dsh-plugin-subscriptions 0.5.1 → 0.5.2

package/README.md

@@ -132,6 +132,12 @@ catalog does not know would otherwise default to `/chat/completions`, which
 responses-only families (gpt-5.5/5.6, …) reject. Pinning `chat-completions` also opts
 out of the tools+effort auto-reroute described above.
 
+## Proxy
+
+Every subscription request — token exchanges, model-API streams, usage lookups, model discovery, and the `x_search` / `image_generate` / `video_generate` tools — can be routed through an HTTP(S) proxy. Configure it in **Settings → Subscriptions → Proxy → Configure…**: enable the flag, enter the proxy URL (`http://127.0.0.1:7890`), optional username/password, and an optional comma-separated bypass list of hostnames that stay direct (`127.0.0.1`, `localhost`, `*.example.com`). The password is stored in `~/.dsh/plugins/subscriptions/proxy.json` (mode 0600) and is never returned to the browser. A "Test" button probes one endpoint through the current configuration and shows the HTTP status/latency.
+
+Changes apply immediately to subsequent requests — no restart needed. The OAuth authorization page opens in your browser and follows the browser/system proxy, not this setting. SOCKS proxies are not supported.
+
 ## Develop
 
 ```sh

package/README.zh.md

@@ -131,6 +131,12 @@ GitHub 安装的:重新执行一遍 `add github:V1ki/dsh-plugin-subscriptions`
 responses-only 系列（gpt-5.5/5.6 等）会拒绝该端点。固定为 `chat-completions` 也会退出上文所述
 tools+effort 的自动改道。
 
+## 代理
+
+所有订阅相关请求 —— token 交换、模型 API 流式调用、用量查询、模型目录发现,以及 `x_search` / `image_generate` / `video_generate` 工具 —— 都可以通过 HTTP(S) 代理发出。在 **设置 → 订阅 → 代理 → 配置…** 中设置:勾选启用,填写代理地址(`http://127.0.0.1:7890`)、可选用户名/密码,以及可选的逗号分隔绕过列表(保持直连的主机名,如 `127.0.0.1`、`localhost`、`*.example.com`)。密码保存在 `~/.dsh/plugins/subscriptions/proxy.json`(权限 0600),不会回传给浏览器;「测试」按钮会用当前配置探测一次端点,显示 HTTP 状态码与耗时。
+
+保存后立即对后续请求生效,无需重启。OAuth 授权页在浏览器中打开,走浏览器/系统自身的代理设置,不受此配置影响;不支持 socks 代理。
+
 ## 开发
 
 ```sh

package/lib/auth/device-flow.d.ts

@@ -1,12 +1,3 @@
-/**
- * GitHub OAuth device-authorization flow (RFC 8628) for providers that cannot
- * use the loopback redirect engine: no redirect URI, no PKCE, no client
- * secret. The user opens a verification URL and types a short code while the
- * plugin polls the token endpoint until GitHub releases the access token.
- * The management model (one attempt per provider, `isBusy`/`pending`/`cancel`)
- * mirrors {@link OAuthFlowManager} so the auth controller can treat both
- * engines uniformly.
- */
 /** Static per-provider device-flow facts. */
 export interface DeviceFlowSpec {
     /** OAuth App / GitHub App client id the device code is requested for. */

package/lib/auth/device-flow.js

@@ -7,6 +7,7 @@
  * mirrors {@link OAuthFlowManager} so the auth controller can treat both
  * engines uniformly.
  */
+import { proxiedFetch } from '../http.js';
 /** Default poll interval when the device-code response omits one. */
 const DEFAULT_INTERVAL_SEC = 5;
 /** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
@@ -64,7 +65,7 @@ export class DeviceFlowManager {
         if (this.attempts.has(provider)) {
             throw new Error(`a ${provider} login attempt is already in progress`);
         }
-        const fetchFn = spec.fetchFn ?? fetch;
+        const fetchFn = spec.fetchFn ?? proxiedFetch;
         const response = await fetchFn(spec.deviceCodeUrl, {
             method: 'POST',
             headers: {

package/lib/auth/rpc.d.ts

@@ -8,6 +8,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment';
 import { type ProviderId } from './store.js';
 import type { ProviderUsage } from '../providers/common.js';
+import type { ProxyConfigView, ProxyDraft, ProxyInput, ProxyTestResult } from '../http.js';
 /** The RPC channel this plugin registers on the host connection. */
 export declare const SUBSCRIPTIONS_AUTH_CHANNEL = "/subscriptions-auth";
 /** Decoded image bytes returned by the `image` endpoint. */
@@ -49,6 +50,18 @@ export interface ProviderStatus {
     /** Subscription detail (plan) or the last login error. */
     detail?: string;
 }
+/** Proxy config operations behind the `proxyGet/proxySet/proxyTest` endpoints. */
+export interface ProxyConfigController {
+    /** Current proxy configuration (secrets omitted). */
+    get(): Promise<ProxyConfigView>;
+    /** Validate, persist, and apply one config. */
+    set(input: ProxyInput): Promise<ProxyConfigView>;
+    /** Probe one destination through the draft (unsaved) or stored proxy. */
+    test(payload: {
+        url?: string;
+        proxy?: ProxyDraft;
+    }): Promise<ProxyTestResult>;
+}
 /** Provider-agnostic auth operations the RPC handler delegates to. */
 export interface AuthController {
     /** Current status of one provider. */
@@ -102,5 +115,6 @@ export interface AuthController {
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
+ * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
  */
-export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController): void;
+export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController, proxy?: ProxyConfigController | undefined): void;

package/lib/auth/rpc.js

@@ -102,7 +102,89 @@ function readSessionId(payload) {
         throw new BadRequest('payload must be an object');
     return readString(payload, 'sessionId');
 }
-async function dispatch(controller, speed, endpoint, payload, signal) {
+/** Validate a `proxySet` payload into a shape `ProxyInput` accepts. */
+function readProxyInput(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        throw new BadRequest('payload must be an object');
+    const record = payload;
+    if (typeof record.enabled !== 'boolean')
+        throw new BadRequest('payload.enabled must be a boolean');
+    if (typeof record.url !== 'string')
+        throw new BadRequest('payload.url must be a string');
+    let username;
+    if (record.username !== undefined) {
+        if (typeof record.username !== 'string')
+            throw new BadRequest('payload.username must be a string when present');
+        username = record.username;
+    }
+    let password;
+    if (record.password !== undefined) {
+        if (record.password !== null && typeof record.password !== 'string') {
+            throw new BadRequest('payload.password must be a string or null when present');
+        }
+        password = record.password;
+    }
+    let bypass;
+    if (record.bypass !== undefined) {
+        if (!Array.isArray(record.bypass) || record.bypass.some(entry => typeof entry !== 'string')) {
+            throw new BadRequest('payload.bypass must be an array of strings when present');
+        }
+        bypass = record.bypass;
+    }
+    return {
+        enabled: record.enabled,
+        url: record.url,
+        ...username === undefined ? {} : { username },
+        ...password === undefined ? {} : { password },
+        ...bypass === undefined ? {} : { bypass },
+    };
+}
+/** Validate a `proxyTest` payload (the destination URL and an optional draft). */
+function readProxyTestPayload(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return {};
+    const record = payload;
+    const url = record.url;
+    if (url === undefined && record.proxy === undefined)
+        return {};
+    if (url !== undefined && (typeof url !== 'string' || url.length === 0)) {
+        throw new BadRequest('payload.url must be a non-empty string when present');
+    }
+    let proxy;
+    if (record.proxy !== undefined) {
+        if (typeof record.proxy !== 'object' || record.proxy === null) {
+            throw new BadRequest('payload.proxy must be an object when present');
+        }
+        const draftRecord = record.proxy;
+        if (typeof draftRecord.url !== 'string' || draftRecord.url.length === 0) {
+            throw new BadRequest('payload.proxy.url must be a non-empty string');
+        }
+        let username;
+        if (draftRecord.username !== undefined) {
+            if (typeof draftRecord.username !== 'string') {
+                throw new BadRequest('payload.proxy.username must be a string when present');
+            }
+            username = draftRecord.username;
+        }
+        let password;
+        if (draftRecord.password !== undefined) {
+            if (typeof draftRecord.password !== 'string') {
+                throw new BadRequest('payload.proxy.password must be a string when present');
+            }
+            password = draftRecord.password;
+        }
+        proxy = {
+            url: draftRecord.url,
+            ...username === undefined ? {} : { username },
+            ...password === undefined ? {} : { password },
+        };
+    }
+    return {
+        ...url === undefined ? {} : { url },
+        ...proxy === undefined ? {} : { proxy },
+    };
+}
+async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
     switch (endpoint) {
         case 'status': {
             const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
@@ -132,6 +214,18 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
         case 'setSpeed':
             await speed.setSpeed(readSessionId(payload), readSpeedTier(payload));
             return ok({ ok: true });
+        case 'proxyGet':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.get());
+        case 'proxySet':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.set(readProxyInput(payload)));
+        case 'proxyTest':
+            if (proxy === undefined)
+                throw new BadRequest('proxy configuration is unavailable');
+            return ok(await proxy.test(readProxyTestPayload(payload)));
         default:
             throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
     }
@@ -141,8 +235,9 @@ async function dispatch(controller, speed, endpoint, payload, signal) {
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
+ * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
  */
-export function registerAuthRpc(ctx, controller, speed) {
+export function registerAuthRpc(ctx, controller, speed, proxy = undefined) {
     // `connection` is not in this plugin's inject list (headless compositions
     // lack it), so its startup order is unconstrained: defer registration until
     // the service exists instead of probing once at apply time.
@@ -150,7 +245,7 @@ export function registerAuthRpc(ctx, controller, speed) {
         const connection = ctx.get('connection');
         ctx.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
             try {
-                return await dispatch(controller, speed, endpoint, payload, signal);
+                return await dispatch(controller, speed, proxy, endpoint, payload, signal);
             }
             catch (error) {
                 return failure(error);

package/lib/client/SubscriptionsSection.d.ts

@@ -23,6 +23,23 @@ export interface ProviderUsage {
     windows?: UsageWindow[];
     plan?: string;
 }
+/** `proxyGet` endpoint value: the node half owns this shape (no secrets). */
+export interface ProxyConfigView {
+    enabled: boolean;
+    url: string;
+    username?: string;
+    passwordSet: boolean;
+    bypass: string[];
+    error?: string;
+}
+/** `proxyTest` endpoint value. */
+export interface ProxyTestResult {
+    ok: boolean;
+    viaProxy: boolean;
+    status?: number;
+    latencyMs?: number;
+    error?: string;
+}
 /** Injected dependencies of {@link SubscriptionsSection} (slot `inject`). */
 export interface SubscriptionsSectionInjected {
     /** Generic logical-RPC caller over the Connection transport. */

package/lib/client/SubscriptionsSection.js

@@ -78,6 +78,10 @@ const styles = {
         border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 12,
         padding: '12px 14px', display: 'flex', flexDirection: 'column', gap: 6,
     },
+    proxyCard: {
+        padding: '12px 14px', display: 'flex', flexDirection: 'column', gap: 6,
+    },
+    separator: { borderTop: '1px solid var(--dsw-alias-border-l2)' },
     cardHeader: { display: 'flex', alignItems: 'center', gap: 8 },
     dot: { width: 8, height: 8, borderRadius: '50%', flexShrink: 0 },
     name: { fontWeight: 500, fontSize: 14, lineHeight: '22px', color: 'var(--dsw-alias-label-primary)' },
@@ -132,6 +136,36 @@ const styles = {
         fontFamily: 'monospace', fontSize: 18, lineHeight: '24px', letterSpacing: 2,
         color: 'var(--dsw-alias-label-primary)', userSelect: 'all',
     },
+    proxyField: { display: 'flex', flexDirection: 'column', gap: 4 },
+    proxyLabel: { fontSize: 12, lineHeight: '18px', color: 'var(--dsw-alias-label-secondary)' },
+    proxyInput: {
+        height: 32, width: '100%', boxSizing: 'border-box',
+        border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8,
+        padding: '0 10px', font: 'inherit', fontSize: 14, lineHeight: '22px',
+        background: 'var(--dsw-alias-bg-layer-1)', color: 'var(--dsw-alias-label-primary)',
+    },
+    proxyHint: {
+        margin: 0, fontSize: 12, lineHeight: '18px', color: 'var(--dsw-alias-label-tertiary)',
+    },
+    proxyCheck: {
+        display: 'flex', alignItems: 'center', gap: 8,
+        fontSize: 13, lineHeight: '20px', color: 'var(--dsw-alias-label-primary)', cursor: 'pointer',
+    },
+    proxyMessage: { margin: 0, fontSize: 12, lineHeight: '18px' },
+    proxyActions: { display: 'flex', gap: 8, alignItems: 'center', justifyContent: 'flex-end', marginTop: 2 },
+    modalOverlay: {
+        position: 'fixed', inset: 0, zIndex: 1000,
+        display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16,
+        background: 'rgba(0, 0, 0, 0.45)',
+    },
+    modal: {
+        width: 460, maxWidth: '100%', maxHeight: '90vh', overflowY: 'auto',
+        boxSizing: 'border-box', display: 'flex', flexDirection: 'column', gap: 12,
+        padding: '16px 18px', borderRadius: 12,
+        background: 'var(--dsw-alias-bg-layer-1)', border: '1px solid var(--dsw-alias-border-l2)',
+    },
+    modalHeader: { display: 'flex', alignItems: 'center', gap: 8 },
+    modalTitle: { fontWeight: 600, fontSize: 15, lineHeight: '22px', color: 'var(--dsw-alias-label-primary)' },
 };
 /** Status dot color for one provider state. */
 function dotColor(status) {
@@ -188,6 +222,24 @@ function usageBarColor(usedPercent) {
         return 'var(--dsw-alias-state-warn-label)';
     return 'var(--dsw-alias-state-success-primary)';
 }
+/** One-line status text of the proxy config card. */
+function proxyStatusText(t, proxy, loadError) {
+    if (loadError !== undefined)
+        return t('proxyLoadFailed', { message: loadError });
+    if (proxy === undefined)
+        return t('proxyLoading');
+    if (proxy.error !== undefined)
+        return t('proxyStatusError', { message: proxy.error });
+    if (proxy.enabled)
+        return t('proxyStatusEnabled', { url: proxy.url });
+    return t('proxyStatusNone');
+}
+/** Feedback-line color of the proxy dialog. */
+function messageColor(tone) {
+    return tone === 'error'
+        ? 'var(--dsw-alias-state-error-primary)'
+        : 'var(--dsw-alias-state-success-primary)';
+}
 /**
  * The Subscriptions settings page component.
  * @param props - the slot inject face ({@link SubscriptionsSectionInjected}).
@@ -211,6 +263,21 @@ export function SubscriptionsSection(props) {
     const pollersRef = useRef(new Map());
     /** Providers with a `usage` call in flight; guards the auto-fetch effect against re-entry. */
     const usageInflightRef = useRef(new Set());
+    /** Proxy config as last answered by `proxyGet`/`proxySet`. */
+    const [proxy, setProxy] = useState(undefined);
+    const [proxyLoadError, setProxyLoadError] = useState(undefined);
+    /** Proxy dialog state (draft fields; the password never pre-fills). */
+    const [proxyOpen, setProxyOpen] = useState(false);
+    const [proxyEnabled, setProxyEnabled] = useState(false);
+    const [proxyUrl, setProxyUrl] = useState('');
+    const [proxyUsername, setProxyUsername] = useState('');
+    const [proxyPassword, setProxyPassword] = useState('');
+    const [proxyClearPassword, setProxyClearPassword] = useState(false);
+    const [proxyBypass, setProxyBypass] = useState('');
+    const [proxySaving, setProxySaving] = useState(false);
+    const [proxyTesting, setProxyTesting] = useState(false);
+    const [proxyMessage, setProxyMessage] = useState(undefined);
+    const [proxyTestResult, setProxyTestResult] = useState(undefined);
     const setProviderError = useCallback((provider, message) => {
         if (!mountedRef.current)
             return;
@@ -427,10 +494,102 @@ export function SubscriptionsSection(props) {
             }, 1500);
         }).catch(() => undefined);
     }, []);
+    // Proxy configuration: load once on mount; the dialog drives proxySet/proxyTest.
+    useEffect(() => {
+        if (rpc === undefined)
+            return;
+        let alive = true;
+        void callSubscriptionsAuth(rpc, 'proxyGet', {}).then((view) => {
+            if (!alive)
+                return;
+            setProxy(view);
+            setProxyLoadError(undefined);
+        }).catch((error) => {
+            if (alive)
+                setProxyLoadError(messageOf(error));
+        });
+        return () => { alive = false; };
+    }, [rpc]);
+    useEffect(() => {
+        if (!proxyOpen)
+            return;
+        const onKey = (event) => {
+            if (event.key === 'Escape')
+                setProxyOpen(false);
+        };
+        window.addEventListener('keydown', onKey);
+        return () => window.removeEventListener('keydown', onKey);
+    }, [proxyOpen]);
+    const openProxyDialog = useCallback(() => {
+        if (proxy === undefined)
+            return;
+        setProxyEnabled(proxy.enabled);
+        setProxyUrl(proxy.url);
+        setProxyUsername(proxy.username ?? '');
+        setProxyPassword('');
+        setProxyClearPassword(false);
+        setProxyBypass(proxy.bypass.join(', '));
+        setProxyMessage(undefined);
+        setProxyTestResult(undefined);
+        setProxyOpen(true);
+    }, [proxy]);
+    const saveProxy = useCallback(async () => {
+        if (rpc === undefined)
+            return;
+        setProxySaving(true);
+        setProxyMessage(undefined);
+        try {
+            const view = await callSubscriptionsAuth(rpc, 'proxySet', {
+                enabled: proxyEnabled,
+                url: proxyUrl.trim(),
+                username: proxyUsername,
+                ...proxyClearPassword ? { password: null } : proxyPassword !== '' ? { password: proxyPassword } : {},
+                bypass: proxyBypass.split(/[,\n]/).map(entry => entry.trim()).filter(entry => entry !== ''),
+            });
+            setProxy(view);
+            setProxyLoadError(undefined);
+            setProxyMessage({ tone: 'success', text: t('proxySaved') });
+            setProxyOpen(false);
+        }
+        catch (error) {
+            setProxyMessage({ tone: 'error', text: t('proxySaveFailed', { message: messageOf(error) }) });
+        }
+        finally {
+            setProxySaving(false);
+        }
+    }, [rpc, proxyEnabled, proxyUrl, proxyUsername, proxyPassword, proxyClearPassword, proxyBypass, t]);
+    const testProxy = useCallback(async () => {
+        if (rpc === undefined || proxyTesting)
+            return;
+        setProxyTesting(true);
+        setProxyTestResult(undefined);
+        try {
+            // Test the dialog's current inputs (they do not need to be saved first);
+            // the host builds a throwaway agent for the probe.
+            setProxyTestResult(await callSubscriptionsAuth(rpc, 'proxyTest', {
+                proxy: {
+                    url: proxyUrl.trim(),
+                    ...proxyUsername.trim() !== '' ? { username: proxyUsername.trim() } : {},
+                    ...proxyPassword !== '' ? { password: proxyPassword } : {},
+                },
+            }));
+        }
+        catch (error) {
+            setProxyTestResult({ ok: false, viaProxy: false, error: messageOf(error) });
+        }
+        finally {
+            setProxyTesting(false);
+        }
+    }, [rpc, proxyTesting, proxyUrl, proxyUsername, proxyPassword]);
     if (rpc === undefined) {
         return _jsx("p", { style: styles.intro, children: t('unavailable') });
     }
-    return (_jsxs("div", { style: styles.section, children: [_jsx("p", { style: styles.intro, children: t('intro') }), PROVIDERS.map(({ id, name }) => {
+    return (_jsxs("div", { style: styles.section, children: [_jsx("p", { style: styles.intro, children: t('intro') }), _jsxs("div", { style: styles.proxyCard, children: [_jsxs("div", { style: styles.cardHeader, children: [_jsx("span", { style: {
+                                    ...styles.dot,
+                                    background: proxy?.enabled === true
+                                        ? 'var(--dsw-alias-state-success-primary)'
+                                        : 'var(--dsw-alias-label-dimmed)',
+                                } }), _jsx("span", { style: styles.name, children: t('proxyTitle') }), _jsx("button", { type: "button", style: { ...styles.button, marginLeft: 'auto', flexShrink: 0 }, onClick: openProxyDialog, children: t('proxyConfigure') })] }), _jsx("p", { style: styles.statusLine, children: proxyStatusText(t, proxy, proxyLoadError) })] }), _jsx("div", { style: styles.separator }), PROVIDERS.map(({ id, name }) => {
                 const status = statuses[id];
                 const busy = status?.busy === true;
                 const deviceCode = deviceCodes[id];
@@ -444,5 +603,14 @@ export function SubscriptionsSection(props) {
                                     return (_jsxs("div", { style: styles.usageRow, children: [_jsxs("div", { style: styles.usageMeta, children: [_jsx("span", { children: usageWindowLabel(t, window) }), _jsxs("span", { children: [`${String(Math.round(percent))}%`, window.resetsAt !== undefined
                                                                 && ` · ${t('usageResets', { date: new Date(window.resetsAt).toLocaleString() })}`] })] }), _jsx("div", { style: styles.usageTrack, children: _jsx("div", { style: { ...styles.usageFill, width: `${String(percent)}%`, background: usageBarColor(percent) } }) })] }, index));
                                 })] })), busy && deviceCode !== undefined && (_jsxs("div", { style: styles.deviceCode, children: [_jsx("span", { style: styles.statusLine, children: t('deviceCodePrompt') }), _jsx("span", { style: styles.deviceCodeText, children: deviceCode.userCode }), _jsxs("div", { style: styles.actions, children: [_jsx("button", { type: "button", style: styles.button, onClick: () => { copyDeviceCode(id, deviceCode.userCode); }, children: copiedCode === id ? t('deviceCodeCopied') : t('deviceCodeCopy') }), _jsx("button", { type: "button", style: styles.button, onClick: () => { window.open(deviceCode.verificationUrl, '_blank', 'noopener'); }, children: t('deviceCodeOpenPage') })] })] })), busy && deviceCode === undefined && (_jsxs("details", { style: styles.manual, children: [_jsx("summary", { children: t('manualSummary') }), _jsxs("div", { style: styles.manualRow, children: [_jsx("input", { style: styles.manualInput, value: manualDrafts[id], placeholder: t('manualPlaceholder'), onChange: event => setManualDrafts(prev => ({ ...prev, [id]: event.target.value })) }), _jsx("button", { type: "button", style: styles.button, onClick: () => { void submitManual(id); }, children: t('submit') })] })] }))] }, id));
-            })] }));
+            }), proxyOpen && (_jsx("div", { style: styles.modalOverlay, onClick: () => setProxyOpen(false), children: _jsxs("div", { style: styles.modal, onClick: event => event.stopPropagation(), children: [_jsxs("div", { style: styles.modalHeader, children: [_jsx("span", { style: styles.modalTitle, children: t('proxyDialogTitle') }), _jsx("button", { type: "button", style: { ...styles.button, marginLeft: 'auto' }, onClick: () => setProxyOpen(false), children: t('proxyDialogClose') })] }), _jsxs("label", { style: styles.proxyCheck, children: [_jsx("input", { type: "checkbox", checked: proxyEnabled, onChange: event => setProxyEnabled(event.target.checked) }), _jsx("span", { children: t('proxyEnabled') })] }), _jsxs("label", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyUrl') }), _jsx("input", { style: styles.proxyInput, value: proxyUrl, placeholder: t('proxyUrlPlaceholder'), onChange: event => setProxyUrl(event.target.value) }), _jsx("p", { style: styles.proxyHint, children: t('proxyUrlHint') })] }), _jsxs("label", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyUsername') }), _jsx("input", { style: styles.proxyInput, value: proxyUsername, placeholder: t('proxyUsernamePlaceholder'), onChange: event => setProxyUsername(event.target.value) })] }), _jsxs("div", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyPassword') }), _jsx("input", { type: "password", style: styles.proxyInput, value: proxyPassword, placeholder: t('proxyPasswordPlaceholder'), onChange: event => setProxyPassword(event.target.value) }), _jsxs("label", { style: styles.proxyCheck, children: [_jsx("input", { type: "checkbox", checked: proxyClearPassword, onChange: event => setProxyClearPassword(event.target.checked) }), _jsx("span", { children: t('proxyClearPassword') })] })] }), _jsxs("label", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyBypass') }), _jsx("input", { style: styles.proxyInput, value: proxyBypass, placeholder: t('proxyBypassPlaceholder'), onChange: event => setProxyBypass(event.target.value) }), _jsx("p", { style: styles.proxyHint, children: t('proxyBypassHint') })] }), _jsx("p", { style: styles.proxyHint, children: t('proxyNote') }), proxyMessage !== undefined && (_jsx("p", { style: { ...styles.proxyMessage, color: messageColor(proxyMessage.tone) }, children: proxyMessage.text })), proxyTestResult !== undefined && (_jsx("p", { style: {
+                                ...styles.proxyMessage,
+                                color: proxyTestResult.ok
+                                    ? 'var(--dsw-alias-state-success-primary)'
+                                    : 'var(--dsw-alias-state-error-primary)',
+                            }, children: proxyTestResult.ok
+                                ? (proxyTestResult.viaProxy
+                                    ? t('proxyTestOk', { status: String(proxyTestResult.status), ms: String(proxyTestResult.latencyMs) })
+                                    : t('proxyTestOkDirect', { status: String(proxyTestResult.status), ms: String(proxyTestResult.latencyMs) }))
+                                : t('proxyTestFail', { message: proxyTestResult.error ?? '' }) })), _jsxs("div", { style: styles.proxyActions, children: [_jsx("button", { type: "button", style: { ...styles.button, ...proxyTesting ? { opacity: 0.5, cursor: 'default' } : {} }, disabled: proxyTesting, onClick: () => { void testProxy(); }, children: proxyTesting ? t('proxyTesting') : t('proxyTest') }), _jsx("button", { type: "button", style: { ...styles.button, ...proxySaving ? { opacity: 0.5, cursor: 'default' } : {} }, disabled: proxySaving, onClick: () => { void saveProxy(); }, children: proxySaving ? t('proxySaving') : t('proxySave') }), _jsx("button", { type: "button", style: styles.button, onClick: () => setProxyOpen(false), children: t('proxyCancel') })] })] }) }))] }));
 }

package/lib/client/index.js

@@ -22,6 +22,17 @@ export const inject = ['slots', 'connection', 'locale'];
  */
 export function apply(ctx) {
     ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-plugin-subscriptions: copy dictionaries');
+    // Settings-shell nudge: the panel (nav title + header row + section body)
+    // sits flush against the panel's top edge; push it down a little to leave
+    // breathing room. Scoped by the settings panel's own dialog role + nav child
+    // so other aria-modal dialogs (e.g. the attachment lightbox) are untouched.
+    ctx.effect(() => {
+        const style = document.createElement('style');
+        style.setAttribute('data-plugin', 'dsh-plugin-subscriptions');
+        style.textContent = 'div[role="dialog"][aria-modal="true"]:has(> nav) { padding-top: 14px; }';
+        document.head.appendChild(style);
+        return () => style.remove();
+    }, 'dsh-plugin-subscriptions: settings panel breathing room');
     // The client-runtime Context merge types `connection` as the host handle;
     // in the browser shell the same key holds the full client ConnectionHandle.
     const connection = ctx.get('connection');

package/lib/client/locales.d.ts

@@ -51,6 +51,38 @@ export declare const en: {
     speedFastDescription: string;
     commandFast: string;
     commandFastUnavailable: string;
+    proxyTitle: string;
+    proxyStatusNone: string;
+    proxyStatusEnabled: string;
+    proxyStatusError: string;
+    proxyConfigure: string;
+    proxyDialogTitle: string;
+    proxyDialogClose: string;
+    proxyEnabled: string;
+    proxyUrl: string;
+    proxyUrlPlaceholder: string;
+    proxyUrlHint: string;
+    proxyUsername: string;
+    proxyUsernamePlaceholder: string;
+    proxyPassword: string;
+    proxyPasswordPlaceholder: string;
+    proxyClearPassword: string;
+    proxyBypass: string;
+    proxyBypassPlaceholder: string;
+    proxyBypassHint: string;
+    proxyTest: string;
+    proxyTesting: string;
+    proxyTestOk: string;
+    proxyTestOkDirect: string;
+    proxyTestFail: string;
+    proxySave: string;
+    proxyCancel: string;
+    proxySaving: string;
+    proxyLoading: string;
+    proxyLoadFailed: string;
+    proxySaved: string;
+    proxySaveFailed: string;
+    proxyNote: string;
 };
 /** zh strings, one per {@link en} key. */
 export declare const zh: {
@@ -104,6 +136,38 @@ export declare const zh: {
     speedFastDescription: string;
     commandFast: string;
     commandFastUnavailable: string;
+    proxyTitle: string;
+    proxyStatusNone: string;
+    proxyStatusEnabled: string;
+    proxyStatusError: string;
+    proxyConfigure: string;
+    proxyDialogTitle: string;
+    proxyDialogClose: string;
+    proxyEnabled: string;
+    proxyUrl: string;
+    proxyUrlPlaceholder: string;
+    proxyUrlHint: string;
+    proxyUsername: string;
+    proxyUsernamePlaceholder: string;
+    proxyPassword: string;
+    proxyPasswordPlaceholder: string;
+    proxyClearPassword: string;
+    proxyBypass: string;
+    proxyBypassPlaceholder: string;
+    proxyBypassHint: string;
+    proxyTest: string;
+    proxyTesting: string;
+    proxyTestOk: string;
+    proxyTestOkDirect: string;
+    proxyTestFail: string;
+    proxySave: string;
+    proxyCancel: string;
+    proxySaving: string;
+    proxyLoading: string;
+    proxyLoadFailed: string;
+    proxySaved: string;
+    proxySaveFailed: string;
+    proxyNote: string;
 };
 /** The Subscriptions namespace key union (en is the key-set source of truth). */
 export type SubscriptionsKey = keyof typeof en;

package/lib/client/locales.js

@@ -51,6 +51,38 @@ export const en = {
     speedFastDescription: '1.5x speed, more usage',
     commandFast: 'Switch the Codex speed tier (Standard/Fast)',
     commandFastUnavailable: 'The current model has no fast tier; /fast only works on Codex models whose catalog advertises one',
+    proxyTitle: 'Proxy',
+    proxyStatusNone: 'Not configured — subscription requests go direct.',
+    proxyStatusEnabled: 'Enabled · {url}',
+    proxyStatusError: 'Config error: {message}',
+    proxyConfigure: 'Configure…',
+    proxyDialogTitle: 'Proxy settings',
+    proxyDialogClose: 'Close',
+    proxyEnabled: 'Route subscription requests through a proxy',
+    proxyUrl: 'Proxy URL',
+    proxyUrlPlaceholder: 'http://localhost:7890',
+    proxyUrlHint: 'HTTP or HTTPS proxy only (Clash/mihomo, v2rayN…); socks is not supported.',
+    proxyUsername: 'Username (optional)',
+    proxyUsernamePlaceholder: 'Proxy username',
+    proxyPassword: 'Password',
+    proxyPasswordPlaceholder: 'Leave blank to keep the saved password',
+    proxyClearPassword: 'Clear the saved password',
+    proxyBypass: 'Bypass hosts',
+    proxyBypassPlaceholder: '127.0.0.1, localhost, *.example.com',
+    proxyBypassHint: 'Comma-separated hostnames that keep going direct.',
+    proxyTest: 'Test',
+    proxyTesting: 'Testing…',
+    proxyTestOk: 'OK · HTTP {status} · {ms} ms',
+    proxyTestOkDirect: 'OK (direct, bypassed) · HTTP {status} · {ms} ms',
+    proxyTestFail: 'Failed: {message}',
+    proxySave: 'Save',
+    proxyCancel: 'Cancel',
+    proxySaving: 'Saving…',
+    proxyLoading: 'Loading proxy settings…',
+    proxyLoadFailed: 'Failed to load proxy settings: {message}',
+    proxySaved: 'Saved — new requests use the proxy.',
+    proxySaveFailed: 'Save failed: {message}',
+    proxyNote: 'Applies to token exchange, model APIs, usage lookups, image/video generation and x_search. The OAuth authorization page opens in your browser and follows the browser/system proxy, not this setting.',
 };
 /** zh strings, one per {@link en} key. */
 export const zh = {
@@ -104,4 +136,36 @@ export const zh = {
     speedFastDescription: '约 1.5 倍速度，消耗更多用量',
     commandFast: '切换 Codex 速度档（标准/快速）',
     commandFastUnavailable: '当前模型不支持快速档；/fast 仅对目录声明了 fast tier 的 Codex 模型可用',
+    proxyTitle: '代理',
+    proxyStatusNone: '未配置 —— 订阅请求直连。',
+    proxyStatusEnabled: '已启用 · {url}',
+    proxyStatusError: '配置错误：{message}',
+    proxyConfigure: '配置…',
+    proxyDialogTitle: '代理设置',
+    proxyDialogClose: '关闭',
+    proxyEnabled: '让订阅相关请求走代理',
+    proxyUrl: '代理地址',
+    proxyUrlPlaceholder: 'http://localhost:7890',
+    proxyUrlHint: '仅支持 HTTP/HTTPS 代理（Clash/mihomo、v2rayN 等）；不支持 socks。',
+    proxyUsername: '用户名（可选）',
+    proxyUsernamePlaceholder: '代理用户名',
+    proxyPassword: '密码',
+    proxyPasswordPlaceholder: '留空则保留已保存的密码',
+    proxyClearPassword: '清除已保存的密码',
+    proxyBypass: '绕过主机',
+    proxyBypassPlaceholder: '127.0.0.1, localhost, *.example.com',
+    proxyBypassHint: '逗号分隔的主机名，这些主机保持直连。',
+    proxyTest: '测试',
+    proxyTesting: '测试中…',
+    proxyTestOk: '成功 · HTTP {status} · {ms} ms',
+    proxyTestOkDirect: '成功（直连，已绕过）· HTTP {status} · {ms} ms',
+    proxyTestFail: '失败：{message}',
+    proxySave: '保存',
+    proxyCancel: '取消',
+    proxySaving: '保存中…',
+    proxyLoading: '代理设置加载中…',
+    proxyLoadFailed: '代理设置加载失败：{message}',
+    proxySaved: '已保存 —— 后续请求将走代理。',
+    proxySaveFailed: '保存失败：{message}',
+    proxyNote: '作用于 token 交换、模型 API、用量查询、图片/视频生成与 x_search。OAuth 授权页在浏览器中打开，走的是浏览器/系统代理，不受此设置影响。',
 };