dsh-rss 0.4.3 → 0.5.0

package/README.en.md

@@ -1,4 +1,14 @@
-# dsh-rss
+# dsh-rss
+
+## 0.5.0 update (2026-10-02)
+
+Adds **Settings → RSS subscriptions** with add/edit/remove, search, category filters, feed checks and OPML import/export. The panel and conversation tools share the existing subscription list. No migration is needed. UI labels follow the host language and appearance settings.
+
+Import previews new feeds, duplicate changes and rejected items before confirmation. Existing labels/categories are preserved by default; updates require an explicit checkbox. Failed saves and stale previews preserve your input. Removing a feed requires confirmation of its name and URL.
+
+Fixes partial imports of malformed XML, acceptance of invalid URLs or embedded credentials, and lost subscriptions during concurrent additions. Check history lasts for the current DSH run; importing does not fetch every feed.
+
+All 94 Windows tests pass. Actual browser interaction in official-source Harness `0.2.0-rc.2` covers add/edit/filter/check/import/remove, Tab/Enter/Escape, two-page conflicts and restart persistence. Native desktop and narrow-screen interaction remain unverified in this run. Synthetic feeds do not establish production-network compatibility.
 
 ## 0.4.3 update (2026-10-01)
 
@@ -26,7 +36,17 @@ Fetches honor the Harness cancellation signal through DNS, response streaming, a
 dsh plugin --profile web add dsh-rss
 ```
 
-Restart the web service after installing. Ask your assistant to subscribe to an RSS URL or list your subscriptions; ordinary subscription management needs no configuration-file editing.
+Restart the web service after installing. Ask your assistant to subscribe to an RSS URL or list your subscriptions; ordinary subscription management needs no configuration-file editing.
+
+For the desktop profile, use `dsh plugin --profile desktop add dsh-rss` and reopen DSH after installation or updates. The shared web settings surface provides the panel in both shells. Update older installed versions through the plugin manager first.
+
+## Subscription panel
+
+Open **Settings → RSS subscriptions**. New URLs are fetched and checked before saving; the name and category are optional. Renaming or recategorizing an unchanged URL works without the remote feed being online.
+
+Choose an OPML file (up to 1 MiB) or paste its text, review the preview, then confirm. Rejected URLs include a reason. If another page or tool changed the list, preview again without retyping. Export downloads OPML without changing subscriptions.
+
+Cards show the most recent check/fetch time, article count or error during this run. Read-only configurations allow viewing, checking and exporting.
 
 ## Uninstall
 

package/README.md

@@ -1,6 +1,16 @@
 [English](README.en.md)
 
-# dsh-rss
+# dsh-rss
+
+## 0.5.0 更新（2026-10-02）
+
+新增 **设置 → RSS 订阅** 面板：添加、编辑、移除、搜索、分类筛选、检查可用性与 OPML 导入导出。面板与对话工具共用原有订阅列表，不需要迁移数据。跟随 DSH 的中文/英文和外观设置。
+
+OPML 导入先预览新增、重复和无效项，再确认保存。默认保留重复订阅的名称和分类；勾选更新时会展示变化。保存失败或预览过期时保留输入。移除订阅需要确认具体名称和地址。
+
+同时修复损坏 XML 被部分导入、无效/含密码 URL 被接受，以及并发添加覆盖另一笔订阅的问题。检查记录只保留在本次 DSH 运行中，导入不会自动抓取全部订阅。
+
+94 项 Windows 测试通过；在官方 Harness `0.2.0-rc.2` 中实际操作了添加、编辑、筛选、检查、导入、移除、Tab/Enter/Esc、双页面冲突和重启持久化。桌面原生窗口与窄屏交互本轮未完成验收，外部生产订阅未替代为本地模拟测试。
 
 ## 0.4.3 更新（2026-10-01）
 
@@ -31,7 +41,17 @@ DSH（DeepSeek Harness）的 RSS/Atom 订阅工具插件：管理订阅源，抓
 dsh plugin --profile web add dsh-rss
 ```
 
-安装后重启 Web 服务即可。直接对助手说「订阅这个 RSS 地址，命名为技术资讯」或「列出我的订阅」即可使用，日常增删订阅不需要编辑配置文件。
+安装后重启 Web 服务即可。直接对助手说「订阅这个 RSS 地址，命名为技术资讯」或「列出我的订阅」即可使用，日常增删订阅不需要编辑配置文件。
+
+桌面版使用 `dsh plugin --profile desktop add dsh-rss`，安装或更新后重新打开 DSH。网页和桌面的共享设置页面均可显示订阅面板；已安装的旧版本请先通过插件管理器更新。
+
+## 订阅面板
+
+打开 **设置 → RSS 订阅**。添加时填写 RSS/Atom 地址，名称可留空，分类可选。新地址通过抓取检查后才会保存；编辑原地址的名称或分类不需要源网站在线。
+
+导入可选择不超过 1 MiB 的 OPML 文件或粘贴文本。先检查预览，再点击确认；跳过的地址会说明原因。已有订阅发生变化时重新预览即可，原输入仍保留。导出通过浏览器下载 OPML，不会修改订阅。
+
+列表卡片显示最近一次手动检查或工具抓取的时间和文章数，失败时显示具体原因。只读配置仍可查看、检查和导出。
 
 ## 卸载
 

package/lib/client.js

@@ -0,0 +1,202 @@
+// This is the browser source. tsc does not rebuild it; check with node --check.
+window.__ModuleLoader__.load({ id: 'dsh-rss', factory: require => {
+  const React = require('react');
+  const { useState, useEffect, useRef, useId } = React;
+  const h = React.createElement;
+  const ROUTE = '_dsh/dsh-rss/subscriptions';
+  let language = 'zh';
+  const listeners = new Set();
+  const words = {
+    title: ['RSS 订阅', 'RSS subscriptions'], intro: ['在这里管理订阅，也可以在对话里让 AI 读取和搜索文章。', 'Manage feeds here, then ask AI to read or search articles in a conversation.'],
+    add: ['添加订阅', 'Add feed'], import: ['导入 OPML', 'Import OPML'], export: ['导出 OPML', 'Export OPML'], refresh: ['刷新列表', 'Refresh list'],
+    search: ['搜索名称或地址', 'Search name or URL'], category: ['分类', 'Category'], all: ['全部分类', 'All categories'], uncategorized: ['未分类', 'Uncategorized'],
+    name: ['显示名称', 'Display name'], nameHint: ['留空时使用订阅源的标题', 'Leave blank to use the feed title'], url: ['订阅源地址', 'Feed URL'], categoryHint: ['例如：科技、阅读', 'For example: Tech, Reading'],
+    save: ['保存订阅', 'Save feed'], saving: ['正在处理…', 'Working…'], cancel: ['取消', 'Cancel'], close: ['关闭', 'Close'], edit: ['编辑', 'Edit'], remove: ['移除', 'Remove'], check: ['检查可用性', 'Check feed'],
+    empty: ['还没有订阅', 'No subscriptions yet'], emptyHint: ['添加 RSS/Atom 地址，或从阅读器导入 OPML 文件。', 'Add an RSS/Atom URL or import an OPML file from your reader.'], noMatch: ['没有匹配的订阅，试试清空筛选。', 'No matches. Try clearing the filters.'], clear: ['清空筛选', 'Clear filters'],
+    readonly: ['当前配置为只读。你可以查看、检查和导出订阅。', 'These settings are read-only. You can view, check and export feeds.'],
+    pending: ['本次运行尚未检查', 'Not checked during this run'], entries: ['篇文章', 'articles'], checked: ['检查通过', 'Check passed'], failed: ['检查失败', 'Check failed'],
+    statusHint: ['检查记录仅保留在本次 DSH 运行中；导入不会自动抓取所有订阅。', 'Check history lasts for this DSH run. Import does not fetch every feed.'],
+    deleteTitle: ['移除这个订阅？', 'Remove this feed?'], deleteHint: ['只移除订阅，不会删除原网站的文章。', 'This removes the subscription; the original articles remain on the website.'],
+    opml: ['OPML 文本', 'OPML text'], file: ['选择 OPML 文件', 'Choose OPML file'], importHint: ['选择文件或粘贴内容，先预览，再确认导入。最多 1 MiB。', 'Choose a file or paste its content, preview, then confirm. Maximum 1 MiB.'],
+    update: ['用导入文件的名称和分类更新重复订阅', 'Update duplicate names and categories from this file'], preserve: ['默认保留现有订阅的名称和分类。', 'Existing names and categories are preserved by default.'],
+    preview: ['预览导入', 'Preview import'], confirm: ['确认导入', 'Confirm import'], new: ['新增', 'New'], duplicates: ['重复', 'Duplicates'], invalid: ['跳过无效项', 'Invalid items skipped'], previewEmpty: ['文件中没有可导入的订阅。请确认 outline 包含 xmlUrl。', 'No importable feeds. Check that outlines contain xmlUrl.'],
+    keep: ['保留', 'Keep'], change: ['更新为', 'Change to'],
+    previewLimit: ['预览最多显示前 20 项，确认会处理全部有效项。', 'Preview shows up to 20 items. Confirmation processes all valid items.'], saved: ['订阅已保存', 'Feed saved'], removed: ['订阅已移除', 'Feed removed'], imported: ['导入完成', 'Import complete'], downloaded: ['已下载 OPML 文件', 'OPML downloaded'],
+    loading: ['正在读取订阅…', 'Loading subscriptions…'], retry: ['重新读取', 'Retry'], loadError: ['无法读取订阅。请确认 DSH 仍在运行，然后重试。', 'Cannot load feeds. Check that DSH is running, then retry.'],
+    conflict: ['订阅列表已变化，请刷新列表，再保存或重新预览。输入已保留。', 'The list has changed. Refresh it, then save or preview again. Your input is preserved.'], duplicate: ['这个地址已经订阅，请编辑现有订阅。', 'This URL is already subscribed. Edit the existing feed.'],
+    bodyLarge: ['文件超过 1 MiB，请拆分后导入。', 'File exceeds 1 MiB. Split it before importing.'], session: ['DSH 会话已失效，请重新打开 DSH 页面。', 'The DSH session has expired. Reopen the DSH page.'], fileError: ['无法读取文件，请重新选择或粘贴 OPML 文本。', 'Cannot read this file. Choose it again or paste OPML text.'],
+  };
+  const t = key => (words[key] || [key, key])[language === 'en' ? 1 : 0];
+  const CSS = `
+    .dshr{color:var(--dsw-alias-label-primary,#202737);font-size:14px;line-height:1.55;max-width:920px;min-width:0}
+    .dshr *,.dshr-dialog *{box-sizing:border-box}.dshr h2{font-size:22px;margin:0 0 6px}.dshr p{margin:0 0 12px}
+    .dshr-muted{color:var(--dsw-alias-label-tertiary,#657083);font-size:13px}.dshr-toolbar{display:flex;flex-wrap:wrap;gap:8px;margin:16px 0}
+    .dshr button,.dshr-dialog button{font:inherit;min-height:38px;padding:7px 12px;border:1px solid var(--dsw-alias-border-l2,#d9dee7);border-radius:9px;color:inherit;background:var(--dsw-alias-bg-layer-1,#fff);cursor:pointer}
+    .dshr button:disabled,.dshr-dialog button:disabled{opacity:.5;cursor:not-allowed}.dshr button:hover:not(:disabled),.dshr-dialog button:hover:not(:disabled){border-color:#5685d4}
+    .dshr .primary,.dshr-dialog .primary{background:#366fd2;color:#fff;border-color:#366fd2}.dshr-dialog .danger{background:#b93838;border-color:#b93838;color:#fff}
+    .dshr button:focus-visible,.dshr-dialog button:focus-visible,.dshr input:focus-visible,.dshr select:focus-visible,.dshr-dialog input:focus-visible,.dshr-dialog textarea:focus-visible{outline:2px solid #5685d4;outline-offset:2px}
+    .dshr-filters{display:flex;flex-wrap:wrap;gap:10px;margin-bottom:16px}.dshr-filters label:first-child{flex:1 1 220px}.dshr label,.dshr-dialog label{display:flex;flex-direction:column;gap:5px;font-size:13px}
+    .dshr input,.dshr select,.dshr-dialog input,.dshr-dialog textarea{font:inherit;font-size:16px;width:100%;min-width:0;min-height:40px;border:1px solid var(--dsw-alias-border-l2,#d9dee7);border-radius:8px;padding:8px 10px;background:var(--dsw-alias-bg-layer-1,#fff);color:inherit}
+    .dshr-list{display:grid;gap:10px;margin:0;padding:0;list-style:none}.dshr-card{background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#d9dee7);border-radius:12px;padding:14px;display:flex;flex-wrap:wrap;gap:12px}
+    .dshr-info{flex:1 1 240px;min-width:0}.dshr-info h3{font-size:15px;margin:0 0 4px;overflow-wrap:anywhere}.dshr-url{font-size:12px;overflow-wrap:anywhere;color:var(--dsw-alias-label-tertiary,#657083)}
+    .dshr-tag{display:inline-block;border-radius:6px;padding:2px 7px;background:var(--dsw-alias-bg-layer-2,#edf3fc);margin-top:7px;font-size:12px}.dshr-actions{display:flex;flex-wrap:wrap;gap:6px;align-items:center}
+    .dshr-status{margin-top:8px;font-size:12px;overflow-wrap:anywhere}.dshr-alert{padding:10px 12px;border-radius:8px;margin:12px 0;overflow-wrap:anywhere;border:1px solid #dba2a2;background:var(--dsw-alias-bg-layer-1,#fff);color:var(--dsw-alias-state-error-primary,#a42a2a)}
+    .dshr-notice{padding:9px 12px;border-left:3px solid #366fd2;margin:10px 0;background:var(--dsw-alias-bg-layer-2,#edf3fc);overflow-wrap:anywhere}.dshr-empty{text-align:center;border:1px dashed var(--dsw-alias-border-l2,#c7d2e4);border-radius:12px;padding:32px 16px}
+    .dshr-dialog{font:inherit;line-height:1.55;color:var(--dsw-alias-label-primary,#202737);background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#d9dee7);border-radius:14px;padding:22px;max-width:620px;width:calc(100% - 28px);max-height:calc(100dvh - 28px);overflow:auto;box-shadow:0 18px 70px #0003}
+    .dshr-dialog::backdrop{background:#14203366}.dshr-dialog h3{font-size:19px;margin:0 0 12px}.dshr-dialog form{display:grid;gap:14px}.dshr-dialog textarea{min-height:140px;resize:vertical}.dshr-dialog p{margin:0}.dshr-dialog .dshr-buttons{display:flex;flex-wrap:wrap;justify-content:flex-end;gap:8px;margin-top:14px}
+    .dshr-dialog label.dshr-checkbox{display:flex;flex-direction:row;align-items:flex-start;gap:8px}.dshr-checkbox input{width:18px;height:18px;min-height:18px;margin-top:3px;flex-shrink:0}.dshr-preview{border-top:1px solid var(--dsw-alias-border-l2,#d9dee7);padding-top:12px;overflow-wrap:anywhere}.dshr-preview ul{margin:8px 0;padding-left:20px}.dshr-preview li{margin-bottom:5px}
+    @media(max-width:520px){.dshr-dialog{padding:16px}.dshr-actions{width:100%}.dshr-filters label{width:100%}.dshr-toolbar button{flex:1 1 auto}.dshr-card{padding:12px}}
+  `;
+  async function request(action, args, signal) {
+    const response = await fetch(new URL(ROUTE, document.baseURI), action ? {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ action, ...args }), signal,
+    } : { credentials: 'same-origin', signal });
+    let value;
+    try { value = await response.json(); } catch { throw new Error(response.status === 401 ? t('session') : t('loadError')); }
+    if (!response.ok) {
+      const error = new Error(['conflict', 'duplicate', 'readonly'].includes(value.code) ? t(value.code) : value.error || t('loadError'));
+      error.snapshot = value.snapshot;
+      throw error;
+    }
+    return value;
+  }
+  function Dialog({ title, busy, onClose, children }) {
+    const ref = useRef(null);
+    const id = useId();
+    useEffect(() => { ref.current.showModal(); return () => ref.current?.close(); }, []);
+    return h('dialog', { ref, className: 'dshr-dialog', 'aria-labelledby': id,
+      onKeyDownCapture: event => {
+        if (event.nativeEvent.isComposing) return;
+        if (event.key === 'Escape') { event.preventDefault(); event.stopPropagation(); if (!busy) onClose(); }
+        if (event.key === 'Tab') {
+          event.stopPropagation();
+          const targets = [...event.currentTarget.querySelectorAll('input:not([disabled]),textarea:not([disabled]),select:not([disabled]),button:not([disabled])')];
+          const first = targets[0], last = targets[targets.length - 1];
+          if (event.shiftKey && document.activeElement === first) { event.preventDefault(); last?.focus(); }
+          else if (!event.shiftKey && document.activeElement === last) { event.preventDefault(); first?.focus(); }
+        }
+      },
+      onCancel: event => { event.preventDefault(); event.stopPropagation(); if (!busy) onClose(); } },
+      h('h3', { id }, title), children);
+  }
+  function Panel() {
+    const [, setLanguage] = useState(language);
+    const [state, setState] = useState(null), [loading, setLoading] = useState(true), [busy, setBusy] = useState('');
+    const [error, setError] = useState(''), [notice, setNotice] = useState(''), [query, setQuery] = useState(''), [category, setCategory] = useState('*');
+    const [modal, setModal] = useState(null), [draft, setDraft] = useState({ url: '', name: '', category: '' });
+    const [opml, setOpml] = useState(''), [updateExisting, setUpdateExisting] = useState(false), [preview, setPreview] = useState(null);
+    const controller = useRef(null), trigger = useRef(null);
+    useEffect(() => { listeners.add(setLanguage); return () => listeners.delete(setLanguage); }, []);
+    useEffect(() => { void run(null); return () => controller.current?.abort(); }, []);
+    async function run(action, args = {}, onSuccess) {
+      if (controller.current) return;
+      const abort = new AbortController(); controller.current = abort;
+      setBusy(action === 'check' && args.id ? args.id : action || 'load'); setError(''); setNotice('');
+      try {
+        const value = await request(action, args, abort.signal);
+        if (value.snapshot) setState(value.snapshot);
+        if (onSuccess) onSuccess(value);
+        return value;
+      } catch (failure) {
+        if (!abort.signal.aborted) { if (failure.snapshot) setState(failure.snapshot); setError(failure.message || t('loadError')); }
+      } finally { if (!abort.signal.aborted) { setBusy(''); setLoading(false); } controller.current = null; }
+    }
+    function close() { setModal(null); setError(''); setPreview(null); queueMicrotask(() => trigger.current?.focus()); }
+    function open(type, feed, event) {
+      trigger.current = event.currentTarget; setError(''); setNotice(''); setPreview(null);
+      if (type === 'feed') setDraft(feed ? { url: feed.url, name: feed.name, category: feed.category } : { url: '', name: '', category: '' });
+      if (type === 'import') { setOpml(''); setUpdateExisting(false); }
+      setModal({ type, feed });
+    }
+    async function chooseFile(event) {
+      const file = event.target.files?.[0];
+      event.target.value = '';
+      if (!file) return;
+      if (file.size > 1024 * 1024) { setError(t('bodyLarge')); return; }
+      try { setOpml(await file.text()); setPreview(null); setError(''); } catch { setError(t('fileError')); }
+    }
+    const field = (key, hint) => h('label', { key }, t(key), h('input', {
+      name: key, type: key === 'url' ? 'url' : 'text', value: draft[key], placeholder: hint, required: key === 'url', disabled: !!busy,
+      autoFocus: key === 'url', onChange: event => setDraft({ ...draft, [key]: event.target.value }),
+    }));
+    const buttons = submit => h('div', { className: 'dshr-buttons' },
+      h('button', { type: 'button', disabled: !!busy, onClick: close }, t('cancel')), submit);
+    const alert = error ? h('div', { role: 'alert', className: 'dshr-alert' }, error) : null;
+    const feeds = state?.feeds || [], writable = state?.writable === true;
+    const categories = [...new Set(feeds.map(feed => feed.category))].sort();
+    const filtered = feeds.filter(feed => (category === '*' || feed.category === category) && (feed.name + ' ' + feed.url).toLowerCase().includes(query.trim().toLowerCase()));
+    return h('section', { className: 'dshr', 'aria-label': t('title') },
+      h('h2', null, t('title')), h('p', { className: 'dshr-muted' }, t('intro')),
+      state && !writable ? h('p', { className: 'dshr-notice' }, t('readonly')) : null,
+      h('div', { className: 'dshr-toolbar' },
+        h('button', { className: 'primary', disabled: !writable || !!busy, onClick: event => open('feed', null, event) }, t('add')),
+        h('button', { disabled: !writable || !!busy, onClick: event => open('import', null, event) }, t('import')),
+        h('button', { disabled: !state || !!busy, onClick: () => run('export', {}, value => {
+          const url = URL.createObjectURL(new Blob([value.opml], { type: 'text/x-opml;charset=utf-8' }));
+          const a = document.createElement('a'); a.href = url; a.download = 'rss-subscriptions.opml'; a.click();
+          setTimeout(() => URL.revokeObjectURL(url), 10000); setNotice(t('downloaded'));
+        }) }, t('export')),
+        h('button', { disabled: !!busy, onClick: () => run(null) }, t('refresh'))),
+      !modal ? alert : null, notice ? h('div', { role: 'status', className: 'dshr-notice' }, notice) : null,
+      loading ? h('p', { role: 'status' }, t('loading')) : !state ? h('button', { disabled: !!busy, onClick: () => run(null) }, t('retry')) :
+      h(React.Fragment, null,
+        feeds.length ? h('div', { className: 'dshr-filters' },
+          h('label', null, t('search'), h('input', { type: 'search', value: query, onChange: event => setQuery(event.target.value) })),
+          h('label', null, t('category'), h('select', { value: category, onChange: event => setCategory(event.target.value) },
+            h('option', { value: '*' }, t('all')), categories.map(value => h('option', { key: value, value }, value || t('uncategorized')))))) : null,
+        !feeds.length ? h('div', { className: 'dshr-empty' }, h('strong', null, t('empty')), h('p', { className: 'dshr-muted' }, t('emptyHint'))) :
+        !filtered.length ? h('div', { className: 'dshr-empty' }, h('p', null, t('noMatch')), h('button', { onClick: () => { setQuery(''); setCategory('*'); } }, t('clear'))) :
+        h('ul', { className: 'dshr-list' }, filtered.map(feed => h('li', { key: feed.id, className: 'dshr-card', 'aria-label': feed.name || feed.url },
+          h('div', { className: 'dshr-info' }, h('h3', null, feed.name || feed.url), h('div', { className: 'dshr-url' }, feed.url),
+            h('span', { className: 'dshr-tag' }, feed.category || t('uncategorized')),
+            h('div', { className: 'dshr-status' }, feed.check ? [
+              new Date(feed.check.checkedAt).toLocaleString(language === 'en' ? 'en-US' : 'zh-CN'), ' · ',
+              feed.check.ok ? feed.check.entryCount + ' ' + t('entries') + ' · ' + t('checked') : t('failed') + '：' + feed.check.error,
+            ] : t('pending'))),
+          h('div', { className: 'dshr-actions' },
+            h('button', { disabled: !!busy, onClick: () => run('check', { id: feed.id }, value => setNotice(t('checked') + ' · ' + value.check.entryCount + ' ' + t('entries'))) }, busy === feed.id ? t('saving') : t('check')),
+            h('button', { disabled: !writable || !!busy, onClick: event => open('feed', feed, event) }, t('edit')),
+            h('button', { disabled: !writable || !!busy, onClick: event => open('remove', feed, event) }, t('remove')))))),
+        feeds.length ? h('p', { className: 'dshr-muted', style: { marginTop: 12 } }, t('statusHint')) : null),
+      modal ? h(Dialog, { title: modal.type === 'import' ? t('import') : modal.type === 'remove' ? t('deleteTitle') : modal.feed ? t('edit') : t('add'), busy: !!busy, onClose: close },
+        alert,
+        modal.type === 'feed' ? h('form', { onSubmit: event => { event.preventDefault(); void run(modal.feed ? 'edit' : 'add', { ...draft, id: modal.feed?.id, revision: state.revision }, () => { close(); setNotice(t('saved')); }); } },
+          field('url', 'https://example.com/feed.xml'), field('name', t('nameHint')), field('category', t('categoryHint')),
+          error ? h('button', { type: 'button', disabled: !!busy, onClick: () => run(null) }, t('refresh')) : null,
+          buttons(h('button', { type: 'submit', className: 'primary', disabled: !!busy }, t(busy ? 'saving' : 'save')))) :
+        modal.type === 'remove' ? h('div', null, h('strong', null, modal.feed.name || modal.feed.url), h('p', { className: 'dshr-url' }, modal.feed.url), h('p', null, t('deleteHint')),
+          buttons(h('button', { className: 'danger', disabled: !!busy, onClick: () => run('remove', { id: modal.feed.id, revision: state.revision }, () => { close(); setNotice(t('removed')); }) }, t(busy ? 'saving' : 'remove')))) :
+        h('form', { onSubmit: event => { event.preventDefault(); void run('preview', { opml, updateExisting }, value => setPreview(value.preview)); } },
+          h('p', { className: 'dshr-muted' }, t('importHint')), h('label', null, t('file'), h('input', { type: 'file', accept: '.opml,.xml,text/xml,application/xml,text/x-opml', disabled: !!busy, onChange: chooseFile })),
+          h('label', null, t('opml'), h('textarea', { required: true, autoFocus: true, value: opml, disabled: !!busy, onChange: event => { setOpml(event.target.value); setPreview(null); } })),
+          h('label', { className: 'dshr-checkbox' }, h('input', { type: 'checkbox', checked: updateExisting, disabled: !!busy, onChange: event => { setUpdateExisting(event.target.checked); setPreview(null); } }), t('update')),
+          h('p', { className: 'dshr-muted' }, t('preserve')),
+          preview ? h('div', { className: 'dshr-preview', role: 'status' },
+            h('strong', null, `${t('new')} ${preview.addedCount} · ${t('duplicates')} ${preview.existedCount} · ${t('invalid')} ${preview.skippedCount}`),
+            !preview.addedCount && !preview.existedCount ? h('p', null, t('previewEmpty')) : null,
+            h('ul', null, preview.added.slice(0, 20).map(feed => h('li', { key: feed.url }, t('new'), '：', feed.name || feed.url, ' · ', feed.category || t('uncategorized'))),
+              (preview.duplicates || []).slice(0, 20).map((item, index) => h('li', { key: 'duplicate-' + index },
+                t('duplicates'), '：', item.before.name || item.url, ' · ', item.before.category || t('uncategorized'),
+                updateExisting ? ' → ' + (item.after.name || item.url) + ' · ' + (item.after.category || t('uncategorized')) : ' · ' + t('keep'))),
+              preview.skipped.slice(0, 20).map((item, index) => h('li', { key: index }, item.title, ' · ', item.url, '：', item.reason))),
+            preview.added.length > 20 || preview.skipped.length > 20 || (preview.duplicates || []).length > 20 ? h('p', { className: 'dshr-muted' }, t('previewLimit')) : null) : null,
+          h('div', { className: 'dshr-buttons' }, h('button', { type: 'button', disabled: !!busy, onClick: close }, t('cancel')),
+            h('button', { type: 'submit', disabled: !!busy || !opml.trim() }, t(busy === 'preview' ? 'saving' : 'preview')),
+            preview ? h('button', { type: 'button', className: 'primary', disabled: !!busy || !(preview.addedCount || updateExisting && preview.existedCount), onClick: () => run('import', { opml, updateExisting, revision: preview.revision, token: preview.token }, value => {
+              close(); setNotice(`${t('imported')} · ${t('new')} ${value.result.addedCount} · ${t('duplicates')} ${value.result.existedCount} · ${t('invalid')} ${value.result.skippedCount}`);
+            }) }, t(busy === 'import' ? 'saving' : 'confirm')) : null))) : null);
+  }
+  function apply(ctx) {
+    ctx.effect(() => {
+      const service = ctx.get ? ctx.get('locale') : ctx.locale;
+      const update = () => { language = String(service?.getSnapshot?.().active || 'zh').startsWith('en') ? 'en' : 'zh'; for (const notify of listeners) notify(language); };
+      update(); return service?.subscribe?.(update) || (() => {});
+    }, 'dsh-rss: locale');
+    ctx.effect(() => {
+      const style = document.createElement('style'); style.dataset.pluginCss = 'dsh-rss/client'; style.textContent = CSS; document.head.appendChild(style);
+      return () => style.remove();
+    }, 'dsh-rss: styles');
+    ctx.slots.inject('settings.section', () => ctx.slots.register({ name: 'settings.section', id: 'dsh-rss', order: 55, label: () => t('title'), inject: () => ({}) }, Panel));
+  }
+  return { apply, inject: ['slots', 'locale'] };
+} });

package/lib/index.d.ts

@@ -28,6 +28,7 @@ type RssPreExecuteListener = (exec: RssPendingToolExecution, next: () => Promise
 /** 插件所需的最小 ctx 面（社区插件不依赖宿主内部类型）。 */
 export interface RssPluginContext {
     settings: {
+        readonly writable?: boolean;
         register?(ns: string, schema: unknown, options?: {
             base?: Record<string, unknown>;
             applies?: string;
@@ -41,6 +42,7 @@ export interface RssPluginContext {
             };
         };
     };
+    inject?: Function;
     tools: {
         register(definition: RssToolDefinition): () => void;
     };
@@ -60,3 +62,4 @@ export * from './parser.js';
 export * from './proxy-fetch.js';
 export * from './settings.js';
 export * from './tools.js';
+export * from './web.js';

package/lib/index.js

@@ -10,6 +10,7 @@ import { resolveConfig } from './config.js';
 import { RSS_SETTINGS_NAMESPACE, RssSettingsSchema, liveConfig } from './settings.js';
 import { buildRssTools } from './tools.js';
 import { installLegacySettingsImport } from './legacy-settings.js';
+import { createRssSettingsBackend, installRssSettingsWeb } from './web.js';
 /** cordis 服务注入：apply 里要用 ctx.settings 与 ctx.tools，必须显式声明，否则宿主会抛 cannot get property without inject。 */
 export const name = 'rss';
 export const inject = ['settings', 'tools'];
@@ -34,6 +35,7 @@ export function apply(ctx, config) {
         },
     };
     const disposers = [];
+    installRssSettingsWeb(ctx, createRssSettingsBackend(cfg, settingsScope, { writable: () => ctx.settings.writable !== false }));
     for (const definition of buildRssTools(cfg, settingsScope)) {
         disposers.push(ctx.tools.register(definition));
     }
@@ -63,3 +65,4 @@ export * from './parser.js';
 export * from './proxy-fetch.js';
 export * from './settings.js';
 export * from './tools.js';
+export * from './web.js';

package/lib/opml.d.ts

@@ -27,6 +27,11 @@ export interface OpmlImportResult {
     existedCount: number;
     skippedCount: number;
     skipped: OpmlSkipped[];
+    duplicates: Array<{
+        url: string;
+        before: Feed;
+        after: Feed;
+    }>;
 }
 /** OPML 文档解析结果。 */
 export interface OpmlDocument {
@@ -40,4 +45,4 @@ export declare function parseOpml(text: string): OpmlDocument;
 /** 把订阅列表序列化为 OPML 2.0 文本。 */
 export declare function buildOpml(feeds: Feed[]): string;
 /** 把 OPML 导入合并进现有订阅（按 url 去重），非法项跳过。 */
-export declare function importOpmlFeeds(current: Feed[], document: OpmlDocument): OpmlImportResult;
+export declare function importOpmlFeeds(current: Feed[], document: OpmlDocument, updateExisting?: boolean): OpmlImportResult;

package/lib/opml.js

@@ -6,8 +6,9 @@
  *
  * @module dsh-rss/opml
  */
-import { XMLParser } from 'fast-xml-parser';
-import { addFeed } from './feeds.js';
+import { XMLParser, XMLValidator } from 'fast-xml-parser';
+import { addFeed, sameFeedUrl } from './feeds.js';
+import { assertHttpUrl } from './network.js';
 const opmlParser = new XMLParser({
     ignoreAttributes: false,
     attributeNamePrefix: '@_',
@@ -42,6 +43,9 @@ export function parseOpml(text) {
     const trimmed = (text ?? '').trim();
     if (trimmed === '')
         throw new Error('OPML 内容为空，请提供 OPML XML 文本。');
+    const validation = XMLValidator.validate(trimmed);
+    if (validation !== true)
+        throw new Error('OPML 解析失败：第 ' + validation.err.line + ' 行，' + validation.err.msg);
     let doc;
     try {
         doc = opmlParser.parse(trimmed);
@@ -120,21 +124,36 @@ export function buildOpml(feeds) {
 }
 const HTTP_URL = /^https?:\/\//i;
 /** 把 OPML 导入合并进现有订阅（按 url 去重），非法项跳过。 */
-export function importOpmlFeeds(current, document) {
+export function importOpmlFeeds(current, document, updateExisting = true) {
     const feeds = [...current];
     const added = [];
     const skipped = [];
+    const duplicates = [];
     let existedCount = 0;
     for (const outline of document.outlines) {
         if (!HTTP_URL.test(outline.url)) {
             skipped.push({ title: outline.name, url: outline.url, reason: 'URL 不是 http(s) 地址' });
             continue;
         }
+        try {
+            assertHttpUrl(outline.url);
+        }
+        catch (error) {
+            skipped.push({ title: outline.name, url: outline.url, reason: error instanceof Error ? error.message : String(error) });
+            continue;
+        }
+        const previous = feeds.find(feed => sameFeedUrl(feed.url, outline.url));
+        if (!updateExisting && previous) {
+            existedCount += 1;
+            duplicates.push({ url: outline.url, before: previous, after: previous });
+            continue;
+        }
         const before = feeds.length;
         const outcome = addFeed(feeds, outline.url, outline.name, outline.category);
         feeds.splice(0, feeds.length, ...outcome.feeds);
         if (outcome.existed) {
             existedCount += 1;
+            duplicates.push({ url: outline.url, before: previous, after: outcome.added });
         }
         else if (feeds.length > before) {
             added.push(outcome.added);
@@ -147,5 +166,6 @@ export function importOpmlFeeds(current, document) {
         existedCount,
         skippedCount: skipped.length,
         skipped,
+        duplicates,
     };
 }

package/lib/subscriptions.d.ts

@@ -0,0 +1,33 @@
+import { type Feed } from './feeds.js';
+import type { RssSettingsScope } from './tools.js';
+import type { ResolvedRssConfig } from './config.js';
+import type { RssToolExecution } from './execution.js';
+import { type FetchLike, type DnsLookupLike } from './network.js';
+export declare class SubscriptionError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(message: string, status?: number, code?: string);
+}
+export declare const feedId: (url: string) => string;
+export declare function subscriptionSnapshot(scope: RssSettingsScope): {
+    feeds: Feed[];
+    revision: string;
+};
+/** Read inside the queue: concurrent tool/UI writes cannot overwrite one another. */
+export declare function mutateSubscriptions<T>(scope: RssSettingsScope, mutate: (feeds: Feed[]) => {
+    feeds: Feed[];
+    value: T;
+}, expectedRevision?: string): Promise<T>;
+export interface FeedCheck {
+    checkedAt: string;
+    ok: boolean;
+    title?: string;
+    entryCount?: number;
+    error?: string;
+}
+export declare function recentFeedChecks(scope: RssSettingsScope): Map<string, FeedCheck>;
+/** Same network boundary, parsing and status for tool calls and manual checks. */
+export declare function readRssFeed(scope: RssSettingsScope, url: string, config: ResolvedRssConfig, exec?: RssToolExecution, fetchImpl?: FetchLike, lookupImpl?: DnsLookupLike): Promise<{
+    parsed: import("./parser.js").ParsedFeed;
+    finalUrl: string;
+}>;

package/lib/subscriptions.js

@@ -0,0 +1,76 @@
+/** Shared subscription storage for tools and the settings panel. */
+import { createHash } from 'node:crypto';
+import { parseFeedsYaml, serializeFeeds } from './feeds.js';
+import { fetchFeedXml } from './network.js';
+import { parseFeed } from './parser.js';
+export class SubscriptionError extends Error {
+    status;
+    code;
+    constructor(message, status = 400, code = 'invalid') {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+const writes = new WeakMap();
+export const feedId = (url) => createHash('sha256').update(url).digest('hex');
+export function subscriptionSnapshot(scope) {
+    const value = scope.get();
+    const yaml = value && typeof value.feedsYaml === 'string' ? value.feedsYaml : '';
+    return { feeds: parseFeedsYaml(yaml), revision: feedId(yaml) };
+}
+/** Read inside the queue: concurrent tool/UI writes cannot overwrite one another. */
+export async function mutateSubscriptions(scope, mutate, expectedRevision) {
+    const task = (writes.get(scope) ?? Promise.resolve()).catch(() => { }).then(async () => {
+        const snapshot = subscriptionSnapshot(scope);
+        if (expectedRevision !== undefined && snapshot.revision !== expectedRevision) {
+            throw new SubscriptionError('订阅列表已经变化。请刷新列表后重新预览或保存；你的输入已保留。', 409, 'conflict');
+        }
+        const result = mutate(snapshot.feeds);
+        try {
+            await scope.update({ feedsYaml: serializeFeeds(result.feeds) });
+        }
+        catch (error) {
+            throw new SubscriptionError('写入订阅配置失败（可能已被其他会话修改，请重试）：' + (error instanceof Error ? error.message : String(error)), 503, 'save_failed');
+        }
+        return result.value;
+    });
+    writes.set(scope, task);
+    try {
+        return await task;
+    }
+    finally {
+        if (writes.get(scope) === task)
+            writes.delete(scope);
+    }
+}
+const checks = new WeakMap();
+export function recentFeedChecks(scope) {
+    let map = checks.get(scope);
+    if (!map) {
+        map = new Map();
+        checks.set(scope, map);
+    }
+    return map;
+}
+/** Same network boundary, parsing and status for tool calls and manual checks. */
+export async function readRssFeed(scope, url, config, exec, fetchImpl, lookupImpl) {
+    const map = recentFeedChecks(scope);
+    const save = (check) => {
+        map.delete(url);
+        map.set(url, check);
+        if (map.size > 256)
+            map.delete(map.keys().next().value);
+    };
+    try {
+        const { xml, finalUrl } = await fetchFeedXml(url, config, exec, fetchImpl, lookupImpl);
+        const parsed = parseFeed(xml, finalUrl);
+        save({ checkedAt: new Date().toISOString(), ok: true, title: parsed.feed.title, entryCount: parsed.entries.length });
+        return { parsed, finalUrl };
+    }
+    catch (error) {
+        if (!exec?.signal.aborted)
+            save({ checkedAt: new Date().toISOString(), ok: false, error: error instanceof Error ? error.message : String(error) });
+        throw error;
+    }
+}

package/lib/tools.js

@@ -5,10 +5,11 @@
  * @module dsh-rss/tools
  */
 import { writeFile } from 'node:fs/promises';
-import { addFeed, findFeedsByName, parseFeedsYaml, removeFeed, sameFeedUrl, serializeFeeds } from './feeds.js';
+import { addFeed, findFeedsByName, removeFeed, sameFeedUrl } from './feeds.js';
 import { buildOpml, importOpmlFeeds, parseOpml } from './opml.js';
 import { parseFeed } from './parser.js';
-import { assertHttpUrl, fetchFeedXml } from './network.js';
+import { assertHttpUrl } from './network.js';
+import { subscriptionSnapshot, mutateSubscriptions, readRssFeed } from './subscriptions.js';
 import { resolveOpmlOutputPath } from './workspace.js';
 export { isBlockedNetworkAddress } from './network.js';
 const TIMEOUT_MS = 30000;
@@ -405,19 +406,8 @@ function renderHealth(_args, value) {
  */
 export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
     const cfg = config;
-    const getFeeds = () => {
-        const value = settingsScope.get();
-        const yamlText = value !== null && typeof value === 'object' && typeof value.feedsYaml === 'string' ? value.feedsYaml : '';
-        return parseFeedsYaml(yamlText);
-    };
-    const persistFeeds = async (feeds) => {
-        try {
-            await settingsScope.update({ feedsYaml: serializeFeeds(feeds) });
-        }
-        catch (error) {
-            throw new Error('写入订阅配置失败（可能已被其他会话修改，请重试）：' + (error instanceof Error ? error.message : String(error)));
-        }
-    };
+    const getFeeds = () => subscriptionSnapshot(settingsScope).feeds;
+    const readFeed = (url, exec) => readRssFeed(settingsScope, url, cfg, exec, fetchImpl, lookupImpl);
     const rssList = {
         name: 'rss_list',
         description: '列出已订阅的 RSS/Atom 源（存在 settings 的 dsh-rss.feedsYaml 里，可用 rss_add / rss_remove 管理）。返回每个订阅的 url、name、category 与总数。',
@@ -450,12 +440,12 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             assertHttpUrl(url);
             const name = optionalString(args, 'name') ?? '';
             const category = optionalString(args, 'category') ?? '';
-            const { xml, finalUrl } = await fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl);
-            const parsed = parseFeed(xml, finalUrl);
+            const { parsed } = await readFeed(url, exec);
             const effectiveName = name !== '' ? name : parsed.feed.title;
-            const { feeds, added, existed } = addFeed(getFeeds(), url, effectiveName, category);
-            await persistFeeds(feeds);
-            return { added, existed, count: feeds.length, feedTitle: parsed.feed.title, feedType: parsed.feed.feedType };
+            return mutateSubscriptions(settingsScope, current => {
+                const { feeds, added, existed } = addFeed(current, url, effectiveName, category);
+                return { feeds, value: { added, existed, count: feeds.length, feedTitle: parsed.feed.title, feedType: parsed.feed.feedType } };
+            });
         },
         timeoutMs: cfg.timeoutMs,
     };
@@ -472,9 +462,10 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
         },
         async execute(rawArgs) {
             const args = asRecord(rawArgs);
-            const { feeds, removed } = removeFeed(getFeeds(), optionalString(args, 'url'), optionalString(args, 'name'));
-            await persistFeeds(feeds);
-            return { removed, count: feeds.length };
+            return mutateSubscriptions(settingsScope, current => {
+                const { feeds, removed } = removeFeed(current, optionalString(args, 'url'), optionalString(args, 'name'));
+                return { feeds, value: { removed, count: feeds.length } };
+            });
         },
         timeoutMs: TIMEOUT_MS,
     };
@@ -523,8 +514,7 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             assertHttpUrl(url);
             const limit = clampedInteger(args, 'limit', 20, 1, 100);
             const incremental = args.incremental === true;
-            const { xml, finalUrl } = await fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl);
-            const parsed = parseFeed(xml, finalUrl);
+            const { parsed, finalUrl } = await readFeed(url, exec);
             if (!incremental) {
                 const entries = parsed.entries.slice(0, limit);
                 return { url: finalUrl, feed: parsed.feed, entries, truncated: parsed.entries.length > limit };
@@ -552,8 +542,7 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             const args = asRecord(rawArgs);
             const url = requiredString(args, 'url', '订阅源地址');
             assertHttpUrl(url);
-            const { xml, finalUrl } = await fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl);
-            const parsed = parseFeed(xml, finalUrl);
+            const { parsed, finalUrl } = await readFeed(url, exec);
             return {
                 ok: true,
                 url: finalUrl,
@@ -605,16 +594,14 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             const args = asRecord(rawArgs);
             const opmlText = requiredString(args, 'opml', 'OPML 文本');
             const document = parseOpml(opmlText);
-            const outcome = importOpmlFeeds(getFeeds(), document);
-            await persistFeeds(outcome.feeds);
-            return {
-                addedCount: outcome.addedCount,
-                existedCount: outcome.existedCount,
-                skippedCount: outcome.skippedCount,
-                totalCount: outcome.feeds.length,
-                added: outcome.added,
-                skipped: outcome.skipped,
-            };
+            return mutateSubscriptions(settingsScope, current => {
+                const outcome = importOpmlFeeds(current, document);
+                return { feeds: outcome.feeds, value: {
+                        addedCount: outcome.addedCount, existedCount: outcome.existedCount,
+                        skippedCount: outcome.skippedCount, totalCount: outcome.feeds.length,
+                        added: outcome.added, skipped: outcome.skipped,
+                    } };
+            });
         },
         timeoutMs: TIMEOUT_MS,
     };
@@ -656,8 +643,7 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
                 if (hits.length >= limit)
                     break;
                 try {
-                    const { xml, finalUrl } = await fetchFeedXml(feed.url, cfg, exec, fetchImpl, lookupImpl);
-                    const parsed = parseFeed(xml, finalUrl);
+                    const { parsed } = await readFeed(feed.url, exec);
                     for (const entry of parsed.entries) {
                         const rec = asRecord(entry);
                         const at = Date.parse(typeof rec.pubDate === 'string' ? rec.pubDate : '');

package/lib/web.d.ts

@@ -0,0 +1,27 @@
+/** Authenticated, local settings route; no separate copy of subscription data. */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RssSettingsScope } from './tools.js';
+import type { ResolvedRssConfig } from './config.js';
+import { type FetchLike, type DnsLookupLike } from './network.js';
+export declare const RSS_SETTINGS_ROUTE = "/_dsh/dsh-rss/subscriptions";
+export declare function createRssSettingsBackend(config: ResolvedRssConfig, scope: RssSettingsScope, options?: {
+    writable?: () => boolean;
+    fetchImpl?: FetchLike;
+    lookupImpl?: DnsLookupLike;
+}): {
+    snapshot: () => {
+        revision: string;
+        writable: boolean;
+        feeds: {
+            id: string;
+            check: import("./subscriptions.js").FeedCheck | null;
+            url: string;
+            name: string;
+            category: string;
+        }[];
+    };
+    handle(req: IncomingMessage, res: ServerResponse): Promise<void>;
+};
+export declare function installRssSettingsWeb(ctx: {
+    inject?: Function;
+}, backend: ReturnType<typeof createRssSettingsBackend>): void;

package/lib/web.js

@@ -0,0 +1,217 @@
+import { sameFeedUrl } from './feeds.js';
+import { assertHttpUrl } from './network.js';
+import { buildOpml, parseOpml, importOpmlFeeds } from './opml.js';
+import { feedId, subscriptionSnapshot, mutateSubscriptions, recentFeedChecks, readRssFeed, SubscriptionError } from './subscriptions.js';
+export const RSS_SETTINGS_ROUTE = '/_dsh/dsh-rss/subscriptions';
+// JSON quoting can double the OPML file size; limit the actual text separately.
+const MAX_OPML = 1024 * 1024;
+const MAX_BODY = MAX_OPML * 2 + 16384;
+const loopback = (host) => ['127.0.0.1', 'localhost', '::1', '[::1]', '::ffff:127.0.0.1'].includes(host.toLowerCase());
+const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const text = (args, key) => typeof args[key] === 'string' ? args[key].trim() : '';
+function requestGuard(req) {
+    const host = req.headers.host;
+    if (!host || !loopback(req.socket.remoteAddress ?? ''))
+        throw new SubscriptionError('设置面板仅允许本机访问。', 403, 'local_only');
+    let target;
+    try {
+        target = new URL('http://' + host);
+    }
+    catch {
+        throw new SubscriptionError('无效的请求地址。', 403);
+    }
+    if (!loopback(target.hostname) || target.username || target.password || target.pathname !== '/' || target.search || target.hash) {
+        throw new SubscriptionError('设置面板仅允许本机访问。', 403, 'local_only');
+    }
+    const protocol = req.socket.encrypted ? 'https:' : 'http:';
+    target.protocol = protocol;
+    const origin = req.headers.origin;
+    if ((req.method === 'POST' && !origin) || (origin !== undefined && origin !== target.origin)) {
+        throw new SubscriptionError('请从当前 DSH 设置页面操作。', 403, 'origin');
+    }
+    if (req.method === 'POST' && !/^application\/json(?:\s*;|$)/i.test(req.headers['content-type'] ?? '')) {
+        throw new SubscriptionError('请求必须使用 JSON。', 415);
+    }
+}
+function readBody(req, signal) {
+    return new Promise((resolve, reject) => {
+        let length = 0;
+        const chunks = [];
+        const cleanup = () => { req.off('data', data); req.off('end', end); req.off('error', error); signal.removeEventListener('abort', abort); };
+        const fail = (reason) => { cleanup(); reject(reason); };
+        const data = (chunk) => {
+            length += chunk.length;
+            if (length > MAX_BODY) {
+                chunks.length = 0;
+                fail(new SubscriptionError('内容超过 1 MiB，请拆分 OPML 文件后重试。', 413));
+                req.resume();
+            }
+            else
+                chunks.push(chunk);
+        };
+        const error = (reason) => fail(reason);
+        const abort = () => fail(signal.reason);
+        const end = () => {
+            cleanup();
+            try {
+                const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    throw new Error();
+                resolve(value);
+            }
+            catch {
+                reject(new SubscriptionError('请求内容不是有效的 JSON。'));
+            }
+        };
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        req.on('data', data);
+        req.on('end', end);
+        req.on('error', error);
+        signal.addEventListener('abort', abort, { once: true });
+    });
+}
+export function createRssSettingsBackend(config, scope, options = {}) {
+    const writable = () => options.writable?.() !== false;
+    const snapshot = () => {
+        const state = subscriptionSnapshot(scope);
+        const checks = recentFeedChecks(scope);
+        return { revision: state.revision, writable: writable(), feeds: state.feeds.map(feed => ({ ...feed, id: feedId(feed.url), check: checks.get(feed.url) ?? null })) };
+    };
+    const find = (feeds, id) => {
+        const feed = feeds.find(feed => feedId(feed.url) === id);
+        if (!feed)
+            throw new SubscriptionError('这个订阅已被移除，请刷新列表。', 409, 'conflict');
+        return feed;
+    };
+    const check = (url, signal) => {
+        assertHttpUrl(url);
+        return readRssFeed(scope, url, config, { signal }, options.fetchImpl, options.lookupImpl);
+    };
+    const preview = (args) => {
+        const opml = text(args, 'opml');
+        if (Buffer.byteLength(opml, 'utf8') > MAX_OPML)
+            throw new SubscriptionError('OPML 内容超过 1 MiB，请拆分后导入。', 413, 'bodyLarge');
+        const state = subscriptionSnapshot(scope);
+        const updateExisting = args.updateExisting === true;
+        const outcome = importOpmlFeeds(state.feeds, parseOpml(opml), updateExisting);
+        // Never return credentials embedded in rejected URLs.
+        const skipped = outcome.skipped.map(item => ({ ...item, url: item.url.replace(/(https?:\/\/)[^/@\s]+@/gi, '$1***@') }));
+        return { ...outcome, feeds: undefined, skipped, revision: state.revision,
+            token: feedId(JSON.stringify([state.revision, opml, updateExisting])) };
+    };
+    async function dispatch(args, signal) {
+        const action = text(args, 'action');
+        if (action === 'export')
+            return { opml: buildOpml(subscriptionSnapshot(scope).feeds) };
+        if (action === 'preview')
+            return { preview: preview(args) };
+        if (action === 'check') {
+            const url = text(args, 'id') ? find(subscriptionSnapshot(scope).feeds, text(args, 'id')).url : text(args, 'url');
+            const { parsed } = await check(url, signal);
+            return { check: { ok: true, title: parsed.feed.title, entryCount: parsed.entries.length } };
+        }
+        if (!['add', 'edit', 'remove', 'import'].includes(action))
+            throw new SubscriptionError('未知的操作。');
+        if (!writable())
+            throw new SubscriptionError('当前配置是只读的，无法保存订阅。', 403, 'readonly');
+        const revision = text(args, 'revision');
+        if (!revision)
+            throw new SubscriptionError('请先刷新订阅列表。', 409, 'conflict');
+        let result;
+        if (action === 'import') {
+            const candidate = preview(args);
+            if (candidate.revision !== revision || candidate.token !== text(args, 'token')) {
+                throw new SubscriptionError('订阅列表或导入内容已经变化，请重新预览；你的输入已保留。', 409, 'conflict');
+            }
+            result = await mutateSubscriptions(scope, feeds => {
+                signal.throwIfAborted();
+                const outcome = importOpmlFeeds(feeds, parseOpml(text(args, 'opml')), args.updateExisting === true);
+                return { feeds: outcome.feeds, value: { addedCount: outcome.addedCount, existedCount: outcome.existedCount, skippedCount: outcome.skippedCount } };
+            }, revision);
+        }
+        else if (action === 'remove') {
+            result = await mutateSubscriptions(scope, feeds => {
+                signal.throwIfAborted();
+                const target = find(feeds, text(args, 'id'));
+                return { feeds: feeds.filter(feed => feed !== target), value: { removed: target.name || target.url } };
+            }, revision);
+        }
+        else {
+            const url = text(args, 'url');
+            assertHttpUrl(url);
+            const current = subscriptionSnapshot(scope);
+            if (current.revision !== revision)
+                throw new SubscriptionError('订阅列表已经变化，请刷新后再保存；你的输入已保留。', 409, 'conflict');
+            const old = action === 'edit' ? find(current.feeds, text(args, 'id')) : undefined;
+            let defaultName = '';
+            if (!old || !sameFeedUrl(old.url, url))
+                defaultName = (await check(url, signal)).parsed.feed.title;
+            result = await mutateSubscriptions(scope, feeds => {
+                signal.throwIfAborted();
+                const previous = action === 'edit' ? find(feeds, text(args, 'id')) : undefined;
+                if (feeds.some(feed => feed !== previous && sameFeedUrl(feed.url, url))) {
+                    throw new SubscriptionError('这个地址已经订阅，请编辑现有订阅。', 409, 'duplicate');
+                }
+                const next = { url, name: text(args, 'name') || defaultName, category: text(args, 'category') };
+                return { feeds: previous ? feeds.map(feed => feed === previous ? next : feed) : [...feeds, next], value: { saved: next.name || next.url } };
+            }, revision);
+        }
+        return { result };
+    }
+    return {
+        snapshot,
+        async handle(req, res) {
+            const controller = new AbortController();
+            const abort = () => { if (!res.writableFinished)
+                controller.abort(new Error('请求已取消')); };
+            req.on('aborted', abort);
+            res.on('close', abort);
+            const send = (status, value) => {
+                if (res.destroyed)
+                    return;
+                res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
+                res.end(JSON.stringify(value));
+            };
+            try {
+                requestGuard(req);
+                if (req.method === 'GET')
+                    send(200, { snapshot: snapshot() });
+                else if (req.method === 'POST') {
+                    const result = await dispatch(await readBody(req, controller.signal), controller.signal);
+                    send(200, { ...result, snapshot: snapshot() });
+                }
+                else {
+                    res.setHeader('Allow', 'GET, POST');
+                    send(405, { error: '仅支持 GET 和 POST。', code: 'method' });
+                }
+            }
+            catch (error) {
+                if (!controller.signal.aborted) {
+                    let state;
+                    try {
+                        state = snapshot();
+                    }
+                    catch { /* Malformed saved YAML must not hide the original error. */ }
+                    send(error instanceof SubscriptionError ? error.status : 400, {
+                        error: error instanceof Error ? error.message : String(error), code: error instanceof SubscriptionError ? error.code : 'invalid', snapshot: state,
+                    });
+                }
+            }
+            finally {
+                req.off('aborted', abort);
+                res.off('close', abort);
+            }
+        },
+    };
+}
+export function installRssSettingsWeb(ctx, backend) {
+    if (typeof ctx.inject !== 'function')
+        return;
+    ctx.inject(['webServer'], (webCtx) => webCtx.effect(() => webCtx.webServer.register({
+        kind: 'exact', path: RSS_SETTINGS_ROUTE,
+        handler: (req, res) => backend.handle(req, res),
+    }), 'dsh-rss: settings route'));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rss",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "DSH RSS 插件：订阅源管理、OPML 导入导出、抓取解析 RSS/Atom 并保留正文。",
   "type": "module",
   "main": "lib/index.js",
@@ -10,6 +10,7 @@
       "types": "./lib/index.d.ts",
       "default": "./lib/index.js"
     },
+    "./client": "./lib/client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
@@ -26,6 +27,10 @@
     "prepublishOnly": "pnpm run build"
   },
   "dsh": {
+    "client": {
+      "inject": ["@deepseek-ai/dsh-client-ui-settings"],
+      "platform": "web"
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     }