feat: 彻底移除端口映射特性

端口映射与产品核心约束（全流量必须走隧道，不允许直连外网）相冲突，
移除后网络策略更纯粹，维护面更小。

后端变更：
- 删除 host_forwarding_linux.go / _other.go（iptables DNAT+SNAT 实现）
- 删除 container_proxy_provider 的端口映射调用和 bridge 断开逻辑中的兼容补丁
- 删除 worker_firewall_linux.go 的 allowedPorts 参数、bridgeGW 白名单、端口映射 ACCEPT 规则
- 删除数据库 host_ports 字段、HostPorts 类型、UpdateHostPorts 方法
- 删除 admin API 的 PUT /v1/admin/hosts/{hostID}/ports 路由和 UpdatePorts handler
- 删除 agentapi.PortMapping 和 HostNetworkSpec.PortMappings
- 删除 runtime 中 HostPorts→PortMappings 转换和 Docker -p 参数
- 更新测试文件

前端变更：
- 删除 port-manager.tsx 组件
- 删除 create-host-dialog.tsx 中的端口映射表单
- 删除 use-hosts.ts 中的 HostPort 接口和 useUpdateHostPorts hook
- 删除 $hostId.tsx 中的 PortManager 引用

文档变更：
- 所有"端口映射"文案改为"SSH 端口"或"服务端口"

Author: ZaneL1u

.planning/quick/260511-o15-api/260511-o15-PLAN.md

@@ -0,0 +1,211 @@
+---
+phase: quick
+plan: 260511-o15
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - internal/network/types.go
+  - internal/agentapi/contracts.go
+  - internal/network/container_proxy_provider.go
+  - internal/network/worker_firewall_linux.go
+  - internal/runtime/runtime_service.go
+  - internal/runtime/tasks/worker.go
+  - internal/controlplane/http/admin_hosts.go
+  - internal/controlplane/http/router.go
+  - internal/store/repository/models.go
+  - internal/store/repository/queries.go
+  - internal/network/worker_firewall_linux_test.go
+  - internal/controlplane/http/admin_hosts_test.go
+  - internal/controlplane/http/admin_egress_ip_probe_test.go
+  - web/admin/src/components/hosts/create-host-dialog.tsx
+  - web/admin/src/hooks/use-hosts.ts
+  - web/admin/src/routes/_dashboard/hosts/$hostId.tsx
+  - cmd/cloud-claude/local.go
+  - tests/scripts/uat-vscode-remote-ssh.sh
+  - docs/zh/guide/configuration.md
+  - docs/zh/guide/cloud-claude-local.md
+autonomous: true
+requirements: []
+must_haves:
+  truths:
+    - "端口映射相关代码、数据库模型、API 路由、前端组件和文案全部移除"
+    - "编译通过，测试通过，前端构建通过"
+    - "所有引用 HostPorts / PortMappings 的地方已清理完毕"
+  artifacts:
+    - path: "internal/network/host_forwarding_linux.go"
+      provides: "已删除"
+    - path: "internal/network/host_forwarding_other.go"
+      provides: "已删除"
+    - path: "internal/store/migrations/0016_host_ports.sql"
+      provides: "已删除"
+    - path: "internal/network/container_proxy_provider_linux.go"
+      provides: "已删除"
+    - path: "internal/network/container_proxy_provider_other.go"
+      provides: "已删除"
+    - path: "web/admin/src/components/hosts/port-manager.tsx"
+      provides: "已删除"
+  key_links:
+    - from: "internal/network/types.go"
+      to: "internal/runtime/runtime_service.go"
+      via: "HostNetworkSpec 不再包含 PortMappings"
+    - from: "internal/store/repository/models.go"
+      to: "internal/store/repository/queries.go"
+      via: "HostPorts 类型和字段已移除"
+---
+
+## Objective
+
+彻底移除 Cloud CLI Proxy 中的端口映射（Port Mapping）特性，包括后端代码、数据库模型、网络层兼容补丁、API 路由、前端组件及相关文案。
+
+Purpose: 端口映射特性与产品核心约束（全流量必须走隧道，不允许直连外网）相冲突，移除后网络策略更纯粹，维护面更小。
+Output: 所有端口映射相关代码、模型、API、UI 和文档文案清理完毕，项目编译和测试通过。
+
+## Execution Context
+
+@.claude/get-shit-done/workflows/execute-plan.md
+@.claude/get-shit-done/templates/summary.md
+
+## Context
+
+@./CLAUDE.md
+
+## Tasks
+
+<task type="auto">
+  <name>Task 1: 删除端口映射专用文件</name>
+  <files>
+    internal/network/host_forwarding_linux.go
+    internal/network/host_forwarding_other.go
+    internal/store/migrations/0016_host_ports.sql
+    internal/network/container_proxy_provider_linux.go
+    internal/network/container_proxy_provider_other.go
+    web/admin/src/components/hosts/port-manager.tsx
+  </files>
+  <action>
+    使用 `git rm` 删除以下 6 个文件：
+    1. `internal/network/host_forwarding_linux.go` — iptables DNAT+SNAT+FORWARD 实现
+    2. `internal/network/host_forwarding_other.go` — 非 Linux 平台的 stub
+    3. `internal/store/migrations/0016_host_ports.sql` — host_ports 表迁移
+    4. `internal/network/container_proxy_provider_linux.go` — 带端口白名单的防火墙实现
+    5. `internal/network/container_proxy_provider_other.go` — 非 Linux stub
+    6. `web/admin/src/components/hosts/port-manager.tsx` — 端口映射 UI 组件
+
+    删除后运行 `go build ./...` 确认无因缺失文件导致的编译错误（预期会有引用错误，在 Task 2 中修复）。
+  </action>
+  <verify>
+    <automated>test $(git status --short | grep -c "^D  internal/network/host_forwarding") -eq 2 &amp;&amp; test $(git status --short | grep -c "^D  internal/store/migrations/0016_host_ports.sql") -eq 1 &amp;&amp; test $(git status --short | grep -c "^D  internal/network/container_proxy_provider") -eq 2 &amp;&amp; test $(git status --short | grep -c "^D  web/admin/src/components/hosts/port-manager.tsx") -eq 1</automated>
+  </verify>
+  <done>6 个端口映射专用文件已从 git 中删除，且 `go build ./...` 无因文件缺失导致的错误</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: 清理后端代码中的 PortMappings / HostPorts 引用</name>
+  <files>
+    internal/network/types.go
+    internal/agentapi/contracts.go
+    internal/network/container_proxy_provider.go
+    internal/network/worker_firewall_linux.go
+    internal/runtime/runtime_service.go
+    internal/runtime/tasks/worker.go
+    internal/controlplane/http/admin_hosts.go
+    internal/controlplane/http/router.go
+    internal/store/repository/models.go
+    internal/store/repository/queries.go
+    internal/network/worker_firewall_linux_test.go
+    internal/controlplane/http/admin_hosts_test.go
+    internal/controlplane/http/admin_egress_ip_probe_test.go
+  </files>
+  <action>
+    按以下清单逐个文件清理端口映射相关代码，每改完一个文件运行 `go build ./...` 确认编译通过：
+
+    1. `internal/network/types.go` — 从 `HostNetworkSpec` 结构体中移除 `PortMappings` 字段及其类型定义。
+    2. `internal/agentapi/contracts.go` — 移除 `PortMappings` 字段和相关 struct 定义。
+    3. `internal/network/container_proxy_provider.go` — 移除端口转发调用和 bridge disconnect 逻辑中与 port mapping 相关的分支。
+    4. `internal/network/worker_firewall_linux.go` — 移除 `allowedPorts` 参数、bridgeGW 例外逻辑、mapped port ACCEPT 规则。
+    5. `internal/runtime/runtime_service.go` — 移除 `HostPorts` 到 `PortMappings` 的转换逻辑。
+    6. `internal/runtime/tasks/worker.go` — 移除端口映射验证逻辑；统一 Docker 启动参数，不再使用 `-p` 端口映射（非 Linux 也不再映射）。
+    7. `internal/controlplane/http/admin_hosts.go` — 移除 `UpdatePorts` handler；从 host 创建逻辑中移除 `HostPorts` 相关字段。
+    8. `internal/controlplane/http/router.go` — 移除 `PUT /v1/admin/hosts/{hostID}/ports` 路由注册。
+    9. `internal/store/repository/models.go` — 移除 `HostPorts` 类型、`Host.HostPorts` 字段、`HostPort` struct。
+    10. `internal/store/repository/queries.go` — 移除 `UpdateHostPorts` 函数和所有 `host_ports` 相关 SQL 查询。
+    11. `internal/network/worker_firewall_linux_test.go` — 移除 `WithAllowedPorts` 相关测试用例。
+    12. `internal/controlplane/http/admin_hosts_test.go` — 移除 `UpdateHostPorts` 相关 stub 和测试。
+    13. `internal/controlplane/http/admin_egress_ip_probe_test.go` — 更新断言，移除对 HostPorts 的期望。
+
+    清理原则：
+    - 只删不改逻辑语义，不引入新行为。
+    - 若某函数签名因移除参数导致调用点变化，同步修改所有调用点。
+    - 若 import 因删除代码而变为未使用，同步移除。
+  </action>
+  <verify>
+    <automated>go build ./... &amp;&amp; go test ./internal/network/... ./internal/controlplane/http/... ./internal/runtime/... ./internal/store/... -count=1</automated>
+  </verify>
+  <done>后端所有 PortMappings / HostPorts 引用已清理，`go build ./...` 和对应包测试全部通过</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: 清理前端代码和文档文案</name>
+  <files>
+    web/admin/src/components/hosts/create-host-dialog.tsx
+    web/admin/src/hooks/use-hosts.ts
+    web/admin/src/routes/_dashboard/hosts/$hostId.tsx
+    cmd/cloud-claude/local.go
+    tests/scripts/uat-vscode-remote-ssh.sh
+    docs/zh/guide/configuration.md
+    docs/zh/guide/cloud-claude-local.md
+  </files>
+  <action>
+    按以下清单清理前端和文案：
+
+    1. `web/admin/src/components/hosts/create-host-dialog.tsx` — 移除 `hostPorts` state、端口映射验证逻辑、表单中端口映射输入 JSX、提交时包含的 `host_ports` 字段。
+    2. `web/admin/src/hooks/use-hosts.ts` — 移除 `HostPort` interface、`host_ports` 字段、`useUpdateHostPorts` hook。
+    3. `web/admin/src/routes/_dashboard/hosts/$hostId.tsx` — 移除 `PortManager` 组件 import 和使用；将三列布局改为两列布局（移除第三列）；清理相关文案。
+    4. `cmd/cloud-claude/local.go` — 将文案 "端口映射" 改为 "SSH 端口"。
+    5. `tests/scripts/uat-vscode-remote-ssh.sh` — 将 "容器端口映射" 改为 "容器 SSH 端口"。
+    6. `docs/zh/guide/configuration.md` — 将章节标题 "Docker Compose 端口映射" 改为 "Docker Compose 服务端口"；清理正文中的端口映射描述。
+    7. `docs/zh/guide/cloud-claude-local.md` — 将 "SSH 端口映射" 改为 "SSH 端口"。
+
+    每改完前端文件后运行 `cd web/admin && npm run build`（或 `pnpm build` / `yarn build`，以项目实际 lockfile 为准）确认构建通过。
+  </action>
+  <verify>
+    <automated>cd web/admin &amp;&amp; npm run build &amp;&amp; grep -r "端口映射" web/admin/src/ cmd/cloud-claude/local.go tests/scripts/uat-vscode-remote-ssh.sh docs/zh/guide/ || echo "No remaining 端口映射 references"</automated>
+  </verify>
+  <done>前端端口映射 UI 和 hook 已移除，文案中 "端口映射" 已替换为 "SSH 端口" 或 "服务端口"，前端构建通过</done>
+</task>
+
+## Threat Model
+
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| 宿主机防火墙规则 | 移除端口映射后，防火墙规则更精简，减少暴露面 |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-quick-01 | Information Disclosure | 残留端口映射文案/代码 | mitigate | 本计划全面清理所有引用，Task 2/3 的 grep 验证确保无残留 |
+| T-quick-02 | Denial of Service | 误删非端口映射代码 | mitigate | 每次修改后运行编译和测试，确保只删不改逻辑语义 |
+
+## Verification
+
+- `go build ./...` 通过
+- `go test ./internal/network/... ./internal/controlplane/http/... ./internal/runtime/... ./internal/store/... -count=1` 通过
+- `cd web/admin && npm run build` 通过
+- `grep -r "PortMappings\|HostPorts\|host_ports\|端口映射" --include="*.go" --include="*.ts" --include="*.tsx" --include="*.md" --include="*.sh" .` 无残留（预期仅命中本 PLAN.md 和 git 历史）
+
+## Success Criteria
+
+- [ ] 6 个端口映射专用文件已从仓库删除
+- [ ] 后端 13 个文件中的 PortMappings / HostPorts / host_ports 引用全部清理
+- [ ] 前端 3 个文件中的端口映射 UI 和 hook 全部清理
+- [ ] 4 个文案文件中的 "端口映射" 已替换为准确描述
+- [ ] Go 编译通过，相关包测试通过
+- [ ] 前端构建通过
+- [ ] 全局搜索确认无残留引用
+
+## Output
+
+After completion, create `.planning/quick/260511-o15-api/260511-o15-SUMMARY.md`

cmd/cloud-claude/local.go

@@ -125,7 +125,7 @@ func runLocalStatus(cmd *cobra.Command, args []string) error {
 	fmt.Printf("容器:     %s\n", status.Name)
 	fmt.Printf("状态:     %s\n", status.Status)
 	fmt.Printf("镜像:     %s\n", status.Image)
-	fmt.Printf("端口映射: %s\n", status.PortMapping)
+	fmt.Printf("SSH 端口: %s\n", status.PortMapping)
 	fmt.Printf("创建时间: %s\n", status.CreatedAt)
 
 	return nil

docs/zh/guide/cloud-claude-local.md

@@ -31,7 +31,7 @@ cloud-claude local up
 cloud-claude local status
 ```
 
-显示本地容器状态、SSH 端口映射和 sing-box 隧道状态。
+显示本地容器状态、SSH 端口和 sing-box 隧道状态。
 
 ### 4. 停止容器
 

docs/zh/guide/configuration.md

@@ -41,7 +41,7 @@ bash deploy/scripts/setup-env.sh
 |------|------|--------|------|
 | `ADMIN_PORT` | 否 | `3000` | 管理后台前端端口（映射到容器 80 端口） |
 
-### Docker Compose 端口映射
+### Docker Compose 服务端口
 
 | 变量 | 默认值 | 说明 |
 |------|--------|------|

internal/agentapi/contracts.go

@@ -62,15 +62,6 @@ type HostActionRequest struct {
 	ClaudeAccountID string `json:"claude_account_id,omitempty"`
 	// BindMounts 携带宿主机目录 bind mount 配置，由 Runtime Service 从 repository.HostMounts 映射而来。
 	BindMounts []BindMount `json:"bind_mounts,omitempty"`
-	// PortMappings 携带宿主机到容器的端口映射配置，由 Runtime Service 从 repository.HostPorts 映射而来。
-	PortMappings []PortMapping `json:"port_mappings,omitempty"`
-}
-
-// PortMapping 描述 docker create -p 的端口映射契约。
-type PortMapping struct {
-	HostPort      int    `json:"host_port"`
-	ContainerPort int    `json:"container_port"`
-	Protocol      string `json:"protocol,omitempty"`
 }
 
 type TaskStatusUpdate struct {

internal/controlplane/http/admin_hosts.go

@@ -40,7 +40,6 @@ type AdminHostStore interface {
 	ListRunningHosts(ctx context.Context) ([]repository.Host, error)
 	GetHostWithClaudeAccount(ctx context.Context, hostID string) (repository.HostWithClaudeAccount, error) // Phase 33 D-22
 	UpdateHostMounts(ctx context.Context, hostID string, mounts repository.HostMounts) error
-	UpdateHostPorts(ctx context.Context, hostID string, ports repository.HostPorts) error
 }
 
 type AdminHostsHandler struct {
@@ -155,7 +154,6 @@ func (h *AdminHostsHandler) Create() nethttp.Handler {
 			CPULimit      float64               `json:"cpu_limit"`
 			DiskLimitGB   int                   `json:"disk_limit_gb"`
 			HostMounts    repository.HostMounts `json:"host_mounts"`
-			HostPorts     repository.HostPorts  `json:"host_ports"`
 		}
 		if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.UserID == "" {
 			writeJSON(w, nethttp.StatusBadRequest, map[string]string{"error": "user_id is required"})
@@ -230,7 +228,6 @@ func (h *AdminHostsHandler) Create() nethttp.Handler {
 				CPULimit:         body.CPULimit,
 				DiskLimitGB:      body.DiskLimitGB,
 				HostMounts:       expandHostMountSources(body.HostMounts),
-				HostPorts:        body.HostPorts,
 			})
 			if err == nil {
 				break
@@ -1067,49 +1064,6 @@ func (h *AdminHostsHandler) UpdateMounts() nethttp.Handler {
 	})
 }
 
-func (h *AdminHostsHandler) UpdatePorts() nethttp.Handler {
-	return nethttp.HandlerFunc(func(w nethttp.ResponseWriter, r *nethttp.Request) {
-		hostID := r.PathValue("hostID")
-		var body struct {
-			Ports repository.HostPorts `json:"ports"`
-		}
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-			writeJSON(w, nethttp.StatusBadRequest, map[string]string{"error": "invalid request body"})
-			return
-		}
-		for _, p := range body.Ports {
-			if p.HostPort <= 0 || p.HostPort > 65535 {
-				writeJSON(w, nethttp.StatusBadRequest, map[string]string{"error": fmt.Sprintf("invalid host port: %d", p.HostPort)})
-				return
-			}
-			if p.ContainerPort <= 0 || p.ContainerPort > 65535 {
-				writeJSON(w, nethttp.StatusBadRequest, map[string]string{"error": fmt.Sprintf("invalid container port: %d", p.ContainerPort)})
-				return
-			}
-			if p.Protocol != "" && p.Protocol != "tcp" && p.Protocol != "udp" {
-				writeJSON(w, nethttp.StatusBadRequest, map[string]string{"error": fmt.Sprintf("invalid protocol: %s (must be tcp or udp)", p.Protocol)})
-				return
-			}
-		}
-		if err := h.store.UpdateHostPorts(r.Context(), hostID, body.Ports); err != nil {
-			h.logger.Error("update host ports failed", "host_id", hostID, "error", err)
-			writeJSON(w, nethttp.StatusInternalServerError, map[string]string{"error": "update ports failed"})
-			return
-		}
-		if h.events != nil {
-			hid := hostID
-			if _, err := h.events.RecordEvent(r.Context(), repository.RecordEventParams{
-				HostID: &hid, Level: "info", Type: "admin.host.update_ports",
-				Message: "管理员更新主机端口映射配置",
-				Metadata: map[string]any{"operator": "admin", "port_count": len(body.Ports)},
-			}); err != nil {
-				h.logger.Error("record event failed", "type", "admin.host.update_ports", "error", err)
-			}
-		}
-		writeJSON(w, nethttp.StatusOK, map[string]string{"status": "ok"})
-	})
-}
-
 // syncContainerPassword updates the Linux user password inside a running container via docker exec.
 // Exposed as a package-level var so unit tests can inject a fake implementation (Phase 29.1).
 var syncContainerPassword = func(containerName, user, password string) error {

internal/controlplane/http/admin_hosts_test.go

@@ -73,9 +73,6 @@ func (s *stubHostStore) UpdateHostMounts(_ context.Context, _ string, _ reposito
 	return nil
 }
 
-func (s *stubHostStore) UpdateHostPorts(_ context.Context, _ string, _ repository.HostPorts) error {
-	return nil
-}
 
 func TestAdminHostsHandler(t *testing.T) {
 	now := time.Now().Truncate(time.Second)

internal/controlplane/http/router.go

@@ -257,7 +257,6 @@ func NewRouter(deps Dependencies) nethttp.Handler {
 			mux.Handle("GET /v1/admin/hosts/{hostID}/logs", adminGuard(hostsHandler.GetLogs()))
 			mux.Handle("DELETE /v1/admin/hosts/{hostID}", adminGuard(hostsHandler.Delete()))
 			mux.Handle("PUT /v1/admin/hosts/{hostID}/mounts", adminGuard(hostsHandler.UpdateMounts()))
-			mux.Handle("PUT /v1/admin/hosts/{hostID}/ports", adminGuard(hostsHandler.UpdatePorts()))
 
 			vncProxy := NewAdminVNCProxyHandler(deps.Logger, deps.AdminHosts)
 			// VNC 入口页 (vnc.html) 带 ?token= 认证；子资源（CSS/JS/图片）

internal/network/container_proxy_provider.go

@@ -105,7 +105,7 @@ func (p *ContainerProxyProvider) PrepareHost(ctx context.Context, spec HostNetwo
 		return fmt.Errorf("gateway: configure worker routes/DNS: %w", err)
 	}
 
-	if err := applyWorkerFirewall(ctx, workerName, gwIP, bridgeGW, spec.PortMappings); err != nil {
+	if err := applyWorkerFirewall(ctx, workerName, gwIP, bridgeGW); err != nil {
 		p.teardownGateway(ctx, hostID)
 		return fmt.Errorf("gateway: apply worker firewall: %w", err)
 	}
@@ -133,17 +133,6 @@ func (p *ContainerProxyProvider) PrepareHost(ctx context.Context, spec HostNetwo
 		"dns_server", result.ActualDNS,
 	)
 
-	if len(spec.PortMappings) > 0 {
-		if err := ensurePortMapChain(ctx); err != nil {
-			p.teardownGateway(ctx, hostID)
-			return fmt.Errorf("gateway: setup portmap chain: %w", err)
-		}
-		if err := setupPortForwarding(ctx, hostID, bridgeGW, gwIP, spec.PortMappings); err != nil {
-			p.teardownGateway(ctx, hostID)
-			return fmt.Errorf("gateway: setup port forwarding: %w", err)
-		}
-	}
-
 	if cpID, _ := os.Hostname(); cpID != "" {
 		if err := dockerNetworkConnect(ctx, netName, cpID, ""); err != nil {
 			p.logger.Warn("container-proxy: connect control-plane to isolated network failed (VNC may not work)",
@@ -174,7 +163,6 @@ func (p *ContainerProxyProvider) teardownGateway(ctx context.Context, hostID str
 	workerName := workerContainerName(hostID)
 
 	cleanupWorkerFirewall(ctx, workerName)
-	teardownPortForwarding(ctx, hostID)
 
 	if cpID, _ := os.Hostname(); cpID != "" {
 		_ = exec.CommandContext(ctx, "docker", "network", "disconnect", "-f", netName, cpID).Run()