fix: normalize Docker firewall rule sync (#13704)

agent/app/service/firewall_sync.go

@@ -790,7 +790,9 @@ func (p databaseSyncPlan) preview() dto.FirewallRuleSyncPreview {
 			result.Total++
 		case firewallRuleSyncBlocked:
 			result.Blocked++
-			result.Total++
+			if item.ReasonCode != firewallsync.ReasonReadOnlyRule {
+				result.Total++
+			}
 		case firewallsync.StatusRemove:
 			result.Removed++
 		}

agent/utils/firewall/docker_guard/policy.go

@@ -91,7 +91,10 @@ func PolicySyncKey(policy Policy) string {
 	if mode == ModeAllow && len(policy.Sources) == 0 {
 		mode = ModeAll
 	}
-	sources := append([]string(nil), policy.Sources...)
+	sources := make([]string, 0, len(policy.Sources))
+	for _, source := range policy.Sources {
+		sources = append(sources, canonicalPolicySource(source))
+	}
 	sort.Strings(sources)
 	return strings.Join([]string{
 		policy.UUID, policy.Family, CanonicalHost(policy.HostIP), strconv.Itoa(int(policy.HostPort)),
@@ -99,6 +102,18 @@ func PolicySyncKey(policy Policy) string {
 	}, "\x00")
 }
 
+func canonicalPolicySource(value string) string {
+	value = strings.TrimSpace(value)
+	if prefix, err := netip.ParsePrefix(value); err == nil {
+		return prefix.Masked().String()
+	}
+	if address, err := netip.ParseAddr(value); err == nil {
+		address = address.Unmap()
+		return netip.PrefixFrom(address, address.BitLen()).String()
+	}
+	return value
+}
+
 func PolicyStatesEqual(left, right []Policy) bool {
 	if len(left) != len(right) {
 		return false

frontend/src/views/host/firewall/sync/index.vue

@@ -205,7 +205,9 @@ const syncDisabled = computed(() => {
 const detailItems = computed(() => {
     if (!preview.value || !detailFilter.value) return [];
     const items = preview.value.items || [];
-    if (detailFilter.value === 'total') return items.filter((item) => item.status !== 'remove');
+    if (detailFilter.value === 'total') {
+        return items.filter((item) => item.status !== 'remove' && item.reasonCode !== 'read_only_rule');
+    }
     return items.filter((item) => item.status === detailFilter.value);
 });