一条命令回答：我的代理到底哪一环断了？ One command that answers: which link of my proxy chain is broken?
Windows 上的代理链路有六七个环节，任何一环出问题，表现却几乎一样："连不上"。你会看到 fetch failed、ECONNRESET、502、SEC_E_NO_CREDENTIALS，或者干脆超时——但没人告诉你断在哪里。
ProxyDoctor 从本地端口一路走到端到端请求，逐环检查，最后给出一条结论 + 一条修复命令。
| 环节 | 检查内容 | 断了会怎样 |
|---|---|---|
| 运行环境 | 权限数量、是否受限令牌 | 受限令牌下 Schannel 失效：curl/git/.NET 全挂，而 node/python 正常 |
| 代理端口 | 端口是否监听、归属进程、能否应答 CONNECT |
端口没开 → 客户端根本没启动；开了但不认 CONNECT → 你指错了端口 |
| 系统代理 | ProxyEnable / ProxyServer / 绕过列表 / PAC / WinHTTP |
浏览器能上网、命令行不能，通常就断在这 |
| 代理环境变量 | 注册表（用户/机器）vs 当前进程 | 注册表有、进程没有 = 程序启动时机不对（应用内"重启"就会这样） |
| DNS / fake-ip | 解析结果是否落在 198.18.0.0/15 或 fdfe:dcba:9876::/64 |
拿到假 IP 后，任何校验"公网地址"的工具都会拒绝抓取 |
| TUN 模式 | Clash Verge Rev 配置 + TUN 网卡 + DNS 劫持迹象 | TUN 开着会劫持 DNS 并下发 fake-ip |
| 端到端 | 直连探针 + 走代理探针（node，走 OpenSSL） | 直连通、代理不通 → 节点或端口问题；隧道被重置 → 上游节点不可用 |
判决顺序是从近到远：先看端口，再看 TUN、系统代理、变量继承，最后才怀疑节点。这样你拿到的永远是最上游的那个断点，而不是被下游的一堆报错带偏。
git clone https://github.com/looeton/proxy-doctor.git
cd proxy-doctor
# 完整检查
pwsh -File ./proxy-doctor.ps1
# 没有 pwsh 就用 Windows PowerShell
powershell -File ./proxy-doctor.ps1典型输出（健康状态）：
ProxyDoctor - which link of the proxy chain is broken?
==========================================================================
Environment
Microsoft Windows 10.0.26100 | PowerShell 7.5.3 | elevated: False
[ OK ] token privileges enabled: 16
Proxy port
[ OK ] 127.0.0.1:7897 listening (verge-mihomo)
[ OK ] answers CONNECT requests
Windows system proxy
[ OK ] enabled -> 127.0.0.1:7897
Proxy environment variables
[ OK ] HTTPS_PROXY = http://127.0.0.1:7897
[ OK ] inherited by this process
[ OK ] NO_PROXY covers loopback
DNS
[ OK ] example.com -> 104.20.23.154, 172.66.147.243
TUN mode
[ OK ] DNS is not hijacked
End-to-end traffic
[ OK ] direct https://example.com -> 200
[ OK ] through proxy https://www.google.com -> 200
==========================================================================
VERDICT [PASS] The proxy chain is healthy: port, system proxy, environment
variables and end-to-end traffic all check out.
典型输出（断了）：
VERDICT [FAIL] These variables exist in the registry but are missing from this
process: HTTP_PROXY, HTTPS_PROXY. It was started before the change.
FIX Fully quit the app (not an in-app restart) and start it again from the
Start menu.
| 参数 | 默认值 | 说明 |
|---|---|---|
-ProxyHost |
127.0.0.1 |
本地代理主机 |
-Port |
自动 | 优先用系统代理里配置的端口，否则取第一个在监听的候选端口 |
-DirectProbe |
https://example.com |
直连应可达的探针 |
-ProxyProbe |
https://www.google.com |
只有代理真的生效才通的探针（真正的判据） |
-DnsProbeHost |
example.com |
用于检测 fake-ip 的域名 |
-SkipNetwork |
关 | 跳过端到端请求（离线/快速检查） |
-Json |
关 | 输出 JSON，便于脚本消费 |
-TimeoutMs |
20000 |
单个网络探针超时 |
| 码 | 含义 |
|---|---|
0 |
链路正常（可能有 WARN） |
1 |
某一环断了 |
2 |
工具自身出错 |
pwsh -File ./proxy-doctor.ps1 -Json | ConvertFrom-Json |
Select-Object -ExpandProperty Verdict
# 只看某几个字段
$r = pwsh -File ./proxy-doctor.ps1 -Json | ConvertFrom-Json
$r.ProxyPort.Port
$r.Dns.Addresses
$r.Connectivity.ThroughProxy.StatusImport-Module ./src/ProxyDoctor.psm1
$report = Get-ProxyDoctorReport -SkipNetwork # 只采集，不打印
$report.Verdict- 只面向 Windows：读注册表、查 TUN 网卡、解析
whoami /priv都是 Windows 专有。 - 端到端探针依赖 Node：Node 走 OpenSSL，在受限令牌下仍然可用；没装 Node 时会明确标注"跳过"，而不是假装通过。
- Clash 配置检测针对 Clash Verge Rev：其他客户端只做端口与 TUN 网卡层面的通用检测。
- 它不修改任何配置：只诊断，不动你的注册表和代理设置。要写入环境变量请用 clash-verge-system-proxy 里的脚本。
- clash-verge-system-proxy —— 同一套思路的完整落地指南：关 TUN、开系统代理、写入代理环境变量、配套修复与排错手册。
A Windows proxy chain has half a dozen links, and when any of them breaks the symptom looks identical: "it cannot connect". You get fetch failed, ECONNRESET, 502, SEC_E_NO_CREDENTIALS or a bare timeout — and nothing tells you where it broke.
ProxyDoctor walks the chain from the local port to the end-to-end request, checks every link, and ends with one verdict plus one fix command.
| Link | Checked | When it breaks |
|---|---|---|
| Environment | privilege count, restricted token | Under a restricted token Schannel dies: curl/git/.NET fail while node/python keep working |
| Proxy port | listening, owning process, CONNECT answer |
Port closed → client not running; open but no CONNECT → wrong port |
| System proxy | ProxyEnable / ProxyServer / bypass / PAC / WinHTTP |
"Browser works, CLI does not" usually breaks here |
| Proxy env vars | registry (user/machine) vs this process | In registry but not in the process = started at the wrong time (an in-app "restart" does this) |
| DNS / fake-ip | answers inside 198.18.0.0/15 or fdfe:dcba:9876::/64 |
Fake IPs make every "is this public?" validator refuse |
| TUN mode | Clash Verge Rev config + TUN adapters + DNS hijack | TUN hijacks DNS and hands out fake IPs |
| End-to-end | direct probe + proxied probe (node, OpenSSL) | Direct OK but proxied failing → node or port; tunnel reset → upstream node unreachable |
The verdict walks nearest-first: port, then TUN, system proxy and variable inheritance, and only then the upstream node. You always get the earliest broken link instead of a pile of downstream errors.
git clone https://github.com/looeton/proxy-doctor.git
cd proxy-doctor
pwsh -File ./proxy-doctor.ps1
# without pwsh: powershell -File ./proxy-doctor.ps1| Parameter | Default | Purpose |
|---|---|---|
-ProxyHost |
127.0.0.1 |
Local proxy host |
-Port |
auto | Uses the port configured in the system proxy, else the first listening candidate |
-DirectProbe |
https://example.com |
URL expected to work with or without a proxy |
-ProxyProbe |
https://www.google.com |
URL that only works when the proxy really routes (the actual verdict) |
-DnsProbeHost |
example.com |
Host used for the fake-ip check |
-SkipNetwork |
off | Skip the end-to-end requests (offline / fast) |
-Json |
off | Emit JSON for scripting |
-TimeoutMs |
20000 |
Per-probe timeout |
| Code | Meaning |
|---|---|
0 |
chain healthy (warnings possible) |
1 |
a link is broken |
2 |
the tool itself failed |
pwsh -File ./proxy-doctor.ps1 -Json | ConvertFrom-Json |
Select-Object -ExpandProperty VerdictImport-Module ./src/ProxyDoctor.psm1
$report = Get-ProxyDoctorReport -SkipNetwork # collect only, no output
$report.Verdict- Windows only: registry reads, TUN adapter queries and
whoami /privparsing are Windows-specific. - The end-to-end probe needs Node: Node uses OpenSSL and keeps working under restricted tokens. Without Node the probe is reported as skipped, never as passed.
- Clash config detection targets Clash Verge Rev: other clients still get the generic port and TUN-adapter checks.
- It changes nothing: diagnosis only — your registry and proxy settings are left untouched. To write the environment variables, use the scripts in clash-verge-system-proxy.
- clash-verge-system-proxy — the full companion guide: TUN off, system proxy on, proxy environment variables, companion fixes and a troubleshooting handbook.
# unit tests (Pester 5)
Invoke-Pester -Path ./tests -Output Detailed
# the CLI against the current machine
pwsh -File ./proxy-doctor.ps1CI runs PSScriptAnalyzer (errors block, warnings are informational), the Pester suite, and a CLI smoke test on windows-latest.