@karoc/dsh-proxy 0.1.4 → 0.1.18

package/lib/client.js

@@ -7,6 +7,28 @@ window.__ModuleLoader__.load({
 		let react = require("react");
 		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
 		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/host-match.ts
+		/**
+		* Normalize a host so ONE comparison covers every spelling it arrives in.
+		* @param host - hostname, possibly bracketed (`[::1]`) or IPv4-mapped.
+		* @returns the comparable form (brackets stripped, IPv4-mapped collapsed).
+		*/
+		function normalizeHostForMatch(host) {
+			const bare = String(host ?? "").trim().toLowerCase().replace(/^\[|\]$/g, "");
+			const dotted = bare.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+			if (dotted !== null) return dotted[1];
+			const mapped = bare.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+			if (mapped === null) return bare;
+			const hi = Number.parseInt(mapped[1], 16);
+			const lo = Number.parseInt(mapped[2], 16);
+			return [
+				hi >> 8,
+				hi & 255,
+				lo >> 8,
+				lo & 255
+			].join(".");
+		}
+		//#endregion
 		//#region src/client/ProxySection.tsx
 		/**
 		* The "Smoothly Proxy" settings section (external plugin).
@@ -16,11 +38,11 @@ window.__ModuleLoader__.load({
 		* host) through an optional upstream proxy, per host. The host half runs the
 		* proxy and serves /proxy/api; this page reads and writes it with plain
 		* same-origin fetch (no settingsScope — the proxy config lives in
-		* <DSH_HOME>/proxy.json, not in dsh settings.yaml).
+		* <DSH_HOME>/proxy.json, not in the dsh settings document).
 		*
 		* UI mirrors the dsh-desktop settings window: upstream card (enabled /
 		* protocol selector / host / port / username / password / test connection),
-		* a "model providers" list derived from dsh settings.yaml, and an "other
+		* a "model providers" list derived from the LIVE settings document, and an "other
 		* observed hosts" list, each with a per-host checkbox. A search box filters
 		* both lists. Saving writes the config; the running proxy re-reads proxy.json
 		* on every request, so changes take effect immediately.
@@ -28,15 +50,15 @@ window.__ModuleLoader__.load({
 		const PROTOCOLS = [
 			{
 				id: "http",
-				label: "HTTP"
+				labelKey: "protocolHttp"
 			},
 			{
 				id: "https",
-				label: "HTTPS"
+				labelKey: "protocolHttps"
 			},
 			{
 				id: "socks5",
-				label: "SOCKS5"
+				labelKey: "protocolSocks5"
 			}
 		];
 		/** Fetch helper bound to the same-origin /proxy/api endpoint. */
@@ -58,7 +80,7 @@ window.__ModuleLoader__.load({
 				},
 				items: PROTOCOLS.map((o) => ({
 					id: o.id,
-					label: o.label
+					label: t(o.labelKey)
 				})),
 				selectedId: value,
 				onSelect: (id) => {
@@ -76,13 +98,36 @@ window.__ModuleLoader__.load({
 					onClick: () => {
 						setOpen((v) => !v);
 					},
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: matched?.label ?? t("protocolHttp") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutlineRegular, {})]
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t(matched?.labelKey ?? "protocolHttp") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutlineRegular, {})]
 				})
 			});
 		}
+		/** The routing rule: which way the checkboxes read. */
+		function RouteModeSelector(props) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dsh-proxy-segmented",
+				role: "group",
+				"aria-label": props.t("modeLabel"),
+				children: [{
+					id: "only-listed",
+					labelKey: "modeOnlyListed"
+				}, {
+					id: "except-listed",
+					labelKey: "modeExceptListed"
+				}].map((o) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+					type: "button",
+					className: o.id === props.value ? "is-active" : "",
+					"aria-pressed": o.id === props.value,
+					onClick: () => {
+						props.onChange(o.id);
+					},
+					children: props.t(o.labelKey)
+				}, o.id))
+			});
+		}
 		/** One host checkbox row (label + route status). */
 		function HostRow(props) {
-			const { host, label, checked, proxied, onToggle } = props;
+			const { host, label, checked, routed, onToggle, t } = props;
 			const labelRef = (0, react.useRef)(null);
 			const [overflowing, setOverflowing] = (0, react.useState)(false);
 			(0, react.useLayoutEffect)(() => {
@@ -126,7 +171,7 @@ window.__ModuleLoader__.load({
 					}) : labelNode,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 						className: "dsh-proxy-host-route",
-						children: proxied ? "via upstream" : "direct"
+						children: routed ? t("viaUpstream") : t("direct")
 					})
 				]
 			});
@@ -146,6 +191,7 @@ window.__ModuleLoader__.load({
 			const { t } = props;
 			const [view, setView] = (0, react.useState)(void 0);
 			const [error, setError] = (0, react.useState)(void 0);
+			const [loadError, setLoadError] = (0, react.useState)(void 0);
 			const [saved, setSaved] = (0, react.useState)(false);
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [testing, setTesting] = (0, react.useState)(false);
@@ -157,6 +203,10 @@ window.__ModuleLoader__.load({
 			const [port, setPort] = (0, react.useState)("");
 			const [username, setUsername] = (0, react.useState)("");
 			const [password, setPassword] = (0, react.useState)("");
+			const [listenPort, setListenPort] = (0, react.useState)("");
+			const [routeMode, setRouteMode] = (0, react.useState)("only-listed");
+			const [advancedOpen, setAdvancedOpen] = (0, react.useState)(void 0);
+			const [adoptedPort, setAdoptedPort] = (0, react.useState)(false);
 			const [proxied, setProxied] = (0, react.useState)(/* @__PURE__ */ new Set());
 			/** Load the config view from /proxy/api. */
 			const load = (0, react.useCallback)(async () => {
@@ -164,15 +214,19 @@ window.__ModuleLoader__.load({
 					const data = await proxyApi();
 					setView(data);
 					setError(void 0);
+					setLoadError(void 0);
 					setEnabled(data.upstream.enabled);
 					setProtocol(data.upstream.protocol);
 					setHost(data.upstream.host);
 					setPort(data.upstream.port > 0 ? String(data.upstream.port) : "");
 					setUsername(data.upstream.username);
 					setPassword(data.upstream.password);
+					setListenPort(data.listenPort > 0 ? String(data.listenPort) : "");
+					setAdoptedPort(data.listenPort === 0 && data.portRequested > 0);
+					setRouteMode(data.routeMode ?? "only-listed");
 					setProxied(new Set(data.proxiedHosts));
 				} catch (err) {
-					setError(err instanceof Error ? err.message : String(err));
+					setLoadError(err instanceof Error ? err.message : String(err));
 				}
 			}, []);
 			(0, react.useEffect)(() => {
@@ -231,7 +285,9 @@ window.__ModuleLoader__.load({
 								username: username.trim(),
 								password
 							},
-							proxiedHosts: [...proxied]
+							proxiedHosts: [...proxied],
+							routeMode,
+							listenPort: Number(listenPort) || 0
 						})
 					})).ok !== true) throw new Error("save rejected");
 					setSaved(true);
@@ -242,6 +298,19 @@ window.__ModuleLoader__.load({
 					setSaving(false);
 				}
 			};
+			/** Drop the observed-host list (live set + proxy.json) and refresh the view. */
+			const clearObserved = async () => {
+				try {
+					await proxyApi({
+						method: "POST",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ op: "forget" })
+					});
+					await load();
+				} catch (err) {
+					setError(err instanceof Error ? err.message : String(err));
+				}
+			};
 			const test = async () => {
 				setTesting(true);
 				setTestResult(void 0);
@@ -274,8 +343,17 @@ window.__ModuleLoader__.load({
 					setTesting(false);
 				}
 			};
+			const selfLoop = view !== void 0 && view.upstream.enabled && /^(127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|::1)$/i.test(view.upstream.host.trim()) && view.upstream.port === view.port;
+			const upstreamUsable = view?.upstream.enabled === true && !selfLoop;
+			const routedHosts = new Set([...proxied].map((h) => normalizeHostForMatch(h)));
+			const isRouted = (host) => upstreamUsable && (routeMode === "except-listed" ? !routedHosts.has(normalizeHostForMatch(host)) : routedHosts.has(normalizeHostForMatch(host)));
 			const providerFiltered = providerHosts.filter((e) => match(e.label));
 			const otherFiltered = otherHosts.filter((e) => match(e.label));
+			const launchPort = (view?.listenPort ?? 0) > 0 ? view.listenPort : view?.port ?? 0;
+			const upstreamIsLoopback = /^(127\.\d{1,3}\.\d{1,3}\.\d{1,3}|localhost|::1)$/i.test((view?.upstream.host ?? "").trim());
+			const portConflictsUpstream = view !== void 0 && view.listenPort > 0 && upstreamIsLoopback && view.upstream.port === view.listenPort;
+			const diagnosticsNeedAttention = view !== void 0 && (portConflictsUpstream || view.egressStatus === void 0 || view.egressStatus !== "self-installed" || !view.portHonored && view.portRequested > 0 || view.listenPort > 0 && view.listenPort !== view.portRequested);
+			const diagnosticsOpen = advancedOpen ?? diagnosticsNeedAttention;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "dsh-proxy-section",
 				children: [
@@ -366,8 +444,95 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dsh-proxy-group",
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", { children: t("proxiedHostsTitle") }),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("proxiedHostsHint") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", { children: t("egressTitle") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("egressHint") }),
+							view === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsh-proxy-egress",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: `dsh-proxy-note ${view.egressStatus === void 0 ? "" : view.inProcessRouted ? "dsh-proxy-note-ok" : "dsh-proxy-note-warn"}`,
+										children: view.egressStatus === void 0 ? t("egressUnknown") : (view.inProcessRouted ? view.egressStatus === "launcher" ? t("egressRoutedLauncher") : t("egressRoutedSelf") : view.egressStatus === "launcher" ? t("egressLauncherOther") : t("egressUnavailable")).replace("{port}", String(view.port ?? "")).replace("{proxy}", String(view.launchProxy ?? "")).replace("{detail}", String(view.egressDetail ?? ""))
+									}),
+									!view.portHonored && view.portRequested > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dsh-proxy-note dsh-proxy-note-warn",
+										children: t("portFallback").replace("{requested}", String(view.portRequested)).replace("{bound}", String(view.port ?? "?"))
+									}),
+									portConflictsUpstream && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dsh-proxy-note dsh-proxy-note-warn",
+										children: t("portConflictsUpstream").replace(/\{port\}/g, String(view?.listenPort ?? ""))
+									}),
+									view.listenPort > 0 && view.listenPort !== view.portRequested && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dsh-proxy-note dsh-proxy-note-warn",
+										children: t("portRestartPending").replace("{listenPort}", String(view.listenPort)).replace("{port}", String(view.port ?? "?"))
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+										type: "button",
+										className: "dsh-proxy-disclosure",
+										"aria-expanded": diagnosticsOpen,
+										onClick: () => {
+											setAdvancedOpen(!diagnosticsOpen);
+										},
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutlineRegular, {}), t("advancedToggle")]
+									}),
+									diagnosticsOpen && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "dsh-proxy-diag",
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+												className: "dsh-proxy-note",
+												children: (adoptedPort ? t("listenAddressAdopted") : t("listenAddress")).replace("{port}", String(view.port ?? "?"))
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagHint") }),
+											view.egressStatus === "unavailable" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("egressSnippetLabel") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+												className: "dsh-proxy-snippet",
+												children: `Environment="HTTP_PROXY=http://127.0.0.1:${launchPort}" "HTTPS_PROXY=http://127.0.0.1:${launchPort}" "ALL_PROXY=http://127.0.0.1:${launchPort}" "NO_PROXY=127.0.0.1,localhost,::1" "NODE_USE_ENV_PROXY=1"`
+											})] }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+												className: "dsh-proxy-row",
+												children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsh-proxy-proto",
+													children: t("listenPortLabel")
+												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+													className: "dsh-proxy-port",
+													placeholder: t("listenPortPlaceholder"),
+													value: listenPort,
+													onChange: (e) => {
+														setListenPort(e.target.value);
+														setSaved(false);
+													},
+													autoComplete: "off",
+													spellCheck: false
+												})]
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("listenPortHint") })
+										]
+									})
+								]
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsh-proxy-group",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsh-proxy-row",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dsh-proxy-proto",
+									children: t("modeLabel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(RouteModeSelector, {
+									value: routeMode,
+									onChange: (v) => {
+										setRouteMode(v);
+										setSaved(false);
+									},
+									t
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", { children: routeMode === "except-listed" ? t("directHostsTitle") : t("proxiedHostsTitle") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: routeMode === "except-listed" ? t("directHostsHint") : t("proxiedHostsHint") }),
+							selfLoop && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "dsh-proxy-note dsh-proxy-note-warn",
+								children: t("selfLoopWarning")
+							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
 								className: "dsh-proxy-search",
 								icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconGlobeOutlineRegular, {}),
@@ -394,17 +559,29 @@ window.__ModuleLoader__.load({
 								}) : providerFiltered.map((e) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostRow, {
 									host: e.host,
 									label: e.label,
-									checked: proxied.has(e.host),
-									proxied: proxied.has(e.host),
-									onToggle: toggleHost
+									checked: routedHosts.has(normalizeHostForMatch(e.host)),
+									routed: isRouted(e.host),
+									onToggle: toggleHost,
+									t
 								}, e.host))
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "dsh-proxy-heading",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", { children: t("othersHeading") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									className: "dsh-proxy-count",
-									children: otherHosts.length
-								})]
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", { children: t("othersHeading") }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsh-proxy-count",
+										children: otherHosts.length
+									}),
+									otherHosts.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsh-proxy-disclosure",
+										onClick: () => {
+											clearObserved();
+										},
+										children: t("othersClear")
+									})
+								]
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "dsh-proxy-hostlist",
@@ -414,9 +591,10 @@ window.__ModuleLoader__.load({
 								}) : otherFiltered.map((e) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostRow, {
 									host: e.host,
 									label: e.label,
-									checked: proxied.has(e.host),
-									proxied: proxied.has(e.host),
-									onToggle: toggleHost
+									checked: routedHosts.has(normalizeHostForMatch(e.host)),
+									routed: isRouted(e.host),
+									onToggle: toggleHost,
+									t
 								}, e.host))
 							})
 						]
@@ -461,6 +639,10 @@ window.__ModuleLoader__.load({
 									" ",
 									error
 								]
+							}),
+							loadError !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "dsh-proxy-status dsh-proxy-status-err",
+								children: /unauthorized|forbidden|40[13]/.test(loadError) ? t("sessionExpired") : `${t("loadFailed")} ${loadError}`
 							})
 						]
 					})
@@ -506,6 +688,20 @@ window.__ModuleLoader__.load({
 .dsh-proxy-status { font-size: 12px; color: var(--dsw-alias-label-tertiary); }
 .dsh-proxy-status-ok { color: var(--dsw-alias-state-success-primary, var(--dsw-alias-label-primary)); }
 .dsh-proxy-status-err { color: var(--dsw-alias-state-error-primary); }
+.dsh-proxy-egress { display: flex; flex-direction: column; gap: 8px; }
+.dsh-proxy-note { padding: 8px 10px; border-radius: 10px; font-size: 12px; line-height: 1.5; border: 1px solid var(--dsw-alias-border-l3); background: var(--dsw-alias-bg-layer-1); color: var(--dsw-alias-label-secondary); }
+.dsh-proxy-note-ok { border-color: var(--dsw-alias-state-success-primary, var(--dsw-alias-border-l3)); color: var(--dsw-alias-state-success-primary, var(--dsw-alias-label-primary)); }
+.dsh-proxy-note-warn { border-color: var(--dsw-alias-state-warning-primary, var(--dsw-alias-border-l3)); color: var(--dsw-alias-label-primary); }
+.dsh-proxy-snippet { padding: 8px 10px; border-radius: 10px; background: var(--dsw-alias-bg-module-platform); color: var(--dsw-alias-label-primary); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 11px; line-height: 1.6; word-break: break-all; user-select: all; }
+.dsh-proxy-port { width: 180px; }
+.dsh-proxy-segmented { display: inline-flex; gap: 2px; padding: 2px; border-radius: 999px; background: var(--dsw-alias-bg-module-platform); }
+.dsh-proxy-segmented button { padding: 4px 12px; border: none; border-radius: 999px; background: transparent; color: var(--dsw-alias-label-secondary); font-size: 12px; cursor: pointer; }
+.dsh-proxy-segmented button:hover { color: var(--dsw-alias-label-primary); }
+.dsh-proxy-segmented button.is-active { background: var(--dsw-alias-button-primary-fill); color: var(--dsw-alias-label-on-primary, #fff); }
+.dsh-proxy-disclosure { display: inline-flex; align-items: center; gap: 6px; align-self: flex-start; padding: 4px 8px; border: none; border-radius: 8px; background: transparent; color: var(--dsw-alias-label-secondary); font-size: 12px; cursor: pointer; }
+.dsh-proxy-disclosure:hover { background: var(--dsw-alias-interactive-bg-hover); }
+.dsh-proxy-disclosure[aria-expanded="true"] svg { transform: rotate(180deg); }
+.dsh-proxy-diag { display: flex; flex-direction: column; gap: 8px; padding: 10px; border-radius: 12px; background: var(--dsw-alias-bg-layer-1); border: 1px solid var(--dsw-alias-border-l3); }
 .dsh-proxy-heading { display: flex; align-items: center; gap: 6px; margin: 0 0 8px; }
 .dsh-proxy-heading h4 { margin: 0; font-size: 13px; font-weight: 600; color: var(--dsw-alias-label-primary); }
 .dsh-proxy-heading .dsh-proxy-count { font-size: 11px; color: var(--dsw-alias-label-tertiary); }
@@ -529,84 +725,127 @@ window.__ModuleLoader__.load({
 		//#region src/client/locales.ts
 		/**
 		* Copy dictionaries for the Smoothly Proxy settings section
-		* (Smoothly Proxy / 思磨力代理插件). English is the key source (en object
-		* keyed by the same strings), zh must carry every key.
+		* (Smoothly Proxy / 思磨力代理插件). English is the key source (zh must carry
+		* every key), and the copy rule for both is: plain words, short sentences, no
+		* restating what the screen already shows.
 		*/
 		const en = {
 			nav: "Smoothly Proxy",
-			title: "Smoothly Proxy",
-			subtitle: "Model-provider traffic through an optional upstream proxy, per host.",
 			upstreamTitle: "Upstream proxy (optional)",
-			upstreamEnabled: "Enable upstream proxy (when off, every host connects directly)",
+			upstreamEnabled: "Send traffic through the upstream proxy",
 			protocolLabel: "Protocol",
 			protocolHttp: "HTTP",
-			protocolHttps: "HTTPS (TLS to the proxy itself)",
+			protocolHttps: "HTTPS",
 			protocolSocks5: "SOCKS5",
-			protoHint: "Clash / V2Ray style mixed ports (e.g. 7890) usually speak HTTP. SOCKS5 upstreams only forward HTTPS targets (http targets fall back to direct).",
+			protoHint: "Mixed ports (e.g. 7890) are usually HTTP. SOCKS5 carries HTTPS targets only.",
 			hostPlaceholder: "Proxy host, e.g. 127.0.0.1",
 			portPlaceholder: "Port, e.g. 7890",
 			usernamePlaceholder: "Username (optional)",
 			passwordPlaceholder: "Password (optional)",
+			modeLabel: "Routing rule",
+			modeOnlyListed: "Only checked hosts",
+			modeExceptListed: "Everything except checked",
 			proxiedHostsTitle: "Hosts going through the proxy",
-			proxiedHostsHint: "All hosts connect directly unless checked here. Model providers are read from dsh settings (settings.yaml); the rest are hosts observed in traffic (install/update included).",
+			directHostsTitle: "Hosts staying direct",
+			proxiedHostsHint: "Checked hosts go upstream; the rest connect directly.",
+			directHostsHint: "Checked hosts connect directly; everything else goes upstream.",
 			searchPlaceholder: "Search host / provider…",
 			providersHeading: "Model providers",
-			providersEmpty: "No model providers found yet — they appear here once you configure models in dsh settings.",
+			providersEmpty: "No provider endpoints yet (loopback endpoints are never proxyable).",
 			othersHeading: "Other observed hosts",
-			othersEmpty: "None yet — external hosts dsh has contacted will appear here.",
+			othersEmpty: "Hosts dsh contacts show up here.",
+			othersClear: "Clear",
+			loadFailed: "Could not load the proxy settings.",
+			sessionExpired: "This page’s session has expired — refresh the page and try again.",
 			save: "Save",
-			saveStatus: "Saved — takes effect immediately (no restart needed)",
+			saveStatus: "Saved.",
 			saving: "Saving…",
 			saveFailed: "Save failed:",
 			test: "Test connection",
 			testing: "Testing…",
-			testFailed: "Test failed:",
 			testStatusOk: "Connected",
 			testStatusFail: "Connection failed",
-			immediateHint: "Saved changes apply immediately; hosts related to install/update take effect on the next install/update.",
+			immediateHint: "Applies immediately; install/update hosts take effect on the next install or update.",
 			direct: "direct",
 			viaUpstream: "via upstream",
-			selfLoopWarning: "The upstream points back at this proxy — treated as disabled (self-loop guard).",
-			noHost: "No proxy host set",
-			teardown: "Proxy engine stopped"
+			selfLoopWarning: "The upstream points at this plugin itself — ignored.",
+			egressTitle: "dsh's own requests",
+			egressHint: "Model calls and web fetch are routed here automatically. Nothing to configure.",
+			egressRoutedSelf: "Routing through this plugin.",
+			egressRoutedLauncher: "Routing through this plugin (named by the launch environment).",
+			egressLauncherOther: "The launch environment declares a different proxy ({proxy}), so it keeps handling these requests. Remove it, or point it here, to use this plugin instead.",
+			egressUnavailable: "Could not take over automatically ({detail}). Set the line below in the environment dsh starts with, then restart.",
+			egressUnknown: "This host half does not report egress state (page newer than plugin). Restart dsh to match.",
+			egressSnippetLabel: "Launch environment (systemd: the [Service] section)",
+			advancedToggle: "Diagnostics & advanced",
+			listenAddress: "Listening on 127.0.0.1:{port} — port picked automatically.",
+			listenAddressAdopted: "Listening on 127.0.0.1:{port} — taken from the launch environment.",
+			diagHint: "Point other tools here if you want to verify traffic; dsh itself needs no configuration.",
+			listenPortLabel: "Fixed listen port (optional — NOT the upstream address)",
+			listenPortPlaceholder: "e.g. 45999 (0 = auto)",
+			listenPortHint: "Only when a launcher must know this address in advance. The upstream address belongs in the card above.",
+			portFallback: "Port {requested} was taken — using {bound} instead. A launcher pointing at {requested} will not reach this plugin.",
+			portRestartPending: "Port changed to {listenPort}; restart dsh to apply (currently on {port}).",
+			portConflictsUpstream: "{port} is your upstream proxy’s port. That address belongs in the card above: here the plugin cannot bind it, and a launcher pointing at it cannot reach this plugin either."
 		};
 		const zh = {
 			nav: "思磨力代理",
-			title: "思磨力代理插件",
-			subtitle: "按主机把模型提供方流量转发到可选的上游代理。",
 			upstreamTitle: "上游代理（可选）",
-			upstreamEnabled: "启用上游代理（未启用时所有主机直连）",
+			upstreamEnabled: "把流量交给上游代理",
 			protocolLabel: "协议",
 			protocolHttp: "HTTP",
-			protocolHttps: "HTTPS（代理服务器自身加密）",
+			protocolHttps: "HTTPS",
 			protocolSocks5: "SOCKS5",
-			protoHint: "Clash / V2Ray 等常用混合端口（如 7890）一般为 HTTP；SOCKS5 上游仅对 HTTPS 目标生效（http 目标会直连）。",
+			protoHint: "混合端口（如 7890）一般选 HTTP；SOCKS5 只承载 HTTPS 目标。",
 			hostPlaceholder: "代理主机，如 127.0.0.1",
 			portPlaceholder: "端口，如 7890",
 			usernamePlaceholder: "用户名（可选）",
 			passwordPlaceholder: "密码（可选）",
+			modeLabel: "代理规则",
+			modeOnlyListed: "只代理勾选的主机",
+			modeExceptListed: "除勾选外全部走代理",
 			proxiedHostsTitle: "走代理的主机",
-			proxiedHostsHint: "默认全部直连，勾选才走上游代理。模型提供方来自 dsh 设置（settings.yaml）；其它为实际访问过的主机（含安装/更新流量）。",
+			directHostsTitle: "直连的主机",
+			proxiedHostsHint: "勾选的主机走上游，其余直连。",
+			directHostsHint: "勾选的主机直连，其余全部走上游。",
 			searchPlaceholder: "搜索主机 / 提供方名称…",
 			providersHeading: "模型提供方",
-			providersEmpty: "尚未读取到模型提供方（在 dsh 设置里配置模型后会自动出现）",
+			providersEmpty: "还没有可代理的模型端点（loopback 端点永远不可代理）。",
 			othersHeading: "其它已观测主机",
-			othersEmpty: "暂无（dsh 访问过外部主机后会自动出现，含 registry.npmjs.org 等安装流量）",
+			othersEmpty: "dsh 访问过的其它主机会出现在这里。",
+			othersClear: "清空",
+			loadFailed: "读取代理设置失败。",
+			sessionExpired: "本页面的登录会话已过期——刷新页面后重试。",
 			save: "保存",
-			saveStatus: "✓ 已保存，立即生效（无需重启）",
+			saveStatus: "已保存。",
 			saving: "保存中…",
 			saveFailed: "保存失败：",
 			test: "测试连接",
 			testing: "测试中…",
-			testFailed: "测试失败：",
-			testStatusOk: "✓ 连接成功",
-			testStatusFail: "✗ 连接失败",
-			immediateHint: "保存后立即生效，无需重启；改动「安装/更新」相关主机的代理会在下次安装/更新时生效。",
+			testStatusOk: "连接成功",
+			testStatusFail: "连接失败",
+			immediateHint: "立即生效；安装/更新类主机在下次安装或更新时生效。",
 			direct: "直连",
-			viaUpstream: "走上游代理",
-			selfLoopWarning: "上游指向本代理自身，视为禁用（防自环保护）。",
-			noHost: "未填写代理主机",
-			teardown: "代理引擎已停止"
+			viaUpstream: "走上游",
+			selfLoopWarning: "上游指向本插件自己，已忽略。",
+			egressTitle: "dsh 自己的请求",
+			egressHint: "模型调用与 web fetch 已自动走本插件，无需配置。",
+			egressRoutedSelf: "已由本插件接管。",
+			egressRoutedLauncher: "已由本插件接管（启动环境指名）。",
+			egressLauncherOther: "启动环境声明了别的代理（{proxy}），这些请求继续归它管。想让它们走本插件，删掉那个声明或把它指向本插件。",
+			egressUnavailable: "未能自动接管（{detail}）。把下面这行加进 dsh 的启动环境后重启。",
+			egressUnknown: "宿主半区还没上报出网状态（页面比插件新）。重启 dsh 让版本一致。",
+			egressSnippetLabel: "启动环境（systemd：[Service] 段）",
+			advancedToggle: "诊断与高级设置",
+			listenAddress: "正在监听 127.0.0.1:{port}，端口自动选择。",
+			listenAddressAdopted: "正在监听 127.0.0.1:{port}，取自启动环境。",
+			diagHint: "可以把其它工具指到这个地址验证流量；dsh 本身无需配置。",
+			listenPortLabel: "本插件监听端口（可选，不是上游地址）",
+			listenPortPlaceholder: "如 45999（0 = 自动）",
+			listenPortHint: "只有启动器必须提前知道这个地址时才填；上游地址在上面的卡片里。",
+			portFallback: "端口 {requested} 被占用，已改用 {bound}。启动环境若指向 {requested}，到不了本插件。",
+			portRestartPending: "端口已改为 {listenPort}，重启 dsh 后生效（当前仍在 {port}）。",
+			portConflictsUpstream: "{port} 是你上游代理的端口，那个地址属于上面的卡片：填在这里插件绑不上，启动环境指向它也到不了本插件。"
 		};
 		//#endregion
 		//#region src/client/index.ts