dsh-rss 0.5.0 → 0.5.1

package/README.en.md

@@ -1,5 +1,11 @@
 # dsh-rss
 
+## 0.5.1 update (2026-10-02)
+
+Fixes public feeds being rejected when a VPN returns Fake-IP DNS addresses. Windows uses the enabled manual system proxy by default. For `198.18.0.0/15` answers, HTTPS DNS obtains real public addresses; connections are pinned to validated addresses while preserving the original hostname and TLS certificate verification. Keep the VPN enabled without changing its configuration or allowing private networks. Request-owned connections are released after redirects, errors or body reads.
+
+All 106 Windows tests pass. With the VPN enabled and native DNS returning Fake-IP, normal plugin calls pass check/add/fetch/persisted incremental deduplication/search for SSPAI, Python Insider, NASA and GitHub Atom, with no injected DNS or fetch results. The legacy Python feed URL also remains readable. These results do not establish separate native desktop UI acceptance.
+
 ## 0.5.0 update (2026-10-02)
 
 Adds **Settings → RSS subscriptions** with add/edit/remove, search, category filters, feed checks and OPML import/export. The panel and conversation tools share the existing subscription list. No migration is needed. UI labels follow the host language and appearance settings.
@@ -65,7 +71,9 @@ Override the plugin row in your profile's `cordis.patch.yml` (the plugin also lo
 - id: rss
   name: 'dsh-rss'
   config:
-    # proxyUrl: http://127.0.0.1:7890   # enable when a feed needs a special proxy
+    # proxyUrl: http://127.0.0.1:7890   # optional override for the Windows system proxy
+    # useSystemProxy: true             # use the enabled Windows manual proxy by default
+    # fakeIpDnsFallback: true          # validate real public DNS answers when Fake-IP is detected
     timeoutMs: 15000                     # fetch timeout in ms (default 15000)
     # maxBodyBytes: 5242880              # response size cap (default 5MB, guards oversized responses)
     # userAgent: 'dsh-rss/0.2.0'         # custom fetch UA
@@ -106,7 +114,9 @@ On Harness 0.1.7, subscriptions and read cursors are stored in the current profi
 
 ## Proxy
 
-Most feeds are reachable directly; a few require a special proxy from your network. When you hit a `fetch failed` error suggesting a proxy, set `proxyUrl` to your local proxy address (e.g. `http://127.0.0.1:7890`) and restart. The proxy only routes this plugin's fetch requests and does not affect other plugins in the same process.
+Windows uses its enabled manual proxy by default, honoring protocol selection and bypass entries. No PAC scripts are evaluated and OS settings are never modified. An explicit `proxyUrl` takes precedence; `useSystemProxy: false` disables automatic detection. Other platforms can still configure an HTTP(S) `proxyUrl`. These routes apply only to this plugin.
+
+When native DNS returns VPN Fake-IP (`198.18.0.0/15`), only the feed hostname is sent to [Cloudflare HTTPS DNS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/), with Google HTTPS DNS as a service-failure fallback. No URL paths, feed content, credentials or subscription lists are sent. Answers must pass public-address checks, and actual connections are pinned to those addresses. Disable this behavior with `fakeIpDnsFallback: false`. Ordinary public DNS, private DNS and IP literals do not trigger it. Trusted internal feeds still require an explicit `allowPrivateNetwork: true`.
 
 ## Parsing capabilities
 

package/README.md

@@ -2,6 +2,12 @@
 
 # dsh-rss
 
+## 0.5.1 更新（2026-10-02）
+
+修复 VPN 开启 Fake-IP 后外部订阅源被拦截的问题。Windows 默认沿用已启用的手动系统代理；检测到 `198.18.0.0/15` 时，通过 HTTPS DNS 查询真实公网地址，再固定连接地址并保留原域名和 TLS 证书校验。VPN 可以保持开启，无需修改代理软件配置或放开内网访问。抓取、跳转或读取结束后释放本次请求的连接。
+
+106 项 Windows 测试通过；在 VPN 开启、原生 DNS 返回 Fake-IP 的环境中，少数派、Python Insider、NASA 和 GitHub Atom 的检查、添加、抓取、持久化增量去重与搜索通过正常插件调用验证，没有注入测试 DNS 或抓取结果。Python 旧订阅地址也仍可读取。桌面原生窗口的单独验收不包含在这些结果中。
+
 ## 0.5.0 更新（2026-10-02）
 
 新增 **设置 → RSS 订阅** 面板：添加、编辑、移除、搜索、分类筛选、检查可用性与 OPML 导入导出。面板与对话工具共用原有订阅列表，不需要迁移数据。跟随 DSH 的中文/英文和外观设置。
@@ -70,7 +76,9 @@ dsh plugin --profile web remove dsh-rss
 - id: rss
   name: 'dsh-rss'
   config:
-    # proxyUrl: http://127.0.0.1:7890   # 部分订阅源需要特殊代理（梯子）才能访问时启用
+    # proxyUrl: http://127.0.0.1:7890   # 可选；覆盖自动读取的 Windows 系统代理
+    # useSystemProxy: true             # 默认读取 Windows 已启用的手动系统代理
+    # fakeIpDnsFallback: true          # 默认在 Fake-IP 下查询并校验真实公网地址
     timeoutMs: 15000                     # 抓取超时（毫秒，默认 15000）
     # maxBodyBytes: 5242880              # 订阅源体积上限（默认 5MB，防超大响应）
     # userAgent: 'dsh-rss/0.2.0'         # 自定义抓取 UA
@@ -108,9 +116,11 @@ rss_opml_import { opml: "<?xml version=\"1.0\"?>..." }
 
 Harness 0.1.7 把订阅列表和读取游标保存在当前 profile 的 `rss` 配置行；增删后立即生效，重启仍保留。默认安装会自动导入旧 `settings.yaml` 或 `settings.yaml.imported` 的 `dsh-rss` 数据一次，保留原文件，且不覆盖已有 profile 值。旧版宿主继续使用原 settings 存储。同名订阅请用 URL 区分。
 
-## 特殊代理（梯子）
+## 代理与 VPN
 
-大部分订阅源可以直接访问；少数订阅源需要特殊代理（梯子）才能连通。遇到 `抓取失败` 且提示需要代理时，把 `proxyUrl` 配成你的本地代理地址（如 `http://127.0.0.1:7890`）并重启即可。代理只作用于本插件的抓取请求，不影响同进程其他插件。
+Windows 上默认读取已启用的手动系统代理，尊重协议与绕过列表；不执行 PAC 脚本，也不修改系统设置。`proxyUrl` 显式配置优先；`useSystemProxy: false` 可关闭自动读取。其他平台仍可通过 `proxyUrl` 配置 HTTP(S) 代理。这些代理仅作用于本插件。
+
+当系统 DNS 返回 VPN 的 Fake-IP（`198.18.0.0/15`）时，默认只向 [Cloudflare HTTPS DNS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/) 查询订阅源域名；服务不可用时尝试 Google HTTPS DNS。查询不会发送订阅源路径、正文、密钥或订阅列表，回答仍须通过公网地址检查；实际连接固定到检查过的地址。`fakeIpDnsFallback: false` 可关闭该兼容方式。普通公网 DNS、私网 DNS 和 IP 字面量不会触发此查询。可信内网订阅仍需单独显式配置 `allowPrivateNetwork: true`。
 
 ## 解析能力
 

package/cordis.patch.yml

@@ -7,7 +7,9 @@
 #   - id: rss
 #     name: 'dsh-rss'
 #     config:
-#       # proxyUrl: http://127.0.0.1:7890   # 部分订阅源需要特殊代理（梯子）时启用
+#       # proxyUrl: http://127.0.0.1:7890   # 可选；覆盖 Windows 系统代理
+#       # useSystemProxy: true              # 默认自动读取 Windows 手动系统代理
+#       # fakeIpDnsFallback: true           # 默认兼容 VPN Fake-IP，仍校验真实公网 IP
 #       timeoutMs: 15000                     # 抓取超时（毫秒）
 #       # feedsYaml: |                        # 可选：预置订阅列表（也可用 rss_add 工具添加）
 #       #   - url: https://example.com/feed.xml

package/lib/config.d.ts

@@ -7,6 +7,8 @@
 /** 插件行配置（cordis.patch.yml 里的 config 段，可缺省）。 */
 export interface RssConfig {
     proxyUrl?: string;
+    useSystemProxy?: boolean;
+    fakeIpDnsFallback?: boolean;
     timeoutMs?: number;
     maxBodyBytes?: number;
     userAgent?: string;
@@ -18,6 +20,8 @@ export interface RssConfig {
 /** 解析后的配置：所有字段都有值。 */
 export interface ResolvedRssConfig {
     proxyUrl: string;
+    useSystemProxy: boolean;
+    fakeIpDnsFallback: boolean;
     timeoutMs: number;
     maxBodyBytes: number;
     userAgent: string;

package/lib/config.js

@@ -6,7 +6,7 @@
  */
 const DEFAULT_TIMEOUT_MS = 15000;
 const DEFAULT_MAX_BODY_BYTES = 5 * 1024 * 1024;
-const DEFAULT_USER_AGENT = 'dsh-rss/0.3.1 (DeepSeek Harness RSS plugin)';
+const DEFAULT_USER_AGENT = 'dsh-rss/0.5.1 (DeepSeek Harness RSS plugin)';
 function configRecord(config) {
     if (config === undefined || config === null)
         return {};
@@ -68,6 +68,8 @@ export function resolveConfig(config) {
         throw new Error('userAgent 不能为空字符串。');
     const feedsYaml = optionalString(cfg, 'feedsYaml') ?? '';
     const allowPrivateNetwork = optionalBoolean(cfg, 'allowPrivateNetwork', false);
+    const useSystemProxy = optionalBoolean(cfg, 'useSystemProxy', true);
+    const fakeIpDnsFallback = optionalBoolean(cfg, 'fakeIpDnsFallback', true);
     const opmlWriteApproval = optionalBoolean(cfg, 'opmlWriteApproval', true);
-    return { proxyUrl, timeoutMs, maxBodyBytes, userAgent, feedsYaml, allowPrivateNetwork, opmlWriteApproval };
+    return { proxyUrl, useSystemProxy, fakeIpDnsFallback, timeoutMs, maxBodyBytes, userAgent, feedsYaml, allowPrivateNetwork, opmlWriteApproval };
 }

package/lib/network.js

@@ -1,9 +1,12 @@
 /** RSS 网络边界：地址校验、重定向、响应大小与调用取消。 */
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
-import { createProxyFetch } from './proxy-fetch.js';
+import { createFeedTransport } from './proxy-fetch.js';
+import { lookupPublicDns } from './public-dns.js';
+import { readResponseText } from './response.js';
+import { readWindowsProxy, selectWindowsProxy } from './system-proxy.js';
 const MAX_REDIRECTS = 5;
-const PROXY_HINT = '。若该订阅源需要特殊代理（梯子）才能访问，请在 cordis.patch.yml 里给 dsh-rss 配置 proxyUrl（如 http://127.0.0.1:7890）后重启。';
+const PROXY_HINT = '。请检查网络与代理连接；也可在 dsh-rss 配置中指定 proxyUrl。';
 function parseHttpUrl(url) {
     let parsed;
     try {
@@ -101,7 +104,11 @@ async function lookupWithSignal(hostname, lookupImpl, signal) {
         });
     });
 }
-async function assertPublicUrl(url, cfg, lookupImpl, signal) {
+function isFakeIp(address) {
+    const bytes = ipv4Bytes(address);
+    return bytes !== null && bytes[0] === 198 && (bytes[1] === 18 || bytes[1] === 19);
+}
+async function resolvePublicUrl(url, cfg, lookupImpl, signal, fallbackLookup) {
     if (cfg.allowPrivateNetwork)
         return;
     const hostname = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
@@ -112,7 +119,7 @@ async function assertPublicUrl(url, cfg, lookupImpl, signal) {
         if (isBlockedNetworkAddress(hostname)) {
             throw new Error('出于安全原因，默认禁止访问回环、私网、链路本地或保留地址：' + hostname + '。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
         }
-        return;
+        return [{ address: hostname, family: isIP(hostname) }];
     }
     let addresses;
     try {
@@ -124,113 +131,91 @@ async function assertPublicUrl(url, cfg, lookupImpl, signal) {
     }
     if (addresses.length === 0)
         throw new Error('无法安全解析订阅源域名 ' + hostname + '：DNS 未返回地址。');
-    const blocked = addresses.find((entry) => isBlockedNetworkAddress(entry.address));
-    if (blocked !== undefined) {
-        const v4 = ipv4Bytes(blocked.address);
-        if (v4 !== null && v4[0] === 198 && (v4[1] === 18 || v4[1] === 19)) {
-            throw new Error('订阅源域名 ' + hostname + ' 被解析为保留地址 ' + blocked.address + '，可能是代理软件的 Fake-IP，已拒绝访问。请在代理 DNS 设置中让该域名返回真实 IP（如加入 fake-ip-filter），然后重试。无需开启内网访问。');
-        }
-        throw new Error('出于安全原因，域名 ' + hostname + ' 解析到了非公网地址 ' + blocked.address + '，已拒绝访问。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
+    const privateAddress = addresses.find(entry => isBlockedNetworkAddress(entry.address) && !isFakeIp(entry.address));
+    if (privateAddress !== undefined) {
+        throw new Error('出于安全原因，域名 ' + hostname + ' 解析到了非公网地址 ' + privateAddress.address + '，已拒绝访问。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
     }
-}
-/** 构造默认 fetch：配置了 proxyUrl 时走插件级代理。 */
-function makeFetch(cfg) {
-    if (cfg.proxyUrl === '')
-        return globalThis.fetch;
-    return createProxyFetch(cfg.proxyUrl);
-}
-/**
- * 抓取订阅源 XML：校验地址、限时、限制体积、剥 BOM。
- */
-async function readResponseText(response, maxBodyBytes, signal) {
-    signal.throwIfAborted();
-    const declaredLength = Number(response.headers.get('content-length'));
-    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
-        await response.body?.cancel('response body exceeds maxBodyBytes');
-        throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
-    }
-    if (response.body === null)
-        return '';
-    const reader = response.body.getReader();
-    const onAbort = () => { void reader.cancel(signal.reason).catch(() => { }); };
-    signal.addEventListener('abort', onAbort, { once: true });
-    const decoder = new TextDecoder('utf-8', { fatal: false });
-    let byteLength = 0;
-    let text = '';
-    try {
-        while (true) {
-            signal.throwIfAborted();
-            const chunk = await reader.read();
-            signal.throwIfAborted();
-            if (chunk.done)
-                break;
-            byteLength += chunk.value.byteLength;
-            if (byteLength > maxBodyBytes) {
-                await reader.cancel('response body exceeds maxBodyBytes');
-                throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
-            }
-            text += decoder.decode(chunk.value, { stream: true });
+    if (addresses.some(entry => isFakeIp(entry.address))) {
+        if (!cfg.fakeIpDnsFallback) {
+            throw new Error('无法安全解析订阅源域名 ' + hostname + '：检测到代理 Fake-IP。可启用 fakeIpDnsFallback 查询真实 IP 后重试，VPN 可以保持开启。');
         }
-        return text + decoder.decode();
+        addresses = await lookupWithSignal(hostname, fallbackLookup, signal);
+        if (addresses.length === 0)
+            throw new Error('无法安全解析订阅源域名 ' + hostname + '：HTTPS DNS 未返回地址。');
     }
-    finally {
-        signal.removeEventListener('abort', onAbort);
-        reader.releaseLock();
+    const blocked = addresses.find((entry) => isBlockedNetworkAddress(entry.address));
+    if (blocked !== undefined) {
+        throw new Error('出于安全原因，域名 ' + hostname + ' 解析到了非公网地址 ' + blocked.address + '，已拒绝访问。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
     }
+    return addresses;
 }
 export async function fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl = async (hostname) => await lookup(hostname, { all: true, verbatim: true })) {
     let currentUrl = parseHttpUrl(url);
-    const fetcher = fetchImpl ?? makeFetch(cfg);
     const signal = mergedSignal(cfg.timeoutMs, exec?.signal);
     let response;
+    let transport;
     try {
-        for (let redirectCount = 0;; redirectCount++) {
+        const systemProxy = fetchImpl === undefined && cfg.proxyUrl === '' && cfg.useSystemProxy
+            ? await readWindowsProxy(signal) : undefined;
+        const fallbackLookup = hostname => lookupPublicDns(hostname, signal, cfg.proxyUrl, systemProxy, fetchImpl);
+        const validate = (target) => resolvePublicUrl(target, cfg, lookupImpl, signal, fallbackLookup);
+        try {
+            for (let redirectCount = 0;; redirectCount++) {
+                signal.throwIfAborted();
+                const addresses = await validate(currentUrl);
+                transport = fetchImpl === undefined ? createFeedTransport(currentUrl, cfg.proxyUrl || selectWindowsProxy(systemProxy, currentUrl), addresses) : undefined;
+                response = await (fetchImpl ?? transport.fetch)(currentUrl.href, {
+                    headers: {
+                        'user-agent': cfg.userAgent,
+                        accept: 'application/rss+xml, application/atom+xml, application/xml, text/xml, */*',
+                    },
+                    redirect: 'manual',
+                    signal,
+                });
+                signal.throwIfAborted();
+                if (![301, 302, 303, 307, 308].includes(response.status))
+                    break;
+                const location = response.headers.get('location');
+                if (location === null)
+                    break;
+                await response.body?.cancel('following validated redirect');
+                await transport?.dispose();
+                transport = undefined;
+                if (redirectCount >= MAX_REDIRECTS)
+                    throw new Error('抓取失败：重定向次数超过 ' + MAX_REDIRECTS + ' 次上限。');
+                currentUrl = parseHttpUrl(new URL(location, currentUrl).href);
+            }
+        }
+        catch (error) {
             signal.throwIfAborted();
-            await assertPublicUrl(currentUrl, cfg, lookupImpl, signal);
-            response = await fetcher(currentUrl.href, {
-                headers: {
-                    'user-agent': cfg.userAgent,
-                    accept: 'application/rss+xml, application/atom+xml, application/xml, text/xml, */*',
-                },
-                redirect: 'manual',
-                signal,
-            });
+            if (error instanceof Error && (error.message.includes('出于安全原因') || error.message.includes('无法安全解析') || error.message.includes('重定向次数超过')))
+                throw error;
+            throw new Error('抓取失败：' + (error instanceof Error ? error.message : String(error)) + PROXY_HINT);
+        }
+        if (response === undefined)
+            throw new Error('抓取失败：未收到服务器响应。');
+        if (!response.ok) {
+            await response.body?.cancel('unsuccessful feed response');
+            throw new Error('抓取失败：服务器返回 HTTP ' + response.status + '。');
+        }
+        const reportedUrl = response.url === '' ? currentUrl : parseHttpUrl(response.url);
+        if (reportedUrl.href !== currentUrl.href)
+            await validate(reportedUrl);
+        let xml;
+        try {
+            xml = await readResponseText(response, cfg.maxBodyBytes, signal);
+        }
+        catch (error) {
             signal.throwIfAborted();
-            if (![301, 302, 303, 307, 308].includes(response.status))
-                break;
-            const location = response.headers.get('location');
-            if (location === null)
-                break;
-            await response.body?.cancel('following validated redirect');
-            if (redirectCount >= MAX_REDIRECTS)
-                throw new Error('抓取失败：重定向次数超过 ' + MAX_REDIRECTS + ' 次上限。');
-            currentUrl = parseHttpUrl(new URL(location, currentUrl).href);
+            if (error instanceof Error && error.message.includes('字节上限'))
+                throw error;
+            throw new Error('读取订阅源内容失败：' + (error instanceof Error ? error.message : String(error)));
         }
+        xml = xml.replace(/^\uFEFF/, '');
+        return { xml, finalUrl: reportedUrl.href };
     }
-    catch (error) {
-        signal.throwIfAborted();
-        if (error instanceof Error && (error.message.includes('出于安全原因') || error.message.includes('无法安全解析') || error.message.includes('重定向次数超过')))
-            throw error;
-        throw new Error('抓取失败：' + (error instanceof Error ? error.message : String(error)) + PROXY_HINT);
-    }
-    if (response === undefined)
-        throw new Error('抓取失败：未收到服务器响应。');
-    if (!response.ok) {
-        await response.body?.cancel('unsuccessful feed response');
-        throw new Error('抓取失败：服务器返回 HTTP ' + response.status + '。');
-    }
-    const reportedUrl = response.url === '' ? currentUrl : parseHttpUrl(response.url);
-    await assertPublicUrl(reportedUrl, cfg, lookupImpl, signal);
-    let xml;
-    try {
-        xml = await readResponseText(response, cfg.maxBodyBytes, signal);
-    }
-    catch (error) {
-        signal.throwIfAborted();
-        if (error instanceof Error && error.message.includes('字节上限'))
-            throw error;
-        throw new Error('读取订阅源内容失败：' + (error instanceof Error ? error.message : String(error)));
+    finally {
+        await response?.body?.cancel().catch(() => { });
+        await transport?.dispose();
     }
-    xml = xml.replace(/^\uFEFF/, '');
-    return { xml, finalUrl: reportedUrl.href };
 }

package/lib/proxy-fetch.d.ts

@@ -1,3 +1,9 @@
+import type { FetchLike, DnsLookupLike } from './network.js';
+/** One request/redirect hop owns its dispatcher until its body has been read. */
+export declare function createFeedTransport(url: URL, proxyUrl: string, addresses?: Awaited<ReturnType<DnsLookupLike>>): {
+    fetch: FetchLike;
+    dispose: () => Promise<void>;
+};
 /**
  * 构造一个把所有请求路由到 proxyUrl 的 fetch。
  * @param proxyUrl - 如 http://127.0.0.1:7890

package/lib/proxy-fetch.js

@@ -1,7 +1,48 @@
 /**
  * 插件级 HTTP 代理：给 RSS 抓取请求一个走指定代理的 fetch，不影响同进程其他插件。
  */
-import { ProxyAgent, fetch as undiciFetch } from 'undici';
+import { Agent, Client, ProxyAgent, fetch as undiciFetch } from 'undici';
+import { isIP } from 'node:net';
+/** One request/redirect hop owns its dispatcher until its body has been read. */
+export function createFeedTransport(url, proxyUrl, addresses) {
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    const servername = isIP(hostname) === 0 ? hostname : undefined;
+    const dispatcher = proxyUrl === ''
+        ? new Agent({ connect: addresses === undefined ? {} : {
+                lookup: (name, options, callback) => {
+                    if (name !== hostname) {
+                        callback(new Error('Unexpected RSS connection hostname'), '', 4);
+                        return;
+                    }
+                    const candidates = addresses.filter(entry => !options.family || entry.family === options.family);
+                    if (candidates.length === 0) {
+                        callback(new Error('No validated RSS address for this family'), '', 4);
+                        return;
+                    }
+                    if (options.all)
+                        callback(null, [...candidates]);
+                    else
+                        callback(null, candidates[0].address, candidates[0].family);
+                },
+            } })
+        : new ProxyAgent({ uri: proxyUrl, proxyTunnel: true, requestTls: { servername },
+            factory: (origin, options) => {
+                const delegate = options.connect;
+                if (addresses === undefined || typeof delegate !== 'function')
+                    return new Client(origin, options);
+                return new Client(origin, { ...options, connect: (socketOptions, callback) => {
+                        const address = addresses[0].address;
+                        const port = socketOptions.port || (url.protocol === 'https:' ? '443' : '80');
+                        const host = (isIP(address) === 6 ? '[' + address + ']' : address) + ':' + port;
+                        delegate({ ...socketOptions, hostname: address, host, port, servername }, callback);
+                    } });
+            },
+        });
+    return {
+        fetch: async (input, init) => await undiciFetch(input, { ...init, redirect: 'manual', dispatcher }),
+        dispose: async () => { await dispatcher.destroy(); },
+    };
+}
 /**
  * 构造一个把所有请求路由到 proxyUrl 的 fetch。
  * @param proxyUrl - 如 http://127.0.0.1:7890

package/lib/public-dns.d.ts

@@ -0,0 +1,3 @@
+import type { FetchLike, DnsLookupLike } from './network.js';
+import { type SystemProxy } from './system-proxy.js';
+export declare function lookupPublicDns(hostname: string, signal: AbortSignal, proxyUrl: string, systemProxy?: SystemProxy, fetchImpl?: FetchLike): Promise<Awaited<ReturnType<DnsLookupLike>>>;

package/lib/public-dns.js

@@ -0,0 +1,49 @@
+/** HTTPS DNS is used only when the OS returns a VPN's 198.18/15 Fake-IP. */
+import { isIP } from 'node:net';
+import { createFeedTransport } from './proxy-fetch.js';
+import { readResponseText } from './response.js';
+import { selectWindowsProxy } from './system-proxy.js';
+const PROVIDERS = ['https://cloudflare-dns.com/dns-query', 'https://dns.google/resolve'];
+export async function lookupPublicDns(hostname, signal, proxyUrl, systemProxy, fetchImpl) {
+    let lastError;
+    for (const provider of PROVIDERS) {
+        try {
+            for (const family of [4, 6]) {
+                signal.throwIfAborted();
+                const url = new URL(provider);
+                url.searchParams.set('name', hostname);
+                url.searchParams.set('type', family === 4 ? 'A' : 'AAAA');
+                const transport = fetchImpl === undefined ? createFeedTransport(url, proxyUrl || selectWindowsProxy(systemProxy, url)) : undefined;
+                let response;
+                try {
+                    response = await (fetchImpl ?? transport.fetch)(url.href, { redirect: 'manual', signal, headers: { accept: 'application/dns-json' } });
+                    if (!response.ok)
+                        throw new Error('HTTPS DNS 返回 HTTP ' + response.status);
+                    const value = JSON.parse(await readResponseText(response, 64 * 1024, signal));
+                    if (value.Status !== 0 || value.TC === true)
+                        throw new Error('HTTPS DNS 未返回完整有效的解析结果');
+                    const records = value.Answer ?? [];
+                    if (!Array.isArray(records))
+                        throw new Error('HTTPS DNS 解析结果格式无效');
+                    const answers = records.filter(record => record.type === (family === 4 ? 1 : 28)).map(record => {
+                        if (typeof record.data !== 'string' || isIP(record.data) !== family)
+                            throw new Error('HTTPS DNS 返回无效 IP 地址');
+                        return { address: record.data, family };
+                    });
+                    if (answers.length > 0)
+                        return answers;
+                }
+                finally {
+                    await response?.body?.cancel().catch(() => { });
+                    await transport?.dispose();
+                }
+            }
+            throw new Error('HTTPS DNS 未返回地址');
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            lastError = error;
+        }
+    }
+    throw new Error('无法安全解析订阅源域名 ' + hostname + ' 的真实 IP：' + (lastError instanceof Error ? lastError.message : String(lastError)) + '。VPN 可以保持开启，请检查代理连接。');
+}

package/lib/response.d.ts

@@ -0,0 +1,2 @@
+/** Read a bounded response while retaining the caller's cancellation reason. */
+export declare function readResponseText(response: Response, maxBodyBytes: number, signal: AbortSignal): Promise<string>;

package/lib/response.js

@@ -0,0 +1,37 @@
+/** Read a bounded response while retaining the caller's cancellation reason. */
+export async function readResponseText(response, maxBodyBytes, signal) {
+    signal.throwIfAborted();
+    const declaredLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        await response.body?.cancel('response body exceeds maxBodyBytes');
+        throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
+    }
+    if (response.body === null)
+        return '';
+    const reader = response.body.getReader();
+    const onAbort = () => { void reader.cancel(signal.reason).catch(() => { }); };
+    signal.addEventListener('abort', onAbort, { once: true });
+    const decoder = new TextDecoder('utf-8', { fatal: false });
+    let byteLength = 0;
+    let text = '';
+    try {
+        while (true) {
+            signal.throwIfAborted();
+            const chunk = await reader.read();
+            signal.throwIfAborted();
+            if (chunk.done)
+                break;
+            byteLength += chunk.value.byteLength;
+            if (byteLength > maxBodyBytes) {
+                await reader.cancel('response body exceeds maxBodyBytes');
+                throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
+            }
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        return text + decoder.decode();
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+        reader.releaseLock();
+    }
+}

package/lib/settings.d.ts

@@ -5,6 +5,8 @@ export declare const Config: modern<Schemastery.ObjectS<NoInfer<{
     proxyUrl: modern<string, string, "plain">;
     timeoutMs: modern<number, number, "plain">;
     maxBodyBytes: modern<number, number, "plain">;
+    useSystemProxy: modern<boolean, boolean, "plain">;
+    fakeIpDnsFallback: modern<boolean, boolean, "plain">;
     userAgent: modern<string, string, "plain">;
     allowPrivateNetwork: modern<boolean, boolean, "plain">;
     opmlWriteApproval: modern<boolean, boolean, "plain">;
@@ -15,6 +17,8 @@ export declare const Config: modern<Schemastery.ObjectS<NoInfer<{
     proxyUrl: modern<string, string, "plain">;
     timeoutMs: modern<number, number, "plain">;
     maxBodyBytes: modern<number, number, "plain">;
+    useSystemProxy: modern<boolean, boolean, "plain">;
+    fakeIpDnsFallback: modern<boolean, boolean, "plain">;
     userAgent: modern<string, string, "plain">;
     allowPrivateNetwork: modern<boolean, boolean, "plain">;
     opmlWriteApproval: modern<boolean, boolean, "plain">;

package/lib/settings.js

@@ -8,6 +8,7 @@ import modern from '@deepseek-ai/schemastery';
 export const Config = modern.object({
     feedsYaml: modern.string().volatile(), cursorsJson: modern.string().volatile(),
     proxyUrl: modern.string(), timeoutMs: modern.number(), maxBodyBytes: modern.number(),
+    useSystemProxy: modern.boolean(), fakeIpDnsFallback: modern.boolean(),
     userAgent: modern.string(), allowPrivateNetwork: modern.boolean(), opmlWriteApproval: modern.boolean(),
     legacySettingsImported: modern.boolean().volatile(),
 });

package/lib/system-proxy.d.ts

@@ -0,0 +1,7 @@
+export interface SystemProxy {
+    server: string;
+    bypass: string;
+}
+export declare function parseWindowsProxy(output: string): SystemProxy | undefined;
+export declare function selectWindowsProxy(proxy: SystemProxy | undefined, url: URL): string;
+export declare function readWindowsProxy(signal: AbortSignal): Promise<SystemProxy | undefined>;

package/lib/system-proxy.js

@@ -0,0 +1,52 @@
+/** Read the enabled Windows manual proxy; never modify OS or VPN settings. */
+import { execFile } from 'node:child_process';
+export function parseWindowsProxy(output) {
+    const enabled = /^\s*ProxyEnable\s+REG_DWORD\s+(\S+)\s*$/mi.exec(output);
+    if (enabled === null || Number(enabled[1]) !== 1)
+        return undefined;
+    const server = /^\s*ProxyServer\s+REG_SZ\s+(.+)$/mi.exec(output)?.[1].trim();
+    if (!server)
+        return undefined;
+    return { server, bypass: /^\s*ProxyOverride\s+REG_SZ\s+(.+)$/mi.exec(output)?.[1].trim() ?? '' };
+}
+export function selectWindowsProxy(proxy, url) {
+    if (proxy === undefined)
+        return '';
+    const hostname = url.hostname.toLowerCase();
+    for (const pattern of proxy.bypass.split(';').map(value => value.trim().toLowerCase()).filter(Boolean)) {
+        if (pattern === '<local>' && !hostname.includes('.'))
+            return '';
+        const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+        if (new RegExp('^' + escaped + '$', 'i').test(hostname))
+            return '';
+    }
+    const entries = proxy.server.split(';').map(value => value.trim()).filter(Boolean);
+    const protocol = url.protocol.slice(0, -1);
+    const selected = entries.some(value => value.includes('='))
+        ? entries.find(value => value.startsWith(protocol + '='))?.slice(protocol.length + 1)
+        : entries[0];
+    if (!selected)
+        return '';
+    try {
+        const parsed = new URL(selected.includes('://') ? selected : 'http://' + selected);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return '';
+        return parsed.href;
+    }
+    catch {
+        return '';
+    }
+}
+export async function readWindowsProxy(signal) {
+    signal.throwIfAborted();
+    if (process.platform !== 'win32')
+        return undefined;
+    return await new Promise((resolveProxy, reject) => {
+        execFile('reg.exe', ['query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'], { encoding: 'utf8', windowsHide: true, timeout: 1500, maxBuffer: 128 * 1024, signal }, (error, stdout) => {
+            if (signal.aborted)
+                reject(signal.reason);
+            else
+                resolveProxy(error === null ? parseWindowsProxy(stdout) : undefined);
+        });
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rss",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "DSH RSS 插件：订阅源管理、OPML 导入导出、抓取解析 RSS/Atom 并保留正文。",
   "type": "module",
   "main": "lib/index.js",
@@ -28,7 +28,9 @@
   },
   "dsh": {
     "client": {
-      "inject": ["@deepseek-ai/dsh-client-ui-settings"],
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
       "platform": "web"
     },
     "bundle": {
@@ -48,11 +50,11 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.3",
     "fast-xml-parser": "^5.0.0",
     "schemastery": "^3.18.0",
-    "undici": "^8.10.0",
-    "yaml": "^2.9.0",
-    "@deepseek-ai/schemastery": "^3.18.3"
+    "undici": "^8.11.2",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",