release: prepare v0.0.31

Author: gitlayzer

.gitignore

@@ -7,6 +7,7 @@
 /.workflow/
 
 # Generated copyright application artifacts
+/docs/
 /docs/copyright/
 
 # IDE settings

README.md

@@ -380,6 +380,53 @@ curl http://10.96.0.12:8080      # Service ClusterIP
 curl http://10.244.0.22:3000     # Pod IP
 ```
 
+### 7. 计费说明
+Sealtun 本身不额外单独收取一笔“软件费”，实际成本来自 Sealos Cloud 为隧道远端 Pod 和公网入口分配的云资源。CLI 目前会在 `resources` / `dashboard` 里展示资源占用提示，但那不是账单估算；真实费用仍以 Sealos Cloud 控制台的计费表和账单为准。
+
+结合当前 Sealos Cloud 价格页，你至少可以按下面几个维度理解 Sealtun 隧道成本：
+
+- `CPU`：按核 / 小时计费
+- `内存`：按 GB / 小时计费
+- `端口`：按个 / 小时计费
+- `网络`：按流量计费
+
+Sealtun 的常见成本来源是：
+
+- 一个远端 tunnel Pod：消耗 `CPU + 内存`
+- HTTP/HTTPS 隧道和 TCP/SSH NodePort 暴露：会占用 `端口`
+- 公网访问流量：会产生 `网络` 成本
+
+不同区域单价不同。根据当前 Sealos Cloud 控制台截图，`杭州 H`、`新加坡 B`、`北京 A`、`广州 G`、`US West` 的 CPU / 内存 / 端口价格都不一样，所以同样一条隧道在不同区域的小时成本会有差异。
+
+当前可直接参考下面这张小时单价表：
+
+| 区域 | CPU (核/小时) | 内存 (GB/小时) | 端口 (个/小时) | 网络 |
+| --- | ---: | ---: | ---: | ---: |
+| `杭州 H` | `0.027671` | `0.013956` | `0.013900` | `0.000781 /M` |
+| `新加坡 B` | `0.067000` | `0.033792` | `0.013900` | `0.000781 /M` |
+| `北京 A` | `0.017125` | `0.008637` | `0.007000` | `0.000781 /M` |
+| `广州 G` | `0.017420` | `0.008786` | `0.007000` | `0.000781 /M` |
+| `US West` | `0.020833` | `0.012500` | `0.006944` | `0.000107 /M` |
+
+如果只做一个最小 HTTPS 隧道，通常至少会涉及：
+
+- 1 个远端 Pod 的 `CPU + 内存`
+- 1 个公网入口端口
+- 实际产生的公网流量
+
+估算时可以用这个思路：
+
+```text
+总成本 ~= Pod(CPU + 内存) + 公网端口 + 网络流量
+```
+
+如果你要压低成本，优先考虑：
+
+- 关闭不用的隧道，或用 `sealtun stop` 把副本缩容为 0
+- 用 `sealtun resources set/unset` 调低 Pod requests / limits
+- 避免给短时调试隧道分配过高资源
+- 对低流量场景优先按需开启，而不是长期常驻
+
 查看或停止当前 cluster connect：
 ```bash
 sealtun connect status
@@ -389,7 +436,7 @@ sudo sealtun disconnect
 
 限制：当前透明数据面仅支持 Linux + TCP，需要 root 权限和 `iptables`；不支持 ICMP/ping 和 UDP。macOS/Windows 会明确提示暂不支持。
 
-### 7. 观测和本地控制台
+### 8. 观测和本地控制台
 查看远端隧道 Pod 日志：
 ```bash
 sealtun logs <tunnel-id>
@@ -487,7 +534,7 @@ sealtun dashboard --addr 0.0.0.0 --allow-remote --basic-auth-user admin --basic-
 
 远程模式不会把 dashboard token 写进 HTML；访问者需要 URL fragment 或请求头中的 token。启用 dashboard Basic Auth 后，HTML、静态资源和 API 都会先经过 Basic Auth。所有写操作仍要求页面确认，并由后端再次校验 `confirm` 字段，避免误触或脚本误调用。
 
-### 8. 协议模板
+### 9. 协议模板
 不确定该怎么写命令或声明式配置时，可以先生成模板：
 
 ```bash
@@ -500,7 +547,7 @@ sealtun template mongodb
 
 模板会同时输出一次性 `sealtun expose` 命令和可提交到项目内的 `sealtun.yaml` 片段。`mysql`、`postgres`、`redis`、`mongodb`、`mqtt` 模板默认走通用 TCP 四层入口；HTTPS 模板才支持自定义域名和访问控制。
 
-### 9. 声明式配置
+### 10. 声明式配置
 创建 `sealtun.yaml`：
 ```yaml
 version: v1

README_EN.md

@@ -389,7 +389,54 @@ sudo sealtun disconnect
 
 Limitations: transparent data-plane support is Linux + TCP only and requires root plus `iptables`; ICMP/ping and UDP are not supported. macOS/Windows fail clearly as unsupported for now.
 
-### 7. Observe tunnels and run the local dashboard
+### 7. Pricing
+Sealtun itself does not charge a separate software fee. The actual cost comes from the Sealos Cloud resources allocated to the remote tunnel Pod and the public entrypoint. The CLI can show resource occupancy hints in `resources` and `dashboard`, but that is not billing estimation; the authoritative source is still the Sealos Cloud pricing page and your actual bill.
+
+Based on the current Sealos Cloud pricing page, Sealtun tunnel cost is easiest to understand through these dimensions:
+
+- `CPU`: billed per core / hour
+- `Memory`: billed per GB / hour
+- `Port`: billed per public port / hour
+- `Network`: billed by traffic usage
+
+Common Sealtun cost sources are:
+
+- one remote tunnel Pod: `CPU + Memory`
+- HTTP/HTTPS tunnels and TCP/SSH NodePort exposure: `Port`
+- public traffic served through the tunnel: `Network`
+
+Unit prices differ by region. Based on the current Sealos Cloud console screenshots, `Hangzhou H`, `Singapore B`, `Beijing A`, `Guangzhou G`, and `US West` all have different CPU, memory, and port prices, so the same tunnel can have different hourly cost across regions.
+
+You can currently use this hourly price table as a direct reference:
+
+| Region | CPU (core/hour) | Memory (GB/hour) | Port (port/hour) | Network |
+| --- | ---: | ---: | ---: | ---: |
+| `Hangzhou H` | `0.027671` | `0.013956` | `0.013900` | `0.000781 /M` |
+| `Singapore B` | `0.067000` | `0.033792` | `0.013900` | `0.000781 /M` |
+| `Beijing A` | `0.017125` | `0.008637` | `0.007000` | `0.000781 /M` |
+| `Guangzhou G` | `0.017420` | `0.008786` | `0.007000` | `0.000781 /M` |
+| `US West` | `0.020833` | `0.012500` | `0.006944` | `0.000107 /M` |
+
+For a minimal HTTPS tunnel, you should usually expect at least:
+
+- one remote Pod worth of `CPU + Memory`
+- one public entry port
+- the actual public traffic consumed
+
+Use this rough formula when estimating:
+
+```text
+total cost ~= Pod(CPU + Memory) + public port + network traffic
+```
+
+To keep cost lower, prioritize:
+
+- stopping unused tunnels, or using `sealtun stop` to scale replicas to 0
+- lowering Pod requests / limits with `sealtun resources set` or `unset`
+- avoiding oversized resources for short-lived debugging tunnels
+- opening low-traffic tunnels on demand instead of keeping them always on
+
+### 8. Observe tunnels and run the local dashboard
 Show remote tunnel pod logs:
 ```bash
 sealtun logs <tunnel-id>
@@ -487,7 +534,7 @@ sealtun dashboard --addr 0.0.0.0 --allow-remote --basic-auth-user admin --basic-
 
 Remote mode does not embed the dashboard token in HTML; callers need the URL fragment token or request header. When dashboard Basic Auth is enabled, HTML, static assets, and APIs are all protected before the dashboard token layer. Every mutating action still requires a page confirmation and a backend-validated `confirm` field to avoid accidental clicks or scripted misuse.
 
-### 8. Protocol templates
+### 9. Protocol templates
 When you are unsure which command or declarative config to use, generate a template first:
 
 ```bash
@@ -500,7 +547,7 @@ sealtun template mongodb
 
 Templates print both a one-shot `sealtun expose` command and a `sealtun.yaml` snippet. `mysql`, `postgres`, `redis`, `mongodb`, and `mqtt` templates default to generic TCP L4 entries; only HTTPS templates support custom domains and access controls.
 
-### 9. Declarative config
+### 10. Declarative config
 Create `sealtun.yaml`:
 ```yaml
 version: v1

cmd/dashboard_api.go

@@ -556,7 +556,7 @@ func dashboardTunnelAudit(ctx context.Context, tunnelID string, r *http.Request)
 }
 
 func dashboardScopedSession(tunnelID string) (*session.TunnelSession, error) {
-	sess, err := findSession(tunnelID)
+	sess, err := findSessionRefreshed(context.Background(), tunnelID)
 	if err != nil {
 		return nil, err
 	}

cmd/doctor.go

@@ -146,7 +146,7 @@ func collectDoctorPayload() (*doctorPayload, error) {
 }
 
 func collectTunnelDoctorPayload(ctx context.Context, tunnelID string) (*tunnelDoctorPayload, error) {
-	sess, err := findSession(tunnelID)
+	sess, err := findSessionRefreshed(ctx, tunnelID)
 	if err != nil {
 		return nil, err
 	}

cmd/domain.go

@@ -297,6 +297,7 @@ func planSessionCustomDomain(tunnelID, customDomain string) (*domainPayload, err
 	if err != nil {
 		return nil, err
 	}
+	refreshSessionFromRemote(context.Background(), sess)
 	if !sessionSupportsCustomDomain(*sess) {
 		return nil, fmt.Errorf("custom domains are only supported for https tunnels")
 	}
@@ -325,6 +326,7 @@ func configureSessionCustomDomain(parent context.Context, tunnelID, customDomain
 	if err != nil {
 		return nil, err
 	}
+	refreshSessionFromRemote(parent, sess)
 	if !sessionSupportsCustomDomain(*sess) {
 		return nil, fmt.Errorf("custom domains are only supported for https tunnels")
 	}
@@ -364,6 +366,7 @@ func clearSessionCustomDomain(parent context.Context, tunnelID string) (*domainP
 	if err != nil {
 		return nil, err
 	}
+	refreshSessionFromRemote(parent, sess)
 	if !sessionSupportsCustomDomain(*sess) {
 		return nil, fmt.Errorf("custom domains are only supported for https tunnels")
 	}
@@ -477,6 +480,9 @@ func collectDomainStatusWithVerifier(parent context.Context, tunnelID string, ti
 		if err != nil {
 			return nil, fmt.Errorf("load tunnel sessions: %w", err)
 		}
+		for i := range list {
+			refreshSessionFromRemote(parent, &list[i])
+		}
 		sessions = list
 	}
 
@@ -679,6 +685,7 @@ func verifySessionDomain(parent context.Context, tunnelID string) (*domainVerify
 	if err != nil {
 		return nil, err
 	}
+	refreshSessionFromRemote(parent, sess)
 	if !sessionSupportsCustomDomain(*sess) {
 		return nil, fmt.Errorf("custom domains are only supported for https tunnels")
 	}
@@ -696,6 +703,7 @@ func waitForSessionDomain(parent context.Context, tunnelID string, timeout time.
 	if err != nil {
 		return nil, err
 	}
+	refreshSessionFromRemote(parent, sess)
 	if !sessionSupportsCustomDomain(*sess) {
 		return nil, fmt.Errorf("custom domains are only supported for https tunnels")
 	}

cmd/events.go

@@ -53,7 +53,7 @@ func init() {
 }
 
 func collectEventsPayloadWithContext(ctx context.Context, tunnelID string, timeout time.Duration) (*eventsPayload, error) {
-	sess, err := findSession(tunnelID)
+	sess, err := findSessionRefreshed(ctx, tunnelID)
 	if err != nil {
 		return nil, err
 	}

cmd/export.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -74,7 +75,7 @@ func runExport(args []string) (*applyFile, []string, error) {
 	var err error
 	switch {
 	case len(args) == 1:
-		sess, err := findSession(args[0])
+		sess, err := findSessionRefreshed(context.Background(), args[0])
 		if err != nil {
 			return nil, nil, err
 		}
@@ -84,6 +85,9 @@ func runExport(args []string) (*applyFile, []string, error) {
 		if err != nil {
 			return nil, nil, fmt.Errorf("load tunnel sessions: %w", err)
 		}
+		for i := range sessions {
+			refreshSessionFromRemote(context.Background(), &sessions[i])
+		}
 	default:
 		return nil, nil, fmt.Errorf("provide a tunnel id or use --all")
 	}

cmd/export_test.go

@@ -1,8 +1,11 @@
 package cmd
 
 import (
+	"context"
 	"testing"
 
+	"github.com/labring/sealtun/pkg/accesspolicy"
+	"github.com/labring/sealtun/pkg/k8s"
 	"github.com/labring/sealtun/pkg/session"
 )
 
@@ -147,3 +150,44 @@ func TestExportSessionRejectsInvalidLocalPort(t *testing.T) {
 		t.Fatal("expected warning for invalid local port")
 	}
 }
+
+func TestRunExportRefreshesRemoteState(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+
+	originalCollector := collectSessionRemoteState
+	collectSessionRemoteState = func(ctx context.Context, sess session.TunnelSession) (*k8s.TunnelRemoteState, error) {
+		return &k8s.TunnelRemoteState{
+			Protocol:   "https",
+			TargetURL:  "https://api.internal:8443",
+			AccessPolicy: &accesspolicy.Policy{RateLimit: "60/m"},
+			DeploymentOK: true,
+			AuthSecretOK: true,
+		}, nil
+	}
+	t.Cleanup(func() { collectSessionRemoteState = originalCollector })
+
+	if err := session.Save(session.TunnelSession{
+		TunnelID:  "web",
+		Protocol:  "https",
+		LocalPort: "3000",
+		Region:    "https://gzg.sealos.run",
+		Namespace: "ns-demo",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	config, _, err := runExport([]string{"web"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(config.Tunnels) != 1 {
+		t.Fatalf("expected one tunnel, got %#v", config.Tunnels)
+	}
+	if config.Tunnels[0].Target != "https://api.internal:8443" {
+		t.Fatalf("expected refreshed remote target, got %#v", config.Tunnels[0])
+	}
+	if config.Tunnels[0].AccessPolicy == nil || config.Tunnels[0].AccessPolicy.RateLimit != "60/m" {
+		t.Fatalf("expected refreshed remote access policy, got %#v", config.Tunnels[0].AccessPolicy)
+	}
+}

cmd/inspect.go

@@ -95,6 +95,7 @@ func collectInspectPayloadWithContext(ctx context.Context, tunnelID string) (*in
 	if err != nil {
 		return nil, err
 	}
+	refreshSessionFromRemote(ctx, sess)
 	ensureSessionPublicPort(ctx, sess)
 
 	snapshot := classifySession(*sess, true)