DSH (DeepSeek Harness) uses the export https_proxy=... environment variable by default, causing all traffic to pass through the upstream proxy, including local API calls and domestic sites. This introduces unnecessary latency and configuration hassle. The dsh-proxy-router plugin uses a local routing proxy to turn “when to use a proxy” into a maintainable rule table.

Core Features

  • Local traffic-splitting proxy: All outbound traffic first hits the local routing proxy, which then decides whether to use the upstream proxy or connect directly based on rules.
  • Web settings page: Provides visual configuration and supports hot reload.
  • Policy matching: Only rule-matched blocked domains go through the upstream proxy; the rest (domestic, intranet, and unknown) connect directly.
  • Coverage: Supports Main-process fetch(), the web_fetch tool, and bash subprocesses (curl, git, etc.).
  • Rule layers: Supports local rule files (highest priority), remote blocklists (Loyalsoldier/clash-rules, gfw.txt, greatfire.txt), and built-in seed lists.
  • Secure defaults: Loopback and LAN addresses always connect directly.

Installation and Enabling

Install the plugin using the official command:

dsh plugin --profile web add @yangzhe1991/dsh-proxy-router

After installation, restart dsh web. By default, the plugin is disabled (Master Switch off), so it does not listen on a port or take over proxy policy; network behavior remains the same as before installation. To use traffic splitting, manually enable it in the settings page.

Configuration and Usage

Settings Page Configuration

Find the Routing Proxy section in the Settings sidebar. The main configuration items are as follows:

  • Enable routing proxy (Master switch): Disabled by default. When enabled, the plugin takes over traffic; when disabled, it restores the previous state.
  • Upstream proxy: Enter the upstream proxy address, such as http://192.168.3.47:12801. If left blank, the plugin falls back to the https_proxy or http_proxy environment variables.
  • Route when nothing matches (Default route): When no rule matches, use a direct connection by default.
  • Local router bind address (Listen address): The local address bound by the plugin. For security reasons, only Loopback addresses (e.g., 127.0.0.1:17890) are allowed. If the port is occupied, it automatically falls back to a random port; if set to 0, the OS selects a port.
  • Connect timeout (Connection timeout): Affects only connection establishment, not streaming responses.

Local Rule Editing

At the bottom of the settings page, you can directly edit the local rule file ~/.dsh/proxy-router/rules.txt. Rules are matched line by line and have the highest priority.

# 注释以 # 开头
proxy: some-blocked-site.com    # 命中规则走上游
direct: cdn.example.cn          # 命中规则直连
example.com                     # 无类型默认走上游
1.2.3.4                         # 支持 IP

Wildcards (*.example.com, .example.com) and dnsmasq-style server=/example.com/114.114.114.114 are supported.

How It Works

The traffic flow is as follows:

DSH main process / web_fetch / bash
        │
        ▼
Local routing proxy (127.0.0.1:17890)
        ├── 匹配本地规则文件
        ├── 匹配远程块列表
        ├── 匹配内置种子列表
        └── 默认路由

Rule layers are matched in order, from highest to lowest priority: local rules > remote lists > built-in lists > default route. Loopback (127.0.0.0/8), intranet addresses (10/8, 172.16/12, 192.168/16), and single-label hostnames (e.g., nas) are never forwarded to the upstream proxy.

Notes

  • Disabled by default: It must be manually enabled in the settings page after installation.
  • Security: The local proxy binds only to Loopback addresses. Binding to 0.0.0.0 or LAN addresses is prohibited to prevent exposing an open proxy.
  • Hot activation: Configuration items are volatile; changes take effect immediately without restarting the process.

dsh-proxy-router manages proxy behavior through a rule table, separating the upstream proxy address from routing policy. It is suitable for scenarios requiring fine-grained control of proxied traffic.

GitHub repository