dsh-rss 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -1,9 +1,18 @@
 # 更新记录
 
+## 0.6.2 (2026-10-15)
+
+- 加固直连、HTTP CONNECT 与 TLS 握手的套接字错误隔离，抓取结束会销毁本次请求仍持有的连接，避免错误在请求结束后逃逸。
+- 更新 Undici 至 8.12.1；新增独立进程的直连失败、代理 TLS 失败和超时取消回归检查。
+
 [返回简介](README.md) · [使用说明](docs/USAGE.md) · [验证记录](docs/VALIDATION.md)
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.6.1 (2026-10-05)
+
+- 增量抓取只消费本次返回的条目，剩余条目可继续分页；并发抓取串行合并游标，避免覆盖其他订阅进度。OPML 限制大小与嵌套深度。
+
 ## 0.6.0 (2026-10-04)
 
 - 新增推荐订阅目录：16 个网站原生 RSS/Atom，提供五类主题、关键词与内容语言筛选、近期文章预览、可用性检查和「已订阅」状态。浏览目录不会自动订阅或抓取全部来源。

package/README.en.md

@@ -6,7 +6,9 @@
 
 Subscribe to and read RSS or Atom feeds, and manage updates from DSH.
 
-[![npm](https://img.shields.io/npm/v/dsh-rss)](https://www.npmjs.com/package/dsh-rss) [![downloads](https://img.shields.io/npm/dm/dsh-rss)](https://www.npmjs.com/package/dsh-rss)
+[![npm](https://img.shields.io/npm/v/dsh-rss)](https://www.npmjs.com/package/dsh-rss) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-rss-downloads.svg)](https://www.npmjs.com/package/dsh-rss)
+
+Feedback and contributions are welcome: report [issues](https://github.com/STARDUSTLC666/dsh-rss/issues) or submit [pull requests](https://github.com/STARDUSTLC666/dsh-rss/pulls).
 
 ## What it does
 

package/README.md

@@ -6,7 +6,9 @@
 
 订阅和阅读 RSS / Atom，在 DSH 中查看与管理更新。
 
-[![npm](https://img.shields.io/npm/v/dsh-rss)](https://www.npmjs.com/package/dsh-rss) [![downloads](https://img.shields.io/npm/dm/dsh-rss)](https://www.npmjs.com/package/dsh-rss)
+[![npm](https://img.shields.io/npm/v/dsh-rss)](https://www.npmjs.com/package/dsh-rss) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-rss-downloads.svg)](https://www.npmjs.com/package/dsh-rss)
+
+欢迎使用，遇到问题或有改进建议，请提交 [issues](https://github.com/STARDUSTLC666/dsh-rss/issues) 和 [PR](https://github.com/STARDUSTLC666/dsh-rss/pulls)。
 
 ## 功能
 

package/docs/CHANGELOG.en.md

@@ -4,6 +4,10 @@
 
 These English notes preserve the earlier translations. The main changelog contains the consolidated version history.
 
+## 0.6.1 (2026-10-05)
+
+- Consume only returned entries during incremental fetches; remaining entries stay available. Serialize cursor updates to preserve concurrent progress. Bound OPML size and nesting.
+
 ## 0.5.1 (2026-10-02)
 
 Fixes public feeds being rejected when a VPN returns Fake-IP DNS addresses. Windows uses the enabled manual system proxy by default. For `198.18.0.0/15` answers, HTTPS DNS obtains real public addresses; connections are pinned to validated addresses while preserving the original hostname and TLS certificate verification. Keep the VPN enabled without changing its configuration or allowing private networks. Request-owned connections are released after redirects, errors or body reads.

package/docs/USAGE.en.md

@@ -2,6 +2,10 @@
 
 [Overview](../README.en.md) · [Changelog](../CHANGELOG.md) · [Validation](VALIDATION.md)
 
+## Current improvements
+
+Repeat rss_fetch with incremental=true and a limit to consume remaining new entries; remaining reports the pending count. Each feed retains up to 5000 deduplication IDs rather than a permanent article archive. OPML is limited to 1 MiB and 64 nesting levels.
+
 ## Installation
 
 ```bash

package/docs/USAGE.md

@@ -2,6 +2,10 @@
 
 [返回简介](../README.md) · [更新记录](../CHANGELOG.md) · [验证记录](VALIDATION.md)
 
+## 本次改进
+
+rss_fetch { incremental: true, limit: 20 } 可重复调用取得余下新条目；remaining 表示本次剩余数量。每源最多保留 5000 个去重 ID，不是永久文章归档。OPML 文本最多 1 MiB、嵌套最多 64 层。
+
 ## 安装
 
 ```bash

package/lib/opml.js

@@ -43,6 +43,8 @@ export function parseOpml(text) {
     const trimmed = (text ?? '').trim();
     if (trimmed === '')
         throw new Error('OPML 内容为空，请提供 OPML XML 文本。');
+    if (Buffer.byteLength(trimmed, 'utf8') > 1024 * 1024)
+        throw new Error('OPML 内容超过 1 MiB，请拆分后导入。');
     const validation = XMLValidator.validate(trimmed);
     if (validation !== true)
         throw new Error('OPML 解析失败：第 ' + validation.err.line + ' 行，' + validation.err.msg);
@@ -60,7 +62,9 @@ export function parseOpml(text) {
     const head = asRecord(opml.head);
     const body = asRecord(opml.body);
     const outlines = [];
-    const walk = (node, inheritedCategory) => {
+    const walk = (node, inheritedCategory, depth = 0) => {
+        if (depth > 64)
+            throw new Error('OPML 分类嵌套超过 64 层，请简化分类后导入。');
         const rec = asRecord(node);
         const xmlUrl = attr(rec, '@_xmlUrl') || attr(rec, '@_xmlurl');
         const text = attr(rec, '@_text') || attr(rec, '@_title') || firstText(rec);
@@ -77,7 +81,7 @@ export function parseOpml(text) {
         const children = Array.isArray(rawChildren) ? rawChildren : (rawChildren === undefined || rawChildren === null ? [] : [rawChildren]);
         const nextCategory = text !== '' ? text : inheritedCategory;
         for (const child of children)
-            walk(child, nextCategory);
+            walk(child, nextCategory, depth + 1);
     };
     const rawBodyOutlines = body.outline;
     const bodyOutlines = Array.isArray(rawBodyOutlines) ? rawBodyOutlines : (rawBodyOutlines === undefined || rawBodyOutlines === null ? [] : [rawBodyOutlines]);

package/lib/proxy-fetch.js

@@ -1,14 +1,39 @@
 /**
  * 插件级 HTTP 代理：给 RSS 抓取请求一个走指定代理的 fetch，不影响同进程其他插件。
  */
-import { Agent, Client, ProxyAgent, fetch as undiciFetch } from 'undici';
+import { Agent, Client, ProxyAgent, buildConnector, fetch as undiciFetch } from 'undici';
 import { isIP } from 'node:net';
 /** One request/redirect hop owns its dispatcher until its body has been read. */
 export function createFeedTransport(url, proxyUrl, addresses) {
     const hostname = url.hostname.replace(/^\[|\]$/g, '');
     const servername = isIP(hostname) === 0 ? hostname : undefined;
+    const sockets = new Set();
+    const onLateError = () => { };
+    function watch(socket) {
+        // CONNECT detaches the HTTP client's listeners before handing over its socket.
+        // Reattach after handover as well as immediately after socket construction.
+        if (!socket.listeners('error').includes(onLateError))
+            socket.on('error', onLateError);
+        if (!sockets.has(socket)) {
+            sockets.add(socket);
+            socket.once('close', () => sockets.delete(socket));
+        }
+        return socket;
+    }
+    function guarded(connect) {
+        return (options, callback) => {
+            const socket = connect(options, (error, connected) => {
+                if (error !== null)
+                    callback(error, null);
+                else
+                    callback(null, watch(connected));
+            });
+            if (socket !== undefined)
+                watch(socket);
+        };
+    }
     const dispatcher = proxyUrl === ''
-        ? new Agent({ connect: addresses === undefined ? {} : {
+        ? new Agent({ connect: guarded(buildConnector(addresses === undefined ? {} : {
                 lookup: (name, options, callback) => {
                     if (name !== hostname) {
                         callback(new Error('Unexpected RSS connection hostname'), '', 4);
@@ -24,23 +49,47 @@ export function createFeedTransport(url, proxyUrl, addresses) {
                     else
                         callback(null, candidates[0].address, candidates[0].family);
                 },
-            } })
+            })) })
         : new ProxyAgent({ uri: proxyUrl, proxyTunnel: true, requestTls: { servername },
+            clientFactory: (origin, rawOptions) => {
+                const options = rawOptions;
+                const connect = typeof options.connect === 'function' ? options.connect : buildConnector(options.connect ?? {});
+                return new Client(origin, { ...options, connect: guarded(connect) });
+            },
             factory: (origin, options) => {
                 const delegate = options.connect;
-                if (addresses === undefined || typeof delegate !== 'function')
-                    return new Client(origin, options);
+                if (typeof delegate !== 'function')
+                    throw new Error('RSS proxy did not supply a tunnel connector');
+                const endpoint = guarded(buildConnector({ servername }));
                 return new Client(origin, { ...options, connect: (socketOptions, callback) => {
-                        const address = addresses[0].address;
+                        const address = addresses?.[0]?.address ?? hostname;
                         const port = socketOptions.port || (url.protocol === 'https:' ? '443' : '80');
                         const host = (isIP(address) === 6 ? '[' + address + ']' : address) + ':' + port;
-                        delegate({ ...socketOptions, hostname: address, host, port, servername }, callback);
+                        // Ask ProxyAgent for a raw CONNECT tunnel, then own the TLS socket too.
+                        // A callback around the final TLS socket alone misses handshake errors.
+                        delegate({ ...socketOptions, protocol: 'http:', hostname: address, host, port, servername }, (error, tunnel) => {
+                            if (error !== null) {
+                                callback(error, null);
+                                return;
+                            }
+                            watch(tunnel);
+                            if (url.protocol !== 'https:') {
+                                callback(null, tunnel);
+                                return;
+                            }
+                            endpoint({ ...socketOptions, hostname: address, host, port, servername, httpSocket: tunnel }, callback);
+                        });
                     } });
             },
         });
     return {
         fetch: async (input, init) => await undiciFetch(input, { ...init, redirect: 'manual', dispatcher }),
-        dispose: async () => { await dispatcher.destroy(); },
+        dispose: async () => {
+            for (const socket of sockets)
+                socket.destroy();
+            await dispatcher.destroy();
+            sockets.clear();
+        },
     };
 }
 /**

package/lib/tools.js

@@ -249,7 +249,8 @@ function renderOpmlImport(_args, value) {
     }
     return [{ type: 'text', text: lines.join('\n') }];
 }
-const CURSOR_GUID_LIMIT = 200;
+const CURSOR_GUID_LIMIT = 5000;
+const cursorWrites = new WeakMap();
 /** 条目唯一 id：优先 guid，退回 link，再退回 标题|发布时间。 */
 function entryId(entry) {
     const rec = asRecord(entry);
@@ -519,12 +520,24 @@ export function buildRssTools(config, settingsScope, fetchImpl, lookupImpl) {
                 const entries = parsed.entries.slice(0, limit);
                 return { url: finalUrl, feed: parsed.feed, entries, truncated: parsed.entries.length > limit };
             }
-            const cursors = parseCursors(readCursorsJson());
-            const fresh = filterNewEntries(cursors[url], parsed.entries);
-            cursors[url] = advanceCursor(cursors[url], parsed.entries, new Date().toISOString());
-            await persistCursors(cursors);
-            const entries = fresh.slice(0, limit);
-            return { url: finalUrl, feed: parsed.feed, entries, truncated: fresh.length > limit, incremental: true, newCount: fresh.length };
+            const requestedUrl = url;
+            const task = (cursorWrites.get(settingsScope) ?? Promise.resolve()).catch(() => { }).then(async () => {
+                exec?.signal.throwIfAborted();
+                const cursors = parseCursors(readCursorsJson());
+                const fresh = filterNewEntries(cursors[requestedUrl], parsed.entries);
+                const entries = fresh.slice(0, limit);
+                cursors[requestedUrl] = advanceCursor(cursors[requestedUrl], entries, new Date().toISOString());
+                await persistCursors(cursors);
+                return { url: finalUrl, feed: parsed.feed, entries, truncated: fresh.length > limit, incremental: true, newCount: fresh.length, remaining: fresh.length - entries.length };
+            });
+            cursorWrites.set(settingsScope, task);
+            try {
+                return await task;
+            }
+            finally {
+                if (cursorWrites.get(settingsScope) === task)
+                    cursorWrites.delete(settingsScope);
+            }
         },
         timeoutMs: cfg.timeoutMs,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rss",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "订阅和阅读 RSS / Atom，在 DSH 中查看与管理更新。",
   "type": "module",
   "main": "lib/index.js",
@@ -55,7 +55,7 @@
     "@deepseek-ai/schemastery": "^3.18.3",
     "fast-xml-parser": "^5.0.0",
     "schemastery": "^3.18.0",
-    "undici": "^8.11.2",
+    "undici": "^8.12.1",
     "yaml": "^2.9.0"
   },
   "devDependencies": {