Merge pull request #608 from NOPTrace/fix/smtp-deadline

fix: set conn deadline in smtp testAnonymousAccess/testOpenRelay to avoid hang on silent servers

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -72,7 +72,8 @@ body:
     attributes:
       label: fscan 版本
       options:
-        - 2.2.0-rc (dev)
+        - 2.2.0
+        - 2.2.0-rc
         - 2.1.3
         - 2.1.2
         - 2.1.0

.github/ISSUE_TEMPLATE/false_positive.yml

@@ -94,7 +94,8 @@ body:
     attributes:
       label: fscan 版本
       options:
-        - 2.2.0-rc (dev)
+        - 2.2.0
+        - 2.2.0-rc
         - 2.1.3
         - 2.1.2
         - 2.1.0

.github/RELEASE.md

@@ -12,6 +12,7 @@ gh workflow run release.yml -f snapshot=true
 # 3. 确认版本号一致
 grep "version" common/globals.go
 grep "版本" README.md
+grep "Version" README_EN.md
 ```
 
 ## 发版
@@ -20,7 +21,7 @@ grep "版本" README.md
 # 1. 确认 release notes 已就绪
 cat .github/release-notes/v<VERSION>.md
 
-# 2. 打 tag（在 dev 分支打 RC，在 main 分支打正式版）
+# 2. 打 tag（RC 手动打；正式版合并到 main 后由 CI 自动打 tag）
 git tag v<VERSION>
 git push origin v<VERSION>
 
@@ -47,18 +48,14 @@ git push origin v<VERSION>
 ## 正式版发布（RC → 正式）
 
 ```bash
-# 1. 合并 dev 到 main
-git checkout main
-git merge dev
-git push
-
-# 2. 更新版本号去掉 -rc
+# 1. 在 dev 分支准备正式版内容
 # common/globals.go, README.md, README_EN.md
-
-# 3. 准备正式版 release notes
 # .github/release-notes/v2.2.0.md
 
-# 4. 打 tag
-git tag v2.2.0
-git push origin v2.2.0
+# 2. 创建 dev -> main PR
+gh pr create --base main --head dev
+
+# 3. 合并 PR
+# main push 会自动读取 common/globals.go 中的版本号，创建 v<VERSION> tag
+# tag push 会触发 GoReleaser 构建并创建 GitHub Release
 ```

.github/conf/.goreleaser.yml

@@ -1,3 +1,5 @@
+version: 2
+
 project_name: "fscan"
 
 before:
@@ -135,17 +137,17 @@ builds:
 upx:
   - ids: [fscan, fscan-nolocal, fscan-web]
     enabled: true
-    goos: [windows, linux, freebsd]
-    goarch: [amd64, "386", arm, arm64, mips, mipsle]
-    compress: best
+    goos: [windows, linux]
+    goarch: [amd64, "386", arm64]
+    compress: "6"
     brute: false
     lzma: false
 
 archives:
   # 标准版归档
   - id: fscan
-    builds: [fscan]
-    format: binary
+    ids: [fscan]
+    formats: [binary]
     allow_different_binary_count: true
     name_template: >-
       fscan_{{ .Version }}_
@@ -158,8 +160,8 @@ archives:
 
   # 无本地插件版归档
   - id: fscan-nolocal
-    builds: [fscan-nolocal]
-    format: binary
+    ids: [fscan-nolocal]
+    formats: [binary]
     allow_different_binary_count: true
     name_template: >-
       fscan-nolocal_{{ .Version }}_
@@ -172,8 +174,8 @@ archives:
 
   # WebUI版归档
   - id: fscan-web
-    builds: [fscan-web]
-    format: binary
+    ids: [fscan-web]
+    formats: [binary]
     allow_different_binary_count: true
     name_template: >-
       fscan-web_{{ .Version }}_
@@ -238,7 +240,7 @@ release:
     **完整更新日志**: https://github.com/{{ .Env.GITHUB_OWNER }}/{{ .Env.GITHUB_REPO }}/compare/{{ .PreviousTag }}...{{ .Tag }}
 
 snapshot:
-  name_template: "{{ incpatch .Version }}-dev-{{ .ShortCommit }}"
+  version_template: "{{ incpatch .Version }}-dev-{{ .ShortCommit }}"
 
 metadata:
   mod_timestamp: "{{ .CommitTimestamp }}"

.github/release-notes/v2.2.0-rc.1.md

@@ -0,0 +1,117 @@
+# fscan v2.2.0-rc.1
+
+> ⚠️ **这是预发布版本 (Release Candidate)**，可能存在未发现的问题。
+> 如果你在使用中遇到任何异常，请积极通过 [Issue](https://github.com/shadow1ng/fscan/issues/new/choose) 反馈，帮助我们尽快稳定正式版。
+> 生产环境建议继续使用 [v2.1.3](https://github.com/shadow1ng/fscan/releases/tag/v2.1.3)。
+
+---
+
+## 与 v2.2.0-rc 的变更
+
+本版本基于大量实机测试反馈，**修复 30+ 个问题，新增自适应扫描系统**。183 个文件变更。
+
+---
+
+### 🚀 新功能
+
+#### 自适应并发调度
+
+扫描前自动探测网络环境（RTT、丢包率、fd limit），基于探测数据推导关键参数，替代硬编码默认值：
+
+- **Timeout**: `median_RTT + 4σ`（覆盖 99.9% 正常连接），下限 1s，上限 10s
+- **ModuleThreadNum**: `ThreadNum / 30`，下限 5，上限 50
+- **MaxRetries**: 基于丢包率推导，保证全失败概率 <1%
+- **ICMPRate / PocNum**: 跟随环境和并发自动调整
+
+线程池升级为 **AIMD + 慢启动**：慢启动阶段 500ms 翻倍，稳态 AIMD（健康 +5%，拥塞 ×0.5），双信号（资源耗尽率 + RTT 趋势）驱动。
+
+#### 协议级超时下限（ModuleTimeout）
+
+新增 `Config.ModuleTimeout()` 方法，保证插件级交互超时不低于 3s。自适应系统将端口扫描超时压到 1s 时，SSH 握手、SNMP 探测、数据库认证等多轮交互协议不再受影响。全部 44 个服务插件已迁移。
+
+#### 限流错误分类（ErrorTypeThrottle）
+
+新增 `ErrorTypeThrottle` 错误类型，区分服务端限流（SSH MaxStartups 等）和真正的网络不可达。限流错误不计入连续失败计数，触发 500ms 退避后继续，避免误判目标不可达而提前放弃。
+
+#### Web 版独立入口
+
+- 拆分 `main.go` 为 `main_cli.go` 和 `main_web.go`
+- Web 版结果存储从内存替换为 SQLite 持久化（纯 Go 零 CGO）
+
+---
+
+### 🐛 Bug 修复
+
+#### 插件调度（#586 #587 #588）
+
+- **非标准端口服务无法匹配插件** — SSH 在 8881 端口，端口匹配失败导致插件不执行。新增服务名称缓存 + 指纹驱动回退匹配 (#588)
+- **移除误导性的"无可用插件"日志** — 预检基于静态端口匹配，不代表实际不执行 (#588)
+- **默认扫描 POC 结果缺失** — `executeRules` 返回空 `vulName` 导致检测结果被丢弃 (#586)
+- **批量扫描（-hf）POC 缺失** — 并发压力下 HTTP 请求瞬时失败未重试，跳过指纹识别和 POC 触发。加入指数退避重试 (#587)
+- **UDP 插件在 `-p` 指定端口时被跳过** — 现在按用户指定端口过滤并正确调度
+- **`-full` 模式下 Web 插件跳过 `IsMarkedWebService` 检查**
+- **不确定服务补做 HTTP 回退探测**，覆盖自定义 HTTP 框架漏网场景
+
+#### UDP 插件
+
+- **UDP 插件阻塞导致扫描无法结束** — `conn.Read()` 在目标不响应时无限阻塞。所有 UDP 插件（SNMP/BACnet/DNS/IPMI/TFTP）统一使用 context timeout + conn.Close 双保险
+- **SNMP community 爆破混入通用密码字典** — 57 个通用密码串行探测导致 10 分钟阻塞，精简为 8 个专用 community
+
+#### SSH
+
+- **SSH goroutine 泄漏** — `ssh.NewClientConn` 不接受 context，context 取消后底层 TCP 连接未关闭，大规模扫描时泄漏数万 goroutine
+- **SSH 握手无 TCP deadline 兜底** — 在 `NewClientConn` 前设置 deadline，握手成功后清除
+- **SSH 爆破并发过高** — 从 30 降至 3，避免触发 OpenSSH MaxStartups 限流
+
+#### Redis
+
+- **Redis exploit 无超时保护** — exploit 阶段移除了全部 deadline，改为 30s 超时
+- **Redis readReply 吞没非超时错误** — 现在仅对 timeout 类型错误做容忍
+
+#### POC 引擎
+
+- **DetectPocFormat 误判含 transport 的 fscan POC 为 xray 格式** — 修复后 388 个 POC 全部正确加载（之前 8 个失败）
+- **CEL clustersend 结果判断错误** — 从字符串比较改为类型断言
+- **CEL wait() 函数 nil Reverse 指针 panic**
+- **reverseCheck 无超时** — 加 10s 超时防止 ceye API 阻塞
+- **正则编译结果未缓存** — `doSearch`/`bmatches` 缓存到 `sync.Map`
+
+#### 参数与输出
+
+- **`-gt` 全局超时参数是死代码** — 现在真正生效，超时后取消所有扫描任务
+- **`-nopoc` 禁用 POC 时仍输出错误日志** — 已修复
+- **`-debug` 日志文件写入失败** — `applyLogLevel` 重建 Logger 时丢失 `DebugLogFile` 配置
+- **`-hash` 不支持 LM:NT 格式** — 现在支持 `aad3b435b51404ee:31d6cfe0d16ae931...` 标准格式
+- **`-pwd` 不支持逗号分隔多个密码** — 现在 `-pwd "123,456,root"` 正确拆分
+- **`-nobr` 跳过了 Redis 未授权检测** — 未授权是服务探测不是爆破，不受 `-nobr` 影响
+- **非终端输出时 ANSI 控制码覆盖扫描结果** — 管道/重定向时自动禁用进度条和颜色
+- **静默模式 NDJSON banner 过长** — Redis INFO ~5KB 截断至 200 字符
+- **CSV 漏洞 Type 列为空** — 补全 `type` 字段
+- **SNMP 探测成功但终端无输出** — 补充 `session.LogVuln` 调用
+
+#### 其他
+
+- **service_probe 连接丢失后静默成功** — `Write`/`Read` 在 `Conn=nil` 时返回明确错误
+- **MongoDB readMongoMsg 未设置读超时**
+- **TXTWriter.Close Sync 失败后未关闭文件**
+- **MySQL 3306 服务名误识别为 genetec-5400** — nmap 指纹库误匹配，通过 banner 特征校正
+- **gmtls stdout 竞态** — 移除 `os.Stdout` 非同步重定向
+
+---
+
+### 🏗️ 架构优化
+
+- **统一服务缓存** — `webServiceCache` 扩展为通用 `serviceCache`，下沉到 per-session State，消除多实例缓存串台
+- **CEL 表达式编译缓存** — 同一 POC 的所有规则共享编译后的 Program
+- **POC 全局状态消除** — `allPocs` 全局变量改为 `pocStore` 按 PocPath 缓存，并发场景不再互相覆盖
+- **进度条竞态修复** — `isActive` 改为 `atomic.Bool`
+- **Lint 全量修复** — cassandra/ipmi/mongodb/webscan 的 ineffassign、unused、errcheck
+
+---
+
+## 反馈与贡献
+
+- 🐛 发现 Bug → [提交 Bug 报告](https://github.com/shadow1ng/fscan/issues/new?template=bug_report.yml)
+- 🎯 结果不准 → [提交误报/漏报](https://github.com/shadow1ng/fscan/issues/new?template=false_positive.yml)
+- ✨ 功能建议 → [提交功能请求](https://github.com/shadow1ng/fscan/issues/new?template=feature_request.yml)
+- 💬 使用疑问 → [Discussions](https://github.com/shadow1ng/fscan/discussions)

.github/release-notes/v2.2.0.md

@@ -0,0 +1,129 @@
+# fscan v2.2.0
+
+v2.2.0 是 v2.2 系列首个正式版，基于 v2.1.3 之后的 RC 测试和 Issue 反馈整理发布。
+
+本版本重点提升大规模扫描稳定性、POC 扫描可靠性、非标准端口服务识别、插件隔离和嵌入式 SDK 能力。
+
+---
+
+## 重点变化
+
+### 嵌入式 Scanner SDK
+
+新增 `pkg/fscan`，fscan 从纯 CLI 工具扩展为可嵌入的 Go 扫描引擎：
+
+- 支持在 Go 程序内直接调用扫描能力
+- Scanner 实例拥有独立 `config` / `state` / `session`
+- 全局状态迁移到 session，改善多实例并发隔离
+- 补充 SDK 结果转换、配置校验和并发扫描测试
+
+### 大规模扫描稳定性
+
+- 新增流式 Host Iterator，大 CIDR 不再一次性展开到内存
+- 移除 MaxHosts 硬限制，大网段不再被静默截断
+- 新增自适应并发调度，基于 RTT、丢包率、fd limit 自动推导扫描参数
+- 线程池升级为 AIMD + 慢启动，遇到资源耗尽时自动降速
+- `-gt` 全局超时正式生效，超时后会取消扫描任务
+- 新增 `-nsp`，可禁用网段预筛
+
+### 服务识别与插件调度
+
+- 修复非标准端口服务无法匹配插件的问题
+- 新增服务缓存和指纹驱动插件匹配
+- `-full` 模式下 Web 插件可覆盖所有开放端口
+- 不确定服务增加 HTTP 回退探测
+- 移除误导性的“无可用插件”日志
+- 用户指定 `-p` 时 UDP 插件按端口交集正确调度
+
+### Web / POC 扫描
+
+- 修复默认扫描 POC 结果缺失
+- 修复 `-hf` 批量扫描时 POC 缺失
+- 修复 HTTPS 端口误用 HTTP 扫描 POC
+- 修复 POC 结果文件只显示 `vulnerable` 不显示漏洞名称
+- POC 加载按 `pocpath` 隔离缓存，多 session 不再互相覆盖
+- 修复 CEL、reverseCheck、正则缓存等稳定性问题
+- `-nopoc` 禁用 POC 时不再输出误导性错误日志
+
+### 新增协议插件
+
+新增多种原生协议插件，覆盖邮件、Java 调试、文件共享、带外管理、UDP 和工控场景：
+
+| 插件 | 用途 |
+|------|------|
+| IMAP / POP3 | 邮件服务器检测 |
+| JDWP | Java Debug 端口检测 |
+| NFS / RMI | 文件共享 / Java 远程调用 |
+| IPMI | 服务器带外管理 |
+| SNMP / DNS / BACnet / Modbus | 网络设备、DNS、工控协议检测 |
+
+### Web 版
+
+- 拆分 CLI / Web 入口
+- Web 版结果存储改为 SQLite 持久化
+- Web API 版本号改为动态读取
+
+---
+
+## Bug 修复摘要
+
+- 修复 #586 默认扫描 POC 结果缺失
+- 修复 #587 `-hf` 批量扫描 POC 缺失
+- 修复 #588 非标准端口服务插件匹配问题
+- 修复 #590 Telnet Cisco MOTD 横幅误判 shell prompt
+- 修复 #591 HTTPS POC 协议错误与结果名称缺失
+- 修复 #592 service probe 空指针 panic
+- 修复 #593 `-ehf` 排除主机未生效，支持 IP / CIDR / range
+- 修复 UDP 插件阻塞导致扫描无法结束
+- 修复 SSH goroutine 泄漏和握手 deadline 问题
+- 修复 Redis exploit 超时和非超时错误处理
+- 修复 MongoDB SCRAM、Cassandra、Oracle 等协议问题
+- 修复 SOCKS5 代理认证、LM:NT hash、逗号分隔密码等参数问题
+- 修复非终端输出 ANSI 控制码覆盖结果
+- 修复 CSV / NDJSON / TXT 输出若干字段问题
+- 修复 ARM 32 位原子计数器对齐问题
+
+---
+
+## 升级注意
+
+- WebUI 仍建议视为实验性能力
+- 本地后渗透插件仅用于授权环境
+- v2.2.0 改动较大，建议从 v2.1.3 升级的用户先在测试环境验证扫描参数
+- 如依赖旧版本输出格式，请重点检查 POC、SERVICE、VULN 结果字段
+
+---
+
+## 版本说明
+
+| 版本 | 说明 |
+|------|------|
+| **fscan** | 标准版，包含全部插件（推荐） |
+| **fscan-nolocal** | 精简版，不含本地模块（体积更小） |
+| **fscan-web** | WebUI 版，带 Web 管理界面（主流平台） |
+
+## 平台支持
+
+| 平台 | 架构 |
+|------|------|
+| Linux | x64, x32, arm64, armv5/6/7, mips, mips64, mipsle |
+| Windows | x64, x32 |
+| macOS | x64, arm64 |
+| FreeBSD | x64, x32, arm64, armv5/6/7 |
+| Solaris | x64 |
+
+---
+
+## 校验
+
+本版本已通过：
+
+- `go test ./...`
+- 近期 Issue 回归验证
+- 本地 HTTP / HTTPS POC 扫描验证
+- `-hf` 批量 POC 扫描验证
+- `-ehf` IP / CIDR 排除验证
+
+完整变更记录见：
+
+https://github.com/shadow1ng/fscan/compare/v2.1.3...v2.2.0

.github/release-notes/v2.2.1.md

@@ -0,0 +1,64 @@
+# fscan v2.2.1
+
+v2.2.1 是 v2.2 系列的稳定性修复版本，重点解决大规模扫描提前结束、开放端口漏扫、服务识别误差和协议插件异常，并扩充常见内网产品的 POC 覆盖。
+
+---
+
+## 重点变化
+
+### 扫描稳定性
+
+- 默认不再启用全局扫描超时，避免大网段或弱网络环境下扫描被整体提前终止
+- `-gt` 仍可用于显式设置全局超时；嵌入式 SDK 同样支持按需配置
+- 修复高并发场景下自适应超时过低导致开放端口漏扫的问题
+- 扫描异常退出时正常执行结果清理和落盘，避免主结果为空及 `.realtime.tmp` 残留
+
+### 服务识别与协议插件
+
+- 修复 `-nobr` 下 VNC 仍继续尝试密码的问题
+- Telnet 未授权结果增加真实命令执行验证，降低提示符误报
+- SSH 服务识别支持 RFC 4253 允许的 identification 前提示行
+- 修复 RDP Fast-Path 数据早于监听器初始化时触发的 nil pointer panic
+- 通用 SSL/TLS 指纹不再直接判定为 Web 服务，减少 MQTT TLS 等非 HTTP 服务的握手报错
+
+### POC 覆盖
+
+新增 100 个经过整理的内网常见产品 POC，覆盖：
+
+- 泛微、致远、蓝凌、万户、通达、用友、金蝶、金蝶云星空
+- H3C、海康威视、锐捷、深信服、契约锁、帆软
+- Nacos、Kubernetes、GitLab、Jenkins、Hadoop、Spark、Solr、Elastic Stack 等
+
+同时补充第三方来源说明，并为新增 POC 增加加载测试。
+
+---
+
+## 已解决 Issue
+
+- #596 Telnet 未授权误报
+- #598 高并发下开放端口漏扫
+- #599 `-nobr` 未阻止 VNC 密码尝试
+- #600 TLS 服务扫描报错、结果文件为空及临时文件残留
+- #601 SSH 服务端口无法识别
+- #603 RDP Fast-Path nil pointer panic
+
+---
+
+## 升级说明
+
+- 从 v2.2.0 可直接升级
+- 如需限制整个扫描任务的最长运行时间，请显式传入 `-gt <秒数>`
+- POC 仅用于已获授权的安全测试环境
+
+## 校验
+
+本版本已通过：
+
+- `go test ./...`
+- GitHub Actions 测试构建
+- GoReleaser 全平台 snapshot 构建
+- VNC、SSH、RDP、Telnet 和 Web 服务识别回归测试
+
+完整变更记录：
+
+https://github.com/shadow1ng/fscan/compare/v2.2.0...v2.2.1

.github/workflows/release.yml

@@ -2,6 +2,8 @@ name: 发布
 
 on:
   push:
+    branches:
+      - main
     tags:
       - 'v*'
   workflow_dispatch:
@@ -22,7 +24,60 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
+  auto-tag:
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
+
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: 读取版本号
+        id: version
+        shell: bash
+        run: |
+          VERSION=$(sed -n 's/^[[:space:]]*version = "\(.*\)"/\1/p' common/globals.go)
+          if [ -z "$VERSION" ]; then
+            echo "❌ 无法从 common/globals.go 读取版本号"
+            exit 1
+          fi
+          TAG="v${VERSION}"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "准备发布 ${TAG}"
+
+      - name: 创建发布标签
+        shell: bash
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/tmp/tag-ref 2>/dev/null; then
+            git fetch --force origin "refs/tags/${TAG}:refs/tags/${TAG}"
+            TAG_COMMIT=$(git rev-list -n 1 "${TAG}")
+            HEAD_COMMIT=$(git rev-parse HEAD)
+            if [ "$TAG_COMMIT" = "$HEAD_COMMIT" ]; then
+              echo "✅ ${TAG} 已指向当前提交，跳过创建"
+              exit 0
+            fi
+            echo "❌ ${TAG} 已存在，但不指向当前提交"
+            echo "tag:  ${TAG_COMMIT}"
+            echo "head: ${HEAD_COMMIT}"
+            exit 1
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${TAG}" -m "Release ${TAG}"
+          git push origin "${TAG}"
+
   release:
+    needs: [auto-tag]
+    if: ${{ always() && (startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.auto-tag.result == 'success')) }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
 
@@ -32,10 +87,32 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: 解析发布标签
+        id: release_tag
+        shell: bash
+        env:
+          AUTO_TAG: ${{ needs.auto-tag.outputs.tag }}
+          SNAPSHOT: ${{ inputs.snapshot }}
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            TAG="${GITHUB_REF_NAME}"
+          elif [ "${GITHUB_EVENT_NAME}" = "push" ] && [ "${GITHUB_REF}" = "refs/heads/main" ]; then
+            TAG="${AUTO_TAG}"
+            git fetch --force origin "refs/tags/${TAG}:refs/tags/${TAG}"
+          elif [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ] && [ "${SNAPSHOT}" = "true" ]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            echo "❌ 非 snapshot 手动发布必须从 tag 触发"
+            exit 1
+          fi
+
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "RELEASE_TAG=${TAG}" >> "$GITHUB_ENV"
+
       - name: 准备 Release Notes
         if: ${{ !inputs.snapshot }}
         run: |
-          TAG="${GITHUB_REF_NAME}"
+          TAG="${RELEASE_TAG}"
           NOTES_FILE=".github/release-notes/${TAG}.md"
 
           if [ -f "$NOTES_FILE" ]; then
@@ -52,7 +129,7 @@ jobs:
         uses: ./.github/actions/build-release
         with:
           mode: ${{ inputs.snapshot && 'snapshot' || 'release' }}
-          go-version: '1.20'
+          go-version: '1.25'
           retention-days: '90'
           release-args: ${{ inputs.draft && '--draft' || '' }}
 
@@ -61,7 +138,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          TAG="${GITHUB_REF_NAME}"
+          TAG="${RELEASE_TAG}"
           NOTES_FILE="${RELEASE_NOTES_FILE}"
 
           if [ -s "$NOTES_FILE" ]; then

.github/workflows/test-build.yml

@@ -54,7 +54,7 @@ jobs:
       - name: 设置 Go 环境
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: 运行 golangci-lint
@@ -114,7 +114,7 @@ jobs:
       - name: 设置 Go 环境
         uses: actions/setup-go@v5
         with:
-          go-version: '1.20'
+          go-version: '1.25'
           cache: true
 
       - name: 下载依赖
@@ -181,7 +181,7 @@ jobs:
       - name: 设置 Go 环境
         uses: actions/setup-go@v5
         with:
-          go-version: '1.20'
+          go-version: '1.25'
           cache: true
 
       - name: 构建验证

.gitignore

@@ -58,6 +58,9 @@ bin/
 *.dll
 *.so
 *.dylib
+/fscan_cli
+/fscan_web
+/embed-agent
 
 # Web UI build / Web前端构建
 web-ui/node_modules/

Makefile

@@ -64,7 +64,7 @@ build-web: build-ui
 	@echo "$(BLUE)构建Web版本...$(NC)"
 	$(GO) build -tags web -ldflags="-s -w" -trimpath -o $(BINARY_NAME)-web .
 	@echo "$(GREEN)✓ 构建完成: $(BINARY_NAME)-web$(NC)"
-	@echo "$(BLUE)提示: 运行 ./$(BINARY_NAME)-web -web 启动Web界面$(NC)"
+	@echo "$(BLUE)提示: 运行 ./$(BINARY_NAME)-web 启动Web界面（默认端口 10240）$(NC)"
 
 ## build-ui: 构建前端（需要Node.js和npm）
 build-ui:

README.md

@@ -4,7 +4,7 @@
 
 内网综合扫描工具，一键自动化漏扫。
 
-**版本**: 2.2.0-rc
+**版本**: 2.2.1
 
 ## 功能特性
 
@@ -186,10 +186,10 @@
 
 ```bash
 # 标准编译
-go build -ldflags="-s -w" -trimpath -o fscan main.go
+go build -ldflags="-s -w" -trimpath -o fscan .
 
 # 带Web管理界面
-go build -tags web -ldflags="-s -w" -trimpath -o fscan main.go
+go build -tags web -ldflags="-s -w" -trimpath -o fscan-web .
 ```
 
 ## 安装

README_EN.md

@@ -4,7 +4,7 @@
 
 Comprehensive intranet scanning tool for automated vulnerability assessment.
 
-**Version**: 2.2.0-rc
+**Version**: 2.2.1
 
 ## Features
 
@@ -185,10 +185,10 @@ Comprehensive intranet scanning tool for automated vulnerability assessment.
 
 ```bash
 # Standard build
-go build -ldflags="-s -w" -trimpath -o fscan main.go
+go build -ldflags="-s -w" -trimpath -o fscan .
 
 # With Web UI
-go build -tags web -ldflags="-s -w" -trimpath -o fscan main.go
+go build -tags web -ldflags="-s -w" -trimpath -o fscan-web .
 ```
 
 ## Install

SKILL.md

@@ -52,7 +52,7 @@ fscan -h 192.168.1.0/24 -silent | jq 'select(.type=="VULN")'
 | `-t` | 端口扫描线程数 | `600` |
 | `-mt` | 模块线程数 | `20` |
 | `-time` | 连接超时（秒） | `3` |
-| `-gt` | 全局超时（秒） | `180` |
+| `-gt` | 全局超时（秒，0 表示不限制） | `0` |
 | `-np` | 跳过存活检测 | `false` |
 | `-ntp` | 禁用 TCP 补充探测 | `false` |
 | `-ao` | 仅存活检测 | `false` |

common/config_builder.go

@@ -4,6 +4,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net"
+	"net/url"
 	"strconv"
 	"strings"
 
@@ -128,9 +129,14 @@ func parseUsernames(fv *FlagVars) ([]string, error) {
 func parsePasswords(fv *FlagVars) ([]string, error) {
 	var passwords []string
 
-	// 命令行密码
+	// 命令行密码（支持逗号分隔多个值，保留空格作为密码的一部分）
 	if fv.Password != "" {
-		passwords = append(passwords, fv.Password)
+		for _, p := range strings.Split(fv.Password, ",") {
+			p = strings.TrimSpace(p)
+			if p != "" {
+				passwords = append(passwords, p)
+			}
+		}
 	}
 
 	// 从文件读取
@@ -171,6 +177,7 @@ func parseUserPassPairs(fv *FlagVars) ([]config.CredentialPair, error) {
 	// 如果命令行同时指定了单个用户名和单个密码（不是逗号分隔的多个）
 	if fv.Username != "" && fv.Password != "" &&
 		!strings.Contains(fv.Username, ",") && !strings.Contains(fv.Password, ",") &&
+		fv.AddUsers == "" && fv.AddPasswords == "" &&
 		fv.UsersFile == "" && fv.PasswordsFile == "" && fv.UserPassFile == "" {
 		pairs = append(pairs, config.CredentialPair{
 			Username: strings.TrimSpace(fv.Username),
@@ -195,11 +202,15 @@ func parseHashes(fv *FlagVars) ([]string, [][]byte, error) {
 	var hashValues []string
 	var hashBytes [][]byte
 
-	// 命令行哈希
+	// 命令行哈希（支持纯 NTLM 32字符 或 LM:NT 格式）
 	if fv.HashValue != "" {
 		hash := strings.TrimSpace(fv.HashValue)
+		// LM:NT 格式取 NT hash 部分
+		if parts := strings.SplitN(hash, ":", 2); len(parts) == 2 && len(parts[1]) == 32 {
+			hash = parts[1]
+		}
 		if len(hash) != 32 {
-			return nil, nil, fmt.Errorf("invalid hash length: %s", hash)
+			return nil, nil, fmt.Errorf("invalid hash length: %s", fv.HashValue)
 		}
 		hashByte, err := hex.DecodeString(hash)
 		if err != nil {
@@ -294,9 +305,42 @@ func normalizeURL(rawURL string) string {
 	}
 	lowerURL := strings.ToLower(rawURL)
 	if !strings.HasPrefix(lowerURL, "http://") && !strings.HasPrefix(lowerURL, "https://") {
-		return "http://" + rawURL
+		return "http://" + normalizeSchemelessURLTarget(rawURL)
 	}
-	return rawURL
+	parsed, err := url.Parse(rawURL)
+	if err != nil || parsed.Host == "" {
+		return rawURL
+	}
+	normalizedHost := normalizeURLHost(parsed.Host)
+	if normalizedHost == parsed.Host {
+		return rawURL
+	}
+	parsed.Host = normalizedHost
+	normalized := parsed.String()
+	if schemeEnd := strings.Index(rawURL, "://"); schemeEnd >= 0 {
+		return rawURL[:schemeEnd] + normalized[len(parsed.Scheme):]
+	}
+	return normalized
+}
+
+func normalizeSchemelessURLTarget(rawURL string) string {
+	authority := rawURL
+	suffix := ""
+	if idx := strings.IndexAny(rawURL, "/?#"); idx >= 0 {
+		authority = rawURL[:idx]
+		suffix = rawURL[idx:]
+	}
+	return normalizeURLHost(authority) + suffix
+}
+
+func normalizeURLHost(host string) string {
+	if strings.HasPrefix(host, "[") {
+		return host
+	}
+	if ip := net.ParseIP(host); ip != nil && strings.Contains(host, ":") {
+		return "[" + host + "]"
+	}
+	return host
 }
 
 // =============================================================================

common/config_builder_test.go

@@ -3,11 +3,14 @@ package common
 import (
 	"reflect"
 	"testing"
+	"time"
+
+	fscanconfig "github.com/shadow1ng/fscan/common/config"
 )
 
 func TestParsePasswordsKeepsPrimaryPasswordLiteral(t *testing.T) {
 	fv := &FlagVars{
-		Password:     "root admin",
+		Password:     "root admin,pass0",
 		AddPasswords: "pass1 pass2,pass3\tpass4",
 	}
 
@@ -15,7 +18,8 @@ func TestParsePasswordsKeepsPrimaryPasswordLiteral(t *testing.T) {
 	if err != nil {
 		t.Fatalf("parsePasswords error = %v", err)
 	}
-	want := []string{"root admin", "pass1", "pass2", "pass3", "pass4"}
+	// -pwd 逗号分隔，空格保留；-pwda 逗号/空格/tab 分隔
+	want := []string{"root admin", "pass0", "pass1", "pass2", "pass3", "pass4"}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("parsePasswords() = %#v, want %#v", got, want)
 	}
@@ -49,6 +53,100 @@ func TestBuildConfigRejectsInvalidHashValue(t *testing.T) {
 	}
 }
 
+func TestBuildConfigDefaultsAreIndependentCopies(t *testing.T) {
+	cfg, _, err := BuildConfig(&FlagVars{Username: "custom-user"}, &HostInfo{})
+	if err != nil {
+		t.Fatalf("BuildConfig error = %v", err)
+	}
+
+	defaultSSHUsers := fscanconfig.DefaultUserDict["ssh"]
+	if len(defaultSSHUsers) == 1 && defaultSSHUsers[0] == "custom-user" {
+		t.Fatal("BuildConfig mutated DefaultUserDict")
+	}
+
+	cfg.Credentials.Userdict["ssh"][0] = "mutated-user"
+	if fscanconfig.DefaultUserDict["ssh"][0] == "mutated-user" {
+		t.Fatal("Config userdict shares backing storage with DefaultUserDict")
+	}
+
+	cfg.Credentials.Passwords[0] = "mutated-password"
+	if fscanconfig.DefaultPasswords[0] == "mutated-password" {
+		t.Fatal("Config passwords share backing storage with DefaultPasswords")
+	}
+
+	port := 80
+	cfg.PortMap[port][0] = "mutated-probe"
+	if fscanconfig.DefaultPortMap[port][0] == "mutated-probe" {
+		t.Fatal("Config port map shares backing storage with DefaultPortMap")
+	}
+
+	cfg.DefaultMap[0] = "mutated-default-probe"
+	if fscanconfig.DefaultProbeMap[0] == "mutated-default-probe" {
+		t.Fatal("Config default map shares backing storage with DefaultProbeMap")
+	}
+}
+
+func TestParseUserPassPairsKeepsAdditionalCredentialFlags(t *testing.T) {
+	tests := []struct {
+		name string
+		fv   *FlagVars
+	}{
+		{
+			name: "additional passwords",
+			fv: &FlagVars{
+				Username:     "root",
+				Password:     "primary",
+				AddPasswords: "extra",
+			},
+		},
+		{
+			name: "additional users",
+			fv: &FlagVars{
+				Username: "root",
+				Password: "primary",
+				AddUsers: "admin",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pairs, err := parseUserPassPairs(tt.fv)
+			if err != nil {
+				t.Fatalf("parseUserPassPairs error = %v", err)
+			}
+			if len(pairs) != 0 {
+				t.Fatalf("parseUserPassPairs returned exact pairs %#v; additional credential flags would be ignored", pairs)
+			}
+		})
+	}
+}
+
+func TestNewConfigDefaultsAreIndependentCopies(t *testing.T) {
+	cfg := NewConfig()
+
+	cfg.Credentials.Userdict["ssh"][0] = "mutated-user"
+	if fscanconfig.DefaultUserDict["ssh"][0] == "mutated-user" {
+		t.Fatal("NewConfig userdict shares backing storage with DefaultUserDict")
+	}
+
+	cfg.Credentials.Passwords[0] = "mutated-password"
+	if fscanconfig.DefaultPasswords[0] == "mutated-password" {
+		t.Fatal("NewConfig passwords share backing storage with DefaultPasswords")
+	}
+
+	port := 80
+	cfg.PortMap[port][0] = "mutated-probe"
+	if fscanconfig.DefaultPortMap[port][0] == "mutated-probe" {
+		t.Fatal("NewConfig port map shares backing storage with DefaultPortMap")
+	}
+
+	cfg.DefaultMap[0] = "mutated-default-probe"
+	if fscanconfig.DefaultProbeMap[0] == "mutated-default-probe" {
+		t.Fatal("NewConfig default map shares backing storage with DefaultProbeMap")
+	}
+}
+
 func TestParseTargetsHostPortDoesNotLeaveSyntheticHost(t *testing.T) {
 	fv := &FlagVars{Ports: "22"}
 	info := &HostInfo{Host: "127.0.0.1:8080"}
@@ -73,3 +171,280 @@ func TestNormalizeURLKeepsUppercaseScheme(t *testing.T) {
 		t.Fatalf("normalizeURL() = %q", got)
 	}
 }
+
+func TestNormalizeURLBracketsIPv6Literals(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{name: "bare ipv6 without scheme", in: "2001:db8::1", want: "http://[2001:db8::1]"},
+		{name: "bracketed ipv6 without scheme", in: "[2001:db8::1]", want: "http://[2001:db8::1]"},
+		{name: "bare ipv6 with scheme", in: "http://2001:db8::1", want: "http://[2001:db8::1]"},
+		{name: "bare ipv6 path without scheme", in: "2001:db8::1/admin", want: "http://[2001:db8::1]/admin"},
+		{name: "bare ipv6 query without scheme", in: "2001:db8::1?debug=1", want: "http://[2001:db8::1]?debug=1"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := normalizeURL(tt.in); got != tt.want {
+				t.Fatalf("normalizeURL(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestModuleTimeout 测试模块超时计算
+func TestModuleTimeout(t *testing.T) {
+	tests := []struct {
+		name    string
+		timeout time.Duration
+		want    time.Duration
+	}{
+		{"超时大于下限", 10 * time.Second, 10 * time.Second},
+		{"超时等于下限", 3 * time.Second, 3 * time.Second},
+		{"超时小于下限", 1 * time.Second, 3 * time.Second},
+		{"零超时", 0, 3 * time.Second},
+		{"负超时", -1 * time.Second, 3 * time.Second},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := NewConfig()
+			cfg.Timeout = tt.timeout
+			got := cfg.ModuleTimeout()
+			if got != tt.want {
+				t.Errorf("ModuleTimeout() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestParseUserPassPairsExactMatch 测试精确单用户单密码路径
+func TestParseUserPassPairsExactMatch(t *testing.T) {
+	fv := &FlagVars{
+		Username: "admin",
+		Password: "secret",
+	}
+	pairs, err := parseUserPassPairs(fv)
+	if err != nil {
+		t.Fatalf("parseUserPassPairs error = %v", err)
+	}
+	if len(pairs) != 1 {
+		t.Fatalf("期望 1 个 pair, 实际 %d", len(pairs))
+	}
+	if pairs[0].Username != "admin" || pairs[0].Password != "secret" {
+		t.Errorf("pair = %+v, want {admin secret}", pairs[0])
+	}
+}
+
+// TestParseUserPassPairsMultiUserSkips 测试多用户时不生成精确 pair
+func TestParseUserPassPairsMultiUserSkips(t *testing.T) {
+	fv := &FlagVars{
+		Username: "admin,root",
+		Password: "pass",
+	}
+	pairs, err := parseUserPassPairs(fv)
+	if err != nil {
+		t.Fatalf("parseUserPassPairs error = %v", err)
+	}
+	if len(pairs) != 0 {
+		t.Fatalf("多用户场景不应生成精确 pair, 实际 %d 个", len(pairs))
+	}
+}
+
+// TestParseURLsEmpty 测试空输入返回空列表
+func TestParseURLsEmpty(t *testing.T) {
+	fv := &FlagVars{}
+	urls, err := parseURLs(fv)
+	if err != nil {
+		t.Fatalf("parseURLs error = %v", err)
+	}
+	if len(urls) != 0 {
+		t.Fatalf("空输入应返回空 url 列表, 实际 %v", urls)
+	}
+}
+
+// TestParseURLsCommaSeparated 测试逗号分隔多 URL
+func TestParseURLsCommaSeparated(t *testing.T) {
+	fv := &FlagVars{
+		TargetURL: "http://a.com,http://b.com,http://a.com", // 含重复
+	}
+	urls, err := parseURLs(fv)
+	if err != nil {
+		t.Fatalf("parseURLs error = %v", err)
+	}
+	if len(urls) != 2 {
+		t.Fatalf("去重后应有 2 个 url, 实际 %d: %v", len(urls), urls)
+	}
+}
+
+// TestParseURLsMissingFile 测试缺失文件返回错误
+func TestParseURLsMissingFile(t *testing.T) {
+	fv := &FlagVars{URLsFile: "nonexistent-urls.txt"}
+	_, err := parseURLs(fv)
+	if err == nil {
+		t.Fatal("缺失文件应返回错误")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// parseHashes
+// ---------------------------------------------------------------------------
+
+// TestParseHashesEmpty 空输入返回空结果
+func TestParseHashesEmpty(t *testing.T) {
+	fv := &FlagVars{}
+	vals, bytes, err := parseHashes(fv)
+	if err != nil {
+		t.Fatalf("parseHashes error = %v", err)
+	}
+	if len(vals) != 0 || len(bytes) != 0 {
+		t.Fatalf("空输入应返回空结果, vals=%v bytes=%v", vals, bytes)
+	}
+}
+
+// TestParseHashesValidNTLM 纯 32 字符 hex hash
+func TestParseHashesValidNTLM(t *testing.T) {
+	hash := "aabbccddeeff00112233445566778899"
+	fv := &FlagVars{HashValue: hash}
+	vals, hashBytes, err := parseHashes(fv)
+	if err != nil {
+		t.Fatalf("parseHashes error = %v", err)
+	}
+	if len(vals) != 1 || vals[0] != hash {
+		t.Fatalf("vals = %v, want [%s]", vals, hash)
+	}
+	if len(hashBytes) != 1 || len(hashBytes[0]) != 16 {
+		t.Fatalf("hashBytes length wrong: %v", hashBytes)
+	}
+}
+
+// TestParseHashesLMNTFormat LM:NT 格式，提取 NT 部分
+func TestParseHashesLMNTFormat(t *testing.T) {
+	lm := "aad3b435b51404eeaad3b435b51404ee"
+	nt := "31d6cfe0d16ae931b73c59d7e0c089c0"
+	fv := &FlagVars{HashValue: lm + ":" + nt}
+	vals, _, err := parseHashes(fv)
+	if err != nil {
+		t.Fatalf("parseHashes error = %v", err)
+	}
+	if len(vals) != 1 || vals[0] != nt {
+		t.Fatalf("vals = %v, want [%s]", vals, nt)
+	}
+}
+
+// TestParseHashesInvalidLength hash 长度不是 32 → error
+func TestParseHashesInvalidLength(t *testing.T) {
+	fv := &FlagVars{HashValue: "tooshort"}
+	_, _, err := parseHashes(fv)
+	if err == nil {
+		t.Fatal("hash 长度不足应返回错误")
+	}
+}
+
+// TestParseHashesInvalidHex 32 字符但含非 hex 字符 → error
+func TestParseHashesInvalidHex(t *testing.T) {
+	fv := &FlagVars{HashValue: "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"}
+	_, _, err := parseHashes(fv)
+	if err == nil {
+		t.Fatal("非 hex 字符应返回错误")
+	}
+}
+
+// TestParseHashesMissingFile hash 文件不存在 → error
+func TestParseHashesMissingFile(t *testing.T) {
+	fv := &FlagVars{HashFile: "nonexistent-hashes.txt"}
+	_, _, err := parseHashes(fv)
+	if err == nil {
+		t.Fatal("缺失 hash 文件应返回错误")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// parseUsernames
+// ---------------------------------------------------------------------------
+
+// TestParseUsernamesEmpty 空输入返回空结果
+func TestParseUsernamesEmpty(t *testing.T) {
+	fv := &FlagVars{}
+	got, err := parseUsernames(fv)
+	if err != nil {
+		t.Fatalf("parseUsernames error = %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("空输入应返回空, got %v", got)
+	}
+}
+
+// TestParseUsernamesCommaSeparated 逗号分隔多用户
+func TestParseUsernamesCommaSeparated(t *testing.T) {
+	fv := &FlagVars{Username: "admin, root, admin"} // 含重复和空格
+	got, err := parseUsernames(fv)
+	if err != nil {
+		t.Fatalf("parseUsernames error = %v", err)
+	}
+	want := []string{"admin", "root"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+// TestParseUsernamesAddUsers AddUsers 追加去重
+func TestParseUsernamesAddUsers(t *testing.T) {
+	fv := &FlagVars{
+		Username: "admin",
+		AddUsers: "root,admin", // admin 重复
+	}
+	got, err := parseUsernames(fv)
+	if err != nil {
+		t.Fatalf("parseUsernames error = %v", err)
+	}
+	want := []string{"admin", "root"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+// TestParseUsernamesMissingFile 缺失用户文件 → error
+func TestParseUsernamesMissingFile(t *testing.T) {
+	fv := &FlagVars{UsersFile: "nonexistent-users.txt"}
+	_, err := parseUsernames(fv)
+	if err == nil {
+		t.Fatal("缺失用户文件应返回错误")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// cloneStringSlice
+// ---------------------------------------------------------------------------
+
+// TestCloneStringSliceNil nil 输入返回 nil
+func TestCloneStringSliceNil(t *testing.T) {
+	got := cloneStringSlice(nil)
+	if got != nil {
+		t.Fatalf("nil 输入应返回 nil, got %v", got)
+	}
+}
+
+// TestCloneStringSliceEmpty 空切片：append 无元素结果为 nil，len 为 0
+func TestCloneStringSliceEmpty(t *testing.T) {
+	got := cloneStringSlice([]string{})
+	if len(got) != 0 {
+		t.Fatalf("got len %d, want 0", len(got))
+	}
+}
+
+// TestCloneStringSliceCopiesValues 正常切片：值正确且独立
+func TestCloneStringSliceCopiesValues(t *testing.T) {
+	src := []string{"a", "b", "c"}
+	got := cloneStringSlice(src)
+	if !reflect.DeepEqual(got, src) {
+		t.Fatalf("got %v, want %v", got, src)
+	}
+	// 修改 clone 不影响原始
+	got[0] = "mutated"
+	if src[0] != "a" {
+		t.Fatal("cloneStringSlice 返回的切片与源共享底层数组")
+	}
+}

common/config_struct.go

@@ -22,19 +22,26 @@ config_struct.go - 配置结构体定义
 // Config 扫描器完整配置 - 初始化后只读，可安全共享
 type Config struct {
 	// 高频访问字段 - 平铺到顶层
-	Timeout         time.Duration // 通用超时
-	ThreadNum       int           // 主线程数
-	ModuleThreadNum int           // 模块线程数
-	DisableBrute    bool          // 禁用暴力破解
-	DisablePing     bool          // 禁用Ping检测
-	DisableTcpProbe bool          // 禁用TCP补充探测
+	Timeout                 time.Duration // 通用超时
+	TimeoutExplicit         bool          // 用户显式指定了 -time
+	ThreadNum               int           // 主线程数
+	ThreadCeiling           int           // 线程数上限（自适应池允许的最大值）
+	ThreadNumExplicit       bool          // 用户显式指定了 -t
+	ModuleThreadNum         int           // 模块线程数
+	ModuleThreadNumExplicit bool          // 用户显式指定了 -mt
+	DisableBrute            bool          // 禁用暴力破解
+	DisablePing             bool          // 禁用Ping检测
+	DisableTcpProbe         bool          // 禁用TCP补充探测
+	DisableSubnetProbe      bool          // 禁用网段预筛
 
 	// 扫描模式
-	Mode        string // 扫描模式
-	LocalMode   bool   // 本地模式
-	LocalPlugin string // 本地插件名
-	AliveOnly   bool   // 仅存活检测
-	MaxRetries  int    // 最大重试次数
+	Mode               string // 扫描模式
+	LocalMode          bool   // 本地模式
+	LocalPlugin        string // 本地插件名
+	AliveOnly          bool   // 仅存活检测
+	MaxRetries         int    // 最大重试次数
+	MaxRetriesExplicit bool   // 用户显式指定了 -retry
+	DetectedNetworkEnv int    // 探测到的网络环境（来自 core.NetworkEnv）
 
 	// 高级功能（从AdvancedConfig合并）
 	Shellcode             string           // Shellcode
@@ -55,6 +62,10 @@ type Config struct {
 	LocalExploit LocalExploitConfig
 	Target       TargetConfig // 扫描目标配置
 
+	// 全局超时
+	GlobalTimeout         time.Duration
+	GlobalTimeoutExplicit bool
+
 	// SOCKS5代理端口配置
 	Socks5ProxyPort int // SOCKS5代理端口
 }
@@ -80,14 +91,15 @@ type CredentialConfig struct {
 
 // NetworkConfig 网络相关配置
 type NetworkConfig struct {
-	HTTPProxy       string
-	Socks5Proxy     string
-	Iface           string
-	WebTimeout      time.Duration
-	MaxRedirects    int
-	PacketRateLimit int64
-	MaxPacketCount  int64
-	ICMPRate        float64
+	HTTPProxy        string
+	Socks5Proxy      string
+	Iface            string
+	WebTimeout       time.Duration
+	MaxRedirects     int
+	PacketRateLimit  int64
+	MaxPacketCount   int64
+	ICMPRate         float64
+	ICMPRateExplicit bool
 }
 
 // OutputConfig 输出相关配置
@@ -106,11 +118,12 @@ type OutputConfig struct {
 
 // POCConfig POC扫描相关配置
 type POCConfig struct {
-	PocPath  string // POC路径
-	PocName  string // 指定POC名称
-	Full     bool   // 完整POC扫描
-	Num      int    // POC并发数
-	Disabled bool   // 禁用POC扫描
+	PocPath     string // POC路径
+	PocName     string // 指定POC名称
+	Full        bool   // 完整POC扫描
+	Num         int    // POC并发数
+	NumExplicit bool   // 用户显式指定了 -num
+	Disabled    bool   // 禁用POC扫描
 }
 
 // RedisConfig Redis利用相关配置
@@ -139,16 +152,58 @@ type LocalExploitConfig struct {
 	DownloadSavePath    string // 下载保存路径
 }
 
+func cloneStringSlice(values []string) []string {
+	if values == nil {
+		return nil
+	}
+	return append([]string(nil), values...)
+}
+
+func cloneStringSliceMap(values map[string][]string) map[string][]string {
+	if values == nil {
+		return nil
+	}
+	cloned := make(map[string][]string, len(values))
+	for key, value := range values {
+		cloned[key] = cloneStringSlice(value)
+	}
+	return cloned
+}
+
+func clonePortMap(values map[int][]string) map[int][]string {
+	if values == nil {
+		return nil
+	}
+	cloned := make(map[int][]string, len(values))
+	for key, value := range values {
+		cloned[key] = cloneStringSlice(value)
+	}
+	return cloned
+}
+
+const minModuleTimeout = 3 * time.Second
+
+// ModuleTimeout 返回插件级超时（用于弱口令测试、服务交互等多轮协议）
+// 保证下限 3s，避免自适应把端口扫描超时压低后影响 SSH/SNMP 等交互型协议
+func (c *Config) ModuleTimeout() time.Duration {
+	if c.Timeout >= minModuleTimeout {
+		return c.Timeout
+	}
+	return minModuleTimeout
+}
+
 // NewConfig 创建带默认值的Config（后备用，正常流程使用BuildConfigFromFlags）
 func NewConfig() *Config {
 	return &Config{
 		// 高频字段 - 使用默认常量
 		Timeout:         time.Duration(DefaultTimeout) * time.Second,
 		ThreadNum:       DefaultThreadNum,
+		ThreadCeiling:   DefaultThreadNum,
 		ModuleThreadNum: 10,
 		DisableBrute:    false,
 		DisablePing:     false,
-		DisableTcpProbe: false,
+		DisableTcpProbe:    false,
+		DisableSubnetProbe: false,
 
 		// 扫描模式
 		Mode:       DefaultScanMode,
@@ -157,13 +212,13 @@ func NewConfig() *Config {
 		MaxRetries: 3,
 
 		// 高级功能 - 使用默认配置
-		PortMap:    config.DefaultPortMap,
-		DefaultMap: config.DefaultProbeMap,
+		PortMap:    clonePortMap(config.DefaultPortMap),
+		DefaultMap: cloneStringSlice(config.DefaultProbeMap),
 
 		// 分组配置 - 使用默认字典
 		Credentials: CredentialConfig{
-			Userdict:      config.DefaultUserDict,
-			Passwords:     config.DefaultPasswords,
+			Userdict:      cloneStringSliceMap(config.DefaultUserDict),
+			Passwords:     cloneStringSlice(config.DefaultPasswords),
 			UserPassPairs: nil,
 		},
 		Network: NetworkConfig{

common/debug/stub_test.go

@@ -0,0 +1,11 @@
+//go:build !debug
+// +build !debug
+
+package debug
+
+import "testing"
+
+func TestStubStartStop(t *testing.T) {
+	Start()
+	Stop()
+}

common/dns_cache_test.go

@@ -0,0 +1,23 @@
+package common
+
+import "testing"
+
+func TestDNSCacheResolveIPAndCacheHit(t *testing.T) {
+	cache := &dnsCache{}
+
+	first, err := cache.ResolveIP("127.0.0.1")
+	if err != nil {
+		t.Fatalf("ResolveIP loopback error = %v", err)
+	}
+	second, err := cache.ResolveIP("127.0.0.1")
+	if err != nil {
+		t.Fatalf("ResolveIP cached loopback error = %v", err)
+	}
+	if first != second {
+		t.Fatal("ResolveIP should return cached address on second lookup")
+	}
+
+	if _, err := cache.ResolveIP("bad host with spaces"); err == nil {
+		t.Fatal("ResolveIP should reject an invalid host")
+	}
+}

common/flag.go

@@ -110,9 +110,10 @@ func Flag(Info *HostInfo) error {
 	flag.IntVar(&fv.ThreadNum, "t", 600, i18n.GetText("flag_thread_num"))
 	flag.Int64Var(&fv.TimeoutSec, "time", 3, i18n.GetText("flag_timeout"))
 	flag.IntVar(&fv.ModuleThreadNum, "mt", 20, i18n.GetText("flag_module_thread_num"))
-	flag.Int64Var(&fv.GlobalTimeout, "gt", 180, i18n.GetText("flag_global_timeout"))
+	flag.Int64Var(&fv.GlobalTimeout, "gt", 0, i18n.GetText("flag_global_timeout"))
 	flag.BoolVar(&fv.DisablePing, "np", false, i18n.GetText("flag_disable_ping"))
 	flag.BoolVar(&fv.DisableTcpProbe, "ntp", false, i18n.GetText("flag_disable_tcp_probe"))
+	flag.BoolVar(&fv.DisableSubnetProbe, "nsp", false, i18n.GetText("flag_disable_subnet_probe"))
 	flag.StringVar(&fv.LocalPlugin, "local", "", i18n.GetText("flag_local_plugin"))
 	flag.BoolVar(&fv.AliveOnly, "ao", false, i18n.GetText("flag_alive_only"))
 
@@ -137,6 +138,7 @@ func Flag(Info *HostInfo) error {
 	flag.StringVar(&fv.TargetURL, "u", "", i18n.GetText("flag_target_url"))
 	flag.StringVar(&fv.URLsFile, "uf", "", i18n.GetText("flag_urls_file"))
 	flag.StringVar(&fv.Cookie, "cookie", "", i18n.GetText("flag_cookie"))
+	flag.StringVar(&fv.UserAgent, "ua", "", i18n.GetText("flag_user_agent"))
 	flag.Int64Var(&fv.WebTimeout, "wt", 5, i18n.GetText("flag_web_timeout"))
 	flag.IntVar(&fv.MaxRedirects, "max-redirect", 10, i18n.GetText("flag_max_redirects"))
 	flag.StringVar(&fv.HTTPProxy, "proxy", "", i18n.GetText("flag_http_proxy"))
@@ -213,6 +215,26 @@ func Flag(Info *HostInfo) error {
 		return err
 	}
 
+	// 检测用户是否显式指定了 -t
+	flag.Visit(func(f *flag.Flag) {
+		switch f.Name {
+		case "t":
+			fv.ThreadNumExplicit = true
+		case "time":
+			fv.TimeoutExplicit = true
+		case "mt":
+			fv.ModuleThreadNumExplicit = true
+		case "retry":
+			fv.MaxRetriesExplicit = true
+		case "gt":
+			fv.GlobalTimeoutExplicit = true
+		case "icmp-rate":
+			fv.ICMPRateExplicit = true
+		case "num":
+			fv.PocNumExplicit = true
+		}
+	})
+
 	// 设置语言
 	i18n.SetLanguage(fv.Language)
 

common/flag_config.go

@@ -1,9 +1,11 @@
 package common
 
 import (
+	"os"
 	"time"
 
 	"github.com/shadow1ng/fscan/common/config"
+	"golang.org/x/term"
 )
 
 /*
@@ -25,22 +27,27 @@ type FlagVars struct {
 	ExcludeHostsFile string
 	Ports            string
 	ExcludePorts     string
-	AddPorts         string
 	HostsFile        string
 	PortsFile        string
 
 	// 扫描控制
-	ScanMode        string
-	ThreadNum       int
-	ModuleThreadNum int
-	TimeoutSec      int64 // 秒，需转换为 time.Duration
-	GlobalTimeout   int64
-	DisablePing     bool
-	DisableTcpProbe bool
-	LocalPlugin     string
-	AliveOnly       bool
-	DisableBrute    bool
-	MaxRetries      int
+	ScanMode                string
+	ThreadNum               int
+	ThreadNumExplicit       bool // 用户显式指定了 -t
+	ModuleThreadNum         int
+	ModuleThreadNumExplicit bool
+	TimeoutSec              int64 // 秒，需转换为 time.Duration
+	TimeoutExplicit         bool
+	GlobalTimeout           int64
+	GlobalTimeoutExplicit   bool
+	DisablePing             bool
+	DisableTcpProbe         bool
+	DisableSubnetProbe      bool
+	LocalPlugin             string
+	AliveOnly               bool
+	DisableBrute            bool
+	MaxRetries              int
+	MaxRetriesExplicit      bool
 
 	// 认证凭据
 	Username      string
@@ -73,6 +80,7 @@ type FlagVars struct {
 	PocFull        bool
 	DNSLog         bool
 	PocNum         int
+	PocNumExplicit bool
 	DisablePocScan bool
 
 	// Redis利用
@@ -84,9 +92,10 @@ type FlagVars struct {
 	DisableRedis      bool
 
 	// 发包频率
-	PacketRateLimit int64
-	MaxPacketCount  int64
-	ICMPRate        float64
+	PacketRateLimit  int64
+	MaxPacketCount   int64
+	ICMPRate         float64
+	ICMPRateExplicit bool
 
 	// 输出控制
 	Outputfile      string
@@ -134,19 +143,24 @@ func GetFlagVars() *FlagVars {
 func BuildConfigFromFlags(fv *FlagVars) *Config {
 	return &Config{
 		// 高频字段
-		Timeout:         time.Duration(fv.TimeoutSec) * time.Second,
-		ThreadNum:       fv.ThreadNum,
-		ModuleThreadNum: fv.ModuleThreadNum,
-		DisableBrute:    fv.DisableBrute,
-		DisablePing:     fv.DisablePing,
-		DisableTcpProbe: fv.DisableTcpProbe,
+		Timeout:                 time.Duration(fv.TimeoutSec) * time.Second,
+		TimeoutExplicit:         fv.TimeoutExplicit,
+		ThreadNum:               fv.ThreadNum,
+		ThreadNumExplicit:       fv.ThreadNumExplicit,
+		ModuleThreadNum:         fv.ModuleThreadNum,
+		ModuleThreadNumExplicit: fv.ModuleThreadNumExplicit,
+		DisableBrute:            fv.DisableBrute,
+		DisablePing:             fv.DisablePing,
+		DisableTcpProbe:         fv.DisableTcpProbe,
+		DisableSubnetProbe:      fv.DisableSubnetProbe,
 
 		// 扫描模式
-		Mode:        fv.ScanMode,
-		LocalMode:   fv.LocalPlugin != "",
-		LocalPlugin: fv.LocalPlugin,
-		AliveOnly:   fv.AliveOnly,
-		MaxRetries:  fv.MaxRetries,
+		Mode:               fv.ScanMode,
+		LocalMode:          fv.LocalPlugin != "",
+		LocalPlugin:        fv.LocalPlugin,
+		AliveOnly:          fv.AliveOnly,
+		MaxRetries:         fv.MaxRetries,
+		MaxRetriesExplicit: fv.MaxRetriesExplicit,
 
 		// 高级功能
 		Shellcode:             fv.Shellcode,
@@ -154,8 +168,12 @@ func BuildConfigFromFlags(fv *FlagVars) *Config {
 		DNSLog:                fv.DNSLog,
 		PersistenceTargetFile: fv.PersistenceTargetFile,
 		WinPEFile:             fv.WinPEFile,
-		PortMap:               config.DefaultPortMap,
-		DefaultMap:            config.DefaultProbeMap,
+		PortMap:               clonePortMap(config.DefaultPortMap),
+		DefaultMap:            cloneStringSlice(config.DefaultProbeMap),
+
+		// 全局超时
+		GlobalTimeout:         time.Duration(fv.GlobalTimeout) * time.Second,
+		GlobalTimeoutExplicit: fv.GlobalTimeoutExplicit,
 
 		// SOCKS5代理端口
 		Socks5ProxyPort: fv.Socks5ProxyPort,
@@ -165,26 +183,27 @@ func BuildConfigFromFlags(fv *FlagVars) *Config {
 			Username:      fv.Username,
 			Password:      fv.Password,
 			Domain:        fv.Domain,
-			Userdict:      config.DefaultUserDict,
-			Passwords:     config.DefaultPasswords,
+			Userdict:      cloneStringSliceMap(config.DefaultUserDict),
+			Passwords:     cloneStringSlice(config.DefaultPasswords),
 			UserPassPairs: nil, // 后续解析
 			SSHKeyPath:    fv.SSHKeyPath,
 		},
 		Network: NetworkConfig{
-			HTTPProxy:       fv.HTTPProxy,
-			Socks5Proxy:     fv.Socks5Proxy,
-			Iface:           fv.Iface,
-			WebTimeout:      time.Duration(fv.WebTimeout) * time.Second,
-			MaxRedirects:    fv.MaxRedirects,
-			PacketRateLimit: fv.PacketRateLimit,
-			MaxPacketCount:  fv.MaxPacketCount,
-			ICMPRate:        fv.ICMPRate,
+			HTTPProxy:        fv.HTTPProxy,
+			Socks5Proxy:      fv.Socks5Proxy,
+			Iface:            fv.Iface,
+			WebTimeout:       time.Duration(fv.WebTimeout) * time.Second,
+			MaxRedirects:     fv.MaxRedirects,
+			PacketRateLimit:  fv.PacketRateLimit,
+			MaxPacketCount:   fv.MaxPacketCount,
+			ICMPRate:         fv.ICMPRate,
+			ICMPRateExplicit: fv.ICMPRateExplicit,
 		},
 		Output: OutputConfig{
 			File:            fv.Outputfile,
 			Format:          fv.OutputFormat,
 			DisableSave:     fv.DisableSave,
-			NoColor:         fv.NoColor,
+			NoColor:         fv.NoColor || !isStdoutTerminal(),
 			Silent:          fv.Silent,
 			DisableProgress: fv.DisableProgress,
 			ShowProgress:    !fv.DisableProgress,
@@ -193,11 +212,12 @@ func BuildConfigFromFlags(fv *FlagVars) *Config {
 			PerfStats:       fv.PerfStats,
 		},
 		POC: POCConfig{
-			PocPath:  fv.PocPath,
-			PocName:  fv.PocName,
-			Full:     fv.PocFull,
-			Num:      fv.PocNum,
-			Disabled: fv.DisablePocScan,
+			PocPath:     fv.PocPath,
+			PocName:     fv.PocName,
+			Full:        fv.PocFull,
+			Num:         fv.PocNum,
+			NumExplicit: fv.PocNumExplicit,
+			Disabled:    fv.DisablePocScan,
 		},
 		Redis: RedisConfig{
 			Disabled:     fv.DisableRedis,
@@ -209,7 +229,7 @@ func BuildConfigFromFlags(fv *FlagVars) *Config {
 		},
 		HTTP: HTTPConfig{
 			Cookie:    fv.Cookie,
-			UserAgent: fv.UserAgent,
+			UserAgent: defaultUserAgent(fv.UserAgent),
 			Accept:    fv.Accept,
 		},
 		LocalExploit: LocalExploitConfig{
@@ -225,3 +245,15 @@ func BuildConfigFromFlags(fv *FlagVars) *Config {
 		},
 	}
 }
+
+func isStdoutTerminal() bool {
+	return term.IsTerminal(int(os.Stdout.Fd()))
+}
+
+// defaultUserAgent 用户未通过 -ua 指定时回退到默认 UA，避免发送空 User-Agent 被 WAF 识别
+func defaultUserAgent(ua string) string {
+	if ua != "" {
+		return ua
+	}
+	return "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
+}

common/flag_test.go

@@ -34,7 +34,7 @@ func TestBuildConfigFromFlags_ScanControl(t *testing.T) {
 				ThreadNum:       600,
 				ModuleThreadNum: 20,
 				TimeoutSec:      3,
-				GlobalTimeout:   180,
+				GlobalTimeout:   0,
 			},
 			validate: func(t *testing.T, cfg *Config) {
 				if cfg.Mode != "all" {
@@ -49,6 +49,9 @@ func TestBuildConfigFromFlags_ScanControl(t *testing.T) {
 				if cfg.Timeout != 3*time.Second {
 					t.Errorf("Timeout = %v, want %v", cfg.Timeout, 3*time.Second)
 				}
+				if cfg.GlobalTimeout != 0 {
+					t.Errorf("GlobalTimeout = %v, want disabled", cfg.GlobalTimeout)
+				}
 			},
 		},
 		{
@@ -955,8 +958,9 @@ func TestBuildConfigFromFlags_BoundaryValues(t *testing.T) {
 				if cfg.HTTP.Cookie != "" {
 					t.Errorf("Cookie 应该为空")
 				}
-				if cfg.HTTP.UserAgent != "" {
-					t.Errorf("UserAgent 应该为空")
+				// 空输入回退到默认 UA，避免发送空 User-Agent
+				if cfg.HTTP.UserAgent == "" {
+					t.Errorf("UserAgent 空输入应回退到默认 UA")
 				}
 			},
 		},

common/flag_web.go

@@ -2,19 +2,8 @@
 
 package common
 
-import (
-	"flag"
+// WebMode Web版本始终为true
+const WebMode = true
 
-	"github.com/shadow1ng/fscan/common/i18n"
-)
-
-// WebMode 表示是否启动Web管理界面
-var WebMode bool
-
-// WebPort Web服务器端口
-var WebPort int
-
-func init() {
-	flag.BoolVar(&WebMode, "web", false, i18n.GetText("flag_web_mode"))
-	flag.IntVar(&WebPort, "webport", 10240, i18n.GetText("flag_web_port"))
-}
+// WebPort 不再使用，端口由 main_web.go 的 -port 参数控制
+var WebPort = 0

common/globals.go

@@ -31,7 +31,11 @@ type HostInfo struct {
 
 // Target 返回 host:port 格式字符串
 func (h *HostInfo) Target() string {
-	return net.JoinHostPort(h.Host, strconv.Itoa(h.Port))
+	host := h.Host
+	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+		host = strings.TrimPrefix(strings.TrimSuffix(host, "]"), "[")
+	}
+	return net.JoinHostPort(host, strconv.Itoa(h.Port))
 }
 
 // =============================================================================
@@ -65,7 +69,7 @@ const (
 
 // 版本信息，通过 ldflags 注入
 var (
-	version = "2.2.0-rc"
+	version = "2.2.1"
 	commit  = "unknown"
 	date    = "unknown"
 )

common/globals_test.go

@@ -1,6 +1,10 @@
 package common
 
-import "testing"
+import (
+	"errors"
+	"strings"
+	"testing"
+)
 
 func TestHostInfoTargetUsesBracketedIPv6(t *testing.T) {
 	info := &HostInfo{Host: "2001:db8::1", Port: 443}
@@ -8,3 +12,56 @@ func TestHostInfoTargetUsesBracketedIPv6(t *testing.T) {
 		t.Fatalf("Target() = %q, want %q", got, want)
 	}
 }
+
+func TestHostInfoTargetDoesNotDoubleBracketIPv6(t *testing.T) {
+	info := &HostInfo{Host: "[2001:db8::1]", Port: 443}
+	if got, want := info.Target(), "[2001:db8::1]:443"; got != want {
+		t.Fatalf("Target() = %q, want %q", got, want)
+	}
+}
+
+func TestGlobalHelpersAndPacketLimitErrors(t *testing.T) {
+	if GetVersion() == "" {
+		t.Fatal("GetVersion returned empty string")
+	}
+	if !ContainsAny("hello fscan", "none", "scan") {
+		t.Fatal("ContainsAny should find a matching substring")
+	}
+	if ContainsAny("hello fscan", "none", "missing") {
+		t.Fatal("ContainsAny should return false when nothing matches")
+	}
+
+	maxErr := &PacketLimitError{Sentinel: ErrMaxPacketReached, Limit: 5, Current: 5}
+	if !errors.Is(maxErr, ErrMaxPacketReached) || !strings.Contains(maxErr.Error(), "5") {
+		t.Fatalf("max packet error = %v", maxErr)
+	}
+
+	rateErr := &PacketLimitError{Sentinel: ErrPacketRateLimited, Limit: 3, Current: 2}
+	if !errors.Is(rateErr, ErrPacketRateLimited) || !strings.Contains(rateErr.Error(), "3") {
+		t.Fatalf("rate limit error = %v", rateErr)
+	}
+}
+
+func TestCanSendPacketUsesGlobalConfigAndState(t *testing.T) {
+	previousConfig := GetGlobalConfig()
+	previousState := GetGlobalState()
+	t.Cleanup(func() {
+		SetGlobalConfig(previousConfig)
+		SetGlobalState(previousState)
+	})
+
+	cfg := NewConfig()
+	cfg.Network.MaxPacketCount = 1
+	state := NewState()
+	state.IncrementPacketCount()
+	SetGlobalConfig(cfg)
+	SetGlobalState(state)
+
+	ok, reason := CanSendPacket()
+	if ok {
+		t.Fatal("CanSendPacket should reject when max packet count is reached")
+	}
+	if reason == "" {
+		t.Fatal("CanSendPacket should return a rejection reason")
+	}
+}

common/i18n/i18n.go

@@ -2,6 +2,7 @@ package i18n
 
 import (
 	"fmt"
+	"strconv"
 	"sync"
 
 	"github.com/nicksnyder/go-i18n/v2/i18n"
@@ -80,9 +81,9 @@ func Tr(key string, args ...interface{}) string {
 	loc := localizer
 	mu.RUnlock()
 
-	data := make(map[string]interface{})
+	data := make(map[string]interface{}, len(args))
 	for i, arg := range args {
-		data[fmt.Sprintf("Arg%d", i+1)] = arg
+		data["Arg"+strconv.Itoa(i+1)] = arg
 	}
 
 	msg, err := loc.Localize(&i18n.LocalizeConfig{

common/i18n/i18n_test.go

@@ -0,0 +1,37 @@
+package i18n
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLanguageLifecycleAndFallbacks(t *testing.T) {
+	original := GetLanguage()
+	t.Cleanup(func() { SetLanguage(original) })
+
+	SetLanguage(LangEN)
+	if got := GetLanguage(); got != LangEN {
+		t.Fatalf("language = %q, want %q", got, LangEN)
+	}
+	if got := GetText("concurrency_plugin"); got == "" || got == "concurrency_plugin" {
+		t.Fatalf("english text = %q, want translated text", got)
+	}
+	if got := Tr("debug_cpu_profile_started", "/tmp/profiles"); !strings.Contains(got, "/tmp/profiles") {
+		t.Fatalf("formatted english text = %q, want path included", got)
+	}
+
+	SetLanguage(LangZH)
+	if got := GetLanguage(); got != LangZH {
+		t.Fatalf("language = %q, want %q", got, LangZH)
+	}
+	if got := GetText("concurrency_plugin"); got == "" || got == "concurrency_plugin" {
+		t.Fatalf("chinese text = %q, want translated text", got)
+	}
+
+	if got := GetText("missing_translation_key"); got != "missing_translation_key" {
+		t.Fatalf("missing GetText = %q, want key", got)
+	}
+	if got := Tr("missing_translation_key", "ignored"); got != "missing_translation_key" {
+		t.Fatalf("missing Tr = %q, want key", got)
+	}
+}

common/i18n/locales/en.yaml

@@ -25,11 +25,15 @@ flag_timeout:
 flag_module_thread_num:
   other: "Module thread count"
 flag_global_timeout:
-  other: "Global timeout"
+  other: "Global timeout in seconds (0 means unlimited)"
+global_timeout_exceeded:
+  other: "Global timeout reached (-gt {{.V0}}s), scan aborted. Use -gt to increase or set to 0 to disable"
 flag_disable_ping:
   other: "Disable ping detection"
 flag_disable_tcp_probe:
   other: "Disable TCP supplementary probe"
+flag_disable_subnet_probe:
+  other: "Disable subnet pre-filter (optimization that skips empty /24 subnets in large scans)"
 flag_local_plugin:
   other: "Specify local plugin name (e.g.: cleaner, systeminfo, keylogger)"
 flag_debug:
@@ -64,6 +68,8 @@ flag_urls_file:
   other: "URLs file"
 flag_cookie:
   other: "HTTP Cookie"
+flag_user_agent:
+  other: "Custom User-Agent header"
 flag_web_timeout:
   other: "Web timeout"
 flag_max_redirects:
@@ -198,7 +204,7 @@ scan_alive_hosts_list:
 progress_scanning_description:
   other: "Scanning Progress"
 progress_scan_completed:
-  other: "Scan Completed:"
+  other: "Scan Completed"
 progress_waiting:
   other: "waiting..."
 progress_done:
@@ -421,6 +427,10 @@ port_open_http:
   other: "Port open {{.Arg1}} [http](HTTP probe)"
 port_scan_no_alive_subnet:
   other: "Subnet probe found no alive subnets, skipping port scan"
+port_scan_task_dropped:
+  other: "[PortScan] task dropped: {{.Arg1}} ({{.Arg2}}), port may be missed"
+port_scan_tasks_dropped_total:
+  other: "[PortScan] {{.Arg1}} tasks dropped total, these ports may be missed"
 network_rate_limited_pattern:
   other: "Rate limited"
 port_scan_debug_start:
@@ -541,6 +551,28 @@ icmp_debug_stable_done:
   other: "[ICMP] response stable, ending early, elapsed {{.Arg1}}, alive {{.Arg2}}/{{.Arg3}}"
 adaptive_pool_resource_exhausted:
   other: "[AdaptivePool] resource exhaustion rate {{.Arg1}}%, threads {{.Arg2}} -> {{.Arg3}}"
+adaptive_pool_decrease:
+  other: "Concurrency adjusted: {{.Arg1}} -> {{.Arg2}} (pressure detected)"
+adaptive_pool_increase:
+  other: "Concurrency adjusted: {{.Arg1}} -> {{.Arg2}} (network healthy)"
+adaptive_pool_slowstart_exit:
+  other: "Slow start exit: current {{.Arg1}} (congestion detected)"
+adaptive_pool_wait_timeout:
+  other: "Thread pool wait timed out (10 minutes), forcing exit"
+net_probe_result:
+  other: "Network probe: {{.Arg1}}, RTT {{.Arg2}}ms, loss {{.Arg3}}%, concurrency {{.Arg4}}/{{.Arg5}}"
+net_env_lan:
+  other: "LAN"
+net_env_wan:
+  other: "WAN"
+net_env_internet:
+  other: "Internet"
+net_env_slow:
+  other: "Slow network"
+env_tune_summary:
+  other: "Adaptive params: Timeout={{.Arg1}}ms, ModuleThread={{.Arg2}}, Retry={{.Arg3}}, ICMPRate={{.Arg4}}, PocNum={{.Arg5}}"
+env_fd_limit:
+  other: "fd limit constraint: threads {{.Arg1}} -> {{.Arg2}} (ulimit={{.Arg3}})"
 
 # ========================= Service Plugin Messages =========================
 # Format: {service}_{type} - type: credential/unauth/service/vuln

common/i18n/locales/zh.yaml

@@ -25,11 +25,15 @@ flag_timeout:
 flag_module_thread_num:
   other: "模块线程数"
 flag_global_timeout:
-  other: "全局超时时间"
+  other: "全局超时时间（秒，0 表示不限制）"
+global_timeout_exceeded:
+  other: "全局超时已到（-gt {{.V0}}s），扫描被终止。大规模扫描请用 -gt 调大超时或设为 0 禁用"
 flag_disable_ping:
   other: "禁用ping探测"
 flag_disable_tcp_probe:
   other: "禁用TCP补充探测"
+flag_disable_subnet_probe:
+  other: "禁用网段预筛（大规模扫描时跳过空 /24 网段的优化）"
 flag_local_plugin:
   other: "指定本地插件名称 (如: cleaner, systeminfo, keylogger 等)"
 flag_debug:
@@ -64,6 +68,8 @@ flag_urls_file:
   other: "URL文件"
 flag_cookie:
   other: "HTTP Cookie"
+flag_user_agent:
+  other: "自定义 User-Agent 请求头"
 flag_web_timeout:
   other: "Web超时时间"
 flag_max_redirects:
@@ -198,7 +204,7 @@ scan_alive_hosts_list:
 progress_scanning_description:
   other: "扫描进度"
 progress_scan_completed:
-  other: "扫描完成:"
+  other: "扫描完成"
 progress_waiting:
   other: "等待中..."
 progress_done:
@@ -421,6 +427,10 @@ port_open_http:
   other: "端口开放 {{.Arg1}} [http](HTTP探测)"
 port_scan_no_alive_subnet:
   other: "网段预筛未发现存活子网，跳过端口扫描"
+port_scan_task_dropped:
+  other: "[PortScan] 任务被丢弃: {{.Arg1}} ({{.Arg2}})，该端口可能被漏扫"
+port_scan_tasks_dropped_total:
+  other: "[PortScan] 共有 {{.Arg1}} 个任务被丢弃，这些端口可能被漏扫"
 network_rate_limited_pattern:
   other: "发包受限"
 port_scan_debug_start:
@@ -541,6 +551,28 @@ icmp_debug_stable_done:
   other: "[ICMP] 响应稳定，提前结束，耗时 {{.Arg1}}，存活 {{.Arg2}}/{{.Arg3}}"
 adaptive_pool_resource_exhausted:
   other: "[AdaptivePool] 资源耗尽率 {{.Arg1}}%, 线程数 {{.Arg2}} -> {{.Arg3}}"
+adaptive_pool_decrease:
+  other: "并发调整: {{.Arg1}} -> {{.Arg2}} (检测到压力)"
+adaptive_pool_increase:
+  other: "并发调整: {{.Arg1}} -> {{.Arg2}} (网络健康)"
+adaptive_pool_slowstart_exit:
+  other: "慢启动退出: 当前 {{.Arg1}} (检测到拥塞)"
+adaptive_pool_wait_timeout:
+  other: "线程池等待超时（10分钟），强制退出"
+net_probe_result:
+  other: "网络探测: {{.Arg1}}, RTT {{.Arg2}}ms, 丢包 {{.Arg3}}%, 并发 {{.Arg4}}/{{.Arg5}}"
+net_env_lan:
+  other: "内网"
+net_env_wan:
+  other: "局域网"
+net_env_internet:
+  other: "公网"
+net_env_slow:
+  other: "慢速网络"
+env_tune_summary:
+  other: "参数自适应: Timeout={{.Arg1}}ms, ModuleThread={{.Arg2}}, Retry={{.Arg3}}, ICMPRate={{.Arg4}}, PocNum={{.Arg5}}"
+env_fd_limit:
+  other: "fd limit 约束: 线程数 {{.Arg1}} -> {{.Arg2}} (ulimit={{.Arg3}})"
 
 # ========================= 服务插件通用消息 =========================
 # 格式: {service}_{type} - type: credential/unauth/service/vuln

common/initialize_test.go

@@ -0,0 +1,55 @@
+package common
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidateExclusiveParams(t *testing.T) {
+	previous := GetFlagVars()
+	t.Cleanup(func() { flagVars = previous })
+
+	tests := []struct {
+		name    string
+		info    *HostInfo
+		flags   *FlagVars
+		wantErr string
+	}{
+		{name: "host only", info: &HostInfo{Host: "127.0.0.1"}, flags: &FlagVars{}},
+		{name: "url only", info: &HostInfo{}, flags: &FlagVars{TargetURL: "http://example.com"}},
+		{name: "local only", info: &HostInfo{}, flags: &FlagVars{LocalPlugin: "sshkey"}},
+		{name: "host and url conflict", info: &HostInfo{Host: "127.0.0.1"}, flags: &FlagVars{TargetURL: "http://example.com"}, wantErr: "-h"},
+		{name: "host url local conflict", info: &HostInfo{Host: "127.0.0.1"}, flags: &FlagVars{TargetURL: "http://example.com", LocalPlugin: "sshkey"}, wantErr: "-local"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			flagVars = tt.flags
+			err := ValidateExclusiveParams(tt.info)
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("ValidateExclusiveParams error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("ValidateExclusiveParams error = %v, want containing %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestCleanupWithoutOutput(t *testing.T) {
+	oldResultOutput := ResultOutput
+	oldStdoutWriter := StdoutWriter
+	t.Cleanup(func() {
+		ResultOutput = oldResultOutput
+		StdoutWriter = oldStdoutWriter
+	})
+
+	ResultOutput = nil
+	StdoutWriter = nil
+	if err := Cleanup(); err != nil {
+		t.Fatalf("Cleanup error = %v", err)
+	}
+}

common/logger_facade_test.go

@@ -0,0 +1,63 @@
+package common
+
+import "testing"
+
+func preserveLoggerForTest(t *testing.T) {
+	t.Helper()
+
+	loggerMu.Lock()
+	oldSilentRefs := silentLoggerRefs
+	silentLoggerRefs = 0
+	resetLoggerLocked()
+	loggerMu.Unlock()
+
+	t.Cleanup(func() {
+		loggerMu.Lock()
+		closeLoggerLocked()
+		silentLoggerRefs = oldSilentRefs
+		resetLoggerLocked()
+		loggerMu.Unlock()
+	})
+}
+
+func TestLoggerFacadeSilentLifecycle(t *testing.T) {
+	preserveLoggerForTest(t)
+
+	previousFlags := GetFlagVars()
+	previousState := GetGlobalState()
+	t.Cleanup(func() {
+		flagVars = previousFlags
+		SetGlobalState(previousState)
+	})
+	flagVars = &FlagVars{Silent: true, LogLevel: "debug"}
+	SetGlobalState(NewState())
+
+	InitLogger()
+	LogDebug("debug")
+	LogInfo("info")
+	LogSuccess("success")
+	LogVuln("vuln")
+	LogError("error")
+	CloseLogger()
+}
+
+func TestPushSilentLoggerReferenceCount(t *testing.T) {
+	preserveLoggerForTest(t)
+
+	restoreOne := PushSilentLogger()
+	restoreTwo := PushSilentLogger()
+	if silentLoggerRefs != 2 {
+		t.Fatalf("silent refs = %d, want 2", silentLoggerRefs)
+	}
+
+	restoreOne()
+	restoreOne()
+	if silentLoggerRefs != 1 {
+		t.Fatalf("silent refs after first restore = %d, want 1", silentLoggerRefs)
+	}
+
+	restoreTwo()
+	if silentLoggerRefs != 0 {
+		t.Fatalf("silent refs after second restore = %d, want 0", silentLoggerRefs)
+	}
+}

common/logging/logger_test.go

@@ -2,6 +2,8 @@ package logging
 
 import (
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
@@ -160,6 +162,13 @@ func TestLogger_AllLevels(t *testing.T) {
 			wantMsg: "success message",
 			wantPfx: PrefixSuccess,
 		},
+		{
+			name:    "Vuln级别",
+			logFunc: logger.Vuln,
+			message: "vuln message",
+			wantMsg: "vuln message",
+			wantPfx: PrefixVuln,
+		},
 		{
 			name:    "Error级别",
 			logFunc: logger.Error,
@@ -650,3 +659,34 @@ func TestLogger_Initialize(t *testing.T) {
 
 	t.Logf("✓ Initialize测试通过")
 }
+
+func TestLogger_CloseClosesDebugFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "debug.log")
+	logger := NewLogger(&LoggerConfig{
+		Level:        LevelAll,
+		EnableColor:  false,
+		ShowProgress: false,
+		StartTime:    time.Now(),
+		LevelColors:  GetDefaultLevelColors(),
+		DebugLogFile: path,
+	})
+	if logger.debugFile == nil {
+		t.Fatal("debug file should be opened")
+	}
+
+	logger.Info("debug file line")
+	logger.Close()
+	if logger.debugFile != nil {
+		t.Fatal("debug file should be nil after Close")
+	}
+
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read debug file: %v", err)
+	}
+	if !strings.Contains(string(content), "debug file line") {
+		t.Fatalf("debug file content = %q", string(content))
+	}
+
+	logger.Close()
+}

common/network.go

@@ -52,16 +52,31 @@ func getGlobalDialer(timeout time.Duration) (proxy.Dialer, error) {
 
 // parseProxyURL 解析代理URL，提取地址和认证信息
 func parseProxyURL(proxyURL, fallback string) (host, username, password string) {
+	if !strings.Contains(proxyURL, "://") {
+		if host, username, password, ok := parseProxyURLCandidate("http://" + proxyURL); ok {
+			return host, username, password
+		}
+	}
+	if host, username, password, ok := parseProxyURLCandidate(proxyURL); ok {
+		return host, username, password
+	}
+	return fallback, "", ""
+}
+
+func parseProxyURLCandidate(proxyURL string) (host, username, password string, ok bool) {
 	parsedURL, err := url.Parse(proxyURL)
 	if err != nil {
-		return fallback, "", ""
+		return "", "", "", false
 	}
 	host = parsedURL.Host
+	if host == "" {
+		return "", "", "", false
+	}
 	if parsedURL.User != nil {
 		username = parsedURL.User.Username()
 		password, _ = parsedURL.User.Password()
 	}
-	return
+	return host, username, password, true
 }
 
 // createProxyConfig 根据全局设置创建代理配置

common/network_facade_test.go

@@ -0,0 +1,52 @@
+package common
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/shadow1ng/fscan/common/proxy"
+)
+
+func TestNetworkFacadeProxyState(t *testing.T) {
+	t.Cleanup(func() { proxy.AutoConfigureProxy(proxy.DefaultProxyConfig()) })
+	proxy.AutoConfigureProxy(proxy.DefaultProxyConfig())
+
+	if IsProxyEnabled() || IsSOCKS5Proxy() || !IsProxyReliable() {
+		t.Fatal("direct global proxy state should be disabled and reliable")
+	}
+
+	proxy.AutoConfigureProxy(&proxy.ProxyConfig{Type: proxy.ProxyTypeSOCKS5})
+	if !IsProxyEnabled() || !IsSOCKS5Proxy() || !IsProxyReliable() {
+		t.Fatal("SOCKS5 global proxy state should be enabled and SOCKS5")
+	}
+}
+
+func TestSafeHTTPDoUsesGlobalPacketLimit(t *testing.T) {
+	previousConfig := GetGlobalConfig()
+	previousState := GetGlobalState()
+	t.Cleanup(func() {
+		SetGlobalConfig(previousConfig)
+		SetGlobalState(previousState)
+	})
+
+	cfg := NewConfig()
+	cfg.Network.MaxPacketCount = 1
+	state := NewState()
+	state.IncrementPacketCount()
+	SetGlobalConfig(cfg)
+	SetGlobalState(state)
+
+	client := &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
+		t.Fatal("transport should not be called when packet limit is reached")
+		return nil, nil
+	})}
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "http://example.com", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if resp, err := SafeHTTPDo(client, req); err == nil || resp != nil {
+		t.Fatalf("SafeHTTPDo = resp %#v err %v, want limit error", resp, err)
+	}
+}

common/output/buffer.go

@@ -22,10 +22,10 @@ type ResultBuffer struct {
 // NewResultBuffer 创建新的结果缓冲
 func NewResultBuffer() *ResultBuffer {
 	return &ResultBuffer{
-		seenHosts:    make(map[string]struct{}),
-		seenPorts:    make(map[string]struct{}),
-		seenServices: make(map[string]int),
-		seenVulns:    make(map[string]struct{}),
+		seenHosts:    make(map[string]struct{}, 256),
+		seenPorts:    make(map[string]struct{}, 512),
+		seenServices: make(map[string]int, 128),
+		seenVulns:    make(map[string]struct{}, 64),
 	}
 }
 

common/output/stdout_writer.go

@@ -4,7 +4,9 @@ import (
 	"bufio"
 	"encoding/json"
 	"fmt"
+	"net"
 	"os"
+	"strconv"
 	"strings"
 	"sync"
 )
@@ -88,10 +90,17 @@ func (w *StdoutNDJSONWriter) flatten(r *ScanResult) *ndjsonRecord {
 
 	rec.Service = strVal(d, "service")
 	rec.Protocol = strVal(d, "protocol")
-	rec.Banner = strVal(d, "banner")
+	if banner := strVal(d, "banner"); len(banner) > 200 {
+		rec.Banner = banner[:200] + "..."
+	} else {
+		rec.Banner = banner
+	}
 	rec.Title = strVal(d, "title")
 	rec.URL = strVal(d, "url")
 	rec.Vulnerability = strVal(d, "vulnerability")
+	if rec.Vulnerability == "" {
+		rec.Vulnerability = strVal(d, "vulnerability_name")
+	}
 	rec.Username = strVal(d, "username")
 	rec.Password = strVal(d, "password")
 	rec.Plugin = strVal(d, "plugin")
@@ -132,13 +141,19 @@ func toInt(v interface{}) (int, bool) {
 }
 
 func splitHostPort(target string) (string, int, bool) {
-	idx := strings.LastIndex(target, ":")
-	if idx < 0 {
+	host, portText, err := net.SplitHostPort(target)
+	if err != nil {
+		if strings.Count(target, ":") != 1 {
+			return "", 0, false
+		}
+		parts := strings.SplitN(target, ":", 2)
+		host, portText = parts[0], parts[1]
+	}
+	port, err := strconv.Atoi(portText)
+	if err != nil {
 		return "", 0, false
 	}
-	host := target[:idx]
-	var port int
-	if _, err := fmt.Sscanf(target[idx+1:], "%d", &port); err != nil {
+	if host == "" || port < 1 || port > 65535 {
 		return "", 0, false
 	}
 	return host, port, true

common/output/stdout_writer_test.go

@@ -0,0 +1,122 @@
+package output
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"testing"
+)
+
+func TestSplitHostPort(t *testing.T) {
+	tests := []struct {
+		name     string
+		target   string
+		wantHost string
+		wantPort int
+		wantOK   bool
+	}{
+		{name: "ipv4", target: "192.168.1.1:80", wantHost: "192.168.1.1", wantPort: 80, wantOK: true},
+		{name: "hostname", target: "example.com:443", wantHost: "example.com", wantPort: 443, wantOK: true},
+		{name: "bracketed ipv6", target: "[2001:db8::1]:8443", wantHost: "2001:db8::1", wantPort: 8443, wantOK: true},
+		{name: "bare ipv6 without port", target: "2001:db8::1", wantOK: false},
+		{name: "invalid port", target: "example.com:abc", wantOK: false},
+		{name: "port out of range", target: "example.com:65536", wantOK: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			host, port, ok := splitHostPort(tt.target)
+			if ok != tt.wantOK {
+				t.Fatalf("splitHostPort(%q) ok = %v, want %v", tt.target, ok, tt.wantOK)
+			}
+			if !ok {
+				return
+			}
+			if host != tt.wantHost || port != tt.wantPort {
+				t.Fatalf("splitHostPort(%q) = (%q, %d), want (%q, %d)", tt.target, host, port, tt.wantHost, tt.wantPort)
+			}
+		})
+	}
+}
+
+func TestNewStdoutNDJSONWriter(t *testing.T) {
+	writer := NewStdoutNDJSONWriter()
+	if writer == nil || writer.writer == nil {
+		t.Fatalf("NewStdoutNDJSONWriter = %#v, want initialized writer", writer)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("Close error = %v", err)
+	}
+}
+
+func TestStdoutNDJSONWriterWriteResult(t *testing.T) {
+	var buf bytes.Buffer
+	writer := &StdoutNDJSONWriter{writer: bufio.NewWriter(&buf)}
+
+	result := &ScanResult{
+		Type:   TypeService,
+		Target: "[2001:db8::1]:8443",
+		Status: "OPEN",
+		Details: map[string]interface{}{
+			"port":          float64(9443),
+			"service":       "https",
+			"protocol":      "tcp",
+			"banner":        123,
+			"title":         "admin",
+			"url":           "https://[2001:db8::1]:8443",
+			"vulnerability": "weak credential",
+			"username":      "admin",
+			"password":      "secret",
+			"plugin":        "webtitle",
+			"version":       "1.2.3",
+			"os":            "linux",
+		},
+	}
+
+	if err := writer.WriteResult(result); err != nil {
+		t.Fatalf("WriteResult error = %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("Close error = %v", err)
+	}
+
+	var rec ndjsonRecord
+	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &rec); err != nil {
+		t.Fatalf("invalid ndjson output %q: %v", buf.String(), err)
+	}
+	if rec.Host != "2001:db8::1" || rec.Port != 9443 {
+		t.Fatalf("host/port = %q/%d", rec.Host, rec.Port)
+	}
+	if rec.Service != "https" || rec.Protocol != "tcp" || rec.Banner != "123" || rec.Title != "admin" {
+		t.Fatalf("flattened fields missing: %#v", rec)
+	}
+	if rec.URL != "https://[2001:db8::1]:8443" || rec.Vulnerability != "weak credential" {
+		t.Fatalf("url/vuln fields missing: %#v", rec)
+	}
+	if rec.Username != "admin" || rec.Password != "secret" || rec.Plugin != "webtitle" || rec.Version != "1.2.3" || rec.OS != "linux" {
+		t.Fatalf("credential/plugin fields missing: %#v", rec)
+	}
+}
+
+func TestStdoutNDJSONFlattenFallbacks(t *testing.T) {
+	writer := &StdoutNDJSONWriter{writer: bufio.NewWriter(&bytes.Buffer{})}
+
+	rec := writer.flatten(&ScanResult{
+		Type:   TypeHost,
+		Target: "2001:db8::1",
+		Status: "ALIVE",
+		Details: map[string]interface{}{
+			"port": int64(22),
+		},
+	})
+	if rec.Host != "2001:db8::1" || rec.Port != 22 {
+		t.Fatalf("flatten fallback = %#v", rec)
+	}
+
+	if got, ok := toInt("22"); ok || got != 0 {
+		t.Fatalf("toInt string = %d/%v, want 0/false", got, ok)
+	}
+	if got := strVal(map[string]interface{}{}, "missing"); got != "" {
+		t.Fatalf("missing strVal = %q, want empty", got)
+	}
+}

common/output/writers.go

@@ -38,6 +38,19 @@ func escapeControlChars(s string) string {
 	return b.String()
 }
 
+func truncateString(s string, maxRunes int) string {
+	if maxRunes < 0 {
+		return s
+	}
+	for i := range s {
+		if maxRunes == 0 {
+			return s[:i] + "..."
+		}
+		maxRunes--
+	}
+	return s
+}
+
 func targetWithPort(target string, port interface{}) string {
 	if port == nil {
 		return target
@@ -46,6 +59,12 @@ func targetWithPort(target string, port interface{}) string {
 		return target
 	}
 	portText := fmt.Sprint(port)
+	if strings.TrimSpace(portText) == "" {
+		return target
+	}
+	if strings.HasPrefix(target, "[") && strings.HasSuffix(target, "]") {
+		target = strings.TrimPrefix(strings.TrimSuffix(target, "]"), "[")
+	}
 	if strings.Count(target, ":") == 1 {
 		return target
 	}
@@ -190,10 +209,8 @@ func (w *TXTWriter) formatServiceLine(result *ScanResult) string {
 		parts = append(parts, service)
 	}
 	if banner != "" {
-		if len(banner) > 100 {
-			banner = banner[:100] + "..."
-		}
 		banner = escapeControlChars(banner)
+		banner = truncateString(banner, 100)
 		parts = append(parts, banner)
 	}
 	return strings.Join(parts, " ")
@@ -266,6 +283,9 @@ func (w *TXTWriter) formatVulnLine(result *ScanResult) string {
 	}
 
 	vuln := w.getDetailStr(result, "vulnerability")
+	if vuln == "" {
+		vuln = w.getDetailStr(result, "vulnerability_name")
+	}
 	if vuln != "" {
 		return fmt.Sprintf("%s %s", result.Target, vuln)
 	}
@@ -333,13 +353,17 @@ func (w *TXTWriter) Close() error {
 		os.Remove(w.realtimePath)
 	}
 
+	var firstErr error
 	if err := w.bufWriter.Flush(); err != nil {
-		return err
+		firstErr = err
 	}
-	if err := w.file.Sync(); err != nil {
-		return err
+	if err := w.file.Sync(); err != nil && firstErr == nil {
+		firstErr = err
 	}
-	return w.file.Close()
+	if err := w.file.Close(); err != nil && firstErr == nil {
+		firstErr = err
+	}
+	return firstErr
 }
 
 // writeSection 写入一个分类的所有结果
@@ -739,9 +763,7 @@ func (w *CSVWriter) formatServiceRecord(result *ScanResult) []string {
 		fingerprints = formatFingerprints(result.Details["fingerprints"])
 		if b, ok := result.Details["banner"].(string); ok {
 			banner = escapeControlChars(b)
-			if len(banner) > 100 {
-				banner = banner[:100] + "..."
-			}
+			banner = truncateString(banner, 100)
 		}
 	}
 	target := result.Target
@@ -770,12 +792,18 @@ func formatFingerprints(value interface{}) string {
 
 func (w *CSVWriter) formatVulnRecord(result *ScanResult) []string {
 	vulnType := ""
+	vulnName := result.Status
 	if result.Details != nil {
 		if t, ok := result.Details["type"].(string); ok {
 			vulnType = t
 		}
+		if v, ok := result.Details["vulnerability"].(string); ok && v != "" {
+			vulnName = v
+		} else if v, ok := result.Details["vulnerability_name"].(string); ok && v != "" {
+			vulnName = v
+		}
 	}
-	return []string{result.Target, vulnType, result.Status}
+	return []string{result.Target, vulnType, vulnName}
 }
 
 // GetFormat 获取格式类型

common/output/writers_test.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 	"testing"
 	"time"
+	"unicode/utf8"
 )
 
 /*
@@ -67,7 +68,10 @@ func TestTargetWithPortIPv6(t *testing.T) {
 		{name: "ipv4 without port", target: "192.168.1.1", port: 80, want: "192.168.1.1:80"},
 		{name: "ipv4 with port", target: "192.168.1.1:80", port: 443, want: "192.168.1.1:80"},
 		{name: "ipv6 without port", target: "2001:db8::1", port: 443, want: "[2001:db8::1]:443"},
+		{name: "bracketed ipv6 without port", target: "[2001:db8::1]", port: 443, want: "[2001:db8::1]:443"},
 		{name: "ipv6 with port", target: "[2001:db8::1]:443", port: 80, want: "[2001:db8::1]:443"},
+		{name: "empty port", target: "example.com", port: "", want: "example.com"},
+		{name: "blank port", target: "example.com", port: " \t", want: "example.com"},
 	}
 
 	for _, tt := range tests {
@@ -79,6 +83,94 @@ func TestTargetWithPortIPv6(t *testing.T) {
 	}
 }
 
+func TestScanResultFormatDetailsAndDefaultManagerConfig(t *testing.T) {
+	result := &ScanResult{
+		Details: map[string]interface{}{
+			"service": "ssh",
+			"port":    22,
+			"banner":  "OpenSSH",
+		},
+	}
+	got := result.FormatDetails(";", "%s=%v")
+	want := "banner=OpenSSH;port=22;service=ssh"
+	if got != want {
+		t.Fatalf("FormatDetails = %q, want %q", got, want)
+	}
+
+	empty := (&ScanResult{}).FormatDetails(";", "%s=%v")
+	if empty != "" {
+		t.Fatalf("empty FormatDetails = %q, want empty", empty)
+	}
+
+	cfg := DefaultManagerConfig("out.json", FormatJSON)
+	if cfg.OutputPath != "out.json" || cfg.Format != FormatJSON {
+		t.Fatalf("DefaultManagerConfig = %#v", cfg)
+	}
+}
+
+func TestCSVWriterFormatRecords(t *testing.T) {
+	writer := &CSVWriter{}
+
+	host := writer.formatHostRecord(&ScanResult{Target: "192.168.1.1"})
+	if len(host) != 1 || host[0] != "192.168.1.1" {
+		t.Fatalf("host record = %#v", host)
+	}
+
+	port := writer.formatPortRecord(&ScanResult{
+		Target:  "192.168.1.1",
+		Details: map[string]interface{}{"port": 22},
+	})
+	if got, want := strings.Join(port, "|"), "192.168.1.1|22|open"; got != want {
+		t.Fatalf("port record = %q, want %q", got, want)
+	}
+
+	longBanner := strings.Repeat("界", 105)
+	service := writer.formatServiceRecord(&ScanResult{
+		Target: "2001:db8::1",
+		Details: map[string]interface{}{
+			"port":         443,
+			"name":         "https",
+			"version":      "1.2.3",
+			"title":        "hello\nworld",
+			"status":       200,
+			"server":       "nginx\r\nunit",
+			"fingerprints": []interface{}{"fp1", "", "fp2", 3},
+			"banner":       longBanner,
+		},
+	})
+	if service[0] != "[2001:db8::1]:443" || service[1] != "https" || service[2] != "1.2.3" {
+		t.Fatalf("service identity fields = %#v", service)
+	}
+	if service[3] != "hello\\nworld" || service[4] != "200" || service[5] != "nginx\\r\\nunit" {
+		t.Fatalf("service text fields = %#v", service)
+	}
+	if service[6] != "fp1,fp2" {
+		t.Fatalf("fingerprints = %q, want fp1,fp2", service[6])
+	}
+	if !utf8.ValidString(service[7]) || len([]rune(service[7])) != 103 || !strings.HasSuffix(service[7], "...") {
+		t.Fatalf("truncated banner = len %d value %q", len(service[7]), service[7])
+	}
+
+	vuln := writer.formatVulnRecord(&ScanResult{
+		Target:  "http://example.com",
+		Status:  "vulnerable",
+		Details: map[string]interface{}{"type": "poc"},
+	})
+	if got, want := strings.Join(vuln, "|"), "http://example.com|poc|vulnerable"; got != want {
+		t.Fatalf("vuln record = %q, want %q", got, want)
+	}
+
+	if got := formatFingerprints([]string{"a", "b"}); got != "a,b" {
+		t.Fatalf("string fingerprints = %q", got)
+	}
+	if got := formatFingerprints(123); got != "" {
+		t.Fatalf("unsupported fingerprints = %q, want empty", got)
+	}
+	if writer.GetFormat() != FormatCSV {
+		t.Fatalf("csv GetFormat = %q", writer.GetFormat())
+	}
+}
+
 // =============================================================================
 // TXTWriter - 基础功能测试
 // =============================================================================
@@ -1636,3 +1728,420 @@ func TestManager_ConcurrentSave(t *testing.T) {
 	t.Logf("✓ 并发保存测试通过（%d个goroutine，每个%d次，输出%d行）",
 		numGoroutines, savesPerGoroutine, len(lines))
 }
+
+// =============================================================================
+// TXTWriter - 内部格式化函数覆盖率测试
+// =============================================================================
+
+// newTestTXTWriter 创建用于单元测试的 TXTWriter（写到临时文件，调用方负责 Close）
+func newTestTXTWriter(t *testing.T) *TXTWriter {
+	t.Helper()
+	w, err := NewTXTWriter(filepath.Join(t.TempDir(), "unit.txt"))
+	if err != nil {
+		t.Fatalf("创建 TXTWriter 失败: %v", err)
+	}
+	return w
+}
+
+// TestFormatServiceLine 覆盖 formatServiceLine 的各分支
+func TestFormatServiceLine(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		details map[string]interface{}
+		want    []string // 输出中必须包含的子串
+		notwant []string // 输出中不应包含的子串
+	}{
+		{
+			name: "非web服务带service和banner",
+			details: map[string]interface{}{
+				"port":    22,
+				"service": "ssh",
+				"banner":  "OpenSSH_8.0",
+			},
+			want:    []string{"ssh", "OpenSSH_8.0"},
+			notwant: []string{"http://", "https://"},
+		},
+		{
+			name: "非web服务只有service",
+			details: map[string]interface{}{
+				"port":    3306,
+				"service": "mysql",
+			},
+			want:    []string{"mysql"},
+			notwant: []string{"http://"},
+		},
+		{
+			name: "非web服务无banner",
+			details: map[string]interface{}{
+				"port":    21,
+				"service": "ftp",
+			},
+			want: []string{"ftp"},
+		},
+		{
+			name: "service=http 走 web 分支",
+			details: map[string]interface{}{
+				"port":    80,
+				"service": "http",
+				"title":   "Home",
+				"status":  200,
+			},
+			want:    []string{"http://", "Home"},
+			notwant: []string{"ssh"},
+		},
+		{
+			name: "service=https 走 web 分支",
+			details: map[string]interface{}{
+				"port":    443,
+				"service": "https",
+				"title":   "Secure",
+				"status":  200,
+			},
+			want: []string{"https://", "Secure"},
+		},
+		{
+			name: "is_web=true 走 web 分支",
+			details: map[string]interface{}{
+				"port":   8080,
+				"is_web": true,
+				"title":  "Dashboard",
+				"status": 302,
+			},
+			want: []string{"http://", "Dashboard"},
+		},
+		{
+			name: "有 status 字段触发 web 分支",
+			details: map[string]interface{}{
+				"port":   8080,
+				"status": 200,
+			},
+			want: []string{"http://"},
+		},
+		{
+			name: "有 server 字段触发 web 分支",
+			details: map[string]interface{}{
+				"port":   8080,
+				"server": "nginx",
+			},
+			want: []string{"http://", "nginx"},
+		},
+		{
+			name: "banner 含控制字符被转义",
+			details: map[string]interface{}{
+				"port":    9999,
+				"service": "custom",
+				"banner":  "hello\nworld\r\n",
+			},
+			want:    []string{"\\n", "\\r"},
+			notwant: []string{"http://"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{
+				Target:  "192.168.1.1",
+				Type:    TypeService,
+				Details: tt.details,
+			}
+			got := w.formatServiceLine(result)
+			for _, s := range tt.want {
+				if !strings.Contains(got, s) {
+					t.Errorf("formatServiceLine() = %q，缺少 %q", got, s)
+				}
+			}
+			for _, s := range tt.notwant {
+				if strings.Contains(got, s) {
+					t.Errorf("formatServiceLine() = %q，不应含 %q", got, s)
+				}
+			}
+		})
+	}
+}
+
+// TestGetFingerprints 覆盖 getFingerprints 的各类型分支
+func TestGetFingerprints(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		details map[string]interface{}
+		want    string
+	}{
+		{
+			name:    "nil fingerprints",
+			details: map[string]interface{}{},
+			want:    "",
+		},
+		{
+			name:    "[]string 非空",
+			details: map[string]interface{}{"fingerprints": []string{"nginx", "php"}},
+			want:    "[nginx,php]",
+		},
+		{
+			name:    "[]string 空slice",
+			details: map[string]interface{}{"fingerprints": []string{}},
+			want:    "",
+		},
+		{
+			name:    "[]interface{} 非空",
+			details: map[string]interface{}{"fingerprints": []interface{}{"wordpress", "jquery"}},
+			want:    "[wordpress,jquery]",
+		},
+		{
+			name:    "[]interface{} 含数字",
+			details: map[string]interface{}{"fingerprints": []interface{}{"apache", 2}},
+			want:    "[apache,2]",
+		},
+		{
+			name:    "[]interface{} 空slice",
+			details: map[string]interface{}{"fingerprints": []interface{}{}},
+			want:    "",
+		},
+		{
+			name:    "不支持的类型返回空",
+			details: map[string]interface{}{"fingerprints": "just-a-string"},
+			want:    "",
+		},
+		{
+			name:    "单个元素",
+			details: map[string]interface{}{"fingerprints": []string{"tomcat"}},
+			want:    "[tomcat]",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{Target: "1.2.3.4", Details: tt.details}
+			got := w.getFingerprints(result)
+			if got != tt.want {
+				t.Errorf("getFingerprints() = %q，want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestFormatVulnLine 覆盖 formatVulnLine 的各分支
+func TestFormatVulnLine(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		target  string
+		status  string
+		details map[string]interface{}
+		want    string
+	}{
+		{
+			name:   "weak_credential 带 service",
+			target: "192.168.1.1:22",
+			details: map[string]interface{}{
+				"type":     "weak_credential",
+				"service":  "ssh",
+				"username": "root",
+				"password": "123456",
+			},
+			want: "192.168.1.1:22 ssh root/123456",
+		},
+		{
+			name:   "weak_credential 不带 service",
+			target: "192.168.1.1:3306",
+			details: map[string]interface{}{
+				"type":     "weak_credential",
+				"username": "admin",
+				"password": "pass",
+			},
+			want: "192.168.1.1:3306 admin/pass",
+		},
+		{
+			name:   "有 vulnerability 字段",
+			target: "10.0.0.1",
+			details: map[string]interface{}{
+				"type":          "poc",
+				"vulnerability": "CVE-2024-1234",
+			},
+			want: "10.0.0.1 CVE-2024-1234",
+		},
+		{
+			name:   "无 vulnerability 字段回退到 status",
+			target: "10.0.0.2",
+			status: "VULNERABLE",
+			details: map[string]interface{}{
+				"type": "unknown",
+			},
+			want: "10.0.0.2 VULNERABLE",
+		},
+		{
+			name:    "空 details 回退到 status",
+			target:  "10.0.0.3",
+			status:  "poc_hit",
+			details: map[string]interface{}{},
+			want:    "10.0.0.3 poc_hit",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{
+				Target:  tt.target,
+				Status:  tt.status,
+				Type:    TypeVuln,
+				Details: tt.details,
+			}
+			got := w.formatVulnLine(result)
+			if got != tt.want {
+				t.Errorf("formatVulnLine() = %q，want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestIsWebService 覆盖 isWebService 的各判断分支
+func TestIsWebService(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		details map[string]interface{}
+		want    bool
+	}{
+		{
+			name:    "is_web=true",
+			details: map[string]interface{}{"is_web": true},
+			want:    true,
+		},
+		{
+			name:    "is_web=false 无其他标志",
+			details: map[string]interface{}{"is_web": false},
+			want:    false,
+		},
+		{
+			name:    "有 status 字段",
+			details: map[string]interface{}{"status": 200},
+			want:    true,
+		},
+		{
+			name:    "status=nil 不触发",
+			details: map[string]interface{}{},
+			want:    false,
+		},
+		{
+			name:    "有非空 server 字段",
+			details: map[string]interface{}{"server": "nginx"},
+			want:    true,
+		},
+		{
+			name:    "空 server 字段不触发",
+			details: map[string]interface{}{"server": ""},
+			want:    false,
+		},
+		{
+			name:    "service=http",
+			details: map[string]interface{}{"service": "http"},
+			want:    true,
+		},
+		{
+			name:    "service=https",
+			details: map[string]interface{}{"service": "https"},
+			want:    true,
+		},
+		{
+			name:    "service=ssh 不是 web",
+			details: map[string]interface{}{"service": "ssh"},
+			want:    false,
+		},
+		{
+			name:    "nil Details",
+			details: nil,
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{Target: "1.2.3.4", Details: tt.details}
+			got := w.isWebService(result)
+			if got != tt.want {
+				t.Errorf("isWebService() = %v，want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestWebProtocol 覆盖 webProtocol 的各判断分支
+func TestWebProtocol(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		target  string
+		details map[string]interface{}
+		want    string
+	}{
+		{
+			name:    "protocol=https 直接返回",
+			target:  "1.2.3.4:8443",
+			details: map[string]interface{}{"protocol": "https"},
+			want:    "https",
+		},
+		{
+			name:    "protocol=http 直接返回",
+			target:  "1.2.3.4:8080",
+			details: map[string]interface{}{"protocol": "http"},
+			want:    "http",
+		},
+		{
+			name:    "protocol=HTTPS 大小写不敏感",
+			target:  "1.2.3.4:443",
+			details: map[string]interface{}{"protocol": "HTTPS"},
+			want:    "https",
+		},
+		{
+			name:    "service=https 回退",
+			target:  "1.2.3.4:8080",
+			details: map[string]interface{}{"service": "https"},
+			want:    "https",
+		},
+		{
+			name:    "target 含 :443 回退 https",
+			target:  "example.com:443",
+			details: map[string]interface{}{},
+			want:    "https",
+		},
+		{
+			name:    "无任何标志默认 http",
+			target:  "1.2.3.4:8080",
+			details: map[string]interface{}{},
+			want:    "http",
+		},
+		{
+			name:    "service=http 默认 http",
+			target:  "1.2.3.4:80",
+			details: map[string]interface{}{"service": "http"},
+			want:    "http",
+		},
+		{
+			name:    "protocol 为其他值走 service 分支",
+			target:  "1.2.3.4:9000",
+			details: map[string]interface{}{"protocol": "tcp", "service": "https"},
+			want:    "https",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{Target: tt.target, Details: tt.details}
+			got := w.webProtocol(result, tt.target)
+			if got != tt.want {
+				t.Errorf("webProtocol() = %q，want %q", got, tt.want)
+			}
+		})
+	}
+}

common/output_api_test.go

@@ -0,0 +1,171 @@
+package common
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common/output"
+)
+
+func readTestFile(t *testing.T, path string) string {
+	t.Helper()
+
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+	return string(content)
+}
+
+func preserveOutputAPIGlobals(t *testing.T) {
+	t.Helper()
+
+	globalMu.RLock()
+	oldConfig := globalConfig
+	oldState := globalState
+	globalMu.RUnlock()
+
+	oldFlagVars := flagVars
+	oldResultOutput := ResultOutput
+	oldStdoutWriter := StdoutWriter
+
+	t.Cleanup(func() {
+		if ResultOutput != nil && ResultOutput != oldResultOutput {
+			_ = ResultOutput.Close()
+		}
+		if StdoutWriter != nil && StdoutWriter != oldStdoutWriter {
+			_ = StdoutWriter.Close()
+		}
+		ClearResultCallback()
+
+		globalMu.Lock()
+		globalConfig = oldConfig
+		globalState = oldState
+		globalMu.Unlock()
+
+		flagVars = oldFlagVars
+		ResultOutput = oldResultOutput
+		StdoutWriter = oldStdoutWriter
+	})
+
+	ClearResultCallback()
+	flagVars = &FlagVars{}
+	ResultOutput = nil
+	StdoutWriter = nil
+	SetGlobalConfig(NewConfig())
+	SetGlobalState(NewState())
+}
+
+func TestInitOutputValidationAndDefaultExtension(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	flagVars = &FlagVars{DisableSave: true}
+	if err := InitOutput(); err != nil {
+		t.Fatalf("InitOutput disable save error = %v", err)
+	}
+	if ResultOutput != nil {
+		t.Fatalf("ResultOutput = %#v, want nil when save is disabled", ResultOutput)
+	}
+
+	flagVars = &FlagVars{OutputFormat: "txt"}
+	if err := InitOutput(); err == nil || !strings.Contains(err.Error(), "output file not specified") {
+		t.Fatalf("missing output error = %v", err)
+	}
+
+	flagVars = &FlagVars{Outputfile: "out.bad", OutputFormat: "xml"}
+	if err := InitOutput(); err == nil || !strings.Contains(err.Error(), "invalid output format") {
+		t.Fatalf("invalid format error = %v", err)
+	}
+
+	dir := t.TempDir()
+	t.Chdir(dir)
+	flagVars = &FlagVars{Outputfile: "result.txt", OutputFormat: "json"}
+	if err := InitOutput(); err != nil {
+		t.Fatalf("InitOutput json error = %v", err)
+	}
+	if ResultOutput == nil {
+		t.Fatal("ResultOutput should be initialized")
+	}
+	if err := SaveResult(&output.ScanResult{
+		Time:   time.Date(2026, 6, 13, 1, 2, 3, 0, time.UTC),
+		Type:   output.TypeHost,
+		Target: "127.0.0.1",
+		Status: "ALIVE",
+	}); err != nil {
+		t.Fatalf("SaveResult json error = %v", err)
+	}
+	if err := CloseOutput(); err != nil {
+		t.Fatalf("CloseOutput error = %v", err)
+	}
+	if content := readTestFile(t, filepath.Join(dir, "result.json")); !strings.Contains(content, "127.0.0.1") {
+		t.Fatalf("result.json content = %q, want saved target", content)
+	}
+}
+
+func TestCloseOutputWithStdoutWriter(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	// 初始化 silent 模式以创建 StdoutWriter
+	flagVars = &FlagVars{Silent: true, DisableSave: true}
+	if err := InitOutput(); err != nil {
+		t.Fatalf("InitOutput silent error = %v", err)
+	}
+	if StdoutWriter == nil {
+		t.Fatal("StdoutWriter 应在 Silent 模式下被初始化")
+	}
+
+	// CloseOutput 应正常关闭 StdoutWriter
+	if err := CloseOutput(); err != nil {
+		t.Fatalf("CloseOutput with StdoutWriter error = %v", err)
+	}
+}
+
+func TestSaveResultFacadeCallbackAndDisabledSave(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	cfg := NewConfig()
+	cfg.Output.DisableSave = true
+	SetGlobalConfig(cfg)
+
+	flagVars = &FlagVars{DisableSave: true}
+	if err := InitOutput(); err != nil {
+		t.Fatalf("InitOutput disable save error = %v", err)
+	}
+
+	called := false
+	SetResultCallback(func(payload interface{}) {
+		called = true
+		data, ok := payload.(map[string]interface{})
+		if !ok {
+			t.Fatalf("callback payload type = %T", payload)
+		}
+		if data["type"] != string(output.TypeVuln) || data["target"] != "http://example.com" {
+			t.Fatalf("callback payload = %#v", data)
+		}
+	})
+
+	if err := SaveResult(nil); err != nil {
+		t.Fatalf("SaveResult nil error = %v", err)
+	}
+	if called {
+		t.Fatal("nil result should not notify callback")
+	}
+
+	if err := SaveResult(&output.ScanResult{
+		Type:    output.TypeVuln,
+		Target:  "http://example.com",
+		Status:  "vulnerable",
+		Details: map[string]interface{}{"type": "poc"},
+	}); err != nil {
+		t.Fatalf("SaveResult disabled save error = %v", err)
+	}
+	if !called {
+		t.Fatal("callback was not notified")
+	}
+	if err := CloseOutput(); err != nil {
+		t.Fatalf("CloseOutput disabled save error = %v", err)
+	}
+}

common/parse.go

@@ -45,6 +45,9 @@ func applyLogLevel() {
 			StartTime:    GetGlobalState().GetStartTime(),
 			LevelColors:  logging.GetDefaultLevelColors(),
 		}
+		if fv.Debug {
+			config.DebugLogFile = "fscan_debug.log"
+		}
 
 		newLogger := logging.NewLogger(config)
 		newLogger.SetCoordinatedOutput(LogWithProgress)

common/parsers/host_iterator.go

@@ -488,3 +488,90 @@ func ipToUint32(ip net.IP) (uint32, bool) {
 func uint32ToIP(v uint32) string {
 	return fmt.Sprintf("%d.%d.%d.%d", byte(v>>24), byte(v>>16), byte(v>>8), byte(v))
 }
+
+// EstimateHostCount 快速估算主机总数（不消费 iterator）
+func EstimateHostCount(host string, filename string) int64 {
+	var total int64
+
+	if filename != "" {
+		if f, err := os.Open(filename); err == nil {
+			scanner := bufio.NewScanner(f)
+			for scanner.Scan() {
+				line := strings.TrimSpace(scanner.Text())
+				if line == "" || strings.HasPrefix(line, "#") {
+					continue
+				}
+				total += estimateHostEntry(line)
+			}
+			_ = f.Close()
+		}
+	}
+
+	for _, h := range strings.Split(host, ",") {
+		h = strings.TrimSpace(h)
+		if h != "" {
+			total += estimateHostEntry(h)
+		}
+	}
+
+	return total
+}
+
+func estimateHostEntry(entry string) int64 {
+	switch {
+	case entry == "192":
+		return 65536 // /16
+	case entry == "172":
+		return 1 << 20 // /12
+	case entry == "10":
+		return 1 << 24 // /8
+	case strings.Contains(entry, "/"):
+		_, ipNet, err := net.ParseCIDR(entry)
+		if err != nil {
+			return 1
+		}
+		ones, bits := ipNet.Mask.Size()
+		if bits != 32 {
+			return 1
+		}
+		size := int64(1) << uint(32-ones)
+		if size > 2 {
+			size -= 2
+		}
+		return size
+	case strings.Contains(entry, "-") && !strings.Contains(entry, ":") && looksLikeIPRange(entry):
+		parts := strings.SplitN(entry, "-", 2)
+		startIP := net.ParseIP(strings.TrimSpace(parts[0]))
+		if startIP == nil {
+			return 1
+		}
+		startU, ok := ipToUint32(startIP)
+		if !ok {
+			return 1
+		}
+		endStr := strings.TrimSpace(parts[1])
+		var endU uint32
+		if len(endStr) < 4 || !strings.Contains(endStr, ".") {
+			n, err := strconv.Atoi(endStr)
+			if err != nil || n > 255 {
+				return 1
+			}
+			endU = (startU & 0xFFFFFF00) | uint32(n)
+		} else {
+			endIP := net.ParseIP(endStr)
+			if endIP == nil {
+				return 1
+			}
+			endU, ok = ipToUint32(endIP)
+			if !ok {
+				return 1
+			}
+		}
+		if endU < startU {
+			return 1
+		}
+		return int64(endU-startU) + 1
+	default:
+		return 1
+	}
+}

common/parsers/host_iterator_test.go

@@ -1,7 +1,10 @@
 package parsers
 
 import (
+	"bufio"
 	"context"
+	"errors"
+	"net"
 	"os"
 	"reflect"
 	"strings"
@@ -103,3 +106,839 @@ func TestHostIteratorReadsLongHostFileLine(t *testing.T) {
 		t.Fatalf("batch = %#v, want long host", batch)
 	}
 }
+
+func TestMultiHostSourceAndMatcherCIDR(t *testing.T) {
+	src := &multiHostSource{sources: []hostSource{
+		&singleHostSource{host: "192.168.1.1"},
+		&singleHostSource{host: "192.168.1.2"},
+	}}
+
+	host, ok, err := src.Next()
+	if err != nil || !ok || host != "192.168.1.1" {
+		t.Fatalf("first Next = %q/%v/%v", host, ok, err)
+	}
+	host, ok, err = src.Next()
+	if err != nil || !ok || host != "192.168.1.2" {
+		t.Fatalf("second Next = %q/%v/%v", host, ok, err)
+	}
+	host, ok, err = src.Next()
+	if err != nil || ok || host != "" {
+		t.Fatalf("exhausted Next = %q/%v/%v", host, ok, err)
+	}
+	if err := src.Close(); err != nil {
+		t.Fatalf("Close error = %v", err)
+	}
+
+	matcher := newHostMatcher()
+	if err := matcher.add("192.168.1.0/30,example.com"); err != nil {
+		t.Fatalf("matcher add error = %v", err)
+	}
+	if !matcher.match("192.168.1.1") || !matcher.match("192.168.1.2") || !matcher.match("example.com") {
+		t.Fatal("matcher should match CIDR hosts and exact host")
+	}
+	if matcher.match("192.168.1.3") || matcher.match("nope.example") {
+		t.Fatal("matcher matched hosts outside its rules")
+	}
+	if err := matcher.add("2001:db8::/126"); err == nil {
+		t.Fatal("IPv6 CIDR should be rejected by IPv4-only matcher")
+	}
+}
+
+func TestCloseHostSourcesIgnoresCloseErrors(t *testing.T) {
+	first := &closeTrackingSource{err: errors.New("close failed")}
+	second := &closeTrackingSource{}
+
+	closeHostSources([]hostSource{first, second})
+
+	if !first.closed || !second.closed {
+		t.Fatalf("sources closed = %v/%v, want both true", first.closed, second.closed)
+	}
+}
+
+type closeTrackingSource struct {
+	closed bool
+	err    error
+}
+
+func (s *closeTrackingSource) Next() (string, bool, error) {
+	return "", false, nil
+}
+
+func (s *closeTrackingSource) Close() error {
+	s.closed = true
+	return s.err
+}
+
+// =============================================================================
+// newHostSource 分支覆盖
+// =============================================================================
+
+// TestNewHostSource_Shortcuts 验证 192/172/10 快捷方式展开为正确 CIDR
+func TestNewHostSource_Shortcuts(t *testing.T) {
+	cases := []struct {
+		input     string
+		wantFirst string
+	}{
+		{"192", "192.168.0.1"},
+		{"172", "172.16.0.1"},
+		{"10", "10.0.0.1"},
+	}
+	for _, c := range cases {
+		t.Run(c.input, func(t *testing.T) {
+			src, err := newHostSource(c.input)
+			if err != nil {
+				t.Fatalf("newHostSource(%q) error = %v", c.input, err)
+			}
+			defer src.Close()
+			host, ok, err := src.Next()
+			if err != nil || !ok {
+				t.Fatalf("Next() = %q/%v/%v", host, ok, err)
+			}
+			if host != c.wantFirst {
+				t.Errorf("first host = %q, 期望 %q", host, c.wantFirst)
+			}
+		})
+	}
+}
+
+// TestNewHostSource_CIDRBranch 验证含 "/" 走 CIDR 分支
+func TestNewHostSource_CIDRBranch(t *testing.T) {
+	src, err := newHostSource("10.0.0.0/30")
+	if err != nil {
+		t.Fatalf("newHostSource CIDR error = %v", err)
+	}
+	defer src.Close()
+	host, ok, _ := src.Next()
+	if !ok || host != "10.0.0.1" {
+		t.Errorf("CIDR first host = %q, 期望 10.0.0.1", host)
+	}
+}
+
+// TestNewHostSource_InvalidCIDR 无效 CIDR 返回错误
+func TestNewHostSource_InvalidCIDR(t *testing.T) {
+	_, err := newHostSource("999.0.0.0/24")
+	if err == nil {
+		t.Error("无效 CIDR 应返回 error")
+	}
+}
+
+// TestNewHostSource_RangeBranch 验证 a-b 格式走 range 分支
+func TestNewHostSource_RangeBranch(t *testing.T) {
+	src, err := newHostSource("192.168.1.5-192.168.1.7")
+	if err != nil {
+		t.Fatalf("newHostSource range error = %v", err)
+	}
+	defer src.Close()
+
+	var got []string
+	for {
+		h, ok, err := src.Next()
+		if err != nil {
+			t.Fatalf("Next() error = %v", err)
+		}
+		if !ok {
+			break
+		}
+		got = append(got, h)
+	}
+	want := []string{"192.168.1.5", "192.168.1.6", "192.168.1.7"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("range hosts = %v, 期望 %v", got, want)
+	}
+}
+
+// TestNewHostSource_RangeShortTail 验证短尾写法 x.x.x.a-b
+func TestNewHostSource_RangeShortTail(t *testing.T) {
+	src, err := newHostSource("10.0.0.3-5")
+	if err != nil {
+		t.Fatalf("newHostSource short-tail range error = %v", err)
+	}
+	defer src.Close()
+
+	var got []string
+	for {
+		h, ok, err := src.Next()
+		if err != nil {
+			t.Fatalf("Next() error = %v", err)
+		}
+		if !ok {
+			break
+		}
+		got = append(got, h)
+	}
+	want := []string{"10.0.0.3", "10.0.0.4", "10.0.0.5"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("short-tail range = %v, 期望 %v", got, want)
+	}
+}
+
+// TestNewHostSource_SingleHost 验证普通主机名走 singleHostSource 分支
+func TestNewHostSource_SingleHost(t *testing.T) {
+	src, err := newHostSource("example.com")
+	if err != nil {
+		t.Fatalf("newHostSource single error = %v", err)
+	}
+	defer src.Close()
+
+	host, ok, err := src.Next()
+	if err != nil || !ok || host != "example.com" {
+		t.Errorf("single host = %q/%v/%v, 期望 example.com/true/nil", host, ok, err)
+	}
+	// 第二次应该耗尽
+	_, ok, _ = src.Next()
+	if ok {
+		t.Error("singleHostSource 第二次 Next 应返回 ok=false")
+	}
+}
+
+// =============================================================================
+// hostMatcher.add 分支覆盖
+// =============================================================================
+
+// TestHostMatcherAdd_192Shortcut 验证 add("192") 展开为 192.168.0.0/16
+func TestHostMatcherAdd_192Shortcut(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("192"); err != nil {
+		t.Fatalf("add(192) error = %v", err)
+	}
+	if !m.match("192.168.1.100") {
+		t.Error("192.168.1.100 应命中 192.168.0.0/16")
+	}
+	if m.match("10.0.0.1") {
+		t.Error("10.0.0.1 不应命中")
+	}
+}
+
+// TestHostMatcherAdd_172Shortcut 验证 add("172")
+func TestHostMatcherAdd_172Shortcut(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("172"); err != nil {
+		t.Fatalf("add(172) error = %v", err)
+	}
+	if !m.match("172.16.0.1") {
+		t.Error("172.16.0.1 应命中 172.16.0.0/12")
+	}
+}
+
+// TestHostMatcherAdd_10Shortcut 验证 add("10")
+func TestHostMatcherAdd_10Shortcut(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("10"); err != nil {
+		t.Fatalf("add(10) error = %v", err)
+	}
+	if !m.match("10.1.2.3") {
+		t.Error("10.1.2.3 应命中 10.0.0.0/8")
+	}
+}
+
+// TestHostMatcherAdd_CIDR 验证 add 处理 CIDR 字符串
+func TestHostMatcherAdd_CIDR(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("192.168.5.0/24"); err != nil {
+		t.Fatalf("add CIDR error = %v", err)
+	}
+	if !m.match("192.168.5.10") {
+		t.Error("192.168.5.10 应命中 /24")
+	}
+	if m.match("192.168.6.10") {
+		t.Error("192.168.6.10 不应命中")
+	}
+}
+
+// TestHostMatcherAdd_Range 验证 add 处理 a-b 范围
+func TestHostMatcherAdd_Range(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("10.0.0.10-10.0.0.20"); err != nil {
+		t.Fatalf("add range error = %v", err)
+	}
+	if !m.match("10.0.0.15") {
+		t.Error("10.0.0.15 应命中范围")
+	}
+	if m.match("10.0.0.9") || m.match("10.0.0.21") {
+		t.Error("边界外不应命中")
+	}
+}
+
+// TestHostMatcherAdd_ExactHost 验证 add 处理普通主机名（exact 分支）
+func TestHostMatcherAdd_ExactHost(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("myhost.local"); err != nil {
+		t.Fatalf("add exact error = %v", err)
+	}
+	if !m.match("myhost.local") {
+		t.Error("exact 主机名应命中")
+	}
+	if m.match("other.local") {
+		t.Error("其他主机名不应命中")
+	}
+}
+
+// TestHostMatcherAdd_MultipleComma 验证逗号分隔多个值
+func TestHostMatcherAdd_MultipleComma(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("host1.com, host2.com, 192.168.1.0/30"); err != nil {
+		t.Fatalf("add comma-separated error = %v", err)
+	}
+	if !m.match("host1.com") || !m.match("host2.com") || !m.match("192.168.1.1") {
+		t.Error("逗号分隔的值应全部命中")
+	}
+}
+
+// TestHostMatcherAdd_EmptyEntry 逗号中间空串不报错
+func TestHostMatcherAdd_EmptyEntry(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add(",,,"); err != nil {
+		t.Fatalf("全空逗号不应报错: %v", err)
+	}
+}
+
+// TestHostMatcherAdd_InvalidCIDR 无效 CIDR 返回 error
+func TestHostMatcherAdd_InvalidCIDR(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("999.0.0.0/8"); err == nil {
+		t.Error("无效 CIDR 应返回 error")
+	}
+}
+
+// =============================================================================
+// fileHostSource.Next 分支覆盖
+// =============================================================================
+
+// TestFileHostSourceNext_SkipsEmptyAndComments 验证空行和注释行被跳过
+func TestFileHostSourceNext_SkipsEmptyAndComments(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	content := "\n# this is a comment\n\n  \n10.0.0.1\n# another comment\n10.0.0.2\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	iter, err := NewHostIterator("", path)
+	if err != nil {
+		t.Fatalf("NewHostIterator error = %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	want := []string{"10.0.0.1", "10.0.0.2"}
+	if !reflect.DeepEqual(batch, want) {
+		t.Errorf("batch = %v, 期望 %v", batch, want)
+	}
+}
+
+// TestFileHostSourceNext_MultipleSources 验证文件中每行多个 host（逗号分隔）走 multiHostSource 分支
+func TestFileHostSourceNext_MultipleSources(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	// 一行两个 host，触发 multiHostSource 分支
+	content := "10.0.0.1,10.0.0.2\n10.0.0.3\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	iter, err := NewHostIterator("", path)
+	if err != nil {
+		t.Fatalf("NewHostIterator error = %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	want := []string{"10.0.0.1", "10.0.0.2", "10.0.0.3"}
+	if !reflect.DeepEqual(batch, want) {
+		t.Errorf("batch = %v, 期望 %v", batch, want)
+	}
+}
+
+// TestFileHostSourceNext_InvalidLineSkipped 无效行（解析失败）被跳过不报错
+func TestFileHostSourceNext_InvalidLineSkipped(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	// 包含无效 CIDR，应被跳过
+	content := "999.0.0.0/8\n10.0.0.1\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	iter, err := NewHostIterator("", path)
+	if err != nil {
+		t.Fatalf("NewHostIterator error = %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	// 无效行被跳过，只返回有效行
+	if len(batch) != 1 || batch[0] != "10.0.0.1" {
+		t.Errorf("batch = %v, 期望 [10.0.0.1]", batch)
+	}
+}
+
+// =============================================================================
+// NewHostIterator 错误路径
+// =============================================================================
+
+// TestNewHostIterator_InvalidFilename 不存在的文件应返回 error
+func TestNewHostIterator_InvalidFilename(t *testing.T) {
+	_, err := NewHostIterator("", "/nonexistent/path/hosts.txt")
+	if err == nil {
+		t.Error("不存在的文件应返回 error")
+	}
+}
+
+// TestNewHostIterator_InvalidHost host 解析失败时应返回 error（并关闭已打开的文件 source）
+func TestNewHostIterator_InvalidHost_WithFile(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	if err := os.WriteFile(path, []byte("10.0.0.1\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+	// 无效 CIDR 会让 newHostSources 失败
+	_, err := NewHostIterator("999.0.0.0/8", path)
+	if err == nil {
+		t.Error("无效 host 应返回 error")
+	}
+}
+
+// TestNewHostIterator_InvalidExclude exclude 参数无效时应返回 error
+func TestNewHostIterator_InvalidExclude(t *testing.T) {
+	_, err := NewHostIterator("10.0.0.1", "", "999.0.0.0/8")
+	if err == nil {
+		t.Error("无效 exclude 应返回 error")
+	}
+}
+
+// TestNewHostIterator_EmptyExcludeSkipped 空白 exclude 条目应被跳过，不报错
+func TestNewHostIterator_EmptyExcludeSkipped(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.1", "", "   ", "")
+	if err != nil {
+		t.Fatalf("空白 exclude 不应报错: %v", err)
+	}
+	defer iter.Close()
+	host, ok, err := iter.Next()
+	if err != nil || !ok || host != "10.0.0.1" {
+		t.Errorf("Next() = %q/%v/%v", host, ok, err)
+	}
+}
+
+// =============================================================================
+// Close 路径
+// =============================================================================
+
+// TestClose_Nil nil HostIterator Close 不 panic
+func TestClose_Nil(t *testing.T) {
+	var it *HostIterator
+	if err := it.Close(); err != nil {
+		t.Errorf("nil Close 应返回 nil, 得到 %v", err)
+	}
+}
+
+// TestClose_WithCurrent 有 current source 时 Close 应关闭它
+func TestClose_WithCurrent(t *testing.T) {
+	src := &closeTrackingSource{}
+	it := &HostIterator{current: src}
+	if err := it.Close(); err != nil {
+		t.Errorf("Close error = %v", err)
+	}
+	if !src.closed {
+		t.Error("current source 应被关闭")
+	}
+	if it.current != nil {
+		t.Error("Close 后 current 应为 nil")
+	}
+}
+
+// TestClose_SourcesError Close 中 source 返回 error 应被记录
+func TestClose_SourcesError(t *testing.T) {
+	errSrc := &closeTrackingSource{err: errors.New("close error")}
+	it := &HostIterator{sources: []hostSource{errSrc}}
+	err := it.Close()
+	if err == nil {
+		t.Error("source Close 失败时应返回 error")
+	}
+	if !errSrc.closed {
+		t.Error("出错的 source 也应被调用 Close")
+	}
+}
+
+// TestClose_CurrentErrorThenSources current Close 报错，后续 source Close 成功，返回 current 的 error
+func TestClose_CurrentErrorThenSources(t *testing.T) {
+	currentSrc := &closeTrackingSource{err: errors.New("current close error")}
+	otherSrc := &closeTrackingSource{}
+	it := &HostIterator{
+		current: currentSrc,
+		sources: []hostSource{otherSrc},
+	}
+	err := it.Close()
+	if err == nil {
+		t.Error("应返回 current 的 error")
+	}
+	if !currentSrc.closed || !otherSrc.closed {
+		t.Error("两个 source 都应被关闭")
+	}
+}
+
+// =============================================================================
+// Next 错误路径
+// =============================================================================
+
+// errorSource 让 Next() 返回 error
+type errorSource struct {
+	err error
+}
+
+func (s *errorSource) Next() (string, bool, error) { return "", false, s.err }
+func (s *errorSource) Close() error                { return nil }
+
+// errorOnCloseSource Next 返回 ok=false，Close 返回 error
+type errorOnCloseSource struct {
+	err error
+}
+
+func (s *errorOnCloseSource) Next() (string, bool, error) { return "", false, nil }
+func (s *errorOnCloseSource) Close() error                { return s.err }
+
+// TestNext_SourceNextError source.Next() 返回 error 时 iter.Next 应透传
+func TestNext_SourceNextError(t *testing.T) {
+	it := &HostIterator{
+		sources: []hostSource{&errorSource{err: errors.New("next error")}},
+	}
+	_, _, err := it.Next()
+	if err == nil {
+		t.Error("source Next error 应透传")
+	}
+}
+
+// TestNext_SourceCloseError 源耗尽时 Close 报错应透传
+func TestNext_SourceCloseError(t *testing.T) {
+	it := &HostIterator{
+		sources: []hostSource{&errorOnCloseSource{err: errors.New("close error")}},
+	}
+	_, _, err := it.Next()
+	if err == nil {
+		t.Error("source 耗尽时 Close error 应透传")
+	}
+}
+
+// =============================================================================
+// NextBatch 边界条件
+// =============================================================================
+
+// TestNextBatch_ZeroSize size=0 应使用 DefaultHostBatchSize（实际受源数量限制）
+func TestNextBatch_ZeroSize(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.1", "")
+	if err != nil {
+		t.Fatalf("NewHostIterator: %v", err)
+	}
+	defer iter.Close()
+
+	// size=0 触发默认 DefaultHostBatchSize 分支，源只有一个 host
+	batch, err := iter.NextBatch(context.Background(), 0)
+	if err != nil {
+		t.Fatalf("NextBatch(0) error = %v", err)
+	}
+	if len(batch) != 1 || batch[0] != "10.0.0.1" {
+		t.Errorf("batch = %v, 期望 [10.0.0.1]", batch)
+	}
+}
+
+// TestNextBatch_NegativeSize size<0 也应使用默认值
+func TestNextBatch_NegativeSize(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.2", "")
+	if err != nil {
+		t.Fatalf("NewHostIterator: %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), -1)
+	if err != nil {
+		t.Fatalf("NextBatch(-1) error = %v", err)
+	}
+	if len(batch) != 1 || batch[0] != "10.0.0.2" {
+		t.Errorf("batch = %v, 期望 [10.0.0.2]", batch)
+	}
+}
+
+// TestNextBatch_ContextCancelled context 取消应立即返回
+func TestNextBatch_ContextCancelled(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.0/8", "")
+	if err != nil {
+		t.Fatalf("NewHostIterator: %v", err)
+	}
+	defer iter.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // 立即取消
+
+	_, err = iter.NextBatch(ctx, 100)
+	if err == nil {
+		t.Error("已取消的 context 应返回 error")
+	}
+}
+
+// TestNextBatch_DeduplicatesHosts 重复 host 只保留一个
+func TestNextBatch_DeduplicatesHosts(t *testing.T) {
+	// 两个相同的单 host source
+	it := &HostIterator{
+		sources: []hostSource{
+			&singleHostSource{host: "10.0.0.1"},
+			&singleHostSource{host: "10.0.0.1"},
+		},
+	}
+	batch, err := it.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	if len(batch) != 1 || batch[0] != "10.0.0.1" {
+		t.Errorf("batch = %v, 期望去重为 [10.0.0.1]", batch)
+	}
+}
+
+// TestNextBatch_NextError Next 报错时应透传
+func TestNextBatch_NextError(t *testing.T) {
+	it := &HostIterator{
+		sources: []hostSource{&errorSource{err: errors.New("iter error")}},
+	}
+	_, err := it.NextBatch(context.Background(), 10)
+	if err == nil {
+		t.Error("Next error 应透传到 NextBatch")
+	}
+}
+
+// =============================================================================
+// newRangeHostSource 错误路径
+// =============================================================================
+
+// TestNewRangeHostSource_TooManyDashes 超过一个 "-" 应报错（实际按首个切分：a-b-c 被 Split 成 3 段）
+func TestNewRangeHostSource_TooManyDashes(t *testing.T) {
+	// "a-b-c" Split by "-" 得到 3 段，len != 2，应报错
+	_, err := newRangeHostSource("10.0.0.1-10.0.0.5-extra")
+	if err == nil {
+		t.Error("三段格式应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidStartIP 起始 IP 无效
+func TestNewRangeHostSource_InvalidStartIP(t *testing.T) {
+	_, err := newRangeHostSource("notanip-10.0.0.5")
+	if err == nil {
+		t.Error("无效起始 IP 应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidShortTailNonNumeric 短尾不是数字应报错
+func TestNewRangeHostSource_InvalidShortTailNonNumeric(t *testing.T) {
+	// 尾部 "xyz" 不是数字
+	_, err := newRangeHostSource("10.0.0.1-xyz")
+	if err == nil {
+		t.Error("非数字短尾应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidShortTailOver255 短尾超过 255 应报错
+func TestNewRangeHostSource_InvalidShortTailOver255(t *testing.T) {
+	_, err := newRangeHostSource("10.0.0.1-300")
+	if err == nil {
+		t.Error("短尾 >255 应报错")
+	}
+}
+
+// TestNewRangeHostSource_StartGTEnd 起始 > 结束应报错
+func TestNewRangeHostSource_StartGTEnd(t *testing.T) {
+	_, err := newRangeHostSource("10.0.0.200-10.0.0.100")
+	if err == nil {
+		t.Error("start > end 应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidFullEndIP 完整结束 IP 无效（如 "10.0.0.999"）
+func TestNewRangeHostSource_InvalidFullEndIP(t *testing.T) {
+	// end IP 包含 "." 但无效
+	_, err := newRangeHostSource("10.0.0.1-10.0.0.999")
+	if err == nil {
+		t.Error("无效结束 IP 应报错")
+	}
+}
+
+// TestNewRangeHostSource_ShortTailStartGTEnd 短尾导致 start > end 应报错
+func TestNewRangeHostSource_ShortTailStartGTEnd(t *testing.T) {
+	_, err := newRangeHostSource("10.0.0.200-100")
+	if err == nil {
+		t.Error("短尾结果 start > end 应报错")
+	}
+}
+
+// =============================================================================
+// hostMatcher.addRange 错误路径
+// =============================================================================
+
+// TestAddRange_InvalidRange addRange 传入无效范围应报错
+func TestAddRange_InvalidRange(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.addRange("notvalid-range"); err == nil {
+		t.Error("无效 range 应返回 error")
+	}
+}
+
+// TestAddRange_ValidRange addRange 正常路径
+func TestAddRange_ValidRange(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.addRange("10.0.0.10-10.0.0.20"); err != nil {
+		t.Fatalf("addRange error = %v", err)
+	}
+	if !m.match("10.0.0.10") || !m.match("10.0.0.20") {
+		t.Error("addRange 边界值应命中")
+	}
+}
+
+// =============================================================================
+// hostMatcher.add 错误路径（shortcut 分支中 addCIDR 失败）
+// =============================================================================
+
+// TestHostMatcherAdd_InvalidRange add 的 range 格式无效
+func TestHostMatcherAdd_InvalidRange(t *testing.T) {
+	m := newHostMatcher()
+	// 构造一个 looksLikeIPRange 通过但 newRangeHostSource 失败的字符串
+	// "10.0.0.200-10.0.0.100" start>end 会报错
+	if err := m.add("10.0.0.200-10.0.0.100"); err == nil {
+		t.Error("无效 range (start>end) 应返回 error")
+	}
+}
+
+// =============================================================================
+// newCIDRHostSource IPv6 路径
+// =============================================================================
+
+// TestNewCIDRHostSource_IPv6Rejected IPv6 CIDR 应报错
+func TestNewCIDRHostSource_IPv6Rejected(t *testing.T) {
+	_, err := newCIDRHostSource("2001:db8::/32")
+	if err == nil {
+		t.Error("IPv6 CIDR 应被拒绝")
+	}
+}
+
+// =============================================================================
+// fileHostSource.Close 路径
+// =============================================================================
+
+// TestFileHostSource_CloseWithCurrent fileHostSource.Close 时 current != nil 分支
+func TestFileHostSource_CloseWithCurrent(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	// 写入一个 CIDR，这样 fileHostSource 会持有 current source
+	if err := os.WriteFile(path, []byte("10.0.0.0/30\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	src, err := newFileHostSource(path)
+	if err != nil {
+		t.Fatalf("newFileHostSource: %v", err)
+	}
+	// 触发 current 被设置
+	_, _, _ = src.Next()
+	// 此时 current 应非 nil，Close 应正常关闭它
+	if err := src.Close(); err != nil {
+		t.Errorf("Close with current error = %v", err)
+	}
+}
+
+// TestFileHostSource_CloseNilFile file 已经为 nil 时 Close 直接返回 nil
+func TestFileHostSource_CloseNilFile(t *testing.T) {
+	src := &fileHostSource{file: nil}
+	if err := src.Close(); err != nil {
+		t.Errorf("nil file Close error = %v", err)
+	}
+}
+
+// =============================================================================
+// multiHostSource.Close 路径
+// =============================================================================
+
+// TestMultiHostSource_CloseWithCurrent Close 时 current != nil 分支
+func TestMultiHostSource_CloseWithCurrent(t *testing.T) {
+	inner := &closeTrackingSource{}
+	ms := &multiHostSource{current: inner}
+	if err := ms.Close(); err != nil {
+		t.Errorf("Close error = %v", err)
+	}
+	if !inner.closed {
+		t.Error("current 应被关闭")
+	}
+	if ms.current != nil {
+		t.Error("Close 后 current 应为 nil")
+	}
+}
+
+// =============================================================================
+// ipToUint32 IPv6 路径
+// =============================================================================
+
+// TestIpToUint32_IPv6ReturnsFalse IPv6 地址应返回 false
+func TestIpToUint32_IPv6ReturnsFalse(t *testing.T) {
+	ip := net.ParseIP("2001:db8::1")
+	_, ok := ipToUint32(ip)
+	if ok {
+		t.Error("IPv6 地址应返回 ok=false")
+	}
+}
+
+// TestIpToUint32_NilReturnsFalse nil IP 应返回 false
+func TestIpToUint32_NilReturnsFalse(t *testing.T) {
+	_, ok := ipToUint32(nil)
+	if ok {
+		t.Error("nil IP 应返回 ok=false")
+	}
+}
+
+// =============================================================================
+// 剩余未覆盖路径
+// =============================================================================
+
+// TestFileHostSource_CurrentNextError fileHostSource.Next 中 current.Next() 报错应透传
+func TestFileHostSource_CurrentNextError(t *testing.T) {
+	src := &fileHostSource{
+		current: &errorSource{err: errors.New("inner error")},
+		// scanner 为 nil——不会走到 scanner 分支
+		scanner: bufio.NewScanner(strings.NewReader("")),
+	}
+	_, _, err := src.Next()
+	if err == nil {
+		t.Error("current.Next() 报错应透传")
+	}
+}
+
+// TestMultiHostSource_InnerNextError multiHostSource.Next 中内部 source.Next() 报错应透传
+func TestMultiHostSource_InnerNextError(t *testing.T) {
+	ms := &multiHostSource{
+		sources: []hostSource{&errorSource{err: errors.New("inner error")}},
+	}
+	_, _, err := ms.Next()
+	if err == nil {
+		t.Error("内部 source.Next() 报错应透传到 multiHostSource.Next")
+	}
+}
+
+// TestNewHostSource_RangeError newHostSource range 分支中 newRangeHostSource 失败
+func TestNewHostSource_RangeError(t *testing.T) {
+	// start > end，looksLikeIPRange 通过（前半部分是有效 IP），但 newRangeHostSource 返回错误
+	_, err := newHostSource("10.0.0.200-10.0.0.100")
+	if err == nil {
+		t.Error("start>end range 应返回 error")
+	}
+}
+
+// TestNewCIDRHostSource_IPv6DirectCall 直接调用 newCIDRHostSource 传入 IPv6 CIDR
+func TestNewCIDRHostSource_IPv6DirectCall(t *testing.T) {
+	// IPv6 CIDR —— bits=128 != 32，触发 line 332-334
+	_, err := newCIDRHostSource("::1/128")
+	if err == nil {
+		t.Error("IPv6 CIDR 应被 newCIDRHostSource 拒绝 (bits!=32)")
+	}
+}

common/parsers/parse_test.go

@@ -386,6 +386,15 @@ func TestParsePort_PortGroups(t *testing.T) {
 	}
 }
 
+func TestParsePortGroupsRequireWholeToken(t *testing.T) {
+	if got := ParsePort("web8080"); len(got) != 0 {
+		t.Fatalf("ParsePort(web8080) = %v, want empty invalid token", got)
+	}
+	if got := ParsePort("web,8080"); len(got) == 0 || got[len(got)-1] != 28018 {
+		t.Fatalf("ParsePort(web,8080) = %v, want expanded web group", got)
+	}
+}
+
 // TestParsePort_WhitespaceHandling 测试空格处理
 func TestParsePort_WhitespaceHandling(t *testing.T) {
 	tests := []struct {

common/parsers/parsers.go

@@ -200,11 +200,14 @@ func parsePortRange(rangeStr string) []int {
 // expandPortGroups 展开端口组
 func expandPortGroups(ports string) string {
 	portGroups := config.GetPortGroups()
-	result := ports
-	for group, portList := range portGroups {
-		result = strings.ReplaceAll(result, group, portList)
+	parts := strings.Split(ports, ",")
+	for i, part := range parts {
+		token := strings.TrimSpace(part)
+		if portList, ok := portGroups[token]; ok {
+			parts[i] = portList
+		}
 	}
-	return result
+	return strings.Join(parts, ",")
 }
 
 // =============================================================================

common/progress_manager.go

@@ -32,7 +32,7 @@ type ProgressManager struct {
 	current         atomic.Int64
 	description     string
 	startTime       time.Time
-	isActive        bool
+	isActive        atomic.Bool
 	terminalHeight  int
 	reservedLines   int // 为进度条保留的行数
 	lastContentLine int // 最后一行内容的位置
@@ -107,7 +107,7 @@ func GetProgressManager() *ProgressManager {
 // InitProgress 初始化进度条
 func (pm *ProgressManager) InitProgress(total int64, description string) {
 	cfg := GetGlobalConfig()
-	if cfg.Output.DisableProgress || cfg.Output.Silent {
+	if cfg.Output.DisableProgress || cfg.Output.Silent || cfg.Output.NoColor {
 		pm.enabled = false
 		return
 	}
@@ -121,7 +121,7 @@ func (pm *ProgressManager) InitProgress(total int64, description string) {
 	pm.current.Store(0)
 	pm.description = description
 	pm.startTime = time.Now()
-	pm.isActive = true
+	pm.isActive.Store(true)
 	pm.enabled = true
 	pm.lastActivity = time.Now()
 	pm.spinnerIndex = 0
@@ -139,7 +139,7 @@ func (pm *ProgressManager) InitProgress(total int64, description string) {
 
 // UpdateProgress 更新进度
 func (pm *ProgressManager) UpdateProgress(increment int64) {
-	if !pm.enabled || !pm.isActive {
+	if !pm.enabled || !pm.isActive.Load() {
 		return
 	}
 
@@ -171,7 +171,7 @@ func (pm *ProgressManager) UpdateProgress(increment int64) {
 
 // FinishProgress 完成进度条
 func (pm *ProgressManager) FinishProgress() {
-	if !pm.enabled || !pm.isActive {
+	if !pm.enabled || !pm.isActive.Load() {
 		return
 	}
 
@@ -189,7 +189,7 @@ func (pm *ProgressManager) FinishProgress() {
 
 	// 清理进度条区域，恢复正常输出
 	pm.clearProgressArea()
-	pm.isActive = false
+	pm.isActive.Store(false)
 }
 
 // setupProgressSpace 设置进度条空间
@@ -321,12 +321,13 @@ func (pm *ProgressManager) showCompletionInfo() {
 	completionMsg := i18n.GetText("progress_scan_completed")
 	doneMsg := i18n.GetText("progress_done")
 	durationMsg := i18n.GetText("progress_duration")
+	total := pm.total.Load()
 	if pm.noColor {
-		fmt.Printf("[%s] %s %d/%d (%s: %s)\n",
-			doneMsg, completionMsg, pm.total.Load(), pm.total.Load(), durationMsg, formatDuration(elapsed))
+		fmt.Printf("[%s] %s: %d/%d (%s: %s)\n",
+			doneMsg, completionMsg, total, total, durationMsg, formatDuration(elapsed))
 	} else {
-		fmt.Printf("%s[%s] %s %d/%d%s %s(%s: %s)%s\n",
-			AnsiGreen, doneMsg, completionMsg, pm.total.Load(), pm.total.Load(), AnsiReset,
+		fmt.Printf("%s[%s] %s: %d/%d%s %s(%s: %s)%s\n",
+			AnsiGreen, doneMsg, completionMsg, total, total, AnsiReset,
 			AnsiGray, durationMsg, formatDuration(elapsed), AnsiReset)
 	}
 }
@@ -341,7 +342,7 @@ func (pm *ProgressManager) clearProgressArea() {
 func (pm *ProgressManager) IsActive() bool {
 	pm.mu.RLock()
 	defer pm.mu.RUnlock()
-	return pm.isActive && pm.enabled
+	return pm.isActive.Load() && pm.enabled
 }
 
 // getTerminalHeight 获取终端高度
@@ -478,7 +479,7 @@ func (pm *ProgressManager) GetPercent() float64 {
 	pm.mu.RLock()
 	defer pm.mu.RUnlock()
 
-	if !pm.isActive || pm.total.Load() == 0 {
+	if !pm.isActive.Load() || pm.total.Load() == 0 {
 		return 0
 	}
 	return float64(pm.current.Load()) / float64(pm.total.Load()) * 100
@@ -516,7 +517,7 @@ func LogWithProgress(message string) {
 
 // renderProgressUnsafe 不加锁的进度条渲染（内部使用）
 func (pm *ProgressManager) renderProgressUnsafe() {
-	if !pm.enabled || !pm.isActive {
+	if !pm.enabled || !pm.isActive.Load() {
 		return
 	}
 
@@ -585,7 +586,7 @@ func (pm *ProgressManager) startActivityIndicator() {
 			select {
 			case <-pm.activityTicker.C:
 				// 只有在活跃状态下才更新指示器
-				if pm.isActive && pm.enabled {
+				if pm.isActive.Load() && pm.enabled {
 					pm.mu.Lock()
 					pm.spinnerIndex = (pm.spinnerIndex + 1) % len(spinnerChars)
 					pm.mu.Unlock()

common/progress_manager_test.go

@@ -0,0 +1,102 @@
+package common
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestProgressTextHelpers(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want int
+	}{
+		{name: "ascii", in: "abc", want: 3},
+		{name: "cjk", in: "中文", want: 4},
+		{name: "mixed", in: "a中", want: 3},
+		{name: "symbol", in: "★", want: 2},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := displayWidth(tt.in); got != tt.want {
+				t.Fatalf("displayWidth(%q) = %d, want %d", tt.in, got, tt.want)
+			}
+		})
+	}
+
+	truncateTests := []struct {
+		name  string
+		in    string
+		width int
+		want  string
+	}{
+		{name: "exact mixed width", in: "abc中文", width: 5, want: "abc中"},
+		{name: "wide char does not fit", in: "中文", width: 1, want: ""},
+		{name: "zero width", in: "abc", width: 0, want: ""},
+		{name: "negative width", in: "abc", width: -1, want: ""},
+	}
+	for _, tt := range truncateTests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := truncateToWidth(tt.in, tt.width); got != tt.want {
+				t.Fatalf("truncateToWidth(%q, %d) = %q, want %q", tt.in, tt.width, got, tt.want)
+			}
+		})
+	}
+
+	if got := stripAnsiCodes("\033[31mred\033[0m plain"); got != "red plain" {
+		t.Fatalf("stripAnsiCodes removed ANSI = %q, want %q", got, "red plain")
+	}
+	if got := stripAnsiCodes("plain"); got != "plain" {
+		t.Fatalf("stripAnsiCodes plain = %q, want plain", got)
+	}
+}
+
+func TestFormatDuration(t *testing.T) {
+	tests := []struct {
+		name string
+		in   time.Duration
+		want string
+	}{
+		{name: "seconds", in: 1500 * time.Millisecond, want: "1.5s"},
+		{name: "minutes", in: 90 * time.Second, want: "1.5m"},
+		{name: "hours", in: 150 * time.Minute, want: "2.5h"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := formatDuration(tt.in); got != tt.want {
+				t.Fatalf("formatDuration(%s) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestConcurrencyMonitorTaskStats(t *testing.T) {
+	monitor := &ConcurrencyMonitor{}
+
+	if status := monitor.GetConcurrencyStatus(); status != "" {
+		t.Fatalf("initial status = %q, want empty", status)
+	}
+
+	monitor.StartPluginTask()
+	monitor.StartPluginTask()
+
+	active, total := monitor.GetPluginTaskStats()
+	if active != 2 || total != 2 {
+		t.Fatalf("stats after start = active %d total %d, want 2/2", active, total)
+	}
+	if status := monitor.GetConcurrencyStatus(); !strings.HasSuffix(status, ":2") {
+		t.Fatalf("status after start = %q, want suffix :2", status)
+	}
+
+	monitor.FinishPluginTask()
+	active, total = monitor.GetPluginTaskStats()
+	if active != 1 || total != 2 {
+		t.Fatalf("stats after one finish = active %d total %d, want 1/2", active, total)
+	}
+
+	monitor.FinishPluginTask()
+	if status := monitor.GetConcurrencyStatus(); status != "" {
+		t.Fatalf("status after all finish = %q, want empty", status)
+	}
+}

common/proxy/httpdialer.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"strings"
 	"time"
 )
 
@@ -54,6 +55,9 @@ func (h *httpDialer) DialContext(ctx context.Context, network, address string) (
 
 // sendConnectRequest 发送HTTP CONNECT请求
 func (h *httpDialer) sendConnectRequest(conn net.Conn, address string) error {
+	if strings.ContainsAny(address, "\r\n") {
+		return NewProxyError(ErrTypeProtocol, "invalid CONNECT target", ErrCodeHTTPReadRespFailed, nil)
+	}
 	// 构建CONNECT请求
 	req := fmt.Sprintf(HTTPConnectRequestFormat, address, address)
 

common/proxy/httpdialer_test.go

@@ -0,0 +1,23 @@
+package proxy
+
+import (
+	"net"
+	"testing"
+	"time"
+)
+
+func TestHTTPDialerRejectsConnectTargetWithLineBreak(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	dialer := &httpDialer{
+		config: &ProxyConfig{Timeout: time.Second},
+		stats:  &ProxyStats{},
+	}
+
+	err := dialer.sendConnectRequest(client, "example.com:80\r\nX-Injected: yes")
+	if err == nil {
+		t.Fatal("sendConnectRequest() error = nil, want invalid target error")
+	}
+}

common/runtime_api_test.go

@@ -0,0 +1,62 @@
+package common
+
+import "testing"
+
+func TestResultCallbackLifecycle(t *testing.T) {
+	ClearResultCallback()
+	t.Cleanup(ClearResultCallback)
+
+	called := false
+	SetResultCallback(func(result interface{}) {
+		called = true
+		if result != "payload" {
+			t.Fatalf("callback payload = %#v", result)
+		}
+	})
+
+	NotifyResult("payload")
+	if !called {
+		t.Fatal("callback was not called")
+	}
+
+	called = false
+	ClearResultCallback()
+	NotifyResult("payload")
+	if called {
+		t.Fatal("callback should not be called after ClearResultCallback")
+	}
+}
+
+func TestStateRuntimeTargetsAndShellFlags(t *testing.T) {
+	state := NewState()
+
+	urls := []string{"http://example.com", "https://example.org"}
+	state.SetURLs(urls)
+	if got := state.GetURLs(); len(got) != 2 || got[0] != urls[0] || got[1] != urls[1] {
+		t.Fatalf("urls = %#v", got)
+	}
+
+	hostPorts := []string{"127.0.0.1:80", "[::1]:443"}
+	state.SetHostPorts(hostPorts)
+	if got := state.GetHostPorts(); len(got) != 2 || got[0] != hostPorts[0] || got[1] != hostPorts[1] {
+		t.Fatalf("hostPorts = %#v", got)
+	}
+	state.ClearHostPorts()
+	if got := state.GetHostPorts(); got != nil {
+		t.Fatalf("hostPorts after clear = %#v, want nil", got)
+	}
+
+	state.SetForwardShellActive(true)
+	state.SetReverseShellActive(true)
+	state.SetSocks5ProxyActive(true)
+	if !state.IsForwardShellActive() || !state.IsReverseShellActive() || !state.IsSocks5ProxyActive() {
+		t.Fatal("shell/proxy flags should be active")
+	}
+
+	state.SetForwardShellActive(false)
+	state.SetReverseShellActive(false)
+	state.SetSocks5ProxyActive(false)
+	if state.IsForwardShellActive() || state.IsReverseShellActive() || state.IsSocks5ProxyActive() {
+		t.Fatal("shell/proxy flags should be inactive")
+	}
+}

common/session_test.go

@@ -6,6 +6,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/shadow1ng/fscan/common/output"
 )
 
 func TestScanSessionLogMethodsHonorSilentConfig(t *testing.T) {
@@ -141,6 +143,105 @@ func TestScanSessionProxyStateComesFromConfig(t *testing.T) {
 	}
 }
 
+func TestParseProxyURLFallsBackWhenHostIsEmpty(t *testing.T) {
+	host, username, password := parseProxyURL("127.0.0.1:8080", "127.0.0.1:8080")
+	if host != "127.0.0.1:8080" {
+		t.Fatalf("host = %q, want fallback address", host)
+	}
+	if username != "" || password != "" {
+		t.Fatalf("unexpected credentials: %q/%q", username, password)
+	}
+}
+
+func TestParseProxyURLExtractsAuthWithoutScheme(t *testing.T) {
+	host, username, password := parseProxyURL("user:[email protected]:8080", "user:[email protected]:8080")
+	if host != "127.0.0.1:8080" {
+		t.Fatalf("host = %q, want proxy address", host)
+	}
+	if username != "user" || password != "pass" {
+		t.Fatalf("credentials = %q/%q, want user/pass", username, password)
+	}
+}
+
+// TestScanSessionSaveResultUsesSink 测试 SaveResult 通过 ResultSink 分发
+func TestScanSessionSaveResultUsesSink(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	cfg := NewConfig()
+	cfg.Output.DisableSave = true
+	SetGlobalConfig(cfg)
+	flagVars = &FlagVars{DisableSave: true}
+	_ = InitOutput()
+
+	var sinkGot *output.ScanResult
+	session := NewScanSession(cfg, NewState(), &FlagVars{})
+	session.ResultSink = func(r *output.ScanResult) error {
+		sinkGot = r
+		return nil
+	}
+
+	result := &output.ScanResult{
+		Type:   output.TypeHost,
+		Target: "10.0.0.1",
+		Status: "ALIVE",
+	}
+	if err := session.SaveResult(result); err != nil {
+		t.Fatalf("session.SaveResult error = %v", err)
+	}
+	if sinkGot != result {
+		t.Fatalf("ResultSink 未被调用或参数不符: got %v", sinkGot)
+	}
+}
+
+// TestScanSessionSaveResultFallsBackToGlobal 测试无 sink 时回退到全局 SaveResult
+func TestScanSessionSaveResultFallsBackToGlobal(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	cfg := NewConfig()
+	cfg.Output.DisableSave = true
+	SetGlobalConfig(cfg)
+	flagVars = &FlagVars{DisableSave: true}
+	_ = InitOutput()
+
+	called := false
+	SetResultCallback(func(payload interface{}) {
+		called = true
+	})
+
+	session := NewScanSession(cfg, NewState(), &FlagVars{})
+	// 不设置 ResultSink，应回退到全局
+
+	result := &output.ScanResult{
+		Type:   output.TypeHost,
+		Target: "10.0.0.2",
+		Status: "ALIVE",
+	}
+	if err := session.SaveResult(result); err != nil {
+		t.Fatalf("session.SaveResult (fallback) error = %v", err)
+	}
+	if !called {
+		t.Fatal("回退到全局 SaveResult 时应触发 ResultCallback")
+	}
+}
+
+// TestScanSessionLogMethodsEnabledByDefault 测试非 Silent 配置下 Log 方法不被屏蔽
+func TestScanSessionLogMethodsEnabledByDefault(t *testing.T) {
+	cfg := NewConfig()
+	cfg.Output.Silent = false
+	session := NewScanSession(cfg, NewState(), &FlagVars{})
+	if !session.loggingEnabled() {
+		t.Fatal("非 Silent 配置下 loggingEnabled 应返回 true")
+	}
+}
+
+// TestNilScanSessionLoggingEnabled 测试 nil session 的 loggingEnabled
+func TestNilScanSessionLoggingEnabled(t *testing.T) {
+	var session *ScanSession
+	if !session.loggingEnabled() {
+		t.Fatal("nil session 的 loggingEnabled 应返回 true（安全降级）")
+	}
+}
+
 type roundTripFunc func(*http.Request) (*http.Response, error)
 
 func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {

common/state.go

@@ -56,6 +56,10 @@ type State struct {
 	forwardShellActive int32 // 使用int32以便原子操作
 	reverseShellActive int32
 	socks5ProxyActive  int32
+
+	// 服务识别缓存（per-session，避免跨扫描污染）
+	// key: "host:port", value: interface{}（core.ServiceInfo 指针）
+	serviceCache sync.Map
 }
 
 // NewState 创建新的状态对象
@@ -455,3 +459,17 @@ func (s *State) CheckAndIncrementPacketRate(rateLimit int64) (bool, error) {
 
 	return true, nil
 }
+
+// =============================================================================
+// 服务识别缓存 - per-session，消除跨扫描污染
+// =============================================================================
+
+// CacheService 缓存服务信息
+func (s *State) CacheService(key string, info interface{}) {
+	s.serviceCache.Store(key, info)
+}
+
+// GetCachedService 获取缓存的服务信息
+func (s *State) GetCachedService(key string) (interface{}, bool) {
+	return s.serviceCache.Load(key)
+}

common/state_test.go

@@ -215,6 +215,301 @@ func TestState_ConcurrentTaskCounters(t *testing.T) {
 	}
 }
 
+// TestState_GetOutputMutex 测试获取输出互斥锁指针
+func TestState_GetOutputMutex(t *testing.T) {
+	s := NewState()
+	mu := s.GetOutputMutex()
+	if mu == nil {
+		t.Fatal("GetOutputMutex returned nil")
+	}
+	// 验证返回的指针可以正常加锁解锁
+	mu.Lock()
+	_ = 1 //nolint:staticcheck // SA2001: 故意测试空临界区
+	mu.Unlock()
+}
+
+// TestState_GetICMPLimiter 测试 ICMP 限速器延迟初始化
+func TestState_GetICMPLimiter(t *testing.T) {
+	s := NewState()
+
+	limiter := s.GetICMPLimiter(0.1)
+	if limiter == nil {
+		t.Fatal("GetICMPLimiter returned nil")
+	}
+
+	// 再次调用应返回同一个实例（sync.Once 保证）
+	limiter2 := s.GetICMPLimiter(0.5)
+	if limiter != limiter2 {
+		t.Fatal("GetICMPLimiter should return the same instance on repeated calls")
+	}
+}
+
+// TestState_GetICMPLimiterMinRate 测试极低速率下的 ICMP 限速器
+func TestState_GetICMPLimiterMinRate(t *testing.T) {
+	s := NewState()
+	// 极低速率（packetsPerSecond < 1）应被钳位到 1
+	limiter := s.GetICMPLimiter(0.000001)
+	if limiter == nil {
+		t.Fatal("GetICMPLimiter with tiny rate returned nil")
+	}
+}
+
+// TestState_GetPerfStats 测试性能统计数据
+func TestState_GetPerfStats(t *testing.T) {
+	s := NewState()
+
+	// 初始状态：全零
+	stats := s.GetPerfStats()
+	if stats.TotalPackets != 0 {
+		t.Errorf("初始 TotalPackets 应为 0, 实际 %d", stats.TotalPackets)
+	}
+	if stats.SuccessRate != 0 {
+		t.Errorf("初始 SuccessRate 应为 0, 实际 %f", stats.SuccessRate)
+	}
+
+	// 增加一些计数后验证统计
+	s.IncrementTCPSuccessPacketCount()
+	s.IncrementTCPSuccessPacketCount()
+	s.IncrementTCPFailedPacketCount()
+	s.SetNum(3)
+
+	stats = s.GetPerfStats()
+	if stats.TotalPackets != 3 {
+		t.Errorf("TotalPackets 期望 3, 实际 %d", stats.TotalPackets)
+	}
+	if stats.TCPSuccess != 2 {
+		t.Errorf("TCPSuccess 期望 2, 实际 %d", stats.TCPSuccess)
+	}
+	if stats.TCPFailed != 1 {
+		t.Errorf("TCPFailed 期望 1, 实际 %d", stats.TCPFailed)
+	}
+	if stats.TargetsScanned != 3 {
+		t.Errorf("TargetsScanned 期望 3, 实际 %d", stats.TargetsScanned)
+	}
+	// success rate = 2/3 * 100 ≈ 66.67%
+	if stats.SuccessRate < 66 || stats.SuccessRate > 67 {
+		t.Errorf("SuccessRate 期望约 66.67, 实际 %f", stats.SuccessRate)
+	}
+}
+
+// TestState_GetPerfStatsJSON 测试性能统计 JSON 序列化
+func TestState_GetPerfStatsJSON(t *testing.T) {
+	s := NewState()
+	s.IncrementTCPSuccessPacketCount()
+
+	json := s.GetPerfStatsJSON()
+	if json == "" || json == "{}" {
+		t.Fatalf("GetPerfStatsJSON 返回空: %q", json)
+	}
+	if len(json) < 10 {
+		t.Fatalf("GetPerfStatsJSON 内容过短: %q", json)
+	}
+	// 验证包含关键字段
+	for _, key := range []string{"total_packets", "tcp_success", "success_rate"} {
+		if !containsStr(json, key) {
+			t.Errorf("GetPerfStatsJSON 缺少字段 %q", key)
+		}
+	}
+}
+
+func containsStr(s, sub string) bool {
+	return len(s) >= len(sub) && (s == sub || len(s) > 0 && stringContains(s, sub))
+}
+
+func stringContains(s, sub string) bool {
+	for i := 0; i <= len(s)-len(sub); i++ {
+		if s[i:i+len(sub)] == sub {
+			return true
+		}
+	}
+	return false
+}
+
+// TestState_GetPacketLimiter 测试通用发包限速器
+func TestState_GetPacketLimiter(t *testing.T) {
+	t.Run("零速率返回nil", func(t *testing.T) {
+		s := NewState()
+		limiter := s.GetPacketLimiter(0)
+		if limiter != nil {
+			t.Fatal("零速率应返回 nil limiter")
+		}
+	})
+
+	t.Run("负速率返回nil", func(t *testing.T) {
+		s := NewState()
+		limiter := s.GetPacketLimiter(-1)
+		if limiter != nil {
+			t.Fatal("负速率应返回 nil limiter")
+		}
+	})
+
+	t.Run("正速率初始化限速器", func(t *testing.T) {
+		s := NewState()
+		limiter := s.GetPacketLimiter(600) // 600/min = 10/s
+		if limiter == nil {
+			t.Fatal("正速率应返回非 nil limiter")
+		}
+		// 再次调用返回同一实例
+		limiter2 := s.GetPacketLimiter(1200)
+		if limiter != limiter2 {
+			t.Fatal("GetPacketLimiter 应通过 sync.Once 复用实例")
+		}
+	})
+
+	t.Run("低速率被钳位到1pps", func(t *testing.T) {
+		s := NewState()
+		// 1/min < 1/s，应被钳位
+		limiter := s.GetPacketLimiter(1)
+		if limiter == nil {
+			t.Fatal("低速率钳位后应返回非 nil limiter")
+		}
+	})
+}
+
+// TestState_CacheService 测试服务识别缓存
+func TestState_CacheService(t *testing.T) {
+	s := NewState()
+
+	// 未缓存时查询返回 false
+	_, ok := s.GetCachedService("192.168.1.1:80")
+	if ok {
+		t.Fatal("未缓存的 key 不应返回 ok=true")
+	}
+
+	// 缓存并查询
+	type fakeInfo struct{ Name string }
+	info := &fakeInfo{Name: "http"}
+	s.CacheService("192.168.1.1:80", info)
+
+	got, ok := s.GetCachedService("192.168.1.1:80")
+	if !ok {
+		t.Fatal("已缓存的 key 应返回 ok=true")
+	}
+	if got != info {
+		t.Fatalf("GetCachedService 返回 %v, 期望 %v", got, info)
+	}
+
+	// 不同 key 互不干扰
+	_, ok = s.GetCachedService("192.168.1.1:443")
+	if ok {
+		t.Fatal("不同 key 不应命中缓存")
+	}
+}
+
+// =============================================================================
+// CheckAndIncrementPacketRate 测试
+// =============================================================================
+
+// TestCheckAndIncrementPacketRate_ZeroLimit 速率为 0 时无限制
+func TestCheckAndIncrementPacketRate_ZeroLimit(t *testing.T) {
+	s := NewState()
+	for i := 0; i < 1000; i++ {
+		ok, err := s.CheckAndIncrementPacketRate(0)
+		if !ok || err != nil {
+			t.Fatalf("零速率限制应始终允许: ok=%v err=%v", ok, err)
+		}
+	}
+}
+
+// TestCheckAndIncrementPacketRate_NegativeLimit 负速率等同于无限制
+func TestCheckAndIncrementPacketRate_NegativeLimit(t *testing.T) {
+	s := NewState()
+	ok, err := s.CheckAndIncrementPacketRate(-1)
+	if !ok || err != nil {
+		t.Fatalf("负速率应允许: ok=%v err=%v", ok, err)
+	}
+}
+
+// TestCheckAndIncrementPacketRate_AllowsWhenTokensAvailable 有令牌时返回 true
+func TestCheckAndIncrementPacketRate_AllowsWhenTokensAvailable(t *testing.T) {
+	s := NewState()
+	// 600/min = 10/s，桶容量 20，初始满桶
+	ok, err := s.CheckAndIncrementPacketRate(600)
+	if !ok || err != nil {
+		t.Fatalf("初始应有令牌: ok=%v err=%v", ok, err)
+	}
+}
+
+// TestCheckAndIncrementPacketRate_RateLimitedAfterExhaustion 耗尽令牌后返回 false 和 PacketLimitError
+func TestCheckAndIncrementPacketRate_RateLimitedAfterExhaustion(t *testing.T) {
+	s := NewState()
+	// 极低速率：1/min，桶容量为 1（钳位后 packetsPerSecond=1，capacity=2）
+	// 消耗掉所有令牌后应被限速
+	const limit int64 = 1
+
+	// 初始化限速器（第一次调用触发 sync.Once）
+	s.GetPacketLimiter(limit)
+
+	// 消耗完所有令牌（容量 <= 2）
+	for i := 0; i < 10; i++ {
+		s.CheckAndIncrementPacketRate(limit) //nolint: errcheck
+	}
+
+	// 此时令牌应已耗尽，下一次调用应被限速
+	ok, err := s.CheckAndIncrementPacketRate(limit)
+	if ok {
+		// 桶可能还剩令牌（容量 2），多耗几次再判断
+		for i := 0; i < 20; i++ {
+			ok, err = s.CheckAndIncrementPacketRate(limit)
+			if !ok {
+				break
+			}
+		}
+	}
+
+	if ok {
+		t.Fatal("令牌耗尽后应返回 ok=false")
+	}
+	if err == nil {
+		t.Fatal("令牌耗尽后应返回 error")
+	}
+	if !isPacketLimitError(err) {
+		t.Errorf("error 类型应为 PacketLimitError, 实际 %T: %v", err, err)
+	}
+}
+
+// isPacketLimitError 检查是否为 PacketLimitError
+func isPacketLimitError(err error) bool {
+	_, ok := err.(*PacketLimitError)
+	return ok
+}
+
+// TestCheckAndIncrementPacketRate_ErrorUnwrapsToSentinel 验证 error 可 unwrap 到 sentinel
+func TestCheckAndIncrementPacketRate_ErrorUnwrapsToSentinel(t *testing.T) {
+	s := NewState()
+	const limit int64 = 1
+
+	// 耗尽令牌
+	for i := 0; i < 50; i++ {
+		s.CheckAndIncrementPacketRate(limit) //nolint: errcheck
+	}
+
+	var lastErr error
+	for i := 0; i < 10; i++ {
+		ok, err := s.CheckAndIncrementPacketRate(limit)
+		if !ok {
+			lastErr = err
+			break
+		}
+	}
+
+	if lastErr == nil {
+		t.Skip("未能触发限速（可能令牌桶容量较大），跳过 unwrap 测试")
+	}
+
+	// 验证可 unwrap 到 ErrPacketRateLimited
+	pErr, ok := lastErr.(*PacketLimitError)
+	if !ok {
+		t.Fatalf("期望 *PacketLimitError, 实际 %T", lastErr)
+	}
+	if pErr.Sentinel != ErrPacketRateLimited {
+		t.Errorf("Sentinel = %v, 期望 ErrPacketRateLimited", pErr.Sentinel)
+	}
+	if pErr.Limit != limit {
+		t.Errorf("Limit = %d, 期望 %d", pErr.Limit, limit)
+	}
+}
+
 // TestState_OutputMutex 测试输出互斥锁
 func TestState_OutputMutex(t *testing.T) {
 	s := NewState()

core/adaptive_pool.go

@@ -1,7 +1,6 @@
 package core
 
 import (
-	"fmt"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -11,140 +10,303 @@ import (
 	"github.com/shadow1ng/fscan/common/i18n"
 )
 
-// AdaptivePool 自适应线程池
-// 封装 ants.PoolWithFunc，支持根据资源耗尽率动态调整线程数
+// HealthSignal 健康评估结果
+type HealthSignal int
+
+const (
+	HealthUnknown   HealthSignal = iota // 样本不足，无法判断
+	HealthGood                          // 一切正常，可以提速
+	HealthOK                            // 正常，维持现状
+	HealthStressed                      // 有压力信号，轻微降速
+	HealthCongested                     // 明确拥塞，大幅降速
+)
+
+// AdaptivePool 自适应线程池（AIMD + 慢启动）
+//
+// 三阶段工作模式：
+//  1. 慢启动：从 target/4 起步，每个检查周期翻倍，直到达到 target 或检测到拥塞
+//  2. 稳态 AIMD：健康时加性增（+5% target），拥塞时乘性减（×0.5）
+//  3. 恢复上限受 ceiling 约束，不会无限增长
+//
+// 健康评估基于两个信号：
+//   - 资源耗尽率（fd/端口不足）
+//   - RTT 趋势（fast EMA / slow EMA）
 type AdaptivePool struct {
-	pool  *ants.PoolWithFunc
-	state *common.State
+	pool    *ants.PoolWithFunc
+	metrics *ScanMetrics
 
-	initialSize int
-	minSize     int
-	maxSize     int
-	currentSize int32 // 原子操作
+	// 网络环境（影响健康评估阈值）
+	networkEnv NetworkEnv
 
-	// 监控参数
-	checkInterval      time.Duration
-	lastCheckNano      atomic.Int64 // UnixNano
-	lastExhaustedCount int64
-	lastPacketCount    int64
+	// 并发控制
+	target      int32 // 探测推荐的目标值
+	ceiling     int32 // 绝对上限（用户指定或探测推荐）
+	currentSize int32
 
-	// 阈值
-	exhaustedThreshold float64 // 资源耗尽率阈值（触发降级）
-	recoveryThreshold  float64 // 恢复阈值（允许升级）
+	// 慢启动
+	inSlowStart bool
+	ssThreshold int32 // 慢启动阈值（拥塞后降为当前值）
 
-	mu sync.Mutex
+	// 检查定时
+	checkInterval time.Duration
+	lastCheck     atomic.Int64 // UnixNano
+
+	// 增量计算
+	mu           sync.Mutex
+	prevSnapshot MetricsSnapshot
 }
 
 // NewAdaptivePool 创建自适应线程池
-func NewAdaptivePool(size int, fn func(interface{}), state *common.State) (*AdaptivePool, error) {
-	// 移除 WithPreAlloc(true)，在大规模扫描时预分配可能导致内存问题
-	pool, err := ants.NewPoolWithFunc(size, fn)
+// target: 目标并发数（来自 NetworkProfile.RecommendConcurrency）
+// ceiling: 最大并发上限
+// metrics: 共享的扫描度量（scanSinglePort 写入，pool 读取）
+func NewAdaptivePool(target, ceiling int, fn func(interface{}), metrics *ScanMetrics, env ...NetworkEnv) (*AdaptivePool, error) {
+	// 慢启动初始值：target 的 25%，但不低于 10
+	initial := target / 4
+	if initial < 10 {
+		initial = 10
+	}
+	if initial > target {
+		initial = target
+	}
+
+	pool, err := ants.NewPoolWithFunc(initial, fn)
 	if err != nil {
 		return nil, err
 	}
 
-	minSize := size / 4
-	if minSize < 10 {
-		minSize = 10
+	netEnv := EnvWAN
+	if len(env) > 0 {
+		netEnv = env[0]
 	}
 
 	return &AdaptivePool{
-		pool:               pool,
-		state:              state,
-		initialSize:        size,
-		minSize:            minSize,
-		maxSize:            size,
-		currentSize:        int32(size),
-		checkInterval:      time.Second,
-		exhaustedThreshold: 0.10, // 10% 资源耗尽率触发降级
-		recoveryThreshold:  0.02, // 2% 以下允许恢复
+		pool:          pool,
+		metrics:       metrics,
+		networkEnv:    netEnv,
+		target:        int32(target),
+		ceiling:       int32(ceiling),
+		currentSize:   int32(initial),
+		inSlowStart:   true,
+		ssThreshold:   int32(target),
+		checkInterval: 500 * time.Millisecond,
 	}, nil
 }
 
-// Invoke 提交任务，并在适当时机检查是否需要调整线程数
+// Invoke 提交任务
 func (ap *AdaptivePool) Invoke(task interface{}) error {
 	ap.maybeAdjust()
 	return ap.pool.Invoke(task)
 }
 
-// maybeAdjust 检查并可能调整线程池大小
-// 使用原子 CAS 进行时间检查，99%+ 的调用零锁开销
+// maybeAdjust 周期性检查并调整并发数
 func (ap *AdaptivePool) maybeAdjust() {
-	lastCheck := ap.lastCheckNano.Load()
+	last := ap.lastCheck.Load()
 	now := time.Now().UnixNano()
-	if now-lastCheck < int64(ap.checkInterval) {
+	if now-last < int64(ap.checkInterval) {
 		return
 	}
-	if !ap.lastCheckNano.CompareAndSwap(lastCheck, now) {
-		return // 其他 goroutine 已在检查
-	}
-
-	// 获取当前计数
-	currentExhausted := ap.state.GetResourceExhaustedCount()
-	currentPackets := ap.state.GetPacketCount()
-
-	ap.mu.Lock()
-	// 计算增量（本周期内的耗尽率）
-	deltaExhausted := currentExhausted - ap.lastExhaustedCount
-	deltaPackets := currentPackets - ap.lastPacketCount
-
-	ap.lastExhaustedCount = currentExhausted
-	ap.lastPacketCount = currentPackets
-	ap.mu.Unlock()
-
-	// 需要足够的样本才能判断
-	if deltaPackets < 100 {
+	if !ap.lastCheck.CompareAndSwap(last, now) {
 		return
 	}
 
-	rate := float64(deltaExhausted) / float64(deltaPackets)
-	currentSize := int(atomic.LoadInt32(&ap.currentSize))
+	ap.adjust()
+}
 
-	if rate > ap.exhaustedThreshold && currentSize > ap.minSize {
-		// 降级：减少 20% 线程
-		newSize := int(float64(currentSize) * 0.8)
-		if newSize < ap.minSize {
-			newSize = ap.minSize
-		}
+func (ap *AdaptivePool) adjust() {
+	health := ap.assessHealth()
+	if health == HealthUnknown {
+		return
+	}
+
+	// RTT 漂移微调：fast EMA 远高于 slow EMA 说明延迟持续恶化
+	// 压低 target 让 AIMD 的天花板跟着降，而不是只靠乘性减
+	ap.maybeReduceTarget()
+
+	current := int(atomic.LoadInt32(&ap.currentSize))
+	target := int(atomic.LoadInt32(&ap.target))
+	ceiling := int(atomic.LoadInt32(&ap.ceiling))
+
+	var newSize int
+
+	if ap.inSlowStart {
+		newSize = ap.adjustSlowStart(health, current, target)
+	} else {
+		newSize = ap.adjustAIMD(health, current, target)
+	}
+
+	// 下限：ceiling 的 5%，但不低于 10
+	minSize := ceiling / 20
+	if minSize < 10 {
+		minSize = 10
+	}
+
+	if newSize < minSize {
+		newSize = minSize
+	}
+	if newSize > ceiling {
+		newSize = ceiling
+	}
+
+	if newSize != current {
 		ap.tune(newSize)
-		common.LogInfo(i18n.Tr("adaptive_pool_resource_exhausted", fmt.Sprintf("%.1f", rate*100), currentSize, newSize))
-	} else if rate < ap.recoveryThreshold && currentSize < ap.maxSize {
-		// 恢复：增加 10% 线程（保守恢复）
-		newSize := int(float64(currentSize) * 1.1)
-		if newSize > ap.maxSize {
-			newSize = ap.maxSize
+
+		// 显著变化时记录日志
+		delta := newSize - current
+		if delta < 0 {
+			delta = -delta
 		}
-		if newSize > currentSize {
-			ap.tune(newSize)
+		if delta > current/5 {
+			if newSize < current {
+				common.LogInfo(i18n.Tr("adaptive_pool_decrease", current, newSize))
+			} else {
+				common.LogDebug(i18n.Tr("adaptive_pool_increase", current, newSize))
+			}
 		}
 	}
 }
 
-// tune 调整线程池大小
+func (ap *AdaptivePool) adjustSlowStart(health HealthSignal, current, target int) int {
+	switch health {
+	case HealthCongested, HealthStressed:
+		// 退出慢启动，设置阈值
+		ap.ssThreshold = int32(current)
+		ap.inSlowStart = false
+		common.LogDebug(i18n.Tr("adaptive_pool_slowstart_exit", current))
+		return int(float64(current) * 0.5)
+	default:
+		// 翻倍
+		newSize := current * 2
+		if newSize >= target {
+			newSize = target
+			ap.inSlowStart = false
+		}
+		return newSize
+	}
+}
+
+func (ap *AdaptivePool) adjustAIMD(health HealthSignal, current, target int) int {
+	switch health {
+	case HealthCongested:
+		// 乘性减：×0.5
+		newSize := int(float64(current) * 0.5)
+		ap.ssThreshold = int32(newSize)
+		return newSize
+	case HealthStressed:
+		// 温和降低：×0.85
+		return int(float64(current) * 0.85)
+	case HealthGood:
+		// 加性增：+5% of target，至少 +1
+		inc := target / 20
+		if inc < 1 {
+			inc = 1
+		}
+		return current + inc
+	default:
+		return current
+	}
+}
+
+// assessHealth 综合健康评估
+func (ap *AdaptivePool) assessHealth() HealthSignal {
+	snap := ap.metrics.Snapshot()
+
+	ap.mu.Lock()
+	prev := ap.prevSnapshot
+	ap.prevSnapshot = snap
+	ap.mu.Unlock()
+
+	// 计算本周期增量
+	deltaTotal := snap.Total() - prev.Total()
+	deltaExhausted := snap.Exhausted - prev.Exhausted
+
+	// 样本不足
+	if deltaTotal < 30 {
+		return HealthUnknown
+	}
+
+	exhaustRate := float64(deltaExhausted) / float64(deltaTotal)
+	rttRatio := ap.metrics.RTTRatio()
+
+	// 阈值根据网络环境调整：内网收紧，公网放宽
+	var congestExhaust, stressExhaust, congestRTT, stressRTT, goodRTT float64
+	switch ap.networkEnv {
+	case EnvLAN:
+		congestExhaust, stressExhaust = 0.08, 0.03
+		congestRTT, stressRTT, goodRTT = 1.8, 1.4, 1.15
+	case EnvWAN:
+		congestExhaust, stressExhaust = 0.15, 0.05
+		congestRTT, stressRTT, goodRTT = 2.5, 1.8, 1.3
+	default: // Internet / Slow
+		congestExhaust, stressExhaust = 0.25, 0.10
+		congestRTT, stressRTT, goodRTT = 3.5, 2.5, 1.5
+	}
+
+	switch {
+	case exhaustRate > congestExhaust:
+		return HealthCongested
+	case rttRatio > congestRTT:
+		return HealthCongested
+	case exhaustRate > stressExhaust:
+		return HealthStressed
+	case rttRatio > stressRTT:
+		return HealthStressed
+	case exhaustRate < 0.01 && rttRatio < goodRTT:
+		return HealthGood
+	default:
+		return HealthOK
+	}
+}
+
+// maybeReduceTarget 当 RTT 持续恶化时压低 target
+// 不低于 ceiling 的 20%，避免过度收缩
+func (ap *AdaptivePool) maybeReduceTarget() {
+	rttRatio := ap.metrics.RTTRatio()
+	if rttRatio <= 3.0 {
+		return
+	}
+
+	target := atomic.LoadInt32(&ap.target)
+	ceiling := atomic.LoadInt32(&ap.ceiling)
+	minTarget := ceiling / 5
+	if minTarget < 10 {
+		minTarget = 10
+	}
+
+	// 压低 10%
+	newTarget := int32(float64(target) * 0.9)
+	if newTarget < minTarget {
+		newTarget = minTarget
+	}
+	if newTarget < target {
+		atomic.StoreInt32(&ap.target, newTarget)
+	}
+}
+
 func (ap *AdaptivePool) tune(newSize int) {
 	ap.pool.Tune(newSize)
 	atomic.StoreInt32(&ap.currentSize, int32(newSize))
 }
 
 // Running 返回当前运行中的 goroutine 数量
-func (ap *AdaptivePool) Running() int {
-	return ap.pool.Running()
-}
+func (ap *AdaptivePool) Running() int { return ap.pool.Running() }
 
 // Cap 返回当前池容量
-func (ap *AdaptivePool) Cap() int {
-	return int(atomic.LoadInt32(&ap.currentSize))
-}
+func (ap *AdaptivePool) Cap() int { return int(atomic.LoadInt32(&ap.currentSize)) }
 
 // Release 释放线程池
-func (ap *AdaptivePool) Release() {
-	ap.pool.Release()
-}
+func (ap *AdaptivePool) Release() { ap.pool.Release() }
 
-// Wait 等待所有任务完成
+// Wait 等待所有任务完成（最多等待 10 分钟）
 func (ap *AdaptivePool) Wait() {
-	// ants 没有原生 Wait，通过 Running() == 0 轮询
+	deadline := time.After(10 * time.Minute)
 	for ap.pool.Running() > 0 {
-		time.Sleep(10 * time.Millisecond)
+		select {
+		case <-deadline:
+			common.LogError(i18n.Tr("adaptive_pool_wait_timeout"))
+			return
+		default:
+			time.Sleep(10 * time.Millisecond)
+		}
 	}
 }

core/adaptive_pool_test.go

@@ -1,160 +1,102 @@
 package core
 
-/*
-adaptive_pool_test.go - AdaptivePool 高价值测试
-
-测试重点：
-1. 并发安全 - 多goroutine同时调整不崩溃
-2. 降级逻辑 - 资源耗尽率高时正确减少线程
-3. 恢复逻辑 - 资源耗尽率低时正确增加线程
-4. 边界条件 - 不超过minSize/maxSize
-
-不测试：
-- 简单的getter方法（太简单，不值得）
-- ants库本身的正确性（库作者负责）
-*/
-
 import (
+	"sync/atomic"
 	"testing"
 	"time"
-
-	"github.com/shadow1ng/fscan/common"
 )
 
-// =============================================================================
-// 场景1：降级逻辑测试（高价值）
-// =============================================================================
-
-// TestAdaptivePool_DowngradeOnHighExhaustion 验证资源耗尽率高时降低线程数
-// 这是个核心业务逻辑：耗尽率 > 10% 时应该减少线程
-func TestAdaptivePool_DowngradeOnHighExhaustion(t *testing.T) {
-	state := common.NewState()
-
-	pool, err := NewAdaptivePool(100, func(interface{}) {}, state)
+// newTestPool 测试辅助：创建测试用的自适应线程池
+func newTestPool(t *testing.T, size int, fn func(interface{})) (*AdaptivePool, *ScanMetrics) {
+	t.Helper()
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(size, size, fn, metrics)
 	if err != nil {
 		t.Fatalf("创建线程池失败: %v", err)
 	}
+	return pool, metrics
+}
+
+// TestAdaptivePool_DowngradeOnHighExhaustion 验证资源耗尽率高时降低线程数
+func TestAdaptivePool_DowngradeOnHighExhaustion(t *testing.T) {
+	pool, metrics := newTestPool(t, 100, func(interface{}) {})
 	defer pool.Release()
 
+	// 慢启动先跑到 target
+	pool.inSlowStart = false
+	pool.tune(100)
+
 	initialCap := pool.Cap()
 
-	// 模拟高资源耗尽率：20% 的包都失败了
-	// 需要至少100个样本才会触发调整
+	// 模拟高资源耗尽率：20%
 	for i := 0; i < 200; i++ {
-		state.IncrementPacketCount()
-		if i < 40 { // 前40个失败（20%）
-			state.IncrementResourceExhaustedCount()
+		if i < 40 {
+			metrics.RecordExhausted()
+		} else {
+			metrics.RecordConnect(time.Millisecond)
 		}
 	}
 
-	// 触发调整：提交足够多的任务让maybeAdjust被调用
+	// 触发调整
 	for i := 0; i < 20; i++ {
 		_ = pool.Invoke(nil)
-		time.Sleep(time.Millisecond * 10) // 等待异步调整
+		time.Sleep(time.Millisecond * 30)
 	}
 
-	// 等待调整完成
-	time.Sleep(time.Millisecond * 50)
-
 	finalCap := pool.Cap()
 
-	// 验证：线程数应该减少
 	if finalCap >= initialCap {
 		t.Errorf("应该降级: 初始 %d, 最终 %d", initialCap, finalCap)
 	}
 
-	// 验证：不应该降到minSize以下
-	minSize := initialCap / 4
-	if minSize < 10 {
-		minSize = 10
-	}
-	if finalCap < minSize {
-		t.Errorf("降到minSize以下: %d < %d", finalCap, minSize)
+	if finalCap < 10 {
+		t.Errorf("降到 minSize 以下: %d", finalCap)
 	}
 
-	t.Logf("降级成功: %d -> %d (min=%d)", initialCap, finalCap, minSize)
+	t.Logf("降级成功: %d -> %d", initialCap, finalCap)
 }
 
-// =============================================================================
-// 场景3：恢复逻辑测试（高价值）
-// =============================================================================
-
-// TestAdaptivePool_NoRecoveryOnLowExhaustion 验证低耗尽率时不升级
-// 防止线程数盲目增长
-func TestAdaptivePool_NoRecoveryOnLowExhaustion(t *testing.T) {
-	state := common.NewState()
-
-	pool, err := NewAdaptivePool(50, func(interface{}) {}, state)
+// TestAdaptivePool_SlowStart 验证慢启动行为
+func TestAdaptivePool_SlowStart(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics)
 	if err != nil {
 		t.Fatalf("创建线程池失败: %v", err)
 	}
 	defer pool.Release()
 
-	// 先降到minSize
-	for i := 0; i < 500; i++ {
-		state.IncrementPacketCount()
-		state.IncrementResourceExhaustedCount() // 100% 耗尽
+	// 初始应该是 target/4 = 25
+	initialCap := pool.Cap()
+	if initialCap > 30 {
+		t.Errorf("慢启动初始值应该 <= 30, got %d", initialCap)
 	}
 
-	for i := 0; i < 20; i++ {
-		_ = pool.Invoke(nil)
-	}
-	time.Sleep(time.Millisecond * 50)
-
-	reducedCap := pool.Cap()
-
-	// 现在模拟低耗尽率：只有1%失败
-	for i := 0; i < 500; i++ {
-		state.IncrementPacketCount()
-		if i%100 == 0 { // 只有5个失败（1%）
-			state.IncrementResourceExhaustedCount()
-		}
+	if !pool.inSlowStart {
+		t.Error("应该处于慢启动状态")
 	}
 
-	for i := 0; i < 20; i++ {
-		_ = pool.Invoke(nil)
-	}
-	time.Sleep(time.Millisecond * 50)
-
-	finalCap := pool.Cap()
-
-	// 验证：即使耗尽率低，也不应该立即恢复（保守策略）
-	// 或者即使恢复，也很有限
-	if finalCap > reducedCap+5 {
-		t.Logf("恢复行为: %d -> %d", reducedCap, finalCap)
-	}
+	t.Logf("慢启动初始: cap=%d, inSlowStart=%v", initialCap, pool.inSlowStart)
 }
 
-// =============================================================================
-// 场景4：边界条件测试（中价值）
-// =============================================================================
-
-// TestAdaptivePool_MinSizeBoundary 验证不会降到minSize以下
+// TestAdaptivePool_MinSizeBoundary 验证不会降到 minSize 以下
 func TestAdaptivePool_MinSizeBoundary(t *testing.T) {
-	state := common.NewState()
-
-	// 创建小线程池，minSize会是10
-	pool, err := NewAdaptivePool(40, func(interface{}) {}, state)
-	if err != nil {
-		t.Fatalf("创建线程池失败: %v", err)
-	}
+	pool, metrics := newTestPool(t, 40, func(interface{}) {})
 	defer pool.Release()
 
-	// 模拟极端的资源耗尽：100%失败
-	for i := 0; i < 1000; i++ {
-		state.IncrementPacketCount()
-		state.IncrementResourceExhaustedCount()
+	pool.inSlowStart = false
+	pool.tune(40)
+
+	// 极端耗尽
+	for i := 0; i < 500; i++ {
+		metrics.RecordExhausted()
 	}
 
-	// 触发多次调整
 	for i := 0; i < 50; i++ {
 		_ = pool.Invoke(nil)
-		time.Sleep(time.Millisecond)
+		time.Sleep(time.Millisecond * 15)
 	}
 
 	finalCap := pool.Cap()
-
-	// 验证：不应该低于10
 	if finalCap < 10 {
 		t.Errorf("线程数 < 10: %d", finalCap)
 	}
@@ -162,76 +104,170 @@ func TestAdaptivePool_MinSizeBoundary(t *testing.T) {
 	t.Logf("最小边界测试通过: cap=%d", finalCap)
 }
 
-// =============================================================================
-// 场景5：样本不足测试（低价值但重要）
-// =============================================================================
-
 // TestAdaptivePool_NotEnoughSamples 验证样本不足时不调整
-// 防止基于小样本做错误决策
 func TestAdaptivePool_NotEnoughSamples(t *testing.T) {
-	state := common.NewState()
-
-	pool, err := NewAdaptivePool(100, func(interface{}) {}, state)
-	if err != nil {
-		t.Fatalf("创建线程池失败: %v", err)
-	}
+	pool, metrics := newTestPool(t, 100, func(interface{}) {})
 	defer pool.Release()
 
+	pool.inSlowStart = false
+	pool.tune(100)
 	initialCap := pool.Cap()
 
-	// 只增加少量样本（<100），不足以触发调整
-	for i := 0; i < 50; i++ {
-		state.IncrementPacketCount()
-		state.IncrementResourceExhaustedCount() // 即使100%失败也不调整
+	// 只 20 个样本，不足 30 的阈值
+	for i := 0; i < 20; i++ {
+		metrics.RecordExhausted()
 	}
 
-	// 提交任务
 	for i := 0; i < 10; i++ {
 		_ = pool.Invoke(nil)
 	}
 	time.Sleep(time.Millisecond * 50)
 
 	finalCap := pool.Cap()
-
-	// 验证：样本不足时不应该调整
 	if finalCap != initialCap {
 		t.Errorf("样本不足时不应该调整: %d -> %d", initialCap, finalCap)
 	}
 }
 
-// =============================================================================
-// 辅助函数
-// =============================================================================
-
-// TestAdaptivePool_Wait 验证Wait方法正确等待所有任务完成
+// TestAdaptivePool_Wait 验证 Wait 方法
 func TestAdaptivePool_Wait(t *testing.T) {
-	state := common.NewState()
-
-	pool, err := NewAdaptivePool(10, func(interface{}) {
+	pool, _ := newTestPool(t, 10, func(interface{}) {
 		time.Sleep(time.Millisecond * 50)
-	}, state)
+	})
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(10)
+
+	for i := 0; i < 20; i++ {
+		_ = pool.Invoke(nil)
+	}
+
+	start := time.Now()
+	pool.Wait()
+	duration := time.Since(start)
+
+	if duration > 300*time.Millisecond {
+		t.Errorf("Wait 耗时过长: %v", duration)
+	}
+
+	t.Logf("Wait 测试通过: %v", duration)
+}
+
+// =============================================================================
+// maybeReduceTarget 补充覆盖
+// =============================================================================
+
+// TestMaybeReduceTarget_NoOpWhenRTTLow rttRatio <= 3.0 时不修改 target
+func TestMaybeReduceTarget_NoOpWhenRTTLow(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics)
 	if err != nil {
 		t.Fatalf("创建线程池失败: %v", err)
 	}
 	defer pool.Release()
 
-	// 提交任务
-	for i := 0; i < 20; i++ {
-		_ = pool.Invoke(nil)
-	}
+	initialTarget := atomic.LoadInt32(&pool.target)
 
-	// Wait应该在所有任务完成后返回
-	start := time.Now()
-	pool.Wait()
-	duration := time.Since(start)
+	// RTTRatio 样本不足（< 20）返回 1.0，远低于 3.0 阈值
+	pool.maybeReduceTarget()
 
-	// 20个任务，每个50ms，10个线程，应该约100ms完成
-	if duration < 80*time.Millisecond {
-		t.Logf("Wait提前返回？可能测试有问题: %v", duration)
+	afterTarget := atomic.LoadInt32(&pool.target)
+	if afterTarget != initialTarget {
+		t.Errorf("rttRatio <= 3.0 时 target 不应改变: %d -> %d", initialTarget, afterTarget)
+	}
+}
+
+// TestMaybeReduceTarget_ReducesWhenRTTHigh rttRatio > 3.0 时压低 target 10%
+func TestMaybeReduceTarget_ReducesWhenRTTHigh(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(200, 200, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 伪造 RTT：让 fastEMA >> slowEMA，ratio > 3.0
+	// 方法：先用大 RTT 建立 fastEMA，再用小 RTT 建立 slowEMA
+	// 更直接：直接操作 atomic 字段（包内测试可以访问）
+	for i := 0; i < 25; i++ {
+		metrics.RecordConnect(10 * time.Millisecond) // 先建 baseline
+	}
+	// 现在把 fastEMA 人为拉高（写入一个远大于 slowEMA 的值）
+	pool.metrics.rttFastNs.Store(int64(400 * time.Millisecond))
+	pool.metrics.rttSlowNs.Store(int64(10 * time.Millisecond))
+
+	initialTarget := atomic.LoadInt32(&pool.target)
+
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	if afterTarget >= initialTarget {
+		t.Errorf("rttRatio > 3.0 时 target 应被压低: %d -> %d", initialTarget, afterTarget)
+	}
+
+	// 验证是 ×0.9
+	expected := int32(float64(initialTarget) * 0.9)
+	if afterTarget != expected {
+		t.Errorf("target 应为 %d (×0.9), 实际 %d", expected, afterTarget)
+	}
+}
+
+// TestMaybeReduceTarget_ClampToMinTarget target 压低后不低于 ceiling/5 或 10
+func TestMaybeReduceTarget_ClampToMinTarget(t *testing.T) {
+	metrics := &ScanMetrics{}
+	// ceiling=20, minTarget = max(20/5, 10) = 10
+	// target=10, newTarget = int(10*0.9) = 9 → 被 clamp 到 10 → newTarget == target → 不更新
+	pool, err := NewAdaptivePool(10, 20, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 强制设置 target=10（初始值就是 10，但确认一下）
+	atomic.StoreInt32(&pool.target, 10)
+
+	// 伪造 rttRatio > 3.0
+	for i := 0; i < 25; i++ {
+		metrics.RecordConnect(10 * time.Millisecond)
+	}
+	pool.metrics.rttFastNs.Store(int64(400 * time.Millisecond))
+	pool.metrics.rttSlowNs.Store(int64(10 * time.Millisecond))
+
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	// newTarget=9 < minTarget=10 → clamp 到 10 → 10 == target → 不写入
+	if afterTarget != 10 {
+		t.Errorf("clamp 后 target 应保持 10, 实际 %d", afterTarget)
+	}
+}
+
+// TestMaybeReduceTarget_LargeCeilingMinTarget ceiling 足够大时 minTarget = ceiling/5
+func TestMaybeReduceTarget_LargeCeilingMinTarget(t *testing.T) {
+	metrics := &ScanMetrics{}
+	// ceiling=100, minTarget = 100/5 = 20
+	// target=21 → newTarget = int(21*0.9) = 18 → clamp 到 20
+	pool, err := NewAdaptivePool(21, 100, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	atomic.StoreInt32(&pool.target, 21)
+	atomic.StoreInt32(&pool.ceiling, 100)
+
+	for i := 0; i < 25; i++ {
+		metrics.RecordConnect(10 * time.Millisecond)
+	}
+	pool.metrics.rttFastNs.Store(int64(400 * time.Millisecond))
+	pool.metrics.rttSlowNs.Store(int64(10 * time.Millisecond))
+
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	// newTarget=18 < minTarget=20 → store 20; 20 < 21 → 更新
+	if afterTarget != 20 {
+		t.Errorf("应 clamp 到 minTarget=20, 实际 %d", afterTarget)
 	}
-	if duration > 200*time.Millisecond {
-		t.Errorf("Wait耗时过长: %v", duration)
-	}
-
-	t.Logf("Wait测试通过: %v", duration)
 }

core/adaptive_timeout.go

@@ -25,10 +25,17 @@ type AdaptiveTimeout struct {
 // NewAdaptiveTimeout 创建自适应超时计算器
 // maxTimeout: 用户配置的超时上限（即原始固定超时）
 func NewAdaptiveTimeout(maxTimeout time.Duration) *AdaptiveTimeout {
+	// minTO: 自适应超时下限，取 max(500ms, maxTimeout/5)
+	// 依据：高并发下 TCP 握手存在尾延迟（OS 调度抖动、backlog 溢出、端口竞争），
+	//       过低的下限会导致开放端口被误判为关闭（issue #503）
+	minTO := maxTimeout / 5
+	if minTO < 500*time.Millisecond {
+		minTO = 500 * time.Millisecond
+	}
 	return &AdaptiveTimeout{
 		samples: make([]float64, 64),
 		size:    64,
-		minTO:   100 * time.Millisecond,
+		minTO:   minTO,
 		maxTO:   maxTimeout,
 		warmup:  10,
 	}

core/alive_scanner.go

@@ -88,6 +88,11 @@ func (s *AliveScanStrategy) performAliveScan(ctx context.Context, info common.Ho
 	for {
 		hosts, err := iter.NextBatch(ctx, targetHostBatchSize(session.Config))
 		if err != nil {
+			if ctx.Err() != nil {
+				session.LogError(i18n.Tr("global_timeout_exceeded",
+					int(session.Config.GlobalTimeout.Seconds())))
+				return
+			}
 			session.LogError(i18n.Tr("parse_target_failed", err))
 			return
 		}

core/base_scan_strategy.go

@@ -29,6 +29,7 @@ const (
 type BaseScanStrategy struct {
 	strategyName string
 	filterType   PluginFilterType
+	state        *common.State
 }
 
 // NewBaseScanStrategy 创建基础扫描策略
@@ -39,6 +40,11 @@ func NewBaseScanStrategy(name string, filterType PluginFilterType) *BaseScanStra
 	}
 }
 
+// SetState 注入 session state（用于 per-session 服务缓存）
+func (b *BaseScanStrategy) SetState(state *common.State) {
+	b.state = state
+}
+
 // GetPlugins 获取插件列表
 func (b *BaseScanStrategy) GetPlugins(config *common.Config) ([]string, bool) {
 	scanMode := config.Mode
@@ -86,6 +92,11 @@ func (b *BaseScanStrategy) IsPluginApplicableByName(pluginName string, targetHos
 		return b.isPluginPassesFilterType(pluginName, isCustomMode, config)
 	}
 
+	// -full 模式下，web 插件对所有开放端口生效（跳过 IsMarkedWebService 检查）
+	if config.POC.Full && b.isWebPlugin(pluginName) {
+		return b.isPluginPassesFilterType(pluginName, isCustomMode, config)
+	}
+
 	// 检查端口匹配和过滤器类型
 	return b.isPluginApplicableToPortWithHost(pluginName, targetHost, targetPort) && b.isPluginPassesFilterType(pluginName, isCustomMode, config)
 }
@@ -115,9 +126,10 @@ func (b *BaseScanStrategy) isLocalPluginExplicitlySpecified(pluginName string, c
 }
 
 // isPluginApplicableToPortWithHost 检查插件是否适用于指定端口
+// 匹配策略：端口匹配 → 服务名称匹配（解决非标准端口问题）
 func (b *BaseScanStrategy) isPluginApplicableToPortWithHost(pluginName string, targetHost string, targetPort int) bool {
 	if b.isWebPlugin(pluginName) {
-		return IsMarkedWebService(targetHost, targetPort)
+		return IsMarkedWebServiceWithState(b.state, targetHost, targetPort)
 	}
 
 	pluginPorts := b.getPluginPorts(pluginName)
@@ -136,10 +148,23 @@ func (b *BaseScanStrategy) isPluginApplicableToPortWithHost(pluginName string, t
 		}
 	}
 
+	// 端口不匹配时，按指纹识别结果匹配
+	// 例：8881 端口上识别到 ssh 服务 → ssh 插件应该执行
+	if targetHost != "" && targetPort > 0 {
+		if info, ok := GetCachedServiceInfoWithState(b.state, targetHost, targetPort); ok && info != nil {
+			if strings.EqualFold(info.Name, pluginName) {
+				return true
+			}
+		}
+	}
+
 	return false
 }
 
 func (b *BaseScanStrategy) isPluginApplicableToPort(pluginName string, targetPort int) bool {
+	if b.isWebPlugin(pluginName) {
+		return true
+	}
 	return b.isPluginApplicableToPortWithHost(pluginName, "", targetPort)
 }
 
@@ -178,27 +203,9 @@ func (b *BaseScanStrategy) isPluginPassesFilterType(pluginName string, isCustomM
 	}
 }
 
-// LogPluginInfo 输出插件信息
+// LogPluginInfo 默认不输出插件信息（service 默认端口模式有意保持安静，减少干扰）。
+// 子类 LocalScanStrategy / ServiceScanStrategy 按需重写。
 func (b *BaseScanStrategy) LogPluginInfo(config *common.Config, session *common.ScanSession) {
-	allPlugins, isCustomMode := b.GetPlugins(config)
-
-	var prefix string
-	switch b.filterType {
-	case FilterLocal:
-		prefix = i18n.GetText("concurrency_local_plugin")
-	case FilterService:
-		prefix = i18n.GetText("concurrency_service_plugin")
-	case FilterWeb:
-		prefix = i18n.GetText("concurrency_web_plugin")
-	default:
-		prefix = i18n.GetText("concurrency_plugin")
-	}
-
-	// 插件信息不再输出，减少干扰
-	_ = allPlugins
-	_ = isCustomMode
-	_ = prefix
-	_ = session
 }
 
 // formatPluginList 格式化插件列表（超过5个时精简显示）
@@ -253,32 +260,32 @@ func (b *BaseScanStrategy) getPluginsByFilterType() []string {
 				filteredPlugins = append(filteredPlugins, pluginName)
 			}
 		}
-		// 确保 webtitle 在 webpoc 之前执行，避免指纹识别竞态
-		sort.Slice(filteredPlugins, func(i, j int) bool {
-			// webtitle 必须在 webpoc 之前
-			if filteredPlugins[i] == "webtitle" {
-				return true
-			}
-			if filteredPlugins[j] == "webtitle" {
-				return false
-			}
-			if filteredPlugins[i] == "webpoc" {
-				return false
-			}
-			if filteredPlugins[j] == "webpoc" {
-				return true
-			}
-			// 其他插件保持字母顺序
-			return filteredPlugins[i] < filteredPlugins[j]
-		})
 	default:
 		// 无过滤器：返回所有插件
 		filteredPlugins = allPlugins
 	}
 
+	orderWebPlugins(filteredPlugins)
 	return filteredPlugins
 }
 
+func orderWebPlugins(pluginNames []string) {
+	sort.SliceStable(pluginNames, func(i, j int) bool {
+		return webPluginOrder(pluginNames[i]) < webPluginOrder(pluginNames[j])
+	})
+}
+
+func webPluginOrder(pluginName string) int {
+	switch pluginName {
+	case "webtitle":
+		return 0
+	case "webpoc":
+		return 2
+	default:
+		return 1
+	}
+}
+
 // parsePluginList 解析插件列表字符串
 func parsePluginList(pluginStr string) []string {
 	if pluginStr == "" {

core/base_scan_strategy_test.go

@@ -2,6 +2,9 @@ package core
 
 import (
 	"testing"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/plugins"
 )
 
 // =============================================================================
@@ -261,6 +264,113 @@ func slicesEqual(a, b []string) bool {
 	return true
 }
 
+func TestOrderWebPlugins(t *testing.T) {
+	plugins := []string{"ssh", "webpoc", "redis", "webtitle", "mysql"}
+
+	orderWebPlugins(plugins)
+
+	expected := []string{"webtitle", "ssh", "redis", "mysql", "webpoc"}
+	if !slicesEqual(plugins, expected) {
+		t.Fatalf("orderWebPlugins = %#v, want %#v", plugins, expected)
+	}
+}
+
+func TestBaseScanStrategyPluginSelectionAndApplicability(t *testing.T) {
+	registerTestPlugins(t)
+	plugins.RegisterWithOptions("core_test_local", func() plugins.Plugin { return nil }, nil, []string{plugins.PluginTypeLocal}, false)
+	plugins.RegisterWithOptions("core_test_udp", func() plugins.Plugin { return nil }, []int{161}, []string{plugins.PluginTypeUDP}, true)
+	clearServiceCache()
+
+	cfg := common.NewConfig()
+	cfg.Mode = "ssh, missing_plugin, webtitle"
+	strategy := NewBaseScanStrategy("service", FilterService)
+	got, custom := strategy.GetPlugins(cfg)
+	if !custom {
+		t.Fatal("explicit mode should be marked as custom")
+	}
+	if !slicesEqual(got, []string{"ssh", "webtitle"}) {
+		t.Fatalf("custom plugins = %#v, want ssh/webtitle", got)
+	}
+
+	cfg.Mode = "all"
+	servicePlugins, custom := strategy.GetPlugins(cfg)
+	if custom {
+		t.Fatal("all mode should not be custom")
+	}
+	if !containsString(servicePlugins, "ssh") || containsString(servicePlugins, "core_test_local") || containsString(servicePlugins, "core_test_udp") {
+		t.Fatalf("service filtered plugins = %#v", servicePlugins)
+	}
+
+	if !strategy.pluginExists("ssh") || strategy.pluginExists("missing_plugin") {
+		t.Fatal("pluginExists returned wrong result")
+	}
+	if !strategy.isPluginApplicableToPort("ssh", 22) || strategy.isPluginApplicableToPort("ssh", 23) {
+		t.Fatal("port applicability for ssh is wrong")
+	}
+	CacheServiceInfo("10.0.0.9", 22222, &ServiceInfo{Name: "ssh"})
+	if !strategy.isPluginApplicableToPortWithHost("ssh", "10.0.0.9", 22222) {
+		t.Fatal("service cache should allow ssh on a non-standard port")
+	}
+	if !strategy.IsPluginApplicableByName("ssh", "10.0.0.9", 1, true, cfg) {
+		t.Fatal("custom mode should respect explicitly selected plugin")
+	}
+	if strategy.IsPluginApplicableByName("missing_plugin", "10.0.0.9", 22, true, cfg) {
+		t.Fatal("missing plugin should never be applicable")
+	}
+}
+
+func TestBaseScanStrategyFilterTypes(t *testing.T) {
+	plugins.RegisterWithOptions("core_test_local_filter", func() plugins.Plugin { return nil }, nil, []string{plugins.PluginTypeLocal}, false)
+	plugins.RegisterWithOptions("core_test_web_filter", func() plugins.Plugin { return nil }, nil, []string{plugins.PluginTypeWeb}, true)
+	plugins.RegisterWithOptions("core_test_udp_filter", func() plugins.Plugin { return nil }, []int{53}, []string{plugins.PluginTypeUDP}, true)
+
+	cfg := common.NewConfig()
+	localStrategy := NewBaseScanStrategy("local", FilterLocal)
+	if localStrategy.isPluginPassesFilterType("core_test_local_filter", false, cfg) {
+		t.Fatal("local plugin should require explicit -local selection")
+	}
+	cfg.LocalPlugin = "core_test_local_filter"
+	if !localStrategy.isPluginPassesFilterType("core_test_local_filter", false, cfg) {
+		t.Fatal("explicit local plugin should pass local filter")
+	}
+
+	serviceStrategy := NewBaseScanStrategy("service", FilterService)
+	if !serviceStrategy.isPluginPassesFilterType("ssh", false, cfg) {
+		t.Fatal("service plugin should pass service filter")
+	}
+	if serviceStrategy.isPluginPassesFilterType("core_test_local_filter", false, cfg) ||
+		serviceStrategy.isPluginPassesFilterType("core_test_udp_filter", false, cfg) {
+		t.Fatal("service filter should reject local and UDP plugins")
+	}
+
+	webStrategy := NewBaseScanStrategy("web", FilterWeb)
+	if !webStrategy.isPluginPassesFilterType("core_test_web_filter", false, cfg) ||
+		webStrategy.isPluginPassesFilterType("ssh", false, cfg) {
+		t.Fatal("web filter should only allow web plugins")
+	}
+	if webPluginOrder("webtitle") != 0 || webPluginOrder("webpoc") != 2 || webPluginOrder("other") != 1 {
+		t.Fatal("web plugin order changed")
+	}
+}
+
+func TestFormatPluginList(t *testing.T) {
+	if got := formatPluginList([]string{"a", "b", "c"}); got != "a, b, c" {
+		t.Fatalf("short plugin list = %q", got)
+	}
+	if got := formatPluginList([]string{"a", "b", "c", "d", "e", "f"}); got == "" || got == "a, b, c, d, e, f" {
+		t.Fatalf("long plugin list should be summarized, got %q", got)
+	}
+}
+
+func containsString(values []string, want string) bool {
+	for _, value := range values {
+		if value == want {
+			return true
+		}
+	}
+	return false
+}
+
 // TestNewBaseScanStrategy 测试构造函数
 func TestNewBaseScanStrategy(t *testing.T) {
 	tests := []struct {
@@ -352,3 +462,134 @@ func TestBaseScanStrategy_ValidateConfiguration(t *testing.T) {
 		t.Errorf("ValidateConfiguration 应返回 nil, 实际: %v", err)
 	}
 }
+
+// =============================================================================
+// IsPluginApplicableByName 补充覆盖
+// =============================================================================
+
+// TestIsPluginApplicableByName_FullModeWebPlugin 测试 -full 模式下 web 插件对任意端口生效
+func TestIsPluginApplicableByName_FullModeWebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	clearServiceCache()
+
+	cfg := common.NewConfig()
+	cfg.POC.Full = true
+
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// webtitle 是 web 插件；-full 模式下不检查 IsMarkedWebService，直接走 passesFilterType
+	// FilterService 不允许 local/udp，但允许 web 插件
+	got := strategy.IsPluginApplicableByName("webtitle", "10.0.0.1", 12345, false, cfg)
+	if !got {
+		t.Error("full 模式下 web 插件应对任意端口返回 true")
+	}
+}
+
+// TestIsPluginApplicableByName_FullModeNonWebPlugin 确认 -full 不影响非 web 插件的端口匹配
+func TestIsPluginApplicableByName_FullModeNonWebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	clearServiceCache()
+
+	cfg := common.NewConfig()
+	cfg.POC.Full = true
+
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// ssh 不是 web 插件，-full 无特殊逻辑，走普通端口匹配
+	// ssh 默认端口 22；用 99999 端口应该不匹配
+	got := strategy.IsPluginApplicableByName("ssh", "10.0.0.1", 99999, false, cfg)
+	if got {
+		t.Error("-full 模式对非 web 插件不应绕过端口匹配")
+	}
+}
+
+// =============================================================================
+// isPluginApplicableToPort 补充覆盖
+// =============================================================================
+
+// TestIsPluginApplicableToPort_WebPlugin web 插件忽略端口直接返回 true
+func TestIsPluginApplicableToPort_WebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// webtitle 是 web 插件，任何端口都应返回 true
+	if !strategy.isPluginApplicableToPort("webtitle", 8080) {
+		t.Error("web 插件在任意端口应返回 true")
+	}
+	if !strategy.isPluginApplicableToPort("webtitle", 0) {
+		t.Error("web 插件在端口 0 也应返回 true")
+	}
+}
+
+// TestIsPluginApplicableToPort_NonWebPlugin 非 web 插件走端口匹配逻辑
+func TestIsPluginApplicableToPort_NonWebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	clearServiceCache()
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// ssh 端口 22 匹配
+	if !strategy.isPluginApplicableToPort("ssh", 22) {
+		t.Error("ssh 应匹配端口 22")
+	}
+	// ssh 端口 9999 不匹配（无服务缓存）
+	if strategy.isPluginApplicableToPort("ssh", 9999) {
+		t.Error("ssh 不应匹配端口 9999")
+	}
+}
+
+// =============================================================================
+// isPluginPassesFilterType 补充覆盖
+// =============================================================================
+
+// TestIsPluginPassesFilterType_CustomMode isCustomMode=true 应直接跳过过滤返回 true（非 UDP）
+func TestIsPluginPassesFilterType_CustomMode(t *testing.T) {
+	registerTestPlugins(t)
+	cfg := common.NewConfig()
+
+	// FilterLocal 策略下 custom mode 也应通过
+	localStrategy := NewBaseScanStrategy("local", FilterLocal)
+	if !localStrategy.isPluginPassesFilterType("ssh", true, cfg) {
+		t.Error("custom mode 下非 UDP 插件应直接返回 true")
+	}
+
+	// FilterService 策略下 custom mode 也应通过
+	serviceStrategy := NewBaseScanStrategy("service", FilterService)
+	if !serviceStrategy.isPluginPassesFilterType("ssh", true, cfg) {
+		t.Error("custom mode 下 service 策略应直接返回 true")
+	}
+}
+
+// TestIsPluginPassesFilterType_FilterNoneNonLocal FilterNone + 普通 TCP 插件 → true
+func TestIsPluginPassesFilterType_FilterNoneNonLocal(t *testing.T) {
+	registerTestPlugins(t)
+	cfg := common.NewConfig()
+
+	noneStrategy := NewBaseScanStrategy("none", FilterNone)
+
+	// ssh 不是 local 插件，FilterNone 应直接返回 true
+	if !noneStrategy.isPluginPassesFilterType("ssh", false, cfg) {
+		t.Error("FilterNone + 非 local 插件应返回 true")
+	}
+	if !noneStrategy.isPluginPassesFilterType("redis", false, cfg) {
+		t.Error("FilterNone + 非 local 插件 redis 应返回 true")
+	}
+}
+
+// TestIsPluginPassesFilterType_FilterNoneLocalPlugin FilterNone + local 插件：需要 -local 显式指定
+func TestIsPluginPassesFilterType_FilterNoneLocalPlugin(t *testing.T) {
+	plugins.RegisterWithOptions("core_test_local_none", func() plugins.Plugin { return nil }, nil, []string{plugins.PluginTypeLocal}, false)
+	cfg := common.NewConfig()
+
+	noneStrategy := NewBaseScanStrategy("none", FilterNone)
+
+	// 未指定 LocalPlugin，应返回 false
+	if noneStrategy.isPluginPassesFilterType("core_test_local_none", false, cfg) {
+		t.Error("FilterNone + local 插件未显式指定时应返回 false")
+	}
+
+	// 指定后应返回 true
+	cfg.LocalPlugin = "core_test_local_none"
+	if !noneStrategy.isPluginPassesFilterType("core_test_local_none", false, cfg) {
+		t.Error("FilterNone + local 插件显式指定后应返回 true")
+	}
+}

core/edge_cases_test.go

@@ -0,0 +1,651 @@
+package core
+
+import (
+	"math"
+	"sync"
+	"testing"
+	"time"
+)
+
+// =============================================================================
+// computeRetries 边界
+// =============================================================================
+
+func TestComputeRetries_EdgeCases(t *testing.T) {
+	tests := []struct {
+		lossRate float64
+		wantMin  int
+		wantMax  int
+		desc     string
+	}{
+		{-0.5, 1, 1, "负数丢包率: 视为零"},
+		{-1.0, 1, 1, "负一: 视为零"},
+		{0.0, 1, 1, "精确零"},
+		{0.001, 1, 1, "精确边界 0.001"},
+		{0.0009, 1, 1, "低于 0.001 边界"},
+		{0.0011, 1, 5, "高于 0.001 边界"},
+		{0.95, 5, 5, "精确边界 0.95"},
+		{0.949, 1, 5, "低于 0.95 边界"},
+		{0.951, 5, 5, "高于 0.95 边界"},
+		{1.0, 5, 5, "精确 1.0"},
+		{1.5, 5, 5, "超过 1.0"},
+		{100.0, 5, 5, "极大值"},
+		{math.SmallestNonzeroFloat64, 1, 1, "最小正浮点数"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			got := computeRetries(tt.lossRate, EnvWAN)
+			if got < tt.wantMin || got > tt.wantMax {
+				t.Errorf("computeRetries(%v) = %d, want [%d, %d]",
+					tt.lossRate, got, tt.wantMin, tt.wantMax)
+			}
+			if got < 1 || got > 5 {
+				t.Errorf("computeRetries(%v) = %d, 超出 [1,6] 范围", tt.lossRate, got)
+			}
+		})
+	}
+}
+
+func TestComputeRetries_NaN_Inf(t *testing.T) {
+	// 确保不 panic
+	for _, v := range []float64{math.NaN(), math.Inf(1), math.Inf(-1)} {
+		got := computeRetries(v, EnvWAN)
+		if got < 1 || got > 5 {
+			t.Errorf("computeRetries(%v) = %d, 超出 [1,6] 范围", v, got)
+		}
+	}
+}
+
+// =============================================================================
+// computeICMPRate 边界
+// =============================================================================
+
+func TestComputeICMPRate_EdgeCases(t *testing.T) {
+	tests := []struct {
+		env     NetworkEnv
+		fdLimit int
+		desc    string
+	}{
+		{EnvLAN, 1, "fd=1: 极小"},
+		{EnvLAN, -1, "fd=负数: 应被忽略"},
+		{EnvLAN, 0, "fd=0: 未知"},
+		{EnvLAN, math.MaxInt32, "fd=极大"},
+		{NetworkEnv(99), 1024, "未知环境类型"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			net := &NetworkProfile{Env: tt.env}
+			sys := &SystemProfile{FDLimit: tt.fdLimit}
+			got := computeICMPRate(net, sys)
+			if got <= 0 || math.IsNaN(got) || math.IsInf(got, 0) {
+				t.Errorf("computeICMPRate(env=%v, fd=%d) = %v, 无效值", tt.env, tt.fdLimit, got)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// classifyEnv 精确边界值
+// =============================================================================
+
+func TestClassifyEnv_ExactBoundaries(t *testing.T) {
+	tests := []struct {
+		median   time.Duration
+		lossRate float64
+		want     NetworkEnv
+		desc     string
+	}{
+		// RTT 边界
+		{4999 * time.Microsecond, 0.0, EnvLAN, "4.999ms → LAN"},
+		{5 * time.Millisecond, 0.0, EnvWAN, "精确 5ms → WAN"},
+		{49999 * time.Microsecond, 0.0, EnvWAN, "49.999ms → WAN"},
+		{50 * time.Millisecond, 0.0, EnvInternet, "精确 50ms → Internet"},
+		{199999 * time.Microsecond, 0.0, EnvInternet, "199.999ms → Internet"},
+		{200 * time.Millisecond, 0.0, EnvSlow, "精确 200ms → Slow"},
+
+		// 丢包率边界
+		{1 * time.Millisecond, 0.009, EnvLAN, "丢包 0.9% → LAN"},
+		{1 * time.Millisecond, 0.01, EnvWAN, "精确 1% → WAN (不满足 < 0.01)"},
+		{1 * time.Millisecond, 0.011, EnvWAN, "丢包 1.1% → WAN (超过 LAN 阈值)"},
+		{20 * time.Millisecond, 0.049, EnvWAN, "丢包 4.9% → WAN"},
+		{20 * time.Millisecond, 0.05, EnvInternet, "精确 5% → Internet (不满足 < 0.05)"},
+		{20 * time.Millisecond, 0.051, EnvInternet, "丢包 5.1% → Internet"},
+		{1 * time.Millisecond, 0.099, EnvInternet, "丢包 9.9% → Internet"},
+		{1 * time.Millisecond, 0.10, EnvInternet, "精确 10% → Internet (< 判断)"},
+		{1 * time.Millisecond, 0.101, EnvSlow, "丢包 10.1% → Slow"},
+
+		// 零值
+		{0, 0.0, EnvLAN, "零 RTT 零丢包 → LAN"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			got := classifyEnv(tt.median, tt.lossRate)
+			if got != tt.want {
+				t.Errorf("classifyEnv(median=%v, loss=%.4f) = %v, want %v",
+					tt.median, tt.lossRate, got, tt.want)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// classifyNetwork 边界
+// =============================================================================
+
+func TestClassifyNetwork_EdgeCases(t *testing.T) {
+	t.Run("单个 RTT 样本", func(t *testing.T) {
+		p := classifyNetwork([]time.Duration{5 * time.Millisecond}, 0, 1)
+		if p.Samples != 1 {
+			t.Errorf("samples = %d, want 1", p.Samples)
+		}
+		// stddev 应该是 0
+		if p.RTTStddev != 0 {
+			t.Errorf("单样本 stddev = %v, want 0", p.RTTStddev)
+		}
+	})
+
+	t.Run("所有 RTT 相同", func(t *testing.T) {
+		rtts := make([]time.Duration, 50)
+		for i := range rtts {
+			rtts[i] = 10 * time.Millisecond
+		}
+		p := classifyNetwork(rtts, 0, 50)
+		if p.RTTStddev != 0 {
+			t.Errorf("全相同 RTT stddev = %v, want 0", p.RTTStddev)
+		}
+		if p.RTTMedian != 10*time.Millisecond {
+			t.Errorf("median = %v, want 10ms", p.RTTMedian)
+		}
+	})
+
+	t.Run("极大 RTT 值", func(t *testing.T) {
+		rtts := []time.Duration{time.Hour, time.Hour, time.Hour}
+		p := classifyNetwork(rtts, 0, 3)
+		if p.Env != EnvSlow {
+			t.Errorf("env = %v, want Slow", p.Env)
+		}
+	})
+
+	t.Run("混合极端值", func(t *testing.T) {
+		rtts := []time.Duration{time.Microsecond, time.Hour}
+		p := classifyNetwork(rtts, 0, 2)
+		// 不 panic 就行
+		if p.Samples != 2 {
+			t.Errorf("samples = %d, want 2", p.Samples)
+		}
+	})
+
+	t.Run("全部失败无响应", func(t *testing.T) {
+		p := classifyNetwork(nil, 100, 100)
+		if p.Env != EnvWAN {
+			t.Errorf("env = %v, want WAN (default)", p.Env)
+		}
+	})
+
+	t.Run("failures > total (异常输入)", func(t *testing.T) {
+		rtts := []time.Duration{time.Millisecond}
+		p := classifyNetwork(rtts, 10, 5) // failures > total
+		// lossRate = 1 - 1/5 = 0.8, 不应 panic
+		if p.LossRate < 0 {
+			t.Errorf("lossRate = %.2f, 不应为负", p.LossRate)
+		}
+	})
+
+	t.Run("total=0", func(t *testing.T) {
+		p := classifyNetwork(nil, 0, 0)
+		// 不 panic
+		if p.Samples != 0 {
+			t.Errorf("samples = %d, want 0", p.Samples)
+		}
+	})
+}
+
+// =============================================================================
+// RecommendConcurrency 边界
+// =============================================================================
+
+func TestRecommendConcurrency_EdgeCases(t *testing.T) {
+	tests := []struct {
+		env      NetworkEnv
+		loss     float64
+		userT    int
+		explicit bool
+		desc     string
+	}{
+		{EnvLAN, 0.0, 0, false, "userThreadNum=0"},
+		{EnvLAN, 0.0, 1, false, "userThreadNum=1"},
+		{EnvLAN, 0.0, -1, false, "userThreadNum 负数"},
+		{EnvLAN, 0.0, math.MaxInt32, false, "userThreadNum 极大"},
+		{EnvLAN, 0.99, 600, false, "99% 丢包"},
+		{EnvLAN, 1.0, 600, false, "100% 丢包"},
+		{EnvSlow, 0.0, 1, true, "慢速+显式+1"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			p := &NetworkProfile{Env: tt.env, LossRate: tt.loss, Samples: 10}
+			target, ceiling := p.RecommendConcurrency(tt.userT, tt.explicit)
+			// 不 panic，且 target >= 1（clamp 保底 10 或 userT）
+			if target < 0 || ceiling < 0 {
+				t.Errorf("target=%d ceiling=%d, 不应为负", target, ceiling)
+			}
+			if tt.explicit && ceiling != tt.userT && tt.userT > 0 {
+				t.Errorf("显式模式 ceiling=%d, want %d", ceiling, tt.userT)
+			}
+			t.Logf("env=%v loss=%.2f userT=%d explicit=%v → target=%d ceiling=%d",
+				tt.env, tt.loss, tt.userT, tt.explicit, target, ceiling)
+		})
+	}
+}
+
+// =============================================================================
+// ScanMetrics 边界
+// =============================================================================
+
+func TestScanMetrics_EdgeCases(t *testing.T) {
+	t.Run("RTT=0", func(t *testing.T) {
+		m := &ScanMetrics{}
+		m.RecordConnect(0)
+		// 不 panic
+		if m.Total() != 1 {
+			t.Errorf("Total = %d, want 1", m.Total())
+		}
+	})
+
+	t.Run("负数 RTT", func(t *testing.T) {
+		m := &ScanMetrics{}
+		m.RecordConnect(-time.Millisecond)
+		// 不 panic，负数 RTT 应被忽略
+		if m.rttSamples.Load() != 0 {
+			t.Errorf("负数 RTT 不应计入采样: got %d", m.rttSamples.Load())
+		}
+	})
+
+	t.Run("极大 RTT", func(t *testing.T) {
+		m := &ScanMetrics{}
+		m.RecordConnect(time.Hour)
+		if m.RTTFast() != time.Hour {
+			t.Errorf("首个样本 RTTFast = %v, want 1h", m.RTTFast())
+		}
+	})
+
+	t.Run("EMA 首个样本初始化", func(t *testing.T) {
+		m := &ScanMetrics{}
+		m.RecordConnect(10 * time.Millisecond)
+		if m.rttFastNs.Load() != int64(10*time.Millisecond) {
+			t.Errorf("首个样本应直接设置 EMA: got %d", m.rttFastNs.Load())
+		}
+	})
+
+	t.Run("空 Snapshot", func(t *testing.T) {
+		m := &ScanMetrics{}
+		snap := m.Snapshot()
+		if snap.Total() != 0 {
+			t.Errorf("空 metrics Snapshot.Total = %d, want 0", snap.Total())
+		}
+	})
+
+	t.Run("RTTRatio 单侧为零", func(t *testing.T) {
+		m := &ScanMetrics{}
+		// 手动设置一个但不设另一个——不应该发生，但防御
+		m.rttFastNs.Store(1000)
+		m.rttSlowNs.Store(0)
+		m.rttSamples.Store(30)
+		ratio := m.RTTRatio()
+		if ratio != 1.0 {
+			t.Errorf("slow=0 时 ratio = %.2f, want 1.0", ratio)
+		}
+	})
+
+	t.Run("大量操作不溢出", func(t *testing.T) {
+		m := &ScanMetrics{}
+		for i := 0; i < 100000; i++ {
+			m.RecordConnect(time.Millisecond)
+		}
+		if m.Total() != 100000 {
+			t.Errorf("Total = %d, want 100000", m.Total())
+		}
+		ratio := m.RTTRatio()
+		if math.IsNaN(ratio) || math.IsInf(ratio, 0) {
+			t.Errorf("大量样本后 ratio = %v, 不应为 NaN/Inf", ratio)
+		}
+	})
+}
+
+// =============================================================================
+// TuneConfig 边界
+// =============================================================================
+
+func TestTuneConfig_EdgeCases(t *testing.T) {
+	t.Run("RTTMedian=0 RTTStddev=0", func(t *testing.T) {
+		config := makeDefaultConfig()
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    NetworkProfile{Env: EnvLAN, RTTMedian: 0, RTTStddev: 0, Samples: 10},
+			System: SystemProfile{FDLimit: 65536},
+		}
+		ep.TuneConfig(config, session)
+		// Timeout: median(0) + 4*stddev(0) = 0 → minTO = 0+200ms → clamp to 1s
+		if config.Timeout < time.Second {
+			t.Errorf("零 RTT Timeout = %v, 应该 >= 1s", config.Timeout)
+		}
+	})
+
+	t.Run("RTTStddev 远大于 RTTMedian", func(t *testing.T) {
+		config := makeDefaultConfig()
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    NetworkProfile{Env: EnvInternet, RTTMedian: 10 * time.Millisecond, RTTStddev: 5 * time.Second, Samples: 10},
+			System: SystemProfile{FDLimit: 65536},
+		}
+		ep.TuneConfig(config, session)
+		// Timeout = 10ms + 4*5s = 20.01s → clamp to 10s
+		if config.Timeout != 10*time.Second {
+			t.Errorf("极大 stddev Timeout = %v, 应该被 clamp 到 10s", config.Timeout)
+		}
+	})
+
+	t.Run("ThreadNum=0", func(t *testing.T) {
+		config := makeDefaultConfig()
+		config.ThreadNum = 0
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    NetworkProfile{Env: EnvLAN, RTTMedian: time.Millisecond, RTTStddev: time.Millisecond, Samples: 10},
+			System: SystemProfile{FDLimit: 65536},
+		}
+		ep.TuneConfig(config, session)
+		// ModuleThreadNum = 0/30 = 0 → clamp to 5
+		if config.ModuleThreadNum < 5 {
+			t.Errorf("ThreadNum=0 时 ModuleThreadNum = %d, 应该 >= 5", config.ModuleThreadNum)
+		}
+	})
+
+	t.Run("多次调用 TuneConfig", func(t *testing.T) {
+		config := makeDefaultConfig()
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    NetworkProfile{Env: EnvLAN, RTTMedian: time.Millisecond, RTTStddev: time.Millisecond, LossRate: 0.0, Samples: 10},
+			System: SystemProfile{FDLimit: 65536},
+		}
+
+		ep.TuneConfig(config, session)
+		first := config.Timeout
+
+		// 第二次调用——已经调整过的值不等于默认值，应被视为"显式"
+		ep.TuneConfig(config, session)
+		second := config.Timeout
+
+		if first != second {
+			t.Errorf("多次调用 TuneConfig 不应重复调整: %v vs %v", first, second)
+		}
+	})
+
+	t.Run("fd limit = ThreadNum 精确值", func(t *testing.T) {
+		config := makeDefaultConfig()
+		config.ThreadNum = 600
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    NetworkProfile{Samples: 0},
+			System: SystemProfile{FDLimit: 1000}, // 1000 * 0.6 = 600
+		}
+		ep.TuneConfig(config, session)
+		// ThreadNum(600) == maxConcurrency(600), 不应触发约束
+		if config.ThreadNum != 600 {
+			t.Errorf("fd=1000 时 ThreadNum = %d, 不应被约束", config.ThreadNum)
+		}
+	})
+
+	t.Run("fd limit 精确低于 ThreadNum", func(t *testing.T) {
+		config := makeDefaultConfig()
+		config.ThreadNum = 600
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    NetworkProfile{Samples: 0},
+			System: SystemProfile{FDLimit: 999}, // 999 * 0.6 = 599
+		}
+		ep.TuneConfig(config, session)
+		if config.ThreadNum > 599 {
+			t.Errorf("fd=999 时 ThreadNum = %d, 应该 <= 599", config.ThreadNum)
+		}
+	})
+}
+
+// =============================================================================
+// AdaptivePool 边界
+// =============================================================================
+
+func TestAdaptivePool_EdgeCases(t *testing.T) {
+	t.Run("target=1", func(t *testing.T) {
+		metrics := &ScanMetrics{}
+		pool, err := NewAdaptivePool(1, 1, func(interface{}) {}, metrics)
+		if err != nil {
+			t.Fatalf("创建失败: %v", err)
+		}
+		defer pool.Release()
+		// initial = max(1/4, 10) = 10 → 但 10 > target(1)... 看实现
+		// 实际上 initial = min(max(1/4, 10), 1) = 1... 不对
+		// initial = target/4 = 0, 但 < 10, 所以 initial = 10
+		// 但 initial > target(1)... initial = min(10, 1) = 1
+		// 看代码：if initial > target { initial = target }
+		if pool.Cap() != 1 {
+			t.Errorf("target=1 时 cap = %d, want 1", pool.Cap())
+		}
+	})
+
+	t.Run("target=0", func(t *testing.T) {
+		metrics := &ScanMetrics{}
+		pool, err := NewAdaptivePool(0, 0, func(interface{}) {}, metrics)
+		// ants 可能拒绝 size=0
+		if err != nil {
+			t.Logf("target=0 正确返回错误: %v", err)
+			return
+		}
+		defer pool.Release()
+		t.Logf("target=0 cap = %d", pool.Cap())
+	})
+
+	t.Run("ceiling < target", func(t *testing.T) {
+		metrics := &ScanMetrics{}
+		pool, err := NewAdaptivePool(100, 50, func(interface{}) {}, metrics)
+		if err != nil {
+			t.Fatalf("创建失败: %v", err)
+		}
+		defer pool.Release()
+		// initial = 100/4 = 25, 不超过 ceiling
+		if pool.Cap() > 50 {
+			t.Errorf("ceiling=50 但 cap = %d", pool.Cap())
+		}
+	})
+
+	t.Run("高频 Invoke 不 panic", func(t *testing.T) {
+		metrics := &ScanMetrics{}
+		pool, err := NewAdaptivePool(10, 10, func(interface{}) {
+			time.Sleep(time.Millisecond)
+		}, metrics)
+		if err != nil {
+			t.Fatalf("创建失败: %v", err)
+		}
+		defer pool.Release()
+		pool.inSlowStart = false
+		pool.tune(10)
+
+		var wg sync.WaitGroup
+		for i := 0; i < 100; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				_ = pool.Invoke(nil)
+			}()
+		}
+		wg.Wait()
+		pool.Wait()
+	})
+
+	t.Run("assessHealth 零增量", func(t *testing.T) {
+		metrics := &ScanMetrics{}
+		pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics)
+		if err != nil {
+			t.Fatalf("创建失败: %v", err)
+		}
+		defer pool.Release()
+
+		// 初始化 prevSnapshot 后不产生新数据
+		pool.prevSnapshot = metrics.Snapshot()
+		health := pool.assessHealth()
+		if health != HealthUnknown {
+			t.Errorf("零增量应返回 HealthUnknown, got %v", health)
+		}
+	})
+}
+
+// =============================================================================
+// pickSamples 边界
+// =============================================================================
+
+func TestPickSamples_EdgeCases(t *testing.T) {
+	t.Run("maxSamples=0", func(t *testing.T) {
+		s := pickSamples([]string{"a", "b"}, 0)
+		if len(s) != 0 {
+			t.Errorf("maxSamples=0 应返回空, got %d", len(s))
+		}
+	})
+
+	t.Run("maxSamples=1", func(t *testing.T) {
+		s := pickSamples([]string{"a", "b", "c"}, 1)
+		if len(s) != 1 {
+			t.Errorf("maxSamples=1 应返回 1 个, got %d", len(s))
+		}
+	})
+
+	t.Run("hosts 等于 maxSamples", func(t *testing.T) {
+		hosts := []string{"a", "b", "c"}
+		s := pickSamples(hosts, 3)
+		if len(s) != 3 {
+			t.Errorf("应返回全部, got %d", len(s))
+		}
+	})
+}
+
+// =============================================================================
+// isTimeoutError / isConnectionRefused 边界
+// =============================================================================
+
+func TestIsTimeoutError_EdgeCases(t *testing.T) {
+	if isTimeoutError(nil) {
+		t.Error("nil 不应判为 timeout")
+	}
+}
+
+func TestIsConnectionRefused_EdgeCases(t *testing.T) {
+	if isConnectionRefused(nil) {
+		t.Error("nil 不应判为 refused")
+	}
+}
+
+// =============================================================================
+// NetworkEnv.String 覆盖
+// =============================================================================
+
+func TestNetworkEnv_String(t *testing.T) {
+	for _, env := range []NetworkEnv{EnvLAN, EnvWAN, EnvInternet, EnvSlow} {
+		s := env.String()
+		if s == "" {
+			t.Errorf("NetworkEnv(%d).String() = 空", env)
+		}
+	}
+	// 未知值
+	s := NetworkEnv(99).String()
+	if s == "" {
+		t.Error("未知 NetworkEnv.String() = 空")
+	}
+}
+
+// =============================================================================
+// clampInt / clampDuration 边界
+// =============================================================================
+
+func TestClampInt(t *testing.T) {
+	tests := []struct {
+		v, min, max, want int
+	}{
+		{5, 1, 10, 5},
+		{0, 1, 10, 1},
+		{15, 1, 10, 10},
+		{-5, -10, -1, -5},
+		{5, 5, 5, 5},  // min == max == v
+		{3, 5, 5, 5},  // v < min == max
+		{10, 5, 5, 5}, // v > min == max
+	}
+
+	for _, tt := range tests {
+		got := clampInt(tt.v, tt.min, tt.max)
+		if got != tt.want {
+			t.Errorf("clampInt(%d, %d, %d) = %d, want %d", tt.v, tt.min, tt.max, got, tt.want)
+		}
+	}
+}
+
+func TestClampDuration(t *testing.T) {
+	got := clampDuration(5*time.Second, time.Second, 10*time.Second)
+	if got != 5*time.Second {
+		t.Errorf("got %v, want 5s", got)
+	}
+	got = clampDuration(0, time.Second, 10*time.Second)
+	if got != time.Second {
+		t.Errorf("got %v, want 1s", got)
+	}
+	got = clampDuration(time.Hour, time.Second, 10*time.Second)
+	if got != 10*time.Second {
+		t.Errorf("got %v, want 10s", got)
+	}
+}
+
+// =============================================================================
+// isExplicit 边界
+// =============================================================================
+
+func TestIsExplicit(t *testing.T) {
+	config := makeDefaultConfig()
+	// 默认值 → 非显式
+	if isExplicit(config, "time") {
+		t.Error("默认 Timeout 不应视为显式")
+	}
+	if isExplicit(config, "mt") {
+		t.Error("默认 ModuleThreadNum 不应视为显式")
+	}
+	if isExplicit(config, "retry") {
+		t.Error("默认 MaxRetries 不应视为显式")
+	}
+	if isExplicit(config, "icmp-rate") {
+		t.Error("默认 ICMPRate 不应视为显式")
+	}
+	if isExplicit(config, "num") {
+		t.Error("默认 PocNum 不应视为显式")
+	}
+
+	// 未知 flag
+	if isExplicit(config, "nonexistent") {
+		t.Error("未知 flag 不应视为显式")
+	}
+
+	// ThreadNumExplicit
+	config.ThreadNumExplicit = true
+	if !isExplicit(config, "t") {
+		t.Error("ThreadNumExplicit=true 应视为显式")
+	}
+
+	config = makeDefaultConfig()
+	config.TimeoutExplicit = true
+	config.ModuleThreadNumExplicit = true
+	config.MaxRetriesExplicit = true
+	config.Network.ICMPRateExplicit = true
+	config.POC.NumExplicit = true
+	if !isExplicit(config, "time") || !isExplicit(config, "mt") ||
+		!isExplicit(config, "retry") || !isExplicit(config, "icmp-rate") ||
+		!isExplicit(config, "num") {
+		t.Error("显式标记为 true 时默认值也应视为显式")
+	}
+}

core/env_profiler.go

@@ -0,0 +1,256 @@
+package core
+
+import (
+	"fmt"
+	"math"
+	"runtime"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+)
+
+// EnvironmentProfile 综合环境探测结果
+type EnvironmentProfile struct {
+	Net    NetworkProfile
+	System SystemProfile
+}
+
+// SystemProfile 系统能力信息
+type SystemProfile struct {
+	FDLimit int // 文件描述符上限（0 表示未知）
+	NumCPU  int
+}
+
+// ProbeSystem 探测系统能力（不需要网络目标）
+func ProbeSystem() SystemProfile {
+	p := SystemProfile{
+		NumCPU: runtime.NumCPU(),
+	}
+	p.FDLimit = getFDLimit()
+	return p
+}
+
+// TuneConfig 根据探测结果调整 Config 中的参数
+// 只调整用户未显式指定的参数
+// 每个参数的推导都有明确的公式和探测依据
+func (ep *EnvironmentProfile) TuneConfig(config *common.Config, session *common.ScanSession) {
+	net := &ep.Net
+	sys := &ep.System
+
+	// ---------- NetworkEnv ----------
+	config.DetectedNetworkEnv = int(net.Env)
+
+	// ---------- ThreadNum / ThreadCeiling ----------
+	if !isExplicit(config, "t") {
+		target, ceiling := net.RecommendConcurrency(config.ThreadNum, config.ThreadNumExplicit)
+		old := config.ThreadNum
+		config.ThreadNum = target
+		config.ThreadCeiling = ceiling
+		session.LogDebug(fmt.Sprintf("ThreadNum: %d -> %d, Ceiling: %d (env=%s)", old, target, ceiling, net.Env))
+	} else {
+		config.ThreadCeiling = config.ThreadNum
+	}
+
+	// ---------- Timeout ----------
+	// 公式: median_rtt + 4 * stddev，下限 1s，上限 10s
+	// 依据: 与 AdaptiveTimeout 相同的统计原理（覆盖 99.9% 的正常连接）
+	if !isExplicit(config, "time") && net.Samples > 0 {
+		computed := net.RTTMedian + 4*net.RTTStddev
+		// 下限：连接建立至少需要 2 个 RTT（SYN + SYN-ACK）+ 处理时间
+		minTO := net.RTTMedian*3 + 200*time.Millisecond
+		if computed < minTO {
+			computed = minTO
+		}
+		computed = clampDuration(computed, time.Second, 10*time.Second)
+
+		old := config.Timeout
+		config.Timeout = computed
+		session.LogDebug(fmt.Sprintf("Timeout: %v -> %v (RTT median=%v stddev=%v)",
+			old, computed, net.RTTMedian, net.RTTStddev))
+	}
+
+	// ---------- ModuleThreadNum ----------
+	// 公式: ThreadNum / 30，下限 5，上限 50
+	// 依据: 插件级并发（爆破等）不应超过端口扫描并发的 ~3%
+	//       单个服务的连接能力远低于 TCP SYN 扫描
+	//       公网服务通常有限流（MaxStartups 等），并发过高适得其反
+	if !isExplicit(config, "mt") {
+		computed := config.ThreadNum / 30
+		computed = clampInt(computed, 5, 50)
+
+		// 高丢包环境进一步压低，避免大量连接被丢弃浪费
+		if net.LossRate > 0.1 {
+			computed = computed * 2 / 3
+			if computed < 5 {
+				computed = 5
+			}
+		}
+
+		old := config.ModuleThreadNum
+		config.ModuleThreadNum = computed
+		session.LogDebug(fmt.Sprintf("ModuleThreadNum: %d -> %d (threadNum=%d)", old, computed, config.ThreadNum))
+	}
+
+	// ---------- MaxRetries ----------
+	// 公式: ceil(log(0.01) / log(loss_rate))
+	// 含义: 重试 N 次后仍然全部丢包的概率 < 1%
+	// 例: 丢包率 5% → N=2, 丢包率 20% → N=3, 丢包率 50% → N=7
+	// 下限 1（零丢包也至少试一次），上限 6（避免对不可达目标死磕）
+	if !isExplicit(config, "retry") {
+		if net.Samples > 0 {
+			computed := computeRetries(net.LossRate, net.Env)
+			old := config.MaxRetries
+			config.MaxRetries = computed
+			session.LogDebug(fmt.Sprintf("MaxRetries: %d -> %d (loss_rate=%.2f%%)", old, computed, net.LossRate*100))
+		} else if config.MaxRetries > 2 {
+			// 无网络探测数据（-np 跳过存活探测），降低默认重试避免对不可达主机死磕
+			old := config.MaxRetries
+			config.MaxRetries = 2
+			session.LogDebug(fmt.Sprintf("MaxRetries: %d -> %d (no network probe data)", old, config.MaxRetries))
+		}
+	}
+
+	// ---------- ICMPRate ----------
+	// 公式: 基于 fd limit 和网络环境
+	// 内网 fd 充裕: 0.5（高速发包）
+	// 公网或 fd 紧张: 0.1（默认保守）
+	// 依据: ICMP 发包速率受两个约束：网络带宽和本机 fd/socket 资源
+	if !isExplicit(config, "icmp-rate") && net.Samples > 0 {
+		computed := computeICMPRate(net, sys)
+		old := config.Network.ICMPRate
+		config.Network.ICMPRate = computed
+		session.LogDebug(fmt.Sprintf("ICMPRate: %.2f -> %.2f (env=%s fd=%d)", old, computed, net.Env, sys.FDLimit))
+	}
+
+	// ---------- PocNum ----------
+	// 公式: 与 ModuleThreadNum 一致
+	// 依据: POC 检测和凭据爆破的并发约束相同——都是对目标服务发起连接
+	if !isExplicit(config, "num") {
+		old := config.POC.Num
+		config.POC.Num = config.ModuleThreadNum
+		session.LogDebug(fmt.Sprintf("PocNum: %d -> %d (follows ModuleThreadNum)", old, config.POC.Num))
+	}
+
+	// ---------- DisablePing ----------
+	// 由 probeWithICMP 自动处理（尝试 → 失败 → 降级），无需在此干预
+
+	// 总结日志
+	if net.Samples > 0 {
+		session.LogInfo(i18n.Tr("env_tune_summary",
+			config.Timeout.Milliseconds(),
+			config.ModuleThreadNum,
+			config.MaxRetries,
+			fmt.Sprintf("%.2f", config.Network.ICMPRate),
+			config.POC.Num))
+	}
+
+	// fd limit 约束：总并发不应超过 fd limit 的 60%（留余量给系统）
+	if sys.FDLimit > 0 {
+		maxConcurrency := sys.FDLimit * 6 / 10
+		if config.ThreadNum > maxConcurrency {
+			session.LogInfo(i18n.Tr("env_fd_limit", config.ThreadNum, maxConcurrency, sys.FDLimit))
+			config.ThreadNum = maxConcurrency
+		}
+		if config.ThreadCeiling > maxConcurrency {
+			config.ThreadCeiling = maxConcurrency
+		}
+	}
+}
+
+// computeRetries 基于丢包率和网络环境计算重试次数
+// 内网丢包异常，用更严格的目标概率（0.5%）和更低上限
+// 公网/慢速丢包常见，放宽目标概率（2%）和更高上限
+func computeRetries(lossRate float64, env NetworkEnv) int {
+	if lossRate <= 0.001 {
+		return 1
+	}
+
+	var targetProb float64
+	var maxRetries int
+	switch env {
+	case EnvLAN:
+		targetProb = 0.005
+		maxRetries = 4
+	case EnvWAN:
+		targetProb = 0.01
+		maxRetries = 5
+	default:
+		targetProb = 0.02
+		maxRetries = 6
+	}
+
+	if lossRate >= 0.95 {
+		return maxRetries
+	}
+	// P(N次全失败) = lossRate^N < targetProb
+	n := math.Ceil(math.Log(targetProb) / math.Log(lossRate))
+	return clampInt(int(n), 1, maxRetries)
+}
+
+// computeICMPRate 基于环境计算 ICMP 发包速率
+func computeICMPRate(net *NetworkProfile, sys *SystemProfile) float64 {
+	// 基准：根据 RTT 估算网络可承受的速率
+	// RTT 越低，网络越快，可以发更快
+	var base float64
+	switch net.Env {
+	case EnvLAN:
+		base = 0.5
+	case EnvWAN:
+		base = 0.3
+	case EnvInternet:
+		base = 0.1
+	default:
+		base = 0.05
+	}
+
+	// fd 约束：fd limit 低时压低速率
+	if sys.FDLimit > 0 && sys.FDLimit < 1024 {
+		base = base * float64(sys.FDLimit) / 1024.0
+		if base < 0.02 {
+			base = 0.02
+		}
+	}
+
+	return base
+}
+
+// isExplicit 检查参数是否被用户显式指定。
+// 显式标记来自 CLI flag.Visit；值比较保留 SDK/测试里直接构造 Config 的旧行为。
+func isExplicit(config *common.Config, flagName string) bool {
+	switch flagName {
+	case "t":
+		return config.ThreadNumExplicit
+	case "time":
+		return config.TimeoutExplicit || config.Timeout != 3*time.Second
+	case "mt":
+		return config.ModuleThreadNumExplicit || config.ModuleThreadNum != 20
+	case "retry":
+		return config.MaxRetriesExplicit || config.MaxRetries != 3
+	case "icmp-rate":
+		return config.Network.ICMPRateExplicit || config.Network.ICMPRate != 0.1
+	case "num":
+		return config.POC.NumExplicit || config.POC.Num != 20
+	}
+	return false
+}
+
+func clampInt(v, min, max int) int {
+	if v < min {
+		return min
+	}
+	if v > max {
+		return max
+	}
+	return v
+}
+
+func clampDuration(v, min, max time.Duration) time.Duration {
+	if v < min {
+		return min
+	}
+	if v > max {
+		return max
+	}
+	return v
+}

core/env_profiler_test.go

@@ -0,0 +1,374 @@
+package core
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
+)
+
+// =============================================================================
+// 单元测试：computeRetries — 丢包率到重试次数的推导
+// =============================================================================
+
+func TestComputeRetries(t *testing.T) {
+	tests := []struct {
+		lossRate float64
+		wantMin  int
+		wantMax  int
+		desc     string
+	}{
+		{0.0, 1, 1, "零丢包: 只需 1 次"},
+		{0.001, 1, 1, "极低丢包: 1 次"},
+		{0.05, 2, 2, "5% 丢包: 0.05^2=0.0025 < 0.01"},
+		{0.10, 2, 3, "10% 丢包: ceil(log(0.01)/log(0.1))=2, 但边界取 ceil 可能是 3"},
+		{0.20, 3, 3, "20% 丢包: 0.2^3=0.008 < 0.01"},
+		{0.30, 3, 4, "30% 丢包"},
+		{0.50, 5, 5, "50% 丢包: ceil(log(0.01)/log(0.5))=7 但上限 5"},
+		{0.80, 5, 5, "80% 丢包: 需要很多次但上限 5"},
+		{0.95, 5, 5, "95% 丢包: 触顶"},
+		{1.0, 5, 5, "100% 丢包: 触顶"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			got := computeRetries(tt.lossRate, EnvWAN)
+			if got < tt.wantMin || got > tt.wantMax {
+				t.Errorf("computeRetries(%.2f) = %d, want [%d, %d]",
+					tt.lossRate, got, tt.wantMin, tt.wantMax)
+			}
+
+			// 验证数学正确性：lossRate^got < 0.01
+			// 跳过：零丢包、极高丢包（触顶上限 6 时数学不满足，属于设计取舍）
+			if tt.lossRate > 0.001 && tt.lossRate < 0.45 {
+				prob := math.Pow(tt.lossRate, float64(got))
+				if prob >= 0.01 {
+					t.Errorf("lossRate=%.2f retries=%d: P(全失败)=%.4f >= 0.01, 重试不够",
+						tt.lossRate, got, prob)
+				}
+			}
+		})
+	}
+}
+
+// =============================================================================
+// 单元测试：computeICMPRate
+// =============================================================================
+
+func TestComputeICMPRate(t *testing.T) {
+	tests := []struct {
+		env     NetworkEnv
+		fdLimit int
+		wantMin float64
+		wantMax float64
+		desc    string
+	}{
+		{EnvLAN, 65536, 0.4, 0.6, "内网高 fd: 高速"},
+		{EnvWAN, 65536, 0.2, 0.4, "局域网高 fd: 中速"},
+		{EnvInternet, 65536, 0.05, 0.15, "公网: 保守"},
+		{EnvSlow, 65536, 0.03, 0.08, "慢速: 极保守"},
+		{EnvLAN, 256, 0.01, 0.2, "内网低 fd: 受限"},
+		{EnvLAN, 0, 0.4, 0.6, "fd 未知: 按环境"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			net := &NetworkProfile{Env: tt.env}
+			sys := &SystemProfile{FDLimit: tt.fdLimit}
+			got := computeICMPRate(net, sys)
+			if got < tt.wantMin || got > tt.wantMax {
+				t.Errorf("computeICMPRate(env=%v, fd=%d) = %.3f, want [%.3f, %.3f]",
+					tt.env, tt.fdLimit, got, tt.wantMin, tt.wantMax)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// 集成测试：TuneConfig — 完整参数调整流程
+// =============================================================================
+
+func TestTuneConfig_LAN(t *testing.T) {
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMin:    500 * time.Microsecond,
+			RTTMedian: 1 * time.Millisecond,
+			RTTP95:    3 * time.Millisecond,
+			RTTStddev: 500 * time.Microsecond,
+			LossRate:  0.0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+	}
+
+	ep.TuneConfig(config, session)
+
+	// Timeout: median(1ms) + 4*stddev(0.5ms) = 3ms → clamp to 1s 下限
+	if config.Timeout < time.Second || config.Timeout > 2*time.Second {
+		t.Errorf("LAN Timeout = %v, 内网应该在 1-2s", config.Timeout)
+	}
+
+	// MaxRetries: 零丢包 → 1
+	if config.MaxRetries != 1 {
+		t.Errorf("LAN MaxRetries = %d, 零丢包应该是 1", config.MaxRetries)
+	}
+
+	// ICMPRate: 内网应该比默认 0.1 高
+	if config.Network.ICMPRate <= 0.1 {
+		t.Errorf("LAN ICMPRate = %.2f, 应该 > 0.1", config.Network.ICMPRate)
+	}
+
+	// ModuleThreadNum: 基于 ThreadNum/30
+	if config.ModuleThreadNum < 5 {
+		t.Errorf("LAN ModuleThreadNum = %d, 应该 >= 5", config.ModuleThreadNum)
+	}
+
+	t.Logf("LAN 参数: Timeout=%v, MT=%d, Retry=%d, ICMP=%.2f, POC=%d",
+		config.Timeout, config.ModuleThreadNum, config.MaxRetries, config.Network.ICMPRate, config.POC.Num)
+}
+
+func TestTuneConfig_Internet(t *testing.T) {
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvInternet,
+			RTTMin:    50 * time.Millisecond,
+			RTTMedian: 100 * time.Millisecond,
+			RTTP95:    250 * time.Millisecond,
+			RTTStddev: 40 * time.Millisecond,
+			LossRate:  0.08,
+			Samples:   25,
+		},
+		System: SystemProfile{FDLimit: 1024, NumCPU: 4},
+	}
+
+	ep.TuneConfig(config, session)
+
+	// Timeout: median(100ms) + 4*stddev(40ms) = 260ms → 但 minTO = 3*100+200 = 500ms
+	if config.Timeout < 500*time.Millisecond || config.Timeout > 5*time.Second {
+		t.Errorf("Internet Timeout = %v, 公网应该在 500ms-5s", config.Timeout)
+	}
+
+	// MaxRetries: 8% 丢包 → ceil(log(0.01)/log(0.08)) ≈ 2
+	if config.MaxRetries < 2 || config.MaxRetries > 3 {
+		t.Errorf("Internet MaxRetries = %d, 8%%丢包应该是 2-3", config.MaxRetries)
+	}
+
+	// ICMPRate: 公网应该偏低
+	if config.Network.ICMPRate > 0.2 {
+		t.Errorf("Internet ICMPRate = %.2f, 应该 <= 0.2", config.Network.ICMPRate)
+	}
+
+	t.Logf("Internet 参数: Timeout=%v, MT=%d, Retry=%d, ICMP=%.2f, POC=%d",
+		config.Timeout, config.ModuleThreadNum, config.MaxRetries, config.Network.ICMPRate, config.POC.Num)
+}
+
+func TestTuneConfig_SlowLossy(t *testing.T) {
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvSlow,
+			RTTMin:    200 * time.Millisecond,
+			RTTMedian: 500 * time.Millisecond,
+			RTTP95:    2 * time.Second,
+			RTTStddev: 300 * time.Millisecond,
+			LossRate:  0.25,
+			Samples:   15,
+		},
+		System: SystemProfile{FDLimit: 512, NumCPU: 2},
+	}
+
+	ep.TuneConfig(config, session)
+
+	// Timeout: median(500ms) + 4*stddev(300ms) = 1700ms, minTO = 500*3+200 = 1700ms
+	if config.Timeout < time.Second {
+		t.Errorf("Slow Timeout = %v, 慢速网络应该 >= 1s", config.Timeout)
+	}
+
+	// MaxRetries: 25% 丢包 → ceil(log(0.01)/log(0.25)) ≈ 4
+	if config.MaxRetries < 3 || config.MaxRetries > 5 {
+		t.Errorf("Slow MaxRetries = %d, 25%%丢包应该是 3-5", config.MaxRetries)
+	}
+
+	// ICMPRate: 慢速 + 低 fd → 应该很低
+	if config.Network.ICMPRate > 0.1 {
+		t.Errorf("Slow ICMPRate = %.2f, 应该 <= 0.1", config.Network.ICMPRate)
+	}
+
+	t.Logf("Slow 参数: Timeout=%v, MT=%d, Retry=%d, ICMP=%.2f, POC=%d",
+		config.Timeout, config.ModuleThreadNum, config.MaxRetries, config.Network.ICMPRate, config.POC.Num)
+}
+
+// =============================================================================
+// 集成测试：用户显式指定时不覆盖
+// =============================================================================
+
+func TestTuneConfig_ExplicitOverride(t *testing.T) {
+	config := makeDefaultConfig()
+	config.Timeout = 5 * time.Second // 用户设了 -time 5
+	config.ModuleThreadNum = 50      // 用户设了 -mt 50
+	config.MaxRetries = 1            // 用户设了 -retry 1
+	config.Network.ICMPRate = 0.8    // 用户设了 -icmp-rate 0.8
+	config.POC.Num = 100             // 用户设了 -num 100
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMedian: 1 * time.Millisecond,
+			RTTStddev: 500 * time.Microsecond,
+			LossRate:  0.0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+	}
+
+	ep.TuneConfig(config, session)
+
+	// 所有非默认值都不应被覆盖
+	if config.Timeout != 5*time.Second {
+		t.Errorf("用户 Timeout 被覆盖: %v", config.Timeout)
+	}
+	if config.ModuleThreadNum != 50 {
+		t.Errorf("用户 ModuleThreadNum 被覆盖: %d", config.ModuleThreadNum)
+	}
+	if config.MaxRetries != 1 {
+		t.Errorf("用户 MaxRetries 被覆盖: %d", config.MaxRetries)
+	}
+	if config.Network.ICMPRate != 0.8 {
+		t.Errorf("用户 ICMPRate 被覆盖: %.2f", config.Network.ICMPRate)
+	}
+	if config.POC.Num != 100 {
+		t.Errorf("用户 PocNum 被覆盖: %d", config.POC.Num)
+	}
+}
+
+func TestTuneConfig_ExplicitDefaultValues(t *testing.T) {
+	config := makeDefaultConfig()
+	config.TimeoutExplicit = true
+	config.ModuleThreadNumExplicit = true
+	config.MaxRetriesExplicit = true
+	config.Network.ICMPRateExplicit = true
+	config.POC.NumExplicit = true
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMedian: 1 * time.Millisecond,
+			RTTStddev: 500 * time.Microsecond,
+			LossRate:  0.0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+	}
+
+	ep.TuneConfig(config, session)
+
+	if config.Timeout != 3*time.Second {
+		t.Errorf("显式默认 Timeout 被覆盖: %v", config.Timeout)
+	}
+	if config.ModuleThreadNum != 20 {
+		t.Errorf("显式默认 ModuleThreadNum 被覆盖: %d", config.ModuleThreadNum)
+	}
+	if config.MaxRetries != 3 {
+		t.Errorf("显式默认 MaxRetries 被覆盖: %d", config.MaxRetries)
+	}
+	if config.Network.ICMPRate != 0.1 {
+		t.Errorf("显式默认 ICMPRate 被覆盖: %.2f", config.Network.ICMPRate)
+	}
+	if config.POC.Num != 20 {
+		t.Errorf("显式默认 PocNum 被覆盖: %d", config.POC.Num)
+	}
+}
+
+// =============================================================================
+// 集成测试：fd limit 约束
+// =============================================================================
+
+func TestTuneConfig_FDLimitConstraint(t *testing.T) {
+	config := makeDefaultConfig()
+	config.ThreadNum = 600
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMedian: 1 * time.Millisecond,
+			RTTStddev: 500 * time.Microsecond,
+			LossRate:  0.0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 256, NumCPU: 4},
+	}
+
+	ep.TuneConfig(config, session)
+
+	// 600 线程 > 256 * 0.6 = 153 → 应该被约束
+	maxExpected := 256 * 6 / 10
+	if config.ThreadNum > maxExpected {
+		t.Errorf("ThreadNum = %d, 应该 <= %d (fd_limit=256)", config.ThreadNum, maxExpected)
+	}
+
+	t.Logf("fd limit 约束: ThreadNum=%d (max=%d)", config.ThreadNum, maxExpected)
+}
+
+// =============================================================================
+// 集成测试：零样本时不调整
+// =============================================================================
+
+func TestTuneConfig_NoSamples(t *testing.T) {
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+
+	origTimeout := config.Timeout
+	origRetry := config.MaxRetries
+	origICMP := config.Network.ICMPRate
+
+	ep := &EnvironmentProfile{
+		Net:    NetworkProfile{Samples: 0},
+		System: SystemProfile{FDLimit: 65536},
+	}
+
+	ep.TuneConfig(config, session)
+
+	if config.Timeout != origTimeout {
+		t.Errorf("零样本不应改 Timeout: %v -> %v", origTimeout, config.Timeout)
+	}
+	// 零样本时，默认重试降到 2（避免对不可达主机死磕）
+	if origRetry > 2 && config.MaxRetries != 2 {
+		t.Errorf("零样本应降 MaxRetries 至 2: %d -> %d", origRetry, config.MaxRetries)
+	}
+	if config.Network.ICMPRate != origICMP {
+		t.Errorf("零样本不应改 ICMPRate: %.2f -> %.2f", origICMP, config.Network.ICMPRate)
+	}
+}
+
+// =============================================================================
+// 辅助
+// =============================================================================
+
+func makeDefaultConfig() *common.Config {
+	return &common.Config{
+		Timeout:         3 * time.Second,
+		ThreadNum:       600,
+		ModuleThreadNum: 20,
+		MaxRetries:      3,
+		Network:         common.NetworkConfig{ICMPRate: 0.1},
+		POC:             common.POCConfig{Num: 20},
+		Output:          common.OutputConfig{LogLevel: "base,info,success"},
+	}
+}
+
+func makeTestSession(config *common.Config) *common.ScanSession {
+	return common.NewScanSession(config, common.NewState(), &common.FlagVars{})
+}

core/fd_limit_unix.go

@@ -0,0 +1,13 @@
+//go:build !windows
+
+package core
+
+import "syscall"
+
+func getFDLimit() int {
+	var lim syscall.Rlimit
+	if err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &lim); err != nil {
+		return 0
+	}
+	return int(lim.Cur)
+}

core/fd_limit_windows.go

@@ -0,0 +1,8 @@
+//go:build windows
+
+package core
+
+// Windows 没有 RLIMIT_NOFILE，句柄上限由系统管理
+func getFDLimit() int {
+	return 0
+}

core/icmp.go

@@ -183,9 +183,6 @@ func probeWithICMP(hostslist []string, chanHosts chan string, aliveHosts *[]stri
 		return
 	}
 
-	common.LogError(i18n.Tr("icmp_listen_failed", err))
-	common.LogInfo(i18n.GetText("trying_no_listen_icmp"))
-
 	// 尝试无监听ICMP探测
 	conn2, err := net.DialTimeout("ip4:icmp", "127.0.0.1", 3*time.Second)
 	if err == nil {
@@ -194,8 +191,6 @@ func probeWithICMP(hostslist []string, chanHosts chan string, aliveHosts *[]stri
 		return
 	}
 
-	common.LogError(i18n.Tr("icmp_connect_failed", err))
-	common.LogError(i18n.GetText("insufficient_privileges"))
 	common.LogInfo(i18n.GetText("switching_to_ping"))
 
 	// 降级使用ping探测

core/integration_test.go

@@ -0,0 +1,545 @@
+package core
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// =============================================================================
+// 集成测试 1：探测 → 参数调整 → 线程池创建 完整链路
+// 验证从 NetworkProfile 到 TuneConfig 到 AdaptivePool 的端到端数据流
+// =============================================================================
+
+func TestIntegration_ProbeToPool_LAN(t *testing.T) {
+	// 模拟内网探测结果
+	profile := classifyNetwork(
+		makeDurations([]int{1, 1, 2, 2, 2, 3, 3, 3, 4, 5}), // ms
+		0, 10,
+	)
+
+	if profile.Env != EnvLAN {
+		t.Fatalf("探测环境 = %v, want LAN", profile.Env)
+	}
+
+	// 构建 Config + TuneConfig
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+	sys := ProbeSystem()
+
+	ep := &EnvironmentProfile{Net: *profile, System: sys}
+	ep.TuneConfig(config, session)
+
+	// 验证参数被合理调整
+	if config.Timeout > 3*time.Second {
+		t.Errorf("内网 Timeout = %v, 不应 > 3s", config.Timeout)
+	}
+	if config.MaxRetries != 1 {
+		t.Errorf("内网零丢包 MaxRetries = %d, want 1", config.MaxRetries)
+	}
+
+	// 用调整后的参数创建线程池
+	target, ceiling := profile.RecommendConcurrency(config.ThreadNum, config.ThreadNumExplicit)
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(target, ceiling, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	if pool.Cap() <= 0 {
+		t.Errorf("池容量 = %d, 应该 > 0", pool.Cap())
+	}
+
+	t.Logf("内网完整链路: Timeout=%v MT=%d Retry=%d ICMP=%.2f target=%d ceiling=%d poolCap=%d",
+		config.Timeout, config.ModuleThreadNum, config.MaxRetries,
+		config.Network.ICMPRate, target, ceiling, pool.Cap())
+}
+
+func TestIntegration_ProbeToPool_Internet(t *testing.T) {
+	profile := classifyNetwork(
+		makeDurations([]int{60, 70, 80, 90, 100, 110, 120, 130, 140, 150}),
+		0, 10,
+	)
+
+	if profile.Env != EnvInternet {
+		t.Fatalf("探测环境 = %v, want Internet", profile.Env)
+	}
+
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+	ep := &EnvironmentProfile{Net: *profile, System: SystemProfile{FDLimit: 4096, NumCPU: 4}}
+	ep.TuneConfig(config, session)
+
+	target, ceiling := profile.RecommendConcurrency(config.ThreadNum, config.ThreadNumExplicit)
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(target, ceiling, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 公网并发应该明显低于默认 600
+	if target >= 600 {
+		t.Errorf("公网 target = %d, 应该 < 600", target)
+	}
+
+	t.Logf("公网完整链路: Timeout=%v MT=%d Retry=%d target=%d ceiling=%d poolCap=%d",
+		config.Timeout, config.ModuleThreadNum, config.MaxRetries, target, ceiling, pool.Cap())
+}
+
+// =============================================================================
+// 集成测试 2：AdaptivePool + ScanMetrics 联动
+// 验证：任务执行 → metrics 记录 → 池读取 metrics → 做出调整决策
+// =============================================================================
+
+func TestIntegration_PoolMetrics_HealthyTraffic(t *testing.T) {
+	metrics := &ScanMetrics{}
+	var taskCount atomic.Int64
+
+	pool, err := NewAdaptivePool(100, 100, func(i interface{}) {
+		taskCount.Add(1)
+	}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(100)
+
+	// 注入健康 metrics
+	for i := 0; i < 200; i++ {
+		metrics.RecordConnect(time.Millisecond)
+	}
+
+	// 运行任务
+	var wg sync.WaitGroup
+	for i := 0; i < 200; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = pool.Invoke(nil)
+		}()
+	}
+	wg.Wait()
+	pool.Wait()
+
+	// 触发调整
+	pool.lastCheck.Store(0)
+	pool.adjust()
+
+	if pool.Cap() < 90 {
+		t.Errorf("健康流量池容量不应大幅下降: cap = %d", pool.Cap())
+	}
+
+	t.Logf("健康流量: tasks=%d connects=%d cap=%d",
+		taskCount.Load(), metrics.Snapshot().Connects, pool.Cap())
+}
+
+func TestIntegration_PoolMetrics_ExhaustedTraffic(t *testing.T) {
+	metrics := &ScanMetrics{}
+
+	pool, err := NewAdaptivePool(100, 100, func(i interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(100)
+
+	// 直接向 metrics 注入大量资源耗尽事件（模拟扫描过程中的 fd 不足）
+	for i := 0; i < 200; i++ {
+		metrics.RecordExhausted()
+	}
+
+	// 手动触发调整（清除时间守卫）
+	pool.lastCheck.Store(0)
+	pool.adjust()
+
+	// 资源耗尽率 100% → 应该降速
+	if pool.Cap() >= 100 {
+		t.Errorf("资源耗尽后池应该降速: cap = %d", pool.Cap())
+	}
+
+	t.Logf("资源耗尽: exhausted=%d cap=%d", metrics.Snapshot().Exhausted, pool.Cap())
+}
+
+// =============================================================================
+// 集成测试 3：慢启动 → 稳态 AIMD 过渡
+// 验证慢启动阶段的翻倍行为和过渡到稳态的时机
+// =============================================================================
+
+func TestIntegration_SlowStartToSteady(t *testing.T) {
+	metrics := &ScanMetrics{}
+
+	pool, err := NewAdaptivePool(100, 100, func(i interface{}) {
+		metrics.RecordConnect(time.Millisecond)
+	}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	if !pool.inSlowStart {
+		t.Fatal("初始应该在慢启动状态")
+	}
+
+	initialCap := pool.Cap()
+	t.Logf("慢启动初始: cap=%d", initialCap)
+
+	// 喂入足够的健康 metrics
+	for i := 0; i < 100; i++ {
+		metrics.RecordConnect(time.Millisecond)
+	}
+
+	// 模拟多次调整周期
+	caps := []int{initialCap}
+	for i := 0; i < 10; i++ {
+		pool.lastCheck.Store(0) // 强制触发检查
+		pool.adjust()
+		caps = append(caps, pool.Cap())
+	}
+
+	// 验证：容量应该逐步增长
+	growing := false
+	for i := 1; i < len(caps); i++ {
+		if caps[i] > caps[i-1] {
+			growing = true
+			break
+		}
+	}
+	if !growing {
+		t.Errorf("慢启动期间容量没有增长: %v", caps)
+	}
+
+	// 最终应该退出慢启动
+	finalCap := pool.Cap()
+	if finalCap < initialCap {
+		t.Errorf("最终容量 %d < 初始 %d, 不合理", finalCap, initialCap)
+	}
+
+	t.Logf("慢启动过渡: %v, inSlowStart=%v", caps, pool.inSlowStart)
+}
+
+// =============================================================================
+// 集成测试 4：拥塞 → 降速 → 恢复 完整周期
+// =============================================================================
+
+func TestIntegration_CongestionRecovery(t *testing.T) {
+	metrics := &ScanMetrics{}
+
+	pool, err := NewAdaptivePool(200, 200, func(i interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 直接到稳态，满容量
+	pool.inSlowStart = false
+	pool.tune(200)
+
+	// === 阶段 1: 正常运行 ===
+	for i := 0; i < 100; i++ {
+		metrics.RecordConnect(time.Millisecond)
+	}
+	pool.lastCheck.Store(0)
+	pool.adjust()
+	normalCap := pool.Cap()
+	t.Logf("正常阶段: cap=%d", normalCap)
+
+	// === 阶段 2: 突发拥塞（大量资源耗尽）===
+	for i := 0; i < 200; i++ {
+		metrics.RecordExhausted()
+	}
+	pool.lastCheck.Store(0)
+	pool.adjust()
+	congestedCap := pool.Cap()
+
+	if congestedCap >= normalCap {
+		t.Errorf("拥塞后应降速: normal=%d congested=%d", normalCap, congestedCap)
+	}
+	t.Logf("拥塞阶段: cap=%d (降幅 %d%%)", congestedCap, (normalCap-congestedCap)*100/normalCap)
+
+	// === 阶段 3: 恢复（大量成功连接）===
+	for i := 0; i < 500; i++ {
+		metrics.RecordConnect(time.Millisecond)
+	}
+
+	// 多次调整模拟恢复过程
+	for i := 0; i < 20; i++ {
+		pool.lastCheck.Store(0)
+		pool.adjust()
+	}
+	recoveredCap := pool.Cap()
+
+	if recoveredCap <= congestedCap {
+		t.Errorf("恢复后应提速: congested=%d recovered=%d", congestedCap, recoveredCap)
+	}
+
+	// 恢复后不应超过 ceiling
+	if recoveredCap > 200 {
+		t.Errorf("恢复后不应超过 ceiling: cap=%d ceiling=200", recoveredCap)
+	}
+
+	t.Logf("恢复阶段: cap=%d", recoveredCap)
+}
+
+// =============================================================================
+// 集成测试 5：RTT 趋势检测 → 池调整
+// 验证 ScanMetrics 的 RTT EMA 趋势信号能正确传导到池的健康判断
+// =============================================================================
+
+func TestIntegration_RTTTrend_DrivesPoolAdjustment(t *testing.T) {
+	metrics := &ScanMetrics{}
+
+	pool, err := NewAdaptivePool(100, 100, func(i interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(100)
+
+	// 建立基线：100 个 5ms RTT
+	for i := 0; i < 200; i++ {
+		metrics.RecordConnect(5 * time.Millisecond)
+	}
+	pool.lastCheck.Store(0)
+	pool.adjust()
+	baselineCap := pool.Cap()
+
+	// RTT 突增到 100ms（20 倍）
+	for i := 0; i < 100; i++ {
+		metrics.RecordConnect(100 * time.Millisecond)
+	}
+
+	ratio := metrics.RTTRatio()
+	if ratio <= 1.0 {
+		t.Logf("RTT ratio = %.2f, EMA 可能还没追上（正常）", ratio)
+	}
+
+	// 多次调整看池是否响应
+	for i := 0; i < 5; i++ {
+		pool.lastCheck.Store(0)
+		pool.adjust()
+	}
+	afterRTTSpike := pool.Cap()
+
+	t.Logf("RTT 趋势: baseline_cap=%d after_spike=%d rtt_ratio=%.2f",
+		baselineCap, afterRTTSpike, ratio)
+
+	// 如果 ratio 足够高，池应该降速
+	if ratio > 2.0 && afterRTTSpike >= baselineCap {
+		t.Errorf("RTT ratio=%.2f 但池没有降速: %d -> %d", ratio, baselineCap, afterRTTSpike)
+	}
+}
+
+// =============================================================================
+// 集成测试 6：不同网络环境下的参数一致性
+// 验证同一组目标在不同环境下参数调整的合理递进关系
+// =============================================================================
+
+func TestIntegration_ParameterProgression(t *testing.T) {
+	environments := []struct {
+		name    string
+		rtts    []int // ms
+		loss    int   // failures out of 10
+		wantEnv NetworkEnv
+	}{
+		{"内网", []int{1, 1, 2, 2, 3, 3, 4, 4, 5, 5}, 0, EnvLAN},
+		{"局域网", []int{10, 15, 20, 25, 30, 35, 40, 45, 48, 49}, 0, EnvWAN},
+		{"公网", []int{60, 70, 80, 90, 100, 120, 140, 160, 180, 195}, 0, EnvInternet},
+		{"慢速", []int{200, 300, 400, 500, 600, 700, 800, 900, 1000, 1500}, 0, EnvSlow},
+	}
+
+	type params struct {
+		timeout  time.Duration
+		mt       int
+		retry    int
+		icmpRate float64
+	}
+
+	var results []params
+
+	for _, env := range environments {
+		profile := classifyNetwork(makeDurations(env.rtts), env.loss, 10)
+		if profile.Env != env.wantEnv {
+			t.Errorf("%s: env = %v, want %v", env.name, profile.Env, env.wantEnv)
+		}
+
+		config := makeDefaultConfig()
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    *profile,
+			System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+		}
+		ep.TuneConfig(config, session)
+
+		results = append(results, params{
+			timeout:  config.Timeout,
+			mt:       config.ModuleThreadNum,
+			retry:    config.MaxRetries,
+			icmpRate: config.Network.ICMPRate,
+		})
+
+		t.Logf("%s: Timeout=%v MT=%d Retry=%d ICMP=%.2f",
+			env.name, config.Timeout, config.ModuleThreadNum, config.MaxRetries, config.Network.ICMPRate)
+	}
+
+	// 验证递进关系：从内网到慢速，Timeout 应递增
+	for i := 1; i < len(results); i++ {
+		if results[i].timeout < results[i-1].timeout {
+			t.Errorf("Timeout 不递增: %v (env[%d]) < %v (env[%d])",
+				results[i].timeout, i, results[i-1].timeout, i-1)
+		}
+	}
+
+	// ICMPRate 应递减（内网最高，慢速最低）
+	for i := 1; i < len(results); i++ {
+		if results[i].icmpRate > results[i-1].icmpRate {
+			t.Errorf("ICMPRate 不递减: %.2f (env[%d]) > %.2f (env[%d])",
+				results[i].icmpRate, i, results[i-1].icmpRate, i-1)
+		}
+	}
+}
+
+// =============================================================================
+// 集成测试 7：用户显式 -t + 网络探测 完整流程
+// 验证用户指定值作为 ceiling 但探测仍然影响其他参数
+// =============================================================================
+
+func TestIntegration_ExplicitThreadNum_WithProbe(t *testing.T) {
+	profile := classifyNetwork(
+		makeDurations([]int{100, 120, 140, 160, 180, 200, 220, 240, 260, 300}),
+		2, 12, // 部分丢包
+	)
+
+	config := makeDefaultConfig()
+	config.ThreadNum = 200
+	config.ThreadNumExplicit = true
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net:    *profile,
+		System: SystemProfile{FDLimit: 4096, NumCPU: 4},
+	}
+	ep.TuneConfig(config, session)
+
+	// ThreadNum 不应被修改（fd limit 允许范围内）
+	// 但 Timeout、ModuleThreadNum 等应根据探测调整
+	if config.Timeout == 3*time.Second {
+		t.Error("即使 -t 显式，Timeout 仍应根据探测调整")
+	}
+
+	// 创建池
+	target, ceiling := profile.RecommendConcurrency(config.ThreadNum, config.ThreadNumExplicit)
+	if ceiling != 200 {
+		t.Errorf("显式 -t 200 的 ceiling = %d, want 200", ceiling)
+	}
+	if target > 200 {
+		t.Errorf("target = %d, 不应超过 ceiling 200", target)
+	}
+
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(target, ceiling, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	t.Logf("显式 -t 200: Timeout=%v MT=%d Retry=%d target=%d ceiling=%d cap=%d",
+		config.Timeout, config.ModuleThreadNum, config.MaxRetries, target, ceiling, pool.Cap())
+}
+
+// =============================================================================
+// 集成测试 8：AdaptiveTimeout + ScanMetrics 双 RTT 追踪
+// 验证两个 RTT 追踪器独立工作不干扰
+// =============================================================================
+
+func TestIntegration_DualRTTTracking(t *testing.T) {
+	adaptiveTO := NewAdaptiveTimeout(3 * time.Second)
+	metrics := &ScanMetrics{}
+
+	// 喂入相同的 RTT 数据到两个追踪器
+	for i := 0; i < 50; i++ {
+		rtt := 10 * time.Millisecond
+		adaptiveTO.Record(rtt)
+		metrics.RecordConnect(rtt)
+	}
+
+	// AdaptiveTimeout 用于连接超时
+	toValue := adaptiveTO.Timeout()
+	// ScanMetrics 用于池健康判断
+	rttFast := metrics.RTTFast()
+	ratio := metrics.RTTRatio()
+
+	if toValue > 3*time.Second {
+		t.Errorf("AdaptiveTimeout 应该 < 初始值: %v", toValue)
+	}
+	if rttFast < 8*time.Millisecond || rttFast > 12*time.Millisecond {
+		t.Errorf("ScanMetrics RTTFast 应接近 10ms: %v", rttFast)
+	}
+	if ratio < 0.8 || ratio > 1.2 {
+		t.Errorf("稳定 RTT 的 ratio 应接近 1.0: %.2f", ratio)
+	}
+
+	t.Logf("双追踪: AdaptiveTO=%v, MetricsFast=%v, Ratio=%.2f", toValue, rttFast, ratio)
+}
+
+// =============================================================================
+// 集成测试 9：丢包环境下 Retry + ModuleThreadNum 联动
+// 验证高丢包同时影响重试和并发
+// =============================================================================
+
+func TestIntegration_LossyNetwork_RetryAndConcurrency(t *testing.T) {
+	lossRates := []float64{0.0, 0.05, 0.10, 0.20, 0.40}
+
+	type result struct {
+		loss  float64
+		retry int
+		mt    int
+	}
+	var results []result
+
+	for _, loss := range lossRates {
+		profile := &NetworkProfile{
+			Env:       EnvInternet,
+			RTTMedian: 80 * time.Millisecond,
+			RTTStddev: 20 * time.Millisecond,
+			LossRate:  loss,
+			Samples:   20,
+		}
+
+		config := makeDefaultConfig()
+		session := makeTestSession(config)
+		ep := &EnvironmentProfile{
+			Net:    *profile,
+			System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+		}
+		ep.TuneConfig(config, session)
+
+		results = append(results, result{loss, config.MaxRetries, config.ModuleThreadNum})
+	}
+
+	// 重试次数应随丢包率单调递增
+	for i := 1; i < len(results); i++ {
+		if results[i].retry < results[i-1].retry {
+			t.Errorf("Retry 不递增: loss=%.2f retry=%d < loss=%.2f retry=%d",
+				results[i].loss, results[i].retry, results[i-1].loss, results[i-1].retry)
+		}
+	}
+
+	// 高丢包时 ModuleThreadNum 应降低
+	if results[len(results)-1].mt >= results[0].mt {
+		t.Errorf("40%%丢包的 MT(%d) 应 < 0%%丢包的 MT(%d)",
+			results[len(results)-1].mt, results[0].mt)
+	}
+
+	for _, r := range results {
+		t.Logf("loss=%.0f%%: Retry=%d MT=%d", r.loss*100, r.retry, r.mt)
+	}
+}

core/network_profiler.go

@@ -0,0 +1,281 @@
+package core
+
+import (
+	"context"
+	"math"
+	"net"
+	"sort"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+)
+
+// NetworkEnv 网络环境分类
+type NetworkEnv int
+
+const (
+	EnvLAN      NetworkEnv = iota // 内网: RTT < 5ms, 丢包 < 1%
+	EnvWAN                        // 局域网/专线: RTT 5~50ms, 丢包 < 5%
+	EnvInternet                   // 公网: RTT 50~200ms
+	EnvSlow                       // 慢速/高丢包: RTT > 200ms 或 丢包 > 10%
+)
+
+func (e NetworkEnv) String() string {
+	switch e {
+	case EnvLAN:
+		return i18n.GetText("net_env_lan")
+	case EnvWAN:
+		return i18n.GetText("net_env_wan")
+	case EnvInternet:
+		return i18n.GetText("net_env_internet")
+	default:
+		return i18n.GetText("net_env_slow")
+	}
+}
+
+// NetworkProfile 网络探测结果
+type NetworkProfile struct {
+	Env       NetworkEnv
+	RTTMin    time.Duration
+	RTTMedian time.Duration
+	RTTP95    time.Duration
+	RTTStddev time.Duration
+	LossRate  float64
+	Samples   int
+}
+
+// RecommendConcurrency 根据探测结果推荐并发参数
+// 返回 (target, ceiling)
+//   - target: 推荐的目标并发数
+//   - ceiling: 允许的最大并发数
+//
+// 如果用户显式指定了 -t，ceiling = 用户值，target 取 min(推荐值, 用户值)
+// 如果用户未指定，target 和 ceiling 均为推荐值
+func (p *NetworkProfile) RecommendConcurrency(userThreadNum int, explicit bool) (target, ceiling int) {
+	// 基于网络环境的缩放因子
+	var factor float64
+	switch p.Env {
+	case EnvLAN:
+		factor = 1.5
+	case EnvWAN:
+		factor = 1.0
+	case EnvInternet:
+		factor = 0.4
+	case EnvSlow:
+		factor = 0.15
+	}
+
+	recommended := int(float64(userThreadNum) * factor)
+	if recommended < 10 {
+		recommended = 10
+	}
+
+	// 丢包率高时进一步压缩
+	if p.LossRate > 0.05 {
+		recommended = int(float64(recommended) * (1.0 - p.LossRate))
+		if recommended < 10 {
+			recommended = 10
+		}
+	}
+
+	if explicit {
+		ceiling = userThreadNum
+		target = recommended
+		if target > ceiling {
+			target = ceiling
+		}
+	} else {
+		target = recommended
+		ceiling = recommended
+	}
+	return
+}
+
+// probePorts 探测用的端口列表（高响应率的常见端口）
+var probePorts = []int{80, 443, 22, 445, 8080, 3389, 21, 8443}
+
+func networkProbeAddress(host string, port int) string {
+	return net.JoinHostPort(host, strconv.Itoa(port))
+}
+
+// ProbeNetwork 探测目标网络环境
+// 从 hosts 中抽样，用低并发 TCP 连接测量 RTT 和丢包率
+// 整个过程控制在数秒内完成
+func ProbeNetwork(ctx context.Context, hosts []string, session *common.ScanSession) *NetworkProfile {
+	if len(hosts) == 0 {
+		return defaultProfile()
+	}
+
+	// 抽样：均匀分布，最多 10 个
+	samples := pickSamples(hosts, 10)
+	probeTimeout := session.Config.Timeout
+	if probeTimeout > time.Second {
+		probeTimeout = time.Second
+	}
+	if probeTimeout < 500*time.Millisecond {
+		probeTimeout = 500 * time.Millisecond
+	}
+
+	var (
+		mu       sync.Mutex
+		rtts     []time.Duration
+		failures int
+		total    int
+	)
+
+	sem := make(chan struct{}, 10)
+	var wg sync.WaitGroup
+
+	for _, host := range samples {
+		for _, port := range probePorts {
+			select {
+			case <-ctx.Done():
+				goto done
+			default:
+			}
+
+			total++
+			wg.Add(1)
+			sem <- struct{}{}
+
+			go func(h string, p int) {
+				defer func() { <-sem; wg.Done() }()
+
+				addr := networkProbeAddress(h, p)
+				start := time.Now()
+				conn, err := session.DialTCP(ctx, "tcp", addr, probeTimeout)
+				rtt := time.Since(start)
+
+				mu.Lock()
+				defer mu.Unlock()
+
+				if err != nil {
+					// 连接拒绝也是有效的 RTT 样本（说明对端可达）
+					if isConnectionRefused(err) {
+						rtts = append(rtts, rtt)
+					}
+					failures++
+				} else {
+					_ = conn.Close()
+					rtts = append(rtts, rtt)
+				}
+			}(host, port)
+		}
+	}
+done:
+	wg.Wait()
+
+	return classifyNetwork(rtts, failures, total)
+}
+
+func classifyNetwork(rtts []time.Duration, failures, total int) *NetworkProfile {
+	if len(rtts) == 0 {
+		return defaultProfile()
+	}
+
+	sort.Slice(rtts, func(i, j int) bool { return rtts[i] < rtts[j] })
+
+	n := len(rtts)
+	median := rtts[n/2]
+	p95idx := int(float64(n) * 0.95)
+	if p95idx >= n {
+		p95idx = n - 1
+	}
+	p95 := rtts[p95idx]
+
+	// 标准差
+	var sum float64
+	for _, r := range rtts {
+		sum += float64(r)
+	}
+	mean := sum / float64(n)
+	var variance float64
+	for _, r := range rtts {
+		d := float64(r) - mean
+		variance += d * d
+	}
+	stddev := time.Duration(math.Sqrt(variance / float64(n)))
+
+	// 丢包率：只计算超时的（非 refused），但简化为 1 - 有效响应数/总数
+	lossRate := 1.0 - float64(n)/float64(total)
+	if lossRate < 0 {
+		lossRate = 0
+	}
+
+	// 分类
+	env := classifyEnv(median, lossRate)
+
+	return &NetworkProfile{
+		Env:       env,
+		RTTMin:    rtts[0],
+		RTTMedian: median,
+		RTTP95:    p95,
+		RTTStddev: stddev,
+		LossRate:  lossRate,
+		Samples:   n,
+	}
+}
+
+func classifyEnv(median time.Duration, lossRate float64) NetworkEnv {
+	switch {
+	case lossRate > 0.10:
+		return EnvSlow
+	case median < 5*time.Millisecond && lossRate < 0.01:
+		return EnvLAN
+	case median < 50*time.Millisecond && lossRate < 0.05:
+		return EnvWAN
+	case median < 200*time.Millisecond:
+		return EnvInternet
+	default:
+		return EnvSlow
+	}
+}
+
+func defaultProfile() *NetworkProfile {
+	return &NetworkProfile{
+		Env:       EnvWAN,
+		RTTMedian: 10 * time.Millisecond,
+		LossRate:  0,
+		Samples:   0,
+	}
+}
+
+// pickSamples 均匀抽样
+func pickSamples(hosts []string, maxSamples int) []string {
+	if maxSamples <= 0 {
+		return nil
+	}
+	n := len(hosts)
+	if n <= maxSamples {
+		return hosts
+	}
+	step := n / maxSamples
+	samples := make([]string, 0, maxSamples)
+	for i := 0; i < n && len(samples) < maxSamples; i += step {
+		samples = append(samples, hosts[i])
+	}
+	return samples
+}
+
+func isConnectionRefused(err error) bool {
+	if err == nil {
+		return false
+	}
+	// connection refused 通常包含 "refused" 关键词
+	// 在不同 OS 上表现一致
+	return containsFold(err.Error(), "refused")
+}
+
+// isTimeoutError 判断是否为超时错误
+func isTimeoutError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if ne, ok := err.(net.Error); ok {
+		return ne.Timeout()
+	}
+	return containsFold(err.Error(), "timeout") || containsFold(err.Error(), "deadline")
+}

core/network_profiler_test.go

@@ -0,0 +1,187 @@
+package core
+
+import (
+	"testing"
+	"time"
+)
+
+// =============================================================================
+// 单元测试：classifyEnv — 网络环境分类
+// =============================================================================
+
+func TestClassifyEnv(t *testing.T) {
+	tests := []struct {
+		median   time.Duration
+		lossRate float64
+		wantEnv  NetworkEnv
+		desc     string
+	}{
+		{1 * time.Millisecond, 0.0, EnvLAN, "1ms 零丢包 → 内网"},
+		{3 * time.Millisecond, 0.005, EnvLAN, "3ms 0.5%丢包 → 内网"},
+		{5 * time.Millisecond, 0.0, EnvWAN, "5ms 零丢包 → 局域网边界"},
+		{20 * time.Millisecond, 0.02, EnvWAN, "20ms 2%丢包 → 局域网"},
+		{50 * time.Millisecond, 0.03, EnvInternet, "50ms 3%丢包 → 公网边界"},
+		{100 * time.Millisecond, 0.05, EnvInternet, "100ms 5%丢包 → 公网"},
+		{300 * time.Millisecond, 0.05, EnvSlow, "300ms → 慢速"},
+		{50 * time.Millisecond, 0.15, EnvSlow, "50ms 15%丢包 → 高丢包归类慢速"},
+		{1 * time.Millisecond, 0.20, EnvSlow, "低延迟但高丢包 → 慢速"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			got := classifyEnv(tt.median, tt.lossRate)
+			if got != tt.wantEnv {
+				t.Errorf("classifyEnv(median=%v, loss=%.2f) = %v, want %v",
+					tt.median, tt.lossRate, got, tt.wantEnv)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// 单元测试：classifyNetwork — 从 RTT 样本推导 profile
+// =============================================================================
+
+func TestClassifyNetwork(t *testing.T) {
+	t.Run("内网 RTT 分布", func(t *testing.T) {
+		rtts := makeDurations([]int{1, 1, 1, 2, 2, 2, 3, 3, 4, 5}) // ms
+		p := classifyNetwork(rtts, 0, 10)
+
+		if p.Env != EnvLAN {
+			t.Errorf("env = %v, want LAN", p.Env)
+		}
+		if p.RTTMedian > 5*time.Millisecond {
+			t.Errorf("median = %v, want < 5ms", p.RTTMedian)
+		}
+		if p.LossRate != 0 {
+			t.Errorf("lossRate = %.2f, want 0", p.LossRate)
+		}
+	})
+
+	t.Run("公网 RTT 分布（低丢包）", func(t *testing.T) {
+		rtts := makeDurations([]int{60, 70, 80, 90, 100, 110, 120, 150, 200, 300}) // ms
+		p := classifyNetwork(rtts, 0, 10)                                          // 无丢包
+
+		if p.Env != EnvInternet {
+			t.Errorf("env = %v, want Internet", p.Env)
+		}
+		if p.LossRate != 0 {
+			t.Errorf("lossRate = %.2f, want 0", p.LossRate)
+		}
+	})
+
+	t.Run("高丢包归类为慢速", func(t *testing.T) {
+		rtts := makeDurations([]int{60, 70, 80, 90, 100}) // ms, 5 responded
+		p := classifyNetwork(rtts, 5, 10)                 // 50% loss
+
+		if p.Env != EnvSlow {
+			t.Errorf("env = %v, want Slow (高丢包)", p.Env)
+		}
+	})
+
+	t.Run("零样本降级", func(t *testing.T) {
+		p := classifyNetwork(nil, 5, 5)
+		if p.Env != EnvWAN {
+			t.Errorf("env = %v, want WAN (default)", p.Env)
+		}
+		if p.Samples != 0 {
+			t.Errorf("samples = %d, want 0", p.Samples)
+		}
+	})
+}
+
+// =============================================================================
+// 单元测试：RecommendConcurrency
+// =============================================================================
+
+func TestRecommendConcurrency(t *testing.T) {
+	tests := []struct {
+		env      NetworkEnv
+		lossRate float64
+		userT    int
+		explicit bool
+		wantTMin int
+		wantTMax int
+		wantCeil int
+		desc     string
+	}{
+		{EnvLAN, 0.0, 600, false, 800, 1000, -1, "内网自动: ×1.5"},
+		{EnvWAN, 0.0, 600, false, 550, 650, -1, "局域网自动: ×1.0"},
+		{EnvInternet, 0.0, 600, false, 200, 280, -1, "公网自动: ×0.4"},
+		{EnvSlow, 0.0, 600, false, 80, 100, -1, "慢速自动: ×0.15"},
+		{EnvInternet, 0.0, 200, true, 70, 100, 200, "公网显式: target<ceiling"},
+		{EnvLAN, 0.0, 100, true, 100, 160, 100, "内网显式: ceiling=用户值"},
+		{EnvInternet, 0.15, 600, false, 170, 240, -1, "公网高丢包: 进一步压缩"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			p := &NetworkProfile{Env: tt.env, LossRate: tt.lossRate, Samples: 10}
+			target, ceiling := p.RecommendConcurrency(tt.userT, tt.explicit)
+
+			if target < tt.wantTMin || target > tt.wantTMax {
+				t.Errorf("target = %d, want [%d, %d]", target, tt.wantTMin, tt.wantTMax)
+			}
+
+			if tt.explicit && ceiling != tt.wantCeil {
+				t.Errorf("ceiling = %d, want %d", ceiling, tt.wantCeil)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// 单元测试：pickSamples
+// =============================================================================
+
+func TestPickSamples(t *testing.T) {
+	hosts := make([]string, 100)
+	for i := range hosts {
+		hosts[i] = "host"
+	}
+
+	s := pickSamples(hosts, 10)
+	if len(s) != 10 {
+		t.Errorf("pickSamples(100, 10) = %d items, want 10", len(s))
+	}
+
+	s = pickSamples(hosts[:5], 10)
+	if len(s) != 5 {
+		t.Errorf("pickSamples(5, 10) = %d items, want 5", len(s))
+	}
+
+	s = pickSamples(nil, 10)
+	if len(s) != 0 {
+		t.Errorf("pickSamples(nil, 10) = %d items, want 0", len(s))
+	}
+}
+
+func TestNetworkProbeAddressUsesJoinHostPort(t *testing.T) {
+	tests := []struct {
+		host string
+		port int
+		want string
+	}{
+		{"127.0.0.1", 80, "127.0.0.1:80"},
+		{"::1", 443, "[::1]:443"},
+		{"2001:db8::1", 22, "[2001:db8::1]:22"},
+	}
+
+	for _, tt := range tests {
+		if got := networkProbeAddress(tt.host, tt.port); got != tt.want {
+			t.Fatalf("networkProbeAddress(%q, %d) = %q, want %q", tt.host, tt.port, got, tt.want)
+		}
+	}
+}
+
+// =============================================================================
+// 辅助
+// =============================================================================
+
+func makeDurations(ms []int) []time.Duration {
+	ds := make([]time.Duration, len(ms))
+	for i, m := range ms {
+		ds[i] = time.Duration(m) * time.Millisecond
+	}
+	return ds
+}

core/optimization_integration_test.go

@@ -0,0 +1,549 @@
+package core
+
+import (
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// =============================================================================
+// 优化 1：target/ceiling 分离
+// =============================================================================
+
+func TestOpt1_TargetCeilingSeparation_TuneConfig(t *testing.T) {
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMedian: 1 * time.Millisecond,
+			RTTStddev: 500 * time.Microsecond,
+			LossRate:  0.0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+	}
+
+	ep.TuneConfig(config, session)
+
+	if config.ThreadCeiling <= 0 {
+		t.Fatalf("ThreadCeiling 未被设置: %d", config.ThreadCeiling)
+	}
+
+	// 内网 factor=1.5，非显式 → target=ceiling=recommended
+	// 但 ceiling 应该 >= target
+	if config.ThreadCeiling < config.ThreadNum {
+		t.Errorf("Ceiling(%d) < ThreadNum(%d)", config.ThreadCeiling, config.ThreadNum)
+	}
+
+	t.Logf("target=%d, ceiling=%d", config.ThreadNum, config.ThreadCeiling)
+}
+
+func TestOpt1_TargetCeilingSeparation_ExplicitT(t *testing.T) {
+	config := makeDefaultConfig()
+	config.ThreadNum = 200
+	config.ThreadNumExplicit = true
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvInternet,
+			RTTMedian: 100 * time.Millisecond,
+			RTTStddev: 30 * time.Millisecond,
+			LossRate:  0.0,
+			Samples:   20,
+		},
+		System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+	}
+
+	ep.TuneConfig(config, session)
+
+	// 用户显式指定 -t → ceiling = threadNum = 200
+	if config.ThreadCeiling != 200 {
+		t.Errorf("显式 -t 200: ceiling=%d, want 200", config.ThreadCeiling)
+	}
+	if config.ThreadNum != 200 {
+		t.Errorf("显式 -t 200: threadNum=%d, want 200", config.ThreadNum)
+	}
+}
+
+func TestOpt1_PoolUsesCeiling(t *testing.T) {
+	metrics := &ScanMetrics{}
+	target, ceiling := 50, 200
+
+	pool, err := NewAdaptivePool(target, ceiling, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(target)
+
+	// 注入健康 metrics 让池增长
+	for i := 0; i < 200; i++ {
+		metrics.RecordConnect(time.Millisecond)
+	}
+
+	// 多次 adjust，池应能增长超过 target 但不超过 ceiling
+	for i := 0; i < 30; i++ {
+		pool.lastCheck.Store(0)
+		pool.adjust()
+	}
+
+	finalCap := pool.Cap()
+	if finalCap <= target {
+		t.Errorf("池应能超过 target(%d): cap=%d", target, finalCap)
+	}
+	if finalCap > ceiling {
+		t.Errorf("池不应超过 ceiling(%d): cap=%d", ceiling, finalCap)
+	}
+
+	t.Logf("target=%d, ceiling=%d, finalCap=%d", target, ceiling, finalCap)
+}
+
+func TestOpt1_FDLimitConstraintsBothFields(t *testing.T) {
+	config := makeDefaultConfig()
+	config.ThreadNum = 1000
+	session := makeTestSession(config)
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMedian: 1 * time.Millisecond,
+			RTTStddev: 500 * time.Microsecond,
+			LossRate:  0.0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 256, NumCPU: 4},
+	}
+
+	ep.TuneConfig(config, session)
+
+	maxFD := 256 * 6 / 10
+	if config.ThreadNum > maxFD {
+		t.Errorf("ThreadNum(%d) 超过 fd 限制(%d)", config.ThreadNum, maxFD)
+	}
+	if config.ThreadCeiling > maxFD {
+		t.Errorf("ThreadCeiling(%d) 超过 fd 限制(%d)", config.ThreadCeiling, maxFD)
+	}
+}
+
+// =============================================================================
+// 优化 2：RTT 漂移微调 target
+// =============================================================================
+
+func TestOpt2_RTTDriftReducesTarget(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(200, 400, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(200)
+
+	// 建立基线：slow EMA 锚定在 1ms 附近
+	for i := 0; i < 500; i++ {
+		metrics.RecordConnect(1 * time.Millisecond)
+	}
+
+	origTarget := atomic.LoadInt32(&pool.target)
+
+	// RTT 突增到 100ms（100 倍），大量喂入让 fast EMA 拉开差距
+	for i := 0; i < 1000; i++ {
+		metrics.RecordConnect(100 * time.Millisecond)
+	}
+
+	ratio := metrics.RTTRatio()
+	t.Logf("RTT ratio after spike: %.2f", ratio)
+
+	if ratio <= 3.0 {
+		t.Skipf("RTT ratio=%.2f，EMA 差距不够大，跳过", ratio)
+	}
+
+	// 需要足够的新 metrics 让 assessHealth 的 deltaTotal >= 30
+	for i := 0; i < 50; i++ {
+		metrics.RecordConnect(100 * time.Millisecond)
+	}
+
+	// 多次 adjust 触发 maybeReduceTarget
+	for i := 0; i < 10; i++ {
+		pool.lastCheck.Store(0)
+		pool.prevSnapshot = MetricsSnapshot{} // 重置快照让 delta 足够
+		pool.adjust()
+	}
+
+	newTarget := atomic.LoadInt32(&pool.target)
+	if newTarget >= origTarget {
+		t.Errorf("RTT 漂移后 target 应降低: %d -> %d (ratio=%.2f)", origTarget, newTarget, ratio)
+	}
+
+	// 不应低于 ceiling/5
+	minTarget := atomic.LoadInt32(&pool.ceiling) / 5
+	if newTarget < minTarget {
+		t.Errorf("target(%d) 低于下限(%d)", newTarget, minTarget)
+	}
+
+	t.Logf("RTT drift: ratio=%.2f, target %d -> %d (min=%d)", ratio, origTarget, newTarget, minTarget)
+}
+
+func TestOpt2_NoReductionWhenStable(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(200, 400, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(200)
+
+	// 稳定 RTT
+	for i := 0; i < 200; i++ {
+		metrics.RecordConnect(10 * time.Millisecond)
+	}
+
+	origTarget := atomic.LoadInt32(&pool.target)
+
+	for i := 0; i < 10; i++ {
+		pool.lastCheck.Store(0)
+		pool.adjust()
+	}
+
+	newTarget := atomic.LoadInt32(&pool.target)
+	if newTarget != origTarget {
+		t.Errorf("稳定 RTT 不应改变 target: %d -> %d", origTarget, newTarget)
+	}
+}
+
+// =============================================================================
+// 优化 3：assessHealth 阈值跟 NetworkEnv 关联
+// =============================================================================
+
+func TestOpt3_LANTighterThresholds(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics, EnvLAN)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(100)
+
+	// 10% exhaust rate — 对 LAN 来说应该是 Congested（阈值 8%）
+	for i := 0; i < 100; i++ {
+		if i < 10 {
+			metrics.RecordExhausted()
+		} else {
+			metrics.RecordConnect(time.Millisecond)
+		}
+	}
+
+	pool.lastCheck.Store(0)
+	pool.adjust()
+
+	if pool.Cap() >= 100 {
+		t.Errorf("LAN 10%% exhaust 应触发降速: cap=%d", pool.Cap())
+	}
+
+	t.Logf("LAN tight threshold: cap=%d (from 100)", pool.Cap())
+}
+
+func TestOpt3_InternetLooseThresholds(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics, EnvInternet)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(100)
+
+	// 10% exhaust rate — 对 Internet 来说不算 Congested（阈值 25%），应是 Stressed
+	for i := 0; i < 100; i++ {
+		if i < 10 {
+			metrics.RecordExhausted()
+		} else {
+			metrics.RecordConnect(10 * time.Millisecond)
+		}
+	}
+
+	pool.lastCheck.Store(0)
+	pool.adjust()
+	capAfter := pool.Cap()
+
+	// Internet 对 10% exhaust 只是 Stressed（×0.85），不是 Congested（×0.5）
+	if capAfter < 80 {
+		t.Errorf("Internet 10%% exhaust 不应大幅降速: cap=%d", capAfter)
+	}
+
+	t.Logf("Internet loose threshold: cap=%d (from 100)", capAfter)
+}
+
+func TestOpt3_EnvAffectsHealthDecision(t *testing.T) {
+	envs := []struct {
+		env  NetworkEnv
+		name string
+	}{
+		{EnvLAN, "LAN"},
+		{EnvWAN, "WAN"},
+		{EnvInternet, "Internet"},
+	}
+
+	var caps []int
+
+	for _, e := range envs {
+		metrics := &ScanMetrics{}
+		pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics, e.env)
+		if err != nil {
+			t.Fatalf("创建池失败: %v", err)
+		}
+
+		pool.inSlowStart = false
+		pool.tune(100)
+
+		// 相同的 12% exhaust rate
+		for i := 0; i < 100; i++ {
+			if i < 12 {
+				metrics.RecordExhausted()
+			} else {
+				metrics.RecordConnect(time.Millisecond)
+			}
+		}
+
+		pool.lastCheck.Store(0)
+		pool.adjust()
+		caps = append(caps, pool.Cap())
+		pool.Release()
+
+		t.Logf("%s: cap=%d (12%% exhaust)", e.name, caps[len(caps)-1])
+	}
+
+	// LAN 反应最激烈（cap 最低），Internet 最宽容（cap 最高）
+	if caps[0] >= caps[2] {
+		t.Errorf("LAN cap(%d) 应 < Internet cap(%d) for same exhaust rate", caps[0], caps[2])
+	}
+}
+
+// =============================================================================
+// 优化 4：去掉 semaphore，ants 池天然反压
+// =============================================================================
+
+func TestOpt4_SemaphoreRemoved(t *testing.T) {
+	// 验证 portScanTask 结构体不再有 semaphore 字段
+	// 如果 semaphore 被加回来，这段代码编译就会报 "unknown field"
+	_ = portScanTask{
+		host: "127.0.0.1",
+		port: 80,
+		addr: "127.0.0.1:80",
+	}
+	t.Log("portScanTask 无 semaphore 字段，反压由 ants pool 统一管理")
+}
+
+// =============================================================================
+// 优化 5：扩充探测端口
+// =============================================================================
+
+func TestOpt5_ProbePortsExpanded(t *testing.T) {
+	if len(probePorts) < 5 {
+		t.Errorf("probePorts 只有 %d 个，应该扩充到至少 5 个", len(probePorts))
+	}
+
+	// 验证包含关键端口
+	required := map[int]bool{80: false, 443: false, 22: false}
+	for _, p := range probePorts {
+		if _, ok := required[p]; ok {
+			required[p] = true
+		}
+	}
+	for port, found := range required {
+		if !found {
+			t.Errorf("probePorts 缺少关键端口 %d", port)
+		}
+	}
+
+	// 验证没有重复
+	seen := make(map[int]bool)
+	for _, p := range probePorts {
+		if seen[p] {
+			t.Errorf("probePorts 有重复端口 %d", p)
+		}
+		seen[p] = true
+	}
+
+	t.Logf("probePorts = %v (%d 个)", probePorts, len(probePorts))
+}
+
+// =============================================================================
+// 优化 6：computeRetries 环境自适应
+// =============================================================================
+
+func TestOpt6_RetriesEnvAware(t *testing.T) {
+	lossRate := 0.3 // 30% 丢包
+
+	lanRetry := computeRetries(lossRate, EnvLAN)
+	wanRetry := computeRetries(lossRate, EnvWAN)
+	inetRetry := computeRetries(lossRate, EnvInternet)
+
+	// LAN 目标概率更严格(0.5%)，应该重试更多；但上限更低(4)
+	// Internet 目标概率更宽松(2%)，应该重试更少；但上限更高(6)
+	t.Logf("30%% loss: LAN=%d, WAN=%d, Internet=%d", lanRetry, wanRetry, inetRetry)
+
+	if lanRetry < 1 || lanRetry > 4 {
+		t.Errorf("LAN retry=%d, 应在 [1,4]", lanRetry)
+	}
+	if wanRetry < 1 || wanRetry > 5 {
+		t.Errorf("WAN retry=%d, 应在 [1,5]", wanRetry)
+	}
+	if inetRetry < 1 || inetRetry > 6 {
+		t.Errorf("Internet retry=%d, 应在 [1,6]", inetRetry)
+	}
+}
+
+func TestOpt6_RetriesMaxByEnv(t *testing.T) {
+	// 高丢包率，各环境应返回各自上限
+	lanMax := computeRetries(0.99, EnvLAN)
+	wanMax := computeRetries(0.99, EnvWAN)
+	inetMax := computeRetries(0.99, EnvInternet)
+
+	if lanMax != 4 {
+		t.Errorf("LAN max retry=%d, want 4", lanMax)
+	}
+	if wanMax != 5 {
+		t.Errorf("WAN max retry=%d, want 5", wanMax)
+	}
+	if inetMax != 6 {
+		t.Errorf("Internet max retry=%d, want 6", inetMax)
+	}
+}
+
+func TestOpt6_RetriesMathCorrectness(t *testing.T) {
+	envs := []struct {
+		env        NetworkEnv
+		targetProb float64
+		name       string
+	}{
+		{EnvLAN, 0.005, "LAN"},
+		{EnvWAN, 0.01, "WAN"},
+		{EnvInternet, 0.02, "Internet"},
+	}
+
+	for _, e := range envs {
+		for _, loss := range []float64{0.05, 0.10, 0.20, 0.30} {
+			retries := computeRetries(loss, e.env)
+			prob := 1.0
+			for i := 0; i < retries; i++ {
+				prob *= loss
+			}
+			// 重试后全失败概率应 < targetProb（除非被 clamp 了）
+			if prob >= e.targetProb && retries < 4 {
+				t.Errorf("%s loss=%.0f%% retries=%d: P=%.6f >= %.3f",
+					e.name, loss*100, retries, prob, e.targetProb)
+			}
+		}
+	}
+}
+
+// =============================================================================
+// 端到端集成：全链路验证
+// =============================================================================
+
+func TestOptAll_EndToEnd_LANToPool(t *testing.T) {
+	// 模拟内网探测 → TuneConfig → 创建池 → 池根据 env 自适应
+	profile := classifyNetwork(
+		makeDurations([]int{1, 1, 2, 2, 2, 3, 3, 3, 4, 5}),
+		0, 10,
+	)
+
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+	ep := &EnvironmentProfile{Net: *profile, System: SystemProfile{FDLimit: 65536, NumCPU: 8}}
+	ep.TuneConfig(config, session)
+
+	// 验证 env 被存储
+	if config.DetectedNetworkEnv != int(EnvLAN) {
+		t.Errorf("DetectedNetworkEnv=%d, want %d(LAN)", config.DetectedNetworkEnv, int(EnvLAN))
+	}
+
+	// 验证 ceiling 合理
+	if config.ThreadCeiling < config.ThreadNum {
+		t.Errorf("ceiling(%d) < target(%d)", config.ThreadCeiling, config.ThreadNum)
+	}
+
+	// 创建池并验证 env 传递
+	netEnv := NetworkEnv(config.DetectedNetworkEnv)
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(config.ThreadNum, config.ThreadCeiling, func(interface{}) {}, metrics, netEnv)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	if pool.networkEnv != EnvLAN {
+		t.Errorf("池的 networkEnv=%v, want LAN", pool.networkEnv)
+	}
+
+	t.Logf("端到端 LAN: target=%d ceiling=%d env=%v maxRetry=%d",
+		config.ThreadNum, config.ThreadCeiling, netEnv, config.MaxRetries)
+}
+
+func TestOptAll_EndToEnd_InternetToPool(t *testing.T) {
+	profile := classifyNetwork(
+		makeDurations([]int{60, 70, 80, 90, 100, 110, 120, 130, 140, 150}),
+		0, 10,
+	)
+
+	config := makeDefaultConfig()
+	session := makeTestSession(config)
+	ep := &EnvironmentProfile{Net: *profile, System: SystemProfile{FDLimit: 4096, NumCPU: 4}}
+	ep.TuneConfig(config, session)
+
+	if config.DetectedNetworkEnv != int(EnvInternet) {
+		t.Errorf("DetectedNetworkEnv=%d, want %d(Internet)", config.DetectedNetworkEnv, int(EnvInternet))
+	}
+
+	// 公网 target 应明显低于默认 600
+	if config.ThreadNum >= 600 {
+		t.Errorf("公网 threadNum=%d, 应 < 600", config.ThreadNum)
+	}
+
+	// ceiling 应 == target（非显式模式）
+	if config.ThreadCeiling != config.ThreadNum {
+		t.Errorf("非显式模式 ceiling(%d) != target(%d)", config.ThreadCeiling, config.ThreadNum)
+	}
+
+	netEnv := NetworkEnv(config.DetectedNetworkEnv)
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(config.ThreadNum, config.ThreadCeiling, func(interface{}) {}, metrics, netEnv)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 注入 12% exhaust，Internet 环境应只是 Stressed 而不是 Congested
+	pool.inSlowStart = false
+	pool.tune(config.ThreadNum)
+	for i := 0; i < 100; i++ {
+		if i < 12 {
+			metrics.RecordExhausted()
+		} else {
+			metrics.RecordConnect(80 * time.Millisecond)
+		}
+	}
+	pool.lastCheck.Store(0)
+	pool.adjust()
+
+	// cap 不应被砍到一半以下（Stressed 只降 15%）
+	if pool.Cap() < config.ThreadNum*7/10 {
+		t.Errorf("Internet 12%% exhaust 降速过猛: %d -> %d", config.ThreadNum, pool.Cap())
+	}
+
+	t.Logf("端到端 Internet: target=%d ceiling=%d cap_after_stress=%d",
+		config.ThreadNum, config.ThreadCeiling, pool.Cap())
+}
+

core/port_scan.go

@@ -101,10 +101,9 @@ func (c *resultCollector) GetAll() []string {
 
 // portScanTask 端口扫描任务（轻量级，用于滑动窗口调度）
 type portScanTask struct {
-	host      string
-	port      int
-	addr      string        // 预格式化的 host:port，避免 fmt.Sprintf 热路径分配
-	semaphore chan struct{} // 完成时释放窗口槽位
+	host string
+	port int
+	addr string // 预格式化的 host:port，避免 fmt.Sprintf 热路径分配
 }
 
 // failedPortInfo 失败端口信息
@@ -148,7 +147,7 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout
 	session.LogDebug(i18n.Tr("port_scan_debug_start", len(hosts), config.ThreadNum))
 
 	// 大规模扫描预筛：跨多个 /24 时先做网段探活，跳过空网段
-	if len(hosts) > subnetProbeThreshold {
+	if !config.DisableSubnetProbe && len(hosts) > subnetProbeThreshold {
 		hosts = probeSubnets(ctx, hosts, time.Duration(timeout)*time.Second, session)
 		if len(hosts) == 0 {
 			session.LogInfo(i18n.GetText("port_scan_no_alive_subnet"))
@@ -187,13 +186,12 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout
 	totalTasks := iter.Total()
 	session.LogDebug(i18n.Tr("port_scan_debug_total_tasks", totalTasks))
 
-	// 使用传入的配置
+	// 并发参数（已由 EnvironmentProfile.TuneConfig 调整过）
 	threadNum := config.ThreadNum
 
-	// 大规模扫描警告和线程数自动调整
+	// 大规模扫描额外约束
 	if totalTasks > 100000 {
 		session.LogInfo(i18n.Tr("large_scan_notice", totalTasks, len(hosts), len(portList)))
-		// 如果任务数超过100万且线程数大于300，自动降低线程数
 		if totalTasks > 1000000 && threadNum > 300 {
 			oldThreadNum := threadNum
 			threadNum = 300
@@ -211,26 +209,28 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout
 	// 初始化并发控制
 	to := time.Duration(timeout) * time.Second
 	adaptiveTO := NewAdaptiveTimeout(to)
+	metrics := &ScanMetrics{}
 	var count atomic.Int64
 	collector := newResultCollector(stream)
 	failedCollector := &failedPortCollector{}
 	var wg sync.WaitGroup
 
+	ceiling := config.ThreadCeiling
+	if ceiling < threadNum {
+		ceiling = threadNum
+	}
+	netEnv := NetworkEnv(config.DetectedNetworkEnv)
 	session.LogDebug(i18n.Tr("port_scan_debug_pool_create", threadNum))
-	// 创建自适应线程池（支持动态调整）
-	pool, err := NewAdaptivePool(threadNum, func(task interface{}) {
+	pool, err := NewAdaptivePool(threadNum, ceiling, func(task interface{}) {
 		taskInfo, ok := task.(portScanTask)
 		if !ok {
 			return
 		}
-		defer func() {
-			<-taskInfo.semaphore // 释放窗口槽位
-			wg.Done()
-		}()
+		defer wg.Done()
 
-		scanSinglePort(ctx, taskInfo.host, taskInfo.port, taskInfo.addr, adaptiveTO, &count, collector, failedCollector, session)
+		scanSinglePort(ctx, taskInfo.host, taskInfo.port, taskInfo.addr, adaptiveTO, metrics, &count, collector, failedCollector, session)
 		common.UpdateProgressBar(1)
-	}, state)
+	}, metrics, netEnv)
 	if err != nil {
 		session.LogError(i18n.Tr("thread_pool_create_failed", err))
 		if stream != nil {
@@ -242,8 +242,8 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout
 	defer pool.Release()
 
 	session.LogDebug(i18n.GetText("port_scan_debug_schedule_start"))
-	// 滑动窗口调度：维护固定数量的"飞行中"任务
-	slidingWindowSchedule(iter, pool, &wg, threadNum)
+	// 滑动窗口调度
+	slidingWindowSchedule(iter, pool, &wg)
 	session.LogDebug(i18n.GetText("port_scan_debug_schedule_done"))
 
 	// 收集结果
@@ -288,36 +288,34 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout
 }
 
 // slidingWindowSchedule 滑动窗口调度器
-// 核心思想：维护固定数量的"飞行中"任务，一个完成立即补充新的
-// 优势：避免任务队列堆积，内存使用恒定
-func slidingWindowSchedule(iter *SocketIterator, pool *AdaptivePool, wg *sync.WaitGroup, windowSize int) {
-	// 使用信号量控制窗口大小
-	semaphore := make(chan struct{}, windowSize)
-
+// ants.PoolWithFunc.Invoke 在池满时阻塞，天然提供反压，无需额外 semaphore
+func slidingWindowSchedule(iter *SocketIterator, pool *AdaptivePool, wg *sync.WaitGroup) {
+	var dropped int64
 	for {
 		host, port, ok := iter.Next()
 		if !ok {
 			break
 		}
 
-		// 获取窗口槽位（阻塞直到有空位）
-		semaphore <- struct{}{}
-
 		wg.Add(1)
 		task := portScanTask{
-			host:      host,
-			port:      port,
-			addr:      net.JoinHostPort(host, fmtPort(port)),
-			semaphore: semaphore,
+			host: host,
+			port: port,
+			addr: net.JoinHostPort(host, fmtPort(port)),
 		}
 		if err := pool.Invoke(task); err != nil {
-			<-semaphore
 			wg.Done()
+			dropped++
+			common.LogError(i18n.Tr("port_scan_task_dropped", task.addr, err))
 		}
 	}
 
 	// 等待所有任务完成
 	wg.Wait()
+
+	if dropped > 0 {
+		common.LogError(i18n.Tr("port_scan_tasks_dropped_total", dropped))
+	}
 }
 
 // fmtPort 无分配的端口号格式化
@@ -336,7 +334,10 @@ func fmtPort(port int) string {
 	return string(buf[i:])
 }
 
-// connectWithRetry 带重试的TCP连接 - 只对资源耗尽错误重试
+// connectWithRetry 带重试的TCP连接
+//   - 资源耗尽错误：指数退避重试（maxRetries 次）
+//   - 其他错误（如 connection refused、timeout）：直接返回
+//     timeout 是正常的扫描结果（防火墙 drop / filtered），不盲目重试
 func connectWithRetry(ctx context.Context, session *common.ScanSession, addr string, timeout time.Duration, maxRetries int) (net.Conn, error) {
 	var lastErr error
 
@@ -349,9 +350,9 @@ func connectWithRetry(ctx context.Context, session *common.ScanSession, addr str
 
 		lastErr = err
 
-		// 只对资源耗尽类错误重试，端口关闭直接返回
+		// 只对资源耗尽类错误重试，端口关闭或超时直接返回
 		if !isResourceExhaustedError(err) {
-			return nil, err
+			return nil, lastErr
 		}
 
 		// 记录资源耗尽错误
@@ -420,10 +421,14 @@ func matchFold(a, b string) bool {
 }
 
 // buildServiceLogMessage 构建服务识别的日志信息
-// 格式: addr service [Product:xxx ||Version:xxx] Banner:(xxx)
+// 格式: addr-or-url service [Product:xxx ||Version:xxx] Banner:(xxx)
 func buildServiceLogMessage(addr string, serviceInfo *ServiceInfo, isWeb bool) string {
 	var msg strings.Builder
-	fmt.Fprintf(&msg, "%-21s", addr)
+	displayTarget := addr
+	if isWeb {
+		displayTarget = buildWebServiceURL(addr, serviceInfo)
+	}
+	fmt.Fprintf(&msg, "%-30s", displayTarget)
 
 	if serviceInfo.Name != "unknown" {
 		fmt.Fprintf(&msg, " %-8s", serviceInfo.Name)
@@ -444,27 +449,80 @@ func buildServiceLogMessage(addr string, serviceInfo *ServiceInfo, isWeb bool) s
 	// Banner 信息
 	if len(serviceInfo.Banner) > 0 {
 		banner := strings.TrimSpace(serviceInfo.Banner)
-		if len(banner) > 80 {
-			banner = banner[:80] + "..."
-		}
+		banner = truncateString(banner, 80)
 		fmt.Fprintf(&msg, " Banner:(%s)", banner)
 	}
 
 	return msg.String()
 }
 
+func truncateString(s string, maxRunes int) string {
+	if maxRunes < 0 {
+		return s
+	}
+	for i := range s {
+		if maxRunes == 0 {
+			return s[:i] + "..."
+		}
+		maxRunes--
+	}
+	return s
+}
+
+func buildWebServiceURL(addr string, serviceInfo *ServiceInfo) string {
+	protocol := "http"
+	serviceName := ""
+	if serviceInfo != nil {
+		serviceName = strings.ToLower(serviceInfo.Name)
+	}
+
+	if strings.Contains(serviceName, "https") || strings.Contains(serviceName, "ssl") || strings.Contains(serviceName, "tls") {
+		protocol = "https"
+	}
+
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return fmt.Sprintf("%s://%s", protocol, addr)
+	}
+	if protocol == "http" && port == "80" {
+		return fmt.Sprintf("http://%s", urlHost(host))
+	}
+	if protocol == "https" && port == "443" {
+		return fmt.Sprintf("https://%s", urlHost(host))
+	}
+	return fmt.Sprintf("%s://%s", protocol, net.JoinHostPort(host, port))
+}
+
+func urlHost(host string) string {
+	if strings.Contains(host, ":") && !strings.HasPrefix(host, "[") {
+		return "[" + host + "]"
+	}
+	return host
+}
+
 // scanSinglePort 扫描单个端口并进行服务识别（重构后的简洁版本）
-func scanSinglePort(ctx context.Context, host string, port int, addr string, adaptiveTO *AdaptiveTimeout, count *atomic.Int64, collector *resultCollector, failedCollector *failedPortCollector, session *common.ScanSession) {
+func scanSinglePort(ctx context.Context, host string, port int, addr string, adaptiveTO *AdaptiveTimeout, metrics *ScanMetrics, count *atomic.Int64, collector *resultCollector, failedCollector *failedPortCollector, session *common.ScanSession) {
 	config := session.Config
 	timeout := adaptiveTO.Timeout()
 	// 步骤1：建立连接
 	start := time.Now()
 	conn, err := connectWithRetry(ctx, session, addr, timeout, 2)
 	if err != nil {
+		rtt := time.Since(start)
+		switch {
+		case isResourceExhaustedError(err):
+			metrics.RecordExhausted()
+		case isTimeoutError(err):
+			metrics.RecordTimeout()
+		default:
+			metrics.RecordRefused(rtt)
+		}
 		handleConnectionFailure(err, host, port, addr, failedCollector)
 		return
 	}
-	adaptiveTO.Record(time.Since(start))
+	rtt := time.Since(start)
+	metrics.RecordConnect(rtt)
+	adaptiveTO.Record(rtt)
 
 	// 步骤1.5：代理连接深度验证（防止透明代理/全回显代理的假连接问题）
 	valid, verifyMethod := verifyProxyConnectionDeep(conn, addr, session)
@@ -488,7 +546,6 @@ func scanSinglePort(ctx context.Context, host string, port int, addr string, ada
 
 	// 步骤2：记录开放端口
 	count.Add(1)
-	collector.Add(addr)
 	saveOpenPort(session, host, port)
 
 	// 步骤3：服务识别（Scanner负责关闭连接，包括探测中可能创建的新连接）
@@ -507,6 +564,7 @@ func scanSinglePort(ctx context.Context, host string, port int, addr string, ada
 
 	// 步骤4：处理结果
 	processServiceResult(ctx, host, port, addr, serviceInfo, config, session)
+	collector.Add(addr)
 }
 
 // handleConnectionFailure 处理连接失败
@@ -652,6 +710,18 @@ func saveOpenPort(session *common.ScanSession, host string, port int) {
 	})
 }
 
+// correctServiceByBanner 根据 banner 特征校正被 nmap 指纹误匹配的服务名
+func correctServiceByBanner(info *ServiceInfo) {
+	if info == nil || info.Banner == "" {
+		return
+	}
+	banner := strings.ToLower(info.Banner)
+	// MySQL 握手包包含认证插件名，nmap 随机 salt 可能导致误匹配
+	if strings.Contains(banner, "mysql_native_password") || strings.Contains(banner, "caching_sha2_password") {
+		info.Name = "mysql"
+	}
+}
+
 // processServiceResult 处理服务识别结果
 func processServiceResult(ctx context.Context, host string, port int, addr string, serviceInfo *ServiceInfo, config *common.Config, session *common.ScanSession) {
 	if serviceInfo == nil {
@@ -662,13 +732,26 @@ func processServiceResult(ctx context.Context, host string, port int, addr strin
 		return
 	}
 
+	// Banner 校正：nmap 指纹库可能将 MySQL 握手包的随机 salt 误匹配为其他服务
+	correctServiceByBanner(serviceInfo)
+
+	// 缓存指纹识别结果，供插件按服务类型匹配（解决非标准端口问题）
+	CacheServiceInfo(host, port, serviceInfo)
+
 	// 保存并输出服务信息
 	details := buildServiceDetails(port, serviceInfo)
 	isWeb := IsWebServiceByFingerprint(serviceInfo)
 
+	// 指纹既不匹配 webKeywords 也不匹配 nonWebKeywords（不确定区间）
+	// 补做一次 HTTP 探测，覆盖自定义 HTTP 框架等漏网场景
+	if !isWeb && !isDefinitelyNonWeb(serviceInfo) {
+		if tryHTTPFallbackDetection(ctx, host, port, addr, config, session) {
+			isWeb = true
+		}
+	}
+
 	if isWeb {
 		details["is_web"] = true
-		MarkAsWebService(host, port, serviceInfo)
 	}
 
 	_ = session.SaveResult(&output.ScanResult{

core/port_scan_test.go

@@ -2,6 +2,8 @@ package core
 
 import (
 	"fmt"
+	"sort"
+	"strings"
 	"testing"
 )
 
@@ -212,6 +214,152 @@ func TestFormatAddress(t *testing.T) {
 	}
 }
 
+func TestBuildWebServiceURLIPv6(t *testing.T) {
+	tests := []struct {
+		name        string
+		addr        string
+		serviceInfo *ServiceInfo
+		want        string
+	}{
+		{
+			name: "http default port",
+			addr: "[2001:db8::1]:80",
+			serviceInfo: &ServiceInfo{
+				Name: "http",
+			},
+			want: "http://[2001:db8::1]",
+		},
+		{
+			name: "https default port",
+			addr: "[2001:db8::1]:443",
+			serviceInfo: &ServiceInfo{
+				Name: "https",
+			},
+			want: "https://[2001:db8::1]",
+		},
+		{
+			name: "http non-default port",
+			addr: "[2001:db8::1]:8080",
+			serviceInfo: &ServiceInfo{
+				Name: "http",
+			},
+			want: "http://[2001:db8::1]:8080",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := buildWebServiceURL(tt.addr, tt.serviceInfo); got != tt.want {
+				t.Fatalf("buildWebServiceURL(%q) = %q, want %q", tt.addr, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPortScanCollectorsAndHelpers(t *testing.T) {
+	t.Run("result collector deduplicates and streams", func(t *testing.T) {
+		stream := make(chan string, 2)
+		collector := newResultCollector(stream)
+		collector.Add("127.0.0.1:80")
+		collector.Add("127.0.0.1:80")
+		collector.Add("127.0.0.1:443")
+
+		got := collector.GetAll()
+		sort.Strings(got)
+		expected := []string{"127.0.0.1:443", "127.0.0.1:80"}
+		if !stringSlicesEqual(got, expected) {
+			t.Fatalf("collector results = %v, want %v", got, expected)
+		}
+
+		close(stream)
+		var streamed []string
+		for addr := range stream {
+			streamed = append(streamed, addr)
+		}
+		sort.Strings(streamed)
+		if !stringSlicesEqual(streamed, expected) {
+			t.Fatalf("streamed results = %v, want %v", streamed, expected)
+		}
+	})
+
+	t.Run("failed collector counts", func(t *testing.T) {
+		var collector failedPortCollector
+		collector.Add("127.0.0.1", 80, "127.0.0.1:80")
+		collector.Add("127.0.0.1", 443, "127.0.0.1:443")
+		if got := collector.Count(); got != 2 {
+			t.Fatalf("failed count = %d, want 2", got)
+		}
+	})
+
+	t.Run("proxy and closed error helpers", func(t *testing.T) {
+		if !isProxyErrorResponse([]byte{0x05, 0x01, 0x00, 0x01}) {
+			t.Fatal("SOCKS5 failure reply should be proxy error")
+		}
+		if !isProxyErrorResponse([]byte("HTTP/1.1 502 Bad Gateway\r\n\r\n")) {
+			t.Fatal("HTTP proxy error text should be detected")
+		}
+		if isProxyErrorResponse(nil) || isProxyErrorResponse([]byte{0x05, 0x00}) {
+			t.Fatal("empty or success response should not be proxy error")
+		}
+		if !isConnectionClosed(fmt.Errorf("use of closed network connection")) {
+			t.Fatal("closed connection error should be detected")
+		}
+		if isConnectionClosed(nil) || isConnectionClosed(fmt.Errorf("temporary timeout")) {
+			t.Fatal("non-closed error should not be detected")
+		}
+	})
+
+	t.Run("service details and subnet prefix", func(t *testing.T) {
+		details := buildServiceDetails(8443, &ServiceInfo{
+			Name:    "https",
+			Version: "1.2.3",
+			Banner:  " hello \r\n",
+			Extras: map[string]string{
+				"vendor_product": "nginx",
+				"os":             "linux",
+				"info":           "tls",
+				"empty":          "",
+				"ignored":        "value",
+			},
+		})
+		expected := map[string]interface{}{
+			"port":    8443,
+			"service": "https",
+			"version": "1.2.3",
+			"banner":  "hello",
+			"product": "nginx",
+			"os":      "linux",
+			"info":    "tls",
+		}
+		for key, want := range expected {
+			if got := details[key]; got != want {
+				t.Fatalf("details[%s] = %#v, want %#v (all=%#v)", key, got, want, details)
+			}
+		}
+		if _, ok := details["ignored"]; ok {
+			t.Fatalf("unexpected ignored extra in details: %#v", details)
+		}
+		if got := subnetPrefix("192.168.1.25"); got != "192.168.1" {
+			t.Fatalf("subnetPrefix IPv4 = %q", got)
+		}
+		if got := subnetPrefix("localhost"); got != "" {
+			t.Fatalf("subnetPrefix hostname = %q, want empty", got)
+		}
+	})
+}
+
+func stringSlicesEqual(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
 // =============================================================================
 // 排除端口逻辑测试（从EnhancedPortScan:28-32行提取）
 // =============================================================================
@@ -478,7 +626,31 @@ func TestBuildServiceLogMessage(t *testing.T) {
 				Extras:  map[string]string{},
 			},
 			isWeb:       true,
-			wantContain: []string{"192.168.1.1:80", "http", "1.1"},
+			wantContain: []string{"http://192.168.1.1", "http", "1.1"},
+		},
+		{
+			name: "非标准端口HTTP服务显示URL",
+			addr: "192.168.1.1:8080",
+			serviceInfo: &ServiceInfo{
+				Name:    "http",
+				Version: "1.1",
+				Banner:  "",
+				Extras:  map[string]string{},
+			},
+			isWeb:       true,
+			wantContain: []string{"http://192.168.1.1:8080", "http", "1.1"},
+		},
+		{
+			name: "HTTPS服务显示HTTPS URL",
+			addr: "192.168.1.1:443",
+			serviceInfo: &ServiceInfo{
+				Name:    "https",
+				Version: "1.1",
+				Banner:  "",
+				Extras:  map[string]string{},
+			},
+			isWeb:       true,
+			wantContain: []string{"https://192.168.1.1", "https", "1.1"},
 		},
 		{
 			name: "带Banner的SSH服务",
@@ -548,6 +720,17 @@ func TestBuildServiceLogMessage(t *testing.T) {
 	}
 }
 
+func TestBuildServiceLogMessageTruncatesBannerByRune(t *testing.T) {
+	result := buildServiceLogMessage("10.0.0.1:22", &ServiceInfo{
+		Name:   "ssh",
+		Banner: strings.Repeat("界", 85),
+		Extras: map[string]string{},
+	}, false)
+	if !strings.Contains(result, strings.Repeat("界", 80)+"...") {
+		t.Fatalf("truncated banner is not rune-safe: %q", result)
+	}
+}
+
 // contains 检查字符串是否包含子串
 func contains(s, substr string) bool {
 	return len(s) >= len(substr) && (s == substr || len(substr) == 0 ||

core/portfinger/probe_parser.go

@@ -13,7 +13,7 @@ func (p *Probe) getDirectiveSyntax(data string) (directive Directive) {
 	directive = Directive{}
 	// 查找第一个空格的位置
 	blankIndex := strings.Index(data, " ")
-	if blankIndex == -1 {
+	if blankIndex == -1 || blankIndex+3 > len(data) {
 		return directive
 	}
 
@@ -33,6 +33,10 @@ func (p *Probe) getDirectiveSyntax(data string) (directive Directive) {
 
 // parseProbeInfo 解析探测器信息，返回错误替代 panic
 func (p *Probe) parseProbeInfo(probeStr string) error {
+	if len(probeStr) < 5 {
+		return fmt.Errorf("%s", i18n.GetText("portfinger_probe_protocol_invalid"))
+	}
+
 	// 提取协议和其他信息
 	proto := probeStr[:4]
 	other := probeStr[4:]
@@ -49,6 +53,9 @@ func (p *Probe) parseProbeInfo(probeStr string) error {
 
 	// 解析指令
 	directive := p.getDirectiveSyntax(other)
+	if directive.DirectiveName == "" || directive.Delimiter == "" {
+		return fmt.Errorf("%s", i18n.GetText("portfinger_probe_name_invalid"))
+	}
 
 	// 设置探测器属性
 	p.Name = directive.DirectiveName

core/portfinger/probe_parser_test.go

@@ -0,0 +1,33 @@
+package portfinger
+
+import "testing"
+
+func TestProbeParserRejectsShortInputs(t *testing.T) {
+	tests := []string{
+		"",
+		"T",
+		"TCP",
+		"TCP ",
+		"TCP Q",
+		"TCP GetRequest q",
+	}
+
+	for _, input := range tests {
+		t.Run(input, func(t *testing.T) {
+			var probe Probe
+			if err := probe.fromString(input); err == nil {
+				t.Fatalf("fromString(%q) error = nil, want malformed input error", input)
+			}
+		})
+	}
+}
+
+func TestProbeParserAcceptsMinimalValidProbe(t *testing.T) {
+	var probe Probe
+	if err := probe.fromString(`TCP GetRequest q|GET / HTTP/1.0\r\n\r\n|`); err != nil {
+		t.Fatalf("fromString valid probe error = %v", err)
+	}
+	if probe.Name != "GetRequest" || probe.Protocol != "tcp" || probe.Data == "" {
+		t.Fatalf("probe parsed incorrectly: %#v", probe)
+	}
+}

core/portfinger/version_parser_test.go

@@ -529,3 +529,72 @@ func TestExtras_ToMap_EmptyStringFiltering(t *testing.T) {
 		}
 	})
 }
+
+// =============================================================================
+// ParseVersionInfo 测试
+// =============================================================================
+
+func TestParseVersionInfo(t *testing.T) {
+	tests := []struct {
+		name        string
+		versionInfo string
+		foundItems  []string
+		wantVP      string // VendorProduct
+		wantVer     string // Version
+		wantCPE     string
+	}{
+		{
+			name:        "只有product-斜线分隔符",
+			versionInfo: " p/Apache/",
+			wantVP:      "Apache",
+		},
+		{
+			name:        "product和version-斜线分隔符",
+			versionInfo: " p/nginx/ v/1.18.0/",
+			wantVP:      "nginx",
+			wantVer:     "1.18.0",
+		},
+		{
+			name:        "pipe分隔符",
+			versionInfo: " p|OpenSSH| v|8.2p1|",
+			wantVP:      "OpenSSH",
+			wantVer:     "8.2p1",
+		},
+		{
+			name:        "含$1占位符替换后解析",
+			versionInfo: " p/OpenSSH/ v/$1/",
+			foundItems:  []string{"8.2p1"},
+			wantVP:      "OpenSSH",
+			wantVer:     "8.2p1",
+		},
+		{
+			name:        "CPE解析",
+			versionInfo: " cpe:/a:apache:httpd:2.4.41",
+			wantCPE:     "a:apache:httpd:2.4.41",
+		},
+		{
+			name:        "空VersionInfo返回全空Extras",
+			versionInfo: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m := &Match{
+				VersionInfo: tt.versionInfo,
+				FoundItems:  tt.foundItems,
+			}
+			got := m.ParseVersionInfo(nil)
+
+			if got.VendorProduct != tt.wantVP {
+				t.Errorf("VendorProduct = %q, want %q", got.VendorProduct, tt.wantVP)
+			}
+			if got.Version != tt.wantVer {
+				t.Errorf("Version = %q, want %q", got.Version, tt.wantVer)
+			}
+			if got.CPE != tt.wantCPE {
+				t.Errorf("CPE = %q, want %q", got.CPE, tt.wantCPE)
+			}
+		})
+	}
+}

core/real_network_test.go

@@ -0,0 +1,491 @@
+package core
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
+)
+
+// =============================================================================
+// 辅助：启动本地 TCP 监听器
+// =============================================================================
+
+// startListeners 启动 N 个本地 TCP 监听端口，返回地址列表和清理函数
+func startListeners(t *testing.T, n int) (addrs []string, hosts []string, ports []int, cleanup func()) {
+	t.Helper()
+	var listeners []net.Listener
+
+	for i := 0; i < n; i++ {
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			for _, l := range listeners {
+				l.Close()
+			}
+			t.Fatalf("启动监听失败: %v", err)
+		}
+		listeners = append(listeners, ln)
+		addr := ln.Addr().String()
+		addrs = append(addrs, addr)
+
+		host, portStr, _ := net.SplitHostPort(addr)
+		hosts = append(hosts, host)
+		var port int
+		fmt.Sscanf(portStr, "%d", &port)
+		ports = append(ports, port)
+
+		// 后台 accept（不处理连接，只让 connect 成功）
+		go func(l net.Listener) {
+			for {
+				conn, err := l.Accept()
+				if err != nil {
+					return
+				}
+				conn.Close()
+			}
+		}(ln)
+	}
+
+	return addrs, hosts, ports, func() {
+		for _, l := range listeners {
+			l.Close()
+		}
+	}
+}
+
+// makeRealSession 创建用于真实网络测试的 session
+func makeRealSession(t *testing.T) (*common.Config, *common.ScanSession) {
+	t.Helper()
+	config := &common.Config{
+		Timeout:         3 * time.Second,
+		ThreadNum:       100,
+		ModuleThreadNum: 10,
+		MaxRetries:      3,
+		Network:         common.NetworkConfig{ICMPRate: 0.1},
+		POC:             common.POCConfig{Num: 20},
+		Output:          common.OutputConfig{LogLevel: "base,info,success"},
+	}
+	session := common.NewScanSession(config, common.NewState(), &common.FlagVars{})
+	return config, session
+}
+
+// =============================================================================
+// 真实测试 1：ProbeNetwork 对 localhost 探测
+// =============================================================================
+
+func TestReal_ProbeNetwork_Localhost(t *testing.T) {
+	_, hosts, _, cleanup := startListeners(t, 3)
+	defer cleanup()
+
+	_, session := makeRealSession(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	profile := ProbeNetwork(ctx, hosts, session)
+
+	if profile.Samples == 0 {
+		t.Fatal("localhost 探测应该有样本")
+	}
+
+	// localhost 应该是内网环境
+	if profile.Env != EnvLAN {
+		t.Errorf("localhost env = %v, want LAN", profile.Env)
+	}
+
+	// RTT 应该 < 10ms
+	if profile.RTTMedian > 10*time.Millisecond {
+		t.Errorf("localhost RTT median = %v, 应该 < 10ms", profile.RTTMedian)
+	}
+
+	// 丢包率应该为 0 或极低
+	if profile.LossRate > 0.1 {
+		t.Errorf("localhost loss = %.2f, 应该接近 0", profile.LossRate)
+	}
+
+	t.Logf("localhost 探测: env=%v RTT_median=%v RTT_p95=%v loss=%.2f%% samples=%d",
+		profile.Env, profile.RTTMedian, profile.RTTP95, profile.LossRate*100, profile.Samples)
+}
+
+// =============================================================================
+// 真实测试 2：ProbeNetwork 对不可达目标
+// =============================================================================
+
+func TestReal_ProbeNetwork_Unreachable(t *testing.T) {
+	_, session := makeRealSession(t)
+	// 使用 RFC 5737 保留地址段，保证不可达
+	hosts := []string{"192.0.2.1", "192.0.2.2", "192.0.2.3"}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	profile := ProbeNetwork(ctx, hosts, session)
+
+	// 不可达目标应该返回默认 profile 或高丢包
+	t.Logf("不可达探测: env=%v samples=%d loss=%.2f%%",
+		profile.Env, profile.Samples, profile.LossRate*100)
+}
+
+// =============================================================================
+// 真实测试 3：ProbeNetwork 混合可达与不可达
+// =============================================================================
+
+func TestReal_ProbeNetwork_Mixed(t *testing.T) {
+	_, hosts, _, cleanup := startListeners(t, 2)
+	defer cleanup()
+
+	// 混合真实主机和不可达地址
+	mixed := append(hosts, "192.0.2.1", "192.0.2.2")
+
+	_, session := makeRealSession(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	profile := ProbeNetwork(ctx, mixed, session)
+
+	if profile.Samples == 0 {
+		t.Error("混合探测应该有一些成功样本")
+	}
+
+	t.Logf("混合探测: env=%v RTT=%v samples=%d loss=%.2f%%",
+		profile.Env, profile.RTTMedian, profile.Samples, profile.LossRate*100)
+}
+
+// =============================================================================
+// 真实测试 4：ProbeSystem
+// =============================================================================
+
+func TestReal_ProbeSystem(t *testing.T) {
+	sys := ProbeSystem()
+
+	if sys.NumCPU <= 0 {
+		t.Errorf("NumCPU = %d, 应该 > 0", sys.NumCPU)
+	}
+
+	t.Logf("系统探测: NumCPU=%d FDLimit=%d", sys.NumCPU, sys.FDLimit)
+
+	// Linux/macOS 上 FDLimit 应该 > 0
+	// Windows 上可能为 0（设计如此）
+	if sys.FDLimit < 0 {
+		t.Errorf("FDLimit = %d, 不应为负", sys.FDLimit)
+	}
+}
+
+// =============================================================================
+// 真实测试 5：完整链路 —— 探测 → 调参 → 池创建 → 真实任务执行
+// =============================================================================
+
+func TestReal_E2E_ProbeAndScan(t *testing.T) {
+	addrs, hosts, _, cleanup := startListeners(t, 5)
+	defer cleanup()
+
+	config, session := makeRealSession(t)
+
+	// 第一步：探测
+	ctx := context.Background()
+	profile := ProbeNetwork(ctx, hosts, session)
+	sys := ProbeSystem()
+	ep := &EnvironmentProfile{Net: *profile, System: sys}
+
+	// 第二步：调参
+	ep.TuneConfig(config, session)
+
+	// 第三步：创建池
+	target, ceiling := profile.RecommendConcurrency(config.ThreadNum, false)
+	metrics := &ScanMetrics{}
+
+	var successCount atomic.Int64
+
+	pool, err := NewAdaptivePool(target, ceiling, func(i interface{}) {
+		addr := i.(string)
+		conn, err := net.DialTimeout("tcp", addr, config.Timeout)
+		if err != nil {
+			metrics.RecordTimeout()
+			return
+		}
+		defer conn.Close()
+		successCount.Add(1)
+		metrics.RecordConnect(time.Millisecond)
+	}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 跳过慢启动测试主要流程
+	pool.inSlowStart = false
+	pool.tune(target)
+
+	// 第四步：提交任务
+	var wg sync.WaitGroup
+	for _, addr := range addrs {
+		wg.Add(1)
+		a := addr
+		go func() {
+			defer wg.Done()
+			_ = pool.Invoke(a)
+		}()
+	}
+	wg.Wait()
+	pool.Wait()
+
+	// 第五步：验证
+	if successCount.Load() != int64(len(addrs)) {
+		t.Errorf("成功连接 %d/%d", successCount.Load(), len(addrs))
+	}
+
+	snap := metrics.Snapshot()
+	if snap.Connects != int64(len(addrs)) {
+		t.Errorf("metrics.Connects = %d, want %d", snap.Connects, len(addrs))
+	}
+
+	t.Logf("E2E: profile=%v timeout=%v mt=%d retry=%d target=%d connects=%d",
+		profile.Env, config.Timeout, config.ModuleThreadNum, config.MaxRetries,
+		target, snap.Connects)
+}
+
+// =============================================================================
+// 真实测试 6：大量连接的自适应行为
+// =============================================================================
+
+func TestReal_AdaptivePool_ManyConnections(t *testing.T) {
+	_, hosts, ports, cleanup := startListeners(t, 3)
+	defer cleanup()
+
+	metrics := &ScanMetrics{}
+	var successCount, failCount atomic.Int64
+
+	pool, err := NewAdaptivePool(50, 50, func(i interface{}) {
+		addr := i.(string)
+		start := time.Now()
+		conn, err := net.DialTimeout("tcp", addr, time.Second)
+		rtt := time.Since(start)
+		if err != nil {
+			failCount.Add(1)
+			metrics.RecordTimeout()
+			return
+		}
+		defer conn.Close()
+		successCount.Add(1)
+		metrics.RecordConnect(rtt)
+	}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(50)
+
+	// 提交 300 个连接任务（对 3 个端口各 100 次）
+	var wg sync.WaitGroup
+	for i := 0; i < 100; i++ {
+		for j, host := range hosts {
+			addr := fmt.Sprintf("%s:%d", host, ports[j])
+			wg.Add(1)
+			go func(a string) {
+				defer wg.Done()
+				_ = pool.Invoke(a)
+			}(addr)
+		}
+	}
+	wg.Wait()
+	pool.Wait()
+
+	total := successCount.Load() + failCount.Load()
+	if total != 300 {
+		t.Errorf("总任务 %d, want 300", total)
+	}
+
+	snap := metrics.Snapshot()
+	t.Logf("大量连接: success=%d fail=%d connects=%d timeouts=%d cap=%d rtt_ratio=%.2f",
+		successCount.Load(), failCount.Load(), snap.Connects, snap.Timeouts, pool.Cap(), metrics.RTTRatio())
+
+	// localhost 连接应该几乎全部成功
+	if successCount.Load() < 280 {
+		t.Errorf("localhost 成功率过低: %d/300", successCount.Load())
+	}
+}
+
+// =============================================================================
+// 真实测试 7：连接关闭端口 + 开放端口混合
+// =============================================================================
+
+func TestReal_MixedOpenClosed(t *testing.T) {
+	_, hosts, ports, cleanup := startListeners(t, 2)
+	defer cleanup()
+
+	metrics := &ScanMetrics{}
+
+	pool, err := NewAdaptivePool(20, 20, func(i interface{}) {
+		addr := i.(string)
+		start := time.Now()
+		conn, err := net.DialTimeout("tcp", addr, time.Second)
+		rtt := time.Since(start)
+		if err != nil {
+			if isConnectionRefused(err) {
+				metrics.RecordRefused(rtt)
+			} else {
+				metrics.RecordTimeout()
+			}
+			return
+		}
+		defer conn.Close()
+		metrics.RecordConnect(rtt)
+	}, metrics)
+	if err != nil {
+		t.Fatalf("创建池失败: %v", err)
+	}
+	defer pool.Release()
+
+	pool.inSlowStart = false
+	pool.tune(20)
+
+	var wg sync.WaitGroup
+
+	// 连接开放端口
+	for i := 0; i < 20; i++ {
+		addr := fmt.Sprintf("%s:%d", hosts[0], ports[0])
+		wg.Add(1)
+		go func(a string) {
+			defer wg.Done()
+			_ = pool.Invoke(a)
+		}(addr)
+	}
+
+	// 连接关闭端口（用一个不存在的端口）
+	for i := 0; i < 20; i++ {
+		addr := fmt.Sprintf("127.0.0.1:%d", 1) // port 1 通常关闭
+		wg.Add(1)
+		go func(a string) {
+			defer wg.Done()
+			_ = pool.Invoke(a)
+		}(addr)
+	}
+
+	wg.Wait()
+	pool.Wait()
+
+	snap := metrics.Snapshot()
+	t.Logf("混合端口: connects=%d refused=%d timeouts=%d total=%d",
+		snap.Connects, snap.Refused, snap.Timeouts, snap.Total())
+
+	// 开放端口应该全部连接成功
+	if snap.Connects < 18 {
+		t.Errorf("开放端口连接数 = %d, 应该接近 20", snap.Connects)
+	}
+
+	// RTT ratio 应该合理（不会因为 refused 而异常）
+	ratio := metrics.RTTRatio()
+	if ratio > 3.0 || ratio < 0.3 {
+		t.Errorf("混合流量 RTT ratio = %.2f, 不合理", ratio)
+	}
+}
+
+// =============================================================================
+// 真实测试 8：Context 取消时的探测行为
+// =============================================================================
+
+func TestReal_ProbeNetwork_ContextCancel(t *testing.T) {
+	_, hosts, _, cleanup := startListeners(t, 3)
+	defer cleanup()
+
+	_, session := makeRealSession(t)
+
+	// 立即取消的 context
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	profile := ProbeNetwork(ctx, hosts, session)
+
+	// 应该优雅返回默认 profile 或部分结果
+	t.Logf("取消探测: env=%v samples=%d", profile.Env, profile.Samples)
+}
+
+// =============================================================================
+// 真实测试 9：AdaptiveTimeout 真实 RTT 收敛
+// =============================================================================
+
+func TestReal_AdaptiveTimeout_Convergence(t *testing.T) {
+	addrs, _, _, cleanup := startListeners(t, 1)
+	defer cleanup()
+
+	at := NewAdaptiveTimeout(3 * time.Second)
+
+	// 初始应该返回最大超时
+	if at.Timeout() != 3*time.Second {
+		t.Errorf("冷启动 Timeout = %v, want 3s", at.Timeout())
+	}
+
+	// 做 20 次真实连接采样
+	for i := 0; i < 20; i++ {
+		start := time.Now()
+		conn, err := net.DialTimeout("tcp", addrs[0], time.Second)
+		rtt := time.Since(start)
+		if err != nil {
+			t.Fatalf("连接失败: %v", err)
+		}
+		conn.Close()
+		at.Record(rtt)
+	}
+
+	// 采样够后 Timeout 应远小于 3s（localhost RTT 通常 < 1ms）
+	converged := at.Timeout()
+	if converged >= 3*time.Second {
+		t.Errorf("采样后 Timeout = %v, 应该 < 3s", converged)
+	}
+
+	// minTO 下限断言：max(500ms, 3s/5) = 600ms
+	// localhost RTT 极低，收敛值应贴在地板上（issue #503）
+	minFloor := 600 * time.Millisecond
+	if converged < minFloor {
+		t.Errorf("收敛后 Timeout = %v, 不应低于 minTO 下限 %v", converged, minFloor)
+	}
+
+	t.Logf("AdaptiveTimeout 收敛: 3s -> %v (%d 个样本), minTO=%v", converged, 20, minFloor)
+}
+
+// =============================================================================
+// 真实测试 10：完整 TuneConfig 对真实探测数据
+// =============================================================================
+
+func TestReal_TuneConfig_WithRealProbe(t *testing.T) {
+	_, hosts, _, cleanup := startListeners(t, 5)
+	defer cleanup()
+
+	config, session := makeRealSession(t)
+
+	ctx := context.Background()
+	profile := ProbeNetwork(ctx, hosts, session)
+	sys := ProbeSystem()
+
+	origTimeout := config.Timeout
+	origMT := config.ModuleThreadNum
+	origRetry := config.MaxRetries
+	origICMP := config.Network.ICMPRate
+
+	ep := &EnvironmentProfile{Net: *profile, System: sys}
+	ep.TuneConfig(config, session)
+
+	t.Logf("真实调参:")
+	t.Logf("  Timeout:  %v -> %v", origTimeout, config.Timeout)
+	t.Logf("  MT:       %d -> %d", origMT, config.ModuleThreadNum)
+	t.Logf("  Retry:    %d -> %d", origRetry, config.MaxRetries)
+	t.Logf("  ICMPRate: %.2f -> %.2f", origICMP, config.Network.ICMPRate)
+	t.Logf("  PocNum:   20 -> %d", config.POC.Num)
+	t.Logf("  ThreadNum: %d (fd_limit=%d)", config.ThreadNum, sys.FDLimit)
+
+	// localhost 环境下的基本验证
+	if config.Timeout > 3*time.Second {
+		t.Errorf("localhost Timeout = %v, 不应高于默认 3s", config.Timeout)
+	}
+	if config.MaxRetries > 3 {
+		t.Errorf("localhost Retry = %d, 不应高于默认 3", config.MaxRetries)
+	}
+}

core/scan_metrics.go

@@ -0,0 +1,118 @@
+package core
+
+import (
+	"runtime"
+	"sync/atomic"
+	"time"
+)
+
+// ScanMetrics 扫描过程中的实时度量指标
+// 所有方法均无锁，使用 atomic 操作，可在高并发下安全调用
+type ScanMetrics struct {
+	connects  atomic.Int64 // TCP 连接成功（端口开放）
+	refused   atomic.Int64 // 连接被拒绝（端口关闭，快速 RTT）
+	timeouts  atomic.Int64 // 连接超时（端口过滤/不可达）
+	exhausted atomic.Int64 // 资源耗尽（fd/端口/内存不足）
+
+	// RTT 追踪：双 EMA（指数移动平均）
+	// fast EMA (α=0.1) 跟踪近期趋势
+	// slow EMA (α=0.02) 作为基线参考
+	rttFastNs  atomic.Int64 // 纳秒
+	rttSlowNs  atomic.Int64 // 纳秒
+	rttSamples atomic.Int64
+}
+
+func (m *ScanMetrics) RecordConnect(rtt time.Duration) {
+	m.connects.Add(1)
+	m.recordRTT(rtt)
+}
+
+func (m *ScanMetrics) RecordRefused(rtt time.Duration) {
+	m.refused.Add(1)
+	m.recordRTT(rtt)
+}
+
+func (m *ScanMetrics) RecordTimeout()  { m.timeouts.Add(1) }
+func (m *ScanMetrics) RecordExhausted() { m.exhausted.Add(1) }
+
+// recordRTT 更新 RTT 双 EMA（lock-free CAS）
+func (m *ScanMetrics) recordRTT(rtt time.Duration) {
+	ns := int64(rtt)
+	if ns <= 0 {
+		return
+	}
+	m.rttSamples.Add(1)
+
+	// Fast EMA: α = 0.1 → new = old + (sample - old) / 10
+	updateEMA(&m.rttFastNs, ns, 10)
+	// Slow EMA: α = 0.02 → new = old + (sample - old) / 50
+	updateEMA(&m.rttSlowNs, ns, 50)
+}
+
+func updateEMA(target *atomic.Int64, sample int64, divisor int64) {
+	for {
+		old := target.Load()
+		if old == 0 {
+			if target.CompareAndSwap(0, sample) {
+				return
+			}
+			runtime.Gosched()
+			continue
+		}
+		next := old + (sample-old)/divisor
+		if target.CompareAndSwap(old, next) {
+			return
+		}
+		runtime.Gosched()
+	}
+}
+
+// Total 总操作数
+func (m *ScanMetrics) Total() int64 {
+	return m.connects.Load() + m.refused.Load() + m.timeouts.Load() + m.exhausted.Load()
+}
+
+// MetricsSnapshot 度量快照，用于计算窗口内增量
+type MetricsSnapshot struct {
+	Connects  int64
+	Refused   int64
+	Timeouts  int64
+	Exhausted int64
+	RTTFastNs int64
+	RTTSlowNs int64
+}
+
+func (s MetricsSnapshot) Total() int64 {
+	return s.Connects + s.Refused + s.Timeouts + s.Exhausted
+}
+
+func (m *ScanMetrics) Snapshot() MetricsSnapshot {
+	return MetricsSnapshot{
+		Connects:  m.connects.Load(),
+		Refused:   m.refused.Load(),
+		Timeouts:  m.timeouts.Load(),
+		Exhausted: m.exhausted.Load(),
+		RTTFastNs: m.rttFastNs.Load(),
+		RTTSlowNs: m.rttSlowNs.Load(),
+	}
+}
+
+// RTTRatio 返回 fast/slow EMA 的比值
+// > 1.0 表示延迟在上升（拥塞信号），< 1.0 表示延迟在下降
+// 样本不足时返回 1.0
+func (m *ScanMetrics) RTTRatio() float64 {
+	if m.rttSamples.Load() < 20 {
+		return 1.0
+	}
+	fast := m.rttFastNs.Load()
+	slow := m.rttSlowNs.Load()
+	if slow <= 0 {
+		return 1.0
+	}
+	return float64(fast) / float64(slow)
+}
+
+// RTTFast 返回快速 EMA 值
+func (m *ScanMetrics) RTTFast() time.Duration {
+	return time.Duration(m.rttFastNs.Load())
+}

core/scan_metrics_test.go

@@ -0,0 +1,242 @@
+package core
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// =============================================================================
+// 单元测试：ScanMetrics 基本操作
+// =============================================================================
+
+func TestScanMetrics_Counters(t *testing.T) {
+	m := &ScanMetrics{}
+
+	m.RecordConnect(time.Millisecond)
+	m.RecordConnect(2 * time.Millisecond)
+	m.RecordRefused(500 * time.Microsecond)
+	m.RecordTimeout()
+	m.RecordExhausted()
+
+	if m.Total() != 5 {
+		t.Errorf("Total() = %d, want 5", m.Total())
+	}
+
+	snap := m.Snapshot()
+	if snap.Connects != 2 {
+		t.Errorf("Connects = %d, want 2", snap.Connects)
+	}
+	if snap.Refused != 1 {
+		t.Errorf("Refused = %d, want 1", snap.Refused)
+	}
+	if snap.Timeouts != 1 {
+		t.Errorf("Timeouts = %d, want 1", snap.Timeouts)
+	}
+	if snap.Exhausted != 1 {
+		t.Errorf("Exhausted = %d, want 1", snap.Exhausted)
+	}
+}
+
+// =============================================================================
+// 单元测试：RTT EMA 收敛
+// =============================================================================
+
+func TestScanMetrics_RTT_EMA(t *testing.T) {
+	m := &ScanMetrics{}
+
+	// 喂入稳定的 10ms RTT
+	for i := 0; i < 100; i++ {
+		m.RecordConnect(10 * time.Millisecond)
+	}
+
+	fast := m.RTTFast()
+	if fast < 9*time.Millisecond || fast > 11*time.Millisecond {
+		t.Errorf("稳定 10ms 后 RTTFast = %v, 应该接近 10ms", fast)
+	}
+
+	ratio := m.RTTRatio()
+	if ratio < 0.9 || ratio > 1.1 {
+		t.Errorf("稳定状态 RTTRatio = %.2f, 应该接近 1.0", ratio)
+	}
+}
+
+func TestScanMetrics_RTT_Trend(t *testing.T) {
+	m := &ScanMetrics{}
+
+	// 先喂入 100 个 5ms 建立基线
+	for i := 0; i < 100; i++ {
+		m.RecordConnect(5 * time.Millisecond)
+	}
+
+	// 再喂入 50 个 50ms（RTT 突增 10 倍）
+	for i := 0; i < 50; i++ {
+		m.RecordConnect(50 * time.Millisecond)
+	}
+
+	ratio := m.RTTRatio()
+	// fast EMA 应该比 slow EMA 高（fast 跟踪快，slow 还没追上来）
+	if ratio <= 1.0 {
+		t.Errorf("RTT 突增后 RTTRatio = %.2f, 应该 > 1.0", ratio)
+	}
+
+	t.Logf("RTT 突增后: ratio=%.2f, fast=%v", ratio, m.RTTFast())
+}
+
+func TestScanMetrics_RTT_InsufficientSamples(t *testing.T) {
+	m := &ScanMetrics{}
+
+	// 少于 20 个样本
+	for i := 0; i < 10; i++ {
+		m.RecordConnect(time.Millisecond)
+	}
+
+	ratio := m.RTTRatio()
+	if ratio != 1.0 {
+		t.Errorf("样本不足时 RTTRatio = %.2f, 应该是 1.0", ratio)
+	}
+}
+
+// =============================================================================
+// 并发安全测试
+// =============================================================================
+
+func TestScanMetrics_ConcurrentSafety(t *testing.T) {
+	m := &ScanMetrics{}
+	var wg sync.WaitGroup
+
+	for i := 0; i < 100; i++ {
+		wg.Add(4)
+		go func() { defer wg.Done(); m.RecordConnect(time.Millisecond) }()
+		go func() { defer wg.Done(); m.RecordRefused(time.Millisecond) }()
+		go func() { defer wg.Done(); m.RecordTimeout() }()
+		go func() { defer wg.Done(); m.RecordExhausted() }()
+	}
+
+	wg.Wait()
+
+	if m.Total() != 400 {
+		t.Errorf("并发后 Total() = %d, want 400", m.Total())
+	}
+
+	// 验证 Snapshot 不 panic
+	snap := m.Snapshot()
+	if snap.Total() != 400 {
+		t.Errorf("并发后 Snapshot.Total() = %d, want 400", snap.Total())
+	}
+
+	// 验证 RTTRatio 不 panic
+	_ = m.RTTRatio()
+}
+
+// =============================================================================
+// 补充测试：按题目要求的函数名
+// =============================================================================
+
+// TestScanMetricsTotal — 各计数器各调一次，Total() 应返回 4
+func TestScanMetricsTotal(t *testing.T) {
+	m := &ScanMetrics{}
+	m.RecordConnect(time.Millisecond)
+	m.RecordRefused(time.Millisecond)
+	m.RecordTimeout()
+	m.RecordExhausted()
+	if got := m.Total(); got != 4 {
+		t.Errorf("Total() = %d, want 4", got)
+	}
+}
+
+// TestScanMetricsSnapshot — 记录数据后 Snapshot() 返回正确快照
+func TestScanMetricsSnapshot(t *testing.T) {
+	m := &ScanMetrics{}
+	m.RecordConnect(5 * time.Millisecond)
+	m.RecordConnect(10 * time.Millisecond)
+	m.RecordRefused(2 * time.Millisecond)
+	m.RecordTimeout()
+	m.RecordExhausted()
+
+	snap := m.Snapshot()
+	tests := []struct {
+		name string
+		got  int64
+		want int64
+	}{
+		{"Connects", snap.Connects, 2},
+		{"Refused", snap.Refused, 1},
+		{"Timeouts", snap.Timeouts, 1},
+		{"Exhausted", snap.Exhausted, 1},
+	}
+	for _, tt := range tests {
+		if tt.got != tt.want {
+			t.Errorf("Snapshot.%s = %d, want %d", tt.name, tt.got, tt.want)
+		}
+	}
+	if snap.RTTFastNs <= 0 {
+		t.Errorf("Snapshot.RTTFastNs = %d, want > 0", snap.RTTFastNs)
+	}
+}
+
+// TestScanMetricsRTTRatio — 样本不足返回 1.0；20+ 个相同 RTT 接近 1.0
+func TestScanMetricsRTTRatio(t *testing.T) {
+	t.Run("样本不足返回1.0", func(t *testing.T) {
+		m := &ScanMetrics{}
+		for i := 0; i < 19; i++ {
+			m.RecordConnect(time.Millisecond)
+		}
+		if r := m.RTTRatio(); r != 1.0 {
+			t.Errorf("样本不足 RTTRatio() = %f, want 1.0", r)
+		}
+	})
+
+	t.Run("稳定RTT接近1.0", func(t *testing.T) {
+		m := &ScanMetrics{}
+		for i := 0; i < 30; i++ {
+			m.RecordConnect(10 * time.Millisecond)
+		}
+		r := m.RTTRatio()
+		if r < 0.9 || r > 1.1 {
+			t.Errorf("稳定RTT下 RTTRatio() = %f, want ~1.0", r)
+		}
+	})
+}
+
+// TestScanMetricsRTTFast — 初始为 0，记录后非零
+func TestScanMetricsRTTFast(t *testing.T) {
+	m := &ScanMetrics{}
+	if m.RTTFast() != 0 {
+		t.Errorf("初始 RTTFast() = %v, want 0", m.RTTFast())
+	}
+	m.RecordConnect(5 * time.Millisecond)
+	if m.RTTFast() == 0 {
+		t.Errorf("记录后 RTTFast() 仍为 0")
+	}
+}
+
+// TestMetricsSnapshotTotal — MetricsSnapshot 各字段求和
+func TestMetricsSnapshotTotal(t *testing.T) {
+	snap := MetricsSnapshot{Connects: 1, Refused: 2, Timeouts: 3, Exhausted: 4}
+	if got := snap.Total(); got != 10 {
+		t.Errorf("MetricsSnapshot.Total() = %d, want 10", got)
+	}
+}
+
+// TestUpdateEMA — 直接测 updateEMA 行为
+func TestUpdateEMA(t *testing.T) {
+	t.Run("target为0时直接设为sample", func(t *testing.T) {
+		var a atomic.Int64
+		updateEMA(&a, 100, 10)
+		if got := a.Load(); got != 100 {
+			t.Errorf("初始为0时 updateEMA 结果 = %d, want 100", got)
+		}
+	})
+
+	t.Run("target非零时做EMA更新", func(t *testing.T) {
+		var a atomic.Int64
+		a.Store(200)
+		// next = 200 + (100-200)/10 = 200 - 10 = 190
+		updateEMA(&a, 100, 10)
+		if got := a.Load(); got != 190 {
+			t.Errorf("EMA更新结果 = %d, want 190", got)
+		}
+	})
+}

core/scanner.go

@@ -94,12 +94,21 @@ func selectStrategy(config *common.Config, state *common.State, info common.Host
 // RunScan 执行整体扫描流程
 func RunScan(ctx context.Context, info common.HostInfo, session *common.ScanSession) (ScanReport, error) {
 	start := time.Now()
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
 	config := session.Config
+
+	// 全局超时：-gt 参数设置整个扫描的硬性截止时间
+	var cancel context.CancelFunc
+	if config.GlobalTimeout > 0 {
+		ctx, cancel = context.WithTimeout(ctx, config.GlobalTimeout)
+	} else {
+		ctx, cancel = context.WithCancel(ctx)
+	}
+	defer cancel()
 	state := session.State
 
+	// 设置全局 State（兼容旧代码路径中未传 state 的调用）
+	SetGlobalState(state)
+
 	// 初始化HTTP客户端（静默，无需日志）
 	if err := lib.Inithttp(config); err != nil {
 		session.LogError(i18n.Tr("http_client_init_failed", err))
@@ -190,6 +199,11 @@ func finishScan(session *common.ScanSession) {
 func ExecuteScanTasks(ctx context.Context, session *common.ScanSession, targets []common.HostInfo, strategy ScanStrategy, ch chan struct{}, wg *sync.WaitGroup) {
 	config := session.Config
 
+	// 注入 session state 到策略（用于 per-session 服务缓存）
+	if setter, ok := strategy.(interface{ SetState(*common.State) }); ok {
+		setter.SetState(session.State)
+	}
+
 	// 获取要执行的插件
 	pluginsToRun, isCustomMode := strategy.GetPlugins(config)
 
@@ -390,13 +404,13 @@ var resultSerializers = map[plugins.ResultType]resultSerializer{
 			return r.Banner
 		},
 		fillDetail: func(r *plugins.Result, _ *common.HostInfo, d map[string]interface{}) {
-			// 优先使用VulInfo，为空则回退到Banner
 			vuln := r.VulInfo
 			if vuln == "" {
 				vuln = r.Banner
 			}
 			d["vulnerability"] = vuln
 			d["service"] = r.Service
+			d["type"] = "vulnerability"
 		},
 	},
 	plugins.ResultTypeWeb: {

core/scanner_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/shadow1ng/fscan/common"
 	"github.com/shadow1ng/fscan/plugins"
@@ -433,6 +434,128 @@ func TestSelectStrategy_EmptyHostInfo(t *testing.T) {
 	}
 }
 
+// =============================================================================
+// buildScanReport 测试
+// =============================================================================
+
+// TestBuildScanReport 验证 buildScanReport 字段映射正确
+func TestBuildScanReport(t *testing.T) {
+	state := common.NewState()
+
+	// 填充各计数器
+	state.SetEnd(10)
+	state.SetNum(7)
+	state.IncrementTCPSuccessPacketCount() // +1 total, +1 tcp, +1 tcpSuccess
+	state.IncrementTCPSuccessPacketCount() // +1 total, +1 tcp, +1 tcpSuccess
+	state.IncrementTCPFailedPacketCount()  // +1 total, +1 tcp, +1 tcpFailed
+	state.IncrementUDPPacketCount()        // +1 total, +1 udp
+	state.IncrementHTTPPacketCount()       // +1 total, +1 http
+	state.IncrementResourceExhaustedCount()
+
+	start := time.Now().Add(-time.Second) // 模拟 1 秒前开始
+	report := buildScanReport(state, start)
+
+	if report.TasksTotal != 10 {
+		t.Errorf("TasksTotal = %d, 期望 10", report.TasksTotal)
+	}
+	if report.TasksCompleted != 7 {
+		t.Errorf("TasksCompleted = %d, 期望 7", report.TasksCompleted)
+	}
+	if report.Packets != 5 {
+		t.Errorf("Packets = %d, 期望 5", report.Packets)
+	}
+	if report.TCPPackets != 3 {
+		t.Errorf("TCPPackets = %d, 期望 3", report.TCPPackets)
+	}
+	if report.TCPSuccessPackets != 2 {
+		t.Errorf("TCPSuccessPackets = %d, 期望 2", report.TCPSuccessPackets)
+	}
+	if report.TCPFailedPackets != 1 {
+		t.Errorf("TCPFailedPackets = %d, 期望 1", report.TCPFailedPackets)
+	}
+	if report.UDPPackets != 1 {
+		t.Errorf("UDPPackets = %d, 期望 1", report.UDPPackets)
+	}
+	if report.HTTPPackets != 1 {
+		t.Errorf("HTTPPackets = %d, 期望 1", report.HTTPPackets)
+	}
+	if report.ResourceExhausted != 1 {
+		t.Errorf("ResourceExhausted = %d, 期望 1", report.ResourceExhausted)
+	}
+	if report.Duration < time.Millisecond {
+		t.Errorf("Duration = %v, 期望 >= 1ms", report.Duration)
+	}
+}
+
+// TestBuildScanReport_ZeroState 验证空 State 返回零值报告
+func TestBuildScanReport_ZeroState(t *testing.T) {
+	state := common.NewState()
+	start := time.Now()
+	report := buildScanReport(state, start)
+
+	if report.TasksTotal != 0 || report.TasksCompleted != 0 || report.Packets != 0 {
+		t.Errorf("空 State 期望全零报告，实际 %+v", report)
+	}
+	if report.Duration < 0 {
+		t.Errorf("Duration 不能为负: %v", report.Duration)
+	}
+}
+
+// =============================================================================
+// determineScanMode IsLocalMode 分支测试
+// =============================================================================
+
+// TestDetermineScanMode_IsLocalModeCallback 覆盖 IsLocalMode 回调分支
+func TestDetermineScanMode_IsLocalModeCallback(t *testing.T) {
+	// 保存原始值
+	origIsLocalMode := common.IsLocalMode
+	defer func() { common.IsLocalMode = origIsLocalMode }()
+
+	// 注册回调：mode == "localtest" 时认为是本地模式
+	common.IsLocalMode = func(mode string) bool {
+		return mode == "localtest"
+	}
+
+	cfg := &common.Config{
+		AliveOnly: false,
+		Mode:      "localtest",
+		LocalMode: false,
+	}
+	state := common.NewState()
+
+	mode := determineScanMode(cfg, state)
+	if mode != ScanModeLocal {
+		t.Errorf("determineScanMode() = %v, 期望 ScanModeLocal", mode)
+	}
+	// 回调命中后应同时设置 LocalMode 和 LocalPlugin
+	if !cfg.LocalMode {
+		t.Error("IsLocalMode 命中后应设置 cfg.LocalMode = true")
+	}
+	if cfg.LocalPlugin != "localtest" {
+		t.Errorf("LocalPlugin = %q, 期望 \"localtest\"", cfg.LocalPlugin)
+	}
+}
+
+// TestDetermineScanMode_IsLocalModeCallbackNoMatch 回调不命中时不影响模式
+func TestDetermineScanMode_IsLocalModeCallbackNoMatch(t *testing.T) {
+	origIsLocalMode := common.IsLocalMode
+	defer func() { common.IsLocalMode = origIsLocalMode }()
+
+	common.IsLocalMode = func(mode string) bool { return false }
+
+	cfg := &common.Config{
+		AliveOnly: false,
+		Mode:      "something",
+		LocalMode: false,
+	}
+	state := common.NewState()
+
+	mode := determineScanMode(cfg, state)
+	if mode != ScanModeService {
+		t.Errorf("回调不命中时期望 ScanModeService, 实际 %v", mode)
+	}
+}
+
 // TestCountApplicableTasks_EmptyPlugins 测试空插件列表
 func TestCountApplicableTasks_EmptyPlugins(t *testing.T) {
 	targets := []common.HostInfo{

core/service_cache_test.go

@@ -0,0 +1,354 @@
+package core
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/plugins"
+)
+
+// registerTestPlugins 注册测试用插件（名字和服务识别结果一致）
+func registerTestPlugins(t *testing.T) {
+	t.Helper()
+	plugins.RegisterWithOptions("ssh", func() plugins.Plugin { return nil }, []int{22, 2222}, nil, true)
+	plugins.RegisterWithOptions("mysql", func() plugins.Plugin { return nil }, []int{3306}, nil, true)
+	plugins.RegisterWithOptions("ftp", func() plugins.Plugin { return nil }, []int{21}, nil, true)
+	plugins.RegisterWithOptions("redis", func() plugins.Plugin { return nil }, []int{6379}, nil, true)
+	plugins.RegisterWithOptions("postgresql", func() plugins.Plugin { return nil }, []int{5432}, nil, true)
+	plugins.RegisterWithOptions("telnet", func() plugins.Plugin { return nil }, []int{23}, nil, true)
+	plugins.RegisterWithOptions("mssql", func() plugins.Plugin { return nil }, []int{1433}, nil, true)
+	plugins.RegisterWithOptions("vnc", func() plugins.Plugin { return nil }, []int{5900}, nil, true)
+	plugins.RegisterWithOptions("webtitle", func() plugins.Plugin { return nil }, []int{}, []string{plugins.PluginTypeWeb}, true)
+}
+
+func clearServiceCache() {
+	state := common.NewState()
+	SetGlobalState(state)
+}
+
+// =============================================================================
+// 单元测试：CacheServiceInfo / GetCachedServiceInfo
+// =============================================================================
+
+func TestCacheServiceInfo_BasicCRUD(t *testing.T) {
+	clearServiceCache()
+
+	t.Run("缓存后可读取", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 22, &ServiceInfo{Name: "ssh", Version: "OpenSSH_8.9"})
+		info, ok := GetCachedServiceInfo("10.0.0.1", 22)
+		if !ok {
+			t.Fatal("缓存未命中")
+		}
+		if info.Name != "ssh" || info.Version != "OpenSSH_8.9" {
+			t.Errorf("got Name=%q Version=%q", info.Name, info.Version)
+		}
+	})
+
+	t.Run("不同端口独立", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 3306, &ServiceInfo{Name: "mysql"})
+		CacheServiceInfo("10.0.0.1", 5432, &ServiceInfo{Name: "postgresql"})
+		i1, _ := GetCachedServiceInfo("10.0.0.1", 3306)
+		i2, _ := GetCachedServiceInfo("10.0.0.1", 5432)
+		if i1.Name != "mysql" || i2.Name != "postgresql" {
+			t.Errorf("端口混淆: 3306=%q 5432=%q", i1.Name, i2.Name)
+		}
+	})
+
+	t.Run("不同主机独立", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 22, &ServiceInfo{Name: "ssh"})
+		CacheServiceInfo("10.0.0.2", 22, &ServiceInfo{Name: "telnet"})
+		i1, _ := GetCachedServiceInfo("10.0.0.1", 22)
+		i2, _ := GetCachedServiceInfo("10.0.0.2", 22)
+		if i1.Name != "ssh" || i2.Name != "telnet" {
+			t.Errorf("主机混淆: .1=%q .2=%q", i1.Name, i2.Name)
+		}
+	})
+
+	t.Run("覆盖写入", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.5", 80, &ServiceInfo{Name: "unknown"})
+		CacheServiceInfo("10.0.0.5", 80, &ServiceInfo{Name: "http"})
+		info, _ := GetCachedServiceInfo("10.0.0.5", 80)
+		if info.Name != "http" {
+			t.Errorf("覆盖失败: %q", info.Name)
+		}
+	})
+
+	t.Run("未缓存返回 false", func(t *testing.T) {
+		if _, ok := GetCachedServiceInfo("192.168.99.99", 12345); ok {
+			t.Error("应返回 false")
+		}
+	})
+}
+
+// =============================================================================
+// 单元测试：Web 服务过滤
+// =============================================================================
+
+func TestWebServiceFiltering(t *testing.T) {
+	clearServiceCache()
+
+	webNames := []string{"http", "https", "nginx", "apache", "iis", "tomcat"}
+	nonWebNames := []string{"ssl", "tls", "ssh", "mysql", "postgresql", "redis", "mongodb", "ftp", "smtp", "telnet", "vnc", "rdp"}
+
+	for _, name := range webNames {
+		clearServiceCache()
+		CacheServiceInfo("10.0.0.1", 443, &ServiceInfo{Name: name})
+		if !IsMarkedWebService("10.0.0.1", 443) {
+			t.Errorf("%q 应被识别为 Web 服务", name)
+		}
+	}
+
+	for _, name := range nonWebNames {
+		clearServiceCache()
+		CacheServiceInfo("10.0.0.1", 9999, &ServiceInfo{Name: name})
+		if IsMarkedWebService("10.0.0.1", 9999) {
+			t.Errorf("%q 不应被识别为 Web 服务", name)
+		}
+	}
+
+	t.Run("GetWebServiceInfo 过滤非 Web", func(t *testing.T) {
+		clearServiceCache()
+		CacheServiceInfo("10.0.0.1", 3306, &ServiceInfo{Name: "mysql"})
+		if _, ok := GetWebServiceInfo("10.0.0.1", 3306); ok {
+			t.Error("mysql 不应通过 GetWebServiceInfo")
+		}
+	})
+
+	t.Run("GetWebServiceInfo 返回 Web", func(t *testing.T) {
+		clearServiceCache()
+		CacheServiceInfo("10.0.0.1", 8080, &ServiceInfo{Name: "nginx"})
+		info, ok := GetWebServiceInfo("10.0.0.1", 8080)
+		if !ok || info.Name != "nginx" {
+			t.Error("nginx 应通过 GetWebServiceInfo")
+		}
+	})
+}
+
+// =============================================================================
+// 集成测试：指纹驱动插件匹配
+// =============================================================================
+
+func TestIntegration_FingerprintDrivenPluginMatch(t *testing.T) {
+	clearServiceCache()
+	registerTestPlugins(t)
+
+	CacheServiceInfo("10.0.0.1", 22, &ServiceInfo{Name: "ssh"})
+	CacheServiceInfo("10.0.0.1", 8881, &ServiceInfo{Name: "ssh"})
+	CacheServiceInfo("10.0.0.1", 13306, &ServiceInfo{Name: "mysql"})
+	CacheServiceInfo("10.0.0.1", 80, &ServiceInfo{Name: "http"})
+	CacheServiceInfo("10.0.0.1", 9443, &ServiceInfo{Name: "https"})
+	CacheServiceInfo("10.0.0.1", 2121, &ServiceInfo{Name: "ftp"})
+	CacheServiceInfo("10.0.0.1", 6380, &ServiceInfo{Name: "redis"})
+
+	strategy := NewServiceScanStrategy()
+
+	tests := []struct {
+		plugin, host string
+		port         int
+		want         bool
+		desc         string
+	}{
+		{"ssh", "10.0.0.1", 22, true, "SSH 标准端口"},
+		{"ssh", "10.0.0.1", 8881, true, "SSH 非标准端口（指纹匹配）"},
+		{"mysql", "10.0.0.1", 13306, true, "MySQL 非标准端口"},
+		{"ftp", "10.0.0.1", 2121, true, "FTP 非标准端口"},
+		{"redis", "10.0.0.1", 6380, true, "Redis 非标准端口"},
+		{"ssh", "10.0.0.1", 13306, false, "SSH 不匹配 MySQL 端口"},
+		{"mysql", "10.0.0.1", 8881, false, "MySQL 不匹配 SSH 端口"},
+		{"redis", "10.0.0.1", 22, false, "Redis 不匹配 SSH 标准端口"},
+		{"ssh", "10.0.0.1", 65000, false, "SSH 不匹配未识别端口"},
+		{"webtitle", "10.0.0.1", 80, true, "Web 匹配 http"},
+		{"webtitle", "10.0.0.1", 9443, true, "Web 匹配 https 非标准"},
+		{"webtitle", "10.0.0.1", 22, false, "Web 不匹配 SSH"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			got := strategy.isPluginApplicableToPortWithHost(tt.plugin, tt.host, tt.port)
+			if got != tt.want {
+				t.Errorf("plugin=%q port=%d: got %v, want %v", tt.plugin, tt.port, got, tt.want)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// 集成测试：非标准端口完整流程
+// =============================================================================
+
+func TestIntegration_NonStandardPortScanFlow(t *testing.T) {
+	clearServiceCache()
+	registerTestPlugins(t)
+
+	host := "172.16.0.100"
+	CacheServiceInfo(host, 8881, &ServiceInfo{
+		Name: "ssh", Version: "OpenSSH_8.2p1",
+		Banner: "SSH-2.0-OpenSSH_8.2p1", Extras: map[string]string{"os": "Linux"},
+	})
+
+	strategy := NewServiceScanStrategy()
+
+	if !strategy.isPluginApplicableToPortWithHost("ssh", host, 8881) {
+		t.Error("SSH 应匹配 8881")
+	}
+	if strategy.isPluginApplicableToPortWithHost("mysql", host, 8881) {
+		t.Error("MySQL 不应匹配 8881 上的 SSH")
+	}
+	if IsMarkedWebService(host, 8881) {
+		t.Error("SSH 不应标记为 Web")
+	}
+}
+
+// =============================================================================
+// 集成测试：同一主机多服务
+// =============================================================================
+
+func TestIntegration_MultiServiceSameHost(t *testing.T) {
+	clearServiceCache()
+	registerTestPlugins(t)
+
+	host := "192.168.1.100"
+	CacheServiceInfo(host, 2222, &ServiceInfo{Name: "ssh"})
+	CacheServiceInfo(host, 33060, &ServiceInfo{Name: "mysql"})
+	CacheServiceInfo(host, 8080, &ServiceInfo{Name: "http"})
+	CacheServiceInfo(host, 63790, &ServiceInfo{Name: "redis"})
+
+	strategy := NewServiceScanStrategy()
+
+	checks := []struct {
+		plugin string
+		port   int
+		want   bool
+	}{
+		{"ssh", 2222, true}, {"ssh", 33060, false}, {"ssh", 8080, false},
+		{"mysql", 33060, true}, {"mysql", 2222, false},
+		{"redis", 63790, true}, {"redis", 2222, false},
+		{"webtitle", 8080, true}, {"webtitle", 2222, false},
+	}
+
+	for _, c := range checks {
+		got := strategy.isPluginApplicableToPortWithHost(c.plugin, host, c.port)
+		if got != c.want {
+			t.Errorf("plugin=%q port=%d: got %v, want %v", c.plugin, c.port, got, c.want)
+		}
+	}
+}
+
+// =============================================================================
+// 边界测试
+// =============================================================================
+
+func TestServiceCache_EdgeCases(t *testing.T) {
+	clearServiceCache()
+	registerTestPlugins(t)
+	strategy := NewServiceScanStrategy()
+
+	t.Run("空服务名不匹配", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 9999, &ServiceInfo{Name: ""})
+		if strategy.isPluginApplicableToPortWithHost("ssh", "10.0.0.1", 9999) {
+			t.Error("空服务名不应匹配")
+		}
+	})
+
+	t.Run("unknown 不匹配", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 8888, &ServiceInfo{Name: "unknown"})
+		if strategy.isPluginApplicableToPortWithHost("ssh", "10.0.0.1", 8888) {
+			t.Error("unknown 不应匹配")
+		}
+	})
+
+	t.Run("大小写不敏感", func(t *testing.T) {
+		clearServiceCache()
+		CacheServiceInfo("10.0.0.1", 5555, &ServiceInfo{Name: "SSH"})
+		if !strategy.isPluginApplicableToPortWithHost("ssh", "10.0.0.1", 5555) {
+			t.Error("SSH 大写应匹配 ssh 插件")
+		}
+	})
+
+	t.Run("host 为空不查缓存", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 8881, &ServiceInfo{Name: "ssh"})
+		if strategy.isPluginApplicableToPortWithHost("ssh", "", 8881) {
+			t.Error("host 为空不应匹配")
+		}
+	})
+
+	t.Run("nil ServiceInfo 不 panic", func(t *testing.T) {
+		CacheServiceInfo("10.0.0.1", 7777, nil)
+		got := strategy.isPluginApplicableToPortWithHost("ssh", "10.0.0.1", 7777)
+		if got {
+			t.Error("nil ServiceInfo 不应匹配")
+		}
+	})
+
+	t.Run("IPv6", func(t *testing.T) {
+		clearServiceCache()
+		CacheServiceInfo("::1", 22, &ServiceInfo{Name: "ssh"})
+		if _, ok := GetCachedServiceInfo("::1", 22); !ok {
+			t.Error("IPv6 缓存失败")
+		}
+	})
+}
+
+// =============================================================================
+// 并发安全
+// =============================================================================
+
+func TestServiceCache_ConcurrentSafety(t *testing.T) {
+	clearServiceCache()
+	var wg sync.WaitGroup
+
+	for i := 0; i < 100; i++ {
+		wg.Add(3)
+		go func(p int) { defer wg.Done(); CacheServiceInfo("10.0.0.1", p, &ServiceInfo{Name: "ssh"}) }(i)
+		go func(p int) { defer wg.Done(); GetCachedServiceInfo("10.0.0.1", p) }(i)
+		go func(p int) { defer wg.Done(); IsMarkedWebService("10.0.0.1", p) }(i)
+	}
+	wg.Wait()
+
+	for i := 0; i < 100; i++ {
+		if _, ok := GetCachedServiceInfo("10.0.0.1", i); !ok {
+			t.Errorf("并发写入丢失: port=%d", i)
+		}
+	}
+}
+
+// =============================================================================
+// 回归测试：#588
+// =============================================================================
+
+func TestRegression_Issue588(t *testing.T) {
+	clearServiceCache()
+	registerTestPlugins(t)
+
+	CacheServiceInfo("192.168.1.50", 8881, &ServiceInfo{Name: "ssh", Version: "OpenSSH_7.4"})
+	strategy := NewServiceScanStrategy()
+
+	if !strategy.isPluginApplicableToPortWithHost("ssh", "192.168.1.50", 8881) {
+		t.Fatal("#588: SSH 应匹配 8881")
+	}
+	for _, p := range []string{"mysql", "ftp", "redis", "postgresql", "telnet", "vnc", "mssql"} {
+		if strategy.isPluginApplicableToPortWithHost(p, "192.168.1.50", 8881) {
+			t.Errorf("#588: %q 不应匹配 8881 上的 SSH", p)
+		}
+	}
+}
+
+// =============================================================================
+// 端口匹配优先于缓存
+// =============================================================================
+
+func TestIntegration_PortMatchPrecedence(t *testing.T) {
+	clearServiceCache()
+	registerTestPlugins(t)
+
+	CacheServiceInfo("10.0.0.1", 22, &ServiceInfo{Name: "http"})
+	strategy := NewServiceScanStrategy()
+
+	if !strategy.isPluginApplicableToPortWithHost("ssh", "10.0.0.1", 22) {
+		t.Error("SSH 应通过端口匹配命中 22（即使缓存是 http）")
+	}
+	if !IsMarkedWebService("10.0.0.1", 22) {
+		t.Error("缓存是 http，应标记为 Web")
+	}
+}

core/service_probe.go

@@ -21,6 +21,8 @@ const (
 	defaultIntensity   = 7    // 默认探测强度 (1-9)
 )
 
+var errConnLost = errors.New("connection lost and reconnect failed")
+
 // sslSecondProbes SSL服务二次探测的探针名称
 var sslSecondProbes = []string{"TerminalServerCookie", "TerminalServer"}
 
@@ -390,6 +392,10 @@ func (i *Info) tryProbes(response []byte, probes []*Probe) bool {
 
 // GetInfo 分析响应数据并提取服务信息
 func (i *Info) GetInfo(response []byte, probe *Probe) {
+	if probe == nil {
+		return
+	}
+
 	// 响应数据有效性检查
 	if len(response) <= 0 {
 		common.LogDebug(i18n.GetText("service_probe_empty_response"))
@@ -527,7 +533,7 @@ var defaultReadTimeoutMS = WrTimeout * 1000
 // Write 写入数据到连接
 func (i *Info) Write(msg []byte) error {
 	if i.Conn == nil {
-		return nil
+		return errConnLost
 	}
 
 	// 设置写入超时
@@ -570,7 +576,7 @@ func (i *Info) Write(msg []byte) error {
 // Read 从连接读取响应
 func (i *Info) Read() ([]byte, error) {
 	if i.Conn == nil {
-		return nil, nil
+		return nil, errConnLost
 	}
 
 	// 设置读取超时（使用动态超时）

core/service_scanner.go

@@ -69,7 +69,7 @@ func (s *ServiceScanStrategy) showPluginsForSpecifiedPorts(config *common.Config
 		applicablePlugins = append(applicablePlugins, pluginName)
 	}
 
-	// 输出结果
+	// 输出结果（仅在有匹配插件时显示，避免因预检端口不完整而输出误导性的"无可用插件"）
 	if len(applicablePlugins) > 0 {
 		pluginStr := formatPluginList(applicablePlugins)
 		if isCustomMode {
@@ -77,8 +77,6 @@ func (s *ServiceScanStrategy) showPluginsForSpecifiedPorts(config *common.Config
 		} else {
 			session.LogInfo(i18n.Tr("service_plugin_info", pluginStr))
 		}
-	} else {
-		session.LogInfo(i18n.GetText("service_plugin_none"))
 	}
 }
 
@@ -88,18 +86,9 @@ func (s *ServiceScanStrategy) parsePortList(portStr string) []int {
 		return []int{}
 	}
 
-	ports := []int{} // 初始化为空切片而非nil
-	parts := strings.Split(portStr, ",")
-	for _, part := range parts {
-		part = strings.TrimSpace(part)
-		if port, err := strconv.Atoi(part); err == nil {
-			// 验证端口范围 1-65535（与 scanner.go 的 parsePort 保持一致）
-			if port >= 1 && port <= 65535 {
-				ports = append(ports, port)
-			} else {
-				common.LogError(i18n.Tr("port_out_of_range", port))
-			}
-		}
+	ports := parsers.ParsePort(portStr)
+	if ports == nil {
+		return []int{}
 	}
 	return ports
 }
@@ -164,10 +153,19 @@ func (s *ServiceScanStrategy) performHostScan(ctx context.Context, session *comm
 	totalAlive := 0
 	sawHosts := false
 	performedLiveness := false
+	envProfiled := false
+
+	// 系统能力探测（不需要网络目标）
+	sysProfile := ProbeSystem()
 
 	for {
 		hosts, err := iter.NextBatch(ctx, targetHostBatchSize(config))
 		if err != nil {
+			if ctx.Err() != nil {
+				session.LogError(i18n.Tr("global_timeout_exceeded",
+					int(config.GlobalTimeout.Seconds())))
+				return
+			}
 			session.LogError(fmt.Sprintf("%s: %v", i18n.GetText("parse_target_failed"), err))
 			return
 		}
@@ -185,6 +183,15 @@ func (s *ServiceScanStrategy) performHostScan(ctx context.Context, session *comm
 			continue
 		}
 
+		// 首批 alive hosts 出来后做网络探测，调整后续所有参数
+		if !envProfiled {
+			envProfiled = true
+			netProfile := ProbeNetwork(ctx, hosts, session)
+			ep := &EnvironmentProfile{Net: *netProfile, System: sysProfile}
+			ep.TuneConfig(config, session)
+		}
+
+		// UDP 插件调度：默认端口模式全量调度，用户指定 -p 时只调度端口有交集的 UDP 插件
 		s.dispatchUDPPlugins(ctx, session, hosts, info, config, ch, wg)
 		s.scanHostBatch(ctx, session, hosts, info, pluginsToRun, isCustomMode, ch, wg)
 	}
@@ -267,9 +274,22 @@ func (s *ServiceScanStrategy) dispatchUDPPlugins(ctx context.Context, session *c
 		return
 	}
 
+	// 用户指定 -p 时，只调度端口有交集的 UDP 插件
+	var userPorts map[int]bool
+	if config.Target.Ports != "" && config.Target.Ports != "all" {
+		parsed := parsers.ParsePort(config.Target.Ports)
+		userPorts = make(map[int]bool, len(parsed))
+		for _, p := range parsed {
+			userPorts[p] = true
+		}
+	}
+
 	for _, host := range hosts {
 		for _, pluginName := range udpPlugins {
 			for _, port := range plugins.GetPluginPorts(pluginName) {
+				if userPorts != nil && !userPorts[port] {
+					continue
+				}
 				target := baseInfo
 				target.Host = host
 				target.Port = port
@@ -328,11 +348,8 @@ func (s *ServiceScanStrategy) LogVulnerabilityPluginInfo(targets []common.HostIn
 		servicePlugins = append(servicePlugins, pluginName)
 	}
 
-	// 输出插件信息
 	if len(servicePlugins) > 0 {
 		common.LogInfo(i18n.Tr("service_plugin_info", strings.Join(servicePlugins, ", ")))
-	} else {
-		common.LogInfo(i18n.GetText("scan_no_service_plugins"))
 	}
 }
 

core/service_scanner_test.go

@@ -65,6 +65,16 @@ func TestParsePortList_BasicParsing(t *testing.T) {
 			input:    "22,80,443,3306",
 			expected: []int{22, 80, 443, 3306},
 		},
+		{
+			name:     "端口范围",
+			input:    "80-82",
+			expected: []int{80, 81, 82},
+		},
+		{
+			name:     "端口和范围混合",
+			input:    "22,80-81",
+			expected: []int{22, 80, 81},
+		},
 		{
 			name:     "空字符串",
 			input:    "",
@@ -281,7 +291,7 @@ func TestParsePortList_ProductionScenarios(t *testing.T) {
 
 	t.Run("数据库端口", func(t *testing.T) {
 		input := "3306,5432,1433,27017"
-		expected := []int{3306, 5432, 1433, 27017}
+		expected := []int{1433, 3306, 5432, 27017}
 		result := s.parsePortList(input)
 		if !intSlicesEqual(result, expected) {
 			t.Errorf("应该正确解析常见数据库端口")
@@ -317,6 +327,13 @@ func TestParsePortList_ProductionScenarios(t *testing.T) {
 			t.Errorf("应该正确解析高端口号")
 		}
 	})
+
+	t.Run("端口组", func(t *testing.T) {
+		result := s.parsePortList("web")
+		if !sliceContains(result, 80) || !sliceContains(result, 443) {
+			t.Errorf("web端口组应该包含80和443, 实际 %v", result)
+		}
+	})
 }
 
 // TestParsePortList_ReturnValue 测试返回值特性
@@ -330,14 +347,11 @@ func TestParsePortList_ReturnValue(t *testing.T) {
 		}
 	})
 
-	t.Run("端口不重复-但不保证去重", func(t *testing.T) {
-		// 注意：当前实现不去重，如果用户输入 "22,22"，会返回 [22, 22]
-		// 这是可以接受的，因为上层逻辑会处理重复
+	t.Run("重复端口会去重", func(t *testing.T) {
 		input := "22,22"
 		result := s.parsePortList(input)
-		// 这里我们只测试解析是否正确，不测试去重
-		if len(result) != 2 || result[0] != 22 || result[1] != 22 {
-			t.Errorf("当前实现不去重，应该返回两个22")
+		if len(result) != 1 || result[0] != 22 {
+			t.Errorf("重复端口应该去重, 实际 %v", result)
 		}
 	})
 }
@@ -355,6 +369,15 @@ func intSlicesEqual(a, b []int) bool {
 	return true
 }
 
+func sliceContains(values []int, target int) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}
+
 // =============================================================================
 // 存活检测判断测试
 // =============================================================================
@@ -839,3 +862,76 @@ func TestConvertToTargetInfos_DeepCopy(t *testing.T) {
 		}
 	})
 }
+
+// =============================================================================
+// mergeHostPorts 测试
+// =============================================================================
+
+func TestMergeHostPorts(t *testing.T) {
+	// 结果顺序不确定（map 遍历），用集合比较
+	toSet := func(ss []string) map[string]struct{} {
+		m := make(map[string]struct{}, len(ss))
+		for _, s := range ss {
+			m[s] = struct{}{}
+		}
+		return m
+	}
+	setsEqual := func(a, b map[string]struct{}) bool {
+		if len(a) != len(b) {
+			return false
+		}
+		for k := range a {
+			if _, ok := b[k]; !ok {
+				return false
+			}
+		}
+		return true
+	}
+
+	tests := []struct {
+		name string
+		a    []string
+		b    []string
+		want []string
+	}{
+		{
+			name: "两个空切片返回空",
+			a:    []string{},
+			b:    []string{},
+			want: []string{},
+		},
+		{
+			name: "无重复-并集",
+			a:    []string{"1.1.1.1:80"},
+			b:    []string{"2.2.2.2:443"},
+			want: []string{"1.1.1.1:80", "2.2.2.2:443"},
+		},
+		{
+			name: "有重复-去重",
+			a:    []string{"1.1.1.1:80", "2.2.2.2:443"},
+			b:    []string{"2.2.2.2:443", "3.3.3.3:22"},
+			want: []string{"1.1.1.1:80", "2.2.2.2:443", "3.3.3.3:22"},
+		},
+		{
+			name: "a为nil-返回b内容",
+			a:    nil,
+			b:    []string{"1.1.1.1:80", "2.2.2.2:443"},
+			want: []string{"1.1.1.1:80", "2.2.2.2:443"},
+		},
+		{
+			name: "b为nil-返回a内容",
+			a:    []string{"1.1.1.1:80"},
+			b:    nil,
+			want: []string{"1.1.1.1:80"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := mergeHostPorts(tt.a, tt.b)
+			if !setsEqual(toSet(got), toSet(tt.want)) {
+				t.Errorf("mergeHostPorts() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

core/tuning_cli_integration_test.go

@@ -0,0 +1,82 @@
+package core
+
+import (
+	"flag"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
+)
+
+func TestCLIExplicitDefaultTuningFlagsSurviveTuneConfig(t *testing.T) {
+	oldArgs := os.Args
+	oldFlagSet := flag.CommandLine
+	oldFlagVars := *common.GetFlagVars()
+	defer func() {
+		os.Args = oldArgs
+		flag.CommandLine = oldFlagSet
+		*common.GetFlagVars() = oldFlagVars
+	}()
+
+	*common.GetFlagVars() = common.FlagVars{}
+	flag.CommandLine = flag.NewFlagSet("fscan-test", flag.ContinueOnError)
+	os.Args = []string{
+		"fscan-test",
+		"-silent",
+		"-h", "127.0.0.1",
+		"-time", "3",
+		"-mt", "20",
+		"-retry", "3",
+		"-icmp-rate", "0.1",
+		"-num", "20",
+	}
+
+	info := &common.HostInfo{}
+	if err := common.Flag(info); err != nil {
+		t.Fatalf("Flag error = %v", err)
+	}
+
+	cfg, _, err := common.BuildConfig(common.GetFlagVars(), info)
+	if err != nil {
+		t.Fatalf("BuildConfig error = %v", err)
+	}
+	if !cfg.TimeoutExplicit || !cfg.ModuleThreadNumExplicit ||
+		!cfg.MaxRetriesExplicit || !cfg.Network.ICMPRateExplicit ||
+		!cfg.POC.NumExplicit {
+		t.Fatalf("explicit flags not propagated: timeout=%v mt=%v retry=%v icmp=%v num=%v",
+			cfg.TimeoutExplicit,
+			cfg.ModuleThreadNumExplicit,
+			cfg.MaxRetriesExplicit,
+			cfg.Network.ICMPRateExplicit,
+			cfg.POC.NumExplicit)
+	}
+
+	ep := &EnvironmentProfile{
+		Net: NetworkProfile{
+			Env:       EnvLAN,
+			RTTMedian: time.Millisecond,
+			RTTStddev: 200 * time.Microsecond,
+			LossRate:  0,
+			Samples:   30,
+		},
+		System: SystemProfile{FDLimit: 65536, NumCPU: 8},
+	}
+	ep.TuneConfig(cfg, makeTestSession(cfg))
+
+	if cfg.Timeout != 3*time.Second {
+		t.Fatalf("Timeout = %v, want explicit default 3s", cfg.Timeout)
+	}
+	if cfg.ModuleThreadNum != 20 {
+		t.Fatalf("ModuleThreadNum = %d, want explicit default 20", cfg.ModuleThreadNum)
+	}
+	if cfg.MaxRetries != 3 {
+		t.Fatalf("MaxRetries = %d, want explicit default 3", cfg.MaxRetries)
+	}
+	if cfg.Network.ICMPRate != 0.1 {
+		t.Fatalf("ICMPRate = %.2f, want explicit default 0.10", cfg.Network.ICMPRate)
+	}
+	if cfg.POC.Num != 20 {
+		t.Fatalf("POC.Num = %d, want explicit default 20", cfg.POC.Num)
+	}
+}

core/web_scanner.go

@@ -56,19 +56,21 @@ func DetectHTTPSchemeContext(ctx context.Context, host string, port int, config
 		return "https"
 	}
 
-	// 第二步：尝试国密TLS握手（GM TLS fallback）
-	gmConn, gmErr := gmtls.DialWithDialer(
-		tlsDialer,
-		"tcp", addr,
-		&gmtls.Config{
-			GMSupport:          gmtls.NewGMSupport(),
-			InsecureSkipVerify: true,
-		},
-	)
-
-	if gmErr == nil {
-		_ = gmConn.Close()
-		return "https-gm"
+	// 第二步：仅在标准 TLS 握手级别失败（cipher/protocol 不兼容）时尝试国密
+	// 连接级别失败（timeout/refused/非 TLS 端口）不需要尝试
+	if maybeGMTLS(err) {
+		gmConn, gmErr := gmtls.DialWithDialer(
+			tlsDialer,
+			"tcp", addr,
+			&gmtls.Config{
+				GMSupport:          gmtls.NewGMSupport(),
+				InsecureSkipVerify: true,
+			},
+		)
+		if gmErr == nil {
+			_ = gmConn.Close()
+			return "https-gm"
+		}
 	}
 
 	// TLS和GM TLS都失败，尝试HTTP
@@ -112,7 +114,11 @@ func createHTTPClient(config *common.Config, session *common.ScanSession) *http.
 	networkConfig := config.Network
 	if networkConfig.HTTPProxy != "" {
 		// 使用HTTP代理
-		if proxyURL, err := url.Parse(networkConfig.HTTPProxy); err == nil {
+		httpProxy := networkConfig.HTTPProxy
+		if !strings.Contains(httpProxy, "://") {
+			httpProxy = "http://" + httpProxy
+		}
+		if proxyURL, err := url.Parse(httpProxy); err == nil && proxyURL.Host != "" {
 			transport.Proxy = http.ProxyURL(proxyURL)
 		} else {
 			session.LogError(i18n.Tr("http_proxy_config_error", err))
@@ -204,11 +210,9 @@ func (w *WebPortDetector) tryHTTP(ctx context.Context, client *http.Client, sess
 // 基于服务指纹的Web服务识别
 // ===============================
 
-// Web服务缓存 - 简化的全局缓存
-var (
-	webServiceCache = make(map[string]*ServiceInfo)
-	webCacheMutex   sync.RWMutex
-)
+// globalState 全局 State 兼容指针（向后兼容不接受 State 的旧调用方）
+// 新代码应通过 State 方法访问服务缓存
+var globalState *common.State
 
 // IsWebServiceByFingerprint 基于服务指纹判断Web服务 - 保持API兼容
 // 服务识别规则 - 编译期常量，避免运行时分配
@@ -218,7 +222,7 @@ var (
 		"telnet", "ftp", "smtp", "pop3", "imap", "ldap", "snmp", "vnc", "rdp", "smb",
 	}
 	webKeywords = []string{
-		"http", "https", "ssl", "tls", "nginx", "apache", "iis", "tomcat",
+		"http", "https", "nginx", "apache", "iis", "tomcat",
 		"jetty", "nodejs", "php", "asp", "jsp",
 	}
 	bannerKeywords = []string{"server:", "http/", "content-type:"}
@@ -259,33 +263,99 @@ func IsWebServiceByFingerprint(serviceInfo *ServiceInfo) bool {
 	return false
 }
 
-// MarkAsWebService 标记Web服务 - 保持API兼容
+// isDefinitelyNonWeb 判断服务是否明确不是 Web 服务
+// 只检查 nonWebKeywords，不在里面 = 不确定 = 值得做 HTTP 探测
+func isDefinitelyNonWeb(serviceInfo *ServiceInfo) bool {
+	if serviceInfo == nil || serviceInfo.Name == "" {
+		return false
+	}
+	serviceName := strings.ToLower(serviceInfo.Name)
+	for _, keyword := range nonWebKeywords {
+		if strings.Contains(serviceName, keyword) {
+			return true
+		}
+	}
+	return false
+}
+
+// SetGlobalState 设置全局 State（RunScan 入口调用，兼容旧代码路径）
+func SetGlobalState(state *common.State) {
+	globalState = state
+}
+
+func resolveState(state *common.State) *common.State {
+	if state != nil {
+		return state
+	}
+	return globalState
+}
+
+// CacheServiceInfoWithState 缓存服务信息到指定 State
+func CacheServiceInfoWithState(state *common.State, host string, port int, serviceInfo *ServiceInfo) {
+	s := resolveState(state)
+	if s == nil {
+		return
+	}
+	key := net.JoinHostPort(host, strconv.Itoa(port))
+	s.CacheService(key, serviceInfo)
+}
+
+// CacheServiceInfo 兼容旧调用（使用全局 State）
+func CacheServiceInfo(host string, port int, serviceInfo *ServiceInfo) {
+	CacheServiceInfoWithState(nil, host, port, serviceInfo)
+}
+
+// MarkAsWebService 标记 Web 服务
 func MarkAsWebService(host string, port int, serviceInfo *ServiceInfo) {
-	cacheKey := net.JoinHostPort(host, strconv.Itoa(port))
-
-	webCacheMutex.Lock()
-	defer webCacheMutex.Unlock()
-
-	webServiceCache[cacheKey] = serviceInfo
+	CacheServiceInfo(host, port, serviceInfo)
 }
 
-// GetWebServiceInfo 获取Web服务信息
+// GetCachedServiceInfoWithState 从指定 State 获取缓存的服务信息
+func GetCachedServiceInfoWithState(state *common.State, host string, port int) (*ServiceInfo, bool) {
+	s := resolveState(state)
+	if s == nil {
+		return nil, false
+	}
+	key := net.JoinHostPort(host, strconv.Itoa(port))
+	val, ok := s.GetCachedService(key)
+	if !ok {
+		return nil, false
+	}
+	info, ok := val.(*ServiceInfo)
+	return info, ok
+}
+
+// GetCachedServiceInfo 兼容旧调用
+func GetCachedServiceInfo(host string, port int) (*ServiceInfo, bool) {
+	return GetCachedServiceInfoWithState(nil, host, port)
+}
+
+// GetWebServiceInfo 获取 Web 服务信息
 func GetWebServiceInfo(host string, port int) (*ServiceInfo, bool) {
-	cacheKey := net.JoinHostPort(host, strconv.Itoa(port))
-
-	webCacheMutex.RLock()
-	defer webCacheMutex.RUnlock()
-
-	serviceInfo, exists := webServiceCache[cacheKey]
-	return serviceInfo, exists
+	return GetWebServiceInfoWithState(nil, host, port)
 }
 
-// IsMarkedWebService 检查是否已标记为Web服务
+// GetWebServiceInfoWithState 从指定 State 获取 Web 服务信息
+func GetWebServiceInfoWithState(state *common.State, host string, port int) (*ServiceInfo, bool) {
+	info, exists := GetCachedServiceInfoWithState(state, host, port)
+	if !exists || !IsWebServiceByFingerprint(info) {
+		return nil, false
+	}
+	return info, true
+}
+
+// IsMarkedWebService 检查是否为 Web 服务（使用全局 State）
 func IsMarkedWebService(host string, port int) bool {
 	_, exists := GetWebServiceInfo(host, port)
 	return exists
 }
 
+// IsMarkedWebServiceWithState 检查是否为 Web 服务（指定 State）
+func IsMarkedWebServiceWithState(state *common.State, host string, port int) bool {
+	_, exists := GetWebServiceInfoWithState(state, host, port)
+	return exists
+}
+
 // ===============================
 // Web扫描策略
 // ===============================
@@ -375,17 +445,31 @@ func (s *WebScanStrategy) createTargetFromURLWithSession(baseInfo common.HostInf
 	// 解析URL获取Host和Port信息
 	parsedURL, err := url.Parse(urlStr)
 	if err != nil {
-		session.LogError(i18n.Tr("url_parse_failed", urlStr, err))
+		if session != nil {
+			session.LogError(i18n.Tr("url_parse_failed", urlStr, err))
+		}
 		return nil
 	}
 
 	urlInfo := baseInfo
 	urlInfo.URL = urlStr
 	urlInfo.Host = parsedURL.Hostname()
+	if urlInfo.Host == "" {
+		if session != nil {
+			session.LogError(i18n.Tr("url_parse_failed", urlStr, "empty host"))
+		}
+		return nil
+	}
 
 	// 设置端口
 	portStr := parsedURL.Port()
 	if portStr == "" {
+		if hasMalformedURLPort(parsedURL.Host) {
+			if session != nil {
+				session.LogError(i18n.Tr("host_port_invalid", urlInfo.Host, ""))
+			}
+			return nil
+		}
 		// 根据协议设置默认端口
 		if parsedURL.Scheme == "https" {
 			urlInfo.Port = 443
@@ -393,18 +477,14 @@ func (s *WebScanStrategy) createTargetFromURLWithSession(baseInfo common.HostInf
 			urlInfo.Port = 80
 		}
 	} else {
-		// 解析端口字符串为整数
-		var port int
-		if _, err := fmt.Sscanf(portStr, "%d", &port); err == nil {
-			urlInfo.Port = port
-		} else {
-			// 解析失败时使用默认端口
-			if parsedURL.Scheme == "https" {
-				urlInfo.Port = 443
-			} else {
-				urlInfo.Port = 80
+		port, err := strconv.Atoi(portStr)
+		if err != nil || port < 1 || port > 65535 {
+			if session != nil {
+				session.LogError(i18n.Tr("host_port_invalid", urlInfo.Host, portStr))
 			}
+			return nil
 		}
+		urlInfo.Port = port
 	}
 
 	// 标记为Web服务，确保Web插件能识别此目标
@@ -412,3 +492,25 @@ func (s *WebScanStrategy) createTargetFromURLWithSession(baseInfo common.HostInf
 
 	return &urlInfo
 }
+
+// maybeGMTLS 判断标准 TLS 握手错误是否可能是国密服务端
+// 只有 cipher/protocol 层面的不兼容才值得尝试国密回退
+// 连接超时、拒绝、非 TLS 端口等连接级错误直接跳过
+func maybeGMTLS(err error) bool {
+	if err == nil {
+		return false
+	}
+	s := err.Error()
+	return strings.Contains(s, "handshake failure") ||
+		strings.Contains(s, "protocol version") ||
+		strings.Contains(s, "no mutual") ||
+		strings.Contains(s, "cipher suite")
+}
+
+func hasMalformedURLPort(host string) bool {
+	if strings.HasPrefix(host, "[") {
+		end := strings.LastIndexByte(host, ']')
+		return end >= 0 && len(host) > end+1 && host[end+1] == ':'
+	}
+	return strings.Contains(host, ":")
+}

core/web_scanner_test.go

@@ -230,11 +230,11 @@ func TestIsWebServiceByFingerprint(t *testing.T) {
 			expected: true,
 		},
 		{
-			name: "SSL/TLS服务",
+			name: "通用TLS服务不是Web",
 			serviceInfo: &ServiceInfo{
 				Name: "ssl",
 			},
-			expected: true,
+			expected: false,
 		},
 		{
 			name: "包含非Web关键字-postgresql",
@@ -440,9 +440,7 @@ func TestCreateTargetFromURL(t *testing.T) {
 // TestWebServiceCache 测试Web服务缓存操作
 func TestWebServiceCache(t *testing.T) {
 	// 清空缓存
-	webCacheMutex.Lock()
-	webServiceCache = make(map[string]*ServiceInfo)
-	webCacheMutex.Unlock()
+	SetGlobalState(common.NewState())
 
 	t.Run("存储和读取", func(t *testing.T) {
 		serviceInfo := &ServiceInfo{
@@ -517,9 +515,7 @@ func TestWebServiceCache(t *testing.T) {
 // TestWebServiceCache_Concurrent 测试并发安全性
 func TestWebServiceCache_Concurrent(t *testing.T) {
 	// 清空缓存
-	webCacheMutex.Lock()
-	webServiceCache = make(map[string]*ServiceInfo)
-	webCacheMutex.Unlock()
+	SetGlobalState(common.NewState())
 
 	t.Run("不同key并发写入", func(t *testing.T) {
 		var wg sync.WaitGroup
@@ -607,17 +603,43 @@ func TestCreateTargetFromURL_EdgeCases(t *testing.T) {
 
 	t.Run("空URL", func(t *testing.T) {
 		result := strategy.createTargetFromURL(common.HostInfo{}, "")
-		// url.Parse("")会成功，但Hostname()返回空
-		if result == nil {
-			t.Skip("空URL解析行为依赖于url.Parse实现")
+		if result != nil {
+			t.Fatalf("空URL应被拒绝，实际 %#v", result)
 		}
 	})
 
 	t.Run("只有协议", func(t *testing.T) {
 		result := strategy.createTargetFromURL(common.HostInfo{}, "http://")
-		// url.Parse("http://")会成功，但Host为空
-		if result != nil && result.Host == "" {
-			t.Log("Empty host check passed as expected")
+		if result != nil {
+			t.Fatalf("空Host URL应被拒绝，实际 %#v", result)
+		}
+	})
+
+	t.Run("非法URL不会因nil session panic", func(t *testing.T) {
+		result := strategy.createTargetFromURL(common.HostInfo{}, "http://[::1")
+		if result != nil {
+			t.Fatalf("非法URL应被拒绝，实际 %#v", result)
+		}
+	})
+
+	t.Run("越界端口", func(t *testing.T) {
+		result := strategy.createTargetFromURL(common.HostInfo{}, "http://example.com:70000")
+		if result != nil {
+			t.Fatalf("越界端口应被拒绝，实际 %#v", result)
+		}
+	})
+
+	t.Run("非数字端口", func(t *testing.T) {
+		result := strategy.createTargetFromURL(common.HostInfo{}, "http://example.com:bad")
+		if result != nil {
+			t.Fatalf("非数字端口应被拒绝，实际 %#v", result)
+		}
+	})
+
+	t.Run("空端口", func(t *testing.T) {
+		result := strategy.createTargetFromURL(common.HostInfo{}, "http://example.com:")
+		if result != nil {
+			t.Fatalf("空端口应被拒绝，实际 %#v", result)
 		}
 	})
 
@@ -642,6 +664,16 @@ func TestCreateTargetFromURL_EdgeCases(t *testing.T) {
 			}
 		}
 	})
+
+	t.Run("IPv6无端口使用默认端口", func(t *testing.T) {
+		result := strategy.createTargetFromURL(common.HostInfo{}, "https://[::1]/")
+		if result == nil {
+			t.Fatal("IPv6无端口URL应能正确解析")
+		}
+		if result.Host != "::1" || result.Port != 443 {
+			t.Fatalf("IPv6默认端口解析错误: %#v", result)
+		}
+	})
 }
 
 // TestIsWebServiceByFingerprint_Priority 测试识别优先级
@@ -676,12 +708,8 @@ func TestIsWebServiceByFingerprint_Priority(t *testing.T) {
 
 // TestDetectHTTPScheme 测试HTTP/HTTPS协议智能检测
 func TestDetectHTTPScheme(t *testing.T) {
-	// 设置WebTimeout避免测试超时
-	cfg := common.GetGlobalConfig()
-	oldTimeout := cfg.Network.WebTimeout
+	cfg := common.NewConfig()
 	cfg.Network.WebTimeout = 2 * time.Second
-	defer func() { cfg.Network.WebTimeout = oldTimeout }()
-
 	session := common.NewScanSession(cfg, common.NewState(), common.GetFlagVars())
 
 	t.Run("HTTPS服务器检测", func(t *testing.T) {
@@ -816,6 +844,19 @@ func TestCreateHTTPClientUsesPerSessionProxy(t *testing.T) {
 	}
 }
 
+func TestCreateHTTPClientNormalizesHTTPProxyWithoutScheme(t *testing.T) {
+	cfg := common.NewConfig()
+	cfg.Network.WebTimeout = time.Second
+	cfg.Network.HTTPProxy = "127.0.0.1:18080"
+	session := common.NewScanSession(cfg, common.NewState(), &common.FlagVars{})
+
+	client := createHTTPClient(cfg, session)
+	proxy := proxyForTest(t, client)
+	if proxy != "http://127.0.0.1:18080" {
+		t.Fatalf("proxy = %q, want http://127.0.0.1:18080", proxy)
+	}
+}
+
 func proxyForTest(t *testing.T, client *http.Client) string {
 	t.Helper()
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/shadow1ng/fscan
 
-go 1.20
+go 1.25.0
 
 require (
 	github.com/fatih/color v1.18.0
@@ -24,13 +24,14 @@ require (
 	go.ciq.dev/go-rsync v0.0.0-20240304021629-0a3bb196e6d1
 	golang.org/x/crypto v0.31.0
 	golang.org/x/net v0.32.0
-	golang.org/x/sys v0.28.0
+	golang.org/x/sys v0.42.0
 	golang.org/x/term v0.27.0
 	golang.org/x/text v0.21.0
 	google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c
 	google.golang.org/protobuf v1.28.1
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
+	modernc.org/sqlite v1.39.0
 )
 
 require (
@@ -38,6 +39,7 @@ require (
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
 	github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/geoffgarside/ber v1.1.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
@@ -53,9 +55,14 @@ require (
 	github.com/kr/pretty v0.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	modernc.org/libc v1.72.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )

go.sum

@@ -5,6 +5,7 @@ github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 h1:yL7+Jz0jTC6yykIK/Wh74gnTJnrGr5AyrNMXuA0gves=
@@ -16,6 +17,8 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
@@ -50,6 +53,8 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
@@ -65,6 +70,8 @@ github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hirochachacha/go-smb2 v1.1.0 h1:b6hs9qKIql9eVXAiN0M2wSFY5xnhbHAQoCwRKbaRTZI=
 github.com/hirochachacha/go-smb2 v1.1.0/go.mod h1:8F1A4d5EZzrGu5R7PU163UcMRDJQl4FtcxjBfsY8TZE=
 github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 h1:hVXNJ57IHkOA8FBq80UG263MEBwNUMfS9c82J2QE5UQ=
@@ -108,6 +115,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed h1:FI2NIv6fpef6BQl2u3IZX/Cj20tfypRF4yd+uaHOMtI=
 github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed/go.mod h1:3rdaFaCv4AyBgu5ALFM0+tSuHrBh6v692nyQe3ikrq0=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/nicksnyder/go-i18n/v2 v2.4.0 h1:3IcvPOAvnCKwNm0TB0dLDTuawWEj+ax/RERNC+diLMM=
 github.com/nicksnyder/go-i18n/v2 v2.4.0/go.mod h1:nxYSZE9M0bf3Y70gPQjN9ha7XNHX7gMc814+6wVyEI4=
 github.com/panjf2000/ants/v2 v2.11.3 h1:AfI0ngBoXJmYOpDh9m516vjqoUu2sLrIVgppI9TZVpg=
@@ -117,6 +126,8 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
@@ -133,6 +144,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
 github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
@@ -159,6 +171,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -187,8 +201,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -204,8 +218,9 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -236,6 +251,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -270,3 +287,31 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
+modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=
+modernc.org/ccgo/v4 v4.34.0/go.mod h1:AS5WYMyBakQ+fhsHhtP8mWB82KTGPkNNJDGfGQCe0/A=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.72.3 h1:ZnDF4tXn4NBXFutMMQC4vtbTFSXhhKzR73fv0beZEAU=
+modernc.org/libc v1.72.3/go.mod h1:dn0dZNnnn1clLyvRxLxYExxiKRZIRENOfqQ8XEeg4Qs=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.39.0 h1:6bwu9Ooim0yVYA7IZn9demiQk/Ejp0BtTjBWFLymSeY=
+modernc.org/sqlite v1.39.0/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

libs/grdp/login/screen.go

@@ -176,8 +176,7 @@ func (g *Client) ProbeOSInfo(host, domain, user, pwd string, timeout int64, rdpP
 	exitFlag := make(chan bool, 1)
 	info = make(map[string]any)
 
-	targetSlice := strings.Split(g.Host, ":")
-	ip := targetSlice[0]
+	ip := rdpTargetHost(g.Host)
 	conn, err := WrapperTcpWithTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
 	if err != nil {
 		return
@@ -273,3 +272,14 @@ loop:
 	glog.Debug("loop ended, elapsed time: ", time.Since(start))
 	return info
 }
+
+func rdpTargetHost(target string) string {
+	host, _, err := net.SplitHostPort(target)
+	if err == nil {
+		return host
+	}
+	if strings.Count(target, ":") == 1 {
+		return strings.SplitN(target, ":", 2)[0]
+	}
+	return target
+}

libs/grdp/login/screen_test.go

@@ -0,0 +1,24 @@
+package login
+
+import "testing"
+
+func TestRDPTargetHost(t *testing.T) {
+	tests := []struct {
+		name   string
+		target string
+		want   string
+	}{
+		{name: "ipv4 with port", target: "192.168.1.1:3389", want: "192.168.1.1"},
+		{name: "hostname with port", target: "rdp.example.com:3389", want: "rdp.example.com"},
+		{name: "bracketed ipv6 with port", target: "[2001:db8::1]:3389", want: "2001:db8::1"},
+		{name: "bare ipv6 without port", target: "2001:db8::1", want: "2001:db8::1"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := rdpTargetHost(tt.target); got != tt.want {
+				t.Fatalf("rdpTargetHost(%q) = %q, want %q", tt.target, got, tt.want)
+			}
+		})
+	}
+}

libs/grdp/protocol/tpkt/tpkt.go

@@ -477,6 +477,13 @@ func (t *TPKT) recvFastPath(s []byte, err error) {
 		return
 	}
 
+	// NLA-only authentication can receive a Fast-Path packet before the PDU
+	// layer installs a listener. Treat it as an ignorable early packet instead
+	// of dereferencing a nil interface and crashing the whole scan.
+	if t.fastPathListener == nil {
+		return
+	}
+
 	t.fastPathListener.RecvFastPath(t.secFlag, s)
 	core.StartReadBytes(2, t.Conn, t.recvHeader)
 }

libs/grdp/protocol/tpkt/tpkt_test.go

@@ -0,0 +1,13 @@
+package tpkt
+
+import (
+	"testing"
+
+	"github.com/shadow1ng/fscan/libs/grdp/glog"
+)
+
+func TestRecvFastPathWithoutListenerDoesNotPanic(t *testing.T) {
+	glog.SetLevel(glog.NONE)
+	tpkt := &TPKT{}
+	tpkt.recvFastPath([]byte{0x00}, nil)
+}

main_cli.go

@@ -1,3 +1,5 @@
+//go:build !web
+
 package main
 
 import (
@@ -10,7 +12,6 @@ import (
 	"github.com/shadow1ng/fscan/common/debug"
 	"github.com/shadow1ng/fscan/common/i18n"
 	"github.com/shadow1ng/fscan/core"
-	"github.com/shadow1ng/fscan/web"
 
 	// 导入统一插件系统
 	_ "github.com/shadow1ng/fscan/plugins/local"
@@ -19,6 +20,10 @@ import (
 )
 
 func main() {
+	os.Exit(run())
+}
+
+func run() int {
 	// 启动 pprof（仅调试版本）
 	debug.Start()
 	defer debug.Stop()
@@ -27,32 +32,23 @@ func main() {
 	var info common.HostInfo
 	if err := common.Flag(&info); err != nil {
 		if err == common.ErrShowHelp {
-			os.Exit(0) // 显示帮助是正常退出
+			return 0 // 显示帮助是正常退出
 		}
 		common.LogError(i18n.Tr("param_error", err))
-		os.Exit(1)
-	}
-
-	// Web模式：启动Web服务器
-	if common.WebMode {
-		if err := web.StartServer(common.WebPort); err != nil {
-			common.LogError(err.Error())
-			os.Exit(1)
-		}
-		return
+		return 1
 	}
 
 	// 检查参数互斥性
 	if err := common.ValidateExclusiveParams(&info); err != nil {
 		common.LogError(i18n.Tr("error_generic", err))
-		os.Exit(1)
+		return 1
 	}
 
 	// 统一初始化：解析 → 配置 → 输出
 	result, err := common.Initialize(&info)
 	if err != nil {
 		common.LogError(i18n.Tr("init_failed", err))
-		os.Exit(1)
+		return 1
 	}
 
 	// 设置信号处理，确保 Ctrl+C 时能正确保存结果
@@ -70,6 +66,8 @@ func main() {
 	// 执行扫描
 	if _, err := core.RunScan(context.Background(), *result.Info, result.Session); err != nil {
 		common.LogError(i18n.Tr("error_generic", err))
-		os.Exit(1)
+		return 1
 	}
+
+	return 0
 }

main_web.go

@@ -0,0 +1,33 @@
+//go:build web
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+	"github.com/shadow1ng/fscan/web"
+
+	// 导入统一插件系统
+	_ "github.com/shadow1ng/fscan/plugins/local"
+	_ "github.com/shadow1ng/fscan/plugins/services"
+	_ "github.com/shadow1ng/fscan/plugins/web"
+)
+
+func main() {
+	port := flag.Int("port", 10240, "Web server listen port")
+	lang := flag.String("lang", "zh", "Language (zh/en)")
+	flag.Parse()
+
+	i18n.SetLanguage(*lang)
+
+	fmt.Printf("fscan web v%s\n", common.GetVersion())
+
+	if err := web.StartServer(*port); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+}

pkg/fscan/result.go

@@ -135,21 +135,25 @@ func (r Result) DetailBool(key string) (bool, bool) {
 // Port returns the result port from details, or from a target in host:port form.
 func (r Result) Port() (int, bool) {
 	if port, ok := r.DetailInt("port"); ok {
-		return port, true
+		return port, validPort(port)
 	}
 	if _, portText, err := net.SplitHostPort(r.Target); err == nil {
 		port, err := strconv.Atoi(portText)
-		return port, err == nil
+		return port, err == nil && validPort(port)
 	}
 	if strings.Count(r.Target, ":") == 1 {
 		if idx := strings.LastIndex(r.Target, ":"); idx >= 0 && idx+1 < len(r.Target) {
 			port, err := strconv.Atoi(r.Target[idx+1:])
-			return port, err == nil
+			return port, err == nil && validPort(port)
 		}
 	}
 	return 0, false
 }
 
+func validPort(port int) bool {
+	return port >= 1 && port <= 65535
+}
+
 // Service returns the detected service name when present.
 func (r Result) Service() (string, bool) { return r.DetailString("service") }
 

pkg/fscan/result_test.go

@@ -76,6 +76,21 @@ func TestResultPortNoPort(t *testing.T) {
 	}
 }
 
+func TestResultPortRejectsOutOfRangePorts(t *testing.T) {
+	tests := []Result{
+		{Target: "10.0.0.1:70000"},
+		{Target: "[::1]:0"},
+		{Details: map[string]interface{}{"port": 70000}},
+		{Details: map[string]interface{}{"port": 0}},
+	}
+
+	for _, result := range tests {
+		if port, ok := result.Port(); ok {
+			t.Fatalf("Port(%#v) = %d/true, want false", result, port)
+		}
+	}
+}
+
 func TestResultCredentialHelpers(t *testing.T) {
 	result := Result{
 		Type:   ResultTypeVuln,
@@ -715,4 +730,3 @@ func TestResultSummaryJSON(t *testing.T) {
 		t.Fatalf("round-trip failed: %#v", decoded)
 	}
 }
-

pkg/fscan/scanner.go

@@ -408,9 +408,10 @@ func buildFlagVars(config Config, target Target) *common.FlagVars {
 		ThreadNum:           threadNum,
 		ModuleThreadNum:     moduleThreads,
 		TimeoutSec:          timeout,
-		GlobalTimeout:       180,
+		GlobalTimeout:       0,
 		DisablePing:         config.DisablePing,
 		DisableTcpProbe:     config.DisableTCPProbe,
+		DisableSubnetProbe:  config.DisableSubnetProbe,
 		AliveOnly:           false,
 		DisableBrute:        config.DisableBrute,
 		MaxRetries:          maxRetries,

pkg/fscan/scanner_test.go

@@ -667,6 +667,9 @@ func TestBuildFlagVarsCustomValues(t *testing.T) {
 	if fv.TimeoutSec != 10 {
 		t.Fatalf("TimeoutSec = %d, want 10", fv.TimeoutSec)
 	}
+	if fv.GlobalTimeout != 0 {
+		t.Fatalf("GlobalTimeout = %d, want disabled", fv.GlobalTimeout)
+	}
 	if fv.WebTimeout != 15 {
 		t.Fatalf("WebTimeout = %d, want 15", fv.WebTimeout)
 	}

pkg/fscan/types.go

@@ -133,9 +133,10 @@ type Config struct {
 	ModuleThreads int
 	MaxRetries    int
 
-	DisablePing     bool
-	DisableTCPProbe bool
-	DisableBrute    bool
+	DisablePing        bool
+	DisableTCPProbe    bool
+	DisableSubnetProbe bool
+	DisableBrute       bool
 
 	Usernames       []string
 	Passwords       []string

plugins/init_test.go

@@ -1,6 +1,7 @@
 package plugins
 
 import (
+	"context"
 	"testing"
 
 	"github.com/shadow1ng/fscan/common"
@@ -23,6 +24,122 @@ init_test.go - 插件系统核心逻辑测试
 // GenerateCredentials - 核心凭据生成逻辑
 // =============================================================================
 
+func preservePluginRegistry(t *testing.T) {
+	t.Helper()
+
+	mutex.RLock()
+	snapshot := make(map[string]*PluginInfo, len(plugins))
+	for name, info := range plugins {
+		copied := *info
+		copied.ports = append([]int(nil), info.ports...)
+		copied.types = append([]string(nil), info.types...)
+		snapshot[name] = &copied
+	}
+	mutex.RUnlock()
+
+	t.Cleanup(func() {
+		mutex.Lock()
+		plugins = snapshot
+		mutex.Unlock()
+	})
+}
+
+type testPlugin struct {
+	BasePlugin
+}
+
+func (p testPlugin) Scan(context.Context, *common.HostInfo, *common.ScanSession) *Result {
+	return &Result{Type: ResultTypeService, Success: true}
+}
+
+func TestPluginRegistryMetadata(t *testing.T) {
+	preservePluginRegistry(t)
+
+	RegisterWithPorts("unit_tcp", func() Plugin {
+		return testPlugin{BasePlugin: NewBasePlugin("unit_tcp")}
+	}, []int{1234, 5678})
+	RegisterUDPWithPorts("unit_udp", func() Plugin {
+		return testPlugin{BasePlugin: NewBasePlugin("unit_udp")}
+	}, []int{161})
+	RegisterWithTypes("unit_local", func() Plugin {
+		return testPlugin{BasePlugin: NewBasePlugin("unit_local")}
+	}, nil, []string{PluginTypeLocal})
+	RegisterUnsafeWithTypes("unit_unsafe_web", func() Plugin {
+		return testPlugin{BasePlugin: NewBasePlugin("unit_unsafe_web")}
+	}, nil, []string{PluginTypeWeb})
+
+	if !Exists("unit_tcp") || Exists("missing_plugin") {
+		t.Fatal("Exists returned wrong result")
+	}
+	if got := Get("unit_tcp"); got == nil || got.Name() != "unit_tcp" {
+		t.Fatalf("Get(unit_tcp) = %#v", got)
+	}
+	if got := Get("missing_plugin"); got != nil {
+		t.Fatalf("Get(missing_plugin) = %#v, want nil", got)
+	}
+	if !HasType("unit_tcp", PluginTypeService) || !HasType("unit_local", PluginTypeLocal) {
+		t.Fatal("registered plugin types were not recorded")
+	}
+	if !IsUDP("unit_udp") || IsUDP("unit_tcp") {
+		t.Fatal("UDP metadata is wrong")
+	}
+	if !IsSafe("unit_tcp") || IsSafe("unit_local") || IsSafe("unit_unsafe_web") || IsSafe("missing_plugin") {
+		t.Fatal("safe metadata is wrong")
+	}
+
+	ports := GetPluginPorts("unit_tcp")
+	if len(ports) != 2 || ports[0] != 1234 || ports[1] != 5678 {
+		t.Fatalf("ports = %#v", ports)
+	}
+	if got := GetPluginPorts("missing_plugin"); len(got) != 0 {
+		t.Fatalf("missing plugin ports = %#v, want empty", got)
+	}
+	if !hasPluginType([]string{PluginTypeWeb, PluginTypeLocal}, PluginTypeLocal) ||
+		hasPluginType([]string{PluginTypeWeb}, PluginTypeUDP) {
+		t.Fatal("hasPluginType returned wrong result")
+	}
+
+	names := All()
+	for _, want := range []string{"unit_tcp", "unit_udp", "unit_local", "unit_unsafe_web"} {
+		if !containsPluginName(names, want) {
+			t.Fatalf("All() missing %q in %#v", want, names)
+		}
+	}
+}
+
+func TestPluginLocalModeHook(t *testing.T) {
+	preservePluginRegistry(t)
+
+	RegisterWithTypes("unit_local_mode", func() Plugin {
+		return testPlugin{BasePlugin: NewBasePlugin("unit_local_mode")}
+	}, nil, []string{PluginTypeLocal})
+	RegisterWithPorts("unit_service_mode", func() Plugin {
+		return testPlugin{BasePlugin: NewBasePlugin("unit_service_mode")}
+	}, []int{22})
+
+	if common.IsLocalMode == nil {
+		t.Fatal("IsLocalMode hook should be installed")
+	}
+	if !common.IsLocalMode("unit_local_mode") {
+		t.Fatal("single local plugin should be local mode")
+	}
+	if !common.IsLocalMode("unit_local_mode, unit_local_mode") {
+		t.Fatal("local plugin list should be local mode")
+	}
+	if common.IsLocalMode("") || common.IsLocalMode("all") || common.IsLocalMode("unit_local_mode,unit_service_mode") {
+		t.Fatal("non-local modes should not be local mode")
+	}
+}
+
+func containsPluginName(values []string, want string) bool {
+	for _, value := range values {
+		if value == want {
+			return true
+		}
+	}
+	return false
+}
+
 func TestGenerateCredentials_UserPassPairs_Priority(t *testing.T) {
 	/*
 	   关键测试：UserPassPairs 应该优先于笛卡尔积
@@ -192,9 +309,9 @@ func TestGenerateCredentials_PlaceholderReplacement(t *testing.T) {
 
 	// 验证：{user} 被正确替换
 	expectedCombos := map[string]string{
-		"root:root":     "root",   // {user} → root
-		"root:root123":  "root",   // {user}123 → root123
-		"mysql:mysql":   "mysql",  // {user} → mysql
+		"root:root":      "root",  // {user} → root
+		"root:root123":   "root",  // {user}123 → root123
+		"mysql:mysql":    "mysql", // {user} → mysql
 		"mysql:mysql123": "mysql", // {user}123 → mysql123
 	}
 
@@ -244,7 +361,7 @@ func TestGenerateCredentials_DefaultValues(t *testing.T) {
 
 	cfg.Credentials.UserPassPairs = []config.CredentialPair{}
 	cfg.Credentials.Userdict = map[string][]string{} // 空字典
-	cfg.Credentials.Passwords = []string{}          // 空密码列表
+	cfg.Credentials.Passwords = []string{}           // 空密码列表
 
 	result := GenerateCredentials("unknown_service", cfg)
 
@@ -327,3 +444,27 @@ func TestGenerateCredentials_EmptyUserPassPairs(t *testing.T) {
 
 	t.Logf("✓ 空 UserPassPairs 正确回退到笛卡尔积")
 }
+
+func TestBuildConfigAdditionalPasswordsAreNotShadowedByExactPair(t *testing.T) {
+	cfg, _, err := common.BuildConfig(&common.FlagVars{
+		Username:     "root",
+		Password:     "primary",
+		AddPasswords: "extra",
+	}, &common.HostInfo{})
+	if err != nil {
+		t.Fatalf("BuildConfig error = %v", err)
+	}
+
+	result := GenerateCredentials("ssh", cfg)
+	found := map[string]bool{}
+	for _, cred := range result {
+		found[cred.Username+":"+cred.Password] = true
+	}
+
+	if !found["root:primary"] {
+		t.Fatal("missing primary password credential")
+	}
+	if !found["root:extra"] {
+		t.Fatal("additional password was shadowed by exact user/password pair")
+	}
+}