope
-type deviceAccess struct {
-	scope   string
-	name    string // 通道或组的名称（通道关闭后为最近一次的名称）
-	lease   *leaseInfo
-	ended   *leaseRecord
-	pending *protocol.AccessRequest // 待处理的延长申请
-	// usedBefore 用过该链接，但访问已结束超过 renewWindow
-	usedBefore bool
-}
-
-// deviceAccess looks up ip's access in the scope of invite code, also after the invite or the
-// tunnel is gone; false when the device never used this invite (a new visitor)
-func (s *stateStore) deviceAccess(code, ip string) (deviceAccess, bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.pruneLocked()
-	now := time.Now()
-	for scope, st := range s.data {
-		inv := st.Invites[code]
-		l, hasLease := st.Leases[ip]
-		rec, hasRec := st.Ended[ip]
-		mine := (inv != nil && usedByLocked(inv, ip)) || (hasLease && l.Invite == code) || (hasRec && rec.Invite == code)
-		if !mine {
-			continue
-		}
-		da := deviceAccess{scope: scope, name: st.Name}
-		switch {
-		case hasLease && now.Before(l.ExpiresAt):
-			da.lease = &l
-		case hasRec && (rec.Revoked || rec.renewable(now)):
-			da.ended = &rec
-		default:
-			da.usedBefore = true
-		}
-		for _, r := range st.Requests {
-			if r.IP == ip && r.Renewal && r.Status == "pending" {
-				c := *r
-				da.pending = &c
-			}
-		}
-		return da, true
-	}
-	return deviceAccess{}, false
-}
-
-// addRenewal files (or re-uses) a renewal request for ip: its lease must be running, or have
-// ended less than renewWindow ago without being revoked
-func (s *stateStore) addRenewal(scope, ip string) (protocol.AccessRequest, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.pruneLocked()
-	st := s.data[scope]
-	if st == nil {
-		return protocol.AccessRequest{}, errNothingToRenew
-	}
-	now := time.Now()
-	var name, invite string
-	if l, ok := st.Leases[ip]; ok && now.Before(l.ExpiresAt) {
-		if l.Deferred {
-			return protocol.AccessRequest{}, errNotStarted
-		}
-		name, invite = l.Name, l.Invite
-	} else if rec, ok := st.Ended[ip]; ok && rec.Revoked {
-		return protocol.AccessRequest{}, errRevoked
-	} else if ok && rec.renewable(now) {
-		name, invite = rec.Name, rec.Invite
-	} else {
-		return protocol.AccessRequest{}, errNothingToRenew
-	}
-	st = s.scopeLocked(scope)
-	for _, r := range st.Requests {
-		if r.IP == ip && r.Renewal && r.Status == "pending" {
-			return *r, nil
-		}
-	}
-	r := &protocol.AccessRequest{ID: randomCode(16), Name: name, IP: ip, Invite: invite, At: now, Status: "pending", Renewal: true}
-	if id, isGroup := splitScope(scope); isGroup {
-		r.GroupID = id
-	} else {
-		r.TunnelID = id
-	}
-	st.Requests[r.ID] = r
-	s.saveLocked()
-	return *r, nil
-}
-
-// extendLease extends ip's access in scope by minutes and approves its pending renewal requests.
-// 不受通道最长开启时长限制：管理员批准的时长优先。
-func (s *stateStore) extendLease(scope, ip string, minutes int) (time.Time, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.pruneLocked()
-	st := s.data[scope]
-	if st == nil {
-		return time.Time{}, errNothingToRenew
-	}
-	exp, err := s.extendLocked(s.scopeLocked(scope), ip, minutes, time.Now())
-	if err != nil {
-		return time.Time{}, err
-	}
-	s.saveLocked()
-	return exp, nil
-}
-
-// extendLocked: a running lease is extended from its expiry (one not yet started starts now),
-// an ended one is restored from now. Caller must hold s.mu and save.
-func (s *stateStore) extendLocked(st *tunnelState, ip string, minutes int, now time.Time) (time.Time, error) {
-	d := time.Duration(minutes) * time.Minute
-	if l, ok := st.Leases[ip]; ok && now.Before(l.ExpiresAt) {
-		if l.Deferred {
-			l.Deferred, l.StartedAt, l.ExpiresAt = false, &now, now.Add(d)
-		} else {
-			l.ExpiresAt = l.ExpiresAt.Add(d)
-		}
-		st.Leases[ip] = l
-	} else if rec, ok := st.Ended[ip]; ok && rec.Revoked {
-		return time.Time{}, errRevoked
-	} else if ok && rec.renewable(now) {
-		st.Leases[ip] = leaseInfo{Name: rec.Name, Invite: rec.Invite, Duration: protocol.LeaseDurationOf(minutes), StartedAt: &now, ExpiresAt: now.Add(d)}
-		delete(st.Ended, ip)
-	} else {
-		return time.Time{}, errNothingToRenew
-	}
-	for _, r := range st.Requests {
-		if r.IP == ip && r.Renewal && r.Status == "pending" {
-			r.Status, r.At = "approved", now
-		}
-	}
-	return st.Leases[ip].ExpiresAt, nil
-}
-
-// renewalList reports, across all scopes (closed ones included), the devices that can still be
-// extended and the pending renewal requests
-func (s *stateStore) renewalList() []protocol.RenewalInfo {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.pruneLocked()
-	now := time.Now()
-	var out []protocol.RenewalInfo
-	for scope, st := range s.data {
-		id, isGroup := splitScope(scope)
-		base := protocol.RenewalInfo{TunnelID: id}
-		if isGroup {
-			base = protocol.RenewalInfo{GroupID: id}
-		}
-		byIP := make(map[string]int)
-		for ip, rec := range st.Ended {
-			if !rec.renewable(now) {
-				continue
-			}
-			info := base
-			end, before := rec.EndedAt, rec.EndedAt.Add(renewWindow)
-			info.IP, info.Name, info.Invite, info.EndedAt, info.RenewBefore = ip, rec.Name, rec.Invite, &end, &before
-			byIP[ip] = len(out)
-			out = append(out, info)
-		}
-		for _, r := range st.Requests {
-			if !r.Renewal || r.Status != "pending" {
-				continue
-			}
-			c := *r
-			if i, ok := byIP[r.IP]; ok {
-				out[i].Request = &c
-				continue
-			}
-			info := base
-			info.IP, info.Name, info.Invite, info.Request = r.IP, r.Name, r.Invite, &c
-			out = append(out, info)
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if (out[i].Request != nil) != (out[j].Request != nil) {
-			return out[i].Request != nil
-		}
-		ti, tj := now, now
-		if out[i].EndedAt != nil {
-			ti = *out[i].EndedAt
-		}
-		if out[j].EndedAt != nil {
-			tj = *out[j].EndedAt
-		}
-		return ti.After(tj)
-	})
-	return out
-}
-
 // ---- housekeeping ----
 
 func (s *stateStore) pruneRequestsLocked() {
@@ -889,12 +560,7 @@ func (s *stateStore) pruneLocked() {
 		}
 		for ip, l := range st.Leases {
 			if !now.Before(l.ExpiresAt) {
-				endLeaseLocked(st, ip, l, l.ExpiresAt, false)
+				delete(st.Leases, ip)
-			}
-		}
-		for ip, r := range st.Ended {
-			if !now.Before(r.EndedAt.Add(renewWindow)) {
-				delete(st.Ended, ip)
 			}
 		}
 		for code, inv := range st.Invites {
@@ -902,7 +568,7 @@ func (s *stateStore) pruneLocked() {
 				delete(st.Invites, code)
 			}
 		}
-		if len(st.Leases) == 0 && len(st.Invites) == 0 && len(st.Requests) == 0 && len(st.Ended) == 0 {
+		if len(st.Leases) == 0 && len(st.Invites) == 0 && len(st.Requests) == 0 {
 			delete(s.data, id)
 		}
 	}
@@ -941,6 +607,10 @@ func (s *stateStore) saveLocked() {
 func leaseExpiry(duration string, scopeExpires *time.Time, now time.Time) time.Time {
 	var exp time.Time
 	switch duration {
+	case protocol.LeaseDuration1h:
+		exp = now.Add(time.Hour)
+	case protocol.LeaseDuration8h:
+		exp = now.Add(8 * time.Hour)
 	case protocol.LeaseDurationToday:
 		y, mo, d := now.Date()
 		exp = time.Date(y, mo, d, 23, 59, 59, 0, now.Location())
@@ -948,11 +618,7 @@ func leaseExpiry(duration string, scopeExpires *time.Time, now time.Time) time.T
 		// 通道开启期间有效：通道被主动关闭时放通会被清除；设一个上限避免永久放通
 		exp = now.Add(30 * 24 * time.Hour)
 	default:
-		minutes, ok := protocol.LeaseMinutes(duration)
+		exp = now.Add(2 * time.Hour)
-		if !ok {
-			minutes = 120
-		}
-		exp = now.Add(time.Duration(minutes) * time.Minute)
 	}
 	if scopeExpires != nil && scopeExpires.After(now) && scopeExpires.Before(exp) {
 		exp = *scopeExpires

server/webauth.go

@@ -31,8 +31,6 @@ func (m *Manager) handleHTTPRequest(w http.ResponseWriter, r *http.Request) {
 		m.serveInviteForm(w, r, r.URL.Query().Get("code"))
 	case path == "/auth/status":
 		m.serveRequestStatus(w, r)
-	case path == "/renew" && r.Method == http.MethodPost:
-		m.serveRenewSubmit(w, r)
 	default:
 		http.NotFound(w, r)
 	}
@@ -110,13 +108,6 @@ func (m *Manager) inviteTarget(code string) (accessScope, protocol.Invite, strin
 
 func (m *Manager) serveInviteForm(w http.ResponseWriter, r *http.Request, code string) {
 	ip := clientIPOf(r)
-	// 用过这个链接的设备：显示它的授权状态，到期前后都可以申请延长（链接或通道失效后也一样）
-	if ip != "" {
-		if da, ok := m.state.deviceAccess(strings.TrimSpace(code), ip); ok {
-			m.serveDeviceAccess(w, r, strings.TrimSpace(code), ip, da)
-			return
-		}
-	}
 	sc, inv, problem := m.inviteTarget(code)
 	if problem == "" && ip == "" {
 		problem = "无法识别客户端 IP"
@@ -151,88 +142,6 @@ func (m *Manager) serveInviteForm(w http.ResponseWriter, r *http.Request, code s
 	m.writePage(w, r, http.StatusOK, pageForm, "申请访问 "+sc.name, body)
 }
 
-// serveDeviceAccess shows a returning device its access and, when it can, the renewal button
-func (m *Manager) serveDeviceAccess(w http.ResponseWriter, r *http.Request, code, ip string, da deviceAccess) {
-	if da.pending != nil {
-		http.Redirect(w, r, "/auth/status?id="+url.QueryEscape(da.pending.ID), http.StatusSeeOther)
-		return
-	}
-	sc, open := m.resolveScope(da.scope)
-	rows := func(validity string) string {
-		if open {
-			return m.detailRows(r, sc, ip, validity)
-		}
-		return closedRows(da, ip, validity)
-	}
-	renewForm := fmt.Sprintf(`
-		<form method="post" action="/renew" class="form">
-		  <input type="hidden" name="code" value="%s">
-		  <button type="submit">申请延长</button>
-		</form>`, html.EscapeString(code))
-	switch {
-	case da.lease != nil && da.lease.Deferred && open:
-		m.writePage(w, r, http.StatusOK, pageSuccess, "已获得访问权限", m.successBody(r, sc, ip, *da.lease))
-	case da.lease != nil && da.lease.Deferred:
-		m.writePage(w, r, http.StatusOK, pageSuccess, "已获得访问权限", rows(leaseValidity(*da.lease)))
-	case da.lease != nil:
-		left := time.Until(da.lease.ExpiresAt).Round(time.Minute)
-		body := rows(fmt.Sprintf("至 %s（剩余 %s）", da.lease.ExpiresAt.Format("01-02 15:04"), protocol.DescribeMinutes(max(1, int(left/time.Minute))))) +
-			`<div class="tip">需要更多时间时可以申请延长，管理员批准后在原到期时间上顺延。</div>` + renewForm
-		m.writePage(w, r, http.StatusOK, pageSuccess, "访问已授权", body)
-	case da.ended != nil && da.ended.Revoked:
-		m.writePage(w, r, http.StatusForbidden, pageError, "授权已撤销", problemHTML(errRevoked.Error()))
-	case da.ended != nil:
-		closedTip := ""
-		if !open {
-			closedTip = "通道当前已关闭，批准后会自动重新开启。"
-		}
-		body := rows("已于 "+da.ended.EndedAt.Format("01-02 15:04")+" 结束") +
-			fmt.Sprintf(`<div class="tip">可在 %s 前申请延长，管理员批准并确定时长后即可继续使用。%s</div>`,
-				da.ended.EndedAt.Add(renewWindow).Format("15:04"), closedTip) + renewForm
-		m.writePage(w, r, http.StatusOK, pageForm, "访问已结束", body)
-	default:
-		m.writePage(w, r, http.StatusGone, pageError, "访问已结束", problemHTML(errNothingToRenew.Error()))
-	}
-}
-
-// closedRows describes a scope whose tunnels are all closed (only its last known name is left)
-func closedRows(da deviceAccess, ip, validity string) string {
-	label := "目标通道"
-	if _, isGroup := splitScope(da.scope); isGroup {
-		label = "目标通道组"
-	}
-	name := da.name
-	if name == "" {
-		name = "（已关闭）"
-	}
-	return fmt.Sprintf(`
-		<div class="row"><span class="label">%s</span><span class="value">%s</span></div>
-		<div class="row"><span class="label">您的设备 IP</span><span class="value mono">%s</span></div>
-		<div class="row"><span class="label">访问有效期</span><span class="value highlight">%s</span></div>`,
-		label, html.EscapeString(name), html.EscapeString(ip), html.EscapeString(validity))
-}
-
-func (m *Manager) serveRenewSubmit(w http.ResponseWriter, r *http.Request) {
-	r.Body = io.NopCloser(io.LimitReader(r.Body, 8<<10))
-	if err := r.ParseForm(); err != nil {
-		m.writePage(w, r, http.StatusBadRequest, pageError, "请求无效", problemHTML("表单内容无法解析"))
-		return
-	}
-	ip := clientIPOf(r)
-	da, ok := m.state.deviceAccess(strings.TrimSpace(r.PostForm.Get("code")), ip)
-	if ip == "" || !ok {
-		m.writePage(w, r, http.StatusNotFound, pageError, "无法申请延长", problemHTML("没有找到这台设备的授权，请联系管理员获取新的邀请链接"))
-		return
-	}
-	req, err := m.state.addRenewal(da.scope, ip)
-	if err != nil {
-		m.writePage(w, r, http.StatusConflict, pageError, "无法申请延长", problemHTML(err.Error()))
-		return
-	}
-	log.Printf("[WebAuth] %s (%s) asked to extend access to %s", req.Name, ip, da.name)
-	http.Redirect(w, r, "/auth/status?id="+url.QueryEscape(req.ID), http.StatusSeeOther)
-}
-
 func sanitizeName(s string) string {
 	s = strings.Map(func(r rune) rune {
 		if unicode.IsControl(r) {
@@ -292,35 +201,15 @@ func (m *Manager) serveRequestStatus(w http.ResponseWriter, r *http.Request) {
 		m.writePage(w, r, http.StatusNotFound, pageError, "申请已失效", problemHTML("申请不存在或已过期，请重新打开邀请链接提交"))
 		return
 	}
-	scope := scopeOf(req.TunnelID, req.GroupID)
+	sc, open := m.resolveScope(scopeOf(req.TunnelID, req.GroupID))
-	sc, open := m.resolveScope(scope)
 	switch {
-	case req.Status == "rejected" && req.Renewal:
-		m.writePage(w, r, http.StatusOK, pageError, "申请未通过", problemHTML("管理员拒绝了您的延长申请"))
 	case req.Status == "rejected":
 		m.writePage(w, r, http.StatusOK, pageError, "申请未通过", problemHTML("管理员拒绝了您的访问申请"))
-	case req.Renewal && req.Status == "approved" && !open:
-		// 批准后 Agent 正在重新开启通道
-		w.Header().Set("Refresh", "3")
-		m.writePage(w, r, http.StatusOK, pagePending, "已批准，正在开启通道", `<div class="tip">管理员已批准延长，通道正在重新开启，此页面会自动刷新。</div>`)
-	case req.Renewal && !open:
-		da := deviceAccess{scope: scope, name: m.state.scopeDisplayName(scope)}
-		w.Header().Set("Refresh", "5")
-		m.writePage(w, r, http.StatusOK, pagePending, "等待管理员批准", closedRows(da, req.IP, "等待批准")+
-			fmt.Sprintf(`<div class="tip">%s，您的延长申请已提交，管理员批准时会确定延长多久；通道当前已关闭，批准后会自动重新开启。此页面会自动刷新。</div>`, html.EscapeString(req.Name)))
 	case !open:
 		m.writePage(w, r, http.StatusOK, pageError, "通道未开启", problemHTML("对应通道当前未开启，请联系管理员"))
-	case req.Status == "approved" && req.Renewal:
-		lease, _ := m.state.lease(sc.key, req.IP)
-		m.writePage(w, r, http.StatusOK, pageSuccess, "延长已批准", m.detailRows(r, sc, req.IP, leaseValidity(lease))+
-			`<div class="tip">管理员已批准延长，现在可以继续使用。到期后 2 小时内还可以重新打开邀请链接申请延长。</div>`)
 	case req.Status == "approved":
 		lease, _ := m.state.lease(sc.key, req.IP)
 		m.writePage(w, r, http.StatusOK, pageSuccess, "申请已批准", m.successBody(r, sc, req.IP, lease))
-	case req.Renewal:
-		w.Header().Set("Refresh", "5")
-		m.writePage(w, r, http.StatusOK, pagePending, "等待管理员批准", m.detailRows(r, sc, req.IP, "等待批准")+
-			fmt.Sprintf(`<div class="tip">%s，您的延长申请已提交，管理员批准时会确定延长多久。此页面会自动刷新。</div>`, html.EscapeString(req.Name)))
 	default:
 		duration := ""
 		if _, inv, ok := m.state.findInvite(req.Invite); ok {
@@ -355,7 +244,7 @@ func (m *Manager) successBody(r *http.Request, sc accessScope, ip string, l leas
 		where = "上面任意一个访问地址"
 	}
 	return m.detailRows(r, sc, ip, leaseValidity(l)) +
-		`<div class="tip">您的设备已获得访问权限，现在可以直接用客户端连接` + where + `，计时从首次连接开始。到期后 2 小时内，可以重新打开这个邀请链接申请延长。</div>`
+		`<div class="tip">您的设备已获得访问权限，现在可以直接用客户端连接` + where + `，计时从首次连接开始。到期后如需继续使用，请向管理员索取新的邀请链接。</div>`
 }
 
 // detailRows renders the info table; a group lists every access address with its target

tools/ui-snapshots/main.swift

@@ -163,12 +163,6 @@ func makeDemoVM(tick: Int = 0) -> PortRelayViewModel {
                    {"code":"gx2","note":"测试组","created_at":"\(t(-100))","expires_at":"\(t(86000))","max_uses":3,"lease_duration":"today","require_approval":true}]}}]
     """)
     vm.groups[0].rate_history = RateSeriesItem(end: ga.end, step: 5, up: zip(ga.up, gb.up).map { $0 + $1 }, down: zip(ga.down, gb.down).map { $0 + $1 })
-    // 授权延长：赵六的访问 20 分钟前结束，刚申请延长；王五结束不到 2 小时，还可以延长
-    vm.tunnels[0].renewals = decode([RenewalItem].self, """
-    [{"tunnel_id":"t1","ip":"192.168.1.47","name":"赵六","invite":"ab1","ended_at":"\(t(-1200))","renew_before":"\(t(6000))",
-      "request":{"id":"rn1","tunnel_id":"t1","name":"赵六","ip":"192.168.1.47","invite":"ab1","at":"\(t(-60))","status":"pending","renewal":true}},
-     {"tunnel_id":"t1","ip":"192.168.1.36","name":"王五","invite":"ab2","ended_at":"\(t(-3000))","renew_before":"\(t(4200))"}]
-    """)
     // 卡片与顶部统计的实时速率取曲线最后一个点
     var totalIn: Int64 = 0, totalOut: Int64 = 0
     for i in [0, 1, 3, 4] {
@@ -195,10 +189,7 @@ func makeDemoVM(tick: Int = 0) -> PortRelayViewModel {
     [
      {"id":"h1","tunnel_id":"t1","tunnel_name":"MySQL 数据库","port":33660,"client_ip":"192.168.1.21:51000","connected_at":"\(t(-5000))","disconnected_at":"\(t(-4000))","duration_sec":1000,"bytes_in":1288490188,"bytes_out":5368709},
      {"id":"h2","tunnel_id":"t1","tunnel_name":"MySQL 数据库","port":33660,"client_ip":"192.168.1.21:51001","connected_at":"\(t(-3000))","disconnected_at":"\(t(-2990))","duration_sec":10,"bytes_in":2048,"bytes_out":4096},
-     {"id":"h3","tunnel_id":"t1","tunnel_name":"MySQL 数据库","port":33660,"client_ip":"192.168.1.35:40000","connected_at":"\(t(-90000))","disconnected_at":"\(t(-86000))","duration_sec":4000,"bytes_in":99999999,"bytes_out":1},
+     {"id":"h3","tunnel_id":"t1","tunnel_name":"MySQL 数据库","port":33660,"client_ip":"192.168.1.35:40000","connected_at":"\(t(-90000))","disconnected_at":"\(t(-86000))","duration_sec":4000,"bytes_in":99999999,"bytes_out":1}
-     {"id":"h4","tunnel_id":"g1a","tunnel_name":"订单服务 (10.0.3.11)","port":33670,"client_ip":"192.168.1.42:50100","connected_at":"\(t(-7000))","disconnected_at":"\(t(-6400))","duration_sec":600,"bytes_in":820000,"bytes_out":5200000},
-     {"id":"h5","tunnel_id":"g1b","tunnel_name":"订单服务 (10.0.3.12)","port":33671,"client_ip":"192.168.1.42:50120","connected_at":"\(t(-6800))","disconnected_at":"\(t(-6000))","duration_sec":800,"bytes_in":420000,"bytes_out":3100000},
-     {"id":"h6","tunnel_id":"g1a","tunnel_name":"订单服务 (10.0.3.11)","port":33670,"client_ip":"192.168.1.66:41022","connected_at":"\(t(-90000))","disconnected_at":"\(t(-88200))","duration_sec":1800,"bytes_in":1200000,"bytes_out":9400000}
     ]
     """)
     vm.totalActiveConns = 8; vm.totalHistoricalConns = 1656; vm.totalRateIn = totalIn; vm.totalRateOut = totalOut
@@ -211,8 +202,6 @@ func makeDemoVM(tick: Int = 0) -> PortRelayViewModel {
 final class KeyWindow: NSWindow {
     override var isKeyWindow: Bool { true }
     override var isMainWindow: Bool { true }
-    /// 渲染进程不会被激活，AppKit 控件（开关、分段控件）按这个私有属性决定是否画成灰色
-    @objc(hasKeyAppearance) func alwaysHasKeyAppearance() -> Bool { true }
 }
 
 @MainActor
@@ -252,8 +241,8 @@ MainActor.assumeIsolated {
     render("01b-main-min", CGSize(width: 920, height: 640), ContentView(vm: vm))
     render("04-clients-history", CGSize(width: 760, height: 600), ClientDetailsSheet(vm: vm, tunnel: t1, initialTab: 1, isPresented: yes))
     render("05-clients-auth", CGSize(width: 760, height: 600), ClientDetailsSheet(vm: vm, tunnel: t1, initialTab: 2, isPresented: yes))
-    render("06-edit-new", CGSize(width: 520, height: 760), TunnelEditSheet(vm: vm, tunnel: nil, isPresented: yes))
+    render("06-edit-new", CGSize(width: 490, height: 760), TunnelEditSheet(vm: vm, tunnel: nil, isPresented: yes))
-    render("07-edit-existing", CGSize(width: 520, height: 760), TunnelEditSheet(vm: vm, tunnel: vm.tunnels[1], isPresented: yes))
+    render("07-edit-existing", CGSize(width: 490, height: 760), TunnelEditSheet(vm: vm, tunnel: vm.tunnels[1], isPresented: yes))
     render("08-invite-form", CGSize(width: 560, height: 400), InviteSheet(vm: vm, tunnel: t1, autoGenerate: false, isPresented: yes))
     render("09-invite-result", CGSize(width: 560, height: 400), InviteSheet(vm: vm, tunnel: t1, autoGenerate: true, isPresented: yes))
     render("10-settings", CGSize(width: 400, height: 320), SettingsSheet(vm: vm, isPresented: yes))
@@ -264,35 +253,25 @@ MainActor.assumeIsolated {
     let demo = makeDemoVM()
     render("readme-main-light", CGSize(width: 980, height: 1180), ContentView(vm: demo))
     render("readme-main-dark", CGSize(width: 980, height: 1180), dark: true, ContentView(vm: demo))
-    render("readme-invite", CGSize(width: 600, height: 270), InviteSheet(vm: demo, tunnel: demo.tunnels[0], autoGenerate: true, isPresented: yes))
+    render("readme-invite", CGSize(width: 560, height: 250), InviteSheet(vm: demo, tunnel: demo.tunnels[0], autoGenerate: true, isPresented: yes))
     render("readme-clients", CGSize(width: 760, height: 560), ClientDetailsSheet(vm: demo, tunnel: demo.tunnels[0], initialTab: 0, isPresented: yes))
-    render("readme-edit", CGSize(width: 520, height: 570), TunnelEditSheet(vm: demo, tunnel: demo.tunnels[0], isPresented: yes))
+    render("readme-access", CGSize(width: 760, height: 490), ClientDetailsSheet(vm: demo, tunnel: demo.tunnels[0], initialTab: 2, isPresented: yes))
+    render("readme-edit", CGSize(width: 490, height: 760), TunnelEditSheet(vm: demo, tunnel: demo.tunnels[0], isPresented: yes))
     let g = demo.groups[0]
-    render("readme-group", CGSize(width: 980, height: 330), GroupCardView(group: g, members: demo.members(of: g), visible: demo.members(of: g), vm: demo,
+    render("group-card", CGSize(width: 980, height: 330), GroupCardView(group: g, members: demo.members(of: g), visible: demo.members(of: g), vm: demo,
         onEdit: {}, onAddMember: {}, onInvite: {}, onViewClients: { _ in }, onEditMember: { _ in }, onInviteMember: { _ in }, onMemberClients: { _ in }).padding(20))
     render("group-card-dark", CGSize(width: 980, height: 330), dark: true, GroupCardView(group: g, members: demo.members(of: g), visible: demo.members(of: g), vm: demo,
         onEdit: {}, onAddMember: {}, onInvite: {}, onViewClients: { _ in }, onEditMember: { _ in }, onInviteMember: { _ in }, onMemberClients: { _ in }).padding(20))
     render("group-card-narrow", CGSize(width: 720, height: 360), GroupCardView(group: g, members: demo.members(of: g), visible: demo.members(of: g), vm: demo,
         onEdit: {}, onAddMember: {}, onInvite: {}, onViewClients: { _ in }, onEditMember: { _ in }, onInviteMember: { _ in }, onMemberClients: { _ in }).padding(20))
-    render("group-add-batch", CGSize(width: 520, height: 900), TunnelEditSheet(vm: demo, tunnel: nil, isPresented: yes,
+    render("group-add-batch", CGSize(width: 490, height: 860), TunnelEditSheet(vm: demo, tunnel: nil, isPresented: yes,
-        draftName: "订单服务", draftRows: [("10.0.3.11", "22, 8080"), ("10.0.3.12", "22, 8080"), ("10.0.3.13", "22")]))
+        draftName: "订单服务", draftTarget: "10.0.3.11-13:22, 10.0.3.11-13:8080"))
-    render("group-add-single", CGSize(width: 520, height: 780), TunnelEditSheet(vm: demo, tunnel: nil, isPresented: yes,
+    render("group-add-member", CGSize(width: 490, height: 780), TunnelEditSheet(vm: demo, tunnel: nil, isPresented: yes, groupId: g.id))
-        draftName: "MySQL 实习库", draftRows: [("10.0.1.16", "3306")]))
-    render("group-add-member", CGSize(width: 520, height: 780), TunnelEditSheet(vm: demo, tunnel: nil, isPresented: yes, groupId: g.id))
     render("group-sheet-edit", CGSize(width: 520, height: 420), GroupEditSheet(vm: demo, group: g, isPresented: yes))
     render("group-invite", CGSize(width: 560, height: 300), InviteSheet(vm: demo, scope: .group(g.id), autoGenerate: true, isPresented: yes))
     render("group-access", CGSize(width: 760, height: 560), ClientDetailsSheet(vm: demo, scope: .group(g.id), initialTab: 2, isPresented: yes))
     render("group-online", CGSize(width: 760, height: 400), ClientDetailsSheet(vm: demo, scope: .group(g.id), initialTab: 0, isPresented: yes))
-    render("group-online-addr", CGSize(width: 760, height: 460), ClientDetailsSheet(vm: demo, scope: .group(g.id), initialTab: 0, byAddress: true, isPresented: yes))
+    render("group-edit-member", CGSize(width: 490, height: 800), TunnelEditSheet(vm: demo, tunnel: demo.tunnels[3], isPresented: yes))
-    render("group-history", CGSize(width: 760, height: 400), ClientDetailsSheet(vm: demo, scope: .group(g.id), initialTab: 1, isPresented: yes))
-    render("group-history-addr", CGSize(width: 760, height: 520), ClientDetailsSheet(vm: demo, scope: .group(g.id), initialTab: 1, byAddress: true, isPresented: yes))
-    render("group-edit-member", CGSize(width: 520, height: 800), TunnelEditSheet(vm: demo, tunnel: demo.tunnels[3], isPresented: yes))
-
-    // 授权延长：申请延长、最近结束、已授权设备的「延长」
-    render("readme-access", CGSize(width: 760, height: 800), ClientDetailsSheet(vm: demo, tunnel: demo.tunnels[0], initialTab: 2, isPresented: yes))
-    render("renew-card", CGSize(width: 980, height: 220), TunnelCardView(tunnel: demo.tunnels[0], vm: demo, onEdit: {}, onViewClients: {}, onViewLeases: {}, onInvite: {}).padding(20))
-    render("renew-invite-form", CGSize(width: 600, height: 400), InviteSheet(vm: demo, tunnel: demo.tunnels[0], autoGenerate: false, isPresented: yes))
-    render("renew-custom", CGSize(width: 300, height: 90), CustomMinutesForm(actionTitle: "延长") { _ in })
 
     // README 动图逐帧：卡片随时间推移（每帧 = 5 秒）
     if only.hasPrefix("gif") {

tools/ui-snapshots/readme.sh

@@ -1,24 +0,0 @@
-#!/bin/bash
-# 重新生成 README 用到的全部截图和动图（模拟数据），写入 docs/images。
-# 用法: tools/ui-snapshots/readme.sh（即 make readme-images）
-# 需要 Xcode 命令行工具和 Google Chrome。
-set -e
-DIR="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$DIR/../.." && pwd)"
-IMG="$ROOT/docs/images"
-
-# App 界面：readme-xxx.png → app-xxx.png
-"$DIR/render.sh" readme
-for f in "$DIR"/out/readme-*.png; do
-	name="$(basename "$f")"
-	cp "$f" "$IMG/app-${name#readme-}"
-done
-
-# 通道卡片动图：40 帧，每帧相当于 5 秒
-FRAMES=40 "$DIR/render.sh" gif
-(cd "$ROOT" && go run ./tools/ui-snapshots/mkgif -o "$IMG/live-traffic.gif" "$DIR"/out/gif-*.png)
-
-# 授权页与网页面板
-"$DIR/web.sh"
-cp "$DIR"/out/web/*.png "$IMG/"
-echo "✓ 已更新 docs/images"

tools/ui-snapshots/web.sh

@@ -1,41 +0,0 @@
-#!/bin/bash
-# 用无头 Chrome 截取 README 里的授权页和网页面板（模拟数据）。
-# 用法: tools/ui-snapshots/web.sh   输出: tools/ui-snapshots/out/web/*.png
-# 需要 Google Chrome，路径可用 CHROME 环境变量指定。
-set -e
-DIR="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$DIR/../.." && pwd)"
-BUILD="$DIR/.build/web"
-OUT="$DIR/out/web"
-CHROME="${CHROME:-/Applications/Google Chrome.app/Contents/MacOS/Google Chrome}"
-[ -x "$CHROME" ] || { echo "找不到 Chrome：$CHROME（可用 CHROME=... 指定）" >&2; exit 1; }
-rm -rf "$BUILD" "$OUT"
-mkdir -p "$BUILD" "$OUT"
-
-# shot URL 宽 高 输出：按 2 倍像素截图，使用临时的浏览器配置
-shot() {
-	"$CHROME" --headless=new --disable-gpu --hide-scrollbars --no-first-run --no-default-browser-check \
-		--blink-settings=preferredColorScheme=1 --force-device-scale-factor=2 --window-size="$2,$3" --timeout=3000 \
-		--user-data-dir="$BUILD/chrome" --screenshot="$4" "$1" >/dev/null 2>&1
-}
-
-# 授权页：服务端用模拟状态生成 HTML。无头 Chrome 的窗口最窄约 500pt，
-# 所以把页面放进居中的 390pt 宽 iframe（手机宽度），截图后从中间裁出 iframe 部分
-(cd "$ROOT" && PORTRELAY_README_PAGES="$BUILD" go test ./server -run '^TestReadmePages$' -count=1 >/dev/null)
-for page in "$BUILD"/auth-*.html; do
-	name="$(basename "$page" .html)"
-	printf '<!DOCTYPE html><body style="margin:0;background:#F5F5F7"><iframe src="%s" width="390" height="610" style="border:0;display:block;margin:0 auto"></iframe>' \
-		"$(basename "$page")" >"$BUILD/frame-$name.html"
-	shot "file://$BUILD/frame-$name.html" 520 610 "$OUT/$name.png"
-	sips -c 1220 780 "$OUT/$name.png" >/dev/null
-	echo "captured $name"
-done
-
-# 网页面板：本机模拟 Agent API，只监听回环地址
-(cd "$ROOT" && go build -o "$BUILD/webpanel" ./tools/ui-snapshots/webpanel)
-"$BUILD/webpanel" "$ROOT/cmd/portrelay-agent/web/index.html" >"$BUILD/webpanel.url" &
-pid=$!
-trap 'kill $pid 2>/dev/null' EXIT
-for _ in $(seq 50); do [ -s "$BUILD/webpanel.url" ] && break; sleep 0.1; done
-shot "$(head -1 "$BUILD/webpanel.url")" 1280 1124 "$OUT/web-panel.png"
-echo "captured web-panel"

tools/ui-snapshots/webpanel/main.go

@@ -1,181 +0,0 @@
-// webpanel 用模拟数据提供 Agent 网页面板，用于 README 截图（tools/ui-snapshots/web.sh 调用）。
-//
-//	go run ./tools/ui-snapshots/webpanel cmd/portrelay-agent/web/index.html
-//
-// 只监听 127.0.0.1 的随机端口，启动后在标准输出打印面板地址。
-// 数据与 tools/ui-snapshots/main.swift 的 makeDemoVM 保持一致，App 截图和网页截图展示的是同一组通道。
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"math"
-	"net"
-	"net/http"
-	"os"
-	"time"
-)
-
-var base = time.Now()
-
-func at(sec float64) string {
-	return base.Add(time.Duration(sec * float64(time.Second))).Format(time.RFC3339Nano)
-}
-
-// demoRate 与 main.swift 的同名函数相同：几段查询突发叠加平稳传输
-func demoRate(k int, seed, level, burst float64) int64 {
-	x := float64(k)
-	v := level * (0.55 + 0.25*math.Sin(x/9+seed) + 0.2*math.Sin(x/3.7+seed*2))
-	for c := -60; c <= 600; c += 21 {
-		h := 0.35 + 0.65*math.Abs(math.Sin(float64(c)*0.731+seed))
-		v += burst * h * math.Exp(-math.Pow((x-float64(c)-7*math.Sin(float64(c)+seed))/3.2, 2))
-	}
-	return int64(math.Max(0, v))
-}
-
-type series struct {
-	End  int64   `json:"end"`
-	Step int     `json:"step"`
-	Up   []int64 `json:"up"`
-	Down []int64 `json:"down"`
-}
-
-func demoSeries(seed, level, burst, upScale float64, points int) series {
-	s := series{End: base.Unix(), Step: 5, Up: make([]int64, 120), Down: make([]int64, 120)}
-	for i := 0; i < points; i++ {
-		s.Down[i] = demoRate(i, seed, level, burst)
-		s.Up[i] = demoRate(i, seed+1.7, level*upScale, burst*upScale)
-	}
-	return s
-}
-
-func sum(a, b series) series {
-	s := series{End: a.End, Step: a.Step}
-	for i := range a.Up {
-		s.Up = append(s.Up, a.Up[i]+b.Up[i])
-		s.Down = append(s.Down, a.Down[i]+b.Down[i])
-	}
-	return s
-}
-
-func obj(format string, args ...any) map[string]any {
-	var m map[string]any
-	if err := json.Unmarshal([]byte(fmt.Sprintf(format, args...)), &m); err != nil {
-		log.Fatal(err)
-	}
-	return m
-}
-
-func member(id, host string, port, conns int, firstAgo float64, connectedSec int, bytesIn, bytesOut int64) map[string]any {
-	first := ""
-	if firstAgo != 0 {
-		first = fmt.Sprintf(`"first_connected_at":%q,`, at(firstAgo))
-	}
-	return obj(`{"id":%q,"name":"订单服务 (%s)","target":"%s:22","listen_port":%d,"whitelist":[],"enabled":true,"group_id":"g1","group_name":"订单服务",
-	  "owner":"运维组","started_at":%q,"effective_idle_close_minutes":30,"idle_close_minutes":30,%s"connected_sec":%d,
-	  "activity":{"in_use":true,"connected_sec":%d},
-	  "metrics":{"tunnel_id":%q,"status":"online","active_conns":%d,"total_conns":%d,"bytes_in":%d,"bytes_out":%d,"blocked_attempts":0}}`,
-		id, host, host, port, at(-1800), first, connectedSec, connectedSec, id, conns, conns*5, bytesIn, bytesOut)
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		log.Fatal("usage: webpanel path/to/index.html")
-	}
-	page, err := os.ReadFile(os.Args[1])
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	tunnels := []map[string]any{
-		obj(`{"id":"t1","name":"MySQL 数据库","target":"10.0.1.16:3306","listen_port":33660,"whitelist":[],"enabled":true,
-		  "owner":"数据组","duration_minutes":240,"started_at":%q,"expires_at":%q,"historical_bytes_in":1288490188,"historical_bytes_out":53687091200,
-		  "idle_close_minutes":30,"effective_idle_close_minutes":30,"first_connected_at":%q,"connected_sec":1520,
-		  "activity":{"in_use":true,"connected_sec":1525},
-		  "metrics":{"tunnel_id":"t1","status":"online","active_conns":3,"total_conns":1287,"bytes_in":245039104,"bytes_out":8703180,"blocked_attempts":12,
-		    "dynamic_leases":[{"ip":"192.168.1.21","expires_at":%q,"name":"张三","invite":"a1","duration":"2h","started_at":%q},
-		                      {"ip":"192.168.1.35","expires_at":%q,"name":"王小明","invite":"a2","duration":"8h","awaiting_connect":true}],
-		    "pending":[{"id":"r1","tunnel_id":"t1","name":"李四","ip":"192.168.1.88","invite":"a3","at":%q,"status":"pending"}]},
-		  "renewals":[{"tunnel_id":"t1","ip":"192.168.1.47","name":"赵六","invite":"ab1","ended_at":%q,"renew_before":%q,
-		    "request":{"id":"rn1","tunnel_id":"t1","name":"赵六","ip":"192.168.1.47","invite":"ab1","at":%q,"status":"pending","renewal":true}},
-		    {"tunnel_id":"t1","ip":"192.168.1.36","name":"王五","invite":"ab2","ended_at":%q,"renew_before":%q}]}`,
-			at(-3725), at(10675), at(-3300), at(7000), at(-200), at(80000), at(-60), at(-1200), at(6000), at(-60), at(-3000), at(4200)),
-		member("g1a", "10.0.3.11", 33670, 1, -1500, 1320, 3203180, 18039104),
-		member("g1b", "10.0.3.12", 33671, 2, -1400, 1100, 2203180, 12039104),
-		member("g1c", "10.0.3.13", 33672, 0, 0, 0, 0, 0),
-		obj(`{"id":"t2","name":"Grafana 监控面板","target":"10.0.2.30:3000","listen_port":33661,"whitelist":["192.168.1.0/24"],"enabled":true,
-		  "owner":"运维组","duration_minutes":0,"started_at":%q,"effective_idle_close_minutes":0,"idle_close_minutes":0,"first_connected_at":%q,"connected_sec":36120,
-		  "activity":{"in_use":true,"connected_sec":36120},
-		  "metrics":{"tunnel_id":"t2","status":"online","active_conns":2,"total_conns":342,"bytes_in":52039104,"bytes_out":2703180,"blocked_attempts":0}}`,
-			at(-50000), at(-49000)),
-		obj(`{"id":"t3","name":"SSH 跳板机（测试环境）","target":"10.0.8.3:22","listen_port":33662,"whitelist":[],"enabled":true,
-		  "owner":"运维组","duration_minutes":0,"started_at":%q,"effective_idle_close_minutes":30,"idle_close_minutes":30,"first_connected_at":%q,"connected_sec":640,
-		  "activity":{"in_use":false,"idle_since":%q,"auto_close_at":%q,"connected_sec":640},
-		  "metrics":{"tunnel_id":"t3","status":"online","active_conns":0,"total_conns":4,"bytes_in":1983000,"bytes_out":204000,"blocked_attempts":0}}`,
-			at(-2100), at(-2000), at(-720), at(1080)),
-		obj(`{"id":"t4","name":"Redis 缓存","target":"10.0.1.20:6379","listen_port":33663,"whitelist":[],"enabled":false,"last_duration_sec":1905,"duration_minutes":0,
-		  "effective_idle_close_minutes":30,"last_connected_sec":742,"close_reason":"闲置 30 分钟自动关闭","historical_bytes_in":3145728,"historical_bytes_out":524288,
-		  "metrics":{"tunnel_id":"t4","status":"disabled"}}`),
-	}
-	rates := map[string]series{
-		"t1":  demoSeries(0.4, 26000, 150000, 0.08, 120),
-		"t2":  demoSeries(2.1, 9000, 30000, 0.15, 120),
-		"t3":  demoSeries(6, 1500, 9000, 0.2, 30), // 前一段时间有流量，之后闲置
-		"g1a": demoSeries(3.3, 4000, 26000, 0.3, 120),
-		"g1b": demoSeries(4.6, 4000, 26000, 0.3, 120),
-		"g1c": demoSeries(0, 0, 0, 0, 0),
-	}
-	for _, t := range tunnels {
-		if s, ok := rates[t["id"].(string)]; ok {
-			t["rate_history"] = s
-			m := t["metrics"].(map[string]any)
-			m["rate_in"], m["rate_out"] = s.Up[len(s.Up)-1], s.Down[len(s.Down)-1]
-		}
-	}
-	groups := []map[string]any{obj(`{"id":"g1","name":"订单服务","owner":"运维组","created_at":%q,"tunnel_ids":["g1a","g1b","g1c"],
-	  "metrics":{"group_id":"g1",
-	    "dynamic_leases":[{"ip":"192.168.1.42","expires_at":%q,"name":"小王","invite":"gx1","duration":"8h","started_at":%q}],
-	    "pending":[{"id":"gr1","tunnel_id":"","group_id":"g1","name":"小李","ip":"192.168.1.57","invite":"gx2","at":%q,"status":"pending"}]}}`,
-		at(-1800), at(27000), at(-1500), at(-40))}
-	groups[0]["rate_history"] = sum(rates["g1a"], rates["g1b"])
-
-	status := map[string]any{
-		"connected": true, "server_addr": "192.168.1.10:33000", "public_host": "192.168.1.10",
-		"invite_base": "http://192.168.1.10:33000/i/", "total_rate_history": sum(rates["t1"], rates["t2"]),
-		"port_range": "33001 - 34000", "timestamp": base,
-	}
-	stream := map[string]any{"metrics": map[string]any{"active_conns": []any{}, "security_events": []any{}}, "tunnels": tunnels, "groups": groups}
-	for k, v := range status {
-		stream[k] = v
-	}
-
-	serveJSON := func(v any) http.HandlerFunc {
-		return func(w http.ResponseWriter, r *http.Request) {
-			w.Header().Set("Content-Type", "application/json")
-			_ = json.NewEncoder(w).Encode(v)
-		}
-	}
-	mux := http.NewServeMux()
-	mux.HandleFunc("/{$}", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		_, _ = w.Write(page)
-	})
-	mux.HandleFunc("/api/status", serveJSON(status))
-	mux.HandleFunc("/api/tunnels", serveJSON(tunnels))
-	mux.HandleFunc("/api/groups", serveJSON(groups))
-	mux.HandleFunc("/api/stream", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		b, _ := json.Marshal(stream)
-		fmt.Fprintf(w, "data: %s\n\n", b)
-		w.(http.Flusher).Flush()
-		<-r.Context().Done()
-	})
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		log.Fatal(err)
-	}
-	fmt.Printf("http://%s/\n", ln.Addr())
-	log.Fatal(http.Serve(ln, mux))
-}