feat: implement scoped proxy configurations

composeApp/src/commonMain/kotlin/zed/rainxch/githubstore/app/di/initKoin.kt

@@ -11,7 +11,7 @@ import zed.rainxch.core.data.di.networkModule
 import zed.rainxch.details.data.di.detailsModule
 import zed.rainxch.devprofile.data.di.devProfileModule
 import zed.rainxch.home.data.di.homeModule
-import zed.rainxch.profile.data.di.settingsModule
+import zed.rainxch.profile.data.di.profileModule
 import zed.rainxch.search.data.di.searchModule
 
 fun initKoin(config: KoinAppDeclaration? = null) {
@@ -30,7 +30,7 @@ fun initKoin(config: KoinAppDeclaration? = null) {
             devProfileModule,
             homeModule,
             searchModule,
-            settingsModule,
+            profileModule,
         )
     }
 }

core/data/src/androidMain/kotlin/zed/rainxch/core/data/services/AndroidDownloader.kt

@@ -14,6 +14,7 @@ import zed.rainxch.core.data.network.ProxyManager
 import zed.rainxch.core.data.network.resolveAndroidSystemProxy
 import zed.rainxch.core.domain.model.DownloadProgress
 import zed.rainxch.core.domain.model.ProxyConfig
+import zed.rainxch.core.domain.model.ProxyScope
 import zed.rainxch.core.domain.network.Downloader
 import java.io.File
 import java.net.Authenticator
@@ -26,7 +27,6 @@ import java.util.concurrent.TimeUnit
 
 class AndroidDownloader(
     private val files: FileLocationsProvider,
-    private val proxyManager: ProxyManager = ProxyManager,
 ) : Downloader {
     private val activeDownloads = ConcurrentHashMap<String, Call>()
     private val activeFileNames = ConcurrentHashMap<String, String>()
@@ -40,7 +40,7 @@ class AndroidDownloader(
             .readTimeout(60, TimeUnit.SECONDS)
             .writeTimeout(60, TimeUnit.SECONDS)
             .apply {
-                when (val config = proxyManager.currentProxyConfig.value) {
+                when (val config = ProxyManager.currentConfig(ProxyScope.DOWNLOAD)) {
                     is ProxyConfig.None -> {
                         proxy(Proxy.NO_PROXY)
                     }

core/data/src/commonMain/kotlin/zed/rainxch/core/data/di/SharedModule.kt

@@ -1,9 +1,11 @@
 package zed.rainxch.core.data.di
 
-import io.ktor.client.HttpClient
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitAll
+import kotlinx.coroutines.coroutineScope
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withTimeout
@@ -24,8 +26,9 @@ import zed.rainxch.core.data.logging.KermitLogger
 import zed.rainxch.core.data.network.BackendApiClient
 import zed.rainxch.core.data.network.GitHubClientProvider
 import zed.rainxch.core.data.network.ProxyManager
+import zed.rainxch.core.data.network.ProxyManagerSeeding
 import zed.rainxch.core.data.network.ProxyTesterImpl
-import zed.rainxch.core.data.network.createGitHubHttpClient
+import zed.rainxch.core.data.network.TranslationClientProvider
 import zed.rainxch.core.data.repository.AuthenticationStateImpl
 import zed.rainxch.core.data.repository.FavouritesRepositoryImpl
 import zed.rainxch.core.data.repository.InstalledAppsRepositoryImpl
@@ -41,6 +44,7 @@ import zed.rainxch.core.domain.getPlatform
 import zed.rainxch.core.domain.logging.GitHubStoreLogger
 import zed.rainxch.core.domain.model.Platform
 import zed.rainxch.core.domain.model.ProxyConfig
+import zed.rainxch.core.domain.model.ProxyScope
 import zed.rainxch.core.domain.network.ProxyTester
 import zed.rainxch.core.domain.system.DownloadOrchestrator
 import zed.rainxch.core.domain.repository.AuthenticationState
@@ -89,7 +93,7 @@ val coreModule =
                 installedAppsDao = get(),
                 historyDao = get(),
                 installer = get(),
-                httpClient = get(),
+                clientProvider = get(),
             )
         }
 
@@ -98,7 +102,7 @@ val coreModule =
                 installedAppsDao = get(),
                 starredRepoDao = get(),
                 platform = get(),
-                httpClient = get(),
+                clientProvider = get(),
             )
         }
 
@@ -123,6 +127,7 @@ val coreModule =
         single<ProxyRepository> {
             ProxyRepositoryImpl(
                 preferences = get(),
+                logger = get(),
             )
         }
 
@@ -144,8 +149,24 @@ val coreModule =
         }
 
         single<BackendApiClient> {
-            BackendApiClient()
+            // Request the seeding sentinel so Koin guarantees ProxyManager
+            // has the user's persisted config loaded before we snapshot
+            // the discovery flow for the initial client build.
+            get<ProxyManagerSeeding>()
+            BackendApiClient(
+                proxyConfigFlow = ProxyManager.configFlow(ProxyScope.DISCOVERY),
+            )
         }
+        // NOTE: the reviewer asked for a Koin onClose hook to call
+        // BackendApiClient.close()/GitHubClientProvider.close()/
+        // TranslationClientProvider.close() at Koin shutdown. Koin 4.x
+        // (4.1.1 on this project) doesn't expose that hook at the
+        // module DSL level — it existed in 3.x and was removed — and
+        // there's no clean replacement short of wrapping each provider
+        // in a Koin scope. On Android/Desktop the process exit
+        // releases these resources anyway, so we intentionally leave
+        // the hooks off rather than fake them with an API that doesn't
+        // fit. Revisit if we upgrade Koin or adopt scope-based DI.
 
         single<DeviceIdentityRepository> {
             DeviceIdentityRepositoryImpl(
@@ -180,58 +201,53 @@ val coreModule =
 
 val networkModule =
     module {
-        single<GitHubClientProvider> {
-            val config =
-                runBlocking {
-                    runCatching {
-                        withTimeout(1_500L) {
-                            get<ProxyRepository>().getProxyConfig().first()
+        // Seed [ProxyManager] from persisted per-scope configs *before*
+        // any HTTP client is constructed. Registered as its own
+        // [ProxyManagerSeeding] sentinel so client providers can depend
+        // on it explicitly — without this the seeding would live inside
+        // one provider's factory and silently race with others.
+        //
+        // Reads run in parallel under a single 1.5s budget (was 1.5s × 3
+        // sequential). On timeout / DataStore failure we fall back to the
+        // in-memory defaults — we'd rather the app network with the
+        // System proxy than stall at launch on a slow disk.
+        single<ProxyManagerSeeding>(createdAtStart = true) {
+            val repository = get<ProxyRepository>()
+            runBlocking {
+                runCatching {
+                    withTimeout(1_500L) {
+                        coroutineScope {
+                            ProxyScope.entries
+                                .map { scope ->
+                                    async {
+                                        scope to repository.getProxyConfig(scope).first()
+                                    }
+                                }.awaitAll()
                         }
-                    }.getOrDefault(ProxyConfig.System)
-                }
-
-            when (config) {
-                is ProxyConfig.None -> {
-                    ProxyManager.setNoProxy()
-                }
-
-                is ProxyConfig.System -> {
-                    ProxyManager.setSystemProxy()
-                }
-
-                is ProxyConfig.Http -> {
-                    ProxyManager.setHttpProxy(
-                        host = config.host,
-                        port = config.port,
-                        username = config.username,
-                        password = config.password,
-                    )
-                }
-
-                is ProxyConfig.Socks -> {
-                    ProxyManager.setSocksProxy(
-                        host = config.host,
-                        port = config.port,
-                        username = config.username,
-                        password = config.password,
-                    )
+                    }
+                }.onSuccess { results ->
+                    results.forEach { (scope, config) ->
+                        ProxyManager.setConfig(scope, config)
+                    }
                 }
             }
+            ProxyManagerSeeding()
+        }
 
+        single<GitHubClientProvider>(createdAtStart = true) {
+            get<ProxyManagerSeeding>()
             GitHubClientProvider(
                 tokenStore = get(),
                 rateLimitRepository = get(),
                 authenticationState = get(),
-                proxyConfigFlow = ProxyManager.currentProxyConfig,
+                proxyConfigFlow = ProxyManager.configFlow(ProxyScope.DISCOVERY),
             )
         }
 
-        single<HttpClient> {
-            createGitHubHttpClient(
-                tokenStore = get(),
-                rateLimitRepository = get(),
-                authenticationState = get(),
-                scope = get(),
+        single<TranslationClientProvider>(createdAtStart = true) {
+            get<ProxyManagerSeeding>()
+            TranslationClientProvider(
+                proxyConfigFlow = ProxyManager.configFlow(ProxyScope.TRANSLATION),
             )
         }
 

core/data/src/commonMain/kotlin/zed/rainxch/core/data/network/BackendApiClient.kt

@@ -16,27 +16,70 @@ import io.ktor.client.request.setBody
 import io.ktor.http.ContentType
 import io.ktor.http.HttpStatusCode
 import io.ktor.http.contentType
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.flow.launchIn
+import kotlinx.coroutines.flow.onEach
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
 import zed.rainxch.core.data.dto.BackendExploreResponse
 import zed.rainxch.core.data.dto.BackendRepoResponse
 import zed.rainxch.core.data.dto.BackendSearchResponse
 import zed.rainxch.core.data.dto.EventRequest
+import zed.rainxch.core.domain.model.ProxyConfig
 import kotlin.coroutines.cancellation.CancellationException
 
-class BackendApiClient {
+/**
+ * Client for GitHub Store's own backend (trending/popular/search).
+ * Treated as *discovery* traffic — routes through the discovery-scope
+ * proxy so users configuring a proxy for GitHub browsing also have
+ * their backend discovery requests proxied consistently.
+ */
+class BackendApiClient(
+    proxyConfigFlow: StateFlow<ProxyConfig>,
+) {
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+    private val mutex = Mutex()
 
-    private val httpClient = HttpClient {
-        install(ContentNegotiation) {
-            json(Json { ignoreUnknownKeys = true })
-        }
-        install(HttpTimeout) {
-            requestTimeoutMillis = 5_000
-            connectTimeoutMillis = 3_000
-            socketTimeoutMillis = 5_000
-        }
-        defaultRequest {
-            url(BASE_URL)
+    @Volatile
+    private var httpClient: HttpClient = buildClient(proxyConfigFlow.value)
+
+    init {
+        proxyConfigFlow
+            .drop(1)
+            .distinctUntilChanged()
+            .onEach { config ->
+                mutex.withLock {
+                    httpClient.close()
+                    httpClient = buildClient(config)
+                }
+            }.launchIn(scope)
+    }
+
+    private fun buildClient(proxyConfig: ProxyConfig): HttpClient =
+        createPlatformHttpClient(proxyConfig).config {
+            install(ContentNegotiation) {
+                json(Json { ignoreUnknownKeys = true })
+            }
+            install(HttpTimeout) {
+                requestTimeoutMillis = 5_000
+                connectTimeoutMillis = 3_000
+                socketTimeoutMillis = 5_000
+            }
+            defaultRequest {
+                url(BASE_URL)
+            }
+            expectSuccess = false
         }
-        expectSuccess = false
+
+    fun close() {
+        httpClient.close()
+        scope.cancel()
     }
 
     suspend fun getCategory(category: String, platform: String): Result<List<BackendRepoResponse>> =

core/data/src/commonMain/kotlin/zed/rainxch/core/data/network/GitHubClientProvider.kt

@@ -42,15 +42,20 @@ class GitHubClientProvider(
             .distinctUntilChanged()
             .onEach { proxyConfig ->
                 mutex.withLock {
-                    currentClient.close()
-                    currentClient =
+                    // Replace-then-close: readers of [client] always see
+                    // a live client. Closing first opens a window where
+                    // an in-flight call could touch a closed engine.
+                    val replacement =
                         createGitHubHttpClient(
                             tokenStore = tokenStore,
                             rateLimitRepository = rateLimitRepository,
                             authenticationState = authenticationState,
                             scope = scope,
                             proxyConfig = proxyConfig,
                         )
+                    val previous = currentClient
+                    currentClient = replacement
+                    previous.close()
                 }
             }.launchIn(scope)
     }

core/data/src/commonMain/kotlin/zed/rainxch/core/data/network/ProxyManager.kt

@@ -4,34 +4,28 @@ import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import zed.rainxch.core.domain.model.ProxyConfig
+import zed.rainxch.core.domain.model.ProxyScope
 
+/**
+ * Live in-memory cache of the three per-scope proxy configurations.
+ * Writers (the repository) push updates via [setConfig]; consumers
+ * subscribe to [configFlow] so they rebuild their HTTP clients when
+ * the user flips a setting mid-session.
+ */
 object ProxyManager {
-    private val _proxyConfig = MutableStateFlow<ProxyConfig>(ProxyConfig.System)
-    val currentProxyConfig: StateFlow<ProxyConfig> = _proxyConfig.asStateFlow()
+    private val flows: Map<ProxyScope, MutableStateFlow<ProxyConfig>> =
+        ProxyScope.entries.associateWith { MutableStateFlow<ProxyConfig>(ProxyConfig.System) }
 
-    fun setNoProxy() {
-        _proxyConfig.value = ProxyConfig.None
-    }
-
-    fun setSystemProxy() {
-        _proxyConfig.value = ProxyConfig.System
-    }
+    fun configFlow(scope: ProxyScope): StateFlow<ProxyConfig> =
+        flows.getValue(scope).asStateFlow()
 
-    fun setHttpProxy(
-        host: String,
-        port: Int,
-        username: String? = null,
-        password: String? = null,
-    ) {
-        _proxyConfig.value = ProxyConfig.Http(host, port, username, password)
-    }
+    fun currentConfig(scope: ProxyScope): ProxyConfig =
+        flows.getValue(scope).value
 
-    fun setSocksProxy(
-        host: String,
-        port: Int,
-        username: String? = null,
-        password: String? = null,
+    fun setConfig(
+        scope: ProxyScope,
+        config: ProxyConfig,
     ) {
-        _proxyConfig.value = ProxyConfig.Socks(host, port, username, password)
+        flows.getValue(scope).value = config
     }
 }

core/data/src/commonMain/kotlin/zed/rainxch/core/data/network/ProxyManagerSeeding.kt

@@ -0,0 +1,11 @@
+package zed.rainxch.core.data.network
+
+/**
+ * Marker type that represents "the [ProxyManager] has been seeded
+ * with the user's persisted per-scope proxy configs." Any component
+ * that constructs an HTTP client whose proxy is read from
+ * [ProxyManager] at creation time must inject this so Koin resolves
+ * the seeding step first — it forces the DI graph dependency to be
+ * explicit instead of depending on registration order.
+ */
+class ProxyManagerSeeding internal constructor()