refactor: 引入 ScanSession，替代全局状态穿透扫描管道 (Phase 1-3)

- 新增 common/session.go: ScanSession 结构体封装 Config/State/Params/Dialer
- RunScan/Strategy/ExecuteScanTasks/executeScanTask 全部接收 session
- Plugin 接口从 Scan(ctx, info, config, state) 改为 Scan(ctx, info, session)
- 48 个插件实现统一更新签名
- Web API 构建 ScanSession 传给 RunScan
- CLI 模式通过 Initialize() 创建 session

common/initialize.go

@@ -13,9 +13,10 @@ initialize.go - 统一初始化入口
 
 // InitResult 初始化结果
 type InitResult struct {
-	Config *Config
+	Config  *Config
-	State  *State
+	State   *State
-	Info   *HostInfo
+	Info    *HostInfo
+	Session *ScanSession
 }
 
 // Initialize 统一初始化函数
@@ -39,10 +40,13 @@ func Initialize(info *HostInfo) (*InitResult, error) {
 		return nil, fmt.Errorf("输出初始化失败: %w", err)
 	}
 
+	session := NewScanSession(cfg, state, GetFlagVars())
+
 	return &InitResult{
-		Config: cfg,
+		Config:  cfg,
-		State:  state,
+		State:   state,
-		Info:   info,
+		Info:    info,
+		Session: session,
 	}, nil
 }
 

common/session.go

@@ -0,0 +1,101 @@
+package common
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/shadow1ng/fscan/common/proxy"
+)
+
+// ScanSession 封装单次扫描的全部上下文
+// 一次扫描一个 session，并发扫描各自独立
+type ScanSession struct {
+	Config *Config   // 不可变，创建后只读
+	State  *State    // 可变，原子操作，每会话独立
+	Params *FlagVars // 原始参数，只读
+
+	// 每会话 dialer（懒初始化，取决于代理配置）
+	dialerOnce sync.Once
+	dialer     proxy.Dialer
+	dialerErr  error
+}
+
+// NewScanSession 从已构建的 Config、State 和 FlagVars 创建会话
+func NewScanSession(config *Config, state *State, params *FlagVars) *ScanSession {
+	return &ScanSession{
+		Config: config,
+		State:  state,
+		Params: params,
+	}
+}
+
+// DialTCP 创建 TCP 连接，内含限速检查、代理、计数
+func (s *ScanSession) DialTCP(ctx context.Context, network, address string, timeout time.Duration) (net.Conn, error) {
+	// 检查发包限制
+	if ok, err := CanSendPacketWith(s.Config, s.State); !ok {
+		LogError(fmt.Sprintf("TCP连接 %s 受限: %s", address, err.Error()))
+		return nil, fmt.Errorf("发包受限: %s", err.Error())
+	}
+
+	// 获取 dialer
+	dialer, err := s.getDialer(timeout)
+	if err != nil {
+		LogError(fmt.Sprintf("获取代理拨号器失败: %v", err))
+		s.State.IncrementTCPFailedPacketCount()
+		return nil, err
+	}
+
+	conn, err := dialer.DialContext(ctx, network, address)
+	if err != nil {
+		s.State.IncrementTCPFailedPacketCount()
+		LogDebug(fmt.Sprintf("连接 %s 失败: %v", address, err))
+		return nil, err
+	}
+
+	s.State.IncrementTCPSuccessPacketCount()
+	return conn, nil
+}
+
+func (s *ScanSession) getDialer(timeout time.Duration) (proxy.Dialer, error) {
+	s.dialerOnce.Do(func() {
+		cfg := s.createProxyConfig(timeout)
+		manager := proxy.NewProxyManager(cfg)
+		s.dialer, s.dialerErr = manager.GetDialer()
+	})
+	return s.dialer, s.dialerErr
+}
+
+func (s *ScanSession) createProxyConfig(timeout time.Duration) *proxy.ProxyConfig {
+	cfg := proxy.DefaultProxyConfig()
+	cfg.Timeout = timeout
+	cfg.LocalAddr = s.Config.Network.Iface
+
+	// 优先 SOCKS5
+	if s.Config.Network.Socks5Proxy != "" {
+		cfg.Type = proxy.ProxyTypeSOCKS5
+		socks5URL := s.Config.Network.Socks5Proxy
+		if !strings.HasPrefix(socks5URL, "socks5://") {
+			socks5URL = "socks5://" + socks5URL
+		}
+		cfg.Address, cfg.Username, cfg.Password = parseProxyURL(socks5URL, s.Config.Network.Socks5Proxy)
+		return cfg
+	}
+
+	// 其次 HTTP
+	if s.Config.Network.HTTPProxy != "" {
+		if strings.HasPrefix(s.Config.Network.HTTPProxy, "https://") {
+			cfg.Type = proxy.ProxyTypeHTTPS
+		} else {
+			cfg.Type = proxy.ProxyTypeHTTP
+		}
+		cfg.Address, cfg.Username, cfg.Password = parseProxyURL(s.Config.Network.HTTPProxy, s.Config.Network.HTTPProxy)
+		return cfg
+	}
+
+	cfg.Type = proxy.ProxyTypeNone
+	return cfg
+}

core/alive_scanner.go

@@ -54,17 +54,15 @@ func (s *AliveScanStrategy) Description() string {
 }
 
 // Execute 执行存活探测扫描策略
-func (s *AliveScanStrategy) Execute(_ context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func (s *AliveScanStrategy) Execute(_ context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
 	// 验证扫描目标（需要同时检查 -h 和 -hf 参数）
-	fv := common.GetFlagVars()
+	if info.Host == "" && session.Params.HostsFile == "" {
-	if info.Host == "" && fv.HostsFile == "" {
 		common.LogError(i18n.GetText("parse_error_target_empty"))
 		return
 	}
 
-
 	// 执行存活探测
-	s.performAliveScan(info, config, state)
+	s.performAliveScan(info, session.Config, session.State)
 
 	// 输出统计信息
 	s.outputStats()

core/local_scanner.go

@@ -42,7 +42,9 @@ func (s *LocalScanStrategy) Description() string {
 }
 
 // Execute 执行本地扫描策略
-func (s *LocalScanStrategy) Execute(ctx context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func (s *LocalScanStrategy) Execute(ctx context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+	config := session.Config
+
 	// 输出扫描开始信息
 	s.LogScanStart()
 
@@ -67,7 +69,7 @@ func (s *LocalScanStrategy) Execute(ctx context.Context, config *common.Config,
 	targets := s.PrepareTargets(info)
 
 	// 执行扫描任务
-	ExecuteScanTasks(ctx, config, state, targets, s, ch, wg)
+	ExecuteScanTasks(ctx, session, targets, s, ch, wg)
 }
 
 // PrepareTargets 准备本地扫描目标

core/scanner.go

@@ -18,7 +18,7 @@ import (
 
 // ScanStrategy 定义扫描策略接口
 type ScanStrategy interface {
-	Execute(ctx context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup)
+	Execute(ctx context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup)
 	GetPlugins(config *common.Config) ([]string, bool)
 	IsPluginApplicableByName(pluginName string, targetHost string, targetPort int, isCustomMode bool, config *common.Config) bool
 }
@@ -73,10 +73,13 @@ func selectStrategy(config *common.Config, state *common.State, info common.Host
 }
 
 // RunScan 执行整体扫描流程
-func RunScan(ctx context.Context, info common.HostInfo, config *common.Config, state *common.State) {
+func RunScan(ctx context.Context, info common.HostInfo, session *common.ScanSession) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	config := session.Config
+	state := session.State
+
 	// 初始化HTTP客户端（静默，无需日志）
 	if err := lib.Inithttp(config); err != nil {
 		common.LogError(i18n.Tr("http_client_init_failed", err))
@@ -91,7 +94,7 @@ func RunScan(ctx context.Context, info common.HostInfo, config *common.Config, s
 	wg := sync.WaitGroup{}
 
 	// 执行策略
-	strategy.Execute(ctx, config, state, info, ch, &wg)
+	strategy.Execute(ctx, session, info, ch, &wg)
 
 	// 等待所有扫描完成
 	wg.Wait()
@@ -142,7 +145,9 @@ func finishScan(config *common.Config, state *common.State) {
 }
 
 // ExecuteScanTasks 任务执行通用框架
-func ExecuteScanTasks(ctx context.Context, config *common.Config, state *common.State, targets []common.HostInfo, strategy ScanStrategy, ch chan struct{}, wg *sync.WaitGroup) {
+func ExecuteScanTasks(ctx context.Context, session *common.ScanSession, targets []common.HostInfo, strategy ScanStrategy, ch chan struct{}, wg *sync.WaitGroup) {
+	config := session.Config
+
 	// 获取要执行的插件
 	pluginsToRun, isCustomMode := strategy.GetPlugins(config)
 
@@ -174,7 +179,7 @@ func ExecuteScanTasks(ctx context.Context, config *common.Config, state *common.
 
 			// 检查插件是否适用于当前目标
 			if strategy.IsPluginApplicableByName(pluginName, target.Host, targetPort, isCustomMode, config) {
-				executeScanTask(ctx, config, state, pluginName, target, ch, wg)
+				executeScanTask(ctx, session, pluginName, target, ch, wg)
 			}
 		}
 	}
@@ -205,7 +210,9 @@ var longRunningPlugins = map[string]bool{
 }
 
 // executeScanTask 执行单个扫描任务
-func executeScanTask(ctx context.Context, config *common.Config, state *common.State, pluginName string, target common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func executeScanTask(ctx context.Context, session *common.ScanSession, pluginName string, target common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+	state := session.State
+
 	// 检查取消
 	select {
 	case <-ctx.Done():
@@ -218,7 +225,7 @@ func executeScanTask(ctx context.Context, config *common.Config, state *common.S
 		go func() {
 			plugin := plugins.Get(pluginName)
 			if plugin != nil {
-				plugin.Scan(ctx, &target, config, state)
+				plugin.Scan(ctx, &target, session)
 			}
 		}()
 		return
@@ -257,7 +264,7 @@ func executeScanTask(ctx context.Context, config *common.Config, state *common.S
 
 		plugin := plugins.Get(pluginName)
 		if plugin != nil {
-			result := plugin.Scan(ctx, &target, config, state)
+			result := plugin.Scan(ctx, &target, session)
 			if result != nil {
 				if result.Success {
 					// 保存成功的扫描结果到文件

core/scanner_test.go

@@ -215,7 +215,7 @@ type mockStrategy struct {
 	applicablePlugins map[string]bool // pluginName -> isApplicable
 }
 
-func (m *mockStrategy) Execute(_ context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func (m *mockStrategy) Execute(_ context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
 }
 
 func (m *mockStrategy) GetPlugins() ([]string, bool) {

core/service_scanner.go

@@ -113,10 +113,11 @@ func (s *ServiceScanStrategy) Description() string {
 }
 
 // Execute 执行服务扫描策略
-func (s *ServiceScanStrategy) Execute(ctx context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func (s *ServiceScanStrategy) Execute(ctx context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+	config := session.Config
+
 	// 验证扫描目标（需要同时检查 -h 和 -hf 参数）
-	fv := common.GetFlagVars()
+	if info.Host == "" && session.Params.HostsFile == "" {
-	if info.Host == "" && fv.HostsFile == "" {
 		common.LogError(i18n.GetText("parse_error_target_empty"))
 		return
 	}
@@ -134,13 +135,13 @@ func (s *ServiceScanStrategy) Execute(ctx context.Context, config *common.Config
 	s.LogPluginInfo(config)
 
 	// 执行主机扫描流程
-	s.performHostScan(ctx, config, state, info, ch, wg)
+	s.performHostScan(ctx, session, info, ch, wg)
 }
 
 // performHostScan 执行主机扫描的完整流程
-func (s *ServiceScanStrategy) performHostScan(ctx context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func (s *ServiceScanStrategy) performHostScan(ctx context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
 	// 发现目标主机和端口
-	targetInfos, err := s.discoverTargets(info.Host, info, config, state)
+	targetInfos, err := s.discoverTargets(info.Host, info, session.Config, session.State)
 	if err != nil {
 		common.LogError(err.Error())
 		return
@@ -148,7 +149,7 @@ func (s *ServiceScanStrategy) performHostScan(ctx context.Context, config *commo
 
 	// 执行漏洞扫描
 	if len(targetInfos) > 0 {
-		ExecuteScanTasks(ctx, config, state, targetInfos, s, ch, wg)
+		ExecuteScanTasks(ctx, session, targetInfos, s, ch, wg)
 	}
 }
 

core/web_scanner.go

@@ -304,7 +304,7 @@ func (s *WebScanStrategy) Description() string {
 }
 
 // Execute 执行Web扫描策略
-func (s *WebScanStrategy) Execute(ctx context.Context, config *common.Config, state *common.State, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func (s *WebScanStrategy) Execute(ctx context.Context, session *common.ScanSession, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
 	// 输出扫描开始信息
 	s.LogScanStart()
 
@@ -315,13 +315,13 @@ func (s *WebScanStrategy) Execute(ctx context.Context, config *common.Config, st
 	}
 
 	// 准备URL目标
-	targets := s.PrepareTargets(info, state)
+	targets := s.PrepareTargets(info, session.State)
 
 	// 输出插件信息
-	s.LogPluginInfo(config)
+	s.LogPluginInfo(session.Config)
 
 	// 执行扫描任务
-	ExecuteScanTasks(ctx, config, state, targets, s, ch, wg)
+	ExecuteScanTasks(ctx, session, targets, s, ch, wg)
 }
 
 // PrepareTargets 准备URL目标列表

main.go

@@ -67,5 +67,5 @@ func main() {
 	defer func() { _ = common.Cleanup() }()
 
 	// 执行扫描
-	core.RunScan(context.Background(), *result.Info, result.Config, result.State)
+	core.RunScan(context.Background(), *result.Info, result.Session)
 }

plugins/init.go

@@ -11,7 +11,7 @@ import (
 // Plugin 统一插件接口
 type Plugin interface {
 	Name() string
-	Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *Result
+	Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *Result
 }
 
 // BasePlugin 基础插件结构，提供通用的name字段
@@ -62,7 +62,7 @@ type Result struct {
 
 // Exploiter 利用接口
 type Exploiter interface {
-	Exploit(ctx context.Context, info *common.HostInfo, creds Credential, config *common.Config) *ExploitResult
+	Exploit(ctx context.Context, info *common.HostInfo, creds Credential, session *common.ScanSession) *ExploitResult
 }
 
 // ExploitResult 利用结果

plugins/local/avdetect.go

@@ -53,7 +53,7 @@ func NewAVDetectPlugin() *AVDetectPlugin {
 }
 
 // Scan 执行AV/EDR检测 - 直接、有效
-func (p *AVDetectPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *AVDetectPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
 	var output strings.Builder
 	var detectedAVs []string
 

plugins/local/cleaner.go

@@ -32,7 +32,7 @@ func NewCleanerPlugin() *CleanerPlugin {
 }
 
 // Scan 执行系统痕迹清理 - 直接、简单
-func (p *CleanerPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *CleanerPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
 	var output strings.Builder
 	var filesCleared, dirsCleared, sysCleared int
 

plugins/local/crontask.go

@@ -35,7 +35,8 @@ func NewCronTaskPlugin() *CronTaskPlugin {
 }
 
 // Scan 执行计划任务持久化 - 直接实现
-func (p *CronTaskPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *CronTaskPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
 	var output strings.Builder
 
 	if runtime.GOOS != "linux" {

plugins/local/dcinfo.go

@@ -41,7 +41,9 @@ func NewDCInfoPlugin() *DCInfoPlugin {
 }
 
 // Scan 执行域控信息收集 - 直接实现
-func (p *DCInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *DCInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	output.WriteString("=== 域控制器信息收集 ===\n")

plugins/local/downloader.go

@@ -35,7 +35,8 @@ func NewDownloaderPlugin() *DownloaderPlugin {
 }
 
 // Scan 执行文件下载任务 - 直接实现
-func (p *DownloaderPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *DownloaderPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/envinfo.go

@@ -30,7 +30,7 @@ func NewEnvInfoPlugin() *EnvInfoPlugin {
 }
 
 // Scan 执行环境变量收集 - 直接、有效
-func (p *EnvInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *EnvInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
 	var output strings.Builder
 	var sensitiveVars []string
 

plugins/local/fileinfo.go

@@ -33,7 +33,7 @@ func NewFileInfoPlugin() *FileInfoPlugin {
 }
 
 // Scan 执行本地文件扫描 - 直接、简单、有效
-func (p *FileInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *FileInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
 	var foundFiles []string
 
 	// 扫描关键敏感文件位置 - 删除复杂的配置系统

plugins/local/forwardshell.go

@@ -37,7 +37,9 @@ func NewForwardShellPlugin() *ForwardShellPlugin {
 }
 
 // Scan 执行正向Shell服务 - 直接实现
-func (p *ForwardShellPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *ForwardShellPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/keylogger.go

@@ -36,7 +36,8 @@ func NewKeyloggerPlugin() *KeyloggerPlugin {
 }
 
 // Scan 执行键盘记录 - 直接实现
-func (p *KeyloggerPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *KeyloggerPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/ldpreload.go

@@ -33,7 +33,8 @@ func NewLDPreloadPlugin() *LDPreloadPlugin {
 }
 
 // Scan 执行LD_PRELOAD持久化 - 直接实现
-func (p *LDPreloadPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *LDPreloadPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
 	var output strings.Builder
 
 	if runtime.GOOS != "linux" {

plugins/local/minidump.go

@@ -83,7 +83,9 @@ func NewMiniDumpPlugin() *MiniDumpPlugin {
 }
 
 // Scan 执行内存转储 - 直接实现
-func (p *MiniDumpPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *MiniDumpPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	defer func() {
 		if r := recover(); r != nil {
 			common.LogError(i18n.Tr("minidump_panic", r))

plugins/local/reverseshell.go

@@ -40,7 +40,9 @@ func NewReverseShellPlugin() *ReverseShellPlugin {
 // GetName 实现Plugin接口
 
 // Scan 执行反弹Shell - 直接实现
-func (p *ReverseShellPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *ReverseShellPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/shellenv.go

@@ -33,7 +33,8 @@ func NewShellEnvPlugin() *ShellEnvPlugin {
 }
 
 // Scan 执行Shell环境变量持久化 - 直接实现
-func (p *ShellEnvPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *ShellEnvPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
 	var output strings.Builder
 
 	if runtime.GOOS != "linux" {

plugins/local/socks5proxy.go

@@ -36,7 +36,9 @@ func NewSocks5ProxyPlugin() *Socks5ProxyPlugin {
 }
 
 // Scan 执行SOCKS5代理扫描 - 直接实现
-func (p *Socks5ProxyPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *Socks5ProxyPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/systemdservice.go

@@ -33,7 +33,8 @@ func NewSystemdServicePlugin() *SystemdServicePlugin {
 }
 
 // Scan 执行系统服务持久化 - 直接实现
-func (p *SystemdServicePlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *SystemdServicePlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
 	var output strings.Builder
 
 	if runtime.GOOS != "linux" {

plugins/local/systeminfo.go

@@ -33,7 +33,7 @@ func NewSystemInfoPlugin() *SystemInfoPlugin {
 }
 
 // Scan 执行系统信息收集 - 直接、简单、有效
-func (p *SystemInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *SystemInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
 	var output strings.Builder
 
 	output.WriteString("=== 系统信息收集 ===\n")

plugins/local/types.go

@@ -10,7 +10,7 @@ import (
 // Plugin 本地插件接口 - 不需要端口概念
 type Plugin interface {
 	Name() string
-	Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result
+	Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result
 }
 
 // RegisterLocalPlugin 注册本地插件 - 自动标记local类型

plugins/local/winregistry.go

@@ -32,7 +32,9 @@ func NewWinRegistryPlugin() *WinRegistryPlugin {
 }
 
 // Scan 执行Windows注册表持久化 - 直接实现
-func (p *WinRegistryPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *WinRegistryPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	if runtime.GOOS != "windows" {

plugins/local/winschtask.go

@@ -33,7 +33,9 @@ func NewWinSchTaskPlugin() *WinSchTaskPlugin {
 }
 
 // Scan 执行Windows计划任务持久化 - 直接实现
-func (p *WinSchTaskPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *WinSchTaskPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/winservice.go

@@ -33,7 +33,9 @@ func NewWinServicePlugin() *WinServicePlugin {
 }
 
 // Scan 执行Windows服务持久化 - 直接实现
-func (p *WinServicePlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *WinServicePlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/winstartup.go

@@ -33,7 +33,9 @@ func NewWinStartupPlugin() *WinStartupPlugin {
 }
 
 // Scan 执行Windows启动文件夹持久化 - 直接实现
-func (p *WinStartupPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *WinStartupPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/local/winwmi.go

@@ -33,7 +33,9 @@ func NewWinWMIPlugin() *WinWMIPlugin {
 }
 
 // Scan 执行Windows WMI事件订阅持久化 - 直接实现
-func (p *WinWMIPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *WinWMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	var output strings.Builder
 
 	// 从config获取配置

plugins/services/activemq.go

@@ -25,7 +25,9 @@ func NewActiveMQPlugin() *ActiveMQPlugin {
 	}
 }
 
-func (p *ActiveMQPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *ActiveMQPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/cassandra.go

@@ -24,7 +24,9 @@ func NewCassandraPlugin() *CassandraPlugin {
 	}
 }
 
-func (p *CassandraPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *CassandraPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/elasticsearch.go

@@ -25,7 +25,9 @@ func NewElasticsearchPlugin() *ElasticsearchPlugin {
 	}
 }
 
-func (p *ElasticsearchPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *ElasticsearchPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/findnet.go

@@ -36,7 +36,9 @@ func NewFindNetPlugin() *FindNetPlugin {
 // GetPorts 实现Plugin接口
 
 // Scan 执行FindNet扫描 - Windows网络信息收集
-func (p *FindNetPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *FindNetPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 检查是否为RPC端口

plugins/services/ftp.go

@@ -24,7 +24,9 @@ func NewFTPPlugin() *FTPPlugin {
 	}
 }
 
-func (p *FTPPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *FTPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	if config.DisableBrute {
 		return p.identifyService(info, config, state)
 	}

plugins/services/kafka.go

@@ -24,7 +24,9 @@ func NewKafkaPlugin() *KafkaPlugin {
 	}
 }
 
-func (p *KafkaPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *KafkaPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	if config.DisableBrute {
 		return p.identifyService(ctx, info, config, state)
 	}

plugins/services/ldap.go

@@ -23,7 +23,9 @@ func NewLDAPPlugin() *LDAPPlugin {
 	}
 }
 
-func (p *LDAPPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *LDAPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	if config.DisableBrute {
 		return p.identifyService(ctx, info, config, state)
 	}

plugins/services/memcached.go

@@ -24,7 +24,9 @@ func NewMemcachedPlugin() *MemcachedPlugin {
 	}
 }
 
-func (p *MemcachedPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *MemcachedPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/mongodb.go

@@ -28,7 +28,9 @@ func NewMongoDBPlugin() *MongoDBPlugin {
 	}
 }
 
-func (p *MongoDBPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *MongoDBPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/ms17010.go

@@ -34,7 +34,9 @@ func NewMS17010Plugin() *MS17010Plugin {
 // GetPorts 实现Plugin接口
 
 // Scan 执行MS17-010扫描
-func (p *MS17010Plugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *MS17010Plugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	// 如果禁用暴力破解，也禁用漏洞检测
 	if config.DisableBrute {
 		return &ScanResult{

plugins/services/mssql.go

@@ -25,7 +25,9 @@ func NewMSSQLPlugin() *MSSQLPlugin {
 	}
 }
 
-func (p *MSSQLPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *MSSQLPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	if config.DisableBrute {
 		return p.identifyService(ctx, info, config, state)
 	}

plugins/services/mysql.go

@@ -36,7 +36,9 @@ func NewMySQLPlugin() *MySQLPlugin {
 	}
 }
 
-func (p *MySQLPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *MySQLPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	if config.DisableBrute {
 		return p.identifyService(info, config)
 	}

plugins/services/neo4j.go

@@ -25,7 +25,9 @@ func NewNeo4jPlugin() *Neo4jPlugin {
 	}
 }
 
-func (p *Neo4jPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *Neo4jPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/netbios.go

@@ -29,7 +29,9 @@ func NewNetBIOSPlugin() *NetBIOSPlugin {
 // GetPorts 实现Plugin接口
 
 // Scan 执行NetBIOS扫描 - 收集Windows主机和域信息
-func (p *NetBIOSPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *NetBIOSPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 检查端口类型

plugins/services/oracle.go

@@ -24,7 +24,9 @@ func NewOraclePlugin() *OraclePlugin {
 	}
 }
 
-func (p *OraclePlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *OraclePlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/postgresql.go

@@ -25,7 +25,9 @@ func NewPostgreSQLPlugin() *PostgreSQLPlugin {
 	}
 }
 
-func (p *PostgreSQLPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *PostgreSQLPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/rabbitmq.go

@@ -26,7 +26,9 @@ func NewRabbitMQPlugin() *RabbitMQPlugin {
 	}
 }
 
-func (p *RabbitMQPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *RabbitMQPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/rdp.go

@@ -28,7 +28,9 @@ func NewRDPPlugin() *RDPPlugin {
 }
 
 // Scan 执行RDP扫描 - 系统指纹识别 + 真实暴力破解
-func (p *RDPPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *RDPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 配置grdp日志级别

plugins/services/redis.go

@@ -31,7 +31,9 @@ func NewRedisPlugin() *RedisPlugin {
 }
 
 // Scan 执行Redis扫描
-func (p *RedisPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *RedisPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 如果禁用暴力破解，只做服务识别

plugins/services/rsync.go

@@ -28,7 +28,9 @@ func NewRsyncPlugin() *RsyncPlugin {
 	}
 }
 
-func (p *RsyncPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *RsyncPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/smb.go

@@ -24,7 +24,9 @@ func NewSmbPlugin() *SmbPlugin {
 	}
 }
 
-func (p *SmbPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *plugins.Result {
+func (p *SmbPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 检查端口

plugins/services/smtp.go

@@ -25,7 +25,9 @@ func NewSMTPPlugin() *SMTPPlugin {
 	}
 }
 
-func (p *SMTPPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *SMTPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/ssh.go

@@ -34,7 +34,9 @@ func NewSSHPlugin() *SSHPlugin {
 }
 
 // Scan 执行SSH扫描
-func (p *SSHPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *SSHPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 如果指定了SSH密钥，优先使用密钥认证

plugins/services/telnet.go

@@ -50,7 +50,9 @@ func NewTelnetPlugin() *TelnetPlugin {
 	}
 }
 
-func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	if config.DisableBrute {

plugins/services/types.go

@@ -10,7 +10,7 @@ import (
 // 插件接口定义 - 统一命名风格
 type Plugin interface {
 	Name() string
-	Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult
+	Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult
 }
 
 type ScanResult = plugins.Result

plugins/services/vnc.go

@@ -24,7 +24,9 @@ func NewVNCPlugin() *VNCPlugin {
 	}
 }
 
-func (p *VNCPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+func (p *VNCPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
+	config := session.Config
+	state := session.State
 	target := info.Target()
 
 	// 检查未授权访问

plugins/web/types.go

@@ -10,7 +10,7 @@ import (
 // WebPlugin Web插件接口 - 使用智能HTTP检测，不需要预定义端口
 type WebPlugin interface {
 	Name() string
-	Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *WebScanResult
+	Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *WebScanResult
 }
 
 // WebScanResult Web扫描结果类型别名

plugins/web/webpoc.go

@@ -87,7 +87,8 @@ func NewWebPocPlugin() *WebPocPlugin {
 // Scan 执行Web POC扫描
 // 注意：非全量模式下，POC扫描由webtitle插件在指纹识别后触发，此插件不执行
 // 全量模式(-full)下，此插件独立执行全量POC扫描
-func (p *WebPocPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *WebScanResult {
+func (p *WebPocPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *WebScanResult {
+	config := session.Config
 	if config.POC.Disabled {
 		return &WebScanResult{
 			Success: false,

plugins/web/webtitle.go

@@ -39,7 +39,8 @@ func NewWebTitlePlugin() *WebTitlePlugin {
 }
 
 // Scan 执行WebTitle扫描
-func (p *WebTitlePlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *WebScanResult {
+func (p *WebTitlePlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *WebScanResult {
+	config := session.Config
 	title, status, length, server, fingerprints, url, err := p.getWebTitle(ctx, info, config)
 	if err != nil {
 		return &WebScanResult{

web/api/scan.go

@@ -206,9 +206,12 @@ func (h *ScanHandler) runScan(req ScanRequest) {
 	fv.DisableSave = true // Web模式不保存到文件
 	fv.Silent = true      // 静默模式
 
-	// 构建Config，同步到全局实例供 network/限速等模块使用
+	// 构建Config和Session
 	config := common.BuildConfigFromFlags(fv)
 	state := common.NewState()
+	session := common.NewScanSession(config, state, fv)
+
+	// 过渡桥：全局状态同步（待 Phase 5 移除）
 	common.SetGlobalConfig(config)
 	common.SetGlobalState(state)
 
@@ -221,7 +224,7 @@ func (h *ScanHandler) runScan(req ScanRequest) {
 	})
 
 	// 执行扫描
-	core.RunScan(ctx, info, config, state)
+	core.RunScan(ctx, info, session)
 }
 
 // Stop 停止扫描