@twinsearth/dsh-2xray 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.2.7 — 2026-10-29
+
+### 新增
+
+- **路由模式**：`global` / `cn-direct`（国内 IP、域名直连）/ `whitelist`（仅白名单走 2Xray）。
+- **黑白名单**：白名单默认 github.com、google.com、youtube.com、x.com、facebook.com；黑名单默认 deepseek.com、api.deepseek.com。黑名单优先，并并入 `noProxy`。
+- **内核安装脚本** `tools/install-xray-core.mjs`：官方 release + `.dgst` SHA2-256 校验 + 解压到数据目录。
+- 侧边栏「实时连接信息」默认展开日志。
+
+### 修复
+
+- macOS 自动发现补充 `~/Library/Application Support/v2rayN`、`/Applications` 等路径。
+- 路由验证 URL 改为保留域 `dsh-2xray-verify.invalid`，不再被 `noProxy: deepseek.com` 绕过（route-instance-mismatch 根因）。
+- 非 Windows 下入站端口 <1024 自动回落到 20808（避免把远端 556 当本地端口导致 EACCES）。
+
+## 0.2.6 — 2026-10-29
+
+### 内置浏览器支持
+
+- 新增 `tools/launch-with-browser-proxy.cmd`：以 `--proxy-server=http://127.0.0.1:20808` 启动 DSH，让内置 Chromium 浏览器也走插件的 xray。
+- 设置页与插件页卡片增加说明：Node 插件无法在运行时修改 Chromium 的 session 代理，必须带启动参数重启；系统代理/TUN 是另一条全机路径。
+- 保留边界：插件仍只接管 DSH 进程内的 undici fetch。
+
 ## 0.2.5 — 2026-10-29
 
 ### 修复

package/README.md

@@ -328,6 +328,36 @@ v0.2.0 提供两个入口，互不替代：
 | 状态一直 `degraded` + `route-install-failed` | 查日志里的模块解析诊断；必要时确认 DSH 安装目录结构 |
 | `xray_switch_node` 报 `unknown service ... RoutingService` | xray 版本早于 2024-09；升级二进制，或关闭 `control.enabled` 只用 `activeNode` |
 
+## 路由模式与黑白名单
+
+- `global`（默认）：全部流量走 2Xray。
+- `cn-direct`：`geoip:cn` / `geosite:cn` 直连，其余走代理。插件会从 xray 二进制旁复制 `geoip.dat`/`geosite.dat` 到数据目录，并设置 `XRAY_LOCATION_ASSET`。
+- `whitelist`：仅白名单域名走 2Xray，其余直连。
+
+黑名单优先于白名单与分流，并会同时加入 DSH 的 `noProxy`（xray 重启时也不受影响）。默认白名单：github.com、google.com、youtube.com、x.com、facebook.com；默认黑名单：deepseek.com、api.deepseek.com。
+
+## 内核安装（macOS / Linux）
+
+npm 包不内嵌五平台内核。未找到内核时：
+
+```bash
+node tools/install-xray-core.mjs 26.9.30
+```
+
+脚本下载官方 release 资产、校验 `.dgst` 的 SHA2-256、解压到 `~/.dsh/xray-proxy/bin/`。GitHub 不可达时设置 `DSH_XRAY_MIRROR` 指向镜像。macOS 也会自动搜索 `~/Library/Application Support/v2rayN/bin/xray/xray`。
+
+## 内置浏览器（Chromium）
+
+DSH 内置浏览器走 Chromium 网络栈，不读 undici dispatcher，插件无法在运行时改它的代理。支持方式只有启动参数：
+
+```powershell
+& "E:\DS\DeepSeek Harness.exe" --proxy-server=http://127.0.0.1:20808
+```
+
+或运行 `tools/launch-with-browser-proxy.cmd`（自动查找 DSH 路径并透传 `--proxy-server`）。
+
+**必须先完全退出 DSH**：单实例再次启动只会聚焦旧窗口，不会应用参数。系统代理/TUN（v2rayN）也能让 Chromium 生效，但那是全机代理，与本插件无关。
+
 ## 开发
 
 ```powershell

package/lib/assets.js

@@ -0,0 +1,42 @@
+import { copyFileSync, existsSync, mkdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+const FILES = ['geoip.dat', 'geosite.dat']
+
+/**
+ * `geoip:cn` / `geosite:cn` need data files next to the binary or in
+ * XRAY_LOCATION_ASSET. A borrowed v2rayN binary keeps them one directory up,
+ * so copy them into the managed data dir and point xray there.
+ */
+export function ensureXrayAssets({ binaryPath, dataDir, logger } = {}) {
+  if (!dataDir) return { dir: undefined, copied: [], missing: FILES }
+  try {
+    mkdirSync(dataDir, { recursive: true })
+  } catch (error) {
+    logger?.warn?.(`无法创建数据目录：${String(error)}`)
+    return { dir: dataDir, copied: [], missing: FILES }
+  }
+  const candidates = [dataDir, dirname(binaryPath ?? ''), dirname(dirname(binaryPath ?? ''))]
+  const copied = []
+  const missing = []
+  for (const name of FILES) {
+    const target = join(dataDir, name)
+    if (existsSync(target)) continue
+    const source = candidates.find((dir) => dir && existsSync(join(dir, name)))
+    if (!source) {
+      missing.push(name)
+      continue
+    }
+    try {
+      copyFileSync(join(source, name), target)
+      copied.push(name)
+    } catch (error) {
+      logger?.warn?.(`复制 ${name} 失败：${String(error)}`)
+      missing.push(name)
+    }
+  }
+  if (missing.length > 0) {
+    logger?.warn?.(`缺少 xray 数据文件 ${missing.join(', ')}；cn-direct / geosite 规则可能启动失败，可从 v2rayN 的 bin/ 目录复制到 ${dataDir}`)
+  }
+  return { dir: dataDir, copied, missing }
+}

package/lib/binary.js

@@ -117,6 +117,12 @@ export function defaultDiscoveryRoots() {
     local,
     home ? join(home, 'Desktop') : '',
     home ? join(home, 'Downloads') : '',
+    // macOS: v2rayN keeps its core under Application Support, not ~/bin.
+    home ? join(home, 'Library', 'Application Support') : '',
+    home ? join(home, '.local', 'bin') : '',
+    '/Applications',
+    '/opt/homebrew/bin',
+    '/usr/local/bin',
     'C:\\Program Files',
     'C:\\Program Files (x86)',
     'D:\\',

package/lib/client.js

@@ -7,6 +7,8 @@ window.__ModuleLoader__.load({
     const PANEL_ID = 'xray'
     const NS = 'xray-proxy'
     const inject = ['slots']
+    const BROWSER_HINT =
+      '内置浏览器走 Chromium 网络栈，不受插件 dispatcher 影响：请用插件目录 tools/launch-with-browser-proxy.cmd 启动 DSH，或在快捷方式目标后追加 --proxy-server=http://127.0.0.1:20808（需完全退出 DSH 后重启才生效）。'
 
     const C = {
       page: { maxWidth: 980, margin: '0 auto', padding: '20px 24px 16px', color: 'var(--dsw-alias-label-primary, #0f1115)' },
@@ -174,7 +176,7 @@ window.__ModuleLoader__.load({
     }
 
     function RuntimeCard({ status, logs, setLogs }) {
-      const [showLogs, setShowLogs] = React.useState(false)
+      const [showLogs, setShowLogs] = React.useState(true)
       const inbound = status?.inbound
       const inboundLabel = inbound
         ? `${String(inbound.protocol).toUpperCase()}:${inbound.port}${inbound.socks ? ` · SOCKS5:${inbound.socks.port}` : ''}`
@@ -311,6 +313,9 @@ window.__ModuleLoader__.load({
       const [port, setPort] = React.useState(String(value.inbound?.port ?? 20808))
       const [enabled, setEnabled] = React.useState(value.enabled === true)
       const [takeover, setTakeover] = React.useState(value.takeover ?? 'auto')
+      const [routingMode, setRoutingMode] = React.useState(value.routing?.mode ?? 'global')
+      const [whitelist, setWhitelist] = React.useState((value.routing?.whitelist ?? []).join('\n'))
+      const [blacklist, setBlacklist] = React.useState((value.routing?.blacklist ?? []).join('\n'))
       const [message, setMessage] = React.useState('')
       const [kind, setKind] = React.useState('')
       const [busy, setBusy] = React.useState(false)
@@ -409,10 +414,18 @@ window.__ModuleLoader__.load({
       const save = async () => {
         setBusy(true)
         try {
+          const splitList = (text) =>
+            String(text)
+              .split(/[\n,]+/)
+              .map((entry) => entry.trim())
+              .filter(Boolean)
           const fields = [
             { path: ['shareLink'], value: shareLink.trim() },
             { path: ['enabled'], value: enabled },
             { path: ['takeover'], value: takeover },
+            { path: ['routing', 'mode'], value: routingMode },
+            { path: ['routing', 'whitelist'], value: splitList(whitelist) },
+            { path: ['routing', 'blacklist'], value: splitList(blacklist) },
           ]
           if (binaryPath.trim()) fields.push({ path: ['binary', 'path'], value: binaryPath.trim() })
           const numericPort = Number(port)
@@ -447,6 +460,29 @@ window.__ModuleLoader__.load({
           h('label', { style: { fontSize: 12.5, display: 'flex', alignItems: 'center', gap: 6, marginTop: 10 } }, 'takeover',
             h('select', { value: takeover, onChange: (event) => setTakeover(event.target.value), style: { padding: '4px 8px', borderRadius: 6, background: 'transparent', color: 'inherit' } },
               h('option', { value: 'auto' }, 'auto'), h('option', { value: 'force' }, 'force'), h('option', { value: 'off' }, 'off')))),
+        h(Field, { label: '路由模式' },
+          h('select', {
+            value: routingMode,
+            onChange: (event) => setRoutingMode(event.target.value),
+            style: { ...C.input, width: 'auto' },
+          },
+            h('option', { value: 'global' }, '全局：全部走 2Xray'),
+            h('option', { value: 'cn-direct' }, '国内直连：国内 IP/域名不走 VPN，国外走'),
+            h('option', { value: 'whitelist' }, '白名单：仅白名单走 2Xray'))),
+        h(Field, { label: '白名单（强制走 2Xray，每行一个域名）' },
+          h('textarea', {
+            style: { ...C.input, minHeight: 58, fontFamily: 'ui-monospace, Consolas, monospace' },
+            value: whitelist,
+            placeholder: 'github.com\ngoogle.com\nyoutube.com\nx.com\nfacebook.com',
+            onChange: (event) => setWhitelist(event.target.value),
+          })),
+        h(Field, { label: '黑名单（强制直连，每行一个域名，优先于白名单）' },
+          h('textarea', {
+            style: { ...C.input, minHeight: 58, fontFamily: 'ui-monospace, Consolas, monospace' },
+            value: blacklist,
+            placeholder: 'deepseek.com\napi.deepseek.com',
+            onChange: (event) => setBlacklist(event.target.value),
+          })),
         h(Field, { label: 'xray 可执行文件路径（留空自动查找）' },
           h('input', { style: { ...C.input, fontFamily: 'ui-monospace, Consolas, monospace' }, value: binaryPath, placeholder: '例如 D:\\v2rayN\\...\\bin\\xray\\xray.exe', onChange: (event) => setBinaryPath(event.target.value) })),
         h(Field, { label: '本地 HTTP 入站端口' },
@@ -463,7 +499,8 @@ window.__ModuleLoader__.load({
       }
       return h('div', { style: { ...C.card, marginTop: 8 } },
         h('div', { style: C.cardHead }, h(GlobeIcon), '2Xray 连接'),
-        h(XrayConfigForm, { pageForm: form }))
+        h(XrayConfigForm, { pageForm: form }),
+        h('p', { style: { ...C.muted, fontSize: 12, marginTop: 10 } }, BROWSER_HINT))
     }
 
     function SettingsSection({ controller }) {
@@ -473,7 +510,8 @@ window.__ModuleLoader__.load({
           h('div', null,
             h('h1', { style: C.title }, '2Xray'),
             h('p', { style: C.sub }, '导入 VLESS 链接或本地二维码，保存后重启 DSH 生效。'))),
-        h('section', { style: C.card }, h(XrayConfigForm, { controller })))
+        h('section', { style: C.card }, h(XrayConfigForm, { controller })),
+        h('p', { style: { ...C.muted, fontSize: 12, marginTop: 4 } }, BROWSER_HINT))
     }
 
     function apply(ctx) {

package/lib/config.js

@@ -51,6 +51,9 @@ export const DEFAULT_CONFIG = {
   takeover: 'auto',
   noProxy: '',
   routing: {
+    mode: 'global',
+    whitelist: ['github.com', 'google.com', 'youtube.com', 'x.com', 'facebook.com'],
+    blacklist: ['deepseek.com', 'api.deepseek.com'],
     bypassDomains: ['localhost', 'local', 'lan', 'internal', 'corp', 'home.arpa'],
     blockAds: false,
     geositeCn: false,
@@ -139,6 +142,20 @@ function asStringList(value, fallback) {
   return clone(fallback)
 }
 
+/** Accept URLs as well as bare domains; routing rules only understand hosts. */
+function normalizeDomainList(entries) {
+  const result = []
+  for (const entry of entries) {
+    let text = String(entry ?? '').trim().toLowerCase()
+    if (!text) continue
+    text = text.replace(/^[a-z][a-z0-9+.-]*:\/\//, '').split('/')[0].split(':')[0]
+    text = text.replace(/^\*\./, '').replace(/\.$/, '')
+    if (!/^[a-z0-9.-]+$/.test(text) || !text.includes('.')) continue
+    if (!result.includes(text)) result.push(text)
+  }
+  return result
+}
+
 export function sanitizeTag(value) {
   return String(value ?? '')
     .trim()
@@ -316,6 +333,22 @@ export function normalizeConfig(raw) {
   merged.routing.bypassDomains = asStringList(merged.routing.bypassDomains, DEFAULT_CONFIG.routing.bypassDomains)
   merged.routing.blockAds = asBool(merged.routing.blockAds, false)
   merged.routing.geositeCn = asBool(merged.routing.geositeCn, false)
+  merged.routing.mode = asString(merged.routing.mode, 'global')
+  merged.routing.whitelist = normalizeDomainList(
+    asStringList(merged.routing.whitelist, DEFAULT_CONFIG.routing.whitelist),
+  )
+  merged.routing.blacklist = normalizeDomainList(
+    asStringList(merged.routing.blacklist, DEFAULT_CONFIG.routing.blacklist),
+  )
+  if (merged.routing.blacklist.length > 0) {
+    // Bypass the plugin at the dispatcher level too: a blacklisted host must
+    // work even when xray is restarting.
+    const existing = String(merged.noProxy ?? '')
+      .split(/[,\s]+/)
+      .map((entry) => entry.trim())
+      .filter(Boolean)
+    merged.noProxy = [...new Set([...existing, ...merged.routing.blacklist])].join(',')
+  }
 
   const control = merged.control
   control.enabled = asBool(control.enabled, false)
@@ -344,11 +377,22 @@ export function normalizeConfig(raw) {
   if (inbound.protocol !== 'http' && inbound.protocol !== 'socks') {
     errors.push({ field: 'inbound.protocol', message: 'inbound.protocol 只支持 http 或 socks' })
   }
+  if (!['global', 'cn-direct', 'whitelist'].includes(merged.routing.mode)) {
+    errors.push({ field: 'routing.mode', message: 'routing.mode 只支持 global、cn-direct、whitelist' })
+  }
+  if (merged.routing.mode === 'whitelist' && merged.routing.whitelist.length === 0) {
+    warnings.push('routing.mode=whitelist 但白名单为空：所有流量都会直连')
+  }
   if (!LOOPBACK_HOSTS.has(inbound.host)) {
     errors.push({ field: 'inbound.host', message: '入站必须绑定回环地址，127.0.0.1 / ::1 / localhost' })
   }
   if (!Number.isInteger(inbound.port) || inbound.port < 1 || inbound.port > 65535) {
     errors.push({ field: 'inbound.port', message: '入站端口必须是 1..65535 的整数' })
+  } else if (inbound.port < 1024 && process.platform !== 'win32') {
+    // A remote node port (e.g. 556) must never become the local listener:
+    // binding <1024 needs root on macOS/Linux and xray fails with EACCES.
+    warnings.push(`入站端口 ${inbound.port} 是特权端口，macOS/Linux 下无法绑定；已改用 ${DEFAULT_CONFIG.inbound.port}`)
+    inbound.port = DEFAULT_CONFIG.inbound.port
   }
   if (socks.enabled) {
     if (!LOOPBACK_HOSTS.has(socks.host)) {

package/lib/route.js

@@ -3,7 +3,11 @@ import { dirname, join } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
 const PROXY_PACKAGE = '@deepseek-ai/dsh-http-proxy'
-const PROBE_URL = 'https://api.deepseek.com/'
+// Route verification must not depend on the data plane it checks: a real
+// target such as api.deepseek.com can legitimately be listed in noProxy, which
+// would make a working install look unproxied. A reserved .invalid host is
+// never bypassed; proxyRouteFor only resolves the route, it never fetches.
+export const PROBE_URL = 'https://dsh-2xray-verify.invalid/'
 const DISPATCHER_SYMBOLS = [Symbol.for('undici.globalDispatcher.2'), Symbol.for('undici.globalDispatcher.1')]
 
 export class RouteError extends Error {

package/lib/schema.js

@@ -93,4 +93,18 @@ export const Config = Schema.object({
       .description('启用 gRPC 控制面（多节点切换与流量统计，需 xray 2024-09+）。')
       .volatile(),
   }),
+  routing: Schema.object({
+    mode: Schema.string()
+      .default('global')
+      .description('global：全部走代理；cn-direct：国内 IP/域名直连；whitelist：仅白名单走代理。')
+      .volatile(),
+    whitelist: Schema.array(Schema.string())
+      .default(['github.com', 'google.com', 'youtube.com', 'x.com', 'facebook.com'])
+      .description('强制走 2Xray 的域名（匹配子域名）。')
+      .volatile(),
+    blacklist: Schema.array(Schema.string())
+      .default(['deepseek.com', 'api.deepseek.com'])
+      .description('强制直连的域名（优先于白名单与分流）。')
+      .volatile(),
+  }),
 })

package/lib/supervisor.js

@@ -1,5 +1,6 @@
 import { join } from 'node:path'
 import { rmSync } from 'node:fs'
+import { ensureXrayAssets } from './assets.js'
 import { buildXrayConfig } from './xray-config.js'
 import { resolveBinary, probeVersion, tail } from './binary.js'
 import { httpProxyProbe, portIsFree, waitForPort } from './health.js'
@@ -222,6 +223,15 @@ export class Supervisor {
     this.#binary = binary
     if (signal.aborted) return
 
+    if (this.dataDir) {
+      const routing = this.config.routing ?? {}
+      if (routing.mode === 'cn-direct' || routing.geositeCn || routing.blockAds) {
+        const assets = ensureXrayAssets({ binaryPath: binary.path, dataDir: this.dataDir, logger: this.#logger })
+        process.env.XRAY_LOCATION_ASSET = this.dataDir
+        if (assets.copied.length > 0) this.#logger?.info?.(`已复制 xray 数据文件：${assets.copied.join(', ')}`)
+      }
+    }
+
     const version = await probeVersion({
       launcher: this.#launcher,
       binaryPath: binary.path,

package/lib/xray-config.js

@@ -156,6 +156,19 @@ export function buildXrayConfig(config) {
   if (routing.blockAds) {
     rules.push({ type: 'field', domain: ['geosite:category-ads-all'], outboundTag: 'block' })
   }
+  const blacklist = dedupe(routing.blacklist ?? [])
+  if (blacklist.length > 0) {
+    // Highest priority: these hosts must stay direct even in whitelist mode.
+    rules.push({ type: 'field', domain: blacklist.map((entry) => `domain:${entry}`), outboundTag: 'direct' })
+  }
+
+  const whitelist = dedupe(routing.whitelist ?? []).filter((entry) => !blacklist.includes(entry))
+  const mode = routing.mode ?? 'global'
+  const proxyTarget = nodes.length > 1 ? { balancerTag: control.balancerTag } : { outboundTag: nodes[0].tag }
+  if (mode === 'whitelist' && whitelist.length > 0) {
+    rules.push({ type: 'field', domain: whitelist.map((entry) => `domain:${entry}`), ...proxyTarget })
+  }
+
   rules.push({ type: 'field', ip: PRIVATE_IP_RULES, outboundTag: 'direct' })
 
   const bypassDomains = dedupe(routing.bypassDomains)
@@ -166,9 +179,12 @@ export function buildXrayConfig(config) {
     rules.push({ type: 'field', domain: bypassDomains.map((entry) => `domain:${entry}`), outboundTag: 'direct' })
   }
 
-  if (routing.geositeCn) {
+  if (mode === 'cn-direct' || routing.geositeCn) {
     rules.push({ type: 'field', domain: ['geosite:cn'], outboundTag: 'direct' })
   }
+  if (mode === 'cn-direct') {
+    rules.push({ type: 'field', ip: ['geoip:cn'], outboundTag: 'direct' })
+  }
 
   const balancers = []
   if (nodes.length > 1) {
@@ -180,6 +196,11 @@ export function buildXrayConfig(config) {
       selector: nodes.map((node) => `^${escapeRegExp(node.tag)}$`),
       strategy: { type: 'random' },
     })
+  }
+  if (mode === 'whitelist') {
+    // Only the whitelist above goes through xray; everything else is direct.
+    rules.push({ type: 'field', network: 'tcp,udp', outboundTag: 'direct' })
+  } else if (nodes.length > 1) {
     rules.push({ type: 'field', network: 'tcp,udp', balancerTag: control.balancerTag })
   } else {
     rules.push({ type: 'field', network: 'tcp,udp', outboundTag: nodes[0].tag })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/dsh-2xray",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "private": false,
   "description": "DSH-2Xray: supervises xray-core and routes DSH process-wide HTTP(S) traffic through its local inbound, with optional multi-node gRPC control plane",
   "type": "module",

package/scripts/release-check.mjs

@@ -73,7 +73,8 @@ const files = walk(ROOT)
 const outside = files.filter((file) => !isAllowed(file))
 check('every packaged file is allow-listed', outside.length === 0, outside.join(', ') || `${files.length} files`)
 
-for (const required of ['index.js', 'package.json', 'cordis.patch.yml', 'README.md', 'CHANGELOG.md', 'LICENSE', 'lib/supervisor.js', 'lib/control/grpc.js', 'locale/en.json', 'locale/zh.json', 'icon.svg']) {
+for (const required of ['index.js', 'package.json', 'cordis.patch.yml', 'README.md', 'CHANGELOG.md', 'LICENSE', 'lib/supervisor.js', 'lib/control/grpc.js',
+  'tools/launch-with-browser-proxy.cmd', 'locale/en.json', 'locale/zh.json', 'icon.svg']) {
   check(`required file ${required}`, files.includes(required))
 }
 

package/test/install-core.test.js

@@ -0,0 +1,22 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { assetName, parseDigest, sha256, dataBinDir } from '../tools/install-xray-core.mjs'
+
+test('asset names follow the official release naming per platform', () => {
+  assert.equal(assetName('win32', 'x64'), 'Xray-windows-64.zip')
+  assert.equal(assetName('darwin', 'arm64'), 'Xray-macos-arm64-v8a.zip')
+  assert.equal(assetName('darwin', 'x64'), 'Xray-macos-64.zip')
+  assert.equal(assetName('linux', 'x64'), 'Xray-linux-64.zip')
+  assert.throws(() => assetName('aix', 'ppc64'), /unsupported/)
+})
+
+test('the .dgst parser reads the SHA2-256 line', () => {
+  const digest = 'SHA2-256: ' + 'a'.repeat(64) + '\n'
+  assert.equal(parseDigest(digest), 'a'.repeat(64))
+  assert.throws(() => parseDigest('SHA1: abc'), /SHA2-256/)
+})
+
+test('sha256 hashes the downloaded bytes', () => {
+  assert.equal(sha256(Buffer.from('abc')).length, 64)
+  assert.equal(dataBinDir().endsWith('bin'), true)
+})

package/test/route.test.js

@@ -156,3 +156,11 @@ test('a socks inbound always takes the builtin path', async () => {
   assert.equal(snapshot.mode, 'builtin')
   await route.restore()
 })
+
+test('the policy verification host is reserved and cannot be in noProxy', async () => {
+  const { PROBE_URL } = await import('../lib/route.js')
+  const url = new URL(PROBE_URL)
+  assert.equal(url.hostname, 'dsh-2xray-verify.invalid')
+  assert.equal(url.hostname.endsWith('.invalid'), true)
+  assert.notEqual(url.hostname, 'api.deepseek.com')
+})

package/test/routing.test.js

@@ -0,0 +1,71 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { normalizeConfig } from '../lib/config.js'
+import { buildXrayConfig } from '../lib/xray-config.js'
+
+function base(root = {}) {
+  return normalizeConfig({
+    enabled: true,
+    server: {
+      address: 'example.com',
+      port: 443,
+      uuid: '11111111-2222-4333-8444-555555555555',
+      serverName: 'www.example.com',
+      password: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      shortId: 'ab12',
+    },
+    ...root,
+  })
+}
+
+function rulesOf(config) {
+  return buildXrayConfig(config).routing.rules
+}
+
+test('global mode keeps the proxy catch-all and private direct rule', () => {
+  const { config, errors } = base()
+  assert.deepEqual(errors, [])
+  const rules = rulesOf(config)
+  assert.ok(rules.some((rule) => Array.isArray(rule.ip) && rule.ip.includes('10.0.0.0/8')))
+  const catchAll = rules[rules.length - 1]
+  assert.equal(catchAll.network, 'tcp,udp')
+  assert.equal(catchAll.outboundTag, 'proxy')
+})
+
+test('cn-direct adds geosite:cn and geoip:cn direct rules', () => {
+  const { config } = base({ routing: { mode: 'cn-direct' } })
+  const rules = rulesOf(config)
+  assert.ok(rules.some((rule) => rule.domain?.includes('geosite:cn')))
+  assert.ok(rules.some((rule) => rule.ip?.includes('geoip:cn')))
+  assert.equal(rules[rules.length - 1].outboundTag, 'proxy')
+})
+
+test('whitelist mode proxies only listed domains and defaults to direct', () => {
+  const { config } = base({ routing: { mode: 'whitelist', whitelist: ['github.com', 'youtube.com'] } })
+  const rules = rulesOf(config)
+  const proxyRule = rules.find((rule) => rule.domain?.includes('domain:github.com'))
+  assert.ok(proxyRule)
+  assert.equal(proxyRule.outboundTag, 'proxy')
+  const catchAll = rules[rules.length - 1]
+  assert.equal(catchAll.outboundTag, 'direct')
+})
+
+test('blacklisted domains go direct and are added to noProxy', () => {
+  const { config } = base({ routing: { blacklist: ['https://api.deepseek.com/anthropic'] } })
+  const rules = rulesOf(config)
+  assert.equal(rules[0].outboundTag, 'direct')
+  assert.ok(rules[0].domain.includes('domain:api.deepseek.com'))
+  assert.match(config.noProxy, /(^|,)api\.deepseek\.com(,|$)/)
+  assert.equal(config.routing.blacklist.includes('api.deepseek.com'), true)
+})
+
+test('whitelist wins over bypassDomains but loses to the blacklist', () => {
+  const { config } = base({
+    routing: { mode: 'whitelist', whitelist: ['github.com'], blacklist: ['github.com'], bypassDomains: ['github.com'] },
+  })
+  const rules = rulesOf(config)
+  const black = rules.findIndex((rule) => rule.domain?.includes('domain:github.com') && rule.outboundTag === 'direct')
+  const white = rules.findIndex((rule) => rule.domain?.includes('domain:github.com') && rule.outboundTag === 'proxy')
+  assert.ok(black >= 0)
+  assert.equal(white, -1)
+})

package/tools/install-xray-core.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+/**
+ * Install an official Xray-core binary into the plugin data directory.
+ *
+ * The npm package does not embed five platform cores (that is ~150 MB). Instead
+ * this one-shot installer downloads the official release asset for the current
+ * platform, verifies the published SHA2-256 digest, extracts it, and places the
+ * binary where the plugin already looks: <dataDir>/bin/xray(.exe).
+ *
+ * Usage:
+ *   node tools/install-xray-core.mjs [version]
+ *   XRAY_VERSION=26.9.30 node tools/install-xray-core.mjs
+ *   DSH_XRAY_MIRROR=https://mirror.example/Xray-core/releases/download node tools/install-xray-core.mjs
+ */
+import { createHash } from 'node:crypto'
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const DEFAULT_VERSION = '26.9.30'
+
+export function assetName(platform = process.platform, arch = process.arch) {
+  if (platform === 'win32' && arch === 'x64') return 'Xray-windows-64.zip'
+  if (platform === 'win32' && arch === 'arm64') return 'Xray-windows-arm64-v8a.zip'
+  if (platform === 'darwin' && arch === 'arm64') return 'Xray-macos-arm64-v8a.zip'
+  if (platform === 'darwin' && arch === 'x64') return 'Xray-macos-64.zip'
+  if (platform === 'linux' && arch === 'x64') return 'Xray-linux-64.zip'
+  if (platform === 'linux' && arch === 'arm64') return 'Xray-linux-arm64-v8a.zip'
+  throw new Error(`unsupported platform: ${platform}/${arch}`)
+}
+
+export function parseDigest(text) {
+  const match = String(text).match(/SHA2-256:\s*([0-9a-f]{64})/i)
+  if (!match) throw new Error('release digest has no SHA2-256 value')
+  return match[1].toLowerCase()
+}
+
+export function sha256(buffer) {
+  return createHash('sha256').update(buffer).digest('hex')
+}
+
+export function dataBinDir() {
+  const home = homedir()
+  return join(home, '.dsh', 'xray-proxy', 'bin')
+}
+
+async function download(url) {
+  const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(180000) })
+  if (!response.ok) throw new Error(`${url} -> HTTP ${response.status}`)
+  return Buffer.from(await response.arrayBuffer())
+}
+
+function extract(zip, destination) {
+  const attempts =
+    process.platform === 'win32'
+      ? [['tar', ['-xf', zip, '-C', destination]], ['powershell', ['-NoProfile', '-Command', `Expand-Archive -LiteralPath '${zip}' -DestinationPath '${destination}' -Force`]]]
+      : [['unzip', ['-o', zip, '-d', destination]], ['tar', ['-xf', zip, '-C', destination]]]
+  let lastError
+  for (const [command, args] of attempts) {
+    const result = spawnSync(command, args, { stdio: 'ignore' })
+    if (result.status === 0) return
+    lastError = result.error ?? new Error(`${command} exited ${result.status}`)
+  }
+  throw lastError
+}
+
+function findBinary(dir, name) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name)
+    if (entry.isFile() && entry.name === name) return full
+    if (entry.isDirectory()) {
+      const nested = findBinary(full, name)
+      if (nested) return nested
+    }
+  }
+  return undefined
+}
+
+export async function main() {
+  const version = process.argv[2] || process.env.XRAY_VERSION || DEFAULT_VERSION
+  const asset = assetName()
+  const mirror = (process.env.DSH_XRAY_MIRROR || 'https://github.com/XTLS/Xray-core/releases/download').replace(/\/$/, '')
+  const url = `${mirror}/v${version.replace(/^v/, '')}/${asset}`
+  const targetDir = dataBinDir()
+  const targetName = process.platform === 'win32' ? 'xray.exe' : 'xray'
+  const target = join(targetDir, targetName)
+
+  if (existsSync(target)) {
+    console.log(`already present: ${target}`)
+    return target
+  }
+
+  console.log(`downloading ${url}`)
+  const zip = await download(url)
+  console.log(`verifying ${asset}.dgst`)
+  const digestText = (await download(`${url}.dgst`)).toString('utf8')
+  const expected = parseDigest(digestText)
+  const actual = sha256(zip)
+  if (expected !== actual) throw new Error(`digest mismatch: expected ${expected}, got ${actual}`)
+
+  const workspace = mkdtempSync(join(tmpdir(), 'dsh-xray-core-'))
+  try {
+    const archive = join(workspace, asset)
+    writeFileSync(archive, zip)
+    const extracted = join(workspace, 'out')
+    mkdirSync(extracted, { recursive: true })
+    extract(archive, extracted)
+    const binary = findBinary(extracted, targetName)
+    if (!binary) throw new Error(`no ${targetName} inside ${asset}`)
+    mkdirSync(targetDir, { recursive: true })
+    copyFileSync(binary, target)
+    if (process.platform !== 'win32') chmodSync(target, 0o755)
+    console.log(`installed ${target} (${Math.round(statSync(target).size / 1048576)} MB, v${version})`)
+    return target
+  } finally {
+    rmSync(workspace, { recursive: true, force: true })
+  }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main().catch((error) => {
+    console.error(`install failed: ${error.message ?? error}`)
+    console.error('If GitHub is unreachable, set DSH_XRAY_MIRROR to a mirror and retry.')
+    process.exitCode = 1
+  })
+}

package/tools/launch-with-browser-proxy.cmd

@@ -0,0 +1,30 @@
+@echo off
+setlocal
+rem Launch DeepSeek Harness with the embedded Chromium browser pointed at the
+rem plugin's local HTTP inbound. A Node plugin cannot change Chromium's proxy at
+rem runtime, so the switch has to be present when the app starts.
+rem
+rem Usage:
+rem   launch-with-browser-proxy.cmd ["C:\path\to\DeepSeek Harness.exe"]
+rem
+rem Close DSH completely before running this: a second launch only focuses the
+rem existing single instance and never applies the flag.
+
+set "PORT=20808"
+set "EXE=%~1"
+if not defined EXE set "EXE=%DSH_EXE%"
+
+if not defined EXE if exist "%LOCALAPPDATA%\Programs\DeepSeek Harness\DeepSeek Harness.exe" set "EXE=%LOCALAPPDATA%\Programs\DeepSeek Harness\DeepSeek Harness.exe"
+if not defined EXE if exist "%ProgramFiles%\DeepSeek Harness\DeepSeek Harness.exe" set "EXE=%ProgramFiles%\DeepSeek Harness\DeepSeek Harness.exe"
+if not defined EXE if exist "E:\DS\DeepSeek Harness.exe" set "EXE=E:\DS\DeepSeek Harness.exe"
+
+if not defined EXE (
+  echo DeepSeek Harness executable not found.
+  echo Pass the path explicitly:
+  echo   %~nx0 "C:\path\to\DeepSeek Harness.exe"
+  exit /b 1
+)
+
+echo Launching with embedded browser proxy: http://127.0.0.1:%PORT%
+start "" "%EXE%" --proxy-server=http://127.0.0.1:%PORT%
+endlocal