dsh-rss 0.4.3 → 0.5.1

package/lib/system-proxy.js

@@ -0,0 +1,52 @@
+/** Read the enabled Windows manual proxy; never modify OS or VPN settings. */
+import { execFile } from 'node:child_process';
+export function parseWindowsProxy(output) {
+    const enabled = /^\s*ProxyEnable\s+REG_DWORD\s+(\S+)\s*$/mi.exec(output);
+    if (enabled === null || Number(enabled[1]) !== 1)
+        return undefined;
+    const server = /^\s*ProxyServer\s+REG_SZ\s+(.+)$/mi.exec(output)?.[1].trim();
+    if (!server)
+        return undefined;
+    return { server, bypass: /^\s*ProxyOverride\s+REG_SZ\s+(.+)$/mi.exec(output)?.[1].trim() ?? '' };
+}
+export function selectWindowsProxy(proxy, url) {
+    if (proxy === undefined)
+        return '';
+    const hostname = url.hostname.toLowerCase();
+    for (const pattern of proxy.bypass.split(';').map(value => value.trim().toLowerCase()).filter(Boolean)) {
+        if (pattern === '<local>' && !hostname.includes('.'))
+            return '';
+        const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+        if (new RegExp('^' + escaped + '$', 'i').test(hostname))
+            return '';
+    }
+    const entries = proxy.server.split(';').map(value => value.trim()).filter(Boolean);
+    const protocol = url.protocol.slice(0, -1);
+    const selected = entries.some(value => value.includes('='))
+        ? entries.find(value => value.startsWith(protocol + '='))?.slice(protocol.length + 1)
+        : entries[0];
+    if (!selected)
+        return '';
+    try {
+        const parsed = new URL(selected.includes('://') ? selected : 'http://' + selected);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return '';
+        return parsed.href;
+    }
+    catch {
+        return '';
+    }
+}
+export async function readWindowsProxy(signal) {
+    signal.throwIfAborted();
+    if (process.platform !== 'win32')
+        return undefined;
+    return await new Promise((resolveProxy, reject) => {
+        execFile('reg.exe', ['query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'], { encoding: 'utf8', windowsHide: true, timeout: 1500, maxBuffer: 128 * 1024, signal }, (error, stdout) => {
+            if (signal.aborted)
+                reject(signal.reason);
+            else
+                resolveProxy(error === null ? parseWindowsProxy(stdout) : undefined);
+        });
+    });
+}

package/lib/tools.js

@@ -5,10 +5,11 @@
  * @module dsh-rss/tools
  */
 import { writeFile } from 'node:fs/promises';
-import { addFeed, findFeedsByName, parseFeedsYaml, removeFeed, sameFeedUrl, serializeFeeds } from './feeds.js';
+import { addFeed, findFeedsByName, removeFeed, sameFeedUrl } from './feeds.js';
 import { buildOpml, importOpmlFeeds, parseOpml } from './opml.js';
 import { parseFeed } from './parser.js';
-import { assertHttpUrl, fetchFeedXml } from './network.js';
+import { assertHttpUrl } from './network.js';
+import { subscriptionSnapshot, mutateSubscriptions, readRssFeed } from './subscriptions.js';
 import { resolveOpmlOutputPath } from './workspace.js';
 export { isBlockedNetworkAddress } from './network.js';
 const TIMEOUT_MS = 30000;
@@ -405,19 +406,8 @@ function renderHealth(_args, value) {
  */
 export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
     const cfg = config;
-    const getFeeds = () => {
-        const value = settingsScope.get();
-        const yamlText = value !== null && typeof value === 'object' && typeof value.feedsYaml === 'string' ? value.feedsYaml : '';
-        return parseFeedsYaml(yamlText);
-    };
-    const persistFeeds = async (feeds) => {
-        try {
-            await settingsScope.update({ feedsYaml: serializeFeeds(feeds) });
-        }
-        catch (error) {
-            throw new Error('写入订阅配置失败（可能已被其他会话修改，请重试）：' + (error instanceof Error ? error.message : String(error)));
-        }
-    };
+    const getFeeds = () => subscriptionSnapshot(settingsScope).feeds;
+    const readFeed = (url, exec) => readRssFeed(settingsScope, url, cfg, exec, fetchImpl, lookupImpl);
     const rssList = {
         name: 'rss_list',
         description: '列出已订阅的 RSS/Atom 源（存在 settings 的 dsh-rss.feedsYaml 里，可用 rss_add / rss_remove 管理）。返回每个订阅的 url、name、category 与总数。',
@@ -450,12 +440,12 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             assertHttpUrl(url);
             const name = optionalString(args, 'name') ?? '';
             const category = optionalString(args, 'category') ?? '';
-            const { xml, finalUrl } = await fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl);
-            const parsed = parseFeed(xml, finalUrl);
+            const { parsed } = await readFeed(url, exec);
             const effectiveName = name !== '' ? name : parsed.feed.title;
-            const { feeds, added, existed } = addFeed(getFeeds(), url, effectiveName, category);
-            await persistFeeds(feeds);
-            return { added, existed, count: feeds.length, feedTitle: parsed.feed.title, feedType: parsed.feed.feedType };
+            return mutateSubscriptions(settingsScope, current => {
+                const { feeds, added, existed } = addFeed(current, url, effectiveName, category);
+                return { feeds, value: { added, existed, count: feeds.length, feedTitle: parsed.feed.title, feedType: parsed.feed.feedType } };
+            });
         },
         timeoutMs: cfg.timeoutMs,
     };
@@ -472,9 +462,10 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
         },
         async execute(rawArgs) {
             const args = asRecord(rawArgs);
-            const { feeds, removed } = removeFeed(getFeeds(), optionalString(args, 'url'), optionalString(args, 'name'));
-            await persistFeeds(feeds);
-            return { removed, count: feeds.length };
+            return mutateSubscriptions(settingsScope, current => {
+                const { feeds, removed } = removeFeed(current, optionalString(args, 'url'), optionalString(args, 'name'));
+                return { feeds, value: { removed, count: feeds.length } };
+            });
         },
         timeoutMs: TIMEOUT_MS,
     };
@@ -523,8 +514,7 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             assertHttpUrl(url);
             const limit = clampedInteger(args, 'limit', 20, 1, 100);
             const incremental = args.incremental === true;
-            const { xml, finalUrl } = await fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl);
-            const parsed = parseFeed(xml, finalUrl);
+            const { parsed, finalUrl } = await readFeed(url, exec);
             if (!incremental) {
                 const entries = parsed.entries.slice(0, limit);
                 return { url: finalUrl, feed: parsed.feed, entries, truncated: parsed.entries.length > limit };
@@ -552,8 +542,7 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             const args = asRecord(rawArgs);
             const url = requiredString(args, 'url', '订阅源地址');
             assertHttpUrl(url);
-            const { xml, finalUrl } = await fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl);
-            const parsed = parseFeed(xml, finalUrl);
+            const { parsed, finalUrl } = await readFeed(url, exec);
             return {
                 ok: true,
                 url: finalUrl,
@@ -605,16 +594,14 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
             const args = asRecord(rawArgs);
             const opmlText = requiredString(args, 'opml', 'OPML 文本');
             const document = parseOpml(opmlText);
-            const outcome = importOpmlFeeds(getFeeds(), document);
-            await persistFeeds(outcome.feeds);
-            return {
-                addedCount: outcome.addedCount,
-                existedCount: outcome.existedCount,
-                skippedCount: outcome.skippedCount,
-                totalCount: outcome.feeds.length,
-                added: outcome.added,
-                skipped: outcome.skipped,
-            };
+            return mutateSubscriptions(settingsScope, current => {
+                const outcome = importOpmlFeeds(current, document);
+                return { feeds: outcome.feeds, value: {
+                        addedCount: outcome.addedCount, existedCount: outcome.existedCount,
+                        skippedCount: outcome.skippedCount, totalCount: outcome.feeds.length,
+                        added: outcome.added, skipped: outcome.skipped,
+                    } };
+            });
         },
         timeoutMs: TIMEOUT_MS,
     };
@@ -656,8 +643,7 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
                 if (hits.length >= limit)
                     break;
                 try {
-                    const { xml, finalUrl } = await fetchFeedXml(feed.url, cfg, exec, fetchImpl, lookupImpl);
-                    const parsed = parseFeed(xml, finalUrl);
+                    const { parsed } = await readFeed(feed.url, exec);
                     for (const entry of parsed.entries) {
                         const rec = asRecord(entry);
                         const at = Date.parse(typeof rec.pubDate === 'string' ? rec.pubDate : '');

package/lib/web.d.ts

@@ -0,0 +1,27 @@
+/** Authenticated, local settings route; no separate copy of subscription data. */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RssSettingsScope } from './tools.js';
+import type { ResolvedRssConfig } from './config.js';
+import { type FetchLike, type DnsLookupLike } from './network.js';
+export declare const RSS_SETTINGS_ROUTE = "/_dsh/dsh-rss/subscriptions";
+export declare function createRssSettingsBackend(config: ResolvedRssConfig, scope: RssSettingsScope, options?: {
+    writable?: () => boolean;
+    fetchImpl?: FetchLike;
+    lookupImpl?: DnsLookupLike;
+}): {
+    snapshot: () => {
+        revision: string;
+        writable: boolean;
+        feeds: {
+            id: string;
+            check: import("./subscriptions.js").FeedCheck | null;
+            url: string;
+            name: string;
+            category: string;
+        }[];
+    };
+    handle(req: IncomingMessage, res: ServerResponse): Promise<void>;
+};
+export declare function installRssSettingsWeb(ctx: {
+    inject?: Function;
+}, backend: ReturnType<typeof createRssSettingsBackend>): void;

package/lib/web.js

@@ -0,0 +1,217 @@
+import { sameFeedUrl } from './feeds.js';
+import { assertHttpUrl } from './network.js';
+import { buildOpml, parseOpml, importOpmlFeeds } from './opml.js';
+import { feedId, subscriptionSnapshot, mutateSubscriptions, recentFeedChecks, readRssFeed, SubscriptionError } from './subscriptions.js';
+export const RSS_SETTINGS_ROUTE = '/_dsh/dsh-rss/subscriptions';
+// JSON quoting can double the OPML file size; limit the actual text separately.
+const MAX_OPML = 1024 * 1024;
+const MAX_BODY = MAX_OPML * 2 + 16384;
+const loopback = (host) => ['127.0.0.1', 'localhost', '::1', '[::1]', '::ffff:127.0.0.1'].includes(host.toLowerCase());
+const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const text = (args, key) => typeof args[key] === 'string' ? args[key].trim() : '';
+function requestGuard(req) {
+    const host = req.headers.host;
+    if (!host || !loopback(req.socket.remoteAddress ?? ''))
+        throw new SubscriptionError('设置面板仅允许本机访问。', 403, 'local_only');
+    let target;
+    try {
+        target = new URL('http://' + host);
+    }
+    catch {
+        throw new SubscriptionError('无效的请求地址。', 403);
+    }
+    if (!loopback(target.hostname) || target.username || target.password || target.pathname !== '/' || target.search || target.hash) {
+        throw new SubscriptionError('设置面板仅允许本机访问。', 403, 'local_only');
+    }
+    const protocol = req.socket.encrypted ? 'https:' : 'http:';
+    target.protocol = protocol;
+    const origin = req.headers.origin;
+    if ((req.method === 'POST' && !origin) || (origin !== undefined && origin !== target.origin)) {
+        throw new SubscriptionError('请从当前 DSH 设置页面操作。', 403, 'origin');
+    }
+    if (req.method === 'POST' && !/^application\/json(?:\s*;|$)/i.test(req.headers['content-type'] ?? '')) {
+        throw new SubscriptionError('请求必须使用 JSON。', 415);
+    }
+}
+function readBody(req, signal) {
+    return new Promise((resolve, reject) => {
+        let length = 0;
+        const chunks = [];
+        const cleanup = () => { req.off('data', data); req.off('end', end); req.off('error', error); signal.removeEventListener('abort', abort); };
+        const fail = (reason) => { cleanup(); reject(reason); };
+        const data = (chunk) => {
+            length += chunk.length;
+            if (length > MAX_BODY) {
+                chunks.length = 0;
+                fail(new SubscriptionError('内容超过 1 MiB，请拆分 OPML 文件后重试。', 413));
+                req.resume();
+            }
+            else
+                chunks.push(chunk);
+        };
+        const error = (reason) => fail(reason);
+        const abort = () => fail(signal.reason);
+        const end = () => {
+            cleanup();
+            try {
+                const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    throw new Error();
+                resolve(value);
+            }
+            catch {
+                reject(new SubscriptionError('请求内容不是有效的 JSON。'));
+            }
+        };
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        req.on('data', data);
+        req.on('end', end);
+        req.on('error', error);
+        signal.addEventListener('abort', abort, { once: true });
+    });
+}
+export function createRssSettingsBackend(config, scope, options = {}) {
+    const writable = () => options.writable?.() !== false;
+    const snapshot = () => {
+        const state = subscriptionSnapshot(scope);
+        const checks = recentFeedChecks(scope);
+        return { revision: state.revision, writable: writable(), feeds: state.feeds.map(feed => ({ ...feed, id: feedId(feed.url), check: checks.get(feed.url) ?? null })) };
+    };
+    const find = (feeds, id) => {
+        const feed = feeds.find(feed => feedId(feed.url) === id);
+        if (!feed)
+            throw new SubscriptionError('这个订阅已被移除，请刷新列表。', 409, 'conflict');
+        return feed;
+    };
+    const check = (url, signal) => {
+        assertHttpUrl(url);
+        return readRssFeed(scope, url, config, { signal }, options.fetchImpl, options.lookupImpl);
+    };
+    const preview = (args) => {
+        const opml = text(args, 'opml');
+        if (Buffer.byteLength(opml, 'utf8') > MAX_OPML)
+            throw new SubscriptionError('OPML 内容超过 1 MiB，请拆分后导入。', 413, 'bodyLarge');
+        const state = subscriptionSnapshot(scope);
+        const updateExisting = args.updateExisting === true;
+        const outcome = importOpmlFeeds(state.feeds, parseOpml(opml), updateExisting);
+        // Never return credentials embedded in rejected URLs.
+        const skipped = outcome.skipped.map(item => ({ ...item, url: item.url.replace(/(https?:\/\/)[^/@\s]+@/gi, '$1***@') }));
+        return { ...outcome, feeds: undefined, skipped, revision: state.revision,
+            token: feedId(JSON.stringify([state.revision, opml, updateExisting])) };
+    };
+    async function dispatch(args, signal) {
+        const action = text(args, 'action');
+        if (action === 'export')
+            return { opml: buildOpml(subscriptionSnapshot(scope).feeds) };
+        if (action === 'preview')
+            return { preview: preview(args) };
+        if (action === 'check') {
+            const url = text(args, 'id') ? find(subscriptionSnapshot(scope).feeds, text(args, 'id')).url : text(args, 'url');
+            const { parsed } = await check(url, signal);
+            return { check: { ok: true, title: parsed.feed.title, entryCount: parsed.entries.length } };
+        }
+        if (!['add', 'edit', 'remove', 'import'].includes(action))
+            throw new SubscriptionError('未知的操作。');
+        if (!writable())
+            throw new SubscriptionError('当前配置是只读的，无法保存订阅。', 403, 'readonly');
+        const revision = text(args, 'revision');
+        if (!revision)
+            throw new SubscriptionError('请先刷新订阅列表。', 409, 'conflict');
+        let result;
+        if (action === 'import') {
+            const candidate = preview(args);
+            if (candidate.revision !== revision || candidate.token !== text(args, 'token')) {
+                throw new SubscriptionError('订阅列表或导入内容已经变化，请重新预览；你的输入已保留。', 409, 'conflict');
+            }
+            result = await mutateSubscriptions(scope, feeds => {
+                signal.throwIfAborted();
+                const outcome = importOpmlFeeds(feeds, parseOpml(text(args, 'opml')), args.updateExisting === true);
+                return { feeds: outcome.feeds, value: { addedCount: outcome.addedCount, existedCount: outcome.existedCount, skippedCount: outcome.skippedCount } };
+            }, revision);
+        }
+        else if (action === 'remove') {
+            result = await mutateSubscriptions(scope, feeds => {
+                signal.throwIfAborted();
+                const target = find(feeds, text(args, 'id'));
+                return { feeds: feeds.filter(feed => feed !== target), value: { removed: target.name || target.url } };
+            }, revision);
+        }
+        else {
+            const url = text(args, 'url');
+            assertHttpUrl(url);
+            const current = subscriptionSnapshot(scope);
+            if (current.revision !== revision)
+                throw new SubscriptionError('订阅列表已经变化，请刷新后再保存；你的输入已保留。', 409, 'conflict');
+            const old = action === 'edit' ? find(current.feeds, text(args, 'id')) : undefined;
+            let defaultName = '';
+            if (!old || !sameFeedUrl(old.url, url))
+                defaultName = (await check(url, signal)).parsed.feed.title;
+            result = await mutateSubscriptions(scope, feeds => {
+                signal.throwIfAborted();
+                const previous = action === 'edit' ? find(feeds, text(args, 'id')) : undefined;
+                if (feeds.some(feed => feed !== previous && sameFeedUrl(feed.url, url))) {
+                    throw new SubscriptionError('这个地址已经订阅，请编辑现有订阅。', 409, 'duplicate');
+                }
+                const next = { url, name: text(args, 'name') || defaultName, category: text(args, 'category') };
+                return { feeds: previous ? feeds.map(feed => feed === previous ? next : feed) : [...feeds, next], value: { saved: next.name || next.url } };
+            }, revision);
+        }
+        return { result };
+    }
+    return {
+        snapshot,
+        async handle(req, res) {
+            const controller = new AbortController();
+            const abort = () => { if (!res.writableFinished)
+                controller.abort(new Error('请求已取消')); };
+            req.on('aborted', abort);
+            res.on('close', abort);
+            const send = (status, value) => {
+                if (res.destroyed)
+                    return;
+                res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
+                res.end(JSON.stringify(value));
+            };
+            try {
+                requestGuard(req);
+                if (req.method === 'GET')
+                    send(200, { snapshot: snapshot() });
+                else if (req.method === 'POST') {
+                    const result = await dispatch(await readBody(req, controller.signal), controller.signal);
+                    send(200, { ...result, snapshot: snapshot() });
+                }
+                else {
+                    res.setHeader('Allow', 'GET, POST');
+                    send(405, { error: '仅支持 GET 和 POST。', code: 'method' });
+                }
+            }
+            catch (error) {
+                if (!controller.signal.aborted) {
+                    let state;
+                    try {
+                        state = snapshot();
+                    }
+                    catch { /* Malformed saved YAML must not hide the original error. */ }
+                    send(error instanceof SubscriptionError ? error.status : 400, {
+                        error: error instanceof Error ? error.message : String(error), code: error instanceof SubscriptionError ? error.code : 'invalid', snapshot: state,
+                    });
+                }
+            }
+            finally {
+                req.off('aborted', abort);
+                res.off('close', abort);
+            }
+        },
+    };
+}
+export function installRssSettingsWeb(ctx, backend) {
+    if (typeof ctx.inject !== 'function')
+        return;
+    ctx.inject(['webServer'], (webCtx) => webCtx.effect(() => webCtx.webServer.register({
+        kind: 'exact', path: RSS_SETTINGS_ROUTE,
+        handler: (req, res) => backend.handle(req, res),
+    }), 'dsh-rss: settings route'));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rss",
-  "version": "0.4.3",
+  "version": "0.5.1",
   "description": "DSH RSS 插件：订阅源管理、OPML 导入导出、抓取解析 RSS/Atom 并保留正文。",
   "type": "module",
   "main": "lib/index.js",
@@ -10,6 +10,7 @@
       "types": "./lib/index.d.ts",
       "default": "./lib/index.js"
     },
+    "./client": "./lib/client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
@@ -26,6 +27,12 @@
     "prepublishOnly": "pnpm run build"
   },
   "dsh": {
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     }
@@ -43,11 +50,11 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.3",
     "fast-xml-parser": "^5.0.0",
     "schemastery": "^3.18.0",
-    "undici": "^8.10.0",
-    "yaml": "^2.9.0",
-    "@deepseek-ai/schemastery": "^3.18.3"
+    "undici": "^8.11.2",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",