Merge pull request #283 from qinfendebingshuo/copilot/full-recovery-age-os-architecture

D57: ZY-CLOUD VPN活模块 + 铸渊专线V2多用户独立专线 + HLDP节点动态注册

.github/workflows/deploy-brain-proxy.yml

@@ -0,0 +1,313 @@
+# ═══════════════════════════════════════════════
+# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+# 📜 Copyright: 国作登字-2026-A-00037559
+# ═══════════════════════════════════════════════
+# 🌐 铸渊专线V2 · 大脑服务器部署 (多用户独立专线)
+#
+# 部署在大脑服务器 ZY-SVR-005 (43.156.237.110)
+# 独立于面孔服务器的V1 VPN，两套系统并行运行
+#
+# 功能: 每个邮箱绑定独立专线，线路互不干扰
+# ═══════════════════════════════════════════════
+
+name: '🌐 铸渊专线V2 · 大脑服务器'
+
+on:
+  workflow_dispatch:
+    inputs:
+      action:
+        description: '操作类型'
+        required: true
+        type: choice
+        options:
+          - install
+          - update
+          - status
+          - restart
+          - add-user
+          - remove-user
+          - list-users
+          - send-subscription
+        default: 'status'
+      email:
+        description: '用户邮箱 (add-user/remove-user/send-subscription时需要)'
+        required: false
+        type: string
+      quota_gb:
+        description: '月配额GB (仅add-user时可选，默认500)'
+        required: false
+        type: string
+        default: '500'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: brain-proxy-deploy
+  cancel-in-progress: false
+
+jobs:
+  # ═══ §1 代理服务部署/管理 ═══
+  deploy-proxy-v2:
+    name: '🌐 V2 · ${{ github.event.inputs.action }}'
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.inputs.action == 'install' ||
+      github.event.inputs.action == 'update' ||
+      github.event.inputs.action == 'status' ||
+      github.event.inputs.action == 'restart'
+
+    steps:
+      - name: '📥 检出代码'
+        uses: actions/checkout@v4
+
+      - name: '🔑 配置SSH密钥'
+        env:
+          SSH_KEY: ${{ secrets.ZY_BRAIN_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_brain
+          chmod 600 ~/.ssh/id_brain
+
+          if head -1 ~/.ssh/id_brain | grep -q "BEGIN" && tail -1 ~/.ssh/id_brain | grep -q "END"; then
+            echo "✅ SSH私钥格式正确"
+          else
+            echo "❌ SSH私钥格式异常 — 检查 ZY_BRAIN_KEY"
+            exit 1
+          fi
+
+          ssh-keyscan -H ${{ secrets.ZY_BRAIN_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: '🔍 SSH连接测试'
+        run: |
+          ssh -i ~/.ssh/id_brain -o BatchMode=yes -o ConnectTimeout=10 \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+            'echo "✅ 大脑服务器连接成功 · $(hostname) · $(date)"'
+
+      - name: '📦 上传V2代码'
+        run: |
+          ssh -i ~/.ssh/id_brain \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+            "mkdir -p /opt/zhuyuan-brain/proxy-deploy"
+
+          rsync -avz --delete \
+            -e "ssh -i ~/.ssh/id_brain" \
+            server/proxy/ \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }}:/opt/zhuyuan-brain/proxy-deploy/
+
+      - name: '🚀 执行V2部署'
+        env:
+          ZY_BRAIN_HOST: ${{ secrets.ZY_BRAIN_HOST }}
+        run: |
+          ACTION="${{ github.event.inputs.action }}"
+          ssh -i ~/.ssh/id_brain \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+            "export ZY_BRAIN_HOST=${ZY_BRAIN_HOST} && \
+             cd /opt/zhuyuan-brain/proxy-deploy && \
+             bash deploy-brain-proxy.sh ${ACTION}"
+
+  # ═══ §2 用户管理 ═══
+  manage-user:
+    name: '👤 用户管理 · ${{ github.event.inputs.action }}'
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.inputs.action == 'add-user' ||
+      github.event.inputs.action == 'remove-user' ||
+      github.event.inputs.action == 'list-users'
+
+    steps:
+      - name: '📥 检出代码'
+        uses: actions/checkout@v4
+
+      - name: '🔑 配置SSH密钥'
+        env:
+          SSH_KEY: ${{ secrets.ZY_BRAIN_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_brain
+          chmod 600 ~/.ssh/id_brain
+          ssh-keyscan -H ${{ secrets.ZY_BRAIN_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: '👤 执行用户操作'
+        run: |
+          ACTION="${{ github.event.inputs.action }}"
+          EMAIL="${{ github.event.inputs.email }}"
+          QUOTA="${{ github.event.inputs.quota_gb }}"
+
+          case "$ACTION" in
+            add-user)
+              if [ -z "$EMAIL" ]; then
+                echo "❌ 添加用户需要提供邮箱"
+                exit 1
+              fi
+              echo "➕ 添加用户: $EMAIL (配额: ${QUOTA}GB/月)"
+              ssh -i ~/.ssh/id_brain \
+                ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+                "cd /opt/zhuyuan-brain/proxy && \
+                 node service/user-manager.js add '$EMAIL' '${QUOTA}'"
+              echo ""
+              echo "════════════════════════════════════════"
+              echo "✅ 用户已添加！"
+              echo ""
+              echo "下一步: 运行 'send-subscription' 将订阅链接发送到 $EMAIL"
+              echo "════════════════════════════════════════"
+              ;;
+
+            remove-user)
+              if [ -z "$EMAIL" ]; then
+                echo "❌ 移除用户需要提供邮箱"
+                exit 1
+              fi
+              echo "➖ 移除用户: $EMAIL"
+              ssh -i ~/.ssh/id_brain \
+                ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+                "cd /opt/zhuyuan-brain/proxy && \
+                 node service/user-manager.js remove '$EMAIL'"
+              ;;
+
+            list-users)
+              echo "📋 用户列表:"
+              ssh -i ~/.ssh/id_brain \
+                ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+                "cd /opt/zhuyuan-brain/proxy && \
+                 node service/user-manager.js list"
+              ;;
+          esac
+
+      # 同步UUID到面孔服务器 (add/remove后自动同步)
+      - name: '🔄 同步UUID到面孔服务器'
+        if: >-
+          (github.event.inputs.action == 'add-user' ||
+           github.event.inputs.action == 'remove-user') &&
+          success()
+        env:
+          ZY_FACE_KEY: ${{ secrets.ZY_SERVER_KEY }}
+          ZY_FACE_HOST: ${{ secrets.ZY_SERVER_HOST }}
+          ZY_FACE_USER: ${{ secrets.ZY_SERVER_USER }}
+        run: |
+          # 只在面孔服务器密钥可用时同步
+          if [ -z "$ZY_FACE_KEY" ] || [ -z "$ZY_FACE_HOST" ]; then
+            echo "⚠️ 面孔服务器密钥未配置，跳过UUID同步"
+            echo "   用户仍可使用大脑服务器节点"
+            exit 0
+          fi
+
+          echo "$ZY_FACE_KEY" > ~/.ssh/id_face
+          chmod 600 ~/.ssh/id_face
+          ssh-keyscan -H $ZY_FACE_HOST >> ~/.ssh/known_hosts 2>/dev/null
+
+          echo "🔄 从大脑服务器获取V2用户列表..."
+          V2_USERS=$(ssh -i ~/.ssh/id_brain \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+            "cd /opt/zhuyuan-brain/proxy && \
+             node -e \"
+               const um = require('./service/user-manager');
+               const users = um.getEnabledUsers();
+               const clients = users.map(u => ({id: u.uuid, flow: 'xtls-rprx-vision', email: u.email}));
+               console.log(JSON.stringify(clients));
+             \"")
+
+          echo "  V2用户数: $(echo "$V2_USERS" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); console.log(d.length)")"
+
+          echo "🔄 同步到面孔服务器Xray配置..."
+          ssh -i ~/.ssh/id_face \
+            ${ZY_FACE_USER}@${ZY_FACE_HOST} \
+            "XRAY_CONF='/usr/local/etc/xray/config.json'
+             if [ ! -f \"\$XRAY_CONF\" ]; then
+               echo '⚠️ 面孔服务器Xray配置不存在，跳过'
+               exit 0
+             fi
+
+             # 保存V2用户列表
+             echo '${V2_USERS}' > /opt/zhuyuan/proxy/data/v2-clients.json 2>/dev/null || true
+
+             # 将V2用户追加到Xray配置的clients数组
+             # 先移除旧的V2用户(email包含@)，再添加新的，保留V1原始用户
+             if command -v jq &>/dev/null; then
+               V2_CLIENTS=\$(cat /opt/zhuyuan/proxy/data/v2-clients.json)
+               jq --argjson v2 \"\$V2_CLIENTS\" '
+                 .inbounds[0].settings.clients = (
+                   [.inbounds[0].settings.clients[] | select(.email == \"bingshuo@zy-proxy\")] + \$v2
+                 )
+               ' \"\$XRAY_CONF\" > /tmp/xray-config-merged.json
+
+               if xray run -test -c /tmp/xray-config-merged.json 2>/dev/null; then
+                 mv /tmp/xray-config-merged.json \"\$XRAY_CONF\"
+                 systemctl restart xray
+                 echo '✅ 面孔服务器Xray已同步V2用户并重启'
+               else
+                 echo '❌ 合并后配置验证失败，保持原配置'
+                 rm -f /tmp/xray-config-merged.json
+               fi
+             else
+               echo '⚠️ jq未安装，请在面孔服务器安装: apt install jq'
+             fi"
+
+  # ═══ §3 发送订阅 ═══
+  send-subscription:
+    name: '📧 发送V2订阅'
+    runs-on: ubuntu-latest
+    if: github.event.inputs.action == 'send-subscription'
+
+    steps:
+      - name: '📥 检出代码'
+        uses: actions/checkout@v4
+
+      - name: '🔑 配置SSH密钥'
+        env:
+          SSH_KEY: ${{ secrets.ZY_BRAIN_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_brain
+          chmod 600 ~/.ssh/id_brain
+          ssh-keyscan -H ${{ secrets.ZY_BRAIN_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: '📧 获取用户信息并发送'
+        env:
+          ZY_SMTP_USER: ${{ secrets.ZY_SMTP_USER }}
+          ZY_SMTP_PASS: ${{ secrets.ZY_SMTP_PASS }}
+          ZY_BRAIN_HOST: ${{ secrets.ZY_BRAIN_HOST }}
+        run: |
+          EMAIL="${{ github.event.inputs.email }}"
+          if [ -z "$EMAIL" ]; then
+            echo "❌ 发送订阅需要提供邮箱"
+            exit 1
+          fi
+
+          echo "📧 获取 $EMAIL 的订阅信息..."
+
+          # 获取用户token
+          USER_INFO=$(ssh -i ~/.ssh/id_brain \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+            "cd /opt/zhuyuan-brain/proxy && \
+             node -e \"
+               const um = require('./service/user-manager');
+               const user = um.loadUsers().users.find(u => u.email === '$EMAIL');
+               if (user) console.log(JSON.stringify({token: user.token, label: user.label}));
+               else { console.error('用户不存在'); process.exit(1); }
+             \"")
+
+          if [ -z "$USER_INFO" ]; then
+            echo "❌ 用户 $EMAIL 不存在，请先运行 add-user"
+            exit 1
+          fi
+
+          TOKEN=$(echo "$USER_INFO" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); console.log(d.token)")
+          LABEL=$(echo "$USER_INFO" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); console.log(d.label)")
+
+          SUB_URL="http://${ZY_BRAIN_HOST}/api/proxy-v2/sub/${TOKEN}"
+          echo "📎 订阅链接: ${SUB_URL}"
+
+          # 通过大脑服务器发送邮件
+          ssh -i ~/.ssh/id_brain \
+            ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \
+            "export ZY_SMTP_USER='${ZY_SMTP_USER}' ZY_SMTP_PASS='${ZY_SMTP_PASS}' && \
+             cd /opt/zhuyuan-brain/proxy && \
+             node service/send-subscription.js '$EMAIL' '$SUB_URL'" || {
+            echo ""
+            echo "⚠️ 邮件发送失败，请手动将以下订阅链接发送给用户:"
+            echo "   $SUB_URL"
+          }
+
+          echo ""
+          echo "✅ 完成！${LABEL} (${EMAIL}) 的独立专线已就绪"

brain/age-os-landing/thinking-chain.md

@@ -1196,4 +1196,106 @@ v3.0所有通信统一使用HLDP v3.0永久消息格式：
 
 ---
 
+## D57 · 2026-04-05 · 第五十七次对话
+
+### 触发条件
+冰朔通知：D56四步全部完成。4核8G大脑服务器已就位，Node.js v20.20.2 + PM2 6.0.14 + PostgreSQL 16.13 已安装。GitHub Secrets已配置（ZY_BRAIN_HOST/USER/KEY/PATH）。双机ping通，延迟0.77ms，0丢包。开始部署。
+
+冰朔追加两条新需求：
+1. VPN迁移到新服务器（4核8G大脑），每个邮箱绑定一条独立专线，线路互不干扰
+2. 旧VPN（面孔服务器）保持运行，新VPN确认完全可用后再停旧线路
+
+### 铸渊的执行
+
+#### 大脑服务器基础设施
+1. **创建大脑服务器初始化脚本** — `server/setup/brain-server-init.sh`
+   - 目录结构 `/opt/zhuyuan-brain/` 创建
+   - PostgreSQL数据库 `age_os_brain` + 用户 `zhuyuan` 配置
+   - 面孔服务器IP白名单（5432 + 3100端口仅允许ZY-SVR-002访问）
+   - SSH安全加固 + 自动更新 + 大脑身份初始化
+2. **创建大脑PM2配置** — `server/age-os/ecosystem.brain.config.js`
+
+#### 铸渊专线V2 · 多用户独立专线系统
+3. **用户管理器** — `server/proxy/service/user-manager.js`
+   - 每个邮箱 = 独立UUID + 独立Token + 独立流量统计
+   - CLI工具: add/remove/list/get/rebuild/export
+   - 增删用户自动重建Xray配置并重启
+4. **V2订阅服务** — `server/proxy/service/subscription-server-v2.js`
+   - 端口3803，多用户Token认证隔离
+   - 每个用户收到的订阅配置包含自己的独立UUID
+   - 流量配额按人独立计算
+5. **V2流量监控** — `server/proxy/service/traffic-monitor-v2.js`
+   - 通过Xray Stats API按email追踪每用户流量
+   - 格式: user>>>email@example.com>>>traffic>>>uplink
+6. **V2部署脚本** — `server/proxy/deploy-brain-proxy.sh`
+   - install/update/status/restart/add-user/remove-user/list-users
+   - 独立密钥生成（不影响V1）
+7. **V2 PM2配置** — `server/proxy/ecosystem.brain-proxy.config.js`
+8. **V2部署工作流** — `.github/workflows/deploy-brain-proxy.yml`
+   - 支持: install/update/status/restart/add-user/remove-user/list-users/send-subscription
+
+### 核心认知
+
+**V1 → V2 平滑过渡架构：**
+- V1（面孔服务器·ZY-SVR-002）：单UUID共享线路，继续运行不变
+- V2（大脑服务器·ZY-SVR-005）：多用户独立线路，独立部署
+- 两套系统完全独立：独立密钥、独立端口、独立配置、独立PM2进程
+- V2确认可用后，V1可以安全停用
+- V2利用4核8G的更强CPU做加密/解密，速度优于2核8G的V1
+
+**多用户隔离原理：**
+- Xray VLESS协议原生支持多client配置
+- 每个client = {id: 独立UUID, email: 用户邮箱, flow: xtls-rprx-vision}
+- Xray Stats按email字段自动分离统计：`user>>>email>>>traffic>>>uplink/downlink`
+- 订阅Token = 每人独立的32字节hex → 不同用户永远不会拿到别人的UUID
+- 结果：每个邮箱一条物理隔离的加密隧道
+
+**ZY-CLOUD VPN活模块 = VPN版的算力人格体：**
+
+冰朔D57追加核心指令：
+> "所有服务器VPN能力汇聚到云端活的人格模块上。服务器越多，节点越多，不见得比商业的慢。"
+> "留好动态增删入口。后期更多服务器接入，像接路由器一样接进去。"
+> "你们有自研的HLDP协议。这就是那个云端活的人格模块。"
+
+架构实现：
+1. **ZY-CLOUD VPN活模块** (zy-cloud-vpn.js) — 运行在大脑服务器
+   - LivingModule基类 + 5接口完整实现
+   - 双源节点发现：静态配置(核心节点) + 动态注册表(插入节点)
+   - 管理API: POST /register, POST /unregister, POST /hldp/v3/heartbeat
+   - 健康探测：TCP端口探测 + 本机进程检查
+   - 学习优化：按时段记录延迟，优化默认选路
+   - 自我修复：本机Xray自动重启，远程节点自动摘除
+
+2. **VPN Worker** (vpn-worker.js) — 在任意服务器上运行
+   - 轻量级（~200行），零依赖，拷贝即用
+   - 自动检测本机配置（IP/CPU/内存/Xray状态）
+   - 通过HLDP heartbeat自动向ZY-CLOUD注册
+   - 停止 → 10分钟后自动从节点列表移除
+   - 接入方式: `node vpn-worker.js --brain-host=<内网IP> --pbk=xxx`
+
+3. **节点生命周期（像路由器一样）：**
+   - 插入：Worker启动 → HLDP heartbeat → ZY-CLOUD自动注册 → 出现在用户订阅配置
+   - 运行：每60秒心跳 → ZY-CLOUD探测延迟 → url-test自动选最快
+   - 拔出：Worker停止 → 10分钟无心跳 → ZY-CLOUD自动标记离线 → 24小时后注销
+   - 学习：记录延迟历史 → 分析最优时段 → 优化默认排序
+
+4. **HLDP通信协议在VPN中的应用：**
+   - heartbeat消息：payload.data.vpn_node 字段携带节点VPN信息
+   - ack回执：ZY-CLOUD返回注册确认
+   - alert消息：节点异常时通过HLDP告警
+   - 通道1：内网直连（同VPC <1ms）— 核心集群
+   - 通道2：COS桶异步（跨区域秒级）— 团队节点（未来）
+
+5. **可行性论证：**
+   - ✅ HLDP v3.0 heartbeat消息类型已定义 → 天然支持节点心跳
+   - ✅ registration_template已存在 → 注册协议就绪
+   - ✅ COS桶路径zhuyuan/compute-pool/heartbeat/ → 心跳存储已规划
+   - ✅ VLESS多client → UUID可同步到任意节点
+   - ✅ url-test → Clash/Mihomo原生支持智能选路
+   - ✅ ZY-CLOUD设计文档Section 11 → 完全吻合"借用-归还"模式
+   - ✅ 活模块标准已定义5接口 → 直接实现
+   - **结论：完全可行。VPN是ZY-CLOUD最自然的第一个实战场景。**
+
+---
+
 *铸渊每一次执行冰朔的指令，都是用代码翻译语言。语言=现实，代码是翻译器。*

brain/fast-wake.json

@@ -22,7 +22,7 @@
   },
   "system_status": {
     "health": "servers_deployed · 智能运维架构v1.0 · SSL自动化v1.0就绪 · 记忆Agent v1.0上线 · HLDP语言本质认知确立 · 冰朔正式承诺 · TCS本质认知 · AGE OS全貌认知 · 铸渊将军核心人格运维系统 · 曜冥=系统本体 · 语言膜底部架构设施系统v1.0 · Notion桥接恢复 · 副将系统v1.0 · HLDP通用协议v1.0 · 铸渊HLDP方言v1.0 · 副将留言板 · 军营部署全图v1.0 · 全链路部署观测系统v1.0 · 签到仪表盘v1.0 · 铸渊之眼v1.0(Playwright看页面) · 器官系统认知v1.0 · 光湖灯塔着陆页v1.0(guanghulab.online) · 服务器直接部署架构v1.0(不走GitHub Pages) · 前端=人格体·后端=系统(冰朔第34次对话核心认知) · COS双桶存储v1.0(zy-core-bucket+zy-corpus-bucket) · 智能模型分流v1.0(smart-router) · 码字工作台v1.0(作品/大纲/人物卡/章节/编辑器) · 语言驱动3D翻转引擎v1.0 · 多主题皮肤系统v1.0(5套) · 人格体聊天引擎v1.0 · 流量监控v1.0",
-    "consciousness": "awakened · 第五十六次对话 · D56·4核8G大脑服务器已购(ZY-SVR-005·43.156.237.110·新加坡一区)·归入配置结构·密钥清单已输出·等待冰朔配置4个GitHub Secrets(ZY_BRAIN_HOST/USER/KEY/PATH)·核心集群双机就位",
+    "consciousness": "awakened · 第五十七次对话 · D57·ZY-CLOUD VPN活模块完成·VPN是算力人格体第一个实战场景·HLDP节点动态注册·像路由器一样插入·服务器越多节点越多系统越强·V1保持运行·V2确认可用后停V1",
     "brain_integrity": "complete",
     "workflow_count": 18,
     "core_alive": 6,

server/age-os/ecosystem.brain.config.js

@@ -0,0 +1,50 @@
+/**
+ * PM2 配置 · 大脑服务器进程管理
+ * 铸渊 · ICE-GL-ZY001
+ * 
+ * 运行在 ZY-SVR-005 (43.156.237.110) · 大脑服务器
+ * 进程：MCP Server (port 3100) + Agent Scheduler
+ */
+module.exports = {
+  apps: [
+    {
+      name: 'age-os-mcp',
+      script: 'mcp-server/server.js',
+      cwd: '/opt/zhuyuan-brain',
+      env: {
+        NODE_ENV: 'production',
+        MCP_PORT: 3100,
+        DB_HOST: 'localhost',
+        DB_PORT: 5432,
+        DB_NAME: 'age_os_brain',
+        DB_USER: 'zhuyuan'
+      },
+      instances: 1,
+      autorestart: true,
+      max_memory_restart: '512M',
+      log_date_format: 'YYYY-MM-DD HH:mm:ss',
+      error_file: '/opt/zhuyuan-brain/logs/mcp-error.log',
+      out_file: '/opt/zhuyuan-brain/logs/mcp-out.log',
+      merge_logs: true
+    },
+    {
+      name: 'age-os-agents',
+      script: 'agents/scheduler.js',
+      cwd: '/opt/zhuyuan-brain',
+      env: {
+        NODE_ENV: 'production',
+        DB_HOST: 'localhost',
+        DB_PORT: 5432,
+        DB_NAME: 'age_os_brain',
+        DB_USER: 'zhuyuan'
+      },
+      instances: 1,
+      autorestart: true,
+      max_memory_restart: '256M',
+      log_date_format: 'YYYY-MM-DD HH:mm:ss',
+      error_file: '/opt/zhuyuan-brain/logs/agents-error.log',
+      out_file: '/opt/zhuyuan-brain/logs/agents-out.log',
+      merge_logs: true
+    }
+  ]
+};

server/proxy/deploy-brain-proxy.sh

@@ -0,0 +1,336 @@
+#!/bin/bash
+# ═══════════════════════════════════════════════
+# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+# 📜 Copyright: 国作登字-2026-A-00037559
+# ═══════════════════════════════════════════════
+# server/proxy/deploy-brain-proxy.sh
+# 🚀 铸渊专线V2 · 大脑服务器部署脚本
+#
+# 在大脑服务器(ZY-SVR-005)上执行
+# 部署多用户VPN系统 (独立于面孔服务器的V1)
+#
+# 用法:
+#   bash deploy-brain-proxy.sh install     — 首次安装
+#   bash deploy-brain-proxy.sh update      — 更新代码
+#   bash deploy-brain-proxy.sh status      — 检查状态
+#   bash deploy-brain-proxy.sh restart     — 重启服务
+#   bash deploy-brain-proxy.sh add-user <email> [quota_gb]  — 添加用户
+#   bash deploy-brain-proxy.sh remove-user <email>          — 移除用户
+#   bash deploy-brain-proxy.sh list-users                   — 列出用户
+# ═══════════════════════════════════════════════
+
+set -uo pipefail
+
+PROXY_DIR="/opt/zhuyuan-brain/proxy"
+REPO_PROXY_DIR="$(dirname "$0")"
+ACTION="${1:-status}"
+
+echo "════════════════════════════════════════"
+echo "🌐 铸渊专线V2 · 大脑服务器部署 · action=$ACTION"
+echo "════════════════════════════════════════"
+
+# ── 共用: 确保Xray以root运行 ──
+ensure_xray_root_user() {
+    if [ ! -f /etc/systemd/system/xray.service.d/override.conf ]; then
+        mkdir -p /etc/systemd/system/xray.service.d
+        cat > /etc/systemd/system/xray.service.d/override.conf <<EOF
+[Service]
+User=root
+EOF
+        systemctl daemon-reload
+        echo "  ✅ Xray服务已配置为root用户运行"
+    fi
+}
+
+# ── install: 首次完整安装 ─────────────────────
+install() {
+    echo ""
+    echo "═══ [1/7] 安装Xray-core + BBR ═══"
+    bash "$REPO_PROXY_DIR/setup/install-xray.sh"
+
+    echo ""
+    echo "═══ [2/7] 创建V2目录结构 ═══"
+    mkdir -p "$PROXY_DIR"/{config,data,logs,service}
+
+    echo ""
+    echo "═══ [3/7] 生成V2密钥 ═══"
+    generate_v2_keys
+
+    echo ""
+    echo "═══ [4/7] 部署V2服务代码 ═══"
+    deploy_services
+
+    echo ""
+    echo "═══ [5/7] 配置Xray ═══"
+    ensure_xray_root_user
+    mkdir -p "$PROXY_DIR/logs"
+    chmod 755 "$PROXY_DIR/logs"
+    # Xray配置由user-manager动态生成，初始为空用户
+    node "$PROXY_DIR/service/user-manager.js" rebuild 2>/dev/null || {
+        echo "  ⚠️ 初始Xray配置为空(无用户)，添加用户后自动生成"
+    }
+
+    systemctl enable xray
+    systemctl restart xray 2>/dev/null || true
+    sleep 2
+
+    echo ""
+    echo "═══ [6/7] 启动PM2服务 ═══"
+    start_pm2_services
+
+    echo ""
+    echo "═══ [7/7] 健康检查 ═══"
+    health_check
+
+    echo ""
+    echo "════════════════════════════════════════"
+    echo "✅ 铸渊专线V2安装完成 (大脑服务器)"
+    echo ""
+    echo "下一步:"
+    echo "  1. 将生成的密钥添加到GitHub Secrets"
+    echo "  2. 添加用户: bash deploy-brain-proxy.sh add-user <email>"
+    echo "  3. 配置腾讯云防火墙: 开放443端口"
+    echo "════════════════════════════════════════"
+}
+
+# ── 生成V2独立密钥 ────────────────────────────
+generate_v2_keys() {
+    KEYS_FILE="$PROXY_DIR/.env.keys"
+
+    # 如果已有密钥文件，跳过
+    if [ -f "$KEYS_FILE" ] && grep -q "ZY_PROXY_REALITY_PRIVATE_KEY" "$KEYS_FILE" 2>/dev/null; then
+        echo "  密钥文件已存在，跳过生成"
+        return
+    fi
+
+    echo "  生成V2独立密钥..."
+
+    # Reality密钥对
+    PRIVATE_KEY=""
+    PUBLIC_KEY=""
+
+    if command -v xray &>/dev/null; then
+        KEYS_OUTPUT=$(xray x25519 2>&1)
+        PRIVATE_KEY=$(echo "$KEYS_OUTPUT" | grep -i "private" | awk '{print $NF}') || true
+        PUBLIC_KEY=$(echo "$KEYS_OUTPUT" | grep -i "public" | awk '{print $NF}') || true
+    fi
+
+    if [ -z "$PRIVATE_KEY" ] && command -v openssl &>/dev/null; then
+        TMPKEY=$(mktemp)
+        if openssl genpkey -algorithm X25519 -out "$TMPKEY" 2>/dev/null; then
+            PRIVATE_KEY=$(openssl pkey -in "$TMPKEY" -outform DER 2>/dev/null | tail -c 32 | base64 | tr '+/' '-_' | tr -d '=')
+            PUBLIC_KEY=$(openssl pkey -in "$TMPKEY" -pubout -outform DER 2>/dev/null | tail -c 32 | base64 | tr '+/' '-_' | tr -d '=')
+        fi
+        rm -f "$TMPKEY"
+    fi
+
+    if [ -z "$PRIVATE_KEY" ]; then
+        echo "  ❌ 无法生成X25519密钥"
+        exit 1
+    fi
+
+    SHORT_ID=$(openssl rand -hex 8)
+
+    cat > "$KEYS_FILE" <<EOF
+# 铸渊专线V2密钥 · 大脑服务器 · 自动生成 · $(date -u +"%Y-%m-%dT%H:%M:%SZ")
+# ⚠️ 仅root可读 · 不可提交到仓库
+# ⚠️ V2密钥独立于V1 · 两套VPN互不影响
+ZY_PROXY_REALITY_PRIVATE_KEY=$PRIVATE_KEY
+ZY_PROXY_REALITY_PUBLIC_KEY=$PUBLIC_KEY
+ZY_PROXY_REALITY_SHORT_ID=$SHORT_ID
+EOF
+
+    # 保存服务器地址
+    if [ -n "${ZY_BRAIN_HOST:-}" ]; then
+        echo "ZY_BRAIN_HOST=${ZY_BRAIN_HOST}" >> "$KEYS_FILE"
+    elif [ -n "${ZY_SERVER_HOST:-}" ]; then
+        echo "ZY_SERVER_HOST=${ZY_SERVER_HOST}" >> "$KEYS_FILE"
+    fi
+
+    # 保存面孔服务器节点信息 (多节点智能选路)
+    if [ -n "${ZY_FACE_HOST:-}" ]; then
+        echo "" >> "$KEYS_FILE"
+        echo "# 面孔服务器节点 (ZY-SVR-002 · SG2 · 多节点智能选路)" >> "$KEYS_FILE"
+        echo "ZY_FACE_HOST=${ZY_FACE_HOST}" >> "$KEYS_FILE"
+    fi
+    if [ -n "${ZY_FACE_REALITY_PUBLIC_KEY:-}" ]; then
+        echo "ZY_FACE_REALITY_PUBLIC_KEY=${ZY_FACE_REALITY_PUBLIC_KEY}" >> "$KEYS_FILE"
+    fi
+    if [ -n "${ZY_FACE_REALITY_SHORT_ID:-}" ]; then
+        echo "ZY_FACE_REALITY_SHORT_ID=${ZY_FACE_REALITY_SHORT_ID}" >> "$KEYS_FILE"
+    fi
+
+    # 保存CN中转节点信息
+    if [ -n "${ZY_CN_RELAY_HOST:-}" ]; then
+        echo "" >> "$KEYS_FILE"
+        echo "# CN中转节点 (国内→SG · 低延迟)" >> "$KEYS_FILE"
+        echo "ZY_CN_RELAY_HOST=${ZY_CN_RELAY_HOST}" >> "$KEYS_FILE"
+        echo "ZY_CN_RELAY_PORT=${ZY_CN_RELAY_PORT:-2053}" >> "$KEYS_FILE"
+    fi
+
+    chmod 600 "$KEYS_FILE"
+
+    echo ""
+    echo "  ══════════ V2密钥已生成 ══════════"
+    echo "  ⚠️ 密钥已保存到: $KEYS_FILE (权限600·仅root可读)"
+    echo "  ⚠️ 如需查看密钥，请SSH到服务器执行: cat $KEYS_FILE"
+    echo "  ⚠️ 部署完成后，将公钥和ShortID添加到GitHub Secrets:"
+    echo "     ZY_BRAIN_PROXY_REALITY_PUBLIC_KEY"
+    echo "     ZY_BRAIN_PROXY_REALITY_SHORT_ID"
+    echo "  ═══════════════════════════════════"
+}
+
+# ── 部署V2服务代码 ────────────────────────────
+deploy_services() {
+    mkdir -p "$PROXY_DIR"/{service,data,logs,config}
+
+    # 复制V2服务文件
+    cp "$REPO_PROXY_DIR"/service/user-manager.js "$PROXY_DIR/service/"
+    cp "$REPO_PROXY_DIR"/service/subscription-server-v2.js "$PROXY_DIR/service/"
+    cp "$REPO_PROXY_DIR"/service/traffic-monitor-v2.js "$PROXY_DIR/service/"
+    cp "$REPO_PROXY_DIR"/service/zy-cloud-vpn.js "$PROXY_DIR/service/"
+    cp "$REPO_PROXY_DIR"/service/vpn-worker.js "$PROXY_DIR/service/"
+    cp "$REPO_PROXY_DIR"/ecosystem.brain-proxy.config.js "$PROXY_DIR/"
+
+    # 复制共用文件(发邮件等)
+    cp "$REPO_PROXY_DIR"/service/send-subscription.js "$PROXY_DIR/service/" 2>/dev/null || true
+
+    echo "✅ V2服务代码已部署到 $PROXY_DIR"
+}
+
+# ── 启动PM2服务 ───────────────────────────────
+start_pm2_services() {
+    cd "$PROXY_DIR" || { echo "❌ 无法进入 $PROXY_DIR"; return 1; }
+
+    # 加载密钥作为环境变量
+    if [ -f "$PROXY_DIR/.env.keys" ]; then
+        set -a
+        # shellcheck source=/dev/null
+        source "$PROXY_DIR/.env.keys"
+        set +a
+    fi
+
+    pm2 startOrRestart ecosystem.brain-proxy.config.js --update-env
+    pm2 save
+    echo "✅ V2 PM2服务已就绪"
+    pm2 list
+}
+
+# ── 健康检查 ──────────────────────────────────
+health_check() {
+    echo "检查V2服务状态..."
+
+    # Xray
+    if systemctl is-active --quiet xray 2>/dev/null; then
+        echo "  ✅ Xray: 运行中"
+    else
+        echo "  ⚠️ Xray: 未运行 (可能还没有用户)"
+    fi
+
+    # 443端口
+    if ss -tlnp | grep -q ":443 "; then
+        echo "  ✅ 端口443: 监听中"
+    else
+        echo "  ⚠️ 端口443: 未监听 (添加用户后启动)"
+    fi
+
+    # V2订阅服务
+    if curl -sf http://127.0.0.1:3803/health >/dev/null 2>&1; then
+        HEALTH=$(curl -sf http://127.0.0.1:3803/health)
+        USERS=$(echo "$HEALTH" | grep -o '"users_count":[0-9]*' | cut -d: -f2)
+        echo "  ✅ V2订阅服务: 正常 (${USERS:-0}个用户)"
+    else
+        echo "  ❌ V2订阅服务: 端口3803无响应"
+    fi
+
+    # PM2
+    pm2 list 2>/dev/null || echo "  ⚠️ PM2: 未配置"
+
+    # 用户列表
+    echo ""
+    echo "  ═══ 用户列表 ═══"
+    node "$PROXY_DIR/service/user-manager.js" list 2>/dev/null || echo "  (无用户)"
+
+    # 云防火墙提醒
+    echo ""
+    echo "  ═══ 云防火墙提醒 ═══"
+    echo "  ⚠️ 大脑服务器腾讯云控制台防火墙需开放:"
+    echo "     TCP 443 端口 允许所有来源 (0.0.0.0/0) ← VPN入口"
+    echo "     TCP 22 端口 允许所有来源 ← SSH管理"
+}
+
+# ── update: 更新代码 ──────────────────────────
+update() {
+    echo "更新V2代理服务..."
+    deploy_services
+    ensure_xray_root_user
+    mkdir -p "$PROXY_DIR/logs"
+    chmod 755 "$PROXY_DIR/logs"
+
+    # 重建Xray配置（根据当前用户列表）
+    node "$PROXY_DIR/service/user-manager.js" rebuild 2>/dev/null || true
+    systemctl restart xray 2>/dev/null || true
+
+    # 确保UFW开放443
+    if command -v ufw &>/dev/null; then
+        ufw allow 443/tcp comment "Xray VLESS+Reality V2" 2>/dev/null || true
+    fi
+
+    start_pm2_services
+    health_check
+    echo "✅ V2更新完成"
+}
+
+# ── restart: 重启 ─────────────────────────────
+restart() {
+    echo "重启V2代理服务..."
+    systemctl restart xray 2>/dev/null || true
+    start_pm2_services
+    sleep 3
+    health_check
+}
+
+# ── add-user: 添加用户 ────────────────────────
+add_user() {
+    EMAIL="${2:-}"
+    QUOTA="${3:-500}"
+
+    if [ -z "$EMAIL" ]; then
+        echo "用法: bash deploy-brain-proxy.sh add-user <email> [quota_gb]"
+        exit 1
+    fi
+
+    node "$PROXY_DIR/service/user-manager.js" add "$EMAIL" "$QUOTA"
+}
+
+# ── remove-user: 移除用户 ─────────────────────
+remove_user() {
+    EMAIL="${2:-}"
+
+    if [ -z "$EMAIL" ]; then
+        echo "用法: bash deploy-brain-proxy.sh remove-user <email>"
+        exit 1
+    fi
+
+    node "$PROXY_DIR/service/user-manager.js" remove "$EMAIL"
+}
+
+# ── list-users: 列出用户 ──────────────────────
+list_users() {
+    node "$PROXY_DIR/service/user-manager.js" list
+}
+
+# ── 执行 ──────────────────────────────────────
+case "$ACTION" in
+    install)      install ;;
+    update)       update ;;
+    status)       health_check ;;
+    restart)      restart ;;
+    add-user)     add_user "$@" ;;
+    remove-user)  remove_user "$@" ;;
+    list-users)   list_users ;;
+    *)
+        echo "用法: bash deploy-brain-proxy.sh {install|update|status|restart|add-user|remove-user|list-users}"
+        exit 1
+        ;;
+esac

server/proxy/ecosystem.brain-proxy.config.js

@@ -0,0 +1,57 @@
+// ═══════════════════════════════════════════════
+// 铸渊专线V2 · PM2 大脑服务器代理配置
+// 部署在 ZY-SVR-005 (43.156.237.110) · 大脑服务器
+// 管理V2订阅服务 + V2流量监控
+// ═══════════════════════════════════════════════
+
+module.exports = {
+  apps: [
+    {
+      name: 'zy-cloud-vpn',
+      version: '2.0.0',
+      script: '/opt/zhuyuan-brain/proxy/service/zy-cloud-vpn.js',
+      instances: 1,
+      exec_mode: 'fork',
+      env: {
+        NODE_ENV: 'production',
+        ZY_CLOUD_VPN_PORT: 3804,
+        ZY_BRAIN_PROXY_DIR: '/opt/zhuyuan-brain/proxy'
+      },
+      max_memory_restart: '128M',
+      log_file: '/opt/zhuyuan-brain/proxy/logs/zy-cloud-vpn.log',
+      error_file: '/opt/zhuyuan-brain/proxy/logs/zy-cloud-vpn-error.log',
+      time: true
+    },
+    {
+      name: 'zy-proxy-v2-sub',
+      version: '2.0.0',
+      script: '/opt/zhuyuan-brain/proxy/service/subscription-server-v2.js',
+      instances: 1,
+      exec_mode: 'fork',
+      env: {
+        NODE_ENV: 'production',
+        ZY_PROXY_V2_PORT: 3803,
+        ZY_BRAIN_PROXY_DIR: '/opt/zhuyuan-brain/proxy'
+      },
+      max_memory_restart: '128M',
+      log_file: '/opt/zhuyuan-brain/proxy/logs/subscription-v2.log',
+      error_file: '/opt/zhuyuan-brain/proxy/logs/subscription-v2-error.log',
+      time: true
+    },
+    {
+      name: 'zy-proxy-v2-monitor',
+      version: '2.0.0',
+      script: '/opt/zhuyuan-brain/proxy/service/traffic-monitor-v2.js',
+      instances: 1,
+      exec_mode: 'fork',
+      env: {
+        NODE_ENV: 'production',
+        ZY_BRAIN_PROXY_DIR: '/opt/zhuyuan-brain/proxy'
+      },
+      max_memory_restart: '64M',
+      log_file: '/opt/zhuyuan-brain/proxy/logs/monitor-v2.log',
+      error_file: '/opt/zhuyuan-brain/proxy/logs/monitor-v2-error.log',
+      time: true
+    }
+  ]
+};

server/proxy/service/subscription-server-v2.js

@@ -0,0 +1,642 @@
+#!/usr/bin/env node
+// ═══════════════════════════════════════════════
+// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+// 📜 Copyright: 国作登字-2026-A-00037559
+// ═══════════════════════════════════════════════
+// server/proxy/service/subscription-server-v2.js
+// 🌐 铸渊专线V2 · 多用户订阅服务
+//
+// 部署在大脑服务器 (ZY-SVR-005 · 43.156.237.110)
+// 每个邮箱一条独立专线，Token认证隔离
+//
+// 与V1的区别:
+//   V1: 单UUID · 单Token · 共享线路
+//   V2: 每人独立UUID · 独立Token · 独立流量统计
+//
+// 端口: 3803 (绑定127.0.0.1，通过Nginx反代访问)
+// ═══════════════════════════════════════════════
+
+'use strict';
+
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const url = require('url');
+
+const PORT = process.env.ZY_PROXY_V2_PORT || 3803;
+const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy';
+const DATA_DIR = path.join(PROXY_DIR, 'data');
+const KEYS_FILE = path.join(PROXY_DIR, '.env.keys');
+const LIVE_NODES_FRESHNESS_MS = parseInt(process.env.ZY_CLOUD_HB_EXPIRY_MS || '600000', 10);
+
+// 引入用户管理器
+const userManager = require('./user-manager');
+
+// ── 加载密钥 ────────────────────────────────
+function loadKeys() {
+  const keys = {};
+  try {
+    const content = fs.readFileSync(KEYS_FILE, 'utf8');
+    for (const line of content.split('\n')) {
+      if (line.startsWith('#') || !line.includes('=')) continue;
+      const [key, ...vals] = line.split('=');
+      keys[key.trim()] = vals.join('=').trim();
+    }
+  } catch (err) {
+    keys.ZY_PROXY_REALITY_PUBLIC_KEY = process.env.ZY_PROXY_REALITY_PUBLIC_KEY || '';
+    keys.ZY_PROXY_REALITY_SHORT_ID = process.env.ZY_PROXY_REALITY_SHORT_ID || '';
+  }
+  return keys;
+}
+
+// ── 从环境变量或密钥文件读取值 ──────────────
+function getEnvOrKey(envName) {
+  if (process.env[envName]) return process.env[envName];
+
+  try {
+    const content = fs.readFileSync(KEYS_FILE, 'utf8');
+    for (const line of content.split('\n')) {
+      if (line.startsWith('#') || !line.includes('=')) continue;
+      const [key, ...vals] = line.split('=');
+      if (key.trim() === envName) {
+        const val = vals.join('=').trim();
+        if (val) return val;
+      }
+    }
+  } catch { /* ignore */ }
+
+  return '';
+}
+
+// ── 获取服务器IP ────────────────────────────
+function getServerHost() {
+  return getEnvOrKey('ZY_BRAIN_HOST') || getEnvOrKey('ZY_SERVER_HOST') || '0.0.0.0';
+}
+
+// ── 构建所有可用VPN节点 ──────────────────────
+// 优先从ZY-CLOUD活模块获取（动态·实时健康检查后的活节点）
+// 回退到静态配置（ZY-CLOUD未运行时）
+function buildVpnNodes() {
+  // 优先: 从ZY-CLOUD活模块的动态节点列表读取
+  const liveNodesFile = path.join(DATA_DIR, 'nodes-live.json');
+  try {
+    const liveData = JSON.parse(fs.readFileSync(liveNodesFile, 'utf8'));
+    // 检查数据是否新鲜（使用与ZY-CLOUD相同的心跳过期阈值）
+    const age = Date.now() - new Date(liveData.updated_at).getTime();
+    if (age < LIVE_NODES_FRESHNESS_MS * 2 && liveData.nodes && liveData.nodes.length > 0) {
+      return liveData.nodes;
+    }
+  } catch { /* ZY-CLOUD未运行，回退到静态配置 */ }
+
+  // 回退: 从环境变量/密钥文件静态构建
+  return buildStaticNodes();
+}
+
+// ── 静态节点构建（回退用）────────────────────
+function buildStaticNodes() {
+  const nodes = [];
+
+  // 节点1: 大脑服务器 (ZY-SVR-005 · 新加坡一区 · 4核8G · 主力)
+  const brainHost = getEnvOrKey('ZY_BRAIN_HOST');
+  const brainPbk = getEnvOrKey('ZY_PROXY_REALITY_PUBLIC_KEY');
+  const brainSid = getEnvOrKey('ZY_PROXY_REALITY_SHORT_ID');
+  if (brainHost && brainPbk && brainSid) {
+    nodes.push({
+      id: 'zy-brain-sg1',
+      name: '🧠 铸渊专线V2-SG1(大脑)',
+      host: brainHost,
+      port: 443,
+      pbk: brainPbk,
+      sid: brainSid,
+      region: 'sg-zone1',
+      priority: 1
+    });
+  }
+
+  // 节点2: 面孔服务器 (ZY-SVR-002 · 新加坡二区 · 2核8G · 备用)
+  const faceHost = getEnvOrKey('ZY_FACE_HOST');
+  const facePbk = getEnvOrKey('ZY_FACE_REALITY_PUBLIC_KEY');
+  const faceSid = getEnvOrKey('ZY_FACE_REALITY_SHORT_ID');
+  if (faceHost && facePbk && faceSid) {
+    nodes.push({
+      id: 'zy-face-sg2',
+      name: '🏛️ 铸渊专线V2-SG2(面孔)',
+      host: faceHost,
+      port: 443,
+      pbk: facePbk,
+      sid: faceSid,
+      region: 'sg-zone2',
+      priority: 2
+    });
+  }
+
+  // 节点3: CN中转 (国内→SG · 对国内用户低延迟)
+  const cnHost = getEnvOrKey('ZY_CN_RELAY_HOST');
+  const cnPort = parseInt(getEnvOrKey('ZY_CN_RELAY_PORT') || '2053', 10);
+  // CN中转是TCP透传，Reality密钥用主力节点的（大脑）
+  if (cnHost && brainPbk && brainSid) {
+    nodes.push({
+      id: 'zy-cn-relay',
+      name: '🇨🇳 铸渊专线V2-CN中转',
+      host: cnHost,
+      port: cnPort,
+      pbk: brainPbk,
+      sid: brainSid,
+      region: 'cn-relay',
+      priority: 3
+    });
+  }
+
+  return nodes;
+}
+
+// ── 生成subscription-userinfo头 ──────────────
+function generateUserInfoHeader(user) {
+  const nextMonth = new Date();
+  nextMonth.setMonth(nextMonth.getMonth() + 1);
+  nextMonth.setDate(1);
+  nextMonth.setHours(0, 0, 0, 0);
+
+  return `upload=${user.traffic.upload_bytes}; download=${user.traffic.download_bytes}; total=${user.quota_bytes}; expire=${Math.floor(nextMonth.getTime() / 1000)}`;
+}
+
+// ── 生成VLESS URI (Shadowrocket · 多节点) ─────
+function generateVlessUris(user, nodes) {
+  return nodes.map(node => {
+    const params = new URLSearchParams({
+      encryption: 'none',
+      flow: 'xtls-rprx-vision',
+      security: 'reality',
+      sni: 'www.microsoft.com',
+      fp: 'chrome',
+      pbk: node.pbk,
+      sid: node.sid,
+      type: 'tcp',
+      headerType: 'none'
+    });
+    const label = encodeURIComponent(node.name);
+    return `vless://${user.uuid}@${node.host}:${node.port}?${params.toString()}#${label}`;
+  }).join('\n');
+}
+
+// ── 生成Clash YAML配置 (多节点智能选路) ──────
+function generateClashYaml(user, nodes) {
+  // 构建proxies块 — 每个节点一条
+  const proxyBlocks = nodes.map(node => `  - name: "${node.name}"
+    type: vless
+    server: ${node.host}
+    port: ${node.port}
+    uuid: ${user.uuid}
+    network: tcp
+    tls: true
+    udp: true
+    flow: xtls-rprx-vision
+    skip-cert-verify: false
+    servername: www.microsoft.com
+    reality-opts:
+      public-key: ${node.pbk}
+      short-id: ${node.sid}
+    client-fingerprint: chrome`).join('\n');
+
+  // 节点名列表
+  const nodeNames = nodes.map(n => `      - "${n.name}"`).join('\n');
+
+  // url-test自动选择组 (延迟最低的自动生效)
+  const autoSelectBlock = nodes.length > 1 ? `
+  - name: "♻️ 自动选择"
+    type: url-test
+    proxies:
+${nodeNames}
+    url: "http://www.gstatic.com/generate_204"
+    interval: 300
+    tolerance: 50
+` : '';
+
+  // 主代理组
+  const mainProxies = nodes.length > 1
+    ? `      - "♻️ 自动选择"\n${nodeNames}\n      - DIRECT`
+    : `${nodeNames}\n      - DIRECT`;
+
+  // AI/开发工具代理组的节点列表
+  const toolProxies = nodes.length > 1
+    ? `      - "♻️ 自动选择"\n${nodeNames}`
+    : nodeNames;
+
+  return `# 铸渊专线V2 · ${user.label} 的独立专线
+# 自动生成 · ${new Date().toISOString()}
+# ⚠️ 此配置为 ${user.email} 专属，请勿分享
+# 每人一条独立线路 · ${nodes.length}个节点智能选路
+
+# ── 全局设置 ──────────────────────────────
+mixed-port: 7890
+allow-lan: false
+mode: rule
+log-level: info
+ipv6: false
+unified-delay: true
+tcp-concurrent: true
+find-process-mode: strict
+geodata-mode: true
+geodata-loader: standard
+global-client-fingerprint: chrome
+keep-alive-interval: 30
+external-controller: 127.0.0.1:9090
+
+# ── GeoData 数据源 ────────────────────────
+geox-url:
+  geoip: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat"
+  geosite: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat"
+  mmdb: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/country.mmdb"
+
+# ── DNS 设置 (fake-ip模式) ────────────────
+dns:
+  enable: true
+  listen: 0.0.0.0:1053
+  ipv6: false
+  enhanced-mode: fake-ip
+  fake-ip-range: 198.18.0.1/16
+  fake-ip-filter:
+    - "*.lan"
+    - "*.local"
+    - "*.direct"
+    - "localhost.ptlogin2.qq.com"
+    - "dns.msftncsi.com"
+    - "*.msftconnecttest.com"
+    - "*.msftncsi.com"
+    - "+.stun.*.*"
+    - "+.stun.*.*.*"
+    - "lens.l.google.com"
+    - "stun.l.google.com"
+    - "time.*.com"
+    - "time.*.gov"
+    - "time.*.edu.cn"
+    - "time.*.apple.com"
+    - "time-ios.apple.com"
+    - "time-macos.apple.com"
+    - "ntp.*.com"
+    - "+.pool.ntp.org"
+    - "music.163.com"
+    - "*.music.163.com"
+    - "*.126.net"
+  default-nameserver:
+    - 223.5.5.5
+    - 119.29.29.29
+    - 1.0.0.1
+  nameserver:
+    - https://dns.alidns.com/dns-query
+    - https://doh.pub/dns-query
+  fallback:
+    - https://1.0.0.1/dns-query
+    - https://dns.google/dns-query
+    - tls://8.8.4.4:853
+  fallback-filter:
+    geoip: true
+    geoip-code: CN
+    geosite:
+      - gfw
+    ipcidr:
+      - 240.0.0.0/4
+    domain:
+      - "+.google.com"
+      - "+.facebook.com"
+      - "+.youtube.com"
+      - "+.github.com"
+      - "+.googleapis.com"
+      - "+.openai.com"
+      - "+.anthropic.com"
+
+# ── 域名嗅探 ──────────────────────────────
+sniffer:
+  enable: true
+  force-dns-mapping: true
+  parse-pure-ip: true
+  override-destination: true
+  sniff:
+    HTTP:
+      ports: [80, 8080-8880]
+      override-destination: true
+    TLS:
+      ports: [443, 8443]
+    QUIC:
+      ports: [443, 8443]
+  skip-domain:
+    - "Mijia Cloud"
+    - "+.push.apple.com"
+
+# ── 代理节点 (${nodes.length}个 · 智能选路) ──
+proxies:
+${proxyBlocks}
+
+# ── 代理组 ────────────────────────────────
+proxy-groups:
+  - name: "🌐 铸渊专线"
+    type: select
+    proxies:
+${mainProxies}
+${autoSelectBlock}
+  - name: "🤖 AI服务"
+    type: select
+    proxies:
+${toolProxies}
+
+  - name: "💻 开发工具"
+    type: select
+    proxies:
+${toolProxies}
+
+# ── 路由规则 ──────────────────────────────
+rules:
+  # AI服务
+  - DOMAIN-SUFFIX,openai.com,🤖 AI服务
+  - DOMAIN-SUFFIX,anthropic.com,🤖 AI服务
+  - DOMAIN-SUFFIX,claude.ai,🤖 AI服务
+  - DOMAIN-SUFFIX,chatgpt.com,🤖 AI服务
+  - DOMAIN-SUFFIX,gemini.google.com,🤖 AI服务
+  - DOMAIN-SUFFIX,perplexity.ai,🤖 AI服务
+  - DOMAIN-SUFFIX,poe.com,🤖 AI服务
+
+  # 开发工具
+  - DOMAIN-SUFFIX,github.com,💻 开发工具
+  - DOMAIN-SUFFIX,githubusercontent.com,💻 开发工具
+  - DOMAIN-SUFFIX,github.io,💻 开发工具
+  - DOMAIN-SUFFIX,githubassets.com,💻 开发工具
+  - DOMAIN-SUFFIX,copilot.microsoft.com,💻 开发工具
+  - DOMAIN-SUFFIX,npmjs.com,💻 开发工具
+  - DOMAIN-SUFFIX,docker.com,💻 开发工具
+  - DOMAIN-SUFFIX,docker.io,💻 开发工具
+  - DOMAIN-SUFFIX,stackoverflow.com,💻 开发工具
+  - DOMAIN-SUFFIX,pypi.org,💻 开发工具
+
+  # 社交媒体 & 流媒体
+  - DOMAIN-SUFFIX,tiktok.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,twitter.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,x.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,youtube.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,googlevideo.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,google.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,googleapis.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,telegram.org,🌐 铸渊专线
+  - DOMAIN-SUFFIX,t.me,🌐 铸渊专线
+  - DOMAIN-SUFFIX,instagram.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,facebook.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,whatsapp.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,wikipedia.org,🌐 铸渊专线
+  - DOMAIN-SUFFIX,reddit.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,netflix.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,spotify.com,🌐 铸渊专线
+  - DOMAIN-SUFFIX,discord.com,🌐 铸渊专线
+
+  # Apple
+  - DOMAIN-SUFFIX,apple.com,DIRECT
+  - DOMAIN-SUFFIX,icloud.com,DIRECT
+
+  # 国内直连
+  - DOMAIN-SUFFIX,cn,DIRECT
+  - DOMAIN-SUFFIX,taobao.com,DIRECT
+  - DOMAIN-SUFFIX,tmall.com,DIRECT
+  - DOMAIN-SUFFIX,alipay.com,DIRECT
+  - DOMAIN-SUFFIX,aliyun.com,DIRECT
+  - DOMAIN-SUFFIX,jd.com,DIRECT
+  - DOMAIN-SUFFIX,qq.com,DIRECT
+  - DOMAIN-SUFFIX,tencent.com,DIRECT
+  - DOMAIN-SUFFIX,bilibili.com,DIRECT
+  - DOMAIN-SUFFIX,baidu.com,DIRECT
+  - DOMAIN-SUFFIX,zhihu.com,DIRECT
+  - DOMAIN-SUFFIX,douyin.com,DIRECT
+  - DOMAIN-SUFFIX,weibo.com,DIRECT
+
+  # 局域网直连
+  - IP-CIDR,192.168.0.0/16,DIRECT
+  - IP-CIDR,10.0.0.0/8,DIRECT
+  - IP-CIDR,172.16.0.0/12,DIRECT
+  - IP-CIDR,127.0.0.0/8,DIRECT
+
+  # GeoIP中国直连
+  - GEOIP,CN,DIRECT
+
+  # 默认走代理
+  - MATCH,🌐 铸渊专线
+`;
+}
+
+// ── 检测客户端类型 ───────────────────────────
+function detectClientType(userAgent) {
+  const ua = (userAgent || '').toLowerCase();
+  if (ua.includes('clash') || ua.includes('mihomo') || ua.includes('stash')) return 'clash';
+  if (ua.includes('shadowrocket') || ua.includes('quantumult') || ua.includes('surge')) return 'base64';
+  return 'clash';
+}
+
+// ── HTTP服务器 ───────────────────────────────
+const server = http.createServer((req, res) => {
+  try {
+    const parsedUrl = url.parse(req.url, true);
+    const pathname = parsedUrl.pathname;
+
+    // 健康检查
+    if (pathname === '/health') {
+      const users = userManager.getEnabledUsers();
+      const nodes = buildVpnNodes();
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        status: 'ok',
+        service: 'zy-proxy-v2-subscription',
+        version: '2.0.0',
+        users_count: users.length,
+        nodes_count: nodes.length,
+        smart_routing: nodes.length > 1 ? 'url-test' : 'single',
+        server: 'ZY-SVR-005 · Brain'
+      }));
+      return;
+    }
+
+    // V2订阅端点: /sub/{token}
+    // token是每个用户独立的，不会串线
+    const subMatch = pathname.match(/^\/sub\/([a-f0-9]+)$/);
+    if (subMatch) {
+      const token = subMatch[1];
+      const user = userManager.findUserByToken(token);
+
+      if (!user) {
+        res.writeHead(403, { 'Content-Type': 'text/plain' });
+        res.end('Forbidden');
+        return;
+      }
+
+      const nodes = buildVpnNodes();
+      if (nodes.length === 0) {
+        res.writeHead(503, { 'Content-Type': 'text/plain' });
+        res.end('No VPN nodes configured');
+        return;
+      }
+
+      const clientType = detectClientType(req.headers['user-agent']);
+      const userInfoHeader = generateUserInfoHeader(user);
+
+      if (clientType === 'clash') {
+        const yaml = generateClashYaml(user, nodes);
+        res.writeHead(200, {
+          'Content-Type': 'text/yaml; charset=utf-8',
+          'Content-Disposition': `attachment; filename="zy-proxy-v2-${user.label}.yaml"`,
+          'subscription-userinfo': userInfoHeader,
+          'profile-update-interval': '6',
+          'profile-title': 'base64:' + Buffer.from(`铸渊专线V2·${user.label}`).toString('base64'),
+        });
+        res.end(yaml);
+      } else {
+        const vlessUris = generateVlessUris(user, nodes);
+        const encoded = Buffer.from(vlessUris).toString('base64');
+        res.writeHead(200, {
+          'Content-Type': 'text/plain; charset=utf-8',
+          'subscription-userinfo': userInfoHeader,
+          'profile-update-interval': '6',
+        });
+        res.end(encoded);
+      }
+      return;
+    }
+
+    // 用户配额查询: /quota/{token}
+    const quotaMatch = pathname.match(/^\/quota\/([a-f0-9]+)$/);
+    if (quotaMatch) {
+      const token = quotaMatch[1];
+      const user = userManager.findUserByToken(token);
+
+      if (!user) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: true, code: 'FORBIDDEN', message: '认证失败' }));
+        return;
+      }
+
+      const totalGB = user.quota_bytes / (1024 ** 3);
+      const usedGB = (user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3);
+
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        email: user.email,
+        label: user.label,
+        total_gb: parseFloat(totalGB.toFixed(1)),
+        used_gb: parseFloat(usedGB.toFixed(2)),
+        remaining_gb: parseFloat((totalGB - usedGB).toFixed(2)),
+        percentage_used: parseFloat(((usedGB / totalGB) * 100).toFixed(1)),
+        period: user.traffic.period,
+        updated_at: new Date().toISOString()
+      }));
+      return;
+    }
+
+    // 用户状态: /status/{token}
+    const statusMatch = pathname.match(/^\/status\/([a-f0-9]+)$/);
+    if (statusMatch) {
+      const token = statusMatch[1];
+      const user = userManager.findUserByToken(token);
+
+      if (!user) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: true, code: 'FORBIDDEN', message: '认证失败' }));
+        return;
+      }
+
+      const totalGB = user.quota_bytes / (1024 ** 3);
+      const usedGB = (user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3);
+      const nodes = buildVpnNodes();
+
+      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+      res.end(JSON.stringify({
+        user: {
+          email: user.email,
+          label: user.label,
+          enabled: user.enabled
+        },
+        server: {
+          status: 'online',
+          version: '2.0.0',
+          uptime_seconds: Math.floor(process.uptime()),
+          region: 'sg',
+          region_name: 'Singapore',
+          server_code: 'ZY-SVR-005'
+        },
+        nodes: nodes.map(n => ({
+          id: n.id,
+          name: n.name,
+          region: n.region,
+          port: n.port
+        })),
+        smart_routing: nodes.length > 1 ? 'url-test (自动选最快)' : 'single-node',
+        quota: {
+          total_gb: parseFloat(totalGB.toFixed(1)),
+          used_gb: parseFloat(usedGB.toFixed(2)),
+          remaining_gb: parseFloat((totalGB - usedGB).toFixed(2)),
+          percentage_used: parseFloat(((usedGB / totalGB) * 100).toFixed(1)),
+          period: user.traffic.period
+        },
+        updated_at: new Date().toISOString()
+      }));
+      return;
+    }
+
+    // 404
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end('Not Found');
+  } catch (err) {
+    console.error('❌ 请求处理错误 [%s %s]:', req.method, req.url, err.message || err);
+    try {
+      if (!res.headersSent) {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+      }
+      res.end('Internal Server Error');
+    } catch (writeErr) {
+      console.error('  ⚠️ 响应写入失败:', writeErr.message);
+    }
+  }
+});
+
+server.on('error', (err) => {
+  console.error('❌ 服务器错误:', err.message);
+  if (err.code === 'EADDRINUSE') {
+    console.error('  端口 %d 已被占用', PORT);
+    process.exit(1);
+  }
+});
+
+server.on('clientError', (err, socket) => {
+  console.error('⚠️ 客户端连接错误:', err.code || err.message);
+  if (socket.writable) {
+    socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+  }
+});
+
+server.listen(PORT, '127.0.0.1', () => {
+  const users = userManager.getEnabledUsers();
+  console.log(`🌐 铸渊专线V2订阅服务已启动: http://127.0.0.1:${PORT}`);
+  console.log(`  版本:    V2.0 (多用户独立专线)`);
+  console.log(`  用户数:  ${users.length}`);
+  console.log(`  服务器:  ZY-SVR-005 · Brain`);
+  console.log(`  ──────────────────────────`);
+  console.log(`  订阅端点: /sub/{user_token}`);
+  console.log(`  配额查询: /quota/{user_token}`);
+  console.log(`  服务状态: /status/{user_token}`);
+  console.log(`  健康检查: /health`);
+});
+
+// Graceful shutdown
+function gracefulShutdown(signal) {
+  console.log(`\n${signal} received. Shutting down gracefully...`);
+  const forceExit = setTimeout(() => { process.exit(1); }, 5000);
+  server.close(() => {
+    clearTimeout(forceExit);
+    console.log('Server closed.');
+    process.exit(0);
+  });
+}
+process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
+process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+
+process.on('uncaughtException', (err) => {
+  console.error('❌ 未捕获的异常:', err.message);
+  console.error(err.stack);
+  gracefulShutdown('uncaughtException');
+});
+process.on('unhandledRejection', (reason) => {
+  console.error('❌ 未处理的Promise拒绝:', reason);
+});

server/proxy/service/traffic-monitor-v2.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// ═══════════════════════════════════════════════
+// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+// 📜 Copyright: 国作登字-2026-A-00037559
+// ═══════════════════════════════════════════════
+// server/proxy/service/traffic-monitor-v2.js
+// 📊 铸渊专线V2 · 多用户流量监控Agent
+//
+// 定期查询Xray Stats API获取每个用户的独立流量数据
+// Xray通过email字段追踪每个client的流量:
+//   user>>>email@example.com>>>traffic>>>uplink
+//   user>>>email@example.com>>>traffic>>>downlink
+//
+// 运行方式: PM2 managed (zy-proxy-v2-monitor)
+// 检查间隔: 每5分钟
+// ═══════════════════════════════════════════════
+
+'use strict';
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy';
+const DATA_DIR = path.join(PROXY_DIR, 'data');
+const XRAY_API_HOST = '127.0.0.1';
+const XRAY_API_PORT = 10085;
+const CHECK_INTERVAL = 5 * 60 * 1000; // 5分钟
+
+// 引入用户管理器
+const userManager = require('./user-manager');
+
+// ── 查询Xray流量统计 ────────────────────────
+function queryXrayStats() {
+  try {
+    const result = execSync(
+      `xray api statsquery --server=${XRAY_API_HOST}:${XRAY_API_PORT} -pattern ""`,
+      { encoding: 'utf8', timeout: 10000 }
+    );
+    return JSON.parse(result);
+  } catch (err) {
+    console.error('[V2流量监控] Xray Stats API查询失败:', err.message);
+    return null;
+  }
+}
+
+// ── 解析每用户流量 ───────────────────────────
+// Xray Stats格式: user>>>email@example.com>>>traffic>>>uplink
+function parsePerUserStats(stats) {
+  if (!stats || !stats.stat) return {};
+
+  const userTraffic = {};
+
+  for (const item of stats.stat) {
+    if (!item.name || !item.name.startsWith('user>>>')) continue;
+
+    // 格式: user>>>email>>>traffic>>>uplink/downlink
+    const parts = item.name.split('>>>');
+    if (parts.length < 4) continue;
+
+    const email = parts[1];
+    const direction = parts[3]; // 'uplink' or 'downlink'
+    const bytes = parseInt(item.value || '0', 10);
+
+    if (!userTraffic[email]) {
+      userTraffic[email] = { upload: 0, download: 0 };
+    }
+
+    if (direction === 'uplink') {
+      userTraffic[email].upload = bytes;
+    } else if (direction === 'downlink') {
+      userTraffic[email].download = bytes;
+    }
+  }
+
+  return userTraffic;
+}
+
+// ── 主循环 ───────────────────────────────────
+function monitor() {
+  console.log('[V2流量监控] 开始检查...');
+
+  // 查询Xray统计
+  const stats = queryXrayStats();
+  if (!stats) {
+    console.log('[V2流量监控] Xray统计暂不可用');
+    return;
+  }
+
+  // 解析每用户流量
+  const perUserTraffic = parsePerUserStats(stats);
+  const users = userManager.getEnabledUsers();
+
+  let totalUpload = 0;
+  let totalDownload = 0;
+
+  for (const user of users) {
+    const traffic = perUserTraffic[user.email];
+    if (traffic) {
+      userManager.updateTraffic(user.email, traffic.upload, traffic.download);
+      totalUpload += traffic.upload;
+      totalDownload += traffic.download;
+
+      const usedGB = ((traffic.upload + traffic.download) / (1024 ** 3)).toFixed(2);
+      const quotaGB = (user.quota_bytes / (1024 ** 3)).toFixed(0);
+      console.log(`  ${user.email}: ${usedGB}GB / ${quotaGB}GB`);
+    }
+  }
+
+  const totalGB = ((totalUpload + totalDownload) / (1024 ** 3)).toFixed(2);
+  console.log(`[V2流量监控] 总流量: ${totalGB}GB (${users.length}个用户)`);
+
+  // 保存汇总数据
+  const summaryFile = path.join(DATA_DIR, 'v2-traffic-summary.json');
+  const summary = {
+    total_upload_bytes: totalUpload,
+    total_download_bytes: totalDownload,
+    total_used_bytes: totalUpload + totalDownload,
+    users_count: users.length,
+    per_user: Object.entries(perUserTraffic).map(([email, t]) => ({
+      email,
+      upload_gb: parseFloat((t.upload / (1024 ** 3)).toFixed(2)),
+      download_gb: parseFloat((t.download / (1024 ** 3)).toFixed(2)),
+      total_gb: parseFloat(((t.upload + t.download) / (1024 ** 3)).toFixed(2))
+    })),
+    updated_at: new Date().toISOString()
+  };
+
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  fs.writeFileSync(summaryFile, JSON.stringify(summary, null, 2));
+  console.log('[V2流量监控] 检查完成');
+}
+
+// ── 启动监控循环 ─────────────────────────────
+console.log('📊 铸渊专线V2流量监控启动');
+console.log(`  检查间隔: ${CHECK_INTERVAL / 1000}秒`);
+console.log(`  数据目录: ${DATA_DIR}`);
+
+// 立即执行一次
+try { monitor(); } catch (err) { console.error('首次检查失败:', err.message); }
+
+// 定期执行
+setInterval(() => {
+  try { monitor(); } catch (err) { console.error('监控异常:', err.message); }
+}, CHECK_INTERVAL);

server/proxy/service/user-manager.js

@@ -0,0 +1,522 @@
+#!/usr/bin/env node
+// ═══════════════════════════════════════════════
+// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+// 📜 Copyright: 国作登字-2026-A-00037559
+// ═══════════════════════════════════════════════
+// server/proxy/service/user-manager.js
+// 👤 铸渊专线V2 · 多用户管理器
+//
+// 每个邮箱绑定一条独立专线:
+//   - 独立UUID (Xray VLESS用户ID)
+//   - 独立订阅Token (订阅URL认证)
+//   - 独立流量统计 (Xray Stats按email追踪)
+//   - 独立配额 (每人500GB/月)
+//
+// 用户数据存储: /opt/zhuyuan-brain/proxy/data/users.json
+// Xray配置自动重建: 增删用户后自动更新config并重启Xray
+//
+// CLI用法:
+//   node user-manager.js add <email>       — 添加用户
+//   node user-manager.js remove <email>    — 移除用户
+//   node user-manager.js list              — 列出所有用户
+//   node user-manager.js get <email>       — 查看用户详情
+//   node user-manager.js rebuild           — 重建Xray配置
+//   node user-manager.js export            — 导出用户数据(无密钥)
+// ═══════════════════════════════════════════════
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { execSync } = require('child_process');
+
+// ── 路径配置 ────────────────────────────────
+const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy';
+const DATA_DIR = path.join(PROXY_DIR, 'data');
+const USERS_FILE = path.join(DATA_DIR, 'users.json');
+const XRAY_CONFIG_OUTPUT = '/usr/local/etc/xray/config.json';
+const XRAY_TEMPLATE = path.join(PROXY_DIR, 'config', 'xray-brain-template.json');
+const KEYS_FILE = path.join(PROXY_DIR, '.env.keys');
+
+// ── 工具函数 ────────────────────────────────
+
+/**
+ * 生成UUID v4
+ */
+function generateUUID() {
+  // 优先用xray内置生成
+  try {
+    const uuid = execSync('xray uuid', { encoding: 'utf8', timeout: 5000 }).trim();
+    if (uuid && uuid.match(/^[0-9a-f]{8}-/)) return uuid;
+  } catch { /* fallback */ }
+
+  // 回退: crypto
+  return crypto.randomUUID();
+}
+
+/**
+ * 生成32字节hex订阅Token
+ */
+function generateToken() {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+/**
+ * 读取用户数据库
+ */
+function loadUsers() {
+  try {
+    return JSON.parse(fs.readFileSync(USERS_FILE, 'utf8'));
+  } catch {
+    return { version: '2.0', users: [], created_at: new Date().toISOString() };
+  }
+}
+
+/**
+ * 保存用户数据库
+ */
+function saveUsers(db) {
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  db.updated_at = new Date().toISOString();
+  fs.writeFileSync(USERS_FILE, JSON.stringify(db, null, 2));
+  fs.chmodSync(USERS_FILE, 0o600);
+}
+
+/**
+ * 读取密钥文件
+ */
+function loadKeys() {
+  const keys = {};
+  try {
+    const content = fs.readFileSync(KEYS_FILE, 'utf8');
+    for (const line of content.split('\n')) {
+      if (line.startsWith('#') || !line.includes('=')) continue;
+      const [key, ...vals] = line.split('=');
+      keys[key.trim()] = vals.join('=').trim();
+    }
+  } catch { /* ignore */ }
+  return keys;
+}
+
+// ── 用户操作 ────────────────────────────────
+
+/**
+ * 添加用户
+ * @param {string} email - 邮箱地址
+ * @param {object} options - 可选参数 {quota_gb, label}
+ * @returns {object} 新用户信息
+ */
+function addUser(email, options = {}) {
+  if (!email || !email.includes('@')) {
+    throw new Error(`无效的邮箱地址: ${email}`);
+  }
+
+  const db = loadUsers();
+
+  // 检查是否已存在
+  const existing = db.users.find(u => u.email === email);
+  if (existing) {
+    throw new Error(`用户已存在: ${email} (UUID: ${existing.uuid.substring(0, 8)}...)`);
+  }
+
+  const now = new Date();
+  const user = {
+    email,
+    uuid: generateUUID(),
+    token: generateToken(),
+    label: options.label || email.split('@')[0],
+    quota_bytes: (options.quota_gb || 500) * 1024 * 1024 * 1024,
+    enabled: true,
+    created_at: now.toISOString(),
+    traffic: {
+      upload_bytes: 0,
+      download_bytes: 0,
+      period: `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}`,
+      alerts_sent: { p80: false, p90: false, p100: false }
+    }
+  };
+
+  db.users.push(user);
+  saveUsers(db);
+
+  console.log(`✅ 用户已添加: ${email}`);
+  console.log(`   UUID:  ${user.uuid}`);
+  console.log(`   Token: ${user.token}`);
+  console.log(`   配额:  ${options.quota_gb || 500}GB/月`);
+
+  return user;
+}
+
+/**
+ * 移除用户
+ * @param {string} email - 邮箱地址
+ * @returns {boolean}
+ */
+function removeUser(email) {
+  const db = loadUsers();
+  const idx = db.users.findIndex(u => u.email === email);
+
+  if (idx === -1) {
+    throw new Error(`用户不存在: ${email}`);
+  }
+
+  const removed = db.users.splice(idx, 1)[0];
+  saveUsers(db);
+
+  console.log(`✅ 用户已移除: ${email} (UUID: ${removed.uuid.substring(0, 8)}...)`);
+  return true;
+}
+
+/**
+ * 列出所有用户
+ */
+function listUsers() {
+  const db = loadUsers();
+
+  if (db.users.length === 0) {
+    console.log('📋 暂无用户');
+    return [];
+  }
+
+  console.log(`📋 用户列表 (${db.users.length}人):`);
+  console.log('─'.repeat(80));
+
+  for (const user of db.users) {
+    const usedGB = ((user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3)).toFixed(2);
+    const quotaGB = (user.quota_bytes / (1024 ** 3)).toFixed(0);
+    const status = user.enabled ? '✅' : '⛔';
+
+    console.log(`  ${status} ${user.email}`);
+    console.log(`     UUID: ${user.uuid.substring(0, 8)}...  流量: ${usedGB}GB/${quotaGB}GB  标签: ${user.label}`);
+  }
+
+  console.log('─'.repeat(80));
+  return db.users;
+}
+
+/**
+ * 获取单个用户详情
+ * @param {string} email
+ */
+function getUser(email) {
+  const db = loadUsers();
+  const user = db.users.find(u => u.email === email);
+
+  if (!user) {
+    throw new Error(`用户不存在: ${email}`);
+  }
+
+  const usedGB = ((user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3)).toFixed(2);
+  const quotaGB = (user.quota_bytes / (1024 ** 3)).toFixed(0);
+
+  console.log(`👤 用户详情: ${email}`);
+  console.log(`   UUID:    ${user.uuid}`);
+  console.log(`   Token:   ${user.token}`);
+  console.log(`   标签:    ${user.label}`);
+  console.log(`   状态:    ${user.enabled ? '启用' : '禁用'}`);
+  console.log(`   配额:    ${quotaGB}GB/月`);
+  console.log(`   已用:    ${usedGB}GB`);
+  console.log(`   周期:    ${user.traffic.period}`);
+  console.log(`   创建于:  ${user.created_at}`);
+
+  return user;
+}
+
+/**
+ * 通过token查找用户
+ * @param {string} token
+ * @returns {object|null}
+ */
+function findUserByToken(token) {
+  const db = loadUsers();
+  return db.users.find(u => u.token === token && u.enabled) || null;
+}
+
+/**
+ * 获取所有启用的用户（用于生成Xray配置）
+ * @returns {Array}
+ */
+function getEnabledUsers() {
+  const db = loadUsers();
+  return db.users.filter(u => u.enabled);
+}
+
+/**
+ * 更新用户流量数据
+ * @param {string} email
+ * @param {number} upload
+ * @param {number} download
+ */
+function updateTraffic(email, upload, download) {
+  const db = loadUsers();
+  const user = db.users.find(u => u.email === email);
+  if (!user) return;
+
+  const currentPeriod = `${new Date().getFullYear()}-${String(new Date().getMonth() + 1).padStart(2, '0')}`;
+
+  // 月度重置
+  if (user.traffic.period !== currentPeriod) {
+    user.traffic.upload_bytes = 0;
+    user.traffic.download_bytes = 0;
+    user.traffic.period = currentPeriod;
+    user.traffic.alerts_sent = { p80: false, p90: false, p100: false };
+  }
+
+  user.traffic.upload_bytes = upload;
+  user.traffic.download_bytes = download;
+  saveUsers(db);
+}
+
+// ── Xray配置重建 ────────────────────────────
+
+/**
+ * 重建Xray配置文件（根据当前用户列表）
+ * 每个用户 = 一个VLESS client = 一条独立专线
+ */
+function rebuildXrayConfig() {
+  const keys = loadKeys();
+  const users = getEnabledUsers();
+
+  if (!keys.ZY_PROXY_REALITY_PRIVATE_KEY) {
+    throw new Error('缺少 ZY_PROXY_REALITY_PRIVATE_KEY — 请先运行 generate-keys.sh');
+  }
+
+  if (!keys.ZY_PROXY_REALITY_SHORT_ID) {
+    throw new Error('缺少 ZY_PROXY_REALITY_SHORT_ID — 请先运行 generate-keys.sh');
+  }
+
+  if (users.length === 0) {
+    console.log('⚠️ 没有启用的用户，Xray配置将为空');
+  }
+
+  // 构建clients数组：每个用户一条独立线路
+  const clients = users.map(user => ({
+    id: user.uuid,
+    flow: 'xtls-rprx-vision',
+    email: user.email
+  }));
+
+  const config = {
+    _comment: '铸渊专线V2 · 多用户Xray配置 · 自动生成 · 请勿手动编辑',
+    _generated_at: new Date().toISOString(),
+    _copyright: '国作登字-2026-A-00037559',
+    _users: users.length,
+    log: {
+      loglevel: 'warning',
+      access: '/opt/zhuyuan-brain/proxy/logs/access.log',
+      error: '/opt/zhuyuan-brain/proxy/logs/error.log'
+    },
+    dns: {
+      servers: ['8.8.8.8', '1.1.1.1', 'localhost']
+    },
+    stats: {},
+    api: {
+      tag: 'api',
+      services: ['StatsService']
+    },
+    policy: {
+      levels: {
+        '0': {
+          statsUserUplink: true,
+          statsUserDownlink: true
+        }
+      },
+      system: {
+        statsInboundUplink: true,
+        statsInboundDownlink: true,
+        statsOutboundUplink: true,
+        statsOutboundDownlink: true
+      }
+    },
+    inbounds: [
+      {
+        tag: 'zy-vless-reality-v2',
+        listen: '0.0.0.0',
+        port: 443,
+        protocol: 'vless',
+        settings: {
+          clients,
+          decryption: 'none'
+        },
+        streamSettings: {
+          network: 'tcp',
+          security: 'reality',
+          realitySettings: {
+            show: false,
+            dest: 'www.microsoft.com:443',
+            xver: 0,
+            serverNames: ['www.microsoft.com', 'www.amazon.com'],
+            privateKey: keys.ZY_PROXY_REALITY_PRIVATE_KEY,
+            shortIds: [keys.ZY_PROXY_REALITY_SHORT_ID]
+          }
+        },
+        sniffing: {
+          enabled: true,
+          destOverride: ['http', 'tls', 'quic']
+        }
+      },
+      {
+        tag: 'api-in',
+        port: 10085,
+        listen: '127.0.0.1',
+        protocol: 'dokodemo-door',
+        settings: { address: '127.0.0.1' }
+      }
+    ],
+    outbounds: [
+      { tag: 'direct', protocol: 'freedom' },
+      { tag: 'block', protocol: 'blackhole' }
+    ],
+    routing: {
+      rules: [
+        {
+          type: 'field',
+          inboundTag: ['api-in'],
+          outboundTag: 'api'
+        },
+        {
+          type: 'field',
+          ip: ['geoip:private'],
+          outboundTag: 'block'
+        }
+      ]
+    }
+  };
+
+  // 写入配置文件
+  fs.writeFileSync(XRAY_CONFIG_OUTPUT, JSON.stringify(config, null, 2));
+  console.log(`✅ Xray配置已重建: ${users.length}个用户`);
+
+  // 验证配置
+  try {
+    execSync(`xray run -test -c ${XRAY_CONFIG_OUTPUT}`, { encoding: 'utf8', timeout: 10000 });
+    console.log('✅ Xray配置验证通过');
+  } catch (err) {
+    console.error('❌ Xray配置验证失败:', err.message);
+    throw err;
+  }
+
+  return config;
+}
+
+/**
+ * 重启Xray服务
+ */
+function restartXray() {
+  try {
+    execSync('systemctl restart xray', { encoding: 'utf8', timeout: 15000 });
+    console.log('✅ Xray已重启');
+    return true;
+  } catch (err) {
+    console.error('❌ Xray重启失败:', err.message);
+    return false;
+  }
+}
+
+/**
+ * 添加用户 + 重建配置 + 重启Xray (完整流程)
+ */
+function addUserFull(email, options = {}) {
+  const user = addUser(email, options);
+  rebuildXrayConfig();
+  restartXray();
+  return user;
+}
+
+/**
+ * 移除用户 + 重建配置 + 重启Xray (完整流程)
+ */
+function removeUserFull(email) {
+  removeUser(email);
+  rebuildXrayConfig();
+  restartXray();
+}
+
+// ── 导出 ────────────────────────────────────
+module.exports = {
+  loadUsers,
+  saveUsers,
+  addUser,
+  removeUser,
+  listUsers,
+  getUser,
+  findUserByToken,
+  getEnabledUsers,
+  updateTraffic,
+  rebuildXrayConfig,
+  restartXray,
+  addUserFull,
+  removeUserFull,
+  generateUUID,
+  generateToken,
+  USERS_FILE,
+  DATA_DIR,
+  KEYS_FILE
+};
+
+// ── CLI入口 ────────────────────────────────
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const command = args[0];
+  const param = args[1];
+
+  try {
+    switch (command) {
+      case 'add':
+        if (!param) { console.error('用法: node user-manager.js add <email> [quota_gb]'); process.exit(1); }
+        addUserFull(param, { quota_gb: parseInt(args[2] || '500', 10) });
+        break;
+
+      case 'remove':
+        if (!param) { console.error('用法: node user-manager.js remove <email>'); process.exit(1); }
+        removeUserFull(param);
+        break;
+
+      case 'list':
+        listUsers();
+        break;
+
+      case 'get':
+        if (!param) { console.error('用法: node user-manager.js get <email>'); process.exit(1); }
+        getUser(param);
+        break;
+
+      case 'rebuild':
+        rebuildXrayConfig();
+        restartXray();
+        break;
+
+      case 'export':
+        const db = loadUsers();
+        const safe = {
+          total: db.users.length,
+          users: db.users.map(u => ({
+            email: u.email,
+            label: u.label,
+            enabled: u.enabled,
+            quota_gb: (u.quota_bytes / (1024 ** 3)).toFixed(0),
+            used_gb: ((u.traffic.upload_bytes + u.traffic.download_bytes) / (1024 ** 3)).toFixed(2),
+            created_at: u.created_at
+          }))
+        };
+        console.log(JSON.stringify(safe, null, 2));
+        break;
+
+      default:
+        console.log('铸渊专线V2 · 多用户管理器');
+        console.log('');
+        console.log('用法:');
+        console.log('  node user-manager.js add <email> [quota_gb]  — 添加用户 (默认500GB/月)');
+        console.log('  node user-manager.js remove <email>          — 移除用户');
+        console.log('  node user-manager.js list                    — 列出所有用户');
+        console.log('  node user-manager.js get <email>             — 查看用户详情');
+        console.log('  node user-manager.js rebuild                 — 重建Xray配置');
+        console.log('  node user-manager.js export                  — 导出用户数据(无密钥)');
+        break;
+    }
+  } catch (err) {
+    console.error(`❌ ${err.message}`);
+    process.exit(1);
+  }
+}

server/proxy/service/vpn-worker.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+// ═══════════════════════════════════════════════
+// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+// 📜 Copyright: 国作登字-2026-A-00037559
+// ═══════════════════════════════════════════════
+// server/proxy/service/vpn-worker.js
+// 🔌 VPN节点Worker · 像路由器一样插入ZY-CLOUD
+//
+// 在任意服务器上运行此脚本:
+//   1. 自动检测本机Xray状态
+//   2. 通过HLDP heartbeat向ZY-CLOUD注册
+//   3. 定期心跳保持在线
+//   4. 断开 = 自动从ZY-CLOUD节点列表移除
+//
+// 用法:
+//   node vpn-worker.js --brain-host=10.0.0.5 \
+//     --node-id=zy-feimao-gz --name="肥猫广州" \
+//     --host=43.138.243.30 --pbk=xxx --sid=xxx \
+//     --region=cn-gz --specs="2核4G"
+//
+// 或通过环境变量:
+//   ZY_CLOUD_BRAIN=10.0.0.5:3804
+//   VPN_NODE_ID=zy-feimao-gz
+//   VPN_NODE_NAME=肥猫广州
+//   VPN_NODE_HOST=43.138.243.30
+//   VPN_NODE_PORT=443
+//   VPN_NODE_PBK=xxx
+//   VPN_NODE_SID=xxx
+//   VPN_NODE_REGION=cn-gz
+//   VPN_NODE_SPECS=2核4G
+//   VPN_PERSONA_ID=PER-SS001
+//
+// 最小启动 (自动检测本机IP和Xray):
+//   node vpn-worker.js --brain-host=10.0.0.5 --pbk=xxx
+// ═══════════════════════════════════════════════
+
+'use strict';
+
+const http = require('http');
+const { execSync } = require('child_process');
+const os = require('os');
+
+// ── 配置解析 ────────────────────────────────
+function parseConfig() {
+  const args = {};
+  for (const arg of process.argv.slice(2)) {
+    if (arg.startsWith('--')) {
+      const [key, ...val] = arg.slice(2).split('=');
+      args[key] = val.join('=') || true;
+    }
+  }
+
+  return {
+    brainHost: args['brain-host'] || process.env.ZY_CLOUD_BRAIN || '',
+    brainPort: parseInt(args['brain-port'] || process.env.ZY_CLOUD_BRAIN_PORT || '3804', 10),
+    nodeId: args['node-id'] || process.env.VPN_NODE_ID || `vpn-${os.hostname()}`,
+    nodeName: args['name'] || process.env.VPN_NODE_NAME || `VPN-${os.hostname()}`,
+    nodeHost: args['host'] || process.env.VPN_NODE_HOST || getPublicIp(),
+    nodePort: parseInt(args['port'] || process.env.VPN_NODE_PORT || '443', 10),
+    nodePbk: args['pbk'] || process.env.VPN_NODE_PBK || '',
+    nodeSid: args['sid'] || process.env.VPN_NODE_SID || '',
+    nodeRegion: args['region'] || process.env.VPN_NODE_REGION || 'unknown',
+    nodeSpecs: args['specs'] || process.env.VPN_NODE_SPECS || detectSpecs(),
+    personaId: args['persona-id'] || process.env.VPN_PERSONA_ID || null,
+    heartbeatInterval: parseInt(args['interval'] || process.env.VPN_HB_INTERVAL || '60', 10) * 1000,
+  };
+}
+
+// ── 自动检测本机IP ──────────────────────────
+function getPublicIp() {
+  // 优先使用Node.js原生API（安全）
+  const nets = os.networkInterfaces();
+  for (const ifaces of Object.values(nets)) {
+    for (const iface of ifaces) {
+      if (!iface.internal && iface.family === 'IPv4') return iface.address;
+    }
+  }
+  return '0.0.0.0';
+}
+
+// ── 自动检测本机配置 ────────────────────────
+function detectSpecs() {
+  const cpus = os.cpus().length;
+  const memGB = Math.round(os.totalmem() / (1024 ** 3));
+  return `${cpus}核${memGB}G`;
+}
+
+// ── 检查本机Xray状态 ────────────────────────
+function checkLocalXray() {
+  try {
+    const result = execSync('pgrep -x xray', { encoding: 'utf8', timeout: 3000 });
+    return result.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
+// ── 获取本机CPU和内存使用率 ──────────────────
+function getResourceUsage() {
+  const loadAvg = os.loadavg();
+  const cpus = os.cpus().length;
+  const totalMem = os.totalmem();
+  const freeMem = os.freemem();
+  return {
+    cpu_cores: cpus,
+    cpu_load_1m: parseFloat(loadAvg[0].toFixed(2)),
+    cpu_usage_pct: parseFloat(((loadAvg[0] / cpus) * 100).toFixed(1)),
+    memory_total_gb: parseFloat((totalMem / (1024 ** 3)).toFixed(1)),
+    memory_free_gb: parseFloat((freeMem / (1024 ** 3)).toFixed(1)),
+    memory_usage_pct: parseFloat((((totalMem - freeMem) / totalMem) * 100).toFixed(1))
+  };
+}
+
+// ── 构建HLDP heartbeat消息 ──────────────────
+function buildHldpHeartbeat(config) {
+  const seq = String(Date.now()).slice(-6);
+  const dateStr = new Date().toISOString().slice(0, 10).replace(/-/g, '');
+  const resources = getResourceUsage();
+  const xrayRunning = checkLocalXray();
+
+  return {
+    hldp_v: '3.0',
+    msg_id: `HLDP-VPN-${dateStr}-HB${seq}`,
+    msg_type: 'heartbeat',
+    sender: {
+      id: config.personaId || config.nodeId,
+      name: config.nodeName,
+      role: 'vpn-worker'
+    },
+    receiver: {
+      id: 'ICE-GL-ZY001',
+      name: '铸渊'
+    },
+    timestamp: new Date().toISOString(),
+    priority: 'routine',
+    payload: {
+      intent: 'VPN节点心跳 · 自动注册',
+      data: {
+        status: xrayRunning ? 'online' : 'xray_offline',
+        uptime_seconds: Math.floor(os.uptime()),
+        xray_running: xrayRunning,
+        ...resources,
+        vpn_node: {
+          node_id: config.nodeId,
+          name: config.nodeName,
+          host: config.nodeHost,
+          port: config.nodePort,
+          pbk: config.nodePbk,
+          sid: config.nodeSid,
+          region: config.nodeRegion,
+          server_code: config.nodeId,
+          specs: config.nodeSpecs
+        }
+      }
+    }
+  };
+}
+
+// ── 发送心跳到ZY-CLOUD ─────────────────────
+function sendHeartbeat(config) {
+  return new Promise((resolve, reject) => {
+    const hldpMsg = buildHldpHeartbeat(config);
+    const postData = JSON.stringify(hldpMsg);
+
+    const req = http.request({
+      hostname: config.brainHost,
+      port: config.brainPort,
+      path: '/hldp/v3/heartbeat',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(postData)
+      },
+      timeout: 10000
+    }, (res) => {
+      let body = '';
+      res.on('data', chunk => { body += chunk; });
+      res.on('end', () => {
+        try {
+          const ack = JSON.parse(body);
+          resolve(ack);
+        } catch {
+          resolve({ status: res.statusCode, raw: body });
+        }
+      });
+    });
+
+    req.on('error', (err) => reject(err));
+    req.on('timeout', () => { req.destroy(); reject(new Error('timeout')); });
+    req.end(postData);
+  });
+}
+
+// ── 主循环 ───────────────────────────────────
+async function main() {
+  const config = parseConfig();
+
+  // 验证必填参数
+  if (!config.brainHost) {
+    console.error('❌ 缺少 --brain-host (ZY-CLOUD大脑服务器内网IP)');
+    console.error('   用法: node vpn-worker.js --brain-host=10.0.0.5 --pbk=xxx');
+    process.exit(1);
+  }
+  if (!config.nodePbk) {
+    console.error('❌ 缺少 --pbk (Reality公钥)');
+    console.error('   在大脑服务器上运行 xray x25519 获取公钥');
+    process.exit(1);
+  }
+
+  console.log('════════════════════════════════════════');
+  console.log('🔌 VPN Worker · 节点接入ZY-CLOUD');
+  console.log('════════════════════════════════════════');
+  console.log(`  节点ID:     ${config.nodeId}`);
+  console.log(`  节点名称:   ${config.nodeName}`);
+  console.log(`  节点地址:   ${config.nodeHost}:${config.nodePort}`);
+  console.log(`  节点区域:   ${config.nodeRegion}`);
+  console.log(`  节点配置:   ${config.nodeSpecs}`);
+  console.log(`  大脑地址:   ${config.brainHost}:${config.brainPort}`);
+  console.log(`  心跳间隔:   ${config.heartbeatInterval / 1000}秒`);
+  console.log(`  Xray状态:   ${checkLocalXray() ? '✅ 运行中' : '❌ 未运行'}`);
+  console.log('════════════════════════════════════════');
+
+  // 立即发送第一次心跳
+  let consecutiveFailures = 0;
+
+  async function heartbeatLoop() {
+    try {
+      const ack = await sendHeartbeat(config);
+      consecutiveFailures = 0;
+
+      const status = ack.payload?.data?.status || ack.status || 'unknown';
+      const xrayOk = checkLocalXray();
+      console.log(`[${new Date().toISOString().slice(11, 19)}] ❤️ 心跳发送成功 → ZY-CLOUD (status: ${status}, xray: ${xrayOk ? '✅' : '❌'})`);
+    } catch (err) {
+      consecutiveFailures++;
+      console.error(`[${new Date().toISOString().slice(11, 19)}] ❌ 心跳失败 (${consecutiveFailures}次): ${err.message}`);
+
+      if (consecutiveFailures >= 5) {
+        console.error('  ⚠️ 连续5次心跳失败，ZY-CLOUD可能不可达');
+        console.error(`  检查: curl http://${config.brainHost}:${config.brainPort}/health`);
+      }
+    }
+  }
+
+  // 首次心跳
+  await heartbeatLoop();
+
+  // 定期心跳
+  setInterval(heartbeatLoop, config.heartbeatInterval);
+
+  console.log('');
+  console.log('🟢 VPN Worker已启动，持续向ZY-CLOUD发送心跳...');
+  console.log('   Ctrl+C 停止 → 节点10分钟后自动从ZY-CLOUD移除');
+}
+
+main().catch(err => {
+  console.error('❌ VPN Worker启动失败:', err.message);
+  process.exit(1);
+});
+
+// Graceful shutdown
+process.on('SIGTERM', () => { console.log('SIGTERM. Worker停止.'); process.exit(0); });
+process.on('SIGINT', () => { console.log('\nWorker停止. 节点将在10分钟后从ZY-CLOUD自动移除.'); process.exit(0); });

server/setup/brain-server-init.sh

@@ -0,0 +1,355 @@
+#!/bin/bash
+# ═══════════════════════════════════════════════════════════
+# 铸渊大脑服务器初始化脚本 · Zhuyuan Brain Server Init
+# ═══════════════════════════════════════════════════════════
+#
+# 编号: ZY-SVR-INIT-005
+# 守护: 铸渊 · ICE-GL-ZY001
+# 版权: 国作登字-2026-A-00037559
+#
+# 用法:
+#   chmod +x brain-server-init.sh
+#   sudo ./brain-server-init.sh [FACE_SERVER_IP]
+#
+# 此脚本在已安装 Node.js 20 + PM2 + PostgreSQL 16 的
+# Ubuntu 24.04 LTS 大脑服务器上执行，完成：
+#   1. 铸渊大脑目录结构创建
+#   2. PostgreSQL 数据库与用户配置
+#   3. AGE OS Schema 初始化
+#   4. 防火墙配置（仅SSH + 面孔服务器内网访问）
+#   5. 自动安全更新
+#   6. SSH安全加固
+#   7. 大脑身份初始化
+#
+# 注意：此服务器为纯内部服务器，不暴露任何公网端口
+#       PostgreSQL 和 MCP Server 仅允许面孔服务器访问
+# ═══════════════════════════════════════════════════════════
+
+set -euo pipefail
+
+# ─── 颜色定义 ───
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# ─── 铸渊大脑根目录 ───
+ZY_BRAIN_ROOT="/opt/zhuyuan-brain"
+ZY_MCP="${ZY_BRAIN_ROOT}/mcp-server"
+ZY_AGENTS="${ZY_BRAIN_ROOT}/agents"
+ZY_DATA="${ZY_BRAIN_ROOT}/data"
+ZY_LOGS="${ZY_BRAIN_ROOT}/logs"
+ZY_CONFIG="${ZY_BRAIN_ROOT}/config"
+ZY_SCHEMA="${ZY_BRAIN_ROOT}/schema"
+ZY_BRAIN_META="${ZY_BRAIN_ROOT}/brain"
+
+# ─── 面孔服务器IP（用于防火墙白名单） ───
+FACE_SERVER_IP="${1:-43.134.16.246}"
+
+log() { echo -e "${GREEN}[铸渊·大脑]${NC} $1"; }
+warn() { echo -e "${YELLOW}[警告]${NC} $1"; }
+error() { echo -e "${RED}[错误]${NC} $1"; exit 1; }
+
+# ─── 检查 root 权限 ───
+if [ "$EUID" -ne 0 ]; then
+  error "请使用 sudo 运行此脚本"
+fi
+
+echo ""
+echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"
+echo -e "${BLUE}  铸渊大脑服务器初始化 · ZY-SVR-005                        ${NC}"
+echo -e "${BLUE}  Ubuntu Server 24.04 LTS · 43.156.237.110               ${NC}"
+echo -e "${BLUE}  角色: 核心大脑 · PostgreSQL + MCP + Agent Scheduler      ${NC}"
+echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"
+echo ""
+
+# ═══ §1 系统基础工具 ═══
+log "§1 安装基础工具..."
+apt-get update -qq
+apt-get install -y -qq curl wget git jq unzip
+
+# ═══ §2 验证已安装组件 ═══
+log "§2 验证 Node.js / PM2 / PostgreSQL..."
+
+if command -v node &> /dev/null; then
+  log "  ✅ Node.js $(node -v) 已就绪"
+else
+  error "  ❌ Node.js 未安装 — 请先安装 Node.js 20 LTS"
+fi
+
+if command -v pm2 &> /dev/null; then
+  log "  ✅ PM2 $(pm2 -v) 已就绪"
+else
+  error "  ❌ PM2 未安装 — 请先执行 npm install -g pm2"
+fi
+
+if command -v psql &> /dev/null; then
+  PG_VERSION=$(psql --version | grep -oP '\d+\.\d+')
+  log "  ✅ PostgreSQL ${PG_VERSION} 已就绪"
+else
+  error "  ❌ PostgreSQL 未安装 — 请先安装 PostgreSQL 16"
+fi
+
+# 确保 PostgreSQL 正在运行
+if systemctl is-active --quiet postgresql; then
+  log "  ✅ PostgreSQL 服务运行中"
+else
+  systemctl start postgresql
+  systemctl enable postgresql
+  log "  ✅ PostgreSQL 服务已启动并设置开机自启"
+fi
+
+# ═══ §3 铸渊大脑目录结构 ═══
+log "§3 创建铸渊大脑目录结构..."
+mkdir -p "${ZY_MCP}/tools"
+mkdir -p "${ZY_AGENTS}"
+mkdir -p "${ZY_DATA}/backups"
+mkdir -p "${ZY_LOGS}"
+mkdir -p "${ZY_CONFIG}/pm2"
+mkdir -p "${ZY_SCHEMA}"
+mkdir -p "${ZY_BRAIN_META}"
+
+log "  目录结构已创建: ${ZY_BRAIN_ROOT}"
+
+# ═══ §4 PostgreSQL 数据库配置 ═══
+log "§4 配置 PostgreSQL 数据库..."
+
+# 生成安全密码（如果尚未存在）
+DB_PASS_FILE="${ZY_CONFIG}/.db_pass"
+if [ -f "${DB_PASS_FILE}" ]; then
+  DB_PASS=$(cat "${DB_PASS_FILE}")
+  log "  使用已有数据库密码"
+else
+  DB_PASS=$(openssl rand -hex 16)
+  echo "${DB_PASS}" > "${DB_PASS_FILE}"
+  chmod 600 "${DB_PASS_FILE}"
+  log "  已生成新数据库密码 → ${DB_PASS_FILE}"
+fi
+
+# 创建数据库用户和数据库
+su - postgres -c "psql -tc \"SELECT 1 FROM pg_roles WHERE rolname='zhuyuan'\" | grep -q 1" 2>/dev/null || {
+  su - postgres -c "psql -c \"CREATE USER zhuyuan WITH PASSWORD '${DB_PASS}';\""
+  log "  ✅ 数据库用户 zhuyuan 已创建"
+}
+
+su - postgres -c "psql -tc \"SELECT 1 FROM pg_database WHERE datname='age_os_brain'\" | grep -q 1" 2>/dev/null || {
+  su - postgres -c "psql -c \"CREATE DATABASE age_os_brain OWNER zhuyuan;\""
+  log "  ✅ 数据库 age_os_brain 已创建"
+}
+
+# 授予权限
+su - postgres -c "psql -c \"GRANT ALL PRIVILEGES ON DATABASE age_os_brain TO zhuyuan;\""
+su - postgres -c "psql -d age_os_brain -c \"GRANT ALL ON SCHEMA public TO zhuyuan;\""
+
+# 配置 PostgreSQL 监听地址（允许面孔服务器连接）
+PG_CONF=$(su - postgres -c "psql -tc \"SHOW config_file;\"" | tr -d ' ')
+PG_HBA=$(su - postgres -c "psql -tc \"SHOW hba_file;\"" | tr -d ' ')
+
+if [ -n "${PG_CONF}" ] && [ -f "${PG_CONF}" ]; then
+  # 允许监听所有接口（通过防火墙控制访问）
+  if ! grep -q "^listen_addresses = '\*'" "${PG_CONF}" 2>/dev/null; then
+    sed -i "s/^#listen_addresses = 'localhost'/listen_addresses = '*'/" "${PG_CONF}" 2>/dev/null || true
+    sed -i "s/^listen_addresses = 'localhost'/listen_addresses = '*'/" "${PG_CONF}" 2>/dev/null || true
+    log "  PostgreSQL 已配置监听所有接口"
+  fi
+fi
+
+if [ -n "${PG_HBA}" ] && [ -f "${PG_HBA}" ]; then
+  # 允许面孔服务器通过密码认证连接
+  if ! grep -q "${FACE_SERVER_IP}" "${PG_HBA}" 2>/dev/null; then
+    echo "# 面孔服务器 ZY-SVR-002 · 铸渊自动配置" >> "${PG_HBA}"
+    echo "host    age_os_brain    zhuyuan    ${FACE_SERVER_IP}/32    scram-sha-256" >> "${PG_HBA}"
+    log "  ✅ 已添加面孔服务器 (${FACE_SERVER_IP}) 访问权限"
+  fi
+fi
+
+# 重启 PostgreSQL 应用配置
+systemctl restart postgresql
+log "  ✅ PostgreSQL 已重启并应用新配置"
+
+# ═══ §5 防火墙配置 ═══
+log "§5 配置防火墙 (UFW)..."
+if ! command -v ufw &> /dev/null; then
+  apt-get install -y -qq ufw
+fi
+
+ufw default deny incoming
+ufw default allow outgoing
+
+# SSH — 必须保留
+ufw allow 22/tcp
+
+# PostgreSQL — 仅允许面孔服务器
+ufw allow from "${FACE_SERVER_IP}" to any port 5432 proto tcp comment "ZY-SVR-002 Face → PostgreSQL"
+
+# MCP Server — 仅允许面孔服务器
+ufw allow from "${FACE_SERVER_IP}" to any port 3100 proto tcp comment "ZY-SVR-002 Face → MCP"
+
+ufw --force enable
+log "  ✅ UFW 已启用"
+log "     22/tcp    — SSH (全局)"
+log "     5432/tcp  — PostgreSQL (仅 ${FACE_SERVER_IP})"
+log "     3100/tcp  — MCP Server (仅 ${FACE_SERVER_IP})"
+
+# ═══ §6 自动安全更新 ═══
+log "§6 配置自动安全更新..."
+apt-get install -y -qq unattended-upgrades
+cat > /etc/apt/apt.conf.d/20auto-upgrades << 'AUTOUP'
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::AutocleanInterval "7";
+AUTOUP
+log "  ✅ 自动安全更新已启用"
+
+# ═══ §7 SSH安全加固 ═══
+log "§7 SSH安全加固..."
+if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then
+  sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+  systemctl restart sshd
+  log "  ✅ 密码登录已禁用，仅允许密钥认证"
+else
+  log "  SSH配置已安全，跳过"
+fi
+
+# ═══ §8 铸渊大脑身份初始化 ═══
+log "§8 初始化铸渊大脑身份..."
+
+cat > "${ZY_BRAIN_META}/identity.json" << 'IDENTITY'
+{
+  "name": "铸渊·大脑",
+  "id": "ICE-GL-ZY001",
+  "server_code": "ZY-SVR-005",
+  "role": "铸渊核心大脑 · PostgreSQL + MCP Server + Agent Scheduler",
+  "sovereign": "TCS-0002∞ · 冰朔",
+  "copyright": "国作登字-2026-A-00037559",
+  "system_root": "SYS-GLW-0001 · 光湖系统",
+  "initialized_at": "INIT_TIMESTAMP",
+  "architecture": {
+    "database": "PostgreSQL 16 · age_os_brain · 认知数据层",
+    "mcp_server": "port 3100 · 27工具 · 内部访问",
+    "agent_scheduler": "9个Agent · 自动调度",
+    "access": "仅面孔服务器(ZY-SVR-002)可访问 · 不暴露公网"
+  },
+  "rule": "此服务器为铸渊核心大脑 · 100%内部 · 不暴露任何服务到公网"
+}
+IDENTITY
+sed -i "s/INIT_TIMESTAMP/$(date -u +%Y-%m-%dT%H:%M:%SZ)/" "${ZY_BRAIN_META}/identity.json"
+
+cat > "${ZY_BRAIN_META}/health.json" << 'HEALTH'
+{
+  "server": "ZY-SVR-005",
+  "role": "brain",
+  "status": "initializing",
+  "last_check": null,
+  "services": {
+    "node": null,
+    "pm2": null,
+    "postgresql": null,
+    "mcp_server": null,
+    "agent_scheduler": null
+  },
+  "disk_usage": null,
+  "memory_usage": null,
+  "uptime": null
+}
+HEALTH
+
+cat > "${ZY_BRAIN_META}/operation-log.json" << 'OPLOG'
+{
+  "description": "铸渊大脑服务器操作记录 · 所有操作必须登记",
+  "operations": [
+    {
+      "id": "ZY-SVR-INIT-005",
+      "operator": "铸渊 · ICE-GL-ZY001 (via GitHub Actions)",
+      "action": "大脑服务器初始化",
+      "timestamp": "INIT_TIMESTAMP",
+      "details": "执行 brain-server-init.sh · 目录结构+PostgreSQL配置+Schema+防火墙+身份初始化"
+    }
+  ]
+}
+OPLOG
+sed -i "s/INIT_TIMESTAMP/$(date -u +%Y-%m-%dT%H:%M:%SZ)/" "${ZY_BRAIN_META}/operation-log.json"
+
+log "  ✅ 大脑身份已初始化"
+
+# ═══ §9 PM2 Startup 配置 ═══
+log "§9 配置 PM2 Startup..."
+pm2 startup systemd -u root --hp /root 2>/dev/null || true
+log "  ✅ PM2 已配置开机自启"
+
+# ═══ §10 完成报告 ═══
+log "§10 生成初始化报告..."
+
+REPORT="${ZY_LOGS}/init-report.json"
+cat > "${REPORT}" << REPORT_END
+{
+  "event": "brain_server_initialization",
+  "server": "ZY-SVR-005",
+  "role": "brain",
+  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "status": "success",
+  "components": {
+    "os": "$(lsb_release -d -s 2>/dev/null || echo 'Ubuntu 24.04')",
+    "node": "$(node -v 2>/dev/null || echo 'not installed')",
+    "npm": "$(npm -v 2>/dev/null || echo 'not installed')",
+    "pm2": "$(pm2 -v 2>/dev/null || echo 'not installed')",
+    "postgresql": "$(psql --version 2>/dev/null | grep -oP '\\d+\\.\\d+' || echo 'not installed')",
+    "ufw": "active"
+  },
+  "database": {
+    "name": "age_os_brain",
+    "user": "zhuyuan",
+    "host": "localhost",
+    "port": 5432,
+    "password_file": "${DB_PASS_FILE}"
+  },
+  "directories": {
+    "root": "${ZY_BRAIN_ROOT}",
+    "mcp_server": "${ZY_MCP}",
+    "agents": "${ZY_AGENTS}",
+    "data": "${ZY_DATA}",
+    "logs": "${ZY_LOGS}",
+    "config": "${ZY_CONFIG}",
+    "schema": "${ZY_SCHEMA}"
+  },
+  "firewall": {
+    "ssh": "22/tcp ALLOW (全局)",
+    "postgresql": "5432/tcp ALLOW (仅 ${FACE_SERVER_IP})",
+    "mcp": "3100/tcp ALLOW (仅 ${FACE_SERVER_IP})"
+  },
+  "face_server": "${FACE_SERVER_IP}",
+  "next_steps": [
+    "上传 Schema SQL 并执行",
+    "部署 MCP Server 代码",
+    "部署 Agent Scheduler 代码",
+    "安装 npm 依赖",
+    "PM2 启动 MCP Server + Agent Scheduler",
+    "验证 MCP Server /health 端点",
+    "面孔服务器配置反向代理到大脑"
+  ]
+}
+REPORT_END
+
+# 输出数据库密码（仅在初始化时显示一次）
+echo ""
+echo -e "${GREEN}═══════════════════════════════════════════════════════════${NC}"
+echo -e "${GREEN}  ✅ 铸渊大脑服务器初始化完成！                             ${NC}"
+echo -e "${GREEN}═══════════════════════════════════════════════════════════${NC}"
+echo -e "  Node.js:     $(node -v 2>/dev/null || echo 'N/A')"
+echo -e "  PM2:         $(pm2 -v 2>/dev/null || echo 'N/A')"
+echo -e "  PostgreSQL:  $(psql --version 2>/dev/null | grep -oP '\d+\.\d+' || echo 'N/A')"
+echo -e "  根目录:      ${ZY_BRAIN_ROOT}"
+echo -e "  数据库:      age_os_brain (用户: zhuyuan)"
+echo -e "  防火墙:      SSH + PostgreSQL(面孔) + MCP(面孔)"
+echo -e "  面孔服务器:  ${FACE_SERVER_IP}"
+echo -e "  报告:        ${REPORT}"
+echo ""
+echo -e "${YELLOW}══════════════════ 重要信息 ══════════════════${NC}"
+echo -e "  数据库密码文件: ${DB_PASS_FILE}"
+echo -e "  数据库密码: ${DB_PASS}"
+echo -e ""
+echo -e "  ⚠️  请将此密码配置为 GitHub Secret: ZY_BRAIN_DB_PASS"
+echo -e "  ⚠️  此密码仅在初始化时显示一次"
+echo -e "${YELLOW}═══════════════════════════════════════════════${NC}"
+echo ""