dsh-proxy

@copylee/dsh-proxy

English | 中文

A network proxy plugin for DeepSeek Harness (dsh):

• Global proxy: enter http://127.0.0.1:7890 under Settings → Network proxy, and model requests, web search, web fetch, HTTP MCP, and commands the agent runs all go through it.
• Per-provider proxy: give one model provider its own proxy or force it direct. For example, Anthropic through http://127.0.0.1:7890 and DeepSeek direct.
• Applies on save: no dsh restart needed.

Precedence: provider setting > global proxy > HTTP(S)_PROXY from launch.

Install

dsh plugin --profile web add @copylee/dsh-proxy

Restart dsh web, and a Network proxy page appears in Settings.

Keep the @copylee/ scope. The unscoped dsh-proxy and dsh-network-proxy packages on npm belong to other people and are unrelated.

You can also install straight from GitHub. Built output is committed, so no build script or allowBuilds entry is needed:

dsh plugin --profile web add github:copylee711/dsh-proxy

Use

Open Settings → Network proxy:

Save applies to the next request, including Fetch available models on the Models page.

System proxy

The global selector offers Off (use launch settings), System proxy (auto-detect), and Manual proxy. Each provider can also select its own system proxy, overriding the global route. Menus follow dsh-free-search's floating cards, hover highlights, and selection checkmarks, with Arrow, Home/End, Enter, Esc, and Tab keyboard support.

Detection tries valid HTTP(S) values from HTTPS_PROXY / https_proxy, HTTP_PROXY / http_proxy, and ALL_PROXY / all_proxy in that order, then Windows current-user Internet Settings or macOS scutil. Linux uses environment variables. A launch environment snapshot prevents the plugin's own installed proxy from feeding back into detection. OS settings are checked every 30 seconds; the settings page also offers Detect again. SOCKS, PAC, and WPAD are not supported. When detection finds no usable proxy, the global layer restores launch settings and provider overrides fall back to the global route with a warning. Status and logs mask proxy credentials.

global:
  enabled: true
  mode: system
  noProxy: []
providers:
  openai:
    enabled: true
    mode: system

Existing configurations without mode continue using their manual proxy. The global proxy remains disabled by default.

Accent colour

The bottom of the page offers an accent colour (terracotta, blue or black) for the primary button and focus rings. The choice is shared with the other copylee plugins: changing it in any one of them recolours all of them.

Configuration file

The same settings live in $DSH_HOME/profiles/<profile>/cordis.patch.yml (the Web UI profile is web):

- id: dsh-proxy
  config:
    global:
      enabled: true
      url: http://127.0.0.1:7890
      noProxy: [internal.example.com]
    providers:
      anthropic:
        mode: proxy
        url: http://127.0.0.1:7890
      deepseek-official:
        mode: direct

Proxy URLs may be http:// or https://. A bare 127.0.0.1:7890 becomes http://127.0.0.1:7890. Credentials go in the URL: http://user:password@host:port.

How it works

• Global proxy installs through dsh's own @deepseek-ai/dsh-http-proxy, the package the launcher uses for HTTP(S)_PROXY. Loopback bypass, NO_PROXY matching, web_fetch routing, and the proxy environment of spawned tools therefore behave exactly as upstream. Turning it off restores the launch policy.
• Per-provider proxy hooks the llm/stream middleware. A provider's model call runs in one async context. The plugin puts that provider's undici ProxyAgent (or a direct Agent) in an AsyncLocalStorage, and fetch uses it inside that context. Other requests are untouched, and concurrent calls to different providers don't interfere.
• Both sections are Cordis volatile fields. Saving in Settings fires loader/volatile-update, and the plugin switches routes in place without reloading.

Limits

• HTTP(S) proxies only; SOCKS5 is not supported. The "mixed port" of Clash, v2rayN, and similar apps (e.g. 7890) also speaks HTTP, so use that port.
• Per-provider routes cover that provider's model requests only (including model discovery). Web search, web fetch, and other traffic use the global route.
• Credentials are stored in plain text. A username and password in the URL are saved in the profile's cordis.patch.yml. The global proxy URL also reaches commands the agent runs through their environment.
• Telemetry stays direct. It uses Node's http module, as it does in upstream dsh.

Develop

npm install
npm run typecheck
npm test        # global / per-provider / direct routing against local fake proxies
npm run build   # regenerates lib/ and client/ (commit them)

Try it in a local dsh: dsh plugin --profile web add /path/to/dsh-proxy.

License

MIT