dsh-provider-proxy 0.5.1 → 0.6.1

package/README.md

@@ -77,6 +77,11 @@ Host catalog 是否列出某个 provider（`live`）不影响已保存路由的
   因为成功判据在响应头到达时就已成立（流式转发不能靠消费 body 来判断）。
   「最近调用」的时间取请求**发起**时刻；「最近成功 / 失败」的结果与时间来自最近一次**结束**的请求——
   两者分开记录，并发调用下不会把一次请求的发起时间配到另一次的结果上。
+  **这条记录只属于当前路由配置**：改代理端点、凭据、`useDefault` 的默认端点、目标域名规则或
+  `localDirect` 后，该 provider 的「最近调用」会变成「尚无代理记录」；`testUrl` / `testTarget`
+  只影响测试，不会清掉它。仅关闭再打开代理开关也保留记录。修改配置前已经启动的请求不会把旧结果
+  写回新配置；删除后重新添加同名 provider 同样视为一条新路由。`hits` 命中计数是历史累计，
+  上述配置变化都不会清空它。
 
 页面顶部与顶层还有三项整页设置（写在 `cordis.patch.yml`，也可以直接编辑）：
 
@@ -86,6 +91,10 @@ Host catalog 是否列出某个 provider（`live`）不影响已保存路由的
 | `localDirect` | `true` | 本机 / 内网目标是否直连（见「目标域名规则」一节） |
 | `testUrl` | `https://api.ipify.org?format=json` | 自检的最后兜底目标；可写多个（逗号或空格分隔，上限 5 个），按序回退 |
 
+其中的 `localDirect` 与 `testUrl` 也可以在默认代理区块下方的 **全局设置（高级）** 折叠块里修改：
+`testUrl` 留空时 Host 使用内置默认值，非法候选或超过 5 项只会提示、不会阻止保存；
+`localDirect` 默认勾选。修改任一项都会清空页面上所有自检结果，并且点「测试」前会把待写设置先落盘。
+
 列表只包含**已激活**的 provider（`llm.listProviders()` 能列出的那些）。仅在配置里声明、
 但没有实际注册的可配置 provider 不显示——它的请求根本不会被发出去。
 已经在 `providers` 里配过代理的条目即使暂时不激活也仍然保留，避免已保存的设置悄悄消失；
@@ -93,10 +102,18 @@ catalog 的 `live` 只影响未配置 provider 是否出现在列表里，不参
 
 保存立即对新请求生效，不需要重启；正在进行中的流会继续用它启动时的那条连接。
 
-每张卡片还有一个 **测试** 按钮：点它会让 Host 通过**该 provider 自己的代理**发一次请求，回报延迟与（探测目标返回时）出口 IP。只要该卡片有完整端点它就会出现——**不必先启用**；未启用的检查会标注为「未启用，仅测试」。代理不可达时它会明确失败，而不是假通过。结果与当前配置绑定：改端点 / 凭据 / 自检目标 / 域名规则后旧结果会立即消失；点「测试」前会先把防抖中的设置写入，Host 测的是刚填的值。
+设置写入失败时，字段会回滚，并在页面顶部显示「保存失败：<字段> — <原因>」和关闭按钮；下一次成功写入或点击关闭后消失。多次失败只保留最新一条。写入成功与失败的诊断都不会包含密码值，密码字段固定显示「值已隐藏」。
+
+每张卡片还有一个 **测试** 按钮：点它会让 Host 通过**该 provider 自己的代理**发一次请求，回报 HTTP 状态、延迟、脱敏后的探测目标与（探测目标返回时）出口 IP；冷却命中时标注「缓存」。只要该卡片有完整端点它就会出现——**不必先启用**；未启用的检查会标注为「未启用，仅测试」。代理不可达时它会明确失败，而不是假通过。结果与当前配置绑定：改端点 / 凭据 / 自检目标 / 域名规则 / 全局设置后旧结果会立即消失；点「测试」前会先把防抖中的设置写入，Host 测的是刚填的值。
+
+探测目标在 Host 侧脱敏后才进入响应：合法 URL 只保留 `origin + pathname`，userinfo、query 与 fragment 都不会出现在结果、诊断或错误文本里；非法 URL 也会去掉 userinfo / query / fragment 并截断长度。网络错误同样不会回显原始目标。
 
 **目标与判定口径**：目标按三级取用——卡片的 `自检目标` → 该 provider 的真实上游（见下一节）→ 顶层 `testUrl`（可写多个候选，按序回退，命中任一即停；`407` 会提前终止，因为那是代理的问题）。结果按状态码分类：
 
+结果行会标出**这次用的是哪一级**：`（本卡片自检目标）` / `（该 provider 的真实上游）` / `（全局自检地址）`。
+所以「改了 `testUrl` 但某张卡片没变」是可以解释的——该 provider 自己发布了真实上游，本就不读 `testUrl`；
+要覆盖它，请在那张卡片的「高级 → 自检目标」里显式填写。
+
 | 状态 | 含义 |
 | --- | --- |
 | `407` | 代理要求认证 |
@@ -104,7 +121,8 @@ catalog 的 `live` 只影响未配置 provider 是否出现在列表里，不参
 | `5xx` | 疑似代理或上游故障。HTTP 代理够不到上游时会**自己**回 502/503/504 |
 | 抛出（`ECONNREFUSED`、超时等） | 按失败原因分类，不会假通过 |
 
-延迟数值按快慢着色——≤500 ms 绿、≤1500 ms 黄、更慢红——但数值始终照常显示，颜色只是辅助。
+延迟数值按快慢着色——≤500 ms 绿、≤1500 ms 黄、更慢红——但**只有延迟数字**带这个颜色，
+状态码、目标与其它文字用普通标签色。一次超过 1500 ms 的成功检查仍然是成功，不会整行变红。
 
 **自检遵循与真实流量相同的代理 / 直连判定。** 目标命中本机 / 内网地址、`bypassHosts`，或落在 `onlyHosts` 之外时，自检与路由一样**直连**——不把一个到不了该目标的请求塞给代理，也就不会把一条健康路由报成「代理坏了」。直连成功时卡片会标注「· 直连（未经过代理）」，直连失败则报「目标不可达」而非指向从未使用的代理。
 
@@ -121,7 +139,7 @@ catalog 的 `live` 只影响未配置 provider 是否出现在列表里，不参
 
 **指向本机或内网的请求默认直连。** 目标主机命中 `localhost`（含子域）、`127.0.0.0/8`、`::1`、`10.0.0.0/8`、`172.16.0.0/12`、`192.168.0.0/16`、`169.254.0.0/16` 时不经代理。这类目标通常是跑在同一台机器上的中转（LiteLLM、Ollama、本地 mock），正向代理根本到不了它，硬走代理只会失败，而且失败看起来像「代理坏了」。顶层 `localDirect: false` 可关掉这条（例如代理本身就是目标）。
 
-带协议前缀（`https://…`）或路径（`example.com/v1`）的条目永远匹配不上——规则只认主机名。这类条目会在输入框下以错误色标出，因为后果是静默的：`onlyHosts` 里的死条目会让 fail-closed 把流量直连出去，而用户以为已经走代理。
+带协议前缀（`https://…`）、路径（`example.com/v1`）、端口（`example.com:443`）或杂散通配符（`*foo`、`foo*`）的条目永远匹配不上——规则只认主机名，通配符只能是单独的 `*` 或以 `*.` 开头；单独的 `*.` 也视为死条目。方括号 IPv6 字面量（如 `[::1]`）是合法的。这类条目会在输入框下以错误色标出，因为后果是静默的：`onlyHosts` 里的死条目会让 fail-closed 把流量直连出去，而用户以为已经走代理。Host 与设置页使用同一份共享解析 / 判定逻辑。
 
 当组成里存在 web 服务时，列表还会多出一张 **Web 搜索** 卡片（保留 id `web-search`，字段与其它卡片完全相同，也支持自检、计数与域名规则）。它承载 `web_search` 工具的流量；不启用它，搜索保持直连。
 
@@ -181,7 +199,7 @@ catalog 的 `live` 只影响未配置 provider 是否出现在列表里，不参
 
 ```sh
 npm run build      # 构建 lib/index.js 与 lib/client.js
-npm test           # 218 个用例，跑的是构建产物
+npm test           # 248 个用例，跑的是构建产物
 npm run typecheck  # 类型检查（仅覆盖 src/）
 npm run verify     # 上面三件事，按顺序
 ```

package/lib/client.js

@@ -64,6 +64,31 @@ __export(client_exports, {
 module.exports = __toCommonJS(client_exports);
 var import_client = __toESM(require_client(), 1);
 
+// src/host-rules.ts
+function splitHostRules(raw) {
+  return raw.split(/[,\s]+/).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+function normalizeHostRule(raw) {
+  return raw.trim().replace(/^\*?\./, "").toLowerCase();
+}
+function isBracketedIpv6(token) {
+  return /^\[[0-9a-f:.]+\]$/i.test(token);
+}
+function hostRuleProblem(raw) {
+  const token = raw.trim();
+  if (token.length === 0) return void 0;
+  if (token === "*." || normalizeHostRule(token).length === 0) return "\u7A7A\u901A\u914D\u7B26";
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token)) return "\u5E26\u534F\u8BAE\u524D\u7F00";
+  if (token.includes("/")) return "\u5E26\u8DEF\u5F84";
+  if (token.includes(":") && !isBracketedIpv6(token)) return "\u5E26\u7AEF\u53E3\u6216\u975E\u6CD5\u5192\u53F7";
+  const withoutLeadingWildcard = token.replace(/^\*\./, "");
+  if (withoutLeadingWildcard.includes("*") && token !== "*") return "\u6742\u6563\u901A\u914D\u7B26";
+  return void 0;
+}
+function deadRuleEntries(raw) {
+  return splitHostRules(raw).filter((entry) => hostRuleProblem(entry) !== void 0);
+}
+
 // src/proxy-address.ts
 var PROXY_HOST_INVALID = "\u4EE3\u7406\u5730\u5740\u53EA\u80FD\u586B IPv4\u3001IPv6 \u6216\u57DF\u540D";
 var IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
@@ -203,6 +228,8 @@ var CATALOG_PATH = "/dsh-provider-proxy/providers";
 var TEST_PATH = "/dsh-provider-proxy/test";
 var LATENCY_FAST_MS = 500;
 var LATENCY_SLOW_MS = 1500;
+var DEFAULT_TEST_URL = "https://api.ipify.org?format=json";
+var MAX_TEST_URLS = 5;
 function latencyColor(ms) {
   if (typeof ms !== "number" || !Number.isFinite(ms)) return "var(--dsw-alias-label-secondary)";
   if (ms <= LATENCY_FAST_MS) return "var(--dsw-alias-state-success-primary, #2ea043)";
@@ -216,6 +243,10 @@ function testResultFrom(body, strings) {
     ok,
     ms: typeof body?.ms === "number" && Number.isFinite(body.ms) ? body.ms : void 0,
     ip: typeof body?.exitIp === "string" && body.exitIp.length > 0 ? body.exitIp : void 0,
+    status: typeof body?.status === "number" && Number.isInteger(body.status) ? body.status : void 0,
+    target: typeof body?.target === "string" && body.target.length > 0 ? body.target : void 0,
+    targetSource: body?.targetSource === "route" || body?.targetSource === "upstream" ? body.targetSource : body?.targetSource === "testUrl" ? "testUrl" : void 0,
+    cached: body?.cached === true,
     // The Host probes a target the way routing would: a loopback/private upstream
     // (or a bypassHosts match) is reached DIRECT, not through the proxy. The card
     // says so, so a green check is not read as "the proxy works".
@@ -223,6 +254,57 @@ function testResultFrom(body, strings) {
     error: ok ? void 0 : typeof body?.error === "string" && body.error.length > 0 ? body.error : strings.testFailed
   };
 }
+function splitTestUrls(raw) {
+  return raw.split(/[,\s]+/).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+function testUrlHint(raw, t) {
+  const entries = splitTestUrls(raw);
+  if (entries.length === 0) return t.testUrlEmptyHint;
+  const invalid = entries.filter((entry) => !isAbsoluteHttpUrl(entry));
+  if (invalid.length > 0) return t.testUrlInvalidHint;
+  if (entries.length > MAX_TEST_URLS) return t.testUrlTooManyHint;
+  return void 0;
+}
+function isAbsoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && url.hostname.length > 0;
+  } catch {
+    return false;
+  }
+}
+function targetSourceSuffix(result, t) {
+  switch (result.targetSource) {
+    case "route":
+      return t.targetSourceRoute;
+    case "upstream":
+      return t.targetSourceUpstream;
+    case "testUrl":
+      return t.targetSourceTestUrl;
+    default:
+      return "";
+  }
+}
+function redactSensitiveText(text, secrets = []) {
+  let safe = text;
+  for (const secret of secrets) {
+    if (typeof secret !== "string" || secret.length === 0) continue;
+    safe = safe.split(secret).join("***");
+  }
+  safe = safe.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, "$1");
+  safe = safe.replace(/([?&#])[^\s"'<>]*/g, "$1");
+  return safe.length > 500 ? `${safe.slice(0, 500)}\u2026` : safe;
+}
+function secretsFromOps(ops) {
+  const out = [];
+  for (const op of ops) {
+    const field = op?.path?.[op.path.length - 1];
+    if (field === "password" && typeof op?.value === "string" && op.value.length > 0) {
+      out.push(op.value);
+    }
+  }
+  return out;
+}
 var catalogueSetter = () => {
 };
 function relativeTime(at, t) {
@@ -293,9 +375,6 @@ function touchCatalogPolling() {
   }, CATALOG_REFRESH_MS);
 }
 var byName = (a, b) => a.name.localeCompare(b.name);
-function deadRuleEntries(raw) {
-  return raw.split(/[,\s]+/).map((entry) => entry.trim()).filter((entry) => /^[a-z][a-z0-9+.-]*:\/\//i.test(entry) || entry.includes("/"));
-}
 function view(route) {
   return {
     enabled: route?.enabled === true,
@@ -462,6 +541,14 @@ var S = {
     cursor: "pointer"
   },
   testResult: {
+    // A flex row so the target can drop onto its own line: the container was a
+    // plain span, where `flexBasis: 100%` does nothing and the target ran into
+    // the "cached" label.
+    display: "flex",
+    flexWrap: "wrap",
+    alignItems: "baseline",
+    columnGap: "6px",
+    rowGap: "2px",
     fontSize: "11px",
     color: "var(--dsw-alias-label-secondary)",
     wordBreak: "break-all"
@@ -570,6 +657,19 @@ var S = {
     color: "var(--dsw-alias-label-primary)",
     font: "inherit",
     fontSize: "12px"
+  },
+  diag: {
+    marginTop: "4px",
+    padding: "8px 10px",
+    border: "1px solid var(--dsw-alias-border-l1)",
+    borderRadius: "8px",
+    fontSize: "11px",
+    color: "var(--dsw-alias-label-secondary)"
+  },
+  hint: {
+    gridColumn: "2",
+    fontSize: "11px",
+    color: "var(--dsw-alias-label-secondary)"
   }
 };
 function renderPage(ctx) {
@@ -641,6 +741,13 @@ function renderPage(ctx) {
   const [defaultDraft, setDefaultDraft] = (React.useState ?? ((v) => [v, () => {
   }]))({});
   const editDefault = (field2, value) => setDefaultDraft((current) => ({ ...current, [field2]: value }));
+  const [globalDraft, setGlobalDraft] = (React.useState ?? ((v) => [v, () => {
+  }]))({});
+  const editGlobal = (field2, value) => setGlobalDraft((current) => ({ ...current, [field2]: value }));
+  const [saveError, setSaveError] = (React.useState ?? ((v) => [v, () => {
+  }]))(void 0);
+  const [savedNote, setSavedNote] = (React.useState ?? ((v) => [v, () => {
+  }]))(void 0);
   const [tests, setTests] = (React.useState ?? ((v) => [v, () => {
   }]))({});
   const invalidateTests = (ids) => {
@@ -668,7 +775,7 @@ function renderPage(ctx) {
     void (async () => {
       try {
         for (const [key, entry] of [...pendingWrites]) {
-          if (key.startsWith(`${id}\0`) || key.startsWith("\0default\0")) {
+          if (key.startsWith(`${id}\0`) || key.startsWith("\0default\0") || key.startsWith("\0global\0")) {
             void entry.flush();
           }
         }
@@ -694,12 +801,20 @@ function renderPage(ctx) {
   const rows = knownProviders({ ...configured, ...draft }, published);
   const inheritingIds = () => rows.filter((row) => view({ ...configured[row.id], ...draft[row.id] }).useDefault === true).map((row) => row.id);
   const save = (key, path, label, value, onRefused) => {
+    const field2 = path[path.length - 1];
+    const secret = field2 === "password" && typeof value === "string" ? value : void 0;
+    const safeLabel = secret === void 0 ? label : `${label}\uFF08\u503C\u5DF2\u9690\u85CF\uFF09`;
     scheduleWrite(
       key,
       () => writeConfig(ctx, [{ op: "set", path, value }]).then(() => {
-        note(`\u5DF2\u4FDD\u5B58 ${label} = ${JSON.stringify(value)}`);
+        setSaveError(void 0);
+        setSavedNote(secret === void 0 ? `\u5DF2\u4FDD\u5B58 ${label}` : `\u5DF2\u4FDD\u5B58 ${safeLabel}`);
       }).catch((error) => {
-        note(`\u4FDD\u5B58\u5931\u8D25 ${label}\uFF1A${error?.message ?? error}`);
+        const message = redactSensitiveText(String(error?.message ?? error), [
+          ...secret === void 0 ? [] : [secret]
+        ]);
+        setSavedNote(void 0);
+        setSaveError({ label: safeLabel, message });
         onRefused();
       })
     );
@@ -739,13 +854,31 @@ function renderPage(ctx) {
       });
     });
   };
+  const bindGlobal = (field2) => (value) => {
+    editGlobal(field2, value);
+    invalidateTests(rows.map((row) => row.id));
+    save(`\0global\0${field2}`, [field2], field2, value, () => {
+      setGlobalDraft((current) => {
+        if (current[field2] === void 0) return current;
+        const next = { ...current };
+        delete next[field2];
+        return next;
+      });
+    });
+  };
   const saveMany = (key, ops, label, onRefused) => {
+    const secrets = secretsFromOps(ops);
+    const hidesValues = ops.some((op) => op?.path?.[op.path.length - 1] === "password");
+    const safeLabel = hidesValues ? `${label}\uFF08\u503C\u5DF2\u9690\u85CF\uFF09` : label;
     scheduleWrite(
       key,
       () => writeConfig(ctx, ops).then(() => {
-        note(`\u5DF2\u4FDD\u5B58 ${label}`);
+        setSaveError(void 0);
+        setSavedNote(`\u5DF2\u4FDD\u5B58 ${safeLabel}`);
       }).catch((error) => {
-        note(`\u4FDD\u5B58\u5931\u8D25 ${label}\uFF1A${error?.message ?? error}`);
+        const message = redactSensitiveText(String(error?.message ?? error), secrets);
+        setSavedNote(void 0);
+        setSaveError({ label: safeLabel, message });
         onRefused();
       })
     );
@@ -968,6 +1101,75 @@ function renderPage(ctx) {
       )
     )
   );
+  const storedTestUrl = typeof snapshot.value?.testUrl === "string" ? snapshot.value.testUrl : DEFAULT_TEST_URL;
+  const storedLocalDirect = snapshot.value?.localDirect !== false;
+  const globalTestUrl = typeof globalDraft.testUrl === "string" ? globalDraft.testUrl : storedTestUrl;
+  const globalLocalDirect = typeof globalDraft.localDirect === "boolean" ? globalDraft.localDirect : storedLocalDirect;
+  const globalTestUrlHint = testUrlHint(globalTestUrl, t);
+  const globalBlock = h(
+    "details",
+    {
+      className: import_client.default.diag,
+      style: {
+        ...S.diag,
+        marginTop: "0"
+      },
+      key: "global-settings"
+    },
+    h("summary", { className: import_client.default.diagSummary }, t.globalTitle),
+    h("p", { className: import_client.default.defaultLead, style: S.defaultLead }, t.globalLead),
+    h(
+      "label",
+      { className: import_client.default.field, style: S.field },
+      h("span", { className: import_client.default.label, style: S.label }, t.testUrl),
+      h("input", {
+        className: import_client.default.input,
+        style: S.input,
+        value: globalTestUrl,
+        onChange: (event) => bindGlobal("testUrl")(event.target.value)
+      }),
+      globalTestUrlHint === void 0 ? h("span", { style: S.hint }, t.testUrlHint) : h(
+        "span",
+        {
+          className: import_client.default.hint,
+          style: {
+            ...S.hint,
+            color: "var(--dsw-alias-state-error-primary, #f85149)"
+          }
+        },
+        globalTestUrlHint
+      )
+    ),
+    h(
+      "div",
+      { style: S.testRow },
+      h(
+        "button",
+        {
+          className: import_client.default.testButton,
+          style: S.testButton,
+          type: "button",
+          onClick: () => bindGlobal("testUrl")(DEFAULT_TEST_URL)
+        },
+        t.restoreDefaultTestUrl
+      )
+    ),
+    h(
+      "label",
+      { className: import_client.default.toggle, style: S.toggle },
+      h("input", {
+        type: "checkbox",
+        checked: globalLocalDirect,
+        onChange: (event) => bindGlobal("localDirect")(event.target.checked === true)
+      }),
+      h("span", null, t.localDirect)
+    ),
+    h(
+      "p",
+      { style: S.hint },
+      globalLocalDirect ? t.localDirectOnHint : t.localDirectOffHint
+    )
+  );
   const query = filter.trim().toLowerCase();
   const shown = query.length === 0 ? rows : rows.filter((row) => `${row.id} ${row.name}`.toLowerCase().includes(query));
   const filterRow = rows.length === 0 ? null : field(
@@ -1186,19 +1388,56 @@ function renderPage(ctx) {
           result?.pending === true ? t.testRunning : t.testButton
         ),
         result?.pending === false ? h(
-          "span",
+          "div",
           { style: S.testResult },
           result.ok === true ? [
-            // Only the latency carries the band colour; the exit IP
-            // stays in the secondary label colour.
+            // The band colour belongs to the LATENCY alone. The
+            // status sits beside it in the plain label colour:
+            // colouring the whole line made a successful check
+            // over 1500 ms read as a failure.
             h(
               "span",
               { key: "lat", style: { color: latencyColor(result.ms) } },
               `\u2713 ${typeof result.ms === "number" ? result.ms : "\u2014"} ms`
             ),
-            result.ip === void 0 ? null : ` \xB7 ${t.exitIpLabel}${result.ip}`,
-            result.direct === true ? ` \xB7 ${t.directLabel}` : null
-          ] : h("span", { key: "err", style: S.testFailure }, `\u2717 ${result.error}`)
+            typeof result.status === "number" ? h(
+              "span",
+              { key: "status" },
+              `HTTP ${result.status}`
+            ) : null,
+            result.ip === void 0 ? null : h("span", { key: "ip" }, `${t.exitIpLabel}${result.ip}`),
+            result.direct === true ? h("span", { key: "direct" }, t.directLabel) : null,
+            result.cached === true ? h("span", { key: "cached" }, t.cachedLabel) : null,
+            result.target === void 0 ? null : h(
+              "span",
+              {
+                key: "target",
+                style: {
+                  flexBasis: "100%",
+                  fontSize: "11px",
+                  color: "var(--dsw-alias-label-secondary)",
+                  wordBreak: "break-all"
+                }
+              },
+              `${t.testTargetLabel}${result.target}${targetSourceSuffix(result, t)}`
+            )
+          ] : [
+            h("span", { key: "err", style: S.testFailure }, `\u2717 ${result.error}`),
+            typeof result.status === "number" ? h("span", { key: "status" }, `HTTP ${result.status}`) : null,
+            result.target === void 0 ? null : h(
+              "span",
+              {
+                key: "target",
+                style: {
+                  flexBasis: "100%",
+                  fontSize: "11px",
+                  color: "var(--dsw-alias-label-secondary)",
+                  wordBreak: "break-all"
+                }
+              },
+              `${t.testTargetLabel}${result.target}${targetSourceSuffix(result, t)}`
+            )
+          ]
         ) : null,
         // Promote this card's endpoint to the shared default. Offered only
         // when the card carries its OWN endpoint: an inheriting card would
@@ -1264,7 +1503,40 @@ function renderPage(ctx) {
     "div",
     { className: import_client.default.root, style: S.root },
     h("p", { className: import_client.default.lead, style: { margin: "0 0 4px", fontSize: "12px", lineHeight: "1.6", color: "var(--dsw-alias-label-secondary)" } }, t.lead),
+    saveError === void 0 ? null : h(
+      "div",
+      {
+        role: "alert",
+        key: "save-error",
+        style: {
+          display: "flex",
+          alignItems: "flex-start",
+          justifyContent: "space-between",
+          gap: "10px",
+          padding: "8px 10px",
+          border: "1px solid var(--dsw-alias-state-error-primary, #f85149)",
+          borderRadius: "8px",
+          background: "var(--dsw-alias-bg-layer-1)",
+          color: "var(--dsw-alias-state-error-primary, #f85149)",
+          fontSize: "12px",
+          fontWeight: "500",
+          wordBreak: "break-all"
+        }
+      },
+      h("span", null, `${t.saveFailedPrefix}${saveError.label} \u2014 ${saveError.message}`),
+      h(
+        "button",
+        {
+          className: import_client.default.testButton,
+          style: { ...S.testButton, flex: "none" },
+          type: "button",
+          onClick: () => setSaveError(void 0)
+        },
+        t.close
+      )
+    ),
     defaultBlock,
+    globalBlock,
     catalogueNotice,
     filterRow,
     ...body,
@@ -1293,8 +1565,9 @@ function renderPage(ctx) {
       h(
         "ul",
         { className: import_client.default.diagList, style: { margin: "6px 0 0", paddingLeft: "18px" } },
-        ...problemCount === 0 && diagnostics.length === 0 ? [h("li", { key: "none" }, t.diagPending)] : [
+        ...problemCount === 0 && diagnostics.length === 0 && savedNote === void 0 ? [h("li", { key: "none" }, t.diagPending)] : [
           ...problemLines,
+          ...savedNote === void 0 ? [] : [h("li", { key: "saved" }, savedNote)],
           ...diagnostics.map((line, index) => h("li", { key: `d${index}` }, line))
         ]
       )
@@ -1342,12 +1615,28 @@ var EN = {
   testFailed: "Test failed",
   exitIpLabel: "exit IP ",
   directLabel: "direct (not through the proxy)",
+  cachedLabel: "cached",
+  testTargetLabel: "Target: ",
+  targetSourceRoute: " (this card's own target)",
+  targetSourceUpstream: " (this provider's real upstream)",
+  targetSourceTestUrl: " (global self-check URL)",
+  globalTitle: "Global settings (advanced)",
+  globalLead: "These fields are saved with the plugin rather than per provider. Leave testUrl empty to use the built-in default; comma/space separated candidates are tried in order and only the first 5 are used. localDirect is on by default; turn it off only when the proxy itself is a loopback or private target.",
+  testUrl: "Self-check URL",
+  testUrlHint: "Comma/space separated; http(s) URLs in the order they should be tried.",
+  testUrlEmptyHint: "Empty means the Host uses its built-in default URL.",
+  testUrlInvalidHint: "Some candidates are not absolute http(s) URLs. They are saved, but those checks will fail.",
+  testUrlTooManyHint: "More than 5 candidates are listed; only the first 5 take effect.",
+  restoreDefaultTestUrl: "Restore default",
+  localDirect: "Loopback / private targets go direct",
+  localDirectOnHint: "On: localhost, 127.x and private ranges bypass the proxy.",
+  localDirectOffHint: "Off: loopback/private targets also use the proxy. Enable only when the proxy itself is the target.",
   advanced: "Advanced: target host rules",
   onlyHosts: "Proxy only",
   onlyHostsHint: "Comma/space separated; when set, only requests to these hosts are proxied (suffix match, * for all).",
   bypassHosts: "Bypass",
   bypassHostsHint: "Comma/space separated; requests to these hosts go direct, taking priority.",
-  ruleDeadHint: "These entries never match \u2014 rules take host names only, without scheme or path: ",
+  ruleDeadHint: "These entries never match \u2014 use bare host names (no port, scheme or path); a wildcard must be `*` or start with `*.`: ",
   testTarget: "Self-check target",
   testTargetHint: "Empty uses the top-level testUrl; when set, this card's Test requests this URL instead \u2014 point it at a real upstream to verify the end-to-end path.",
   socks5Hint: "SOCKS5 tunnels the connection; the proxy resolves the target host name.",
@@ -1357,7 +1646,9 @@ var EN = {
   complete: "complete",
   notConfigured: "not configured",
   diagnostics: "Connection diagnostics",
-  diagPending: "(collecting\u2026)"
+  diagPending: "(collecting\u2026)",
+  saveFailedPrefix: "Save failed: ",
+  close: "Close"
 };
 var ZH = {
   lead: "\u8BA9\u6307\u5B9A\u7684 provider \u8D70\u4F60\u81EA\u5DF1\u7684\u6B63\u5411\u4EE3\u7406\uFF0C\u5176\u5B83 provider \u4FDD\u6301\u76F4\u8FDE\u3002\u6307\u5411\u672C\u673A\u6216\u5185\u7F51\u5730\u5740\uFF08localhost\u3001127.x\u3001\u79C1\u6709\u7F51\u6BB5\uFF09\u7684\u8BF7\u6C42\u9ED8\u8BA4\u76F4\u8FDE\uFF0C\u9876\u5C42 localDirect \u8BBE\u4E3A false \u65F6\u6062\u590D\u8D70\u4EE3\u7406\u2014\u2014\u6B63\u5411\u4EE3\u7406\u901A\u5E38\u591F\u4E0D\u5230\u4F60\u81EA\u5DF1\u7684\u673A\u5668\u3002",
@@ -1400,12 +1691,28 @@ var ZH = {
   testFailed: "\u6D4B\u8BD5\u5931\u8D25",
   exitIpLabel: "\u51FA\u53E3 IP ",
   directLabel: "\u76F4\u8FDE\uFF08\u672A\u7ECF\u8FC7\u4EE3\u7406\uFF09",
+  cachedLabel: "\u7F13\u5B58",
+  testTargetLabel: "\u76EE\u6807 ",
+  targetSourceRoute: "\uFF08\u672C\u5361\u7247\u81EA\u68C0\u76EE\u6807\uFF09",
+  targetSourceUpstream: "\uFF08\u8BE5 provider \u7684\u771F\u5B9E\u4E0A\u6E38\uFF09",
+  targetSourceTestUrl: "\uFF08\u5168\u5C40\u81EA\u68C0\u5730\u5740\uFF09",
+  globalTitle: "\u5168\u5C40\u8BBE\u7F6E\uFF08\u9AD8\u7EA7\uFF09",
+  globalLead: "\u8FD9\u91CC\u7684\u4E24\u9879\u5C5E\u4E8E\u63D2\u4EF6\u5168\u5C40\u8BBE\u7F6E\u3002testUrl \u7559\u7A7A\u65F6 Host \u4F7F\u7528\u5185\u7F6E\u9ED8\u8BA4\u503C\uFF1B\u591A\u4E2A\u5019\u9009\u7528\u9017\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF0C\u6309\u987A\u5E8F\u56DE\u9000\uFF0C\u53EA\u6709\u524D 5 \u4E2A\u751F\u6548\u3002localDirect \u9ED8\u8BA4\u5F00\u542F\uFF1B\u53EA\u6709\u4EE3\u7406\u672C\u8EAB\u5C31\u662F\u672C\u673A\u6216\u5185\u7F51\u76EE\u6807\u65F6\u624D\u9700\u8981\u5173\u95ED\u3002",
+  testUrl: "\u81EA\u68C0\u5730\u5740",
+  testUrlHint: "\u9017\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF1B\u6309\u987A\u5E8F\u5C1D\u8BD5\u7684 http(s) URL\u3002",
+  testUrlEmptyHint: "\u7559\u7A7A\u65F6 Host \u4F7F\u7528\u5185\u7F6E\u9ED8\u8BA4\u5730\u5740\u3002",
+  testUrlInvalidHint: "\u90E8\u5206\u5019\u9009\u4E0D\u662F\u7EDD\u5BF9\u7684 http(s) URL\u3002\u4ECD\u4F1A\u4FDD\u5B58\uFF0C\u4F46\u8FD9\u4E9B\u5019\u9009\u4F1A\u6D4B\u8BD5\u5931\u8D25\u3002",
+  testUrlTooManyHint: "\u5019\u9009\u8D85\u8FC7 5 \u4E2A\uFF0C\u53EA\u6709\u524D 5 \u4E2A\u751F\u6548\u3002",
+  restoreDefaultTestUrl: "\u6062\u590D\u9ED8\u8BA4",
+  localDirect: "\u672C\u673A / \u5185\u7F51\u76EE\u6807\u76F4\u8FDE",
+  localDirectOnHint: "\u5F00\u542F\uFF1Alocalhost\u3001127.x \u4E0E\u79C1\u6709\u7F51\u6BB5\u7ED5\u8FC7\u4EE3\u7406\u3002",
+  localDirectOffHint: "\u5173\u95ED\uFF1A\u672C\u673A / \u5185\u7F51\u76EE\u6807\u4E5F\u8D70\u4EE3\u7406\uFF1B\u4EC5\u5728\u4EE3\u7406\u672C\u8EAB\u5C31\u662F\u76EE\u6807\u65F6\u4F7F\u7528\u3002",
   advanced: "\u9AD8\u7EA7\uFF1A\u76EE\u6807\u57DF\u540D\u89C4\u5219",
   onlyHosts: "\u4EC5\u8D70\u4EE3\u7406",
   onlyHostsHint: "\u9017\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF1B\u975E\u7A7A\u65F6\u53EA\u6709\u5339\u914D\u8FD9\u4E9B\u4E3B\u673A\u7684\u8BF7\u6C42\u8D70\u4EE3\u7406\uFF08\u540E\u7F00\u5339\u914D\uFF0C* \u8868\u793A\u5168\u90E8\uFF09\u3002",
   bypassHosts: "\u76F4\u8FDE",
   bypassHostsHint: "\u9017\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF1B\u5339\u914D\u8FD9\u4E9B\u4E3B\u673A\u7684\u8BF7\u6C42\u76F4\u8FDE\uFF0C\u4F18\u5148\u4E8E\u4E0A\u4E00\u9879\u3002",
-  ruleDeadHint: "\u4EE5\u4E0B\u6761\u76EE\u6C38\u8FDC\u5339\u914D\u4E0D\u4E0A\u2014\u2014\u89C4\u5219\u53EA\u8BA4\u4E3B\u673A\u540D\uFF0C\u4E0D\u8981\u5E26\u534F\u8BAE\u524D\u7F00\u6216\u8DEF\u5F84\uFF1A",
+  ruleDeadHint: "\u4EE5\u4E0B\u6761\u76EE\u6C38\u8FDC\u5339\u914D\u4E0D\u4E0A\u2014\u2014\u89C4\u5219\u53EA\u8BA4\u4E3B\u673A\u540D\uFF08\u4E0D\u8981\u5E26\u7AEF\u53E3\u3001\u534F\u8BAE\u524D\u7F00\u6216\u8DEF\u5F84\uFF09\uFF0C\u901A\u914D\u7B26\u53EA\u80FD\u662F\u5355\u72EC\u7684 * \u6216\u4EE5 *. \u5F00\u5934\uFF1A",
   testTarget: "\u81EA\u68C0\u76EE\u6807",
   testTargetHint: "\u7559\u7A7A\u7528\u9876\u5C42 testUrl\uFF1B\u586B\u5199\u540E\u8BE5\u5361\u7247\u7684\u300C\u6D4B\u8BD5\u300D\u6539\u4E3A\u8BF7\u6C42\u8FD9\u4E2A\u5730\u5740\uFF0C\u53EF\u62FF\u771F\u5B9E\u4E0A\u6E38\u9A8C\u8BC1\u7AEF\u5230\u7AEF\u8DEF\u5F84\u3002",
   socks5Hint: "SOCKS5 \u4F1A\u5EFA\u7ACB\u96A7\u9053\uFF0C\u76EE\u6807\u57DF\u540D\u7531\u4EE3\u7406\u7AEF\u89E3\u6790\u3002",
@@ -1415,7 +1722,9 @@ var ZH = {
   complete: "\u914D\u7F6E\u5B8C\u6574",
   notConfigured: "\u672A\u914D\u7F6E",
   diagnostics: "\u8FDE\u63A5\u8BCA\u65AD",
-  diagPending: "\uFF08\u6B63\u5728\u6536\u96C6\u2026\uFF09"
+  diagPending: "\uFF08\u6B63\u5728\u6536\u96C6\u2026\uFF09",
+  saveFailedPrefix: "\u4FDD\u5B58\u5931\u8D25\uFF1A",
+  close: "\u5173\u95ED"
 };
 function stringsFor(ctx) {
   const language = localeOf(ctx);