dsh-provider-proxy 0.3.0 → 0.4.0

package/README.md

@@ -38,8 +38,8 @@ dsh plugin --profile web add dsh-provider-proxy
 | 类型 | `HTTP` / `HTTPS` / `SOCKS5` |
 | IP / 主机 | 只填主机名或 IP，不要带 `http://` 或路径 |
 | 端口 | 1–65535 的整数 |
-| 用户名 | 可选（SOCKS5 用，需与密码同时填写） |
-| 密码 | 可选（SOCKS5 用）。作为 SOCKS5 认证口令发给代理 |
+| 用户名 | 可选 |
+| 密码 | 可选。作为代理认证口令发给代理（`HTTP` / `HTTPS` / `SOCKS5` 均支持） |
 
 列表只包含**已激活**的 provider（`llm.listProviders()` 能列出的那些）。仅在配置里声明、
 但没有实际注册的可配置 provider 不显示——它的请求根本不会被发出去。
@@ -47,6 +47,19 @@ dsh plugin --profile web add dsh-provider-proxy
 
 保存立即对新请求生效，不需要重启；正在进行中的流会继续用它启动时的那条连接。
 
+每张卡片在**该 provider 已启用代理**时还有一个 **测试** 按钮：点它会让 Host 通过**该 provider 自己的代理**发一次请求，回报延迟与（探测目标返回时）出口 IP。探测目标默认是 `https://api.ipify.org?format=json`，可用顶层设置 `testUrl` 换成自建的回显服务。代理不可达时它会明确失败，而不是假通过。延迟数值按快慢着色——≤500 ms 绿、≤1500 ms 黄、更慢红——但数值始终照常显示，颜色只是辅助。
+
+卡片里还有一个折叠的 **高级：目标域名规则**，按**目标主机**决定是否走代理：
+
+| 字段 | 说明 |
+| --- | --- |
+| `仅走代理`（`onlyHosts`） | 逗号或空格分隔。非空时，只有匹配这些主机的请求走代理，其余直连。 |
+| `直连`（`bypassHosts`） | 逗号或空格分隔。匹配这些主机的请求直连，优先于 `onlyHosts`。 |
+
+两者都按后缀匹配（`example.com` 覆盖 `api.example.com`），`*` 表示全部，大小写不敏感。**默认是 fail-closed**：启用了代理的路由默认走代理，只有「`bypassHosts` 命中」与「`onlyHosts` 非空且未命中」两种显式例外才直连；解析不出目标主机时**仍走代理**，避免畸形 URL 把带凭据的请求悄悄直连出去。
+
+当组成里存在 web 服务时，列表还会多出一张 **Web 搜索** 卡片（保留 id `web-search`，字段与其它卡片完全相同，也支持自检、计数与域名规则）。它承载 `web_search` 工具的流量；不启用它，搜索保持直连。
+
 > **为什么是独立设置页，而不是内嵌在 Models 的 provider 卡片里？**
 > 本插件最早按卡片内嵌（`settings.models.provider-card`）实现，但那个槽位是 keyed 的、
 > 按 provider 命名空间派发，第三方注册在 0.2.0-rc.1 上始终匹配不上——不报错、不发请求、
@@ -76,14 +89,17 @@ dsh plugin --profile web add dsh-provider-proxy
 ## 已知限制
 
 - **SOCKS5 由 `undici` 内置的 `Socks5ProxyAgent` 实现**（RFC 1928 / RFC 1929），API 稳定性标记为 *Experimental*；`undici` 若在未来移除，需要同步调整。
-- **SOCKS5 的用户名必须与密码同时填写。** 只填用户名会被拒绝并给出提示，而不是静默降级为无认证——否则在强制认证的代理端，报错会指向代理而真正原因是设置缺项。
+- **代理认证字段的成对规则。** SOCKS5 下填了用户名就必须填密码（`Socks5ProxyAgent` 只在两者齐备时才发起认证；只填用户名会被拒绝并给出提示，而不是静默降级为无认证）；HTTP/HTTPS 下填了密码就必须填用户名（基本认证无法只发密码）。不合规则的配置会被拒绝并在「连接诊断」里说明，而不是被静默忽略——否则在强制认证的代理端，报错会指向代理而真正原因是设置缺项。HTTP/HTTPS 下只填用户名仍照常工作。
 - **SOCKS5 不支持 `socks://` 别名与 SOCKS5 over TLS**（`proxyTls`）。
+- **`bypassHosts` 命中时由本机解析并连接目标**（DNS 不经过代理）。SOCKS5 下这一点后果最明显：命中的域名不再由代理端解析，本机 DNS 会暴露该次查询。
+- **`web_search` 可以走代理，`web_fetch` 不行。** 搜索 provider（`dsh-web-search-deepseek`）用全局 `fetch`，插件通过包裹 `ctx.web.search` 把它送进代理作用域；这条成立的前提是：工具每次调用都重新取 `ctx.web.search`，且 provider 的 `search()` 是 await-to-completion（不是惰性消费的流）。`web_fetch` 则用 `undici` 自带的 `dispatcher`（来自官方的进程级 env 策略），没有 per-provider 注入点，本插件覆盖不到——需要覆盖它请改用 `HTTP_PROXY` 之类的环境变量。
+- **保留 id `web-search`。** 它的路由存在 `providers` 字典里；真实 provider 若恰好撞名，会与该路由共用同一份配置，无害。
 - **上游若绕过 `globalThis.fetch` 自行建连，则不受影响。** `llm-deepseek` 确认是调用时解析全局 `fetch`；`llm-pi-ai` 走外部 SDK，抓取 `fetch` 的时机未能在源码层面确证。
 - **不支持 PAC**，也不读取系统代理设置。
 - **不改写 `baseURL`** —— 反向代理/中转请直接在 provider 上配置。
 - **代理不可达时**请求照常失败，DSH 既有的重试与错误码语义不变。
-- **SOCKS5 代理密码以明文随设置写入 `cordis.patch.yml`。** 它只会作为选项传给 `Socks5ProxyAgent`，不会出现在日志或诊断报告里的代理 URL 中。
-- **HTTP/HTTPS 代理仍只支持用户名**，密码只对 SOCKS5 生效。
+- **连接自检依赖 `testUrl` 可达。** 默认的回显主机在部分网络下可能不可达，会让自检误报失败；请通过 `testUrl` 换成自建回显服务。自检只接受 `POST`，同一 provider 的多次点击会共享同一次在飞请求，不会被当成外呼放大器。
+- **代理密码以明文随设置写入 `cordis.patch.yml`。** HTTP/HTTPS 的密码会拼进交给 `undici` 的代理 URL（`ProxyAgent` 由此生成 `Proxy-Authorization`），SOCKS5 的密码只作为选项传给 `Socks5ProxyAgent`；两者都不会出现在日志或诊断里的代理 URL——那里只显示不含凭据的 origin。
 
 ## 如何验证代理确实生效
 

package/index.js

@@ -1,6 +1,6 @@
-// Loader compatibility shim.
-//
-// cordis-plugin-loader resolves an entry as "<package>/index.js" by convention
-// and does NOT read package.json `main`/`exports`, so a package installed into
-// a profile must expose this file. The implementation lives in ./lib/index.js.
+// Loader compatibility shim.
+//
+// cordis-plugin-loader resolves an entry as "<package>/index.js" by convention
+// and does NOT read package.json `main`/`exports`, so a package installed into
+// a profile must expose this file. The implementation lives in ./lib/index.js.
 export * from './lib/index.js'

package/lib/client.js

@@ -159,18 +159,45 @@ function knownProviders(configured, published) {
   return [...rows.values()].sort(byName);
 }
 var CATALOG_PATH = "/dsh-provider-proxy/providers";
+var TEST_PATH = "/dsh-provider-proxy/test";
+var LATENCY_FAST_MS = 500;
+var LATENCY_SLOW_MS = 1500;
+function latencyColor(ms) {
+  if (typeof ms !== "number" || !Number.isFinite(ms)) return "var(--dsw-alias-label-secondary)";
+  if (ms <= LATENCY_FAST_MS) return "var(--dsw-alias-state-success-primary, #2ea043)";
+  if (ms <= LATENCY_SLOW_MS) return "var(--dsw-alias-state-warn-primary, #d29922)";
+  return "var(--dsw-alias-state-error-primary, #f85149)";
+}
+function testResultFrom(body, strings) {
+  const ok = body?.ok === true;
+  return {
+    pending: false,
+    ok,
+    ms: typeof body?.ms === "number" && Number.isFinite(body.ms) ? body.ms : void 0,
+    ip: typeof body?.exitIp === "string" && body.exitIp.length > 0 ? body.exitIp : void 0,
+    error: ok ? void 0 : typeof body?.error === "string" && body.error.length > 0 ? body.error : strings.testFailed
+  };
+}
 var catalogueSetter = () => {
 };
-async function fetchProviders() {
+async function fetchCatalog() {
   const response = await globalThis.fetch(CATALOG_PATH, { headers: { accept: "application/json" } });
   if (!response.ok) throw new Error(`Host answered ${response.status}`);
   const body = await response.json();
   const list = Array.isArray(body?.providers) ? body.providers : [];
-  return list.filter((row) => typeof row?.id === "string" && row.id.length > 0).map((row) => ({
+  const rows = list.filter((row) => typeof row?.id === "string" && row.id.length > 0).map((row) => ({
     id: row.id,
     name: typeof row.name === "string" && row.name.length > 0 ? row.name : row.id,
     live: row.live === true
   }));
+  const hits = {};
+  const published = body?.hits;
+  if (published !== null && typeof published === "object") {
+    for (const [id, count] of Object.entries(published)) {
+      if (typeof count === "number" && Number.isFinite(count)) hits[id] = count;
+    }
+  }
+  return { rows, hits };
 }
 var byName = (a, b) => a.name.localeCompare(b.name);
 function view(route) {
@@ -180,7 +207,9 @@ function view(route) {
     host: route?.host ?? "",
     port: route?.port ?? 0,
     username: route?.username ?? "",
-    password: route?.password ?? ""
+    password: route?.password ?? "",
+    onlyHosts: route?.onlyHosts ?? "",
+    bypassHosts: route?.bypassHosts ?? ""
   };
 }
 var diagnostics = [];
@@ -232,6 +261,42 @@ var S = {
     fontSize: "11px",
     color: "var(--dsw-alias-label-secondary)"
   },
+  hits: {
+    flex: "none",
+    fontSize: "11px",
+    color: "var(--dsw-alias-label-secondary)",
+    whiteSpace: "nowrap"
+  },
+  testRow: {
+    display: "flex",
+    alignItems: "center",
+    gap: "10px",
+    flexWrap: "wrap"
+  },
+  testButton: {
+    padding: "5px 12px",
+    border: "1px solid var(--dsw-alias-border-l1)",
+    borderRadius: "6px",
+    background: "var(--dsw-alias-bg-layer-1)",
+    color: "var(--dsw-alias-label-primary)",
+    font: "inherit",
+    fontSize: "12px",
+    cursor: "pointer"
+  },
+  testResult: {
+    fontSize: "11px",
+    color: "var(--dsw-alias-label-secondary)",
+    wordBreak: "break-all"
+  },
+  advanced: {
+    marginTop: "4px",
+    fontSize: "12px"
+  },
+  advancedSummary: {
+    cursor: "pointer",
+    fontSize: "11px",
+    color: "var(--dsw-alias-label-secondary)"
+  },
   pill: {
     flex: "none",
     padding: "2px 10px",
@@ -296,20 +361,46 @@ function renderPage(ctx) {
   );
   const [state, setState] = (React.useState ?? ((fn) => [fn(), () => {
   }]))(() => {
-    void fetchProviders().then((rows2) => catalogueSetter?.(rows2)).catch((error) => {
+    void fetchCatalog().then((catalog) => catalogueSetter?.(catalog)).catch((error) => {
       note(`provider \u5217\u8868\u83B7\u53D6\u5931\u8D25\uFF1A${error?.message ?? error}`);
-      catalogueSetter?.([]);
+      catalogueSetter?.({ rows: [], hits: {} });
     });
-    return { rows: void 0, pending: true };
+    return { rows: void 0, hits: {}, pending: true };
   });
-  catalogueSetter = (rows2) => setState({ rows: rows2, pending: false });
+  catalogueSetter = (catalog) => setState({ rows: catalog.rows, hits: catalog.hits, pending: false });
   const published = state.rows ?? [];
+  const hits = state.hits ?? {};
   note(
     `provider \u5217\u8868\uFF1A\u6765\u81EA Host \u5171 ${published.length} \u4E2A\uFF08${published.map((r) => r.id).join("\u3001") || "\u65E0"}\uFF09`
   );
   const [draft, setDraft] = (React.useState ?? ((v) => [v, () => {
   }]))({});
   const edit = (id, field2, value) => setDraft((current) => ({ ...current, [id]: { ...current[id], [field2]: value } }));
+  const [tests, setTests] = (React.useState ?? ((v) => [v, () => {
+  }]))({});
+  const runTest = (id) => {
+    setTests((current) => ({ ...current, [id]: { pending: true } }));
+    void (async () => {
+      try {
+        const response = await globalThis.fetch(TEST_PATH, {
+          method: "POST",
+          headers: { "content-type": "application/json", accept: "application/json" },
+          body: JSON.stringify({ provider: id })
+        });
+        const body2 = await response.json();
+        setTests((current) => ({ ...current, [id]: testResultFrom(body2, t) }));
+        if (body2?.ok === true) {
+          void fetchCatalog().then((catalog) => catalogueSetter?.(catalog)).catch(() => {
+          });
+        }
+      } catch (error) {
+        setTests((current) => ({
+          ...current,
+          [id]: { pending: false, ok: false, error: String(error?.message ?? error) }
+        }));
+      }
+    })();
+  };
   const rows = knownProviders({ ...configured, ...draft }, published);
   const save = (id, field2, value) => {
     void writeConfig(ctx, [{ op: "set", path: ["providers", id, field2], value }]).then(() => {
@@ -359,6 +450,7 @@ function renderPage(ctx) {
   ] : rows.map((row) => {
     const route = view({ ...configured[row.id], ...draft[row.id] });
     const disabled = !route.enabled;
+    const result = tests[row.id];
     return h(
       "section",
       {
@@ -373,7 +465,14 @@ function renderPage(ctx) {
           "div",
           { className: import_client.default.cardTitles, style: S.titles },
           h("span", { className: import_client.default.name, style: S.name }, row.name),
-          h("span", { className: import_client.default.id, style: S.id }, row.id)
+          h("span", { className: import_client.default.id, style: S.id }, row.id),
+          // A disabled route can never have hits, so "0" there would only add
+          // noise; the count shows once the route is on (or has counted).
+          route.enabled || (hits[row.id] ?? 0) > 0 ? h(
+            "span",
+            { className: import_client.default.hits, style: S.hits },
+            `${t.hitCountPrefix}${hits[row.id] ?? 0}${t.hitCountSuffix}`
+          ) : null
         ),
         h(
           "span",
@@ -454,13 +553,12 @@ function renderPage(ctx) {
           onChange: (event) => bind(row.id, "username")(event.target.value)
         })
       ),
-      // Only SOCKS5 authenticates in-band, so only SOCKS5 shows this field.
-      //
-      // The password is stored on the route and therefore written into the
-      // settings file with the rest of the config. It is handed to
-      // Socks5ProxyAgent as an option, never embedded in the proxy URL that
-      // the diagnostics surface.
-      route.protocol === "socks5" ? field(
+      // Every transport accepts a password now: SOCKS5 hands it to
+      // Socks5ProxyAgent as an option, HTTP/HTTPS embed it in the proxy URL
+      // userinfo (undici turns that into Proxy-Authorization). It is stored on
+      // the route, so it lands in the settings file with the rest of the
+      // config; the diagnostics only ever surface a credential-free origin.
+      field(
         t.password,
         h("input", {
           className: import_client.default.input,
@@ -471,8 +569,69 @@ function renderPage(ctx) {
           value: route.password,
           onChange: (event) => bind(row.id, "password")(event.target.value)
         }),
-        t.passwordHint
-      ) : void 0
+        route.protocol === "socks5" ? t.passwordHint : t.passwordHintProxy
+      ),
+      // The self-check only makes sense for a route that is ON; a disabled
+      // route is not in the Host's table, so there is nothing to test.
+      route.enabled ? h(
+        "div",
+        { className: import_client.default.testRow, style: S.testRow, key: `${row.id}:test` },
+        h(
+          "button",
+          {
+            className: import_client.default.testButton,
+            style: S.testButton,
+            type: "button",
+            disabled: result?.pending === true,
+            onClick: () => runTest(row.id)
+          },
+          result?.pending === true ? t.testRunning : t.testButton
+        ),
+        result?.pending === false ? h(
+          "span",
+          { className: import_client.default.testResult, style: S.testResult },
+          result.ok === true ? [
+            // Only the latency carries the band colour; the exit IP
+            // stays in the secondary label colour.
+            h(
+              "span",
+              { key: "lat", style: { color: latencyColor(result.ms) } },
+              `\u2713 ${typeof result.ms === "number" ? result.ms : "\u2014"} ms`
+            ),
+            result.ip === void 0 ? null : ` \xB7 ${t.exitIpLabel}${result.ip}`
+          ] : `\u2717 ${result.error}`
+        ) : null
+      ) : null,
+      // Target-host rules, collapsed so the common case stays one short card.
+      h(
+        "details",
+        { className: import_client.default.advanced, style: S.advanced, key: `${row.id}:rules` },
+        h("summary", { className: import_client.default.advancedSummary, style: S.advancedSummary }, t.advanced),
+        field(
+          t.onlyHosts,
+          h("input", {
+            className: import_client.default.input,
+            style: S.input,
+            disabled,
+            placeholder: "api.example.com",
+            value: route.onlyHosts,
+            onChange: (event) => bind(row.id, "onlyHosts")(event.target.value)
+          }),
+          t.onlyHostsHint
+        ),
+        field(
+          t.bypassHosts,
+          h("input", {
+            className: import_client.default.input,
+            style: S.input,
+            disabled,
+            placeholder: "localhost",
+            value: route.bypassHosts,
+            onChange: (event) => bind(row.id, "bypassHosts")(event.target.value)
+          }),
+          t.bypassHostsHint
+        )
+      )
     );
   });
   return h(
@@ -514,6 +673,18 @@ var EN = {
   password: "Password",
   hostHint: "Host or IP only, without scheme or path.",
   passwordHint: "Sent to the SOCKS5 proxy for authentication; stored with this setting.",
+  passwordHintProxy: "Sent to the proxy as an authentication password; stored with this setting.",
+  hitCountPrefix: "",
+  hitCountSuffix: " proxied",
+  testButton: "Test",
+  testRunning: "Testing\u2026",
+  testFailed: "Test failed",
+  exitIpLabel: "exit IP ",
+  advanced: "Advanced: target host rules",
+  onlyHosts: "Proxy only",
+  onlyHostsHint: "Comma/space separated; when set, only requests to these hosts are proxied (suffix match, * for all).",
+  bypassHosts: "Bypass",
+  bypassHostsHint: "Comma/space separated; requests to these hosts go direct, taking priority.",
   socks5Hint: "SOCKS5 tunnels the connection; the proxy resolves the target host name.",
   on: "proxied",
   live: "active",
@@ -532,6 +703,18 @@ var ZH = {
   password: "\u5BC6\u7801",
   hostHint: "\u53EA\u586B\u4E3B\u673A\u540D\u6216 IP\uFF0C\u4E0D\u8981\u5E26\u534F\u8BAE\u524D\u7F00\u6216\u8DEF\u5F84\u3002",
   passwordHint: "\u4EC5\u4F5C\u4E3A SOCKS5 \u8BA4\u8BC1\u53E3\u4EE4\u53D1\u9001\u7ED9\u4EE3\u7406\uFF1B\u968F\u8BE5\u8BBE\u7F6E\u4E00\u8D77\u4FDD\u5B58\u3002",
+  passwordHintProxy: "\u4F5C\u4E3A\u4EE3\u7406\u8BA4\u8BC1\u53E3\u4EE4\u53D1\u9001\u7ED9\u4EE3\u7406\uFF1B\u968F\u8BE5\u8BBE\u7F6E\u4E00\u8D77\u4FDD\u5B58\u3002",
+  hitCountPrefix: "\u5DF2\u4EE3\u7406 ",
+  hitCountSuffix: " \u6B21",
+  testButton: "\u6D4B\u8BD5",
+  testRunning: "\u6D4B\u8BD5\u4E2D\u2026",
+  testFailed: "\u6D4B\u8BD5\u5931\u8D25",
+  exitIpLabel: "\u51FA\u53E3 IP ",
+  advanced: "\u9AD8\u7EA7\uFF1A\u76EE\u6807\u57DF\u540D\u89C4\u5219",
+  onlyHosts: "\u4EC5\u8D70\u4EE3\u7406",
+  onlyHostsHint: "\u9017\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF1B\u975E\u7A7A\u65F6\u53EA\u6709\u5339\u914D\u8FD9\u4E9B\u4E3B\u673A\u7684\u8BF7\u6C42\u8D70\u4EE3\u7406\uFF08\u540E\u7F00\u5339\u914D\uFF0C* \u8868\u793A\u5168\u90E8\uFF09\u3002",
+  bypassHosts: "\u76F4\u8FDE",
+  bypassHostsHint: "\u9017\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF1B\u5339\u914D\u8FD9\u4E9B\u4E3B\u673A\u7684\u8BF7\u6C42\u76F4\u8FDE\uFF0C\u4F18\u5148\u4E8E\u4E0A\u4E00\u9879\u3002",
   socks5Hint: "SOCKS5 \u4F1A\u5EFA\u7ACB\u96A7\u9053\uFF0C\u76EE\u6807\u57DF\u540D\u7531\u4EE3\u7406\u7AEF\u89E3\u6790\u3002",
   on: "\u8D70\u4EE3\u7406",
   live: "\u542F\u7528\u4E2D",