dsh-rss 0.5.0 → 0.5.2

package/docs/VALIDATION.md

@@ -0,0 +1,25 @@
+# dsh-rss 验证记录
+
+[0.5.2 中英文界面验收](validation-language-2026-10-03.md)。
+
+本页整理原 README 的历史验证说明，保留当时的版本、日期与范围。自动测试、启动检查、浏览器操作和真实服务验收分别记录，不能相互替代。更详细的版本验收文件仍保留在仓库中。
+
+## 原中文记录
+
+0.4.0 起适配官方源码构建的 Harness **0.1.7 及以上的声明式设置接口**；当前基线为 **0.2.0-rc.2**，18 个插件同载、工具契约、订阅读写与重启持久化在隔离环境通过验证；真实外部订阅源需要正常网络连接。Node 要求为 22.19 及以上的 22.x，或 24 及以上。
+
+抓取接收 Harness 的取消信号，取消 DNS、网络读取或跨源搜索时保留原始取消原因。默认预检域名解析结果并拒绝回环、私网和链路本地地址；每次重定向都重新校验。可信内网源可显式配置 `allowPrivateNetwork: true`。
+
+`rss_opml_export.path` 必须相对本次调用的会话工作区，父目录须已存在；工具拒绝绝对路径、目录穿越和指向工作区外的链接，并返回实际写入文件的绝对路径。文件写入默认通过 Harness 审批门，`opmlWriteApproval: false` 可关闭该门；省略 `path` 时仅返回 OPML 文本。
+
+## Original English record
+
+Version 0.4.0 supports the declarative settings interface introduced in Harness **0.1.7**. The current baseline is official-source **0.2.0-rc.2**. All 18 plugins load together; tool contracts, subscription updates and restart persistence pass in isolation. Live feeds require working network access. Requires Node 22.19 or later within 22.x, or 24 or later.
+
+Fetches honor the Harness cancellation signal through DNS, response streaming, and cross-feed searches. Hostname preflight checks reject loopback, private, and link-local addresses by default, including redirect destinations. Set `allowPrivateNetwork: true` for trusted internal feeds.
+
+`rss_opml_export.path` is relative to the calling session's workspace, with an existing parent directory. Absolute paths, traversal, and links outside the workspace are rejected; the result returns the absolute written path. File writes request Harness approval by default (`opmlWriteApproval: false` disables this gate). Omit `path` to return only OPML text.
+
+## 0.4.3 原验证说明
+
+验证宿主：官方源码构建的 Harness `0.2.0-rc.2`（commit `639ed01539`，2026-10-01）。81 项 Windows 插件测试、18 个插件共同加载与 9 个 RSS 工具的契约检查通过。真实外部订阅源仍需正常网络连接。

package/docs/validation-2026-10-02-fakeip.md

@@ -0,0 +1,32 @@
+# RSS 0.5.1 VPN / Fake-IP acceptance
+
+Date: 2026-10-02. Host: official-source Harness `0.2.0-rc.2`, commit `639ed015397290b3745d163aafe02ffee4aa3f84`. Windows, Node 24.16.0, Undici 8.11.2.
+
+## Reproduction and fix
+
+Native Windows DNS returned `198.18.*` for public feed domains while FlClash remained enabled in Fake-IP mode. Version 0.5.0 rejected those answers before fetching. Version 0.5.1 uses the already-enabled manual Windows proxy and HTTPS DNS for Fake-IP answers. Feed connections are pinned to validated public addresses, with the original HTTP Host and TLS servername. Each redirect is separately validated. TLS verification and private-network protection remain enabled. Request-owned dispatchers are destroyed after completion or cancellation.
+
+The VPN was not stopped or reconfigured. Its three process IDs and generated configuration SHA256 remained unchanged during acceptance. No user profile, API key or existing subscription was used or modified.
+
+## Verification
+
+- `pnpm test`: 106/106 on Windows. Includes real local CONNECT-proxy transport, preserved Host, no second socket DNS lookup, HTTPS DNS cancellation/body cap/redirect handling, private answers, opt-outs and Windows proxy parsing/bypass behavior.
+- `pnpm audit --prod --registry https://registry.npmjs.org`: no known vulnerabilities.
+- `node --check lib/client.js`: passed.
+- Exact npm tarball installed into a fresh consumer: 34/34 relevant regressions passed. The tarball contains the compiled networking modules and client entry.
+- Normal `buildRssTools` calls from that installation used production fetch/DNS without injection, the default 15-second timeout, no explicit `proxyUrl`, and `allowPrivateNetwork: false`.
+
+| Real source | Format / entries | Check | Add / fetch / search | Incremental after tools rebuilt from disk |
+| --- | --- | --- | --- | --- |
+| `https://sspai.com/feed` | RSS / 10 | Pass | Pass | 10 first, 0 repeated |
+| `https://blog.python.org/rss.xml` | RSS / 50 | Pass | Pass | 50 first, 0 repeated |
+| `https://www.nasa.gov/feed/` | RSS / 10 | Pass | Pass | 10 first, 0 repeated |
+| `https://github.com/deepseek-ai/deepseek-harness/releases.atom` | Atom / 10 | Pass | Pass | 10 first, 0 repeated |
+
+The old Python URL `https://blog.python.org/feeds/posts/default?alt=rss` also passed. It returned a valid RSS feed without an HTTP redirect in the earlier URL diagnostic.
+
+## Human browser operations
+
+An isolated, keyless profile loaded the fresh tarball installation in the official host. Through Settings → RSS subscriptions, all four public feeds were entered and saved using the visible form. Every card displayed its real entry count and a passing check. Clicking the GitHub Atom check button completed successfully. Adding `http://127.0.0.1/private-feed` was rejected, retained the typed form values and left the four subscriptions intact. No console errors were recorded. Screenshots and DOM snapshots were retained in the local validation directory. The temporary browser tab and test host closed after acceptance.
+
+This covers the shared browser settings surface and production networking. It does not constitute separate native desktop-window acceptance or live testing of other plugins.

package/docs/validation-language-2026-10-03.md

@@ -0,0 +1,16 @@
+# 0.5.2：中英文界面验收
+
+2026-10-03，Windows / Node 24.16.0。采用 E 盘独立 DSH_HOME、合成资料与无密钥 profile；用户资料、账号、密钥、桌面窗口与 VPN 保持原状。
+
+- 自动测试：107 项全部通过。
+- 可见 Web 操作：英文无效 OPML 显示可恢复说明；混合合法 / 非 HTTP 地址预览正确显示跳过原因，并只导入一条合成中文命名订阅。中文界面读取同一订阅，原名称保留；无效 OPML 中文提示保留。
+- 宿主：官方 DSH 0.2.1-alpha.1 Web；官方 RC2 与 alpha SDK 同载 18 组件，110 工具、35 插件技能、19 输出样例注册与 schema 检查通过。无账号的健康结果不代表真实连接。
+- 边界：导入本身不抓取文章。本轮语言补丁没有重复执行外部订阅网络矩阵，网络验收见之前版本记录。
+
+中英文共用同一份资料；界面翻译不会改写标题、正文、路径、引用或项目文件。系统文件选择控件和文件对话框跟随 Windows / 浏览器语言。未知技术诊断与原始引擎日志保留原文；英文界面提供操作恢复引导。
+
+此记录不代表原生桌面窗口内的新功能已逐项操作通过。发布包完整性、GitHub CI 与公开 npm 全新安装在发布时另行核对。
+
+## English scope
+
+The Chinese and English UI share the same data. UI translation preserves original content, paths and project files. Visible interactions were performed in an isolated official alpha Web profile; both RC2 and alpha SDK registration/schema checks passed. Native file controls use the OS/browser language, and original diagnostic logs are retained. Browser results do not certify native desktop interaction or real-service delivery.

package/lib/client.js

@@ -27,6 +27,19 @@ window.__ModuleLoader__.load({ id: 'dsh-rss', factory: require => {
     bodyLarge: ['文件超过 1 MiB，请拆分后导入。', 'File exceeds 1 MiB. Split it before importing.'], session: ['DSH 会话已失效，请重新打开 DSH 页面。', 'The DSH session has expired. Reopen the DSH page.'], fileError: ['无法读取文件，请重新选择或粘贴 OPML 文本。', 'Cannot read this file. Choose it again or paste OPML text.'],
   };
   const t = key => (words[key] || [key, key])[language === 'en' ? 1 : 0];
+
+  function feedError(message, code) {
+    if (language !== 'en' || !/[\u3400-\u9fff]/.test(message || '')) return message;
+    if (['conflict', 'duplicate', 'readonly', 'bodyLarge', 'session'].includes(code)) return t(code);
+    if (/HTTP/.test(message)) return 'Feed request failed. Check the URL, connection and proxy settings, then retry.';
+    if (/YAML|feedsYaml/.test(message)) return 'The feed configuration is invalid. Fix the feedsYaml list in settings before retrying.';
+    if (/OPML|outline|xmlUrl/.test(message)) return 'The OPML content is invalid. Export it again with xmlUrl attributes on feed outlines.';
+    if (/地址|URL|url|http|https|协议/.test(message)) return 'Enter a valid HTTP or HTTPS feed URL. Local and private-network addresses are not allowed.';
+    if (/写入|只读/.test(message)) return 'Could not save the feed configuration. Check write access and reload the list before retrying; your input is preserved.';
+    if (/未找到|找不到|没有找到/.test(message)) return 'No matching feed was found. Refresh the subscription list.';
+    return 'The feed could not be read. Check the URL, network and proxy settings, then retry.';
+  }
+
   const CSS = `
     .dshr{color:var(--dsw-alias-label-primary,#202737);font-size:14px;line-height:1.55;max-width:920px;min-width:0}
     .dshr *,.dshr-dialog *{box-sizing:border-box}.dshr h2{font-size:22px;margin:0 0 6px}.dshr p{margin:0 0 12px}
@@ -54,7 +67,7 @@ window.__ModuleLoader__.load({ id: 'dsh-rss', factory: require => {
     let value;
     try { value = await response.json(); } catch { throw new Error(response.status === 401 ? t('session') : t('loadError')); }
     if (!response.ok) {
-      const error = new Error(['conflict', 'duplicate', 'readonly'].includes(value.code) ? t(value.code) : value.error || t('loadError'));
+      const error = new Error(['conflict', 'duplicate', 'readonly'].includes(value.code) ? t(value.code) : feedError(value.error, value.code) || t('loadError'));
       error.snapshot = value.snapshot;
       throw error;
     }
@@ -151,7 +164,7 @@ window.__ModuleLoader__.load({ id: 'dsh-rss', factory: require => {
             h('span', { className: 'dshr-tag' }, feed.category || t('uncategorized')),
             h('div', { className: 'dshr-status' }, feed.check ? [
               new Date(feed.check.checkedAt).toLocaleString(language === 'en' ? 'en-US' : 'zh-CN'), ' · ',
-              feed.check.ok ? feed.check.entryCount + ' ' + t('entries') + ' · ' + t('checked') : t('failed') + '：' + feed.check.error,
+              feed.check.ok ? feed.check.entryCount + ' ' + t('entries') + ' · ' + t('checked') : t('failed') + (language === 'en' ? ': ' : '：') + feedError(feed.check.error),
             ] : t('pending'))),
           h('div', { className: 'dshr-actions' },
             h('button', { disabled: !!busy, onClick: () => run('check', { id: feed.id }, value => setNotice(t('checked') + ' · ' + value.check.entryCount + ' ' + t('entries'))) }, busy === feed.id ? t('saving') : t('check')),
@@ -178,7 +191,7 @@ window.__ModuleLoader__.load({ id: 'dsh-rss', factory: require => {
               (preview.duplicates || []).slice(0, 20).map((item, index) => h('li', { key: 'duplicate-' + index },
                 t('duplicates'), '：', item.before.name || item.url, ' · ', item.before.category || t('uncategorized'),
                 updateExisting ? ' → ' + (item.after.name || item.url) + ' · ' + (item.after.category || t('uncategorized')) : ' · ' + t('keep'))),
-              preview.skipped.slice(0, 20).map((item, index) => h('li', { key: index }, item.title, ' · ', item.url, '：', item.reason))),
+              preview.skipped.slice(0, 20).map((item, index) => h('li', { key: index }, item.title, ' · ', item.url, language === 'en' ? ': ' : '：', feedError(item.reason)))),
             preview.added.length > 20 || preview.skipped.length > 20 || (preview.duplicates || []).length > 20 ? h('p', { className: 'dshr-muted' }, t('previewLimit')) : null) : null,
           h('div', { className: 'dshr-buttons' }, h('button', { type: 'button', disabled: !!busy, onClick: close }, t('cancel')),
             h('button', { type: 'submit', disabled: !!busy || !opml.trim() }, t(busy === 'preview' ? 'saving' : 'preview')),
@@ -196,7 +209,11 @@ window.__ModuleLoader__.load({ id: 'dsh-rss', factory: require => {
       const style = document.createElement('style'); style.dataset.pluginCss = 'dsh-rss/client'; style.textContent = CSS; document.head.appendChild(style);
       return () => style.remove();
     }, 'dsh-rss: styles');
-    ctx.slots.inject('settings.section', () => ctx.slots.register({ name: 'settings.section', id: 'dsh-rss', order: 55, label: () => t('title'), inject: () => ({}) }, Panel));
+    ctx.slots.inject('settings.section', () => ctx.slots.register({ name: 'settings.section', id: 'dsh-rss', order: 55, label: () => {
+      let lang = language;
+      try { const service = ctx.get ? ctx.get('locale') : ctx.locale; if (service?.getSnapshot) lang = String(service.getSnapshot().active || '').startsWith('en') ? 'en' : 'zh'; } catch {}
+      return words.title[lang === 'en' ? 1 : 0];
+    }, inject: () => ({}) }, Panel));
   }
   return { apply, inject: ['slots', 'locale'] };
 } });

package/lib/config.d.ts

@@ -7,6 +7,8 @@
 /** 插件行配置（cordis.patch.yml 里的 config 段，可缺省）。 */
 export interface RssConfig {
     proxyUrl?: string;
+    useSystemProxy?: boolean;
+    fakeIpDnsFallback?: boolean;
     timeoutMs?: number;
     maxBodyBytes?: number;
     userAgent?: string;
@@ -18,6 +20,8 @@ export interface RssConfig {
 /** 解析后的配置：所有字段都有值。 */
 export interface ResolvedRssConfig {
     proxyUrl: string;
+    useSystemProxy: boolean;
+    fakeIpDnsFallback: boolean;
     timeoutMs: number;
     maxBodyBytes: number;
     userAgent: string;

package/lib/config.js

@@ -6,7 +6,7 @@
  */
 const DEFAULT_TIMEOUT_MS = 15000;
 const DEFAULT_MAX_BODY_BYTES = 5 * 1024 * 1024;
-const DEFAULT_USER_AGENT = 'dsh-rss/0.3.1 (DeepSeek Harness RSS plugin)';
+const DEFAULT_USER_AGENT = 'dsh-rss/0.5.1 (DeepSeek Harness RSS plugin)';
 function configRecord(config) {
     if (config === undefined || config === null)
         return {};
@@ -68,6 +68,8 @@ export function resolveConfig(config) {
         throw new Error('userAgent 不能为空字符串。');
     const feedsYaml = optionalString(cfg, 'feedsYaml') ?? '';
     const allowPrivateNetwork = optionalBoolean(cfg, 'allowPrivateNetwork', false);
+    const useSystemProxy = optionalBoolean(cfg, 'useSystemProxy', true);
+    const fakeIpDnsFallback = optionalBoolean(cfg, 'fakeIpDnsFallback', true);
     const opmlWriteApproval = optionalBoolean(cfg, 'opmlWriteApproval', true);
-    return { proxyUrl, timeoutMs, maxBodyBytes, userAgent, feedsYaml, allowPrivateNetwork, opmlWriteApproval };
+    return { proxyUrl, useSystemProxy, fakeIpDnsFallback, timeoutMs, maxBodyBytes, userAgent, feedsYaml, allowPrivateNetwork, opmlWriteApproval };
 }

package/lib/network.js

@@ -1,9 +1,12 @@
 /** RSS 网络边界：地址校验、重定向、响应大小与调用取消。 */
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
-import { createProxyFetch } from './proxy-fetch.js';
+import { createFeedTransport } from './proxy-fetch.js';
+import { lookupPublicDns } from './public-dns.js';
+import { readResponseText } from './response.js';
+import { readWindowsProxy, selectWindowsProxy } from './system-proxy.js';
 const MAX_REDIRECTS = 5;
-const PROXY_HINT = '。若该订阅源需要特殊代理（梯子）才能访问，请在 cordis.patch.yml 里给 dsh-rss 配置 proxyUrl（如 http://127.0.0.1:7890）后重启。';
+const PROXY_HINT = '。请检查网络与代理连接；也可在 dsh-rss 配置中指定 proxyUrl。';
 function parseHttpUrl(url) {
     let parsed;
     try {
@@ -101,7 +104,11 @@ async function lookupWithSignal(hostname, lookupImpl, signal) {
         });
     });
 }
-async function assertPublicUrl(url, cfg, lookupImpl, signal) {
+function isFakeIp(address) {
+    const bytes = ipv4Bytes(address);
+    return bytes !== null && bytes[0] === 198 && (bytes[1] === 18 || bytes[1] === 19);
+}
+async function resolvePublicUrl(url, cfg, lookupImpl, signal, fallbackLookup) {
     if (cfg.allowPrivateNetwork)
         return;
     const hostname = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
@@ -112,7 +119,7 @@ async function assertPublicUrl(url, cfg, lookupImpl, signal) {
         if (isBlockedNetworkAddress(hostname)) {
             throw new Error('出于安全原因，默认禁止访问回环、私网、链路本地或保留地址：' + hostname + '。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
         }
-        return;
+        return [{ address: hostname, family: isIP(hostname) }];
     }
     let addresses;
     try {
@@ -124,113 +131,91 @@ async function assertPublicUrl(url, cfg, lookupImpl, signal) {
     }
     if (addresses.length === 0)
         throw new Error('无法安全解析订阅源域名 ' + hostname + '：DNS 未返回地址。');
-    const blocked = addresses.find((entry) => isBlockedNetworkAddress(entry.address));
-    if (blocked !== undefined) {
-        const v4 = ipv4Bytes(blocked.address);
-        if (v4 !== null && v4[0] === 198 && (v4[1] === 18 || v4[1] === 19)) {
-            throw new Error('订阅源域名 ' + hostname + ' 被解析为保留地址 ' + blocked.address + '，可能是代理软件的 Fake-IP，已拒绝访问。请在代理 DNS 设置中让该域名返回真实 IP（如加入 fake-ip-filter），然后重试。无需开启内网访问。');
-        }
-        throw new Error('出于安全原因，域名 ' + hostname + ' 解析到了非公网地址 ' + blocked.address + '，已拒绝访问。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
+    const privateAddress = addresses.find(entry => isBlockedNetworkAddress(entry.address) && !isFakeIp(entry.address));
+    if (privateAddress !== undefined) {
+        throw new Error('出于安全原因，域名 ' + hostname + ' 解析到了非公网地址 ' + privateAddress.address + '，已拒绝访问。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
     }
-}
-/** 构造默认 fetch：配置了 proxyUrl 时走插件级代理。 */
-function makeFetch(cfg) {
-    if (cfg.proxyUrl === '')
-        return globalThis.fetch;
-    return createProxyFetch(cfg.proxyUrl);
-}
-/**
- * 抓取订阅源 XML：校验地址、限时、限制体积、剥 BOM。
- */
-async function readResponseText(response, maxBodyBytes, signal) {
-    signal.throwIfAborted();
-    const declaredLength = Number(response.headers.get('content-length'));
-    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
-        await response.body?.cancel('response body exceeds maxBodyBytes');
-        throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
-    }
-    if (response.body === null)
-        return '';
-    const reader = response.body.getReader();
-    const onAbort = () => { void reader.cancel(signal.reason).catch(() => { }); };
-    signal.addEventListener('abort', onAbort, { once: true });
-    const decoder = new TextDecoder('utf-8', { fatal: false });
-    let byteLength = 0;
-    let text = '';
-    try {
-        while (true) {
-            signal.throwIfAborted();
-            const chunk = await reader.read();
-            signal.throwIfAborted();
-            if (chunk.done)
-                break;
-            byteLength += chunk.value.byteLength;
-            if (byteLength > maxBodyBytes) {
-                await reader.cancel('response body exceeds maxBodyBytes');
-                throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
-            }
-            text += decoder.decode(chunk.value, { stream: true });
+    if (addresses.some(entry => isFakeIp(entry.address))) {
+        if (!cfg.fakeIpDnsFallback) {
+            throw new Error('无法安全解析订阅源域名 ' + hostname + '：检测到代理 Fake-IP。可启用 fakeIpDnsFallback 查询真实 IP 后重试，VPN 可以保持开启。');
         }
-        return text + decoder.decode();
+        addresses = await lookupWithSignal(hostname, fallbackLookup, signal);
+        if (addresses.length === 0)
+            throw new Error('无法安全解析订阅源域名 ' + hostname + '：HTTPS DNS 未返回地址。');
     }
-    finally {
-        signal.removeEventListener('abort', onAbort);
-        reader.releaseLock();
+    const blocked = addresses.find((entry) => isBlockedNetworkAddress(entry.address));
+    if (blocked !== undefined) {
+        throw new Error('出于安全原因，域名 ' + hostname + ' 解析到了非公网地址 ' + blocked.address + '，已拒绝访问。若确需访问可信内网源，请显式配置 allowPrivateNetwork: true。');
     }
+    return addresses;
 }
 export async function fetchFeedXml(url, cfg, exec, fetchImpl, lookupImpl = async (hostname) => await lookup(hostname, { all: true, verbatim: true })) {
     let currentUrl = parseHttpUrl(url);
-    const fetcher = fetchImpl ?? makeFetch(cfg);
     const signal = mergedSignal(cfg.timeoutMs, exec?.signal);
     let response;
+    let transport;
     try {
-        for (let redirectCount = 0;; redirectCount++) {
+        const systemProxy = fetchImpl === undefined && cfg.proxyUrl === '' && cfg.useSystemProxy
+            ? await readWindowsProxy(signal) : undefined;
+        const fallbackLookup = hostname => lookupPublicDns(hostname, signal, cfg.proxyUrl, systemProxy, fetchImpl);
+        const validate = (target) => resolvePublicUrl(target, cfg, lookupImpl, signal, fallbackLookup);
+        try {
+            for (let redirectCount = 0;; redirectCount++) {
+                signal.throwIfAborted();
+                const addresses = await validate(currentUrl);
+                transport = fetchImpl === undefined ? createFeedTransport(currentUrl, cfg.proxyUrl || selectWindowsProxy(systemProxy, currentUrl), addresses) : undefined;
+                response = await (fetchImpl ?? transport.fetch)(currentUrl.href, {
+                    headers: {
+                        'user-agent': cfg.userAgent,
+                        accept: 'application/rss+xml, application/atom+xml, application/xml, text/xml, */*',
+                    },
+                    redirect: 'manual',
+                    signal,
+                });
+                signal.throwIfAborted();
+                if (![301, 302, 303, 307, 308].includes(response.status))
+                    break;
+                const location = response.headers.get('location');
+                if (location === null)
+                    break;
+                await response.body?.cancel('following validated redirect');
+                await transport?.dispose();
+                transport = undefined;
+                if (redirectCount >= MAX_REDIRECTS)
+                    throw new Error('抓取失败：重定向次数超过 ' + MAX_REDIRECTS + ' 次上限。');
+                currentUrl = parseHttpUrl(new URL(location, currentUrl).href);
+            }
+        }
+        catch (error) {
             signal.throwIfAborted();
-            await assertPublicUrl(currentUrl, cfg, lookupImpl, signal);
-            response = await fetcher(currentUrl.href, {
-                headers: {
-                    'user-agent': cfg.userAgent,
-                    accept: 'application/rss+xml, application/atom+xml, application/xml, text/xml, */*',
-                },
-                redirect: 'manual',
-                signal,
-            });
+            if (error instanceof Error && (error.message.includes('出于安全原因') || error.message.includes('无法安全解析') || error.message.includes('重定向次数超过')))
+                throw error;
+            throw new Error('抓取失败：' + (error instanceof Error ? error.message : String(error)) + PROXY_HINT);
+        }
+        if (response === undefined)
+            throw new Error('抓取失败：未收到服务器响应。');
+        if (!response.ok) {
+            await response.body?.cancel('unsuccessful feed response');
+            throw new Error('抓取失败：服务器返回 HTTP ' + response.status + '。');
+        }
+        const reportedUrl = response.url === '' ? currentUrl : parseHttpUrl(response.url);
+        if (reportedUrl.href !== currentUrl.href)
+            await validate(reportedUrl);
+        let xml;
+        try {
+            xml = await readResponseText(response, cfg.maxBodyBytes, signal);
+        }
+        catch (error) {
             signal.throwIfAborted();
-            if (![301, 302, 303, 307, 308].includes(response.status))
-                break;
-            const location = response.headers.get('location');
-            if (location === null)
-                break;
-            await response.body?.cancel('following validated redirect');
-            if (redirectCount >= MAX_REDIRECTS)
-                throw new Error('抓取失败：重定向次数超过 ' + MAX_REDIRECTS + ' 次上限。');
-            currentUrl = parseHttpUrl(new URL(location, currentUrl).href);
+            if (error instanceof Error && error.message.includes('字节上限'))
+                throw error;
+            throw new Error('读取订阅源内容失败：' + (error instanceof Error ? error.message : String(error)));
         }
+        xml = xml.replace(/^\uFEFF/, '');
+        return { xml, finalUrl: reportedUrl.href };
     }
-    catch (error) {
-        signal.throwIfAborted();
-        if (error instanceof Error && (error.message.includes('出于安全原因') || error.message.includes('无法安全解析') || error.message.includes('重定向次数超过')))
-            throw error;
-        throw new Error('抓取失败：' + (error instanceof Error ? error.message : String(error)) + PROXY_HINT);
-    }
-    if (response === undefined)
-        throw new Error('抓取失败：未收到服务器响应。');
-    if (!response.ok) {
-        await response.body?.cancel('unsuccessful feed response');
-        throw new Error('抓取失败：服务器返回 HTTP ' + response.status + '。');
-    }
-    const reportedUrl = response.url === '' ? currentUrl : parseHttpUrl(response.url);
-    await assertPublicUrl(reportedUrl, cfg, lookupImpl, signal);
-    let xml;
-    try {
-        xml = await readResponseText(response, cfg.maxBodyBytes, signal);
-    }
-    catch (error) {
-        signal.throwIfAborted();
-        if (error instanceof Error && error.message.includes('字节上限'))
-            throw error;
-        throw new Error('读取订阅源内容失败：' + (error instanceof Error ? error.message : String(error)));
+    finally {
+        await response?.body?.cancel().catch(() => { });
+        await transport?.dispose();
     }
-    xml = xml.replace(/^\uFEFF/, '');
-    return { xml, finalUrl: reportedUrl.href };
 }

package/lib/proxy-fetch.d.ts

@@ -1,3 +1,9 @@
+import type { FetchLike, DnsLookupLike } from './network.js';
+/** One request/redirect hop owns its dispatcher until its body has been read. */
+export declare function createFeedTransport(url: URL, proxyUrl: string, addresses?: Awaited<ReturnType<DnsLookupLike>>): {
+    fetch: FetchLike;
+    dispose: () => Promise<void>;
+};
 /**
  * 构造一个把所有请求路由到 proxyUrl 的 fetch。
  * @param proxyUrl - 如 http://127.0.0.1:7890

package/lib/proxy-fetch.js

@@ -1,7 +1,48 @@
 /**
  * 插件级 HTTP 代理：给 RSS 抓取请求一个走指定代理的 fetch，不影响同进程其他插件。
  */
-import { ProxyAgent, fetch as undiciFetch } from 'undici';
+import { Agent, Client, ProxyAgent, fetch as undiciFetch } from 'undici';
+import { isIP } from 'node:net';
+/** One request/redirect hop owns its dispatcher until its body has been read. */
+export function createFeedTransport(url, proxyUrl, addresses) {
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    const servername = isIP(hostname) === 0 ? hostname : undefined;
+    const dispatcher = proxyUrl === ''
+        ? new Agent({ connect: addresses === undefined ? {} : {
+                lookup: (name, options, callback) => {
+                    if (name !== hostname) {
+                        callback(new Error('Unexpected RSS connection hostname'), '', 4);
+                        return;
+                    }
+                    const candidates = addresses.filter(entry => !options.family || entry.family === options.family);
+                    if (candidates.length === 0) {
+                        callback(new Error('No validated RSS address for this family'), '', 4);
+                        return;
+                    }
+                    if (options.all)
+                        callback(null, [...candidates]);
+                    else
+                        callback(null, candidates[0].address, candidates[0].family);
+                },
+            } })
+        : new ProxyAgent({ uri: proxyUrl, proxyTunnel: true, requestTls: { servername },
+            factory: (origin, options) => {
+                const delegate = options.connect;
+                if (addresses === undefined || typeof delegate !== 'function')
+                    return new Client(origin, options);
+                return new Client(origin, { ...options, connect: (socketOptions, callback) => {
+                        const address = addresses[0].address;
+                        const port = socketOptions.port || (url.protocol === 'https:' ? '443' : '80');
+                        const host = (isIP(address) === 6 ? '[' + address + ']' : address) + ':' + port;
+                        delegate({ ...socketOptions, hostname: address, host, port, servername }, callback);
+                    } });
+            },
+        });
+    return {
+        fetch: async (input, init) => await undiciFetch(input, { ...init, redirect: 'manual', dispatcher }),
+        dispose: async () => { await dispatcher.destroy(); },
+    };
+}
 /**
  * 构造一个把所有请求路由到 proxyUrl 的 fetch。
  * @param proxyUrl - 如 http://127.0.0.1:7890

package/lib/public-dns.d.ts

@@ -0,0 +1,3 @@
+import type { FetchLike, DnsLookupLike } from './network.js';
+import { type SystemProxy } from './system-proxy.js';
+export declare function lookupPublicDns(hostname: string, signal: AbortSignal, proxyUrl: string, systemProxy?: SystemProxy, fetchImpl?: FetchLike): Promise<Awaited<ReturnType<DnsLookupLike>>>;

package/lib/public-dns.js

@@ -0,0 +1,49 @@
+/** HTTPS DNS is used only when the OS returns a VPN's 198.18/15 Fake-IP. */
+import { isIP } from 'node:net';
+import { createFeedTransport } from './proxy-fetch.js';
+import { readResponseText } from './response.js';
+import { selectWindowsProxy } from './system-proxy.js';
+const PROVIDERS = ['https://cloudflare-dns.com/dns-query', 'https://dns.google/resolve'];
+export async function lookupPublicDns(hostname, signal, proxyUrl, systemProxy, fetchImpl) {
+    let lastError;
+    for (const provider of PROVIDERS) {
+        try {
+            for (const family of [4, 6]) {
+                signal.throwIfAborted();
+                const url = new URL(provider);
+                url.searchParams.set('name', hostname);
+                url.searchParams.set('type', family === 4 ? 'A' : 'AAAA');
+                const transport = fetchImpl === undefined ? createFeedTransport(url, proxyUrl || selectWindowsProxy(systemProxy, url)) : undefined;
+                let response;
+                try {
+                    response = await (fetchImpl ?? transport.fetch)(url.href, { redirect: 'manual', signal, headers: { accept: 'application/dns-json' } });
+                    if (!response.ok)
+                        throw new Error('HTTPS DNS 返回 HTTP ' + response.status);
+                    const value = JSON.parse(await readResponseText(response, 64 * 1024, signal));
+                    if (value.Status !== 0 || value.TC === true)
+                        throw new Error('HTTPS DNS 未返回完整有效的解析结果');
+                    const records = value.Answer ?? [];
+                    if (!Array.isArray(records))
+                        throw new Error('HTTPS DNS 解析结果格式无效');
+                    const answers = records.filter(record => record.type === (family === 4 ? 1 : 28)).map(record => {
+                        if (typeof record.data !== 'string' || isIP(record.data) !== family)
+                            throw new Error('HTTPS DNS 返回无效 IP 地址');
+                        return { address: record.data, family };
+                    });
+                    if (answers.length > 0)
+                        return answers;
+                }
+                finally {
+                    await response?.body?.cancel().catch(() => { });
+                    await transport?.dispose();
+                }
+            }
+            throw new Error('HTTPS DNS 未返回地址');
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            lastError = error;
+        }
+    }
+    throw new Error('无法安全解析订阅源域名 ' + hostname + ' 的真实 IP：' + (lastError instanceof Error ? lastError.message : String(lastError)) + '。VPN 可以保持开启，请检查代理连接。');
+}

package/lib/response.d.ts

@@ -0,0 +1,2 @@
+/** Read a bounded response while retaining the caller's cancellation reason. */
+export declare function readResponseText(response: Response, maxBodyBytes: number, signal: AbortSignal): Promise<string>;

package/lib/response.js

@@ -0,0 +1,37 @@
+/** Read a bounded response while retaining the caller's cancellation reason. */
+export async function readResponseText(response, maxBodyBytes, signal) {
+    signal.throwIfAborted();
+    const declaredLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        await response.body?.cancel('response body exceeds maxBodyBytes');
+        throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
+    }
+    if (response.body === null)
+        return '';
+    const reader = response.body.getReader();
+    const onAbort = () => { void reader.cancel(signal.reason).catch(() => { }); };
+    signal.addEventListener('abort', onAbort, { once: true });
+    const decoder = new TextDecoder('utf-8', { fatal: false });
+    let byteLength = 0;
+    let text = '';
+    try {
+        while (true) {
+            signal.throwIfAborted();
+            const chunk = await reader.read();
+            signal.throwIfAborted();
+            if (chunk.done)
+                break;
+            byteLength += chunk.value.byteLength;
+            if (byteLength > maxBodyBytes) {
+                await reader.cancel('response body exceeds maxBodyBytes');
+                throw new Error('订阅源内容超过 ' + maxBodyBytes + ' 字节上限，已停止读取。');
+            }
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        return text + decoder.decode();
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+        reader.releaseLock();
+    }
+}

package/lib/settings.d.ts

@@ -5,6 +5,8 @@ export declare const Config: modern<Schemastery.ObjectS<NoInfer<{
     proxyUrl: modern<string, string, "plain">;
     timeoutMs: modern<number, number, "plain">;
     maxBodyBytes: modern<number, number, "plain">;
+    useSystemProxy: modern<boolean, boolean, "plain">;
+    fakeIpDnsFallback: modern<boolean, boolean, "plain">;
     userAgent: modern<string, string, "plain">;
     allowPrivateNetwork: modern<boolean, boolean, "plain">;
     opmlWriteApproval: modern<boolean, boolean, "plain">;
@@ -15,6 +17,8 @@ export declare const Config: modern<Schemastery.ObjectS<NoInfer<{
     proxyUrl: modern<string, string, "plain">;
     timeoutMs: modern<number, number, "plain">;
     maxBodyBytes: modern<number, number, "plain">;
+    useSystemProxy: modern<boolean, boolean, "plain">;
+    fakeIpDnsFallback: modern<boolean, boolean, "plain">;
     userAgent: modern<string, string, "plain">;
     allowPrivateNetwork: modern<boolean, boolean, "plain">;
     opmlWriteApproval: modern<boolean, boolean, "plain">;

package/lib/settings.js

@@ -8,6 +8,7 @@ import modern from '@deepseek-ai/schemastery';
 export const Config = modern.object({
     feedsYaml: modern.string().volatile(), cursorsJson: modern.string().volatile(),
     proxyUrl: modern.string(), timeoutMs: modern.number(), maxBodyBytes: modern.number(),
+    useSystemProxy: modern.boolean(), fakeIpDnsFallback: modern.boolean(),
     userAgent: modern.string(), allowPrivateNetwork: modern.boolean(), opmlWriteApproval: modern.boolean(),
     legacySettingsImported: modern.boolean().volatile(),
 });

package/lib/system-proxy.d.ts

@@ -0,0 +1,7 @@
+export interface SystemProxy {
+    server: string;
+    bypass: string;
+}
+export declare function parseWindowsProxy(output: string): SystemProxy | undefined;
+export declare function selectWindowsProxy(proxy: SystemProxy | undefined, url: URL): string;
+export declare function readWindowsProxy(signal: AbortSignal): Promise<SystemProxy | undefined>;