@aiwayds/dsh-llm-proxy 0.2.0

package/README.md

@@ -0,0 +1,156 @@
+# dsh-llm-proxy
+
+dsh 插件：**SYSTEM proxy + LLM 分流代理**。通过一个进程级 undici 路由 Dispatcher，
+把 LLM 流量按配置列表分流到指定代理，其余流量走系统代理（启动环境变量），都没配则直连。
+
+## 优先级语义
+
+```
+LLM 列表命中 > SYSTEM proxy（env 语义）> 直连
+```
+
+- 请求 origin 命中 `llmProxy` 列表条目 → 走该条目指定的代理（undici `ProxyAgent`）
+- 未命中 → 走共享的 undici `EnvHttpProxyAgent`，它自己处理
+  `HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` / `NO_PROXY`
+  （大小写均兼容）——即标准 env 代理语义
+- SYSTEM 也未配置 → 直连
+
+> 环境变量**只读不写**：插件不会修改 `process.env.HTTP_PROXY`——对已启动进程无意义。
+
+## 安装
+
+```bash
+# 方式一：作为 npm 插件加入 profile
+dsh plugin add @aiwayds/dsh-llm-proxy   # 或在 settings.yaml 的 plugins 里声明
+
+# 方式二：手动 patch 挂载（本包自带 cordis.patch.yml）
+# 在 profile 的 bundles 中插入：
+#   - id: dsh-llm-proxy
+#     name: '@aiwayds/dsh-llm-proxy'
+```
+
+> ⚠️ 最低宿主要求：0.2.0 起本插件声明 `inject: ['skills']`，要求宿主 dsh 提供 skills
+> 服务（`@deepseek-ai/dsh-skill` 0.1.1-rc 系列+）。无该服务的旧宿主上，本插件（含代理
+> 路由功能）不会加载。
+
+> 发布状态：本包已发布到 npm（0.2.0，自带内置 skill），方式一
+> `dsh plugin add @aiwayds/dsh-llm-proxy` 即可直接用。
+
+## Skill（内置使用指南）
+
+本仓库自带一个 dsh skill（`skills/dsh-llm-proxy/SKILL.md`）：面向 agent 的配置 + 排障
+使用指南，frontmatter `description` 内嵌触发词（dsh 代理、HTTP 代理、LLM 分流、llmProxy、
+407、CONNECT 挂起、SOCKS、NODE_USE_ENV_PROXY 等），进入每会话模型目录用于路由。三种获取方式：
+
+1. **随插件自动注册（零操作）**：通过 npm 包或 bundle（cordis.patch.yml）挂载本插件后，
+   skill 随插件 `apply()` 自动注册——进入每会话 skill 目录（`<available_skills>`，
+   frontmatter `description` 供模型路由），`/dsh-llm-proxy` 手势可直接调出指南（已实测可用）。
+2. **GitHub 安装（不装插件，只要 skill）**：
+
+   ```bash
+   npx skills add fan56/dsh-llm-proxy   # 安装到 ~/.agents/skills/
+   ```
+
+3. **手动**：`git clone` 本仓库后，把 `skills/dsh-llm-proxy/` 拷贝或软链到 `~/.dsh/skills/`：
+
+   ```bash
+   git clone https://github.com/fan56/dsh-llm-proxy.git
+   ln -s "$(pwd)/dsh-llm-proxy/skills/dsh-llm-proxy" ~/.dsh/skills/dsh-llm-proxy
+   ```
+
+⚠️ 铁律：本包的 `@deepseek-ai/*` 只声明在 **peerDependencies**
+（devDependencies 保留供本地构建）。请勿把它们挪进 dependencies——那会装出第二份
+cordis 闭包，导致双实例崩溃（详见 dsh 生态 link-dsh-closure 机制）。
+
+## 配置入口（settings.yaml 命名空间段）
+
+dsh 插件的用户配置唯一入口是 **settings.yaml 里按插件 id 命名的命名空间段**。本插件通过
+`@deepseek-ai/dsh-settings` 的 `installSettingsSection` 注册了 `dsh-llm-proxy` 命名空间
+（与 harness 内置插件 `llm-deepseek` 的 `llm-deepseek:` 段同机制），所以请在
+`~/.dsh/settings.yaml` 写：
+
+```yaml
+dsh-llm-proxy:
+  enabled: true                    # 总开关，默认 true；false 时完全不动全局
+  systemMode: env                  # 'env'（默认，读环境变量）| 'off'（全部直连，仅 llmProxy 生效）
+  llmProxy:                        # 匹配列表，按顺序首条命中生效
+    - match: "api.deepseek.org"    # 域名精确匹配（含任意端口）
+      proxy: "http://127.0.0.1:7890"
+    - match: "*.volces.com"        # 通配：volces.com 本身 + 任意子域
+      proxy: "http://127.0.0.1:7891"
+    - match: "https://api.openai.com"  # 完整 origin 精确匹配（大小写不敏感）
+      proxy: "http://127.0.0.1:7892"
+```
+
+要点：
+
+- **顶层键必须是 `dsh-llm-proxy:`**（与插件 id 一致）。写其他键（如 `llm-proxy:`）不会
+  被读到，静默失效。
+- 编辑 settings.yaml **热生效**：settings provider 发布变更后，插件会拆掉旧 router、按新
+  配置重建，无需重启。
+- bundle entry config（`cordis.patch.yml` insert 行的 `config:`）作为 base 层仍然有效；
+  settings.yaml 段覆盖其上的同名键。
+- 未挂载 settings 服务的宿主自动回退到 entry config，插件照常工作。
+
+### match 规则
+
+| 写法 | 含义 |
+|------|------|
+| `api.example.com` | host 精确匹配，**任意端口**都算命中 |
+| `api.example.com:8443` | host + 显式端口必须相等（https 默认 443 / http 默认 80 会补全比较） |
+| `*.example.com` | `example.com` 本身及任意层级子域 |
+| `https://api.example.com` | 完整 origin 精确匹配（scheme 也要一致） |
+
+匹配全部大小写不敏感、纯词法比较（无 DNS/IO）。IDN 域名在匹配前统一归一化为 punycode
+（`中文.com` 与 `xn--fiq228c.com` 两种写法等价，pattern 和 origin 两侧对称处理）。
+实现为纯函数（`src/match.ts`），有完整单测。
+
+### proxy 协议限制
+
+undici `ProxyAgent` 只支持 **http:// 与 https://** 上游代理。
+`socks5://` 等 schema 在启动校验时直接报错（fail-fast），README 明说：**SOCKS 不支持**。
+
+## 实现要点
+
+- service start 时创建自定义 undici 路由 Dispatcher 并 `setGlobalDispatcher(router)`；
+  router 的 `dispatch()` 按 origin 分流：命中 → 该条的 `ProxyAgent`（按 URL 缓存复用）；
+  未命中 → 共享 `EnvHttpProxyAgent`（或 `systemMode: off` 时直连 `Agent`）。
+- **照抄 pi-src 生产模板的防御细节**：
+  - `undici.install?.()` 防 Node 内建 fetch 与 npm undici 版本偏斜 bug
+    （Node 26 bundled fetch 经 npm undici dispatcher 不解压导致 `response.json()`
+    失败）；用 pristine/owned 双守卫只在未被替换时 install。
+  - undici Client 中途断流会发裸 `error` 事件导致 unhandled crash——对本插件创建的
+    每个 dispatcher 挂 EventEmitter 级 error 兜底 listener（与 pi-src
+    `http-dispatcher.ts` 同款机制，覆盖进程内所有由本插件创建的 dispatcher）。
+- **HMR 重载窗口闭环**：接管状态（原始 dispatcher/fetch + 活跃层列表）存放在
+  `Symbol.for` 共享槽位，跨模块副本可见。cordis `Group.update` 先 create 后 remove、
+  vendor HMR 先 re-import 后 dispose——新版 apply 可能发生在旧版 dispose 之前；
+  dispose 只摘除自己那一层，把 globals 还给最近的存活层，绝不打掉别人的路由器。
+- dispose（cordis effect 语义）时**非阻塞拆除**：先把 globals 还回去（新请求立即不再
+  进入旧 router），再后台 fire-and-forget 地 `close()` 排空在途请求——长 LLM 流式响应
+  不会拖住热重载。
+- proxy URL 中可能出现的 userinfo 凭证（`user:pass@host`）在日志/error message 里一律
+  脱敏为 `***@host`。
+- 与 `NODE_USE_ENV_PROXY` 官方姿势的关系：本插件是等价替代——无需该变量、无需重启，
+  对新请求即时生效，且额外提供 LLM 分流能力。
+
+## 手动 e2e 验证（CI 无网，不做真实请求测试）
+
+```bash
+# 1. 配一个本地回显代理（如 clash/mihomo 的 mixed-port 7890）
+export HTTPS_PROXY=http://127.0.0.1:7890
+# 2. settings.yaml 配 dsh-llm-proxy 段，把某个 API 域名指到另一端口
+# 3. 启动 dsh 后发起对话，观察代理访问日志：
+#    - llmProxy 命中域名的请求出现在该条代理日志里
+#    - 其他外网请求出现在 7890 日志里
+# 4. unset HTTPS_PROXY 重启 → 只有 llmProxy 命中的流量走代理，其余直连
+```
+
+## 开发
+
+```bash
+npm run build   # tsc -> lib/
+npm run check   # tsc --noEmit
+npm test        # node --test（match / router 探针分流 / config 边界 / skill 注册 /
+                # dispose 对称性 / e2e 全链路：apply → 全局 fetch 分流 → dispose 恢复 + HMR 窗口回归）
+```

package/cordis.patch.yml

@@ -0,0 +1,9 @@
+# dsh-llm-proxy bundle patch: mounts the plugin into the profile's assembly
+# tree under the stable plugin id `dsh-llm-proxy`. On service start it swaps
+# the process-global undici dispatcher for a router: llmProxy hits go through
+# their configured proxy, everything else follows the env SYSTEM proxy
+# semantics (or connects directly with systemMode: off).
+
+- insert:
+    - id: dsh-llm-proxy
+      name: '@aiwayds/dsh-llm-proxy'

package/lib/index.d.ts

@@ -0,0 +1,102 @@
+/**
+ * dsh-llm-proxy — SYSTEM proxy + LLM traffic-splitting proxy for dsh.
+ *
+ * Installs a single process-global undici routing dispatcher:
+ * - requests whose origin hits an `llmProxy` list entry go through that
+ *   entry's proxy (undici ProxyAgent);
+ * - everything else goes through a shared EnvHttpProxyAgent, which applies
+ *   the startup environment's HTTPS_PROXY / HTTP_PROXY / ALL_PROXY / NO_PROXY
+ *   semantics (upper- and lowercase);
+ * - with no env proxy configured the fallback is a direct connection.
+ *
+ * Priority: llmProxy hit > SYSTEM (env) > direct.
+ *
+ * apply() also registers a bundled skill (skills/dsh-llm-proxy/SKILL.md) that
+ * carries the plugin's configuration and troubleshooting guide.
+ *
+ * User configuration arrives exclusively through the `dsh-llm-proxy`
+ * settings.yaml namespace (registered via installSettingsSection, the same
+ * seam harness core plugins use); the bundle entry config is the base layer.
+ * Edits to the settings section hot-publish: the router is rebuilt in place,
+ * unless the resolved values are unchanged, in which case the rebuild is
+ * skipped (the settings attach itself fires one redundant onChange).
+ *
+ * Environment variables are only read, never written: mutating
+ * process.env.HTTP_PROXY in an already-started process has no effect on
+ * undici/Node internals and is deliberately avoided.
+ *
+ * @module @aiwayds/dsh-llm-proxy
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import * as undici from 'undici';
+import { type LlmProxyEntry } from './router.ts';
+export { matchOrigin } from './match.ts';
+export { createProxyRouterDispatcher, resolveRoute, type LlmProxyEntry, type RouteDecision } from './router.ts';
+export declare const name = "dsh-llm-proxy";
+/** Service required by the bundled skill provider. */
+export declare const inject: string[];
+/** Plugin configuration. */
+export interface Config {
+    /** Master switch; `false` leaves globals untouched (default `true`). */
+    enabled?: boolean;
+    /**
+     * Fallback mode for requests no llmProxy entry matches (default `env`):
+     * `env` applies HTTPS_PROXY / HTTP_PROXY / ALL_PROXY / NO_PROXY from the
+     * startup environment; `off` connects directly.
+     */
+    systemMode?: 'env' | 'off';
+    /** Ordered LLM proxy list; the first entry whose match hits wins. */
+    llmProxy?: Array<{
+        match: string;
+        proxy: string;
+    }>;
+}
+/** Runtime schema for {@link Config}. */
+export declare const Config: z<Config>;
+/**
+ * Mask the userinfo part of a proxy URL ("user:pass@host") so log lines and
+ * error messages never carry credentials.
+ */
+export declare function redactProxyUrl(proxyUrl: string): string;
+/** Fully resolved plugin policy captured at apply time. */
+export interface ResolvedConfig {
+    readonly enabled: boolean;
+    readonly systemMode: 'env' | 'off';
+    readonly llmProxy: readonly LlmProxyEntry[];
+}
+/**
+ * Validate, default, and freeze the plugin configuration.
+ * @param config - optional plugin configuration; omission selects defaults.
+ */
+export declare function resolveConfig(config: Config | undefined): ResolvedConfig;
+/** Injectable seams for tests; production defaults build real undici agents. */
+export interface ApplyInternals {
+    /**
+     * Creates the shared system fallback; the default builds an
+     * EnvHttpProxyAgent for `env`, a direct Agent for `off`.
+     */
+    createSystemDispatcher?: (systemMode: 'env' | 'off') => undici.Dispatcher;
+    /** Creates the per-proxy dispatcher; defaults to ProxyAgent. Overridable in tests. */
+    createProxyDispatcher?: (proxyUrl: string) => undici.Dispatcher;
+}
+/**
+ * Strip a leading YAML frontmatter block (`---` / body / `---`) from a skill
+ * markdown file. `SkillDefinition.content` must be the instruction body after
+ * metadata removal — the same shape the filesystem provider serves — so the
+ * bundled SKILL.md, which keeps its frontmatter for the GitHub/manual install
+ * paths, has the block removed when served through {@link skillProvider.get}.
+ * Tolerant by design: input that does not open with a `---` line, or whose
+ * frontmatter block is never closed, is returned unchanged. Mirrors the
+ * delimiter semantics of the upstream skill-filesystem provider.
+ */
+export declare function stripFrontmatter(raw: string): string;
+/**
+ * Install the global routing dispatcher, wire the `dsh-llm-proxy` settings
+ * namespace, register the bundled skill provider, and register teardown.
+ * @param ctx - plugin context owning the dispose effect.
+ * @param config - composition entry config; the base layer under the
+ *   settings.yaml `dsh-llm-proxy` section.
+ * @param internals - injectable dispatcher factories for tests.
+ */
+export declare function apply(ctx: Context, config?: Config, internals?: ApplyInternals): void;

package/lib/index.js

@@ -0,0 +1,335 @@
+/**
+ * dsh-llm-proxy — SYSTEM proxy + LLM traffic-splitting proxy for dsh.
+ *
+ * Installs a single process-global undici routing dispatcher:
+ * - requests whose origin hits an `llmProxy` list entry go through that
+ *   entry's proxy (undici ProxyAgent);
+ * - everything else goes through a shared EnvHttpProxyAgent, which applies
+ *   the startup environment's HTTPS_PROXY / HTTP_PROXY / ALL_PROXY / NO_PROXY
+ *   semantics (upper- and lowercase);
+ * - with no env proxy configured the fallback is a direct connection.
+ *
+ * Priority: llmProxy hit > SYSTEM (env) > direct.
+ *
+ * apply() also registers a bundled skill (skills/dsh-llm-proxy/SKILL.md) that
+ * carries the plugin's configuration and troubleshooting guide.
+ *
+ * User configuration arrives exclusively through the `dsh-llm-proxy`
+ * settings.yaml namespace (registered via installSettingsSection, the same
+ * seam harness core plugins use); the bundle entry config is the base layer.
+ * Edits to the settings section hot-publish: the router is rebuilt in place,
+ * unless the resolved values are unchanged, in which case the rebuild is
+ * skipped (the settings attach itself fires one redundant onChange).
+ *
+ * Environment variables are only read, never written: mutating
+ * process.env.HTTP_PROXY in an already-started process has no effect on
+ * undici/Node internals and is deliberately avoided.
+ *
+ * @module @aiwayds/dsh-llm-proxy
+ */
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { deepEqualJson, installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
+import { BUNDLED_SKILL_RANK, } from '@deepseek-ai/dsh-skill';
+import z from '@deepseek-ai/schemastery';
+import * as undici from 'undici';
+import { createProxyRouterDispatcher, withUndiciErrorListener } from "./router.js";
+export { matchOrigin } from "./match.js";
+export { createProxyRouterDispatcher, resolveRoute } from "./router.js";
+export const name = 'dsh-llm-proxy';
+/** Service required by the bundled skill provider. */
+export const inject = ['skills'];
+/**
+ * The settings.yaml namespace this plugin owns. dsh feeds user configuration
+ * to plugins only through registered settings namespaces; the document
+ * section key that reaches this plugin is exactly this string.
+ */
+const SETTINGS_NAMESPACE = settingsNamespace('dsh-llm-proxy');
+/** Runtime schema for {@link Config}. */
+export const Config = z.object({
+    enabled: z.boolean().default(true),
+    systemMode: z.union([z.const('env'), z.const('off')]).default('env'),
+    llmProxy: z.array(z.object({
+        match: z.string(),
+        proxy: z.string(),
+    })),
+});
+const CONFIG_KEYS = new Set(['enabled', 'systemMode', 'llmProxy']);
+/**
+ * Mask the userinfo part of a proxy URL ("user:pass@host") so log lines and
+ * error messages never carry credentials.
+ */
+export function redactProxyUrl(proxyUrl) {
+    let parsed;
+    try {
+        parsed = new URL(proxyUrl);
+    }
+    catch {
+        // Unparsable input: best-effort masking of a credential-shaped token.
+        return proxyUrl.replace(/(^|\/\/|\s)[^\s@/]+@/, '$1***@');
+    }
+    if (!parsed.username && !parsed.password)
+        return proxyUrl;
+    const auth = parsed.password ? '***:***@' : '***@';
+    const path = parsed.pathname === '/' ? '' : parsed.pathname;
+    return `${parsed.protocol}//${auth}${parsed.host}${path}${parsed.search}${parsed.hash}`;
+}
+function validateProxyUrl(proxy, index) {
+    let parsed;
+    try {
+        parsed = new URL(proxy);
+    }
+    catch {
+        throw new Error(`dsh-llm-proxy: config.llmProxy[${index}].proxy is not a valid URL: "${redactProxyUrl(proxy)}"`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`dsh-llm-proxy: config.llmProxy[${index}].proxy must use http:// or https:// `
+            + `(undici ProxyAgent does not support ${parsed.protocol}//; SOCKS is not supported)`);
+    }
+}
+/**
+ * Validate, default, and freeze the plugin configuration.
+ * @param config - optional plugin configuration; omission selects defaults.
+ */
+export function resolveConfig(config) {
+    if (config !== undefined) {
+        for (const key of Object.keys(config)) {
+            if (!CONFIG_KEYS.has(key))
+                throw new Error(`dsh-llm-proxy: config: unknown key "${key}"`);
+        }
+    }
+    const enabled = config?.enabled ?? true;
+    const systemMode = config?.systemMode ?? 'env';
+    if (systemMode !== 'env' && systemMode !== 'off') {
+        throw new Error('dsh-llm-proxy: config.systemMode must be "env" or "off"');
+    }
+    const entries = (config?.llmProxy ?? []).map((entry, index) => {
+        if (typeof entry?.match !== 'string' || !entry.match.trim()) {
+            throw new Error(`dsh-llm-proxy: config.llmProxy[${index}].match must be a non-empty string`);
+        }
+        if (typeof entry?.proxy !== 'string' || !entry.proxy.trim()) {
+            throw new Error(`dsh-llm-proxy: config.llmProxy[${index}].proxy must be a non-empty string`);
+        }
+        validateProxyUrl(entry.proxy, index);
+        return { match: entry.match.trim(), proxy: entry.proxy.trim() };
+    });
+    return Object.freeze({ enabled, systemMode, llmProxy: Object.freeze(entries) });
+}
+const GLOBALS_KEY = Symbol.for('dsh-llm-proxy.global-state');
+function globalsState() {
+    const host = globalThis;
+    return (host[GLOBALS_KEY] ??= {
+        originalDispatcher: undefined,
+        originalFetch: undefined,
+        layers: [],
+    });
+}
+/**
+ * Put `router` — and, when fetch is still pristine or still ours, npm
+ * undici's fetch — on top of the process globals, recording the layer so
+ * dispose can unwind exactly one level even under interleaved reloads.
+ */
+function takeoverGlobals(router) {
+    const state = globalsState();
+    state.originalDispatcher ??= undici.getGlobalDispatcher();
+    state.originalFetch ??= globalThis.fetch;
+    // Take over fetch only when it is still pristine or still owned by the top
+    // layer; a deliberate override by someone else must survive untouched.
+    const under = state.layers[state.layers.length - 1];
+    let fetch;
+    if (globalThis.fetch === (under?.fetch ?? state.originalFetch)) {
+        undici.install?.();
+        fetch = globalThis.fetch;
+    }
+    const layer = { router, fetch };
+    state.layers.push(layer);
+    undici.setGlobalDispatcher(router);
+    return {
+        restore() {
+            const index = state.layers.lastIndexOf(layer);
+            if (index !== -1)
+                state.layers.splice(index, 1);
+            // Restore only what this instance still owns: after an interleaved
+            // reload a newer router may sit on top, and clobbering it would break
+            // that one. Unwind hands control to the nearest live layer below, or
+            // back to the pristine values once no layer remains.
+            if (undici.getGlobalDispatcher() === router) {
+                const above = state.layers[state.layers.length - 1];
+                undici.setGlobalDispatcher(above?.router ?? state.originalDispatcher);
+            }
+            if (fetch !== undefined && globalThis.fetch === fetch) {
+                const above = [...state.layers].reverse().find((candidate) => candidate.fetch !== undefined);
+                globalThis.fetch = above?.fetch ?? state.originalFetch;
+            }
+        },
+    };
+}
+// --- Bundled skill -----------------------------------------------------------
+/** Provider name under `ctx.skills`; doubles as the skill name. */
+const SKILL_PROVIDER_NAME = 'dsh-llm-proxy';
+/** Packaged skill body; `../skills/` resolves to the package root from both lib/ and src/. */
+const SKILL_BODY_URL = new URL('../skills/dsh-llm-proxy/SKILL.md', import.meta.url);
+/** Resource base served with the skill so its relative links resolve. */
+const SKILL_RESOURCE_BASE = {
+    kind: 'directory',
+    path: fileURLToPath(new URL('../skills/dsh-llm-proxy/', import.meta.url)),
+};
+const SKILL_INVOCATION = { modelInvocable: true, userInvocable: true };
+/** Routing description; must stay identical to the SKILL.md frontmatter (asserted in tests). */
+const SKILL_DESCRIPTION = 'dsh 出站代理 / LLM 分流插件（@aiwayds/dsh-llm-proxy）使用指南。凡给 dsh 插件配置 HTTP 代理、LLM 出站分流，或排查代理网络问题时先读本指南：settings.yaml 顶层 `dsh-llm-proxy:` 段（enabled/systemMode/llmProxy）、llmProxy match 规则、代理 407、CONNECT 挂起、socks5 报错（SOCKS 不支持）、NODE_USE_ENV_PROXY 等价替代。触发词：dsh 代理、HTTP 代理、LLM 分流、llmProxy、llm-proxy、407、CONNECT 挂起、SOCKS、HTTPS_PROXY、NO_PROXY、出站代理、NODE_USE_ENV_PROXY。';
+const SKILL_CANDIDATE = {
+    name: SKILL_PROVIDER_NAME,
+    description: SKILL_DESCRIPTION,
+    invocation: SKILL_INVOCATION,
+    provider: SKILL_PROVIDER_NAME,
+    source: 'bundled',
+    resourceBase: SKILL_RESOURCE_BASE,
+    rank: BUNDLED_SKILL_RANK,
+    locator: SKILL_BODY_URL,
+};
+const skillProvider = {
+    name: SKILL_PROVIDER_NAME,
+    list: () => Promise.resolve([SKILL_CANDIDATE]),
+    async get(_candidate) {
+        return {
+            name: SKILL_CANDIDATE.name,
+            description: SKILL_CANDIDATE.description,
+            invocation: SKILL_CANDIDATE.invocation,
+            provider: SKILL_CANDIDATE.provider,
+            source: SKILL_CANDIDATE.source,
+            resourceBase: SKILL_RESOURCE_BASE,
+            content: stripFrontmatter(await readFile(SKILL_BODY_URL, 'utf8')),
+        };
+    },
+};
+/**
+ * Strip a leading YAML frontmatter block (`---` / body / `---`) from a skill
+ * markdown file. `SkillDefinition.content` must be the instruction body after
+ * metadata removal — the same shape the filesystem provider serves — so the
+ * bundled SKILL.md, which keeps its frontmatter for the GitHub/manual install
+ * paths, has the block removed when served through {@link skillProvider.get}.
+ * Tolerant by design: input that does not open with a `---` line, or whose
+ * frontmatter block is never closed, is returned unchanged. Mirrors the
+ * delimiter semantics of the upstream skill-filesystem provider.
+ */
+export function stripFrontmatter(raw) {
+    const firstLineEnd = raw.indexOf('\n');
+    if (firstLineEnd < 0 || raw.slice(0, firstLineEnd).replace(/\r$/, '') !== '---')
+        return raw;
+    let lineStart = firstLineEnd + 1;
+    while (lineStart <= raw.length) {
+        const nextNewline = raw.indexOf('\n', lineStart);
+        const lineEnd = nextNewline < 0 ? raw.length : nextNewline;
+        if (raw.slice(lineStart, lineEnd).replace(/\r$/, '') === '---') {
+            return raw.slice(nextNewline < 0 ? raw.length : nextNewline + 1).trim();
+        }
+        if (nextNewline < 0)
+            return raw;
+        lineStart = nextNewline + 1;
+    }
+    return raw;
+}
+/**
+ * Install the global routing dispatcher, wire the `dsh-llm-proxy` settings
+ * namespace, register the bundled skill provider, and register teardown.
+ * @param ctx - plugin context owning the dispose effect.
+ * @param config - composition entry config; the base layer under the
+ *   settings.yaml `dsh-llm-proxy` section.
+ * @param internals - injectable dispatcher factories for tests.
+ */
+export function apply(ctx, config = {}, internals = {}) {
+    // `inject = ['skills']` guarantees the service exists on every real host;
+    // register unconditionally so a missing service fails loud instead of
+    // silently dropping the bundled skill.
+    ctx.skills.registerProvider(() => skillProvider);
+    // Current authoritative config source: the entry until a settings scope
+    // layers the user's settings.yaml section on top (and back to the entry if
+    // the settings provider detaches). The seam hands over a thunk so every
+    // rejudge reads the live layered value instead of a stale snapshot.
+    let getSource = () => config;
+    let active;
+    let activePolicy;
+    let effectRegistered = false;
+    function installLayer(policy) {
+        const systemDispatcher = internals.createSystemDispatcher?.(policy.systemMode)
+            ?? withUndiciErrorListener(policy.systemMode === 'env' ? new undici.EnvHttpProxyAgent() : new undici.Agent());
+        const router = createProxyRouterDispatcher(policy.llmProxy, {
+            systemDispatcher,
+            proxyFactory: internals.createProxyDispatcher
+                ?? ((proxyUrl) => withUndiciErrorListener(new undici.ProxyAgent(proxyUrl))),
+        });
+        return { router, globals: takeoverGlobals(router) };
+    }
+    function teardownLayer(layer) {
+        layer.globals.restore();
+        // Non-blocking teardown: close() waits for in-flight requests to drain,
+        // which would stall hot reloads behind long LLM streams. The globals are
+        // already handed back above, so no new request reaches this router; let
+        // it finish draining and closing in the background instead of awaiting.
+        void layer.router.close().catch(() => { });
+    }
+    const ensureDisposeEffect = () => {
+        if (effectRegistered)
+            return;
+        effectRegistered = true;
+        ctx.effect(() => async () => {
+            const current = active;
+            active = undefined;
+            if (current)
+                teardownLayer(current);
+        }, 'dsh-llm-proxy: restore global dispatcher/fetch and close proxies');
+    };
+    const rejudge = (failFast) => {
+        let policy;
+        try {
+            policy = resolveConfig(getSource());
+        }
+        catch (error) {
+            if (failFast)
+                throw error;
+            ctx.logger?.error('dsh-llm-proxy: ignoring invalid settings update, keeping current routing: %s', error instanceof Error ? error.message : String(error));
+            return;
+        }
+        // Attaching the settings scope fires onChange unconditionally, even when
+        // the layered section resolves to the same values as the entry base
+        // layer; rebuilding then would tear down and reinstall an identical
+        // router for nothing. Skip when no resolved value changed.
+        if (activePolicy !== undefined && deepEqualJson(policy, activePolicy))
+            return;
+        if (!policy.enabled) {
+            const current = active;
+            active = undefined;
+            activePolicy = policy;
+            if (current)
+                teardownLayer(current);
+            return;
+        }
+        let next;
+        try {
+            next = installLayer(policy);
+        }
+        catch (error) {
+            if (failFast)
+                throw error;
+            ctx.logger?.error('dsh-llm-proxy: failed to rebuild routing, keeping current routing: %o', error);
+            return;
+        }
+        const previous = active;
+        active = next;
+        activePolicy = policy;
+        ensureDisposeEffect();
+        if (previous)
+            teardownLayer(previous);
+    };
+    // Start immediately with the entry config so the plugin works even on hosts
+    // that never mount a settings service; when the service appears, the
+    // layered section takes over and subsequent edits hot-publish here.
+    rejudge(true);
+    installSettingsSection(ctx, SETTINGS_NAMESPACE, Config, config, {
+        setSource: (current) => {
+            getSource = current;
+        },
+        onChange: () => rejudge(false),
+    });
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AACpG,OAAO,EACL,kBAAkB,GAInB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAsB,MAAM,aAAa,CAAA;AAEtG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAA0C,MAAM,aAAa,CAAA;AAE/G,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,sDAAsD;AACtD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;AAEhC;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAA;AAgB7D,yCAAyC;AACzC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACpE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC,CAAC;CACJ,CAAyB,CAAA;AAE1B,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IAC3D,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,gCAAgC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,kCAAkC,KAAK,uCAAuC;cAC5E,uCAAuC,MAAM,CAAC,QAAQ,6BAA6B,CACtF,CAAA;IACH,CAAC;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,GAAG,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAA;IACvC,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,KAAK,CAAA;IAC9C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAiB,EAAE;QAC3E,IAAI,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,oCAAoC,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,oCAAoC,CAAC,CAAA;QAC9F,CAAC;QACD,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAA;IACjE,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AACjF,CAAC;AAsBD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;AAE5D,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,UAAqC,CAAA;IAClD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK;QAC5B,kBAAkB,EAAE,SAAS;QAC7B,aAAa,EAAE,SAAS;QACxB,MAAM,EAAE,EAAE;KACX,CAAiB,CAAA;AACpB,CAAC;AAOD;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAyB;IAChD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAA;IAC5B,KAAK,CAAC,kBAAkB,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAA;IACzD,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,KAAK,CAAA;IAExC,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACnD,IAAI,KAA4C,CAAA;IAChD,IAAI,UAAU,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,OAAO,EAAE,EAAE,CAAA;QAClB,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC/B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxB,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAElC,OAAO;QACL,OAAO;YACL,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAC7C,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC/C,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,qDAAqD;YACrD,IAAI,MAAM,CAAC,mBAAmB,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACnD,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,kBAAmB,CAAC,CAAA;YACxE,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACtD,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;gBAC5F,UAAU,CAAC,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,aAAc,CAAA;YACzD,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAmBD,gFAAgF;AAEhF,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAE3C,8FAA8F;AAC9F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEnF,yEAAyE;AACzE,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;CACjE,CAAA;AAEV,MAAM,gBAAgB,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW,CAAA;AAE/E,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,gWAAgW,CAAA;AAE1X,MAAM,eAAe,GAAmB;IACtC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,gBAAgB;IAC5B,QAAQ,EAAE,mBAAmB;IAC7B,MAAM,EAAE,SAAS;IACjB,YAAY,EAAE,mBAAmB;IACjC,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,cAAc;CACxB,CAAA;AAED,MAAM,aAAa,GAAkB;IACnC,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;IAC9C,KAAK,CAAC,GAAG,CAAC,UAAU;QAClB,OAAO;YACL,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,YAAY,EAAE,mBAAmB;YACjC,OAAO,EAAE,gBAAgB,CAAC,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;SAClE,CAAA;IACH,CAAC;CACF,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK;QAAE,OAAO,GAAG,CAAA;IAC3F,IAAI,SAAS,GAAG,YAAY,GAAG,CAAC,CAAA;IAChC,OAAO,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAA;QAC1D,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/D,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzE,CAAC;QACD,IAAI,WAAW,GAAG,CAAC;YAAE,OAAO,GAAG,CAAA;QAC/B,SAAS,GAAG,WAAW,GAAG,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAiB,EAAE,EAAE,YAA4B,EAAE;IACrF,0EAA0E;IAC1E,sEAAsE;IACtE,uCAAuC;IACvC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAA;IAChD,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,SAAS,GAAiB,GAAG,EAAE,CAAC,MAAM,CAAA;IAC1C,IAAI,MAA+B,CAAA;IACnC,IAAI,YAAwC,CAAA;IAC5C,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,SAAS,YAAY,CAAC,MAAsB;QAC1C,MAAM,gBAAgB,GACpB,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;eAClD,uBAAuB,CACxB,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAClF,CAAA;QACH,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC1D,gBAAgB;YAChB,YAAY,EAAE,SAAS,CAAC,qBAAqB;mBACxC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC9E,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAA;IACrD,CAAC;IAED,SAAS,aAAa,CAAC,KAAkB;QACvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,mBAAmB,GAAG,GAAS,EAAE;QACrC,IAAI,gBAAgB;YAAE,OAAM;QAC5B,gBAAgB,GAAG,IAAI,CAAA;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,OAAO,GAAG,MAAM,CAAA;YACtB,MAAM,GAAG,SAAS,CAAA;YAClB,IAAI,OAAO;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC,EAAE,kEAAkE,CAAC,CAAA;IACxE,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,QAAiB,EAAQ,EAAE;QAC1C,IAAI,MAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ;gBAAE,MAAM,KAAK,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,KAAK,CACf,8EAA8E,EAC9E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAA;YACD,OAAM;QACR,CAAC;QACD,yEAAyE;QACzE,oEAAoE;QACpE,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;YAAE,OAAM;QAC7E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,CAAA;YACtB,MAAM,GAAG,SAAS,CAAA;YAClB,YAAY,GAAG,MAAM,CAAA;YACrB,IAAI,OAAO;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QACD,IAAI,IAAiB,CAAA;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ;gBAAE,MAAM,KAAK,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,KAAK,CACf,uEAAuE,EACvE,KAAK,CACN,CAAA;YACD,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAA;QACvB,MAAM,GAAG,IAAI,CAAA;QACb,YAAY,GAAG,MAAM,CAAA;QACrB,mBAAmB,EAAE,CAAA;QACrB,IAAI,QAAQ;YAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC,CAAA;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,oEAAoE;IACpE,OAAO,CAAC,IAAI,CAAC,CAAA;IACb,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YACrB,SAAS,GAAG,OAAO,CAAA;QACrB,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KAC/B,CAAC,CAAA;AACJ,CAAC"}

package/lib/match.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Origin matcher for the LLM proxy routing list.
+ *
+ * A match pattern is one of:
+ * - a full origin ("https://api.deepseek.org") — case-insensitive exact match
+ *   against the request origin;
+ * - a host authority ("api.deepseek.org", "api.deepseek.org:8443") — matches
+ *   the host exactly, or with a leading `*.` wildcard also any subdomain and
+ *   the bare domain itself ("*.volces.com" matches "volces.com" and
+ *   "a.volces.com"). An explicit port in the pattern must equal the request
+ *   origin's port (scheme defaults count: https=443, http=80).
+ *
+ * All comparisons are lowercase; matching is purely lexical — no DNS, no I/O.
+ * Hostnames are normalized the way WHATWG URL parsing normalizes request
+ * origins: lowercase ASCII with IDN labels converted to punycode, so a
+ * pattern and an origin written in either the unicode or the xn-- form of
+ * the same domain compare equal.
+ */
+/**
+ * Whether a request origin hits a routing-list match pattern.
+ * @param match - pattern from the llmProxy list entry.
+ * @param origin - request origin, e.g. "https://api.example.com" or
+ *   "https://api.example.com:8443"; a bare host[:port] is tolerated.
+ */
+export declare function matchOrigin(match: string, origin: string): boolean;