dsh-provider-proxy 0.4.0 → 0.5.0

package/lib/index.js

@@ -44,10 +44,18 @@ function installSharedRouter() {
       return originalFetch.call(globalThis, input, init);
     }
     active.onHit?.();
-    return undiciFetch(input, {
+    const inFlight = undiciFetch(input, {
       ...init,
       dispatcher: active.dispatcher
     });
+    if (active.onSettle !== void 0) {
+      const settle = active.onSettle;
+      void inFlight.then(
+        (response) => settle(response.status < 500, response),
+        (error) => settle(false, error)
+      ).catch(() => void 0);
+    }
+    return inFlight;
   };
   Object.defineProperty(globalThis, "fetch", {
     ...descriptor ?? { configurable: true, enumerable: true, writable: true },
@@ -1017,9 +1025,27 @@ function vol(field) {
   return typeof volatile2 === "function" ? volatile2.call(field) : field;
 }
 var PROTOCOLS = ["http", "https", "socks5"];
+var DefaultProxy = z.object({
+  protocol: z.union(PROTOCOLS).default("http"),
+  /** Proxy host or IP, without scheme, port, or path. */
+  host: z.string().default(""),
+  /** Proxy port. 0 means "not configured". */
+  port: z.number().default(0),
+  username: z.string().default(""),
+  password: z.string().default("")
+});
 var ProviderProxyRoute = z.object({
   /** Whether this provider's calls are routed through the proxy below. */
   enabled: z.boolean().default(false),
+  /**
+   * When true, this route's TRANSPORT fields (protocol/host/port/username/
+   * password) come from the top-level `defaultProxy` instead of its own, so the
+   * same endpoint is configured once for every provider that shares it. The
+   * target-host rules and the self-check target stay the route's own. There is
+   * no partial inheritance: to use a different endpoint, turn this off and fill
+   * the fields in.
+   */
+  useDefault: z.boolean().default(false),
   /** Proxy transport. `socks5` is accepted but only honoured when the socks helper loaded. */
   protocol: z.union(PROTOCOLS).default("http"),
   /** Proxy host or IP, without scheme, port, or path. */
@@ -1036,11 +1062,31 @@ var ProviderProxyRoute = z.object({
    */
   onlyHosts: z.string().default(""),
   /** Comma/space-separated TARGET hosts that bypass the proxy; takes priority over `onlyHosts`. */
-  bypassHosts: z.string().default("")
+  bypassHosts: z.string().default(""),
+  /**
+   * Optional self-check target for THIS provider's 测试 button. Empty falls back
+   * to the top-level `testUrl`. Only the self-check reads it; routing never
+   * touches it, so a bad value costs a failed check, never a broken route.
+   */
+  testTarget: z.string().default("")
 });
 var Config = z.object({
   /** Per-provider proxy routes, keyed by provider route id (e.g. `sensenova`). */
   providers: vol(z.dict(ProviderProxyRoute).default({})),
+  /**
+   * Shared endpoint for every route that sets `useDefault`. Volatile for the
+   * same reason as `providers`: a settings write is committed into the running
+   * fiber instead of remounting the plugin.
+   */
+  defaultProxy: vol(DefaultProxy.default({})),
+  /**
+   * Whether a loopback/private-address target is sent DIRECT instead of through
+   * the proxy. On by default: such a target is normally a relay on this very
+   * machine (LiteLLM, Ollama, a local mock), which a forward proxy cannot reach
+   * at all — forcing it through one fails, and the failure reads as "the proxy
+   * is broken". Turn this off only when the proxy itself is the target.
+   */
+  localDirect: vol(z.boolean().default(true)),
   /**
    * URL the per-provider connection self-check requests THROUGH the proxy.
    * Volatile, so a settings write does not remount the plugin; the default is an
@@ -1048,12 +1094,28 @@ var Config = z.object({
    */
   testUrl: vol(z.string().default("https://api.ipify.org?format=json"))
 });
-function normalizeRoute(provider, raw) {
-  const route = ProviderProxyRoute(raw ?? {});
-  const value = typeof route.get === "function" ? route.get() : route;
+function plain(parsed) {
+  const get = parsed.get;
+  return typeof get === "function" ? get.call(parsed) : parsed;
+}
+function normalizeDefaultProxy(raw) {
+  const value = plain(DefaultProxy(raw ?? {}));
+  return {
+    protocol: value.protocol,
+    host: value.host.trim(),
+    port: value.port,
+    username: value.username.trim(),
+    password: value.password
+  };
+}
+function normalizeRoute(provider, raw, options) {
+  const value = plain(ProviderProxyRoute(raw ?? {}));
   const onlyHosts = value.onlyHosts.trim().toLowerCase();
   const bypassHosts = value.bypassHosts.trim().toLowerCase();
-  if (!value.enabled) return { ...value, port: value.port || 0, onlyHosts, bypassHosts };
+  const testTarget = value.testTarget.trim();
+  if (!value.enabled && options?.requireEnabled !== false) {
+    return { ...value, port: value.port || 0, onlyHosts, bypassHosts, testTarget };
+  }
   const host = value.host.trim();
   if (host.length === 0) {
     throw new TypeError(`dsh-provider-proxy: provider "${provider}" \u542F\u7528\u4E86\u4EE3\u7406\uFF0C\u4F46\u672A\u586B\u5199\u4EE3\u7406\u5730\u5740`);
@@ -1066,7 +1128,26 @@ function normalizeRoute(provider, raw) {
       `dsh-provider-proxy: provider "${provider}" \u7684\u4EE3\u7406\u7AEF\u53E3\u65E0\u6548\uFF08\u9700\u4E3A 1-65535 \u7684\u6574\u6570\uFF09`
     );
   }
-  return { ...value, host, username: value.username.trim(), onlyHosts, bypassHosts };
+  return { ...value, host, username: value.username.trim(), onlyHosts, bypassHosts, testTarget };
+}
+
+// src/proxy-address.ts
+function defaultProxyProblem(endpoint) {
+  const host = (endpoint.host ?? "").trim();
+  if (host.length === 0) return "\u672A\u586B\u5199\u4EE3\u7406\u5730\u5740";
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(host) || host.includes("/")) {
+    return "\u4EE3\u7406\u5730\u5740\u53EA\u586B\u4E3B\u673A\u540D\u6216 IP\uFF0C\u4E0D\u8981\u5E26\u534F\u8BAE\u524D\u7F00\u6216\u8DEF\u5F84";
+  }
+  const port = endpoint.port ?? 0;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    return "\u4EE3\u7406\u7AEF\u53E3\u65E0\u6548\uFF08\u9700\u4E3A 1-65535 \u7684\u6574\u6570\uFF09";
+  }
+  const hasUser = (endpoint.username ?? "").length > 0;
+  const hasPassword = (endpoint.password ?? "").length > 0;
+  if (hasUser !== hasPassword) {
+    return hasUser ? "\u914D\u7F6E\u4E86\u4EE3\u7406\u7528\u6237\u540D\u4F46\u6CA1\u6709\u5BC6\u7801\uFF1B\u8BF7\u8865\u5168\u5BC6\u7801\u6216\u6E05\u7A7A\u7528\u6237\u540D" : "\u914D\u7F6E\u4E86\u4EE3\u7406\u5BC6\u7801\u4F46\u6CA1\u6709\u7528\u6237\u540D\uFF1B\u8BF7\u8865\u5168\u7528\u6237\u540D\u6216\u6E05\u7A7A\u5BC6\u7801";
+  }
+  return void 0;
 }
 
 // src/proxy-table.ts
@@ -1099,56 +1180,115 @@ function hostMatches(host, rules) {
   }
   return false;
 }
-function buildDecide(route) {
+function isLocalHost(host) {
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  if (bare === "localhost" || bare.endsWith(".localhost")) return true;
+  if (bare === "::1") return true;
+  const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(bare);
+  if (octets === null) return false;
+  const [a, b, c, d] = octets.slice(1).map(Number);
+  if (a > 255 || b > 255 || c > 255 || d > 255) return false;
+  if (a === 127) return true;
+  if (a === 10) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  return false;
+}
+function buildDecide(route, localDirect) {
   const only = parseHostList(route.onlyHosts);
   const bypass = parseHostList(route.bypassHosts);
   return (host) => {
     if (host === void 0) return "proxy";
+    if (localDirect && isLocalHost(host)) return "direct";
     if (hostMatches(host, bypass)) return "direct";
     if (only.length > 0 && !hostMatches(host, only)) return "direct";
     return "proxy";
   };
 }
-function createProxyTable(config) {
-  const entries = /* @__PURE__ */ new Map();
-  const problems = /* @__PURE__ */ new Map();
-  for (const [provider, raw] of Object.entries(config ?? {})) {
-    let route;
-    try {
-      route = normalizeRoute(provider, raw);
-    } catch (error) {
-      problems.set(provider, error instanceof Error ? error.message : String(error));
-      continue;
-    }
-    if (!route.enabled) continue;
-    if (route.protocol === "socks5" && route.username.length > 0 && route.password.length === 0) {
-      problems.set(
-        provider,
-        "dsh-provider-proxy: SOCKS5 \u914D\u7F6E\u4E86\u7528\u6237\u540D\u4F46\u6CA1\u6709\u5BC6\u7801\uFF1B\u8BF7\u8865\u5168\u5BC6\u7801\u6216\u6E05\u7A7A\u7528\u6237\u540D"
-      );
-      continue;
-    }
-    if (route.protocol !== "socks5" && route.password.length > 0 && route.username.length === 0) {
-      problems.set(
-        provider,
-        "dsh-provider-proxy: \u914D\u7F6E\u4E86\u4EE3\u7406\u5BC6\u7801\u4F46\u6CA1\u6709\u7528\u6237\u540D\uFF1B\u8BF7\u8865\u5168\u7528\u6237\u540D\u6216\u6E05\u7A7A\u5BC6\u7801"
-      );
-      continue;
-    }
-    const url = proxyUrl(route);
-    let dispatcher;
-    try {
-      dispatcher = createDispatcher(route, url, route.password);
-    } catch (error) {
-      problems.set(provider, error instanceof Error ? error.message : String(error));
-      continue;
+function withDefaultProxy(route, defaultProxy) {
+  return {
+    ...route,
+    protocol: defaultProxy.protocol,
+    host: defaultProxy.host,
+    port: defaultProxy.port,
+    username: defaultProxy.username,
+    password: defaultProxy.password
+  };
+}
+function buildRouteEntry(provider, raw, options) {
+  let effective = raw;
+  if (raw?.useDefault === true) {
+    const why = defaultProxyProblem(options.defaultProxy);
+    if (why !== void 0) {
+      return {
+        ok: false,
+        problem: `dsh-provider-proxy: provider "${provider}" \u542F\u7528\u4E86\u300C\u4F7F\u7528\u9ED8\u8BA4\u4EE3\u7406\u300D\uFF0C\u4F46\u9876\u5C42\u9ED8\u8BA4\u4EE3\u7406\u4E0D\u53EF\u7528\uFF1A${why}`
+      };
     }
-    entries.set(provider, {
+    effective = withDefaultProxy(raw, options.defaultProxy);
+  }
+  let route;
+  try {
+    route = normalizeRoute(provider, effective, { requireEnabled: options.requireEnabled });
+  } catch (error) {
+    return { ok: false, problem: error instanceof Error ? error.message : String(error) };
+  }
+  if (route.protocol === "socks5" && route.username.length > 0 && route.password.length === 0) {
+    return {
+      ok: false,
+      problem: "dsh-provider-proxy: SOCKS5 \u914D\u7F6E\u4E86\u7528\u6237\u540D\u4F46\u6CA1\u6709\u5BC6\u7801\uFF1B\u8BF7\u8865\u5168\u5BC6\u7801\u6216\u6E05\u7A7A\u7528\u6237\u540D"
+    };
+  }
+  if (route.protocol === "socks5" && route.password.length > 0 && route.username.length === 0) {
+    return {
+      ok: false,
+      problem: "dsh-provider-proxy: SOCKS5 \u914D\u7F6E\u4E86\u5BC6\u7801\u4F46\u6CA1\u6709\u7528\u6237\u540D\uFF1B\u8BF7\u8865\u5168\u7528\u6237\u540D\u6216\u6E05\u7A7A\u5BC6\u7801"
+    };
+  }
+  if (route.protocol !== "socks5" && route.password.length > 0 && route.username.length === 0) {
+    return {
+      ok: false,
+      problem: "dsh-provider-proxy: \u914D\u7F6E\u4E86\u4EE3\u7406\u5BC6\u7801\u4F46\u6CA1\u6709\u7528\u6237\u540D\uFF1B\u8BF7\u8865\u5168\u7528\u6237\u540D\u6216\u6E05\u7A7A\u5BC6\u7801"
+    };
+  }
+  if (route.protocol !== "socks5" && route.username.length > 0 && route.password.length === 0) {
+    return {
+      ok: false,
+      problem: "dsh-provider-proxy: \u914D\u7F6E\u4E86\u4EE3\u7406\u7528\u6237\u540D\u4F46\u6CA1\u6709\u5BC6\u7801\uFF1B\u8BF7\u8865\u5168\u5BC6\u7801\u6216\u6E05\u7A7A\u7528\u6237\u540D"
+    };
+  }
+  const url = proxyUrl(route);
+  let dispatcher;
+  try {
+    dispatcher = createDispatcher(route, url, route.password);
+  } catch (error) {
+    return { ok: false, problem: error instanceof Error ? error.message : String(error) };
+  }
+  return {
+    ok: true,
+    entry: {
       provider,
       proxyOrigin: displayOrigin(route, url),
       dispatcher,
-      decide: buildDecide(route)
-    });
+      decide: buildDecide(route, options.localDirect),
+      testTarget: route.testTarget
+    }
+  };
+}
+function createProxyTable(config, options = {}) {
+  const entries = /* @__PURE__ */ new Map();
+  const problems = /* @__PURE__ */ new Map();
+  const buildOptions = {
+    defaultProxy: normalizeDefaultProxy(options.defaultProxy),
+    requireEnabled: true,
+    localDirect: options.localDirect !== false
+  };
+  for (const [provider, raw] of Object.entries(config ?? {})) {
+    if (raw?.enabled !== true) continue;
+    const built = buildRouteEntry(provider, raw, buildOptions);
+    if (!built.ok) problems.set(provider, built.problem);
+    else entries.set(provider, built.entry);
   }
   return { entries, problems };
 }
@@ -1169,6 +1309,20 @@ function plainProviders(config) {
   const value = typeof snapshot2 === "function" ? snapshot2.call(raw) : raw;
   return value ?? {};
 }
+function plainDefaultProxy(config) {
+  const raw = config?.defaultProxy;
+  if (raw === void 0) return {};
+  const snapshot2 = raw.get;
+  const value = typeof snapshot2 === "function" ? snapshot2.call(raw) : raw;
+  return value ?? {};
+}
+function plainLocalDirect(config) {
+  const raw = config?.localDirect;
+  if (raw === void 0) return true;
+  const snapshot2 = raw.get;
+  const value = typeof snapshot2 === "function" ? snapshot2.call(raw) : raw;
+  return value !== false;
+}
 function apply(ctx, config) {
   const router = acquireFetchRouter();
   let current = /* @__PURE__ */ new Map();
@@ -1176,18 +1330,69 @@ function apply(ctx, config) {
   let closed = false;
   let webAvailable = false;
   const hits = /* @__PURE__ */ new Map();
+  const lastUse = /* @__PURE__ */ new Map();
   const bump = (provider) => {
     hits.set(provider, (hits.get(provider) ?? 0) + 1);
+    lastUse.set(provider, { ...lastUse.get(provider), startedAt: Date.now() });
+  };
+  const settle = (provider) => (ok, detail) => {
+    const previous = lastUse.get(provider);
+    lastUse.set(provider, {
+      startedAt: previous?.startedAt ?? Date.now(),
+      // `at` is the FINISH time, written together with the outcome it belongs to.
+      at: Date.now(),
+      ok,
+      code: ok ? String(detail?.status ?? "") : failureCodeOf(detail)
+    });
   };
   const DEFAULT_TEST_URL = "https://api.ipify.org?format=json";
+  const MAX_TEST_TARGETS = 5;
   const TEST_TIMEOUT_MS = 1e4;
+  const MAX_REQUEST_BYTES = 8 * 1024;
   const selfChecks = /* @__PURE__ */ new Map();
-  const plainTestUrl = () => {
+  const SELF_CHECK_COOLDOWN_MS = 3e3;
+  const lastChecks = /* @__PURE__ */ new Map();
+  const plainTestUrls = () => {
     const raw = config?.testUrl;
     const snapshot2 = raw?.get;
     const value = typeof snapshot2 === "function" ? snapshot2.call(raw) : raw;
-    return typeof value === "string" && value.trim().length > 0 ? value.trim() : DEFAULT_TEST_URL;
+    const list = typeof value === "string" ? value.split(/[,\s]+/).map((entry) => entry.trim()).filter((entry) => entry.length > 0) : [];
+    return list.length > 0 ? list.slice(0, MAX_TEST_TARGETS) : [DEFAULT_TEST_URL];
+  };
+  const walk = (value, path) => {
+    let node = value;
+    for (const key of path) {
+      if (node === null || typeof node !== "object") return void 0;
+      node = node[key];
+    }
+    return node;
+  };
+  const upstreamOf = (provider) => {
+    let settings;
+    try {
+      settings = typeof ctx?.get === "function" ? ctx.get("settings") : void 0;
+    } catch {
+      return void 0;
+    }
+    if (settings === void 0 || typeof settings.get !== "function") return void 0;
+    let entry;
+    try {
+      const entries = ctx.llm?.listConfigurableProviders?.() ?? [];
+      entry = entries.find((candidate) => candidate?.provider === provider);
+    } catch {
+      return void 0;
+    }
+    if (entry === void 0) return void 0;
+    let profile;
+    try {
+      profile = walk(settings.get(entry.settingsNs), entry.settingsPath ?? []);
+    } catch {
+      return void 0;
+    }
+    const baseURL = profile?.baseURL;
+    return typeof baseURL === "string" && baseURL.trim().length > 0 ? baseURL.trim() : void 0;
   };
+  const bareMessage = (message) => message.replace(/^dsh-provider-proxy:\s*/, "");
   const causesOf = (error) => {
     const out = [];
     const seen = /* @__PURE__ */ new Set();
@@ -1204,10 +1409,11 @@ function apply(ctx, config) {
     }
     return out;
   };
-  const classifyTestError = (error) => {
+  const classifyTestError = (error, viaProxy) => {
     const chain = causesOf(error);
     const names = chain.map((node) => node.name).filter((name2) => typeof name2 === "string");
     const codes = chain.map((node) => node.code).filter((code2) => typeof code2 === "string");
+    const messages = chain.map((node) => node.message).filter((text) => typeof text === "string");
     const message = error instanceof Error ? error.message : String(error);
     if (names.includes("TimeoutError") || names.includes("AbortError")) {
       return { kind: "timeout", error: `\u8D85\u65F6\uFF08${TEST_TIMEOUT_MS / 1e3}s\uFF09\uFF1A\u4EE3\u7406\u6216\u76EE\u6807\u65E0\u54CD\u5E94` };
@@ -1215,27 +1421,43 @@ function apply(ctx, config) {
     const connectivity = ["ECONNREFUSED", "ENOTFOUND", "EHOSTUNREACH", "ENETUNREACH", "ECONNRESET", "EAI_AGAIN"];
     const code = connectivity.find((candidate) => codes.includes(candidate));
     if (code !== void 0) {
-      return { kind: "proxy-unreachable", error: `\u4EE3\u7406\u4E0D\u53EF\u8FBE\uFF08${code}\uFF09\uFF1A${message}` };
+      return viaProxy ? { kind: "proxy-unreachable", error: `\u4EE3\u7406\u4E0D\u53EF\u8FBE\uFF08${code}\uFF09\uFF1A${message}` } : { kind: "target", error: `\u76EE\u6807\u4E0D\u53EF\u8FBE\uFF08${code}\uFF09\uFF1A${message}` };
     }
-    if (names.includes("ProxyAuthentication") || message.includes("407")) {
+    if (names.includes("ProxyAuthentication") || messages.some((text) => text.includes("407"))) {
       return { kind: "proxy-auth", error: `\u4EE3\u7406\u8981\u6C42\u8BA4\u8BC1\uFF08HTTP 407\uFF09\uFF1A${message}` };
     }
     return { kind: "target", error: `\u8BF7\u6C42\u5931\u8D25\uFF1A${message}` };
   };
-  const runSelfCheck = async (provider) => {
-    const route = current.get(provider);
-    if (route === void 0) {
-      return { ok: false, kind: "no-route", error: `provider "${provider}" \u672A\u542F\u7528\u4EE3\u7406` };
+  const failureCodeOf = (error) => {
+    const chain = causesOf(error);
+    const names = chain.map((node) => node.name).filter((name2) => typeof name2 === "string");
+    if (names.includes("TimeoutError")) return "TIMEOUT";
+    if (names.includes("AbortError")) return "ABORTED";
+    for (const node of chain) {
+      const code = node.code;
+      if (typeof code === "string" && code.length > 0) return code;
     }
+    return "ERROR";
+  };
+  const probeTarget = async (target, route) => {
+    let host;
+    try {
+      host = new URL(target).hostname;
+    } catch {
+      return { ok: false, kind: "target", error: `\u81EA\u68C0\u76EE\u6807\u4E0D\u662F\u5408\u6CD5 URL\uFF1A${target}` };
+    }
+    const viaProxy = route.decide(host) === "proxy";
     const started = performance.now();
     try {
-      const response = await undiciFetch2(plainTestUrl(), {
-        dispatcher: route.dispatcher,
+      const response = await undiciFetch2(target, {
+        // A direct probe must NOT carry the dispatcher, or undici would force it
+        // through the proxy anyway.
+        ...viaProxy ? { dispatcher: route.dispatcher } : {},
         signal: AbortSignal.timeout(TEST_TIMEOUT_MS)
       });
       const ms = Math.round(performance.now() - started);
-      if (response.status === 407) {
-        return { ok: false, ms, status: 407, kind: "proxy-auth", error: "\u4EE3\u7406\u8981\u6C42\u8BA4\u8BC1\uFF08HTTP 407\uFF09" };
+      if (viaProxy && response.status === 407) {
+        return { ok: false, ms, status: 407, kind: "proxy-auth", viaProxy, error: "\u4EE3\u7406\u8981\u6C42\u8BA4\u8BC1\uFF08HTTP 407\uFF09" };
       }
       let exitIp;
       try {
@@ -1243,15 +1465,92 @@ function apply(ctx, config) {
         if (typeof body?.ip === "string" && body.ip.length > 0) exitIp = body.ip;
       } catch {
       }
+      const reachable = response.status < 500;
+      if (reachable) {
+        return {
+          ok: true,
+          ms,
+          status: response.status,
+          viaProxy,
+          ...exitIp === void 0 ? {} : { exitIp },
+          kind: "ok"
+        };
+      }
       return {
-        ok: response.ok === true,
+        ok: false,
         ms,
         status: response.status,
-        ...exitIp === void 0 ? {} : { exitIp },
-        kind: response.ok === true ? "ok" : "target"
+        viaProxy,
+        kind: "target",
+        error: `\u76EE\u6807\u8FD4\u56DE HTTP ${response.status}\uFF085xx\uFF0C\u4E0A\u6E38\u6216\u94FE\u8DEF\u5F02\u5E38\uFF09`
       };
     } catch (error) {
-      return { ok: false, ms: Math.round(performance.now() - started), ...classifyTestError(error) };
+      return {
+        ok: false,
+        ms: Math.round(performance.now() - started),
+        viaProxy,
+        ...classifyTestError(error, viaProxy)
+      };
+    }
+  };
+  const selfCheckTargets = (provider, testTarget) => {
+    const own = (testTarget ?? "").trim();
+    if (own.length > 0) return [own];
+    const upstream = upstreamOf(provider);
+    if (upstream !== void 0) return [upstream];
+    return plainTestUrls();
+  };
+  const selfCheckKey = (provider) => {
+    const raw = plainProviders(config)[provider] ?? {};
+    const endpoint = raw.useDefault === true ? plainDefaultProxy(config) : raw;
+    return JSON.stringify([
+      provider,
+      endpoint.protocol ?? "http",
+      endpoint.host ?? "",
+      endpoint.port ?? 0,
+      endpoint.username ?? "",
+      endpoint.password ?? "",
+      raw.testTarget ?? "",
+      raw.onlyHosts ?? "",
+      raw.bypassHosts ?? "",
+      plainLocalDirect(config),
+      selfCheckTargets(provider, raw.testTarget)
+    ]);
+  };
+  const runSelfCheck = async (provider) => {
+    let route = current.get(provider);
+    let temporary = false;
+    if (route === void 0) {
+      const problem = problems.get(provider);
+      if (problem !== void 0) {
+        return { ok: false, kind: "route-rejected", error: bareMessage(problem) };
+      }
+      const configured = plainProviders(config)[provider];
+      if (configured === void 0 || configured.enabled === true) {
+        return { ok: false, kind: "no-route", error: `provider "${provider}" \u672A\u542F\u7528\u4EE3\u7406` };
+      }
+      const built = buildRouteEntry(provider, configured, {
+        defaultProxy: normalizeDefaultProxy(plainDefaultProxy(config)),
+        requireEnabled: false,
+        localDirect: plainLocalDirect(config)
+      });
+      if (!built.ok) {
+        return { ok: false, kind: "route-rejected", error: bareMessage(built.problem) };
+      }
+      route = built.entry;
+      temporary = true;
+    }
+    try {
+      let last;
+      for (const target of selfCheckTargets(provider, route.testTarget)) {
+        const outcome = await probeTarget(target, route);
+        if (outcome.ok === true) return outcome;
+        last = outcome;
+        if (outcome.kind === "proxy-auth") break;
+      }
+      return last ?? { ok: false, kind: "target", error: "\u6CA1\u6709\u53EF\u7528\u7684\u81EA\u68C0\u76EE\u6807" };
+    } finally {
+      if (temporary) await route.dispatcher.close().catch(() => void 0);
     }
   };
   try {
@@ -1259,7 +1558,10 @@ function apply(ctx, config) {
   } catch {
   }
   const rebuild = async () => {
-    const next = createProxyTable(plainProviders(config));
+    const next = createProxyTable(plainProviders(config), {
+      defaultProxy: plainDefaultProxy(config),
+      localDirect: plainLocalDirect(config)
+    });
     const previous = current;
     current = next.entries;
     problems = next.problems;
@@ -1308,8 +1610,11 @@ function apply(ctx, config) {
           try {
             const text = JSON.stringify({
               ...catalog(),
-              problems: Object.fromEntries(problems),
-              hits: Object.fromEntries(hits)
+              problems: Object.fromEntries(
+                [...problems].map(([id, message]) => [id, bareMessage(message)])
+              ),
+              hits: Object.fromEntries(hits),
+              lastUse: Object.fromEntries(lastUse)
             });
             res.writeHead(200, {
               "content-type": "application/json; charset=utf-8",
@@ -1327,7 +1632,10 @@ function apply(ctx, config) {
         kind: "exact",
         path: "/dsh-provider-proxy/test",
         handler: (req, res) => {
+          let replied = false;
           const send = (status, payload) => {
+            if (replied) return;
+            replied = true;
             const text = JSON.stringify(payload);
             res.writeHead(status, {
               "content-type": "application/json; charset=utf-8",
@@ -1344,10 +1652,24 @@ function apply(ctx, config) {
             send(400, { ok: false, kind: "body", error: "\u65E0\u6CD5\u8BFB\u53D6\u8BF7\u6C42\u4F53" });
             return;
           }
+          let bytes = 0;
           const chunks = [];
-          req.on("data", (chunk) => chunks.push(chunk));
+          req.on("data", (chunk) => {
+            if (replied) return;
+            bytes += chunk.length;
+            if (bytes > MAX_REQUEST_BYTES) {
+              send(413, {
+                ok: false,
+                kind: "body",
+                error: `\u8BF7\u6C42\u4F53\u8D85\u8FC7 ${MAX_REQUEST_BYTES} \u5B57\u8282\u4E0A\u9650`
+              });
+              return;
+            }
+            chunks.push(chunk);
+          });
           req.on("error", () => send(400, { ok: false, kind: "body", error: "\u8BFB\u53D6\u8BF7\u6C42\u4F53\u5931\u8D25" }));
           req.on("end", () => {
+            if (replied) return;
             void (async () => {
               let provider;
               try {
@@ -1361,12 +1683,21 @@ function apply(ctx, config) {
                 send(400, { ok: false, kind: "body", error: "\u7F3A\u5C11 provider" });
                 return;
               }
-              let pending = selfChecks.get(provider);
+              const key = selfCheckKey(provider);
+              let pending = selfChecks.get(key);
               if (pending === void 0) {
-                pending = runSelfCheck(provider);
-                selfChecks.set(provider, pending);
+                const last = lastChecks.get(key);
+                if (last !== void 0 && Date.now() - last.at < SELF_CHECK_COOLDOWN_MS) {
+                  send(200, { ...last.result, cached: true });
+                  return;
+                }
+                pending = runSelfCheck(provider).then((result) => {
+                  lastChecks.set(key, { at: Date.now(), result });
+                  return result;
+                });
+                selfChecks.set(key, pending);
                 void pending.finally(() => {
-                  if (selfChecks.get(provider) === pending) selfChecks.delete(provider);
+                  if (selfChecks.get(key) === pending) selfChecks.delete(key);
                 });
               }
               send(200, await pending);
@@ -1391,8 +1722,8 @@ function apply(ctx, config) {
       return router.run(
         {
           dispatcher: route.dispatcher,
-          provider: WEB_SEARCH_KEY,
           onHit: () => bump(WEB_SEARCH_KEY),
+          onSettle: settle(WEB_SEARCH_KEY),
           decide: route.decide
         },
         () => original.call(this, request, signal)
@@ -1401,7 +1732,7 @@ function apply(ctx, config) {
     web.search = patched;
     const registerEffect = typeof wctx?.effect === "function" ? wctx.effect.bind(wctx) : ctx.effect?.bind(ctx);
     registerEffect?.(() => () => {
-      if (web.search === patched) web.search = original;
+      if (Object.getOwnPropertyDescriptor(web, "search")?.value === patched) delete web.search;
     });
   });
   ctx.effect(() => {
@@ -1415,8 +1746,8 @@ function apply(ctx, config) {
         return router.wrap(
           {
             dispatcher: route.dispatcher,
-            provider,
             onHit: () => bump(provider),
+            onSettle: settle(provider),
             decide: route.decide
           },
           next
@@ -1446,7 +1777,8 @@ function apply(ctx, config) {
         proxyOrigin: entry.proxyOrigin
       })),
       problems: Object.fromEntries(problems),
-      hits: Object.fromEntries(hits)
+      hits: Object.fromEntries(hits),
+      lastUse: Object.fromEntries(lastUse)
     })
   });
 }
@@ -1457,10 +1789,13 @@ export {
   WEB_SEARCH_KEY,
   acquireFetchRouter,
   apply,
+  buildRouteEntry,
   closeTable,
   createProxyTable,
+  defaultProxyProblem,
   inject,
   name,
+  normalizeDefaultProxy,
   normalizeRoute,
   proxyUrl
 };