@yanglaofish/dsh-proxy-pro 1.0.3 → 1.0.5

package/docs/LESSONS.md

@@ -699,4 +699,55 @@ module-level policy（§2-§3）。卸载"插件行"是安全的，删除"包"
 
 **教训**：诊断工具的返回值必须回答"能不能用"和"下一步怎么办"——只回一个状态码，等于把问题
 又丢回给用户。另外 `additionalProperties: false` 的 schema 必须同步列出新字段
-（verdict/why/fix/note），否则 defineTool 校验直接失败。
+（verdict/why/fix/note），否则 defineTool 校验直接失败。
+
+---
+
+## 25. 策略通道也要同一 undici 副本（2026-09-17）
+
+**症状**：1.0.3 面板「连通探测」（不勾选「使用代理」）显示
+`不可用：dispatcher rejected by this undici instance (UND_ERR_INVALID_ARG) — mixed undici copies`。
+
+**根因**：1.0.2 只修了强制通道（`und.fetch` + 同副本 dispatcher，§22）。策略通道一直用 Node
+内置 `fetch` 且不传 dispatcher —— 但全局 dispatcher 是 `installProxyFromEnvironment` 用 **app
+undici** 装的，内置 fetch 拿它发请求 = A 组合（内置 fetch + 外部 Agent）→ 必然
+UND_ERR_INVALID_ARG。之前没暴露，是因为面板默认勾选「使用代理」（强制通道）掩盖了它。
+
+**修法**（1.0.4）：策略通道同样走 app undici——
+`policyProbe()` = `und.fetch(url, { dispatcher: und.getGlobalDispatcher() })`。
+`getGlobalDispatcher()` 返回的正是 web_fetch 通道在用的全局 dispatcher，语义 = 模拟 web_fetch，
+且永远同副本。三条探测路径现在统一：policy = 全局 dispatcher / forced-direct = 新建 Agent /
+forced-proxy = 新建 ProxyAgent，全部由 `und.fetch` 发起。
+
+**连带**：所有展示文案（short/why/fix/hint）中文化——面板是中文 UI，英文 why/fix 让人无法
+行动；`proxy_test` 工具输出同步中文（模型照读）。教训：给用户看的文案别用英文"图省事"，
+判定结论必须能直接用。
+
+**测试**：断言随中文文案同步翻新（/混用/、/超时/、/上游|超时/、/ECONNREFUSED/）。
+
+---
+
+## 26. 不 import 会被移除的库导出：settings 走服务（2026-09-18）
+
+**症状**：升级 test profile 后，dsh CLI 启动时整棵树崩溃：
+`SyntaxError: The requested module '@deepseek-ai/dsh-settings' does not provide an export named 'installSettingsSection'`，
+插件行加载失败 → 整个启动终止。
+
+**根因**：dsh-settings 同时存在两个版本——桌面版（resources/app/node_modules）**保留**了
+`installSettingsSection`/`settingsNamespace` 兼容导出；全局 dsh CLI（AppData/Roaming/npm 的
+`@deepseek-ai/dsh` 自带依赖树）是**新版，已移除这两个导出**。插件在模块顶层
+`import { installSettingsSection } from '@deepseek-ai/dsh-settings'` → ESM 求值阶段就抛
+SyntaxError，不是运行期错误——profile 插件树加载失败，启动直接终止。
+
+**改法**（1.0.5）：彻底不 import dsh-settings 的任何导出，配置注册改走 **settings 服务**：
+```js
+const scope = ctx.settings.register(PROXY_NS, Config, { base: config })
+source = () => scope.get()                 // update() 重算 registration.resolved，get() 始终新鲜
+scope.watch(() => { void requestSync().catch(() => {}) })
+```
+`register`/`watch`/`update`/`replace` 在两端（旧桌面版 SettingsProvider 与新 CLI 版）都存在；
+命名空间直接写字面量 `'proxy'`（旧 `settingsNamespace()` 也只是 parse + 校验）。
+
+**教训**：① ESM 顶层 import 命中断言是**加载期**错误——一次错误的 import 能杀死整个进程，所以
+对外部包的导出要查运行环境的实际版本，而不是凭记忆；② 能从服务拿到的（settings 是 inject 服务）
+就不要 import 包；③ 「桌面版」与「全局 CLI 版」是两套依赖树，一个功能必须两端都能加载。

package/docs/SPEC.md

@@ -105,7 +105,7 @@ profile 内安装（pnpm nodeLinker: hoisted；本地=file: 软链，发布=regi
 
 ```
 [浏览器 client.js]                    [host index.js (NodeService 链)]
-  │  inject settings.section            │  installSettingsSection(proxy NS)
+  │  inject settings.section            │  ctx.settings.register('proxy') + watch
   │  inject header.utilities            │  sync(): resolve → applyEffective(env+dispatcher)
   │  fetch /dsh-proxy-pro/api/*  ◄──────┤          → installProxyFromEnvironment(policy)
   │                                     │              ↓ 让 web_fetch 的 proxyRouteFor 判 PROXIED
@@ -140,7 +140,9 @@ function apply(ctx, config) { … }   // 导出 { Config, apply, inject, name }
 - **没有 savedEnv / EnvHttpProxyAgent / 手写 dispatcher**：传输完全委托
   `installProxyFromEnvironment`（env + 全局 dispatcher + 模块级策略一体，
   LESSONS §12.4：单一通道，杜绝 undici 错版）。
-- `installSettingsSection(ctx, PROXY_NS, Config, config, { setSource, onChange })`，
+- `ctx.settings.register(PROXY_NS, Config, { base: config })` 拿 owner scope，
+  `source = () => scope.get()`，`scope.watch(onChange)` —— 新版 dsh-settings 已移除
+  `installSettingsSection` 导出（LESSONS §26），必须走 settings 服务；
   onChange → `requestSync()`（合并去重，`syncing` 单飞）。
 - teardown（`ctx.effect`）：清 pollTimer → `await httpProxyPolicy?.()`（卸载=恢复
   env/dispatcher/策略）。

package/lib/index.js

@@ -26,7 +26,6 @@
  */
 import z from '@deepseek-ai/schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
-import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings'
 import { installProxyFromEnvironment, proxyRouteFor } from '@deepseek-ai/dsh-http-proxy'
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
@@ -56,8 +55,11 @@ const name = 'dsh-proxy-pro'
 /** Services this plugin must resolve before it applies. */
 const inject = ['tools', 'systemPrompt', 'settings']
 
-/** Settings namespace owning the proxy configuration (shared with stock tooling). */
-const PROXY_NS = settingsNamespace('proxy')
+/** Settings namespace owning the proxy configuration (shared with stock
+ *  tooling). Plain literal: the legacy settingsNamespace() helper was removed
+ *  from newer dsh-settings, and 'proxy' is already a valid lowercase-hyphenated
+ *  namespace identifier. */
+const PROXY_NS = 'proxy'
 
 /** Ordered placement of the proxy status section in the system prompt. */
 const SECTION_ORDER = 55
@@ -169,13 +171,12 @@ const PROBE_UA = 'dsh-proxy-pro/0.1'
 const PROBE_TIMEOUT_MS = 6000
 
 /**
- * One probe attempt: HEAD first, then a GET retry when the endpoint does not
- * implement HEAD (405/501) — many APIs only answer GET, and a HEAD-only probe
- * would libel a perfectly usable host. `request` is the caller's fetch: the
- * global one for the policy channel, this undici copy's `fetch` for forced
- * channels (LESSONS §22 — the two must never be mixed).
+ * 一个探测尝试：先 HEAD，端点不支持 HEAD（405/501）时再用 GET 复测——
+ * 很多 API 只实现 GET，只用 HEAD 会冤枉一个可用主机。`request` 是调用方
+ * 的 fetch：两条通道现在都用 app undici 的 `und.fetch` 配同副本 dispatcher
+ * （LESSONS §22/§25 —— 绝不要把两份副本混在一起）。
  *
- * @returns a verdict from classifyProbeStatus / classifyTargetFailure.
+ * @returns classifyProbeStatus / classifyTargetFailure 的判定。
  */
 async function probeHttp(request, target, dispatcher) {
   const attempt = async (method) => {
@@ -201,8 +202,8 @@ async function probeHttp(request, target, dispatcher) {
   if (get.error !== undefined) return classifyTargetFailure(get.error)
   const retried = classifyProbeStatus(get.res.status)
   retried.note = retried.ok === true
-    ? 'HEAD was rejected but GET works — the host is usable.'
-    : 'HEAD was rejected; the GET retry hit the same class of problem.'
+    ? 'HEAD 被拒绝但 GET 可用 — 主机可用。'
+    : 'HEAD 被拒绝；GET 复测也遇到同类问题。'
   return retried
 }
 
@@ -215,9 +216,9 @@ async function probeHttp(request, target, dispatcher) {
 async function forceChannelProbe(url, channel, proxyUrl) {
   const und = await getUndici()
   if (und === null) {
-    return { ok: false, verdict: 'unusable', kind: 'unavailable', short: 'forced channel unavailable (undici could not be loaded)',
-      why: 'The app-side undici package could not be imported by the host process.',
-      fix: 'Uncheck 使用代理 to use the policy channel, or restart DSH; report the plugin version if it persists.' }
+    return { ok: false, verdict: 'unusable', kind: 'unavailable', short: '强制通道不可用（undici 未能加载）',
+      why: '宿主进程无法加载 app 侧 undici 包。',
+      fix: '取消勾选「使用代理」改用策略通道，或重启 DSH；仍出现请反馈插件版本。' }
   }
   let dispatcher
   try {
@@ -225,9 +226,9 @@ async function forceChannelProbe(url, channel, proxyUrl) {
       ? new und.Agent({ connections: 1 })
       : new und.ProxyAgent(proxyUrl)
   } catch (error) {
-    return { ok: false, verdict: 'unusable', kind: 'bad-proxy', short: `invalid proxy address: ${String(error?.message ?? error)}`,
-      why: 'The effective proxy address is not a valid http(s) proxy URL.',
-      fix: 'Fix the address in 代理配置 (mode = 自定义地址) or clear the custom URL.' }
+    return { ok: false, verdict: 'unusable', kind: 'bad-proxy', short: `代理地址无效：${String(error?.message ?? error)}`,
+      why: '当前生效的代理地址不是有效的 http(s) 代理 URL。',
+      fix: '在「代理配置」修复地址（mode = 自定义地址）或清空自定义地址。' }
   }
   try {
     // MUST issue the request with THIS undici copy. The host runs two copies —
@@ -243,10 +244,26 @@ async function forceChannelProbe(url, channel, proxyUrl) {
 }
 
 /**
- * Probe one target the way web_fetch will see it: route verdict first, then a
- * real request through the installed policy (global fetch → policy dispatcher).
- * `channel` selects the probe path: 'policy' (default), 'proxy' (forced via
- * proxy), or 'direct' (forced bypass).
+ * 按已安装策略探测，与 web_fetch 走同一条路：用同一份 undici 的 fetch 加
+ * 全局 dispatcher。策略通道不能用 Node 内置 `fetch`——全局 dispatcher 由
+ * app 的 undici（installProxyFromEnvironment）安装，内置 fetch 拿它必然
+ * UND_ERR_INVALID_ARG（LESSONS §25，A 组合；面板当时显示"dispatcher
+ * rejected… mixed undici copies"）。
+ */
+async function policyProbe(target) {
+  const und = await getUndici()
+  if (und === null) {
+    return { ok: false, verdict: 'unusable', kind: 'unavailable', short: '策略通道不可用（undici 未能加载）',
+      why: '宿主进程无法加载 app 侧 undici 包。', fix: '重启 DSH；仍出现请反馈插件版本。' }
+  }
+  const dispatcher = typeof und.getGlobalDispatcher === 'function' ? und.getGlobalDispatcher() : undefined
+  return probeHttp((u, i) => und.fetch(u, i), target, dispatcher)
+}
+
+/**
+ * 按 web_fetch 的方式探测一个目标：先给路由判定，再用策略通道发真实请求
+ * （app undici 的 fetch + 全局 dispatcher，见 policyProbe）。`channel` 选择
+ * 探测路径：'policy'（默认）、'proxy'（强制走代理）、'direct'（强制绕过）。
  */
 async function probeTarget(url, snapshot, channel = 'policy') {
   let parsed
@@ -254,13 +271,13 @@ async function probeTarget(url, snapshot, channel = 'policy') {
     parsed = new URL(url)
   } catch {
     return { url, route: 'invalid', bypassed: false,
-      probe: { ok: false, verdict: 'unusable', kind: 'invalid', short: 'invalid URL — expected http(s)://host/path',
-        why: 'The text is not a parseable absolute URL.', fix: 'Use the full form, e.g. https://github.com/foo/bar.' } }
+      probe: { ok: false, verdict: 'unusable', kind: 'invalid', short: 'URL 无效 — 需要 http(s)://主机/路径',
+        why: '输入不是可解析的绝对 URL。', fix: '用完整形式，如 https://github.com/foo/bar。' } }
   }
   let routeName = 'DIRECT'
   try {
-    const policyProbe = proxyRouteFor(parsed)
-    routeName = policyProbe.proxied ? `PROXIED ${policyProbe.proxy}` : 'DIRECT'
+    const routeProbe = proxyRouteFor(parsed)
+    routeName = routeProbe.proxied ? `PROXIED ${routeProbe.proxy}` : 'DIRECT'
   } catch {
     // proxyRouteFor unavailable in this composition → rely on state snapshot
   }
@@ -272,13 +289,13 @@ async function probeTarget(url, snapshot, channel = 'policy') {
   if (channel === 'proxy' || channel === 'direct') {
     const proxyUrl = channel === 'proxy' ? (snapshot?.effective?.url ?? '') : ''
     const probe = proxyUrl === '' && channel === 'proxy'
-      ? { ok: false, verdict: 'unusable', kind: 'bad-proxy', short: 'no active proxy url in the current snapshot',
-        why: 'The proxy switch is off (or the Windows system proxy is off), so there is nothing to force traffic through.',
-        fix: 'Turn the proxy on, or fix the address/mode in 代理配置.' }
+      ? { ok: false, verdict: 'unusable', kind: 'bad-proxy', short: '当前快照里没有可用的代理地址',
+        why: '代理开关处于关闭（或 Windows 系统代理关闭），没有可强制走代理的对象。',
+        fix: '打开代理，或在「代理配置」里修复地址/模式。' }
       : await forceChannelProbe(parsed, channel, proxyUrl)
     return { url, route: routeName, bypassed, channel, probe }
   }
-  const probe = await probeHttp((u, i) => fetch(u, i), parsed, undefined)
+  const probe = await policyProbe(parsed)
   return { url, route: routeName, bypassed, probe }
 }
 
@@ -427,16 +444,22 @@ function apply(ctx, config) {
   }
 
   // Configuration source: the `proxy` settings namespace layered over the
-  // composition entry; every committed change re-syncs live.
-  installSettingsSection(ctx, PROXY_NS, Config, config, {
-    setSource: (current) => {
-      source = current
-      void requestSync().catch(() => {})
-    },
-    onChange: () => {
+  // composition entry; every committed change re-syncs live. Registration goes
+  // through the settings SERVICE — newer dsh-settings removed the
+  // `installSettingsSection` export entirely, so importing it throws a
+  // SyntaxError at boot and kills the whole profile (LESSONS §26).
+  // register() + scope.get()/watch() exist on every version we target, and
+  // update() recomputes registration.resolved, so scope.get() stays fresh.
+  const settingsService = ctx.get('settings')
+  if (settingsService !== undefined && typeof settingsService.register === 'function') {
+    const proxyScope = settingsService.register(PROXY_NS, Config, { base: config })
+    source = () => proxyScope.get()
+    proxyScope.watch(() => {
       void requestSync().catch(() => {})
-    },
-  })
+    })
+  }
+  // Without a settings service in this composition, `source` keeps the
+  // composition default (initialized above) and the plugin still runs, read-only.
 
   // ---------- Agent tools ----------
 
@@ -505,17 +528,17 @@ function apply(ctx, config) {
       render: (_args, value) => {
         const p = value.probe ?? {}
         const head = p.verdict === 'usable'
-          ? `usable${p.status === undefined ? '' : ` (HTTP ${p.status})`}`
-          : `${p.verdict === 'degraded' ? 'degraded' : 'unusable'} — ${p.short ?? 'unknown'}`
+          ? `可用${p.status === undefined ? '' : `（HTTP ${p.status}）`}`
+          : `${p.verdict === 'degraded' ? '降级' : '不可用'} — ${p.short ?? '未知'}`
         const lines = [
-          `Route: ${value.route}`,
-          `NO_PROXY bypassed: ${value.bypassed}`,
-          `Probe: ${head}`,
+          `路由: ${value.route}`,
+          `NO_PROXY 命中: ${value.bypassed}`,
+          `连通探测: ${head}`,
         ]
-        if (p.why) lines.push(`Why: ${p.why}`)
-        if (p.fix) lines.push(`Fix: ${p.fix}`)
-        if (p.note) lines.push(`Note: ${p.note}`)
-        if (value.hint) lines.push(`Hint: ${value.hint}`)
+        if (p.why) lines.push(`可能原因: ${p.why}`)
+        if (p.fix) lines.push(`挽救措施: ${p.fix}`)
+        if (p.note) lines.push(`备注: ${p.note}`)
+        if (value.hint) lines.push(`提示: ${value.hint}`)
         return [{ type: 'text', text: lines.join('\n') }]
       },
     },

package/lib/proxy-core.js

@@ -254,150 +254,148 @@ export function summarize(snapshot) {
 }
 
 /**
- * NTLM keepalive hint: SWG proxies (netentsec etc.) ask undici for NTLM auth
- * which undici cannot negotiate; a curl/browser NAT'd connection keeps a
- * window open. Only relevant when a 407 or auth-required response is seen.
- * The example URL is caller-supplied (the effective proxy), never hardcoded —
- * a fixed sample leaked this developer's own corporate proxy into every hint.
+ * NTLM keepalive 提示：SWG 类代理（netentsec 等）向 undici 索要 NTLM 认证，
+ * undici 无法协商；curl/浏览器最近一次经过同一代理的连接会保持一段已认证
+ * 窗口。仅在看到 407 或认证相关应答时才有意义。示例 URL 由调用方传入
+ * （生效代理地址），绝不硬编码——固定样例曾把开发者自己的公司代理泄漏进
+ * 每一条提示里。
  */
 export function keepaliveHint(message = '', proxyUrl = '') {
   const text = typeof message === 'string' ? message : ''
   if (!/407|NTLM|proxy authentication|authentication required/i.test(text)) return ''
   const example = typeof proxyUrl === 'string' && proxyUrl !== '' ? proxyUrl : 'http://localhost:7890'
-  return `This proxy asks for NTLM authentication, which undici cannot negotiate by itself. A recent curl/browser connection to the same proxy keeps an authenticated window open — run a \`curl\` through the proxy (e.g. \`curl -x ${example} -I https://github.com\`) once, then retry.`
+  return `该代理要求 NTLM 认证，undici 无法自行协商。最近一次 curl/浏览器到同一代理的连接会保持一段已认证窗口——先执行一次 \`curl -x ${example} -I https://github.com\`，然后重试。`
 }
 
 /**
- * Three-state verdict for one HTTP answer, shared by the panel, `proxy_test`
- * and the HTTP API:
+ * 单个 HTTP 应答的三态判定，供面板、`proxy_test` 与 HTTP API 共用：
  *
- *  - `usable`   — the route works for real calls (2xx/3xx, plus 401: a healthy
- *                 API endpoint answering the credential-less probe).
- *  - `degraded` — an HTTP answer came back, so the route works, but the call
- *                 itself would likely fail (403/404/405/429 and other 4xx).
- *  - `unusable` — the route or the far end failed (407 auth wall, 5xx from the
- *                 target, gateway/upstream timeouts).
+ *  - `usable`   — 真实调用可用（2xx/3xx，以及 401：健康的 API 端点对
+ *                 不带凭证的探测就该回 401）。
+ *  - `degraded` — 拿到了 HTTP 应答（路由通），但这次调用多半会失败
+ *                 （403/404/405/429 等 4xx）。
+ *  - `unusable` — 路由或对端失败（407 认证墙、目标 5xx、网关/上游超时）。
  *
- * Every verdict carries `why` (the likely cause) and `fix` (what to try), so a
- * diagnosis is actionable instead of a bare status code (2026-09-17: 504 and
- * 200 both rendered as "reachable", which answered nothing).
+ * 每个结论都带 `why`（可能原因）与 `fix`（挽救措施），让诊断直接可行动，
+ * 而不是丢一个状态码（2026-09-17：504 曾与 200 一样显示成「可达」）。
  *
- * @param status - the HTTP status code a probe received.
- * @returns `{ ok, verdict, kind, status, short, why, fix }`.
+ * @param status - 探测收到的 HTTP 状态码。
+ * @returns `{ ok, verdict, kind, status, short, why, fix }`（中文文案）。
  */
 export function classifyProbeStatus(status) {
   const code = Number(status)
   const base = { status: code }
   if (code === 407) {
-    return { ...base, ok: false, verdict: 'unusable', kind: 'auth', short: 'HTTP 407 — the proxy asks for authentication (NTLM)',
-      why: 'The request never reached the target: the proxy demands NTLM, which undici cannot negotiate.',
-      fix: 'Run one curl/browser request through the same proxy (e.g. curl -x <proxy> -I https://github.com) to open an authenticated window, then retry.' }
+    return { ...base, ok: false, verdict: 'unusable', kind: 'auth', short: 'HTTP 407 — 代理要求 NTLM 认证',
+      why: '请求根本没到目标：代理拦下并索要 NTLM 认证，undici 无法协商。',
+      fix: '先用 curl/浏览器走同一代理过一次（如 curl -x <代理> -I https://github.com）打开认证窗口，再重试。' }
   }
   if (code >= 200 && code < 400) {
-    return { ...base, ok: true, verdict: 'usable', kind: 'ok', short: `HTTP ${code} — the target answered`, why: '', fix: '' }
+    return { ...base, ok: true, verdict: 'usable', kind: 'ok', short: `HTTP ${code} — 目标正常响应`, why: '', fix: '' }
   }
   if (code === 401) {
-    return { ...base, ok: true, verdict: 'usable', kind: 'ok', short: 'HTTP 401 — the target is alive (credentials required)',
-      why: 'The probe sends no credentials, so 401 is the healthy answer from an API endpoint.',
-      fix: 'Real calls need a valid key/header; the route itself is proven to work.' }
+    return { ...base, ok: true, verdict: 'usable', kind: 'ok', short: 'HTTP 401 — 目标存活（需要凭证）',
+      why: '探测不带凭证，所以 401 是健康 API 端点的正常应答。',
+      fix: '真实调用需要有效 key/请求头；这条结果已经证明路由可用。' }
   }
   if (code === 403) {
-    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: 'HTTP 403 — the target refused the request',
-      why: 'The server was reached but denies this client: key scope, IP allow-list, WAF, or a blocked probe User-Agent.',
-      fix: 'Compare the other channel (direct vs proxy) and check the key/UA rules for this host.' }
+    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: 'HTTP 403 — 目标拒绝了请求',
+      why: '已到达服务器但被拒绝：key 权限、IP 白名单、WAF，或探测 UA 被挡。',
+      fix: '对比直连/代理两侧，并检查该主机的 key/UA 规则。' }
   }
   if (code === 404) {
-    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: 'HTTP 404 — path not found',
-      why: 'The route reached the server; that path does not exist there (probes often hit the bare origin).',
-      fix: 'Re-test with the concrete path you really call; if that works, ignore this result.' }
+    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: 'HTTP 404 — 路径不存在',
+      why: '路由已到服务器，但该路径不存在（探测常打根路径）。',
+      fix: '用真实调用的完整路径复测；能通就忽略此结果。' }
   }
   if (code === 405 || code === 501) {
-    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: `HTTP ${code} — the endpoint does not accept HEAD`,
-      why: 'The diagnostic probes with HEAD; some APIs and gateways only implement GET.',
-      fix: 'The panel retries with GET automatically; a GET success means the host is usable.' }
+    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: `HTTP ${code} — 端点不支持 HEAD`,
+      why: '诊断用 HEAD 探测，有些 API/网关只实现 GET。',
+      fix: '面板已自动换 GET 复测；GET 成功即主机可用。' }
   }
   if (code === 429) {
-    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: 'HTTP 429 — rate limited',
-      why: 'The server is alive but throttling this client.',
-      fix: 'Retry later or lower the request rate; the route itself is fine.' }
+    return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: 'HTTP 429 — 被限流',
+      why: '服务器活着但在限流。',
+      fix: '稍后重试或降低请求频率；路由本身没问题。' }
   }
   if (code === 502) {
-    return { ...base, ok: false, verdict: 'unusable', kind: 'gateway', short: 'HTTP 502 — bad gateway',
-      why: 'An intermediary (the proxy or the target gateway) got an invalid answer from upstream — often the proxy cannot reach this host.',
-      fix: 'Compare the other channel (direct vs proxy); if the proxy is the failing leg, keep this host on the working side of NO_PROXY.' }
+    return { ...base, ok: false, verdict: 'unusable', kind: 'gateway', short: 'HTTP 502 — 网关错误（bad gateway）',
+      why: '中间环节（代理或目标网关）拿到无效上游响应——常见是代理连不上该主机。',
+      fix: '对比直连/代理两侧；若失败在代理侧，把该主机保留在 NO_PROXY 的另一边。' }
   }
   if (code === 503) {
-    return { ...base, ok: false, verdict: 'unusable', kind: 'gateway', short: 'HTTP 503 — service unavailable',
-      why: 'The target (or its gateway) is overloaded or in maintenance.',
-      fix: 'Retry later; this is server-side and unrelated to the route.' }
+    return { ...base, ok: false, verdict: 'unusable', kind: 'gateway', short: 'HTTP 503 — 服务不可用',
+      why: '目标（或其网关）过载或维护中。',
+      fix: '稍后重试；这是服务端问题，与路由无关。' }
   }
   if (code === 504) {
-    return { ...base, ok: false, verdict: 'unusable', kind: 'gateway', short: 'HTTP 504 — gateway/upstream timeout',
-      why: 'The request was forwarded but nothing answered upstream in time: the target is slow or dead, or the proxy leg to it is broken.',
-      fix: 'Compare the other channel (direct vs proxy) and retry; if only one channel times out, that channel is the problem.' }
+    return { ...base, ok: false, verdict: 'unusable', kind: 'gateway', short: 'HTTP 504 — 网关/上游超时',
+      why: '请求已转发但上游迟迟无响应：目标慢或挂了，或代理到目标这一段坏了。',
+      fix: '对比直连/代理两侧并重试；只有某一侧超时，问题就在那一侧。' }
   }
   if (code >= 500) {
-    return { ...base, ok: false, verdict: 'unusable', kind: 'server-error', short: `HTTP ${code} — the target failed`,
-      why: 'The server answered with an error of its own; the route is fine.',
-      fix: 'Retry later; nothing to change in the proxy configuration.' }
+    return { ...base, ok: false, verdict: 'unusable', kind: 'server-error', short: `HTTP ${code} — 目标服务端错误`,
+      why: '服务器自身报错；路由没问题。',
+      fix: '稍后重试；无需改动代理配置。' }
   }
-  return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: `HTTP ${code} — request rejected`,
-    why: 'The route works (an HTTP answer came back) but the request itself was not successful.',
-    fix: 'Check the method, path and headers your real calls use.' }
+  return { ...base, ok: false, verdict: 'degraded', kind: 'http-error', short: `HTTP ${code} — 请求被拒绝`,
+    why: '路由通（拿到了 HTTP 应答），但这次请求本身不成功。',
+    fix: '检查真实调用用的方法、路径和请求头。' }
 }
 
 /**
- * Turn a fetch rejection into an actionable verdict. A bare `fetch failed`
- * hides the real cause: a dispatcher built by one undici copy handed to another
- * rejects with UND_ERR_INVALID_ARG ("invalid onRequestStart method"), which is
- * how the forced-channel diagnostic failed for both channels (LESSONS §22).
+ * 把 fetch 的拒绝转成可行动的结论。裸的 `fetch failed` 掩盖了真正原因：
+ * 一份 undici 造的 dispatcher 交给另一份使用时，会抛 UND_ERR_INVALID_ARG
+ * （"invalid onRequestStart method"）——1.0.2 之前强制通道诊断两个方向都
+ * 死在这里（LESSONS §22）；1.0.4 又发现策略通道也在混两份副本
+ * （LESSONS §25）。把 cause code 亮出来，下一次报告就能指名道姓。
  *
- * @param error - the rejection from `fetch`.
- * @returns `{ ok, verdict, kind, short, why, fix }` with a cause-aware message.
+ * @param error - `fetch` 抛出的拒绝。
+ * @returns 带 cause 信息的 `{ ok, verdict, kind, short, why, fix }`（中文文案）。
  */
 export function classifyTargetFailure(error) {
   const cause = error?.cause
   const code = cause?.code ?? error?.code ?? ''
   const message = String(error?.message ?? error)
   if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
-    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `DNS lookup failed (${code})`,
-      why: 'The hostname did not resolve — a wrong name/DNS, or a proxy that cannot resolve it.',
-      fix: 'Check the hostname; if this host must go through the proxy, remove it from NO_PROXY (or add it if it must go direct).' }
+    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `DNS 解析失败（${code}）`,
+      why: '主机名没解析出来——名字/DNS 错，或代理无法解析它。',
+      fix: '检查主机名；该主机若必须走代理，把它移出 NO_PROXY（反之加进去）。' }
   }
   if (code === 'ECONNREFUSED') {
-    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: 'connection refused (ECONNREFUSED)',
-      why: 'Something answered but refused the connection: nothing listens on that port, or the proxy is not accepting.',
-      fix: 'Check the port and that the proxy is running; compare the other channel.' }
+    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: '连接被拒绝（ECONNREFUSED）',
+      why: '有东西应答但拒绝连接：端口无人监听，或代理不在接受连接。',
+      fix: '检查端口与代理是否在运行；对比另一侧通道。' }
   }
   if (code === 'EACCES' || code === 'ENETUNREACH' || code === 'EHOSTUNREACH') {
-    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `cannot reach directly (${code}) — needs a proxy route`,
-      why: 'The network path itself is unavailable from this machine.',
-      fix: 'Route this host through the proxy (remove the NO_PROXY entry) and retry.' }
+    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `直连不可达（${code}）—需要走代理`,
+      why: '本机到目标的网络路径本身不可用。',
+      fix: '让该主机走代理（从 NO_PROXY 移除）再重试。' }
   }
   if (code === 'ETIMEDOUT' || code === 'UND_ERR_CONNECT_TIMEOUT' || code === 'ABORT_ERR' || error?.name === 'AbortError') {
-    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `no answer before the timeout (${code || error?.name || 'timeout'})`,
-      why: 'Nothing answered in time — a slow/dead target, or a proxy that silently drops this destination.',
-      fix: 'Compare the other channel (direct vs proxy) and retry; if only one channel times out, that channel is the problem.' }
+    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `超时前无应答（${code || error?.name || 'timeout'}）`,
+      why: '到时间没应答——目标慢/挂，或代理静默丢弃该目标。',
+      fix: '对比直连/代理两侧并重试；只有某一侧超时，问题就在那一侧。' }
   }
   if (code === 'ECONNRESET' || code === 'UND_ERR_SOCKET' || code === 'EPIPE') {
-    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `connection reset (${code})`,
-      why: 'The connection was cut mid-flight by an intermediary or a TLS problem (corporate interception, MTU, or a reset by the far end).',
-      fix: 'Retry; compare the other channel; if TLS interception is in play, confirm the corporate CA is trusted (NODE_EXTRA_CA_CERTS).' }
+    return { ok: false, verdict: 'unusable', kind: 'unreachable', short: `连接被重置（${code}）`,
+      why: '连接中途被切断——中间设备或 TLS 问题（公司拦截、MTU、对端重置）。',
+      fix: '重试并对比另一侧；若有 TLS 拦截，确认公司 CA 已被信任（NODE_EXTRA_CA_CERTS）。' }
   }
   if (code === 'UND_ERR_INVALID_ARG' || /invalid onRequestStart/i.test(String(cause?.message ?? ''))) {
-    return { ok: false, verdict: 'unusable', kind: 'dispatcher', short: `dispatcher rejected by this undici instance (${code || 'UND_ERR_INVALID_ARG'}) — mixed undici copies`,
-      why: 'The request and its dispatcher came from two different undici copies; the diagnostic had this bug (fixed in 1.0.2).',
-      fix: 'Update the plugin; if it persists, report the plugin version with this message.' }
+    return { ok: false, verdict: 'unusable', kind: 'dispatcher', short: `dispatcher 被当前 undici 副本拒绝（${code || 'UND_ERR_INVALID_ARG'}）—两份副本混用`,
+      why: '请求和它的 dispatcher 来自两份不同的 undici 副本；1.0.2 修过强制通道，1.0.4 修策略通道。',
+      fix: '更新插件；若仍出现，把插件版本连同这条信息一起反馈。' }
   }
   if (/407|NTLM|authentication required/i.test(message)) {
-    return { ok: false, verdict: 'unusable', kind: 'auth', short: 'the proxy asks for NTLM authentication',
-      why: 'The proxy demands NTLM, which undici cannot negotiate by itself.',
-      fix: 'Run one curl/browser request through the same proxy to open an authenticated window, then retry.' }
+    return { ok: false, verdict: 'unusable', kind: 'auth', short: '代理要求 NTLM 认证',
+      why: '代理索要 NTLM，undici 无法单独完成协商。',
+      fix: '先用 curl/浏览器走同一代理过一次（打开认证窗口），再重试。' }
   }
   const detail = cause?.code
     ? `${cause.code}${cause?.message ? `: ${String(cause.message).slice(0, 90)}` : ''}`
     : (cause?.message ?? '')
-  return { ok: false, verdict: 'unusable', kind: 'other', short: (detail ? `${message} (${detail})` : message).slice(0, 180),
-    why: 'The request failed for a reason the probe could not classify.',
-    fix: 'Compare the other channel (direct vs proxy) and retry; check proxy_status for the effective route.' }
+  return { ok: false, verdict: 'unusable', kind: 'other', short: (detail ? `${message}（${detail}）` : message).slice(0, 180),
+    why: '请求失败，探测器无法归类原因。',
+    fix: '对比直连/代理两侧并重试；用 proxy_status 查看生效路由。' }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanglaofish/dsh-proxy-pro",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "DSH proxy manager: route model requests, web fetches and spawned tools through the Windows system proxy or a custom address; per-URL route diagnosis, one-click toggle from the conversation header, a dedicated Settings page, and keepalive-aware 407 hints.",
   "type": "module",
   "main": "./lib/index.js",