dsh-proxy-routing 0.4.1

package/lib/proxy/http11.js

@@ -0,0 +1,133 @@
+// lib/proxy/http11.js — 经已建立 socket 的 HTTP/1.1 请求：状态行 + 响应头解析，
+// 流式响应体（chunked / content-length / 无长度读至 EOF）+ 解压，对齐 fetch 语义。
+import { proxyError, abortError } from "./errors.js";
+import { parseStatusLine, statusTextOf } from "./parse.js";
+import { ByteStream } from "./stream.js";
+import { makeBodyController } from "./decode.js";
+
+/** 响应头数量上限（防畸形响应撑爆内存）。 */
+export const MAX_HEADERS = 256;
+/** 单个 chunk 上限 64MB。 */
+export const MAX_CHUNK = 64 * 1024 * 1024;
+
+/** 无响应体的状态码（对齐 fetch：204/205/304 及 HEAD 请求）。 */
+function noBody(status, method) {
+  return status === 204 || status === 205 || status === 304 || method === "HEAD";
+}
+
+/**
+ * 发送 HTTP/1.1 请求并返回流式 Response（解压 + 无 body 短路）。
+ * @param {import("node:net").Socket} sock 已连到目标（HTTP）或隧道+TLS（HTTPS）的 socket
+ * @param {string} url 完整目标 URL（用于 Response.url）
+ * @param {string} head 已组装的请求头块（含 \r\n\r\n 结尾）
+ * @param {*} body string/Buffer/Readable 或 null
+ * @param {{signal?:AbortSignal, idleMs?:number}} [opts] idleMs：响应读空闲超时（每次收包重置；大下载不被绝对超时误杀）
+ */
+export async function sendViaSocket(sock, url, head, body, { signal, idleMs } = {}) {
+  // 请求包 = 头 + 体；体非空且未声明 content-length 时补上（HEAD 等场景体为空）。
+  let packet = Buffer.from(head, "latin1");
+  if (body != null) {
+    const buf = Buffer.isBuffer(body) ? body : typeof body === "string" ? Buffer.from(body) : null;
+    if (buf) {
+      if (!/content-length:/i.test(head)) {
+        packet = Buffer.concat([Buffer.from(head.replace(/\r\n\r\n$/, `\r\nContent-Length: ${buf.length}\r\n\r\n`), "latin1"), buf]);
+      } else {
+        packet = Buffer.concat([packet, buf]);
+      }
+    }
+  }
+  const stream = new ByteStream(sock, { idleMs });
+
+  const onAbort = () => {
+    try { sock.destroy(); } catch {}
+    stream.error = abortError();
+    stream.ended = true;
+    stream.detach();
+  };
+  if (signal) {
+    if (signal.aborted) {
+      try { sock.destroy(); } catch {}
+      throw abortError();
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+  }
+
+  sock.write(packet);
+  if (body != null && typeof body.pipe === "function") body.pipe(sock);
+
+  try {
+    const statusLine = await stream.readLine();
+    const status = parseStatusLine(statusLine);
+    if (status === 0) throw proxyError("EPARSE", `malformed status line: ${statusLine.slice(0, 80)}`);
+
+    const headers = {};
+    for (let n = 0; ; n++) {
+      const line = await stream.readLine();
+      if (line === "") break;
+      if (n >= MAX_HEADERS) throw proxyError("EHEADER", "too many response headers");
+      const ci = line.indexOf(":");
+      if (ci === -1) continue;
+      const k = line.slice(0, ci).trim().toLowerCase();
+      headers[k] = headers[k] !== undefined ? `${headers[k]}, ${line.slice(ci + 1).trim()}` : line.slice(ci + 1).trim();
+    }
+
+    const ce = (headers["content-encoding"] || "").toLowerCase();
+    const doDecode = ce === "gzip" || ce === "deflate" || ce === "br";
+    if (doDecode) delete headers["content-length"]; // 本地解压后长度不再匹配
+
+    const method = head.split(" ")[0].toUpperCase();
+    if (noBody(status, method)) {
+      try { sock.destroy(); } catch {}
+      const resp = new Response(null, { status, statusText: statusTextOf(statusLine), headers: new Headers(headers) });
+      Object.defineProperty(resp, "url", { value: url });
+      return resp;
+    }
+
+    const streamBody = new ReadableStream({
+      start(controller) {
+        (async () => {
+          const sink = makeBodyController(controller, ce);
+          try {
+            const te = (headers["transfer-encoding"] || "").toLowerCase();
+            if (te.includes("chunked")) {
+              for (;;) {
+                const line = await stream.readLine();
+                const size = parseInt(line.trim().split(";")[0], 16);
+                if (!Number.isFinite(size) || size <= 0) break;
+                if (size > MAX_CHUNK) throw proxyError("ECHUNK", "chunk too large");
+                await sink.write(await stream.readExactly(size));
+                await stream.readLine(); // chunk 尾部 CRLF
+              }
+            } else {
+              const hasCl = /^\d+$/.test((headers["content-length"] || "").trim());
+              let rem = hasCl ? Number(headers["content-length"]) : -1;
+              for (;;) {
+                const d = await stream.nextData();
+                if (d === null) break;
+                if (rem >= 0) {
+                  if (d.length >= rem) { await sink.write(d.subarray(0, rem)); rem = 0; }
+                  else { rem -= d.length; await sink.write(d); }
+                } else {
+                  await sink.write(d);
+                }
+                if (rem === 0) break;
+              }
+            }
+            await sink.finish();
+          } catch (e) {
+            sink.destroy();
+            try { controller.error(e); } catch {}
+          } finally {
+            try { sock.destroy(); } catch {}
+          }
+        })();
+      },
+    });
+
+    const resp = new Response(streamBody, { status, statusText: statusTextOf(statusLine), headers: new Headers(headers) });
+    Object.defineProperty(resp, "url", { value: url });
+    return resp;
+  } finally {
+    if (signal) signal.removeEventListener("abort", onAbort);
+  }
+}

package/lib/proxy/http2.js

@@ -0,0 +1,96 @@
+// lib/proxy/http2.js — 经 TLS socket 已协商出 h2（ALPN）时发起 HTTP/2 请求
+//
+// 用 node:http2 的 createConnection 挂到已建立的 TLS socket 上，避免重复
+// 握手；响应流式读 + 解压，对齐 fetch 语义。
+import http2 from "node:http2";
+import { proxyError, abortError } from "./errors.js";
+import { makeBodyController } from "./decode.js";
+
+/**
+ * @param {import("node:tls").TLSSocket} tlsSock 已与目标完成 TLS 且 ALPN=h2
+ * @param {string} authority Host[:port]
+ * @param {URL} urlObj
+ * @param {string} method
+ * @param {Record<string,string>} headers 普通头（不含伪头）
+ * @param {*} body string/Buffer 或 null
+ * @param {AbortSignal} [signal]
+ */
+export async function sendViaHttp2(tlsSock, authority, urlObj, method, headers, body, signal) {
+  const client = http2.connect(`https://${authority}`, { createConnection: () => tlsSock });
+  const reqHeaders = {
+    ":method": method,
+    ":path": urlObj.pathname + urlObj.search,
+    ":scheme": "https",
+    ":authority": authority,
+    ...headers,
+  };
+  if (body != null && (Buffer.isBuffer(body) || typeof body === "string")) {
+    reqHeaders["content-length"] = Buffer.byteLength(body);
+  }
+  const req = client.request(reqHeaders);
+  let onAbort = () => {};
+  try {
+    return await new Promise((resolve, reject) => {
+      let done = false;
+      const fin = (err, resp) => {
+        if (done) return;
+        done = true;
+        err ? reject(err) : resolve(resp);
+      };
+      onAbort = () => {
+        fin(abortError());
+        try { client.destroy(); } catch {}
+      };
+      if (signal) {
+        if (signal.aborted) return onAbort();
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
+      req.on("error", (e) => fin(proxyError("EHTTP2", `HTTP/2 request failed: ${e.message}`, e)));
+      req.on("response", (h) => {
+        try {
+          const status = Number(h[":status"]) || 0;
+          const headers = {};
+          for (const k of Object.keys(h)) {
+            if (k === ":status") continue;
+            const lk = k.toLowerCase();
+            headers[lk] = Array.isArray(h[k]) ? h[k].join(", ") : String(h[k]);
+          }
+          const ce = (headers["content-encoding"] || "").toLowerCase();
+          const doDecode = ce === "gzip" || ce === "deflate" || ce === "br";
+          if (doDecode) delete headers["content-length"];
+          if (status === 204 || status === 205 || status === 304) {
+            const empty = new Response(null, { status, headers: new Headers(headers) });
+            Object.defineProperty(empty, "url", { value: urlObj.href });
+            try { client.close(); } catch {}
+            return fin(null, empty);
+          }
+          const streamBody = new ReadableStream({
+            start(c) {
+              const sink = makeBodyController(c, ce);
+              if (sink.dec) {
+                req.on("data", (d) => { if (!sink.dec.write(d)) req.pause(); });
+                sink.dec.on("drain", () => req.resume());
+              } else {
+                req.on("data", (d) => { try { c.enqueue(new Uint8Array(d)); } catch {} });
+              }
+              req.on("end", () => { sink.finish(); try { client.close(); } catch {} });
+              req.on("error", (e) => { sink.destroy(); try { c.error(e); } catch {} });
+            },
+          });
+          const resp = new Response(streamBody, { status, headers: new Headers(headers) });
+          Object.defineProperty(resp, "url", { value: urlObj.href });
+          fin(null, resp);
+        } catch (e) {
+          fin(proxyError("EHTTP2", `HTTP/2 response parse failed: ${e.message}`, e));
+        }
+      });
+      if (body != null && (Buffer.isBuffer(body) || typeof body === "string")) {
+        req.end(Buffer.isBuffer(body) ? body : Buffer.from(body));
+      } else {
+        req.end();
+      }
+    });
+  } finally {
+    if (signal) signal.removeEventListener("abort", onAbort);
+  }
+}

package/lib/proxy/noproxy.js

@@ -0,0 +1,92 @@
+// lib/proxy/noproxy.js — NO_PROXY 命中判定（纯函数，零依赖）
+//
+// 支持的条目形式（大小写不敏感，条目可带端口）：
+//   - `*`                    ：全部命中
+//   - `<local>`              ：回环与 localhost 系列
+//   - `example.com` / `.example.com`：host 精确匹配或域名后缀
+//   - `example.com:443`      ：host + 端口同时匹配
+//   - `10.0.0.0/8`           ：IPv4 CIDR
+
+/** IPv4 字面量转 32 位整数；非 IPv4 返回 null。 */
+function ipv4ToInt(s) {
+  const p = String(s).split(".");
+  if (p.length !== 4) return null;
+  let n = 0;
+  for (const part of p) {
+    const v = Number(part);
+    if (!Number.isInteger(v) || v < 0 || v > 255) return null;
+    n = n * 256 + v;
+  }
+  return n;
+}
+
+/** 取 IPv4-mapped IPv6（::ffff:a.b.c.d / ::ffff:7f00:1）的低 32 位；非映射返回 null。 */
+function mappedIpv4(bare) {
+  const m = /^::ffff:(.+)$/i.exec(bare);
+  if (!m) return null;
+  const rest = m[1].toLowerCase();
+  if (rest.includes(".")) return ipv4ToInt(rest); // 点分十进制
+  const parts = rest.split(":").map((p) => parseInt(p, 16)); // 十六进制 1-4 段
+  if (parts.some((p) => !Number.isInteger(p) || p < 0 || p > 0xffff)) return null;
+  let n = 0;
+  for (const p of parts) n = n * 0x10000 + p;
+  return n;
+}
+
+/** 判定 rawUrl 是否命中 noProxy 列表（命中则直连）。 */
+export function isNoProxy(rawUrl, noProxy) {
+  if (!Array.isArray(noProxy) || noProxy.length === 0) return false;
+  let host;
+  let port = null;
+  try {
+    const u = new URL(rawUrl);
+    host = u.hostname.toLowerCase();
+    port = u.port ? Number(u.port) : u.protocol === "https:" ? 443 : 80;
+  } catch {
+    host = String(rawUrl).toLowerCase();
+  }
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+
+  for (const raw of noProxy) {
+    const e = String(raw || "").trim().toLowerCase();
+    if (!e) continue;
+    if (e === "*") return true;
+    if (e === "<local>") {
+      // 回环系列：localhost 子域、::1、127.0.0.0/8、IPv4-mapped 回环（::ffff:127.* 两种写法）
+      const mapped = mappedIpv4(bare);
+      if (host === "localhost" || host.endsWith(".localhost") || host === "::1" ||
+        bare.startsWith("127.") || (mapped != null && (mapped >>> 24) === 127)) return true;
+      continue;
+    }
+    // host:port 形式：端口不匹配则跳过该条；支持方括号 IPv6（[::1]:8080）
+    let onlyHost = e;
+    if (port != null) {
+      const bracket = /^\[([^\]]+)\]:(\d+)$/.exec(e);
+      if (bracket) {
+        if (Number(bracket[2]) !== port) continue;
+        onlyHost = bracket[1];
+      } else if (/^[^:]+:\d+$/.test(e)) {
+        const ci = e.lastIndexOf(":");
+        if (Number(e.slice(ci + 1)) !== port) continue;
+        onlyHost = e.slice(0, ci);
+      }
+    }
+    // IPv4 CIDR
+    if (onlyHost.includes("/")) {
+      const [cidrHost, cidrStr] = onlyHost.split("/");
+      const cidr = parseInt(cidrStr, 10);
+      const ip = ipv4ToInt(bare);
+      const base = ipv4ToInt(cidrHost);
+      if (ip != null && base != null && Number.isInteger(cidr) && cidr >= 0 && cidr <= 32) {
+        if (cidr === 0) return true;
+        const mask = cidr === 32 ? 0xffffffff : ~((1 << (32 - cidr)) - 1) >>> 0;
+        if ((ip & mask) === (base & mask)) return true;
+      }
+      continue;
+    }
+    // 支持 `.example.com` 与 `example.com` 两种写法（都匹配自身与子域）；bare 覆盖 IPv6 无括号写法
+    const domain = onlyHost.startsWith(".") ? onlyHost.slice(1) : onlyHost;
+    if (host === domain || bare === domain || host.endsWith("." + domain)) return true;
+  }
+  return false;
+}

package/lib/proxy/parse.js

@@ -0,0 +1,22 @@
+// lib/proxy/parse.js — 协议解析小工具（纯函数）
+import zlib from "node:zlib";
+
+/** 按 content-encoding 创建解压流；不支持或无编码时返回 null。 */
+export function createDecoder(ce) {
+  if (ce === "gzip") return zlib.createGunzip();
+  if (ce === "deflate") return zlib.createInflate();
+  if (ce === "br") return zlib.createBrotliDecompress();
+  return null;
+}
+
+/** 解析 HTTP 状态行（如 `HTTP/1.1 200 OK`），返回状态码；不匹配返回 0。 */
+export function parseStatusLine(line) {
+  const m = /^HTTP\/\d\.\d\s+(\d{3})/.exec(String(line || ""));
+  return m ? Number(m[1]) : 0;
+}
+
+/** 从状态行提取状态文本（OK / Not Found …），无则空串。 */
+export function statusTextOf(line) {
+  const m = /^HTTP\/\d\.\d\s+\d{3}\s*(.*)$/.exec(String(line || ""));
+  return m ? m[1].trim() : "";
+}

package/lib/proxy/request.js

@@ -0,0 +1,206 @@
+// lib/proxy/request.js — proxiedFetch 入口：输入规范化、NO_PROXY 直连判定、
+// 请求头组装、http/https 协议分发、TLS（SNI/ALPN）、重定向跟随（对齐 fetch 语义）。
+import net from "node:net";
+import tls from "node:tls";
+import { proxyError } from "./errors.js";
+import { connectProxy, httpConnect, socksConnect } from "./connect.js";
+import { sendViaSocket } from "./http11.js";
+import { sendViaHttp2 } from "./http2.js";
+import { isNoProxy } from "./noproxy.js";
+
+/** hop-by-hop 头：转发时移除（代理语义），Host 以计算值为准。 */
+const HOP_BY_HOP = ["proxy-connection", "keep-alive", "connection", "upgrade", "transfer-encoding", "host", "content-length", "accept-encoding"];
+
+/** 从 fetch init 提取 header 映射（支持 Headers 实例 / 数组 / 普通对象）。 */
+function collectHeaders(init) {
+  const out = {};
+  const src = init && init.headers;
+  if (src == null || typeof src !== "object") return out;
+  if (typeof Headers !== "undefined" && src instanceof Headers) {
+    src.forEach((v, k) => (out[k] = v));
+  } else if (Array.isArray(src)) {
+    for (const [k, v] of src) out[k] = v;
+  } else {
+    Object.assign(out, src);
+  }
+  return out;
+}
+
+/** 从 fetch init 读取单个头（不区分大小写）。 */
+function headerValue(init, name) {
+  const src = init && init.headers;
+  if (src == null || typeof src !== "object") return null;
+  if (typeof Headers !== "undefined" && src instanceof Headers) return src.get(name);
+  if (Array.isArray(src)) {
+    const lname = name.toLowerCase();
+    const f = src.find((x) => String(x[0]).toLowerCase() === lname);
+    return f ? f[1] : null;
+  }
+  for (const k of Object.keys(src)) {
+    if (k.toLowerCase() === name.toLowerCase()) return src[k];
+  }
+  return null;
+}
+
+/** 规范化请求体：string/Buffer 原样；URLSearchParams 转 Buffer；ReadableStream 有上限缓冲；
+ *  Blob 等 arrayBuffer 可转者读取；FormData 与未知类型显式拒绝（绝不静默发送空体）。 */
+const MAX_REQUEST_BODY = 512 * 1024 * 1024;
+
+async function normalizeBody(body) {
+  if (body == null) return null;
+  if (Buffer.isBuffer(body)) return body;
+  if (typeof body === "string") return Buffer.from(body);
+  if (body instanceof URLSearchParams) return Buffer.from(body.toString());
+  if (typeof FormData !== "undefined" && body instanceof FormData) {
+    throw proxyError("EBODY", "FormData request bodies are not supported through the proxy transport");
+  }
+  if (typeof ReadableStream !== "undefined" && body instanceof ReadableStream) {
+    // 无 Content-Length 的裸流无法可靠分帧；改为有上限缓冲后带 CL 发送（保留语义，拒绝超大）
+    const reader = body.getReader();
+    const parts = [];
+    let total = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.length;
+      if (total > MAX_REQUEST_BODY) throw proxyError("EBODY", "request body exceeds 512MB cap");
+      parts.push(Buffer.from(value));
+    }
+    return Buffer.concat(parts);
+  }
+  if (typeof body.arrayBuffer === "function") {
+    return Buffer.from(await body.arrayBuffer()); // Blob/ArrayBufferView；转换失败直接抛出，不吞错
+  }
+  throw proxyError("EBODY", "unsupported request body type");
+}
+
+/** 校验头名/值不含 CR/LF（防注入；含则拒绝）。 */
+function assertHeaderSafe(name, value) {
+  if (/[\r\n]/.test(name) || /[\r\n]/.test(String(value))) {
+    throw proxyError("EPROTO", "request header name/value contains CR or LF");
+  }
+}
+
+/** 解析输入为 { url, method }（支持 string / URL / Request-like）。 */
+function parseInput(input, init) {
+  if (typeof input === "string" || input instanceof URL) return { url: String(input), method: (init && init.method) || "GET" };
+  if (input && typeof input === "object" && input.url) {
+    return { url: String(input.url), method: (init && init.method) || input.method || "GET" };
+  }
+  throw new Error("proxiedFetch: invalid input");
+}
+
+/** 发起单次请求（不跟随重定向）。 */
+async function proxiedOnce(url, init, proxy, originalFetch) {
+  const urlObj = new URL(url);
+  const method = ((init && init.method) || "GET").toUpperCase();
+  const body = await normalizeBody(init && init.body);
+  const signal = init && init.signal;
+
+  if (isNoProxy(url, proxy.noProxy)) {
+    return originalFetch(url, init);
+  }
+
+  const targetHostRaw = urlObj.hostname; // IPv6 形如 [::1]
+  const targetHost = targetHostRaw.startsWith("[") && targetHostRaw.endsWith("]") ? targetHostRaw.slice(1, -1) : targetHostRaw;
+  const defaultPort = urlObj.protocol === "https:" ? 443 : 80;
+  const targetPort = urlObj.port ? Number(urlObj.port) : defaultPort;
+  const hostHeader = targetPort === defaultPort ? targetHostRaw : `${targetHostRaw}:${targetPort}`;
+  const isSocks = proxy.protocol === "socks5";
+
+  // 组装头：去掉 hop-by-hop；accept-encoding 尊重调用方显式声明，否则 identity
+  const headers = collectHeaders(init);
+  for (const h of HOP_BY_HOP) delete headers[h];
+  const declaredAE = headerValue(init, "accept-encoding");
+  headers["accept-encoding"] = declaredAE != null && String(declaredAE).trim() !== "" ? String(declaredAE) : "identity";
+
+  if (urlObj.protocol === "https:") {
+    // HTTPS 目标：先建隧道，再 TLS（IP 目标不发 SNI；ALPN 协商 h2/http1.1）
+    let raw;
+    if (isSocks) raw = await socksConnect(proxy, targetHost, targetPort, signal, { handshakeTimeoutMs: proxy.timeout });
+    else raw = await httpConnect(proxy, targetHost, targetPort, signal, { handshakeTimeoutMs: proxy.timeout });
+    try {
+      const isIP = net.isIP(targetHost);
+      const tlsSock = tls.connect({
+        socket: raw,
+        servername: isIP ? undefined : targetHost,
+        host: targetHost,
+        port: targetPort,
+        ALPNProtocols: ["h2", "http/1.1"],
+      });
+      await new Promise((resolve, reject) => {
+        tlsSock.once("secureConnect", () => { tlsSock.removeAllListeners("error"); resolve(); });
+        tlsSock.once("error", (e) => reject(proxyError("ETLS", `TLS to ${targetHost} failed: ${e.message}`, e)));
+      });
+      if (tlsSock.alpnProtocol === "h2") {
+        return sendViaHttp2(tlsSock, hostHeader, urlObj, method, headers, body, signal);
+      }
+      const path = urlObj.pathname + urlObj.search;
+      const h = { Host: hostHeader, Connection: "close", ...headers };
+      for (const [k, v] of Object.entries(h)) assertHeaderSafe(k, v);
+      const head = `${method} ${path} HTTP/1.1\r\n${Object.entries(h).map(([k, v]) => `${k}: ${v}`).join("\r\n")}\r\n\r\n`;
+      return await sendViaSocket(tlsSock, url, head, body, { signal, idleMs: proxy.timeout });
+    } catch (e) {
+      try { raw.destroy(); } catch {}
+      throw e;
+    }
+  }
+
+  if (urlObj.protocol === "http:") {
+    // HTTP 目标：绝对 URL 形式发往代理
+    const sock = await connectProxy(proxy, signal, { connectTimeoutMs: proxy.timeout });
+    try {
+      const absUrl = `${urlObj.protocol}//${urlObj.host}${urlObj.pathname}${urlObj.search}`;
+      const proxyAuth = proxy.username || proxy.password
+        ? { "Proxy-Authorization": "Basic " + Buffer.from(`${proxy.username || ""}:${proxy.password || ""}`).toString("base64") }
+        : {};
+      const h = { Host: urlObj.host, Connection: "close", ...proxyAuth, ...headers };
+      for (const [k, v] of Object.entries(h)) assertHeaderSafe(k, v);
+      const head = `${method} ${absUrl} HTTP/1.1\r\n${Object.entries(h).map(([k, v]) => `${k}: ${v}`).join("\r\n")}\r\n\r\n`;
+      return await sendViaSocket(sock, url, head, body, { signal, idleMs: proxy.timeout });
+    } catch (e) {
+      try { sock.destroy(); } catch {}
+      throw e;
+    }
+  }
+
+  throw proxyError("EPROTO", `unsupported protocol ${urlObj.protocol}`);
+}
+
+/**
+ * 把一次 fetch 请求经代理发出（含重定向跟随，最多 5 跳；命中 NO_PROXY 直连）。
+ * @param {string|URL|{url:string}} input
+ * @param {RequestInit} [init]
+ * @param {{protocol:string,host:string,port:number,username?:string,password?:string,noProxy?:string[],timeout?:number}} proxy
+ * @param {typeof fetch} originalFetch 直连路径使用的原始 fetch
+ */
+export async function proxiedFetch(input, init = {}, proxy, originalFetch) {
+  const { url, method } = parseInput(input, init);
+  let curUrl = url;
+  let curInit = { ...init };
+  for (let hop = 0; hop <= 5; hop++) {
+    const resp = await proxiedOnce(curUrl, curInit, proxy, originalFetch);
+    const status = resp.status;
+    if (status === 301 || status === 302 || status === 303 || status === 307 || status === 308) {
+      const loc = resp.headers ? resp.headers.get("location") : null;
+      if (loc) {
+        const next = new URL(loc, curUrl).href;
+        // 303 → GET；301/302 对 POST 也降级为 GET（对齐 fetch 行为）
+        let nextInit = { ...curInit };
+        if (status === 303 || ((status === 301 || status === 302) && method === "POST")) {
+          nextInit = { ...nextInit, method: "GET", body: undefined, headers: { ...(curInit.headers || {}) } };
+          if (typeof Headers !== "undefined" && curInit.headers instanceof Headers) {
+            const h = new Headers();
+            curInit.headers.forEach((v, k) => { if (!/^content-/i.test(k)) h.set(k, v); });
+            nextInit.headers = h;
+          }
+        }
+        curUrl = next;
+        curInit = nextInit;
+        continue;
+      }
+    }
+    return resp;
+  }
+  throw proxyError("EREDIRECT", "too many redirects");
+}