feat: productize dashboard workbench

Author: gitlayzer

README.md

@@ -13,7 +13,7 @@ Sealtun 是一款功能强大、设计优雅的 CLI 工具，旨在为 **Sealos
 - 👤 **Profile 多账号管理**：可把不同 Sealos 账号、region、workspace 和 kubeconfig 保存为命名 profile，按需切换。
 - 🚀 **一键暴露服务**：执行 `sealtun expose 8080`，即可获得一个受信任的 HTTPS URL，将流量安全地路由到本地。
 - 🌐 **自定义域名自动化**：可用 `domain plan/add/verify/status/doctor` 生成 CNAME 指引、等待 DNS、绑定域名并检查证书状态。
-- 📊 **状态与诊断**：`doctor <tunnel-id>`、`inspect --remote`、`logs`、`events` 和 `metrics` 可定位本地端口、daemon、远端 Pod、Service、Ingress 与证书问题。
+- 📊 **状态、诊断与工作台**：`doctor <tunnel-id>`、`inspect --remote`、`logs`、`events`、`metrics` 和 `dashboard` 可定位本地端口、daemon、远端 Pod、Service、Ingress 与证书问题，也可在本地工作台中管理隧道。
 - 🧩 **协议模板**：`template https|ssh|tcp|mysql|postgres|redis|mqtt` 可生成直接命令和 `sealtun.yaml` 示例。
 - 🧾 **声明式配置**：`apply -f sealtun.yaml` 可用 YAML 声明隧道，并以稳定名称幂等创建或更新。
 - 🌐 **深度适配 Sealos**：原生使用 Sealos Cloud 的 Kubernetes、Service 与 Ingress 能力，当前稳定支持 HTTPS 入口和 WebSocket 隧道。
@@ -314,15 +314,22 @@ sealtun doctor <tunnel-id> --json
 
 `metrics` 会聚合本地 session 状态、远端 Deployment/Pod/Ingress 状态，并在远端 Pod 支持时读取受 Bearer secret 保护的 `/_sealtun/metrics` 请求计数。TCP/SSH 四层隧道还会暴露 TCP 连接数、活跃连接数、字节数和错误数。
 
-启动本地只读控制台：
+启动本地工作台：
 ```bash
 sealtun dashboard
 
 # 自定义监听地址
 sealtun dashboard --addr 127.0.0.1 --port 19777
 ```
 
-Dashboard 仅监听本地地址，数据来自当前 CLI 进程读取到的本地 session、登录状态、远端诊断和自定义域名状态。
+Dashboard 默认仅监听本地地址，数据来自当前 active profile/region/namespace 的本地 session、登录状态、远端诊断和自定义域名状态。页面可以创建 HTTPS/SSH/TCP 隧道、执行 `sealtun.yaml` 的 dry-run/diff/apply、stop/start/cleanup 隧道、查看 logs/metrics/events，并执行 domain plan/add/verify/clear。
+
+```bash
+# 允许远程访问工作台，仅建议在可信网络临时使用
+sealtun dashboard --addr 0.0.0.0 --allow-remote
+```
+
+远程模式不会把 dashboard token 写进 HTML；访问者需要 URL fragment 或请求头中的 token。所有写操作都要求页面确认，并由后端再次校验 `confirm` 字段，避免误触或脚本误调用。
 
 ### 7. 协议模板
 不确定该怎么写命令或声明式配置时，可以先生成模板：

README_EN.md

@@ -13,7 +13,7 @@ It connects your local development machine straight to the internet by dynamical
 - 👤 **Named Profiles**: Save different Sealos accounts, regions, workspaces, and kubeconfigs as named profiles and switch between them.
 - 🚀 **One-Command Expose**: Execute `sealtun expose 8080`, and get a fully trusted HTTPS URL for your localhost securely routed.
 - 🌐 **Custom Domain Automation**: Use `domain plan/add/verify/status/doctor` to generate CNAME guidance, wait for DNS, attach domains, and inspect certificate readiness.
-- 📊 **Status and Diagnostics**: Use `doctor <tunnel-id>`, `inspect --remote`, `logs`, `events`, and `metrics` to diagnose local ports, daemon state, remote Pods, Services, Ingresses, and certificates.
+- 📊 **Status, Diagnostics, and Workbench**: Use `doctor <tunnel-id>`, `inspect --remote`, `logs`, `events`, `metrics`, and `dashboard` to diagnose local ports, daemon state, remote Pods, Services, Ingresses, and certificates, or manage tunnels from the local workbench.
 - 🧩 **Protocol Templates**: Use `template https|ssh|tcp|mysql|postgres|redis|mqtt` to generate commands and `sealtun.yaml` examples.
 - 🧾 **Declarative Config**: Use `apply -f sealtun.yaml` to declare tunnels in YAML and create or update them with stable names.
 - 🌐 **Optimized for Sealos**: Native support for Sealos Cloud domains, HTTPS traffic, and WebSocket tunnels.
@@ -314,15 +314,22 @@ sealtun doctor <tunnel-id> --json
 
 `metrics` combines local session state, remote Deployment/Pod/Ingress readiness, and server-side request counters when the remote pod supports the Bearer-secret-protected `/_sealtun/metrics` endpoint. TCP/SSH tunnels also expose TCP connection, active connection, byte, and error counters.
 
-Run the local read-only dashboard:
+Run the local workbench:
 ```bash
 sealtun dashboard
 
 # Custom listen address
 sealtun dashboard --addr 127.0.0.1 --port 19777
 ```
 
-The dashboard listens locally and reads the same data as the CLI: local sessions, login state, remote diagnostics, and custom domain readiness.
+The dashboard listens locally by default and uses only the current active profile/region/namespace. It reads local sessions, login state, remote diagnostics, and custom domain readiness. The page can create HTTPS/SSH/TCP tunnels, run `sealtun.yaml` dry-run/diff/apply, stop/start/cleanup tunnels, view logs/metrics/events, and run domain plan/add/verify/clear.
+
+```bash
+# Allow remote access to the workbench; use only on trusted networks
+sealtun dashboard --addr 0.0.0.0 --allow-remote
+```
+
+Remote mode does not embed the dashboard token in HTML; callers need the URL fragment token or request header. Every mutating action requires a page confirmation and a backend-validated `confirm` field to avoid accidental clicks or scripted misuse.
 
 ### 7. Protocol templates
 When you are unsure which command or declarative config to use, generate a template first:

cmd/apply.go

@@ -169,6 +169,18 @@ func runApply(ctx context.Context, path string, dryRun bool) ([]applyResult, err
 	if err != nil {
 		return nil, err
 	}
+	return runApplyConfig(ctx, config, dryRun)
+}
+
+func runApplyContent(ctx context.Context, data []byte, dryRun bool) ([]applyResult, error) {
+	config, err := loadApplyData("dashboard yaml", data)
+	if err != nil {
+		return nil, err
+	}
+	return runApplyConfig(ctx, config, dryRun)
+}
+
+func runApplyConfig(ctx context.Context, config *applyFile, dryRun bool) ([]applyResult, error) {
 	if len(config.Tunnels) == 0 {
 		return nil, fmt.Errorf("apply file has no tunnels")
 	}
@@ -253,18 +265,25 @@ func loadApplyFile(path string) (*applyFile, error) {
 	if len(data) > applyFileMaxBytes {
 		return nil, fmt.Errorf("apply file %s is too large; limit is %d bytes", path, applyFileMaxBytes)
 	}
+	return loadApplyData(path, data)
+}
+
+func loadApplyData(label string, data []byte) (*applyFile, error) {
+	if len(data) > applyFileMaxBytes {
+		return nil, fmt.Errorf("apply file %s is too large; limit is %d bytes", label, applyFileMaxBytes)
+	}
 	var config applyFile
 	decoder := yaml.NewDecoder(bytes.NewReader(data))
 	decoder.KnownFields(true)
 	if err := decoder.Decode(&config); err != nil {
-		return nil, fmt.Errorf("parse %s: %w", path, err)
+		return nil, fmt.Errorf("parse %s: %w", label, err)
 	}
 	var extra interface{}
 	if err := decoder.Decode(&extra); err != io.EOF {
 		if err != nil {
-			return nil, fmt.Errorf("parse %s: %w", path, err)
+			return nil, fmt.Errorf("parse %s: %w", label, err)
 		}
-		return nil, fmt.Errorf("parse %s: multiple YAML documents are not supported", path)
+		return nil, fmt.Errorf("parse %s: multiple YAML documents are not supported", label)
 	}
 	if config.Version == "" {
 		config.Version = "v1"
@@ -853,6 +872,22 @@ func runDiff(path string) ([]diffResult, error) {
 	if err != nil {
 		return nil, err
 	}
+	return runDiffConfig(config)
+}
+
+func runDiffContent(data []byte) ([]diffResult, error) {
+	config, err := loadApplyData("dashboard yaml", data)
+	if err != nil {
+		return nil, err
+	}
+	return runDiffConfig(config)
+}
+
+func runDiffConfig(config *applyFile) ([]diffResult, error) {
+	return runDiffConfigWithSessionLookup(config, session.Get)
+}
+
+func runDiffConfigWithSessionLookup(config *applyFile, lookup func(string) (*session.TunnelSession, error)) ([]diffResult, error) {
 	if len(config.Tunnels) == 0 {
 		return nil, fmt.Errorf("apply file has no tunnels")
 	}
@@ -874,7 +909,7 @@ func runDiff(path string) ([]diffResult, error) {
 			AccessPolicy: normalized.AccessPolicy != nil,
 			BasicAuth:    normalized.BasicAuth != nil && normalized.BasicAuth.Enabled,
 		}
-		existing, err := session.Get(normalized.TunnelID)
+		existing, err := lookup(normalized.TunnelID)
 		if err == nil {
 			reuseExistingExpiration(&normalized, existing)
 			result.ExpiresAt = normalized.ExpiresAt

cmd/daemon.go

@@ -247,7 +247,7 @@ func runDaemonTunnel(ctx context.Context, sess session.TunnelSession) {
 			err = fmt.Errorf("invalid tunnel control host: %w", hostErr)
 		} else {
 			wsURL := fmt.Sprintf("wss://%s/_sealtun/ws", controlHost)
-			err = tunnel.DialServerAndServeWithOnConnected(ctx, wsURL, current.Secret, current.LocalPort, func() {
+			err = tunnel.DialServerAndServeProtocol(ctx, wsURL, current.Secret, current.LocalPort, current.Protocol, func() {
 				latest, getErr := session.Get(sess.TunnelID)
 				if getErr != nil {
 					return