dsh-provider-proxy 0.6.0 → 0.7.0

package/README.md

@@ -40,7 +40,7 @@ dsh plugin --profile web add dsh-provider-proxy
 | IP / 主机 | 只填 IPv4、IPv6 或 ASCII 域名；不要带协议前缀、端口、路径或凭据。IDN 需先转 punycode |
 | 端口 | 1–65535 的整数 |
 | 用户名 | 可选（与密码成对填写） |
-| 密码 | 可选（与用户名成对填写）。作为代理认证口令发给代理（`HTTP` / `HTTPS` / `SOCKS5` 均支持） |
+| 密码 | 可选（与用户名成对填写）。作为代理认证口令发给代理（`HTTP` / `HTTPS` / `SOCKS5` 均支持）。默认隐藏，可用密码框内右侧的眼睛图标临时查看，切换不会改写或保存密码 |
 
 同一个代理要给多张卡片用时，只在页面顶部的 **默认代理** 区块填一次，再在每张卡片勾上 **使用默认代理**。
 勾上之后该卡片的传输字段（类型 / 主机 / 端口 / 用户名 / 密码）**整体**取自默认区块，卡片不再显示这些输入框，
@@ -69,7 +69,9 @@ Host catalog 是否列出某个 provider（`live`）不影响已保存路由的
   协议 / 主机 / 端口 / 用户名 / 密码，并且是**一次**写入（不是五个字段各写一次）。显式写出的 `:80` / `:443`
   会保留；完全没写端口时保持「未配置」，不会自动补默认端口。
 - **设为默认代理**（卡片上，仅在该卡片有自己的端点时出现）：把它当前的端点一次性提升为顶部的默认端点。
-- **所有 provider 使用默认代理**（默认区块里）：一条批量写把每张卡片都指向默认端点；默认端点不可用时按钮禁用。
+  如果默认端点已配置且有卡片正在继承，会先弹确认框；取消后不写入、不改草稿。
+- **所有 provider 使用默认代理（N）**（默认区块里）：N 是全部 provider 的数量，不受过滤框影响。
+  一条批量写把每张卡片都指向默认端点；默认端点不可用时按钮禁用。
 - **最近一次调用**：卡片头上会显示「最近成功 3 分钟前」，失败时显示「最近失败 ECONNREFUSED」。
   命中计数只说明这条路由被用过，这一行说明它**现在是否还工作**。已启用但还没代理过请求的路由显示
   「尚无代理记录」；**测试按钮不计入**——它证明的是「代理这一跳通」，不是「这条路由承载过真实流量」，两者混在一起会让这一行的含义不可信。
@@ -77,6 +79,11 @@ Host catalog 是否列出某个 provider（`live`）不影响已保存路由的
   因为成功判据在响应头到达时就已成立（流式转发不能靠消费 body 来判断）。
   「最近调用」的时间取请求**发起**时刻；「最近成功 / 失败」的结果与时间来自最近一次**结束**的请求——
   两者分开记录，并发调用下不会把一次请求的发起时间配到另一次的结果上。
+  **这条记录只属于当前路由配置**：改代理端点、凭据、`useDefault` 的默认端点、目标域名规则或
+  `localDirect` 后，该 provider 的「最近调用」会变成「尚无代理记录」；`testUrl` / `testTarget`
+  只影响测试，不会清掉它。仅关闭再打开代理开关也保留记录。修改配置前已经启动的请求不会把旧结果
+  写回新配置；删除后重新添加同名 provider 同样视为一条新路由。`hits` 命中计数是历史累计，
+  上述配置变化都不会清空它。
 
 页面顶部与顶层还有三项整页设置（写在 `cordis.patch.yml`，也可以直接编辑）：
 
@@ -95,6 +102,11 @@ Host catalog 是否列出某个 provider（`live`）不影响已保存路由的
 已经在 `providers` 里配过代理的条目即使暂时不激活也仍然保留，避免已保存的设置悄悄消失；
 catalog 的 `live` 只影响未配置 provider 是否出现在列表里，不参与已保存卡片的状态判定。
 
+如果 Host 目录读取成功，但某个**已保存**的 provider 完全没有出现在目录里，页面不会隐藏它，
+而是在「连接诊断」里列出这些 provider，并说明代理配置仍会保留。目录读取中或读取失败时不会显示
+这条提示，避免把所有已保存 provider 误报为缺失。`live: false` 只表示目录中存在但当前未激活，
+不算缺失。
+
 保存立即对新请求生效，不需要重启；正在进行中的流会继续用它启动时的那条连接。
 
 设置写入失败时，字段会回滚，并在页面顶部显示「保存失败：<字段> — <原因>」和关闭按钮；下一次成功写入或点击关闭后消失。多次失败只保留最新一条。写入成功与失败的诊断都不会包含密码值，密码字段固定显示「值已隐藏」。
@@ -194,7 +206,7 @@ catalog 的 `live` 只影响未配置 provider 是否出现在列表里，不参
 
 ```sh
 npm run build      # 构建 lib/index.js 与 lib/client.js
-npm test           # 248 个用例，跑的是构建产物
+npm test           # 274 个用例，跑的是构建产物
 npm run typecheck  # 类型检查（仅覆盖 src/）
 npm run verify     # 上面三件事，按顺序
 ```

package/lib/client.js

@@ -39,13 +39,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var require_client = __commonJS({
   "src/client.css"(exports, module2) {
     "use strict";
-    var __dshMap = { "root": "bcf3ba25_root", "lead": "86cd7a9a_lead", "empty": "4ec3d74d_empty", "card": "61dfce67_card", "cardActive": "56b6c433_cardActive", "cardRejected": "24b300e2_cardRejected", "defaultCard": "665ef72b_defaultCard", "defaultLead": "351db191_defaultLead", "cardHead": "9ee651d9_cardHead", "cardTitles": "bb118443_cardTitles", "name": "a1b940d4_name", "id": "1870f756_id", "pillOn": "e9cfdcad_pillOn", "pillLive": "3d3b7405_pillLive", "pillOff": "a517f862_pillOff", "pillRejected": "3e11f4ea_pillRejected", "toggle": "31ab2dc8_toggle", "field": "52ffb01c_field", "label": "b8d05488_label", "hint": "d8b3bd46_hint", "input": "0b74e44b_input", "testButton": "47b71ed7_testButton", "diag": "f395d2a5_diag", "diagSummary": "84895b20_diagSummary", "diagList": "9ecca3cd_diagList" };
+    var __dshMap = { "root": "b4bf55bf_root", "lead": "03b72018_lead", "empty": "9a9a9c27_empty", "card": "6d6907d5_card", "cardActive": "a287416b_cardActive", "cardRejected": "aabaa9b3_cardRejected", "defaultCard": "ebf26189_defaultCard", "defaultLead": "5b9e9eb5_defaultLead", "cardHead": "a3319282_cardHead", "cardTitles": "6f64c28d_cardTitles", "name": "847f7e47_name", "id": "7864474d_id", "pillOn": "7ed5399b_pillOn", "pillLive": "0ccb6da5_pillLive", "pillOff": "3accadc4_pillOff", "pillRejected": "86897991_pillRejected", "toggle": "81025292_toggle", "field": "5e2577de_field", "label": "d9087e9b_label", "hint": "aae2a8a2_hint", "input": "feb8c902_input", "passwordToggle": "5645283d_passwordToggle", "testButton": "de8ca09a_testButton", "diag": "4ad17b9d_diag", "diagSummary": "b2f0759b_diagSummary", "diagList": "f49699bb_diagList" };
     var __dshStyles = globalThis.__dshPluginStyles || (globalThis.__dshPluginStyles = /* @__PURE__ */ new Set());
     if (!__dshStyles.has("dsh-provider-proxy/client.css")) {
       __dshStyles.add("dsh-provider-proxy/client.css");
       __dshStyle = document.createElement("style");
       __dshStyle.setAttribute("data-plugin-css", "dsh-provider-proxy/client.css");
-      __dshStyle.textContent = '/* dsh-provider-proxy \u2014 provider proxy settings page.\n   Tokens only: no literal colours, matching the shared --dsw-* system. */\n\n.bcf3ba25_root {\n  display: flex;\n  flex-direction: column;\n  gap: 12px;\n  max-width: 640px;\n}\n\n.86cd7a9a_lead {\n  margin: 0 0 4px;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.4ec3d74d_empty {\n  margin: 0;\n  padding: 16px;\n  border: 1px dashed var(--dsw-alias-border-l1);\n  border-radius: 8px;\n  font-size: 12px;\n  text-align: center;\n  color: var(--dsw-alias-state-idle-primary);\n}\n\n/* ---- provider card ---- */\n\n.61dfce67_card,\n.56b6c433_cardActive,\n.24b300e2_cardRejected {\n  display: flex;\n  flex-direction: column;\n  gap: 10px;\n  padding: 12px 14px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-1);\n}\n\n.56b6c433_cardActive {\n  border-color: var(--dsw-alias-state-success-primary);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n/* An enabled route the Host refused: never dress it as active. */\n.24b300e2_cardRejected {\n  border-color: var(--dsw-alias-state-error-primary, #f85149);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n/* ---- shared default endpoint ---- */\n\n/* A distinct outer layer, so it reads as "one setting for the page" rather than\n   as one more provider card. */\n.665ef72b_defaultCard {\n  display: flex;\n  flex-direction: column;\n  gap: 10px;\n  padding: 14px 16px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n.351db191_defaultLead {\n  margin: -2px 0 0;\n  font-size: 11px;\n  line-height: 1.5;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.9ee651d9_cardHead {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n}\n\n.bb118443_cardTitles {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n  min-width: 0;\n}\n\n.a1b940d4_name {\n  overflow: hidden;\n  font-size: 13px;\n  font-weight: 600;\n  white-space: nowrap;\n  text-overflow: ellipsis;\n  color: var(--dsw-alias-label-primary);\n}\n\n.1870f756_id {\n  flex: none;\n  padding: 1px 6px;\n  border-radius: 4px;\n  background: var(--dsw-alias-bg-layer-2);\n  font-family: ui-monospace, monospace;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n/* ---- status pill ---- */\n\n.e9cfdcad_pillOn,\n.3d3b7405_pillLive,\n.a517f862_pillOff,\n.3e11f4ea_pillRejected {\n  flex: none;\n  padding: 2px 8px;\n  border-radius: 999px;\n  font-size: 11px;\n  font-weight: 500;\n  white-space: nowrap;\n}\n\n.e9cfdcad_pillOn {\n  background: var(--dsw-alias-state-success-primary);\n  color: var(--dsw-alias-bg-base);\n}\n\n.3d3b7405_pillLive {\n  border: 1px solid var(--dsw-alias-border-l2);\n  color: var(--dsw-alias-label-secondary);\n}\n\n.a517f862_pillOff {\n  color: var(--dsw-alias-state-idle-primary);\n}\n\n.3e11f4ea_pillRejected {\n  border: 1px solid var(--dsw-alias-state-error-primary, #f85149);\n  color: var(--dsw-alias-state-error-primary, #f85149);\n}\n\n/* ---- toggle ---- */\n\n.31ab2dc8_toggle {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  padding-top: 2px;\n  font-size: 12px;\n  color: var(--dsw-alias-label-primary);\n  cursor: pointer;\n}\n\n.31ab2dc8_toggle input {\n  accent-color: var(--dsw-alias-brand-primary);\n  cursor: pointer;\n}\n\n/* ---- fields ---- */\n\n.52ffb01c_field {\n  display: grid;\n  grid-template-columns: 96px 1fr;\n  align-items: center;\n  gap: 10px;\n  font-size: 12px;\n}\n\n.b8d05488_label {\n  color: var(--dsw-alias-label-secondary);\n}\n\n.d8b3bd46_hint {\n  grid-column: 2;\n  margin-top: -2px;\n  font-size: 11px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.0b74e44b_input {\n  box-sizing: border-box;\n  width: 100%;\n  min-width: 0;\n  padding: 5px 8px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 6px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 12px;\n  transition: border-color 120ms ease, background 120ms ease;\n}\n\n/* The base look of every input is INLINE too, so these three state rules only\n   ever take effect as author-important declarations \u2014 same reason as the\n   self-check button above. `cursor` has no inline base and needs none, and the\n   hover border uses `l3` because `l1`\u2192`l2` is a 4%\u219210% black step nobody can\n   see. */\n\n.0b74e44b_input:hover:not(:disabled) {\n  border-color: var(--dsw-alias-border-l3) !important;\n}\n\n.0b74e44b_input:focus {\n  border-color: var(--dsw-alias-brand-primary) !important;\n}\n\n.0b74e44b_input:disabled {\n  color: var(--dsw-alias-state-idle-primary) !important;\n  background: var(--dsw-alias-bg-layer-2) !important;\n  cursor: not-allowed;\n}\n\n/* ---- self-check ---- */\n\n/* The hover state is the one thing an inline style cannot express, which is why\n   this element carries a class at all. Layout stays inline.\n\n   Two traps, both hit before this comment existed:\n   - `!important` is load-bearing: the base border and background are INLINE, and\n     the cascade sorts a style attribute after every author rule, so a plain\n     declaration here would ship, match, and still lose.\n   - the TOKENS must be visible ones. `bg-layer-1/2/3` all resolve to\n     `neutral-bluish-00` in the light theme, so a layer swap is a no-op there, and\n     `border-l1`\u2192`l2` is 4%\u219210% black on a 1px line. The app\'s own hovers use\n     `interactive-bg-hover`; using it here is what makes the feedback exist. */\n.47b71ed7_testButton {\n  transition: border-color 120ms ease, background 120ms ease;\n}\n\n.47b71ed7_testButton:hover:not(:disabled) {\n  border-color: var(--dsw-alias-border-l3) !important;\n  background: var(--dsw-alias-interactive-bg-hover) !important;\n}\n\n/* ---- diagnostics ---- */\n\n.f395d2a5_diag {\n  margin-top: 2px;\n  padding: 8px 10px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 8px;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.84895b20_diagSummary {\n  cursor: pointer;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.9ecca3cd_diagList {\n  margin: 6px 0 0;\n  padding-left: 18px;\n  font-family: ui-monospace, monospace;\n  word-break: break-all;\n}\n';
+      __dshStyle.textContent = '/* dsh-provider-proxy \u2014 provider proxy settings page.\n   Tokens only: no literal colours, matching the shared --dsw-* system. */\n\n.b4bf55bf_root {\n  display: flex;\n  flex-direction: column;\n  gap: 12px;\n  max-width: 640px;\n}\n\n.03b72018_lead {\n  margin: 0 0 4px;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.9a9a9c27_empty {\n  margin: 0;\n  padding: 16px;\n  border: 1px dashed var(--dsw-alias-border-l1);\n  border-radius: 8px;\n  font-size: 12px;\n  text-align: center;\n  color: var(--dsw-alias-state-idle-primary);\n}\n\n/* ---- provider card ---- */\n\n.6d6907d5_card,\n.a287416b_cardActive,\n.aabaa9b3_cardRejected {\n  display: flex;\n  flex-direction: column;\n  gap: 10px;\n  padding: 12px 14px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-1);\n}\n\n.a287416b_cardActive {\n  border-color: var(--dsw-alias-state-success-primary);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n/* An enabled route the Host refused: never dress it as active. */\n.aabaa9b3_cardRejected {\n  border-color: var(--dsw-alias-state-error-primary, #f85149);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n/* ---- shared default endpoint ---- */\n\n/* A distinct outer layer, so it reads as "one setting for the page" rather than\n   as one more provider card. */\n.ebf26189_defaultCard {\n  display: flex;\n  flex-direction: column;\n  gap: 10px;\n  padding: 14px 16px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n.5b9e9eb5_defaultLead {\n  margin: -2px 0 0;\n  font-size: 11px;\n  line-height: 1.5;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.a3319282_cardHead {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n}\n\n.6f64c28d_cardTitles {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n  min-width: 0;\n}\n\n.847f7e47_name {\n  overflow: hidden;\n  font-size: 13px;\n  font-weight: 600;\n  white-space: nowrap;\n  text-overflow: ellipsis;\n  color: var(--dsw-alias-label-primary);\n}\n\n.7864474d_id {\n  flex: none;\n  padding: 1px 6px;\n  border-radius: 4px;\n  background: var(--dsw-alias-bg-layer-2);\n  font-family: ui-monospace, monospace;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n/* ---- status pill ---- */\n\n.7ed5399b_pillOn,\n.0ccb6da5_pillLive,\n.3accadc4_pillOff,\n.86897991_pillRejected {\n  flex: none;\n  padding: 2px 8px;\n  border-radius: 999px;\n  font-size: 11px;\n  font-weight: 500;\n  white-space: nowrap;\n}\n\n.7ed5399b_pillOn {\n  background: var(--dsw-alias-state-success-primary);\n  color: var(--dsw-alias-bg-base);\n}\n\n.0ccb6da5_pillLive {\n  border: 1px solid var(--dsw-alias-border-l2);\n  color: var(--dsw-alias-label-secondary);\n}\n\n.3accadc4_pillOff {\n  color: var(--dsw-alias-state-idle-primary);\n}\n\n.86897991_pillRejected {\n  border: 1px solid var(--dsw-alias-state-error-primary, #f85149);\n  color: var(--dsw-alias-state-error-primary, #f85149);\n}\n\n/* ---- toggle ---- */\n\n.81025292_toggle {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  padding-top: 2px;\n  font-size: 12px;\n  color: var(--dsw-alias-label-primary);\n  cursor: pointer;\n}\n\n.81025292_toggle input {\n  accent-color: var(--dsw-alias-brand-primary);\n  cursor: pointer;\n}\n\n/* ---- fields ---- */\n\n.5e2577de_field {\n  display: grid;\n  grid-template-columns: 96px 1fr;\n  align-items: center;\n  gap: 10px;\n  font-size: 12px;\n}\n\n.d9087e9b_label {\n  color: var(--dsw-alias-label-secondary);\n}\n\n.aae2a8a2_hint {\n  grid-column: 2;\n  margin-top: -2px;\n  font-size: 11px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.feb8c902_input {\n  box-sizing: border-box;\n  width: 100%;\n  min-width: 0;\n  padding: 5px 8px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 6px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 12px;\n  transition: border-color 120ms ease, background 120ms ease;\n}\n\n/* The base look of every input is INLINE too, so these three state rules only\n   ever take effect as author-important declarations \u2014 same reason as the\n   self-check button above. `cursor` has no inline base and needs none, and the\n   hover border uses `l3` because `l1`\u2192`l2` is a 4%\u219210% black step nobody can\n   see. */\n\n.feb8c902_input:hover:not(:disabled) {\n  border-color: var(--dsw-alias-border-l3) !important;\n}\n\n.feb8c902_input:focus {\n  border-color: var(--dsw-alias-brand-primary) !important;\n}\n\n.feb8c902_input:disabled {\n  color: var(--dsw-alias-state-idle-primary) !important;\n  background: var(--dsw-alias-bg-layer-2) !important;\n  cursor: not-allowed;\n}\n\n/* The icon sits inside the input, so its hover/focus feedback must be local\n   and must outrank the transparent inline base. */\n.5645283d_passwordToggle {\n  transition: background 120ms ease, color 120ms ease;\n}\n\n.5645283d_passwordToggle:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover) !important;\n  color: var(--dsw-alias-label-primary) !important;\n}\n\n.5645283d_passwordToggle:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* ---- self-check ---- */\n\n/* The hover state is the one thing an inline style cannot express, which is why\n   this element carries a class at all. Layout stays inline.\n\n   Two traps, both hit before this comment existed:\n   - `!important` is load-bearing: the base border and background are INLINE, and\n     the cascade sorts a style attribute after every author rule, so a plain\n     declaration here would ship, match, and still lose.\n   - the TOKENS must be visible ones. `bg-layer-1/2/3` all resolve to\n     `neutral-bluish-00` in the light theme, so a layer swap is a no-op there, and\n     `border-l1`\u2192`l2` is 4%\u219210% black on a 1px line. The app\'s own hovers use\n     `interactive-bg-hover`; using it here is what makes the feedback exist. */\n.de8ca09a_testButton {\n  transition: border-color 120ms ease, background 120ms ease;\n}\n\n.de8ca09a_testButton:hover:not(:disabled) {\n  border-color: var(--dsw-alias-border-l3) !important;\n  background: var(--dsw-alias-interactive-bg-hover) !important;\n}\n\n/* ---- diagnostics ---- */\n\n.4ad17b9d_diag {\n  margin-top: 2px;\n  padding: 8px 10px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 8px;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.b2f0759b_diagSummary {\n  cursor: pointer;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.f49699bb_diagList {\n  margin: 6px 0 0;\n  padding-left: 18px;\n  font-family: ui-monospace, monospace;\n  word-break: break-all;\n}\n';
       document.head.appendChild(__dshStyle);
     }
     var __dshStyle;
@@ -357,7 +357,7 @@ async function fetchCatalog() {
       };
     }
   }
-  return { rows, hits, problems, lastUse };
+  return { rows, publishedRows: rows, hits, problems, lastUse };
 }
 var CATALOG_REFRESH_MS = 1e4;
 var catalogPoll;
@@ -540,6 +540,29 @@ var S = {
     fontSize: "12px",
     cursor: "pointer"
   },
+  /** The reveal/hide control sits inside the password field's right edge. */
+  passwordControl: {
+    position: "relative",
+    minWidth: "0"
+  },
+  passwordToggle: {
+    position: "absolute",
+    top: "50%",
+    right: "4px",
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "center",
+    width: "26px",
+    height: "26px",
+    padding: "0",
+    border: "0",
+    borderRadius: "6px",
+    background: "transparent",
+    color: "var(--dsw-alias-label-secondary)",
+    lineHeight: "1",
+    transform: "translateY(-50%)",
+    cursor: "pointer"
+  },
   testResult: {
     // A flex row so the target can drop onto its own line: the container was a
     // plain span, where `flexBasis: 100%` does nothing and the target ran into
@@ -566,6 +589,10 @@ var S = {
   diagProblem: {
     color: "var(--dsw-alias-state-error-primary, #f85149)"
   },
+  /** Informational catalogue mismatch: not a rejected route, so no error red. */
+  diagNote: {
+    color: "var(--dsw-alias-label-secondary)"
+  },
   advanced: {
     marginTop: "4px",
     fontSize: "12px"
@@ -693,6 +720,7 @@ function renderPage(ctx) {
     void fetchCatalog().then((catalog) => catalogueSetter?.(catalog)).catch((error) => {
       catalogueSetter?.({
         rows: [],
+        publishedRows: [],
         hits: {},
         problems: {},
         lastUse: {},
@@ -701,6 +729,7 @@ function renderPage(ctx) {
     });
     return {
       rows: void 0,
+      publishedRows: void 0,
       hits: {},
       problems: {},
       lastUse: {},
@@ -710,6 +739,7 @@ function renderPage(ctx) {
   });
   catalogueSetter = (catalog) => setState({
     rows: catalog.rows,
+    publishedRows: catalog.publishedRows,
     hits: catalog.hits,
     problems: catalog.problems,
     lastUse: catalog.lastUse,
@@ -718,6 +748,7 @@ function renderPage(ctx) {
   });
   touchCatalogPolling();
   const published = state.rows ?? [];
+  const publishedRows = state.publishedRows ?? [];
   const hits = state.hits ?? {};
   const lastUse = state.lastUse ?? {};
   const lastUseText = (id) => {
@@ -731,7 +762,14 @@ function renderPage(ctx) {
   const problemLines = Object.entries(problems).map(
     ([id, message]) => h("li", { key: `p:${id}`, style: S.diagProblem }, `${id}\uFF1A${message}`)
   );
-  const problemCount = problemLines.length;
+  const publishedIds = new Set(publishedRows.map((row) => row.id));
+  const missingFromCatalog = state.pending === true || state.error !== void 0 ? [] : Object.keys(configured).filter((id) => !publishedIds.has(id)).sort();
+  const catalogueMismatchLine = missingFromCatalog.length === 0 ? void 0 : h(
+    "li",
+    { key: "catalogue-mismatch", style: S.diagNote },
+    `${t.catalogueMismatch}${missingFromCatalog.join("\u3001")}${t.catalogueMismatchSuffix}`
+  );
+  const problemCount = problemLines.length + (catalogueMismatchLine === void 0 ? 0 : 1);
   note(
     `provider \u5217\u8868\uFF1A\u6765\u81EA Host \u5171 ${published.length} \u4E2A\uFF08${published.map((r) => r.id).join("\u3001") || "\u65E0"}\uFF09`
   );
@@ -741,6 +779,45 @@ function renderPage(ctx) {
   const [defaultDraft, setDefaultDraft] = (React.useState ?? ((v) => [v, () => {
   }]))({});
   const editDefault = (field2, value) => setDefaultDraft((current) => ({ ...current, [field2]: value }));
+  const [passwordVisible, setPasswordVisible] = (React.useState ?? ((v) => [v, () => {
+  }]))({});
+  const [defaultPasswordVisible, setDefaultPasswordVisible] = (React.useState ?? ((v) => [v, () => {
+  }]))(false);
+  const togglePassword = (id) => setPasswordVisible((current) => ({ ...current, [id]: current[id] !== true }));
+  const toggleDefaultPassword = () => setDefaultPasswordVisible((current) => current !== true);
+  const passwordToggle = (visible, onToggle) => h(
+    "button",
+    {
+      className: import_client.default.passwordToggle,
+      style: S.passwordToggle,
+      type: "button",
+      "aria-label": visible ? t.hidePassword : t.showPassword,
+      "aria-pressed": visible,
+      title: visible ? t.hidePassword : t.showPassword,
+      onClick: onToggle
+    },
+    h(
+      "svg",
+      {
+        width: 16,
+        height: 16,
+        viewBox: "0 0 24 24",
+        fill: "none",
+        stroke: "currentColor",
+        strokeWidth: 2,
+        strokeLinecap: "round",
+        strokeLinejoin: "round",
+        "aria-hidden": "true",
+        focusable: "false"
+      },
+      h("path", {
+        key: "eye",
+        d: "M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12Z"
+      }),
+      h("circle", { key: "pupil", cx: 12, cy: 12, r: 3 }),
+      visible ? h("path", { key: "slash", d: "m3 3 18 18" }) : null
+    )
+  );
   const [globalDraft, setGlobalDraft] = (React.useState ?? ((v) => [v, () => {
   }]))({});
   const editGlobal = (field2, value) => setGlobalDraft((current) => ({ ...current, [field2]: value }));
@@ -924,6 +1001,9 @@ function renderPage(ctx) {
     );
   };
   const promoteToDefault = (id) => {
+    if (defaultComplete && inheritingIds().length > 0 && globalThis.window?.confirm?.(t.confirmPromoteToDefault) !== true) {
+      return;
+    }
     const route = view({ ...configured[id], ...draft[id] });
     applyDefaultUrl({
       protocol: route.protocol,
@@ -945,7 +1025,7 @@ function renderPage(ctx) {
     saveMany(
       "\0default\0applyAll",
       ids.map((id) => ({ op: "set", path: ["providers", id, "useDefault"], value: true })),
-      "\u6240\u6709 provider \u7684 useDefault",
+      `\u6240\u6709 provider \u7684 useDefault\uFF08${ids.length} \u4E2A\uFF09`,
       () => setDraft((current) => {
         const next = { ...current };
         for (const id of ids) {
@@ -1065,21 +1145,26 @@ function renderPage(ctx) {
       h("input", {
         className: import_client.default.input,
         style: S.input,
-        autocomplete: "off",
+        autoComplete: "off",
         value: defaultView.username,
         onChange: (event) => bindDefault("username")(event.target.value)
       })
     ),
     field(
       t.password,
-      h("input", {
-        className: import_client.default.input,
-        style: S.input,
-        type: "password",
-        autocomplete: "off",
-        value: defaultView.password,
-        onChange: (event) => bindDefault("password")(event.target.value)
-      }),
+      h(
+        "div",
+        { style: S.passwordControl },
+        h("input", {
+          className: import_client.default.input,
+          style: { ...S.input, paddingRight: "36px" },
+          type: defaultPasswordVisible === true ? "text" : "password",
+          autoComplete: "off",
+          value: defaultView.password,
+          onChange: (event) => bindDefault("password")(event.target.value)
+        }),
+        passwordToggle(defaultPasswordVisible === true, toggleDefaultPassword)
+      ),
       t.passwordHintProxy
     ),
     // Bulk opt-in, in ONE write: a per-card walk would rebuild the table N times.
@@ -1097,7 +1182,7 @@ function renderPage(ctx) {
           disabled: !defaultComplete || rows.length === 0,
           onClick: applyDefaultToAll
         },
-        t.applyDefaultAll
+        `${t.applyDefaultAll}\uFF08${rows.length}\uFF09`
       )
     )
   );
@@ -1274,7 +1359,7 @@ function renderPage(ctx) {
         h("input", {
           className: import_client.default.input,
           style: S.input,
-          autocomplete: "off",
+          autoComplete: "off",
           value: route.username,
           onChange: (event) => bind(row.id, "username")(event.target.value)
         })
@@ -1286,14 +1371,19 @@ function renderPage(ctx) {
       // config; the diagnostics only ever surface a credential-free origin.
       field(
         t.password,
-        h("input", {
-          className: import_client.default.input,
-          style: S.input,
-          type: "password",
-          autocomplete: "off",
-          value: route.password,
-          onChange: (event) => bind(row.id, "password")(event.target.value)
-        }),
+        h(
+          "div",
+          { style: S.passwordControl },
+          h("input", {
+            className: import_client.default.input,
+            style: { ...S.input, paddingRight: "36px" },
+            type: passwordVisible[row.id] === true ? "text" : "password",
+            autoComplete: "off",
+            value: route.password,
+            onChange: (event) => bind(row.id, "password")(event.target.value)
+          }),
+          passwordToggle(passwordVisible[row.id] === true, () => togglePassword(row.id))
+        ),
         route.protocol === "socks5" ? t.passwordHint : t.passwordHintProxy
       )
     ];
@@ -1567,6 +1657,7 @@ function renderPage(ctx) {
         { className: import_client.default.diagList, style: { margin: "6px 0 0", paddingLeft: "18px" } },
         ...problemCount === 0 && diagnostics.length === 0 && savedNote === void 0 ? [h("li", { key: "none" }, t.diagPending)] : [
           ...problemLines,
+          ...catalogueMismatchLine === void 0 ? [] : [catalogueMismatchLine],
           ...savedNote === void 0 ? [] : [h("li", { key: "saved" }, savedNote)],
           ...diagnostics.map((line, index) => h("li", { key: `d${index}` }, line))
         ]
@@ -1596,6 +1687,9 @@ var EN = {
   port: "Port",
   username: "Username",
   password: "Password",
+  showPassword: "Show",
+  hidePassword: "Hide",
+  confirmPromoteToDefault: "The default proxy is already in use by one or more providers. Replace it with this card's endpoint?",
   hostHint: "Only an IPv4, IPv6, or domain name is allowed. A full proxy URL (socks5://user:pass@host:1080) can be pasted instead \u2014 it is split into the fields.",
   passwordHint: "Sent to the SOCKS5 proxy for authentication; stored with this setting.",
   passwordHintProxy: "Sent to the proxy as an authentication password; stored with this setting.",
@@ -1647,6 +1741,8 @@ var EN = {
   notConfigured: "not configured",
   diagnostics: "Connection diagnostics",
   diagPending: "(collecting\u2026)",
+  catalogueMismatch: "Saved but not listed by the Host catalogue: ",
+  catalogueMismatchSuffix: ". Their proxy settings are kept.",
   saveFailedPrefix: "Save failed: ",
   close: "Close"
 };
@@ -1672,6 +1768,9 @@ var ZH = {
   port: "\u7AEF\u53E3",
   username: "\u7528\u6237\u540D",
   password: "\u5BC6\u7801",
+  showPassword: "\u663E\u793A",
+  hidePassword: "\u9690\u85CF",
+  confirmPromoteToDefault: "\u5DF2\u6709 provider \u6B63\u5728\u4F7F\u7528\u9ED8\u8BA4\u4EE3\u7406\u3002\u8981\u7528\u8FD9\u5F20\u5361\u7247\u7684\u7AEF\u70B9\u8986\u76D6\u5B83\u5417\uFF1F",
   hostHint: "\u53EA\u5141\u8BB8\u586B\u5199 IPv4\u3001IPv6 \u6216\u57DF\u540D\uFF1B\u4E5F\u53EF\u4EE5\u76F4\u63A5\u7C98\u8D34\u5B8C\u6574\u4EE3\u7406 URL\uFF08\u5982 socks5://user:pass@host:1080\uFF09\uFF0C\u4F1A\u81EA\u52A8\u62C6\u5206\u5230\u5404\u5B57\u6BB5\u3002",
   passwordHint: "\u4EC5\u4F5C\u4E3A SOCKS5 \u8BA4\u8BC1\u53E3\u4EE4\u53D1\u9001\u7ED9\u4EE3\u7406\uFF1B\u968F\u8BE5\u8BBE\u7F6E\u4E00\u8D77\u4FDD\u5B58\u3002",
   passwordHintProxy: "\u4F5C\u4E3A\u4EE3\u7406\u8BA4\u8BC1\u53E3\u4EE4\u53D1\u9001\u7ED9\u4EE3\u7406\uFF1B\u968F\u8BE5\u8BBE\u7F6E\u4E00\u8D77\u4FDD\u5B58\u3002",
@@ -1723,6 +1822,8 @@ var ZH = {
   notConfigured: "\u672A\u914D\u7F6E",
   diagnostics: "\u8FDE\u63A5\u8BCA\u65AD",
   diagPending: "\uFF08\u6B63\u5728\u6536\u96C6\u2026\uFF09",
+  catalogueMismatch: "\u5DF2\u4FDD\u5B58\u4F46\u672A\u51FA\u73B0\u5728 Host \u76EE\u5F55\u4E2D\u7684 provider\uFF1A",
+  catalogueMismatchSuffix: "\u3002\u4EE3\u7406\u914D\u7F6E\u4ECD\u4F1A\u4FDD\u7559\u3002",
   saveFailedPrefix: "\u4FDD\u5B58\u5931\u8D25\uFF1A",
   close: "\u5173\u95ED"
 };