refactor(proxy): 代理 URL 不再做密码遮蔽

- proxy_service 删除 _mask_proxy_url，get_public 返回原始 URL
- /api/proxy 与 /api/proxy/test 去掉 ***@ 特殊处理
- 设置页去掉显示/隐藏切换，直接展示完整 URL

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

services/api.py

@@ -580,15 +580,8 @@ def create_app() -> FastAPI:
     @router.post("/api/proxy")
     async def update_proxy(body: ProxyUpdateRequest, authorization: str | None = Header(default=None)):
         require_auth_key(authorization)
-
-        # If the client echoes back the masked form (contains `***@`), treat it as "no change"
-        # so the stored password is preserved.
-        url = body.url
-        if url is not None and "***@" in url:
-            url = None
-
         try:
-            proxy_config.update(enabled=body.enabled, url=url)
+            proxy_config.update(enabled=body.enabled, url=body.url)
         except ValueError as exc:
             raise HTTPException(status_code=400, detail={"error": str(exc)}) from exc
         return {"proxy": proxy_config.get_public()}
@@ -600,8 +593,7 @@ def create_app() -> FastAPI:
     ):
         require_auth_key(authorization)
         candidate = (body.url or "").strip()
-        if not candidate or "***@" in candidate:
-            # Fall back to the stored url when caller omits it or sent the masked form.
+        if not candidate:
             candidate = (proxy_config.get().get("url") or "").strip()
         if not candidate:
             raise HTTPException(status_code=400, detail={"error": "proxy url is required"})

services/proxy_service.py

@@ -11,7 +11,7 @@ import os
 import time
 from pathlib import Path
 from threading import Lock
-from urllib.parse import quote, urlparse, urlunparse
+from urllib.parse import urlparse
 
 from curl_cffi.requests import Session
 
@@ -37,23 +37,6 @@ def _is_valid_proxy_url(url: str) -> bool:
     return bool(parsed.hostname)
 
 
-def _mask_proxy_url(url: str) -> str:
-    """Return a display-safe version of the proxy URL where password is hidden."""
-    if not url:
-        return ""
-    try:
-        parsed = urlparse(url)
-    except Exception:
-        return url
-    if not parsed.password:
-        return url
-    user = parsed.username or ""
-    host = parsed.hostname or ""
-    port = f":{parsed.port}" if parsed.port else ""
-    netloc = f"{quote(user, safe='')}:***@{host}{port}"
-    return urlunparse(parsed._replace(netloc=netloc))
-
-
 class ProxyConfig:
     def __init__(self, store_file: Path):
         self._store_file = store_file
@@ -92,11 +75,10 @@ class ProxyConfig:
             return dict(self._state)
 
     def get_public(self) -> dict:
-        """Return a masked representation safe to expose over the API."""
         state = self.get()
         return {
             "enabled": bool(state.get("enabled")),
-            "url": _mask_proxy_url(_clean(state.get("url"))),
+            "url": _clean(state.get("url")),
         }
 
     def update(self, *, enabled: bool | None, url: str | None) -> dict:

web/src/app/settings/components/proxy-settings.tsx

@@ -2,8 +2,6 @@
 
 import { useEffect, useRef, useState } from "react";
 import {
-  Eye,
-  EyeOff,
   LoaderCircle,
   PlugZap,
   Save,
@@ -27,7 +25,6 @@ export function ProxySettingsCard() {
   const [settings, setSettings] = useState<ProxySettings>({ enabled: false, url: "" });
   const [formUrl, setFormUrl] = useState("");
   const [formEnabled, setFormEnabled] = useState(false);
-  const [showUrl, setShowUrl] = useState(false);
   const [isLoading, setIsLoading] = useState(true);
   const [isSaving, setIsSaving] = useState(false);
   const [isTesting, setIsTesting] = useState(false);
@@ -147,25 +144,14 @@ export function ProxySettingsCard() {
                 <PlugZap className="size-3.5" />
                 代理地址
               </label>
-              <div className="relative">
-                <Input
-                  type={showUrl ? "text" : "password"}
-                  value={formUrl}
-                  onChange={(event) => setFormUrl(event.target.value)}
-                  placeholder="http://user:pass@host:port 或 socks5://host:port"
-                  className="h-11 rounded-xl border-stone-200 bg-white pr-10 font-mono text-xs"
-                />
-                <button
-                  type="button"
-                  className="absolute top-1/2 right-3 -translate-y-1/2 text-stone-400 transition hover:text-stone-600"
-                  onClick={() => setShowUrl((prev) => !prev)}
-                >
-                  {showUrl ? <EyeOff className="size-4" /> : <Eye className="size-4" />}
-                </button>
-              </div>
+              <Input
+                value={formUrl}
+                onChange={(event) => setFormUrl(event.target.value)}
+                placeholder="http://user:pass@host:port 或 socks5://host:port"
+                className="h-11 rounded-xl border-stone-200 bg-white font-mono text-xs"
+              />
               <div className="text-xs text-stone-400">
                 支持 <code className="font-mono">http / https / socks4 / socks5 / socks5h</code>。
-                密码部分展示时会被遮蔽（<code className="font-mono">***</code>），回传时保持原样即可保留密码。
               </div>
             </div>