dsh-web-search-router

Web Search Router for DeepSeek Harness

简体中文 · DeepSeek Harness · Security

A priority-ordered, multi-provider web_search router for DSH. Keep the model-facing tool unchanged while automatically switching providers when one is unavailable.

The plugin registers one DSH web search provider (web-search-router) and keeps the model-facing tool unchanged: agents still call DSH's built-in web_search. Providers are tried from top to bottom and the router stops on the first successful result.

Features

• Reorder and enable/disable providers from the DSH Settings UI.
• Automatic fallback on missing configuration, provider failures, timeouts, rate limits, quota/credit exhaustion, and (by default) empty results.
• Short cooldowns for transient failures and configurable cooldowns for rate/quota failures.
• Non-secret router settings are stored in plugins/dsh-web-search-router/config.json next to $DSH_HOME and apply without restarting DSH.
• API keys stay in DSH credentials / launch environment and are never returned to the Settings UI.
• Provider error messages are sanitized before being logged or returned through the router.

Providers

Unconfigured providers are skipped automatically.

Compatibility

Check package.json for the runtime and peer-dependency constraints supported by the current source. DeepSeek Harness is under active development and may introduce compatibility-breaking changes. Pin the plugin to a Git commit when reproducibility matters, and retest when upgrading DSH.

Agent preset requirement

This plugin supplies the search backend; it does not add a second model-facing tool. Your agent preset must expose DSH's built-in web_search tool (for example, the standard preset). A minimal preset that omits web_search will not invoke this router.

Install

Install to the profile that runs your agents (desktop is an example):

dsh plugin --profile desktop add github:Kerberos255/dsh-web-search-router

For reproducible installations, pin a Git commit. Local development can instead use link:/absolute/path/to/dsh-web-search-router with the same profile. Installing the plugin does not add web_search to a preset that omits the native tool.

The bundled patch selects web-search-router as DSH's search provider and inserts the plugin with generic defaults.

Settings

Open Settings → Plugins → Plugin configuration → Web Search Router and expand the card to:

• reorder providers;
• enable/disable providers;
• configure SearXNG;
• write or clear provider API keys;
• set per-provider timeout and cooldown;
• choose whether an empty result falls through to the next provider.

Non-secret settings live in plugins/dsh-web-search-router/config.json next to $DSH_HOME; the card reads and writes that file.

Settings writes are accepted only from loopback access. API keys are written through DSH credentials; the UI only reads configured/unconfigured state.

DeepSeek Search tier

The DeepSeek tier configures nothing of its own: it calls the deepseek-official provider DSH itself registered, so the endpoint, the model, the account-or-key authentication, and the per-request limits all stay owned by DSH. Changing the endpoint in DSH's own Web search settings needs no extra step here.

The tier is attempted only while that provider is registered and the session can plausibly authenticate — a session on the deepseek-account route, or the shared DEEPSEEK_API_KEY credential the Models page manages for chat. Otherwise the router skips to the next provider.

Fallback behavior

For each enabled provider, in configured order:

1. skip it if not configured or currently cooling down;
2. run it with the configured timeout;
3. return immediately on success;
4. optionally continue on an empty result;
5. on failure, classify the error and continue to the next provider.

Caller aborts are propagated immediately and never trigger fallback.

Development

npm test

Tests cover routing order/fallback/cooldowns, settings persistence and provider request/response adapters. Live tests used during local development are intentionally excluded from the public repository because they depend on a running local DSH instance and local credentials.

Security

• Never commit API keys or .env files.
• Credential values are resolved only on the host side.
• The browser receives credential references and configured-state metadata, never stored key values.
• Router errors redact URLs and key/token-like values before logging or surfacing failure details.

Related plugins

• Browser Tools for CDP-based web interaction.
• Status Cards for DSH runtime and provider status.

License

MIT

Optional plugin diagnostics

The plugin optionally emits privacy-restricted operation and failure metadata to dsh-plugin-diagnostics. Diagnostics contain event type, status, fixed error code and elapsed time; conversation content and credentials are not logged. The diagnostics plugin is optional and does not change the host requirements.