Refactor XRayMOD into a Secure VPN Infrastructure Control Plane

.github/workflows/ci.yml

@@ -32,24 +32,14 @@ jobs:
         run: |
           if [ -f package-lock.json ]; then npm ci; else npm install; fi
 
-      - name: Typecheck worker (if tsconfig present)
-        run: |
-          if [ -f tsconfig.json ]; then
-            npx tsc --noEmit || true
-          fi
+      - name: Typecheck worker
+        run: npm run lint
 
       - name: Frontend install & build
-        working-directory: frontend
-        run: |
-          if [ -f package.json ]; then
-            if [ -f package-lock.json ]; then npm ci; else npm install; fi
-            npm run build --if-present
-          fi
+        run: npm run build:ui
 
-      - name: Smoke scripts
-        run: |
-          if [ -f scripts/smoke-test.mjs ]; then node scripts/smoke-test.mjs || true; fi
-          if [ -f test-offline.sh ]; then bash test-offline.sh || true; fi
+      - name: Smoke tests
+        run: npm test
 
   installer-syntax:
     name: Installer syntax

.github/workflows/rolling-bundle.yml

@@ -0,0 +1,23 @@
+name: Rolling bundle
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  bundle:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - name: Build & publish rolling
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash scripts/publish-rolling.sh

.gitignore

@@ -12,6 +12,8 @@ frontend/.next/
 frontend/tsconfig.tsbuildinfo
 .wrangler/
 .wrangler-dist/
+.wrangler-deploy.*.toml
+.rolling/
 dist-worker/
 worker.js
 index.js
@@ -67,3 +69,5 @@ uv.lock
 # Temp
 tmp/
 temp/
+.deploy/
+*.cpuprofile

AGENTS.md

@@ -0,0 +1,142 @@
+# AGENTS.md — XRayMOD operating manual
+
+Living checklist for agents working in this fork. Follow phases in order. Report after each phase. Do **not** delete non-generated repo files unless the user explicitly says `approve cleanup`.
+
+## Checkout pin (update when syncing)
+
+| Field | Value |
+|-------|-------|
+| Branch | `main` (sync merged via PR #1; phases 3–7 on this line) |
+| Upstream remote | `upstream` → `https://github.com/EvolveBeyond/XRayMOD.git` |
+| Adopted upstream tip | `fed637e` (`main`, product **1.9.12**) |
+| Merge commit | `7431daf` |
+| Canonical version source | [`worker/lib/version.ts`](worker/lib/version.ts) — `XRayMOD_VERSION` / `XRayMOD_SCHEMA_VERSION` / `XRayMOD_BUILD` |
+| Product version | **1.9.12** (not 5.1.1) |
+
+## Product intent
+
+Migrate from a “VPN/proxy panel” mindset to a **Secure VPN Infrastructure Control Plane**:
+
+- **Control plane**: Cloudflare Worker + D1 + panel UI (APIs, policy, subscriptions, onboarding).
+- **Data plane**: user nodes / Xray / sing-box / gateways — **not** VPN traffic execution inside Workers.
+- Cloudflare is an **Edge Provider** (security/control/edge endpoints), not the VPN runtime.
+- Wizard is the **canonical** install/orchestrator; shell installers are deprecated primary path (mark, don’t delete without approval).
+- Mini App / Telegram commerce / TWA stay **removed** (hard 404). Do not reintroduce from upstream merges.
+
+## Non-negotiable rules
+
+1. Read real execution paths before refactoring (`worker/` → router → API → D1).
+2. Preserve local Lab / edge-ops / TWA-removal / login recovery unless explicitly superseded.
+3. Prefer upstream dependency/security bumps when they don’t break Worker/UI builds.
+4. No mass deletion of `installer/`, `backend/`, install scripts without cleanup audit + `approve cleanup`.
+5. No claiming Cloudflare IPs are “clean”/residential or guaranteed to evade classification.
+6. After every phase: build, test, inspect diff, update docs, report status.
+
+## Report cadence
+
+After each phase, report:
+
+1. What changed (paths)
+2. `npm run lint` / `npm run build:ui` / `npm test` result
+3. Blockers / decisions needed
+4. Next phase id
+
+---
+
+## Phased checklist
+
+### Phase 0 — Upstream sync + version truth — DONE
+
+- [x] Branch `sync/upstream-1.9.12` from fork tip
+- [x] Merge `upstream/main` @ `fed637e`
+- [x] Keep Lab + TWA removal; take upstream deps + remote API
+- [x] Canonical version in `worker/lib/version.ts`
+- [x] Lint + UI build + smoke tests green
+
+### Phase 1 — Post-sync stabilize + architectural audit — DONE
+
+- [x] Document current architecture → [`docs/architecture/current-state.md`](docs/architecture/current-state.md)
+- [x] Confirm version identity 1.9.12 everywhere meaningful (`deploy-panel.sh` fixed)
+- [x] Note merge overlays and known dual-stack (Worker vs `backend/` / `src/`)
+
+### Phase 2 — Cleanup audit only (no deletes) — DONE (awaiting approval)
+
+- [x] Inventory candidates → [`docs/architecture/cleanup-audit.md`](docs/architecture/cleanup-audit.md)
+- [x] Classify candidates (no permanent deletes performed)
+- [ ] **Stop** for user `approve cleanup` before any permanent deletes
+
+### Phase 3 — Domain renames + Edge Provider abstraction — DONE
+
+- [x] Introduce Edge Provider interface; Cloudflare as first implementation (`worker/lib/edge-provider/`)
+- [x] Wire self-update CF HTTP through `CloudflareEdgeProvider.request`
+- [x] Expose `edge_provider` capability summary on admin dashboard API
+- [x] Domain aliases (`worker/lib/domain.ts`) + honest copy for former cleanip/disguise surfaces
+- [x] Wizard `/api/wizard/capabilities` consumes Edge Provider reports
+
+### Phase 4 — Node Agent model + control/data-plane boundary — DONE
+
+- [x] Define Node Agent contract (heartbeat, config pull, health) — `worker/lib/node-agent.ts`, `worker/api/agents.ts`
+- [x] Keep proxy/data-plane off Worker by default via `security.policy_json.disable_in_worker_proxy`
+- [x] Secure agent auth (`xrm_node_` bearer); legacy `backends` listed as compatibility shim
+
+### Phase 5 — Wizard as canonical orchestrator — DONE
+
+- [x] Stateful wizard steps in `wizard.state_json`; OAuth called out as preferred
+- [x] Versioned rolling artifacts (`releases/download/rolling/worker.mjs`) instead of raw `main/worker.js`
+- [x] Deprecate shell installers as primary path (docs + banner), files kept
+
+### Phase 6 — Subscription / policy / security / dashboard — DONE
+
+- [x] Security policy engine (`worker/lib/security-policy.ts`) + admin dashboard / policy API
+- [x] Node list UI enrolls agents; subscription still generated by control plane for node users
+- [x] Honest edge-endpoint / origin-protection copy (no “clean IP” / stealth-as-camouflage claims)
+
+### Phase 7 — Docs / CI / operator runbooks — DONE
+
+- [x] [`DEPLOY.md`](DEPLOY.md) documents `ship-panel.sh`, `deploy-panel.sh`, `publish-rolling.sh`
+- [x] GitHub Actions: [`ci.yml`](.github/workflows/ci.yml), [`rolling-bundle.yml`](.github/workflows/rolling-bundle.yml)
+- [x] Shell installers marked deprecated in README + Wizard UI (files kept per cleanup audit)
+
+### Phase 8 — Ship surfaces (wizard UI + node agent script) — DONE
+
+- [x] Panel Wizard page consuming `/api/wizard` + `/api/wizard/capabilities`
+- [x] `scripts/node-agent.sh` heartbeat/config pull loop
+- [x] Wizard remote deploy uses rolling `worker.mjs` + `assets.tar.gz` + `run_worker_first` (same as `deploy-worker-module.py`)
+- [x] OAuth PKCE endpoints: `/api/wizard/oauth/url` + `/api/wizard/oauth/callback` (requires operator OAuth app in kvstore for non-localhost redirect)
+- [x] Commit + publish rolling + deploy live panel (operator): `bash scripts/ship-panel.sh`
+
+### Phase 2 remainder
+
+- [ ] **Stop** for user `approve cleanup` before any permanent deletes
+
+---
+
+## What not to delete (without approval)
+
+- `installer/`, `install.sh`, `install.ps1`, `install.cmd`, `backend/`, `wizard/` source
+- Database schema/migrations, CI workflows, security files, wrangler deploy config
+- Compatibility layers still referenced by production Worker
+- Anything classified `UNKNOWN` in the cleanup audit
+
+## Generated artifacts (may remove when rebuilding)
+
+- `frontend/.next/`, `frontend/out/` (rebuild via `npm run build:ui`)
+- `node_modules/`, `.wrangler/` local state, `__pycache__/`
+
+## Default merge policy (future upstream pulls)
+
+| Area | Policy |
+|------|--------|
+| Version strings | Upstream 1.x lineage via `worker/lib/version.ts` |
+| Telegram / TWA / store | Keep **our removal** |
+| Lab / edge-ops / login recovery | Keep **ours** |
+| Dependencies | Prefer **upstream** bumps if build stays green |
+| Remote API | Keep merged upstream remote key/API routes |
+
+## Commands
+
+```bash
+npm run lint
+npm run build:ui
+npm test
+```

CHANGELOG.md

@@ -8,14 +8,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
-- Telegram operator bot (`telegram-bot/`) — create / list / delete / update panels with Persian reply keyboard and step progress
 - Client-path Clean IP scan with ranked recommendations from the visitor network
 - Dual-author credit: Askar Niroomand & Pakrohk
 
+### Removed
+- Telegram Mini App (`/twa/*`), commerce/store, Telegram bot integration, and `telegram-bot/`
+
 ### Changed
 - Panel UI branding normalized to XRayMOD (removed internal theme codenames from user-facing chrome)
 - README EN/FA: clearer install path and Cloudflare API token guide
-- Telegram / panel Persian copy cleaned up (no casual assistant tone)
+- Panel Persian copy cleaned up (no casual assistant tone)
 
 ### Fixed
 - Nested `/panel/*` routes loading `/_next` assets

CONTRIBUTING.md

@@ -92,7 +92,7 @@ security: harden rate limit headers
 ```
 
 Author identity must be your real name or consistent handle + valid email.  
-Do not commit as generic names like `engineer` / `مهندس`.
+Do not commit as generic names like `engineer` / generic placeholder names.
 
 ## Coding standards
 

DEPLOY.md

@@ -16,20 +16,34 @@ Legacy Vite SPA lives under `src/` and is **not** used by `npm run deploy`.
 - Cloudflare account + API token (Edit Cloudflare Workers)
 - Account must **not** be disabled (`wrangler whoami` must succeed)
 
-## Quick deploy
+## Quick deploy (operator)
+
+**Preferred:** ship to an existing panel (preserves D1, uses `worker.mjs` + `run_worker_first`):
 
 ```bash
-# 1. Install
 npm install
+# ~/.xraymod/config.json from first deploy-panel.sh run
+bash scripts/ship-panel.sh
+```
+
+**First panel** on a Cloudflare account:
 
-# 2. Create D1 (once)
+```bash
+npm install
+export CLOUDFLARE_API_TOKEN="…"
+export CLOUDFLARE_ACCOUNT_ID="…"
 npx wrangler d1 create xraymod-db
-# paste database_id into wrangler.toml
+bash scripts/deploy-panel.sh xraymod <d1_id>
+```
+
+Publish rolling bundle for in-panel self-update / wizard remote deploy:
 
-# 3. Build UI + deploy Worker
-npm run deploy
+```bash
+bash scripts/publish-rolling.sh
 ```
 
+Legacy `npm run deploy` (wrangler from TS) can trigger CF Error 1101 on some accounts — avoid for production.
+
 Panel URL after first install / bootstrap:
 
 ```
@@ -77,7 +91,6 @@ Most panel secrets live in **D1** (not CF env) after Gen 1.9.12.
 | `PAGES_URL` | Optional remote Pages origin (if not using ASSETS) |
 | `PANEL_RECOVERY` | `true` disables disguise (break-glass) |
 | `DISGUISE_PAGE` | Default `404` (also `1101`, `nginx`, …) |
-| `ENABLE_TELEGRAM` | Telegram bot feature flag |
 | `CRYPTO_KEY` | Override default crypto key (set in production) |
 
 ## Admin Dashboard