dsh-proxy-routing 0.4.1

package/lib/tools.js

@@ -0,0 +1,453 @@
+// lib/tools.js — agent 工具层：v2 路由控制面
+//
+// 写操作（enable/disable）走 tools/pre-execute 审批门禁：full access 权限等级
+// （会话生效 sandbox mode 为 danger-full-access）免询问直接放行，更低等级需
+// 经人类批准；enable 只改 Agent binding（可顺带更新 default profile 端点），
+// disable 只置 Agent 直连，均不动显式 provider 覆盖。未配置端点时给出固定
+// 指引，绝不静默采用默认代理。
+import { defineTool } from "@deepseek-ai/dsh-tools";
+import { UNCONFIGURED_GUIDANCE } from "./config.js";
+import { enableProfile, agentDirect } from "./actions.js";
+import { discoverProxies } from "./discovery.js";
+
+function statusProbe(result) {
+  return {
+    ok: result.ok,
+    connectMs: result.connectMs,
+    totalMs: result.totalMs,
+    httpStatus: result.httpStatus,
+    ...(typeof result.error === "string" ? { error: result.error } : {}),
+  };
+}
+
+/**
+ * Register five net_proxy_* tools.
+ * @param {import('@deepseek-ai/cordis').Context} ctx
+ * @param {object} control
+ * @param {()=>object} control.getStatus 公开状态（buildStatus 产物，已脱敏）
+ * @param {(opts:{apply:(c:object)=>object, persist?:boolean})=>Promise<object>} control.mutate
+ * @param {(proxy:object, opts?:object)=>Promise<object>} control.probe 探测（显式路由，不改状态）
+ */
+export function registerProxyTools(ctx, control) {
+  ctx.tools.register(defineTool({
+    name: "net_proxy_status",
+    description: "查询网络出口路由插件的当前状态：配置修订号、default profile 是否已配置端点、Agent 生效路由（直连/代理，脱敏端点）、provider 覆盖、fetch 路由归属、子进程适配与持久 shell 代际。可选 verify=true 顺带探测一次连通性（会花几秒）。",
+    parameters: {
+      verify: { type: "boolean", default: false, description: "是否顺带探测代理连通性（默认 false）" },
+    },
+    output: {
+      schema: {
+        type: "object",
+        properties: {
+          revision: { type: "number" },
+          migration: {
+            oneOf: [
+              { type: "object", properties: { from: { type: "string" }, configured: { type: "boolean" } }, additionalProperties: false },
+              { type: "null" },
+            ],
+          },
+          profiles: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                id: { type: "string" },
+                configured: { type: "boolean" },
+                protocol: { type: "string" },
+                host: { type: "string" },
+                port: { type: "number" },
+                hasUsername: { type: "boolean" },
+                hasPassword: { type: "boolean" },
+                noProxy: { type: "array", items: { type: "string" } },
+                timeout: { type: "number" },
+              },
+              additionalProperties: false,
+            },
+          },
+          agent: {
+            type: "object",
+            properties: {
+              route: {
+                type: "object",
+                properties: {
+                  kind: { type: "string" },
+                  profileId: { type: "string" },
+                  endpoint: {
+                    type: "object",
+                    properties: {
+                      protocol: { type: "string" },
+                      host: { type: "string" },
+                      port: { type: "number" },
+                      hasUsername: { type: "boolean" },
+                      hasPassword: { type: "boolean" },
+                    },
+                    additionalProperties: false,
+                  },
+                },
+                additionalProperties: false,
+              },
+              generation: { type: "number" },
+            },
+            additionalProperties: false,
+          },
+          providers: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                provider: { type: "string" },
+                route: {
+                  type: "object",
+                  properties: {
+                    kind: { type: "string" },
+                    profileId: { type: "string" },
+                  },
+                  additionalProperties: false,
+                },
+              },
+              additionalProperties: false,
+            },
+          },
+          gateway: {
+            type: "object",
+            properties: {
+              enabled: { type: "boolean" },
+              port: { type: "number" },
+              dedicatedPurposePorts: { type: "boolean" },
+              purposes: { type: "array", items: { type: "string" } },
+            },
+            additionalProperties: false,
+          },
+          fetchRouter: {
+            type: "object",
+            properties: { owned: { type: "boolean" }, owners: { type: "number" } },
+            additionalProperties: false,
+          },
+          shell: {
+            oneOf: [
+              {
+                type: "object",
+                properties: {
+                  generation: { type: "number" },
+                  persistentShells: {
+                    type: "array",
+                    items: {
+                      type: "object",
+                      properties: {
+                        agentId: { oneOf: [{ type: "string" }, { type: "null" }] },
+                        stale: { type: "boolean" },
+                        current: { type: "boolean" },
+                      },
+                      additionalProperties: false,
+                    },
+                  },
+                },
+                additionalProperties: false,
+              },
+              { type: "null" },
+            ],
+          },
+          probe: {
+            oneOf: [
+              {
+                type: "object",
+                properties: {
+                  ok: { type: "boolean" },
+                  connectMs: { type: "number" },
+                  totalMs: { type: "number" },
+                  httpStatus: { type: "number" },
+                  error: { type: "string" },
+                },
+                additionalProperties: false,
+              },
+              { type: "null" },
+            ],
+          },
+        },
+        additionalProperties: false,
+      },
+      render: (_args, value) => [{ type: "text", text: describeStatus(value) }],
+    },
+    async execute(args) {
+      const out = control.getStatus();
+      if (args.verify) {
+        const route = out.agent.route;
+        if (route.kind === "profile" && route.endpoint) {
+          const { protocol, host, port } = route.endpoint;
+          const pr = await control.probe({ protocol, host, port }, {});
+          out.probe = statusProbe(pr);
+        } else {
+          out.probe = { ok: false, error: "当前 Agent 路由为直连或未配置，无需/无法探测代理" };
+        }
+      }
+      return out;
+    },
+  }));
+
+  ctx.tools.register(defineTool({
+    name: "net_proxy_discover",
+    description: "仅在当前会话 Full Access（danger-full-access）下，扫描代理环境变量和有限的本机常见代理端口并探测连通性；只报告候选，不写入配置、不启用代理。受限权限不会扫描，会返回请用户提供 protocol/host/port 的引导。",
+    parameters: {
+      url: { type: "string", description: "探测目标 URL（默认 gstatic generate_204）" },
+      timeout: { type: "number", description: "每个候选的超时毫秒（默认 1500，最大 5000）" },
+    },
+    output: {
+      schema: {
+        type: "object",
+        properties: {
+          allowed: { type: "boolean" },
+          message: { type: "string" },
+          scanned: { type: "number" },
+          candidates: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                source: { type: "string" },
+                protocol: { type: "string" },
+                host: { type: "string" },
+                port: { type: "number" },
+                ok: { type: "boolean" },
+                connectMs: { type: "number" },
+                totalMs: { type: "number" },
+                httpStatus: { type: "number" },
+                error: { type: "string" },
+              },
+              additionalProperties: false,
+            },
+          },
+        },
+        additionalProperties: false,
+      },
+      render: (_args, value) => [{ type: "text", text: value.message }],
+    },
+    async execute(args, exec) {
+      if (!isFullAccess(exec, ctx)) {
+        return {
+          allowed: false,
+          message: "当前会话不是 Full Access，出于权限边界不会主动扫描本机代理；请向用户询问已运行代理的 protocol/host/port，再使用 net_proxy_probe 检测。",
+          scanned: 0,
+          candidates: [],
+        };
+      }
+      const timeout = Math.min(Math.max(Number.isFinite(args.timeout) ? args.timeout : 1500, 250), 5000);
+      const found = await discoverProxies({ target: args.url, timeout });
+      return {
+        allowed: true,
+        message: found.candidates.length > 0
+          ? `发现 ${found.candidates.length} 个可用代理候选；请先确认候选用途，再请求 net_proxy_enable。`
+          : `未发现可用代理候选（已扫描 ${found.scanned} 个候选）；请向用户询问 protocol/host/port。`,
+        scanned: found.scanned,
+        candidates: found.candidates,
+      };
+    },
+  }));
+  ctx.tools.register(defineTool({
+    name: "net_proxy_probe",
+    description: "用当前 default profile（或临时指定的 protocol/host/port）做一次连通与延迟探测，不改动任何配置。未配置端点时返回固定指引。",
+    parameters: {
+      url: { type: "string", description: "探测目标 URL（默认 gstatic generate_204）" },
+      protocol: { type: "string", enum: ["http", "socks5"], description: "临时覆盖协议（不持久化）" },
+      host: { type: "string", description: "临时覆盖代理地址（不持久化）" },
+      port: { type: "number", description: "临时覆盖代理端口（不持久化）" },
+      username: { type: "string", description: "临时覆盖认证用户名（不持久化）" },
+      password: { type: "string", description: "临时覆盖认证密码（不持久化）" },
+      timeout: { type: "number", description: "超时毫秒（默认 15000）" },
+    },
+    output: {
+      schema: {
+        type: "object",
+        properties: {
+          ok: { type: "boolean" },
+          connectMs: { type: "number" },
+          totalMs: { type: "number" },
+          httpStatus: { type: "number" },
+          target: { type: "string" },
+          error: { type: "string" },
+        },
+        additionalProperties: false,
+      },
+      render: (_args, value) => [{
+        type: "text",
+        text: value.ok
+          ? `代理链路正常：${value.target} → HTTP ${value.httpStatus}（TCP ${value.connectMs}ms / 总 ${value.totalMs}ms）`
+          : `代理链路不可用：${value.error || "unknown"}（TCP ${value.connectMs}ms / 总 ${value.totalMs}ms）`,
+      }],
+    },
+    async execute(args) {
+      const status = control.getStatus();
+      const profile = status.profiles.find((p) => p.id === "default");
+      const hasEndpoint = args.host !== undefined || args.port !== undefined;
+      const usable = profile?.configured || hasEndpoint;
+      if (!usable) {
+        return { ok: false, error: UNCONFIGURED_GUIDANCE };
+      }
+      const probeCfg = {
+        protocol: args.protocol ?? profile?.protocol ?? "http",
+        host: args.host ?? profile?.host,
+        port: args.port ?? profile?.port,
+        username: args.username,
+        password: args.password,
+        noProxy: profile?.noProxy ?? [],
+        timeout: args.timeout ?? profile?.timeout ?? 60000,
+      };
+      return control.probe(probeCfg, { target: args.url, timeout: args.timeout });
+    },
+  }));
+
+  ctx.tools.register(defineTool({
+    name: "net_proxy_enable",
+    description: "启用网络代理：把 Agent 路由指向 default profile；可顺带更新该 profile 的 protocol/host/port/noProxy 等端点并持久化。未配置端点且未提供 host/port 时给出配置指引。此操作需要人类批准。",
+    parameters: {
+      protocol: { type: "string", enum: ["http", "socks5"], description: "代理协议：http（含 CONNECT 隧道，Clash/v2rayN 等默认）或 socks5" },
+      host: { type: "string", description: "代理地址（如 127.0.0.1）" },
+      port: { type: "number", description: "代理端口（如 Clash Verge 为 7897，1-65535）" },
+      username: { type: "string", description: "可选认证用户名" },
+      password: { type: "string", description: "可选认证密码" },
+      noProxy: { type: "array", items: { type: "string" }, description: "直连白名单（host / .domain / host:port / CIDR / <local> / *）" },
+    },
+    output: {
+      schema: {
+        type: "object",
+        properties: {
+          ok: { type: "boolean" },
+          message: { type: "string" },
+          config: {
+            type: "object",
+            properties: {
+              id: { type: "string" },
+              configured: { type: "boolean" },
+              protocol: { type: "string" },
+              host: { type: "string" },
+              port: { type: "number" },
+              hasUsername: { type: "boolean" },
+              hasPassword: { type: "boolean" },
+              noProxy: { type: "array", items: { type: "string" } },
+              timeout: { type: "number" },
+            },
+            additionalProperties: false,
+          },
+        },
+        additionalProperties: false,
+      },
+      render: (_args, value) => [{ type: "text", text: value.message }],
+    },
+    async execute(args) {
+      if (args.port !== undefined && (!Number.isInteger(args.port) || args.port < 1 || args.port > 65535)) {
+        throw new Error(`net_proxy_enable: port 必须是 1-65535 的整数，收到 ${args.port}`);
+      }
+      const endpoint = {
+        ...(args.protocol !== undefined ? { protocol: args.protocol } : {}),
+        ...(args.host !== undefined ? { host: args.host } : {}),
+        ...(args.port !== undefined ? { port: args.port } : {}),
+        ...(args.username !== undefined ? { username: args.username } : {}),
+        ...(args.password !== undefined ? { password: args.password } : {}),
+        ...(args.noProxy !== undefined ? { noProxy: args.noProxy } : {}),
+      };
+      let result;
+      try {
+        result = await control.mutate({ apply: (c) => enableProfile(c, endpoint), persist: true });
+      } catch (error) {
+        if (error && error.code === "UNCONFIGURED_PROFILE") throw new Error(UNCONFIGURED_GUIDANCE);
+        throw error;
+      }
+      const status = control.getStatus();
+      const profile = status.profiles.find((p) => p.id === "default");
+      return {
+        ok: true,
+        message: profile?.configured
+          ? `代理已启用：${profile.protocol}://${profile.host}:${profile.port}（修订 #${result.revision}）`
+          : `代理已启用（修订 #${result.revision}）`,
+        config: profile,
+      };
+    },
+  }));
+
+  ctx.tools.register(defineTool({
+    name: "net_proxy_disable",
+    description: "停用网络代理：把 Agent 路由置为直连。显式 provider 覆盖保持独立，不受影响。此操作需要人类批准。",
+    parameters: {},
+    output: {
+      schema: {
+        type: "object",
+        properties: {
+          ok: { type: "boolean" },
+          message: { type: "string" },
+        },
+        additionalProperties: false,
+      },
+      render: (_args, value) => [{ type: "text", text: value.message }],
+    },
+    async execute() {
+      const result = await control.mutate({ apply: agentDirect, persist: true });
+      return { ok: true, message: `代理已停用，Agent 路由恢复直连（修订 #${result.revision}）` };
+    },
+  }));
+}
+
+/**
+ * 会话生效的权限等级是否为 full access（sandbox mode = danger-full-access）。
+ * 折叠会话日志中最后一个 `sandbox/mode` 事件（与 dsh-sandbox-policy 的
+ * effectiveSandboxMode 同语义）；无会话级覆盖时回退到 shell 服务的部署默认
+ * 模式。无法判定时 fail-closed：视为受限等级（需要询问）。
+ * @param {object} exec tools/pre-execute 的 exec 载荷
+ * @param {import('@deepseek-ai/cordis').Context} ctx
+ */
+function isFullAccess(exec, ctx) {
+  const events = exec?.agent?.session?.events;
+  if (Array.isArray(events)) {
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+      const event = events[index];
+      if (event?.type === "sandbox/mode") return event?.data?.mode === "danger-full-access";
+    }
+  }
+  return ctx?.shell?.sandboxMode === "danger-full-access";
+}
+
+/**
+ * 审批门禁：net_proxy_enable / net_proxy_disable 调用需经 dsh 审批 seam。
+ * 权限分级：full access（danger-full-access）等级免询问直接放行；
+ * 其他低等级（read-only / workspace-write 等）返回 ask，经人类批准后生效。
+ * @param {import('@deepseek-ai/cordis').Context} ctx
+ */
+export function installApprovalGate(ctx) {
+  ctx.on("tools/pre-execute", async (exec, next) => {
+    if (exec.name === "net_proxy_enable" || exec.name === "net_proxy_disable") {
+      if (isFullAccess(exec, ctx)) return next();
+      return {
+        kind: "ask",
+        reason: exec.name === "net_proxy_enable"
+          ? "启用网络代理：Agent 的 shell 执行与未覆盖的 LLM provider 流量将改经本机代理发出"
+          : "停用网络代理：Agent 路由恢复直连",
+      };
+    }
+    return next();
+  });
+}
+
+/** 状态文本描述（render 用）。 */
+function describeStatus(value) {
+  const parts = [`修订 #${value.revision}`];
+  const profile = value.profiles?.find((p) => p.id === "default");
+  parts.push(profile?.configured
+    ? `default 已配置：${profile.protocol}://${profile.host}:${profile.port}${profile.hasUsername ? "（含认证）" : ""}`
+    : "default 未配置端点");
+  const route = value.agent?.route;
+  parts.push(route?.kind === "profile"
+    ? `Agent 路由：代理（${route.endpoint?.protocol}://${route.endpoint?.host}:${route.endpoint?.port}）`
+    : "Agent 路由：直连");
+  if (value.agent?.generation) parts.push(`策略代际 #${value.agent.generation}`);
+  if (value.providers?.length) parts.push(`provider 覆盖：${value.providers.map((p) => p.provider).join(", ")}`);
+  if (value.fetchRouter) parts.push(`fetch 路由：${value.fetchRouter.owned ? `已接管（${value.fetchRouter.owners} owner）` : "未接管"}`);
+  if (value.shell) {
+    const stale = value.shell.persistentShells.filter((s) => s.stale).length;
+    parts.push(`持久 shell：${value.shell.persistentShells.length} 个，其中 ${stale} 个为旧策略（需重置）`);
+  }
+  if (value.migration) parts.push(`配置迁移：${value.migration.from}（configured=${value.migration.configured}）`);
+  if (value.probe) {
+    parts.push(value.probe.ok
+      ? `探测：正常（HTTP ${value.probe.httpStatus}）`
+      : `探测：不可用（${value.probe.error || "unknown"}）`);
+  }
+  return parts.join("；");
+}

package/package.json

@@ -0,0 +1,114 @@
+{
+  "name": "dsh-proxy-routing",
+  "version": "0.4.1",
+  "description": "DSH 网络出口路由插件：通过官方 proxy-routing settings namespace 接入用户已运行的 HTTP/SOCKS5 代理，按每次执行路由 shell 与 LLM provider 流量。",
+  "type": "module",
+  "main": "lib/index.js",
+  "license": "MIT",
+  "files": [
+    "lib",
+    "tools",
+    "README.md",
+    "README.zh.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "cordis.patch.yml"
+  ],
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "keywords": [
+    "deepseek",
+    "harness",
+    "dsh",
+    "dsh-plugin",
+    "proxy",
+    "http",
+    "socks5",
+    "network"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chenjiyan2001/dsh-proxy-routing.git"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-web-react"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.0",
+    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-web-react": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6",
+    "@deepseek-ai/schemastery": ">=3.0.0",
+    "react": "^18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": { "optional": true },
+    "@deepseek-ai/dsh-client-connection": { "optional": true },
+    "@deepseek-ai/dsh-client-locale": { "optional": true },
+    "@deepseek-ai/dsh-client-runtime": { "optional": true },
+    "@deepseek-ai/dsh-client-ui-settings": { "optional": true },
+    "@deepseek-ai/dsh-client-ui-slots": { "optional": true },
+    "@deepseek-ai/dsh-client-web-react": { "optional": true },
+    "@deepseek-ai/dsh-settings": { "optional": true },
+    "@deepseek-ai/dsh-tools": { "optional": true },
+    "@deepseek-ai/schemastery": { "optional": true },
+    "react": { "optional": true }
+  },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.0",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-web-react": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-code-runtime": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-scope": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-settings": "0.1.1-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-timeout": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6",
+    "@deepseek-ai/dsh-user-approval": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": ">=3.0.0",
+    "@types/node": "^22.20.0",
+    "@types/react": "~18.3.1",
+    "lightningcss": "^1.32.0",
+    "react": "^18.3.1",
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.3"
+  },
+  "scripts": {
+    "test": "bash tools/gen-cert.sh && NODE_EXTRA_CA_CERTS=$PWD/tests/.certs/cert.pem node --test \"tests/*.test.mjs\"",
+    "build:client": "tsdown --config tsdown.client.config.ts",
+    "probe": "node tools/proxy-probe.mjs"
+  }
+}

package/tools/gen-cert.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# tools/gen-cert.sh — 生成集成测试用的自签证书（localhost SAN）
+# 输出到 tests/.certs/{cert,key}.pem；测试以 NODE_EXTRA_CA_CERTS 信任之。
+set -euo pipefail
+cd "$(dirname "$0")/.."
+mkdir -p tests/.certs
+if [[ ! -f tests/.certs/cert.pem || ! -f tests/.certs/key.pem ]]; then
+  openssl req -x509 -newkey rsa:2048 -nodes \
+    -keyout tests/.certs/key.pem -out tests/.certs/cert.pem -days 30 \
+    -subj "/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" 2>/dev/null
+fi
+echo "cert ready: tests/.certs/cert.pem"

package/tools/proxy-probe.mjs

@@ -0,0 +1,49 @@
+// tools/proxy-probe.mjs — 命令行探测：测试本机代理链路（不改任何配置）
+//
+// 用法：
+//   node tools/proxy-probe.mjs [--proxy http://127.0.0.1:7897] [--target https://www.gstatic.com/generate_204]
+// 缺省 --proxy 时读取官方 `$DSH_HOME/settings.yaml` 的 `proxy-routing` section。
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { probeProxy } from "../lib/probe.js";
+import { canonicalDefaults, toProxy, validateCanonical } from "../lib/config.js";
+
+const args = process.argv.slice(2);
+const flag = (name, dflt) => {
+  const i = args.indexOf(name);
+  return i >= 0 && args[i + 1] ? args[i + 1] : dflt;
+};
+
+let proxy;
+const rawProxy = flag("--proxy", "");
+if (rawProxy) {
+  try {
+    const u = new URL(rawProxy);
+    proxy = { protocol: u.protocol === "socks5:" ? "socks5" : "http", host: u.hostname, port: Number(u.port || 7890), noProxy: [] };
+  } catch {
+    console.error(`无法解析 --proxy: ${rawProxy}`);
+    process.exit(2);
+  }
+} else {
+  const home = process.env.DSH_HOME || path.join(os.homedir(), ".dsh");
+  const settingsFile = path.join(home, "settings.yaml");
+  let document = {};
+  if (fs.existsSync(settingsFile)) {
+    document = parseYaml(fs.readFileSync(settingsFile, "utf8")) ?? {};
+  }
+  const canonical = validateCanonical(document["proxy-routing"] ?? canonicalDefaults());
+  proxy = toProxy(canonical);
+  if (!proxy.protocol || !proxy.host || !proxy.port) {
+    console.error("proxy-routing settings 中未配置可探测的代理端点");
+    process.exit(2);
+  }
+  console.log(`使用已保存配置: ${proxy.protocol}://${proxy.host}:${proxy.port}`);
+}
+
+const target = flag("--target", "https://www.gstatic.com/generate_204");
+console.log(`探测目标: ${target}`);
+const res = await probeProxy(proxy, { target });
+console.log(JSON.stringify(res, null, 2));
+process.exit(res.ok ? 0 : 1);