dsh-search-plugin 0.2.0 → 0.2.2

package/README.md

@@ -12,20 +12,21 @@ web_fetch  → ctx.web → search-http → 官方 HttpFetchProvider + CIDR resol
 ```sh
 pnpm install
 pnpm check
-dsh plugin --profile <name> add ./dsh-search-plugin
+dsh plugin --profile <name> add dsh-search-plugin
 ```
 
-本地 checkout 安装需要保留目录及构建产物。更新已经安装的包后需要重启 DSH profile，再刷新网页。仅构建本仓库不会更新已经运行的 GUI。bundle 选择 `searchProvider: codex`、`fetchProvider: search-http`，标准 base 需已有 web 服务与工具消费者；旧 `http` provider 保留，其配置不被修改，但默认路由改由本插件接管。
+通过 npm 发布版本安装和更新；修复不直接覆盖本机已安装插件。更新已经安装的包后需要重启 DSH profile，再刷新网页。仅构建本仓库不会更新已经运行的 GUI。bundle 选择 `searchProvider: codex`、`fetchProvider: search-http`，标准 base 需已有 web 服务与工具消费者；旧 `http` provider 保留，其配置不被修改，但默认路由改由本插件接管。
 
 ## 配置 UI
 
-进入 **插件 → 联网搜索 → 配置**，或组件行的配置页面。
+进入 **插件 → 联网搜索 → 配置**。仅保留插件包这一处配置入口，内部组件行不重复提供相同表单。
 
 - 搜索协议选择器动态显示对应协议字段；切换协议保留各自配置，保存后下一次操作生效。
 - Alpha 可复用 OpenAI provider，或使用独立端点与凭据。仅 Alpha 显示超时、响应和答案上限。
 - DeepSeek 显示 API 基础地址、独立凭据引用和结果数量；使用官方 Search API 实现和传输限制。
-- 网页抓取独立分组：CIDR 多行授权、超时与正文限制。可将常见代理网段填入草稿，再保存生效。
-- 保存使用官方 ConfigForms 与 revision 冲突检查，支持放弃编辑、重置覆盖、只读与失败提示。
+- 搜索与网页抓取使用独立表单，各自管理草稿、校验、保存、放弃编辑和重置覆盖；操作只修改所属字段。
+- 网页抓取配置包含 CIDR 多行授权、超时与正文限制。按实际网络环境手动填写 CIDR，不提供预设网段按钮。
+- 保存使用官方 ConfigForms 与 revision 冲突检查，支持只读与失败提示。
 - 密钥走官方 Credentials API 单独保存、删除和刷新状态；不回显、不放入公开配置和浏览器持久存储。删除托管值后，环境变量等其他来源仍可能提供同名凭据。
 
 ## 搜索配置

package/lib/cidr.js

@@ -0,0 +1,36 @@
+/** Schemastery serializes this function for browser forms. Keep it closure-free. */
+export function validateCidr(rule) {
+    const [address, prefixText, ...extra] = rule.trim().split('/');
+    if (!address || !prefixText || extra.length || !/^(0|[1-9]\d*)$/.test(prefixText)) {
+        throw new Error(`Invalid CIDR: ${JSON.stringify(rule)}`);
+    }
+    let bytes;
+    if (address.includes(':')) {
+        if (!/^[\da-f:.]+$/i.test(address))
+            throw new Error(`Invalid IPv6 CIDR: ${JSON.stringify(rule)}`);
+        // URL uses the same IPv6 parser in Node and browsers, including embedded IPv4.
+        const normalized = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+        const halves = normalized.split('::').map(part => part ? part.split(':') : []);
+        const groups = halves.length === 1 ? halves[0] : [...halves[0], ...Array(8 - halves[0].length - halves[1].length).fill('0'), ...halves[1]];
+        bytes = groups.flatMap(group => { const n = parseInt(group, 16); return [n >>> 8, n & 255]; });
+    }
+    else {
+        const parts = address.split('.');
+        if (parts.length !== 4 || parts.some(part => !/^(0|[1-9]\d{0,2})$/.test(part) || Number(part) > 255)) {
+            throw new Error(`Invalid IPv4 CIDR: ${JSON.stringify(rule)}`);
+        }
+        bytes = parts.map(Number);
+    }
+    const prefix = Number(prefixText);
+    if (prefix > bytes.length * 8)
+        throw new Error(`Invalid CIDR prefix: ${JSON.stringify(rule)}`);
+    if (bytes.some((byte, i) => (byte & (255 >>> Math.max(0, Math.min(8, prefix - i * 8)))) !== 0)) {
+        throw new Error(`CIDR must use its network base: ${JSON.stringify(rule)}`);
+    }
+    const embeddedV4 = bytes.length === 16 && bytes.slice(0, 10).every(b => b === 0)
+        && ((bytes[10] === 255 && bytes[11] === 255) || (bytes[10] === 0 && bytes[11] === 0));
+    if (embeddedV4 && bytes.some(Boolean) && !(bytes.slice(0, 15).every(b => b === 0) && bytes[15] === 1)) {
+        throw new Error(`Use an IPv4 CIDR for IPv4-mapped or compatible addresses: ${JSON.stringify(rule)}`);
+    }
+    return rule;
+}

package/lib/client.js

@@ -30,14 +30,12 @@ module.exports = __toCommonJS(index_exports);
 // src/client/SearchConfig.tsx
 var import_react = require("react");
 var import_jsx_runtime = require("react/jsx-runtime");
-var defaults = { protocol: "codex-alpha", authMode: "openai", openaiProvider: "openai", credentialRef: "DSH_CODEX_API_KEY", endpoint: "", timeoutMs: "60000", maxResponseBytes: "2000000", maxAnswerChars: "16000", deepseekEndpoint: "https://api.deepseek.com/v1/tools", deepseekCredentialRef: "DEEPSEEK_API_KEY", deepseekCount: "10", fetchAllowedCidrs: "", fetchTimeoutMs: "30000", fetchMaxResponseBytes: "5000000", fetchMaxContentChars: "100000" };
+var defaults = { protocol: "codex-alpha", authMode: "openai", openaiProvider: "openai", credentialRef: "DSH_CODEX_API_KEY", endpoint: "", timeoutMs: "60000", maxResponseBytes: "2000000", maxAnswerChars: "16000", deepseekEndpoint: "https://api.deepseek.com/v1/tools", deepseekCredentialRef: "DEEPSEEK_API_KEY", deepseekCount: "10" };
 var fields = Object.keys(defaults);
 var alphaLimits = ["timeoutMs", "maxResponseBytes", "maxAnswerChars"];
-var fetchLimits = ["fetchTimeoutMs", "fetchMaxResponseBytes", "fetchMaxContentChars"];
-var numeric = /* @__PURE__ */ new Set([...alphaLimits, ...fetchLimits, "deepseekCount"]);
-var cidrsOf = (text) => text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+var numeric = /* @__PURE__ */ new Set([...alphaLimits, "deepseekCount"]);
 function valuesOf(value) {
-  return Object.fromEntries(fields.map((field) => [field, field === "fetchAllowedCidrs" ? value[field]?.join("\n") ?? "" : String(value[field] ?? defaults[field])]));
+  return Object.fromEntries(fields.map((field) => [field, String(value[field] ?? defaults[field])]));
 }
 function validEndpoint(value) {
   try {
@@ -88,7 +86,7 @@ function SearchConfig(props) {
       return;
     }
     if (!reset) {
-      const activeNumeric = [...fetchLimits, ...deepseek ? ["deepseekCount"] : alphaLimits];
+      const activeNumeric = deepseek ? ["deepseekCount"] : alphaLimits;
       let valid = activeNumeric.every((field) => Number.isSafeInteger(Number(values[field])) && Number(values[field]) > 0);
       valid &&= deepseek ? Number(values.deepseekCount) <= 50 && validRef && validEndpoint(values.deepseekEndpoint) : independent ? validRef && validEndpoint(values.endpoint) : Boolean(values.openaiProvider.trim());
       if (!valid) {
@@ -96,7 +94,7 @@ function SearchConfig(props) {
         return;
       }
     }
-    const ops = reset ? fields.map((field) => ({ op: "unset", path: [field] })) : fields.filter((field) => values[field] !== accepted[field]).map((field) => ({ op: "set", path: [field], value: numeric.has(field) ? Number(values[field]) : field === "fetchAllowedCidrs" ? cidrsOf(values[field]) : values[field] }));
+    const ops = reset ? fields.map((field) => ({ op: "unset", path: [field] })) : fields.filter((field) => values[field] !== accepted[field]).map((field) => ({ op: "set", path: [field], value: numeric.has(field) ? Number(values[field]) : values[field] }));
     setBusy(true);
     setMessage(null);
     try {
@@ -130,7 +128,7 @@ function SearchConfig(props) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { name: field, type: numeric.has(field) ? "number" : "text", min: numeric.has(field) ? 1 : void 0, max: field === "deepseekCount" ? 50 : void 0, step: numeric.has(field) ? 1 : void 0, value: values[field], onChange: (event) => edit(field, event.target.value), disabled: field === refField && keyBusy })
   ] }, field);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dsh-search-config", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: (event) => {
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { "aria-label": t("searchSettings"), onSubmit: (event) => {
       event.preventDefault();
       void save(false);
     }, children: [
@@ -158,16 +156,6 @@ function SearchConfig(props) {
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("legend", { children: t("searchLimits") }),
         alphaLimits.map(input)
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("fieldset", { disabled, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("legend", { children: t("fetchSettings") }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dsh-search-wide", children: [
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("fetchAllowedCidrs") }),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("textarea", { name: "fetchAllowedCidrs", rows: 4, value: values.fetchAllowedCidrs, onChange: (event) => edit("fetchAllowedCidrs", event.target.value), "aria-describedby": "dsh-search-cidr-hint" })
-        ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { id: "dsh-search-cidr-hint", className: "dsh-search-hint dsh-search-wide", children: t("cidrHint") }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "dsh-search-wide", onClick: () => edit("fetchAllowedCidrs", [.../* @__PURE__ */ new Set([...cidrsOf(values.fetchAllowedCidrs), "198.18.0.0/15", "192.168.96.0/20"])].join("\n")), children: t("cidrPreset") }),
-        fetchLimits.map(input)
-      ] }),
       !state.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t("readOnly") }),
       conflict && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", children: t("conflict") }),
       message && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t(message) }),
@@ -216,6 +204,95 @@ function SearchConfig(props) {
   ] });
 }
 
+// src/client/FetchConfig.tsx
+var import_react2 = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var defaults2 = { fetchAllowedCidrs: "", fetchTimeoutMs: "30000", fetchMaxResponseBytes: "5000000", fetchMaxContentChars: "100000" };
+var fields2 = Object.keys(defaults2);
+var limits = ["fetchTimeoutMs", "fetchMaxResponseBytes", "fetchMaxContentChars"];
+function valuesOf2(value) {
+  return Object.fromEntries(fields2.map((field) => [field, field === "fetchAllowedCidrs" ? value[field]?.join("\n") ?? "" : String(value[field] ?? defaults2[field])]));
+}
+function FetchConfig(props) {
+  const { t } = props;
+  const state = props.useConfig((snapshot) => snapshot);
+  const [draft, setDraft] = (0, import_react2.useState)(null);
+  const [busy, setBusy] = (0, import_react2.useState)(false);
+  const [message, setMessage] = (0, import_react2.useState)(null);
+  if (state.status !== "ready" || !state.value) return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { role: "status", children: t(state.status === "loading" ? "loading" : "unavailable") });
+  const accepted = valuesOf2(state.value);
+  const values = draft?.values ?? accepted;
+  const conflict = draft !== null && draft.revision !== state.revision;
+  const disabled = !state.writable || busy;
+  const edit = (field, value) => {
+    setDraft({ values: { ...values, [field]: value }, revision: draft ? draft.revision : state.revision });
+    setMessage(null);
+  };
+  const save = async (reset) => {
+    if (conflict) {
+      setMessage("conflict");
+      return;
+    }
+    if (!reset && !limits.every((field) => Number.isSafeInteger(Number(values[field])) && Number(values[field]) > 0)) {
+      setMessage("fetchInvalid");
+      return;
+    }
+    const ops = reset ? fields2.map((field) => ({ op: "unset", path: [field] })) : fields2.filter((field) => values[field] !== accepted[field]).map((field) => ({ op: "set", path: [field], value: field === "fetchAllowedCidrs" ? values[field].split(/\r?\n/).map((line) => line.trim()).filter(Boolean) : Number(values[field]) }));
+    setBusy(true);
+    setMessage(null);
+    try {
+      if (await props.mutateConfig(ops, draft ? draft.revision : state.revision)) {
+        setDraft(null);
+        setMessage("saved");
+      } else setMessage("failed");
+    } catch {
+      setMessage("failed");
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "dsh-search-config", children: /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("form", { "aria-label": t("fetchSettings"), onSubmit: (event) => {
+    event.preventDefault();
+    void save(false);
+  }, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("fieldset", { disabled, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("legend", { children: t("fetchSettings") }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("label", { className: "dsh-search-wide", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { children: t("fetchAllowedCidrs") }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("textarea", { name: "fetchAllowedCidrs", rows: 4, value: values.fetchAllowedCidrs, onChange: (event) => edit("fetchAllowedCidrs", event.target.value), "aria-describedby": "dsh-search-cidr-hint" })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { id: "dsh-search-cidr-hint", className: "dsh-search-hint dsh-search-wide", children: t("cidrHint") }),
+      limits.map((field) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("label", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { children: t(field) }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("input", { name: field, type: "number", min: 1, step: 1, value: values[field], onChange: (event) => edit(field, event.target.value) })
+      ] }, field))
+    ] }),
+    !state.writable && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { role: "status", children: t("readOnly") }),
+    conflict && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { role: "alert", children: t("conflict") }),
+    message && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { role: "status", children: t(message) }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "dsh-search-actions", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "submit", disabled: disabled || conflict || !draft, children: t(busy ? "saving" : "save") }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", disabled: disabled || conflict, onClick: () => {
+        void save(true);
+      }, children: t("reset") }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", disabled: busy || !draft, onClick: () => {
+        setDraft(null);
+        setMessage(null);
+      }, children: t("discard") })
+    ] })
+  ] }) });
+}
+
+// src/client/BundleConfig.tsx
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function BundleConfig(props) {
+  if (props.view === "summary") return props.t("description");
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SearchConfig, { ...props }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(FetchConfig, { ...props })
+  ] });
+}
+
 // src/client/locales.ts
 var en = {
   title: "Web search",
@@ -236,8 +313,7 @@ var en = {
   fetchTimeoutMs: "Fetch timeout (ms)",
   fetchMaxResponseBytes: "Fetch maximum response bytes",
   fetchMaxContentChars: "Fetch maximum content characters",
-  cidrHint: "These ranges explicitly allow web_fetch to reach otherwise blocked network addresses. An empty list adds no exceptions. Enter one IPv4 or IPv6 CIDR per line; other URL, DNS, redirect and transport safety checks still apply. The shortcut only updates this draft; save configuration to apply it.",
-  cidrPreset: "Add 198.18.0.0/15 and 192.168.96.0/20 to draft",
+  cidrHint: "These ranges explicitly allow web_fetch to reach otherwise blocked network addresses. An empty list adds no exceptions. Enter one IPv4 or IPv6 CIDR per line; other URL, DNS, redirect and transport safety checks still apply.",
   authMode: "Authentication",
   openai: "Reuse OpenAI provider (default)",
   credential: "Independent credential",
@@ -271,6 +347,7 @@ var en = {
   keySaved: "Credential updated. Environment or other source layers may still supply a value after removal.",
   keyFailed: "Credential operation failed. Check the credential provider and retry.",
   invalidRef: "Use an environment-style reference name (letters, digits, underscore; not starting with a digit).",
+  fetchInvalid: "Use positive integer fetch limits.",
   invalid: "Use positive integer limits and 1\u201350 DeepSeek results. Reuse requires a provider route; independent authentication and DeepSeek require a valid credential reference and a full HTTP(S) URL without credentials or a fragment."
 };
 var zh = {
@@ -292,8 +369,7 @@ var zh = {
   fetchTimeoutMs: "\u6293\u53D6\u8D85\u65F6\uFF08\u6BEB\u79D2\uFF09",
   fetchMaxResponseBytes: "\u6293\u53D6\u54CD\u5E94\u5B57\u8282\u4E0A\u9650",
   fetchMaxContentChars: "\u6293\u53D6\u5185\u5BB9\u5B57\u7B26\u4E0A\u9650",
-  cidrHint: "\u8FD9\u4E9B\u7F51\u6BB5\u660E\u786E\u5141\u8BB8 web_fetch \u8BBF\u95EE\u539F\u672C\u53D7\u963B\u7684\u7F51\u7EDC\u5730\u5740\u3002\u7A7A\u5217\u8868\u4E0D\u589E\u52A0\u653E\u884C\u4F8B\u5916\u3002\u6BCF\u884C\u586B\u5199\u4E00\u4E2A IPv4 \u6216 IPv6 CIDR\uFF1B\u5176\u4ED6 URL\u3001DNS\u3001\u91CD\u5B9A\u5411\u548C\u4F20\u8F93\u5B89\u5168\u68C0\u67E5\u4ECD\u7136\u9002\u7528\u3002\u5FEB\u6377\u6309\u94AE\u4EC5\u4FEE\u6539\u8349\u7A3F\uFF0C\u4FDD\u5B58\u914D\u7F6E\u540E\u751F\u6548\u3002",
-  cidrPreset: "\u5C06 198.18.0.0/15 \u548C 192.168.96.0/20 \u52A0\u5165\u8349\u7A3F",
+  cidrHint: "\u8FD9\u4E9B\u7F51\u6BB5\u660E\u786E\u5141\u8BB8 web_fetch \u8BBF\u95EE\u539F\u672C\u53D7\u963B\u7684\u7F51\u7EDC\u5730\u5740\u3002\u7A7A\u5217\u8868\u4E0D\u589E\u52A0\u653E\u884C\u4F8B\u5916\u3002\u6BCF\u884C\u586B\u5199\u4E00\u4E2A IPv4 \u6216 IPv6 CIDR\uFF1B\u5176\u4ED6 URL\u3001DNS\u3001\u91CD\u5B9A\u5411\u548C\u4F20\u8F93\u5B89\u5168\u68C0\u67E5\u4ECD\u7136\u9002\u7528\u3002",
   authMode: "\u8BA4\u8BC1\u65B9\u5F0F",
   openai: "\u590D\u7528 OpenAI Provider\uFF08\u9ED8\u8BA4\uFF09",
   credential: "\u72EC\u7ACB\u51ED\u636E",
@@ -327,6 +403,7 @@ var zh = {
   keySaved: "\u51ED\u636E\u5DF2\u66F4\u65B0\uFF1B\u79FB\u9664\u540E\u73AF\u5883\u53D8\u91CF\u6216\u5176\u4ED6\u6765\u6E90\u4ECD\u53EF\u80FD\u63D0\u4F9B\u51ED\u636E\u3002",
   keyFailed: "\u51ED\u636E\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u51ED\u636E\u63D0\u4F9B\u65B9\u540E\u91CD\u8BD5\u3002",
   invalidRef: "\u8BF7\u8F93\u5165\u73AF\u5883\u53D8\u91CF\u683C\u5F0F\u7684\u5F15\u7528\u540D\uFF08\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\uFF0C\u4E0D\u80FD\u4EE5\u6570\u5B57\u5F00\u5934\uFF09\u3002",
+  fetchInvalid: "\u8BF7\u586B\u5199\u6B63\u6574\u6570\u6293\u53D6\u4E0A\u9650\u3002",
   invalid: "\u8BF7\u586B\u5199\u6B63\u6574\u6570\u4E0A\u9650\uFF0CDeepSeek \u7ED3\u679C\u6570\u91CF\u987B\u4E3A 1\u201350\u3002\u590D\u7528\u6A21\u5F0F\u9700\u8981 Provider \u8DEF\u7531\uFF1B\u72EC\u7ACB\u8BA4\u8BC1\u548C DeepSeek \u9700\u8981\u6709\u6548\u51ED\u636E\u5F15\u7528\u540D\u4E0E\u5B8C\u6574 HTTP(S) \u5730\u5740\uFF0CURL \u4E0D\u5F97\u5305\u542B\u7528\u6237\u540D\u3001\u5BC6\u7801\u6216\u7247\u6BB5\u3002"
 };
 
@@ -412,13 +489,7 @@ function apply(ctx) {
     key: "dsh-search-plugin",
     locale: "searchPlugin",
     inject: () => face
-  }, SearchConfig)));
-  ctx.effect(() => ctx.slots.inject("plugins.row.config", () => ctx.slots.register({
-    name: "plugins.row.config",
-    key: "dsh-search-plugin#dsh-search-plugin",
-    locale: "searchPlugin",
-    inject: () => face
-  }, SearchConfig)));
+  }, BundleConfig)));
 }
 
 return module.exports;

package/lib/fetch.js

@@ -1,25 +1,14 @@
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
 import ipaddr from 'ipaddr.js';
+import { validateCidr } from './cidr.js';
 import { WebError } from '@deepseek-ai/dsh-web';
 import { HttpFetchProvider } from '@deepseek-ai/dsh-web-fetch-http';
 const bareHost = (host) => host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
 function parseCidr(rule) {
-    const [address, prefixText, ...extra] = rule.trim().split('/');
-    if (!address || !prefixText || extra.length || !/^(0|[1-9]\d*)$/.test(prefixText) || !isIP(address) || address.includes('%')) {
-        throw new Error(`Invalid CIDR: ${JSON.stringify(rule)}`);
-    }
+    const [address, prefixText] = validateCidr(rule).trim().split('/');
     const bytes = ipaddr.parse(address).toByteArray();
     const prefix = Number(prefixText);
-    if (prefix > bytes.length * 8)
-        throw new Error(`Invalid CIDR prefix: ${JSON.stringify(rule)}`);
-    // Requiring the network base catches accidental overly broad operator rules.
-    if (bytes.some((byte, i) => (byte & (255 >>> Math.max(0, Math.min(8, prefix - i * 8)))) !== 0)) {
-        throw new Error(`CIDR must use its network base: ${JSON.stringify(rule)}`);
-    }
-    if (bytes.length === 16 && isEmbeddedV4(bytes) && bytes.some(Boolean) && !(bytes.slice(0, 15).every(b => b === 0) && bytes[15] === 1)) {
-        throw new Error(`Use an IPv4 CIDR for IPv4-mapped or compatible addresses: ${JSON.stringify(rule)}`);
-    }
     return { bytes, prefix };
 }
 /** Validate explicit IPv4/IPv6 network CIDRs; no implicit private ranges are added. */

package/lib/index.js

@@ -1,6 +1,7 @@
 import Schema from '@deepseek-ai/schemastery';
 import { ConfiguredSearchProvider } from './connection.js';
-import { ConfiguredFetchProvider, validateCidrs } from './fetch.js';
+import { ConfiguredFetchProvider } from './fetch.js';
+import { validateCidr } from './cidr.js';
 export const name = 'dsh-search-plugin';
 export const inject = ['web'];
 export const Config = Schema.object({
@@ -8,11 +9,7 @@ export const Config = Schema.object({
     deepseekEndpoint: Schema.string().pattern(/^https?:\/\/[^\s]+$/).default('https://api.deepseek.com/v1/tools').volatile(),
     deepseekCredentialRef: Schema.string().pattern(/^[A-Za-z_][A-Za-z0-9_]*$/).default('DEEPSEEK_API_KEY').volatile(),
     deepseekCount: Schema.number().step(1).min(1).max(50).default(10).volatile(),
-    fetchAllowedCidrs: Schema.transform(Schema.array(Schema.string()), value => {
-        if (!validateCidrs(value))
-            throw new Error('Use valid IPv4 or IPv6 network CIDRs');
-        return value;
-    }, true).default([]).volatile(),
+    fetchAllowedCidrs: Schema.array(Schema.transform(Schema.string(), validateCidr, true)).default([]).volatile(),
     fetchTimeoutMs: Schema.number().step(1).min(1).default(30000).volatile(),
     fetchMaxResponseBytes: Schema.number().step(1).min(1).default(5000000).volatile(),
     fetchMaxContentChars: Schema.number().step(1).min(1).default(100000).volatile(),

package/lib/types/cidr.d.ts

@@ -0,0 +1,2 @@
+/** Schemastery serializes this function for browser forms. Keep it closure-free. */
+export declare function validateCidr(rule: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-search-plugin",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/urzz/dsh-search-plugin.git"