Foreword

In DeepSeek Harness (DSH) usage scenarios, you may need to route specific provider traffic through a proxy server while keeping other traffic direct. Global proxy configuration is often not granular enough. The dsh-provider-proxy plugin solves this by allowing proxy parameters to be configured separately for each provider on the settings page.

What It Is

dsh-provider-proxy is a plugin that makes providers use a proxy. It belongs to the Network Tools category, is maintained by hpfs0, has 1 star, and is licensed under MIT.

Installation and Enabling

Before installation, ensure the build artifacts (lib/index.js and lib/client.js) have been built. The desktop version must be fully opened once to initialize the profile.

dsh plugin --profile desktop add dsh-provider-proxy
dsh plugin --profile web add dsh-provider-proxy

After installation, restart the corresponding app. The settings are written to $DSH_HOME/profiles/<profile>/cordis.patch.yml.

Core Features

  • Independent configuration: Configure whether each provider uses a proxy individually; the other providers and other DSH traffic remain direct.
  • Proxy types: Supports HTTP, HTTPS, and SOCKS5 proxy types.
  • Domain rules: Supports specifying target domains using onlyHosts and bypassHosts rules.
  • Web search: Supports proxy routing for the Web Search card.
  • Connection self-check: Supports a connection self-test; click the test button to verify proxy connectivity.
  • Independent dispatching: Implements an independent dispatcher for each provider based on AsyncLocalStorage.

Usage

  1. Open Settings and find Provider Proxy in the left navigation.
  2. The page lists all activated providers, with one card per provider.
  3. Configure the following in each card:
    - Switch: Controls whether the provider uses a proxy.
    - Type: Select HTTP / HTTPS / SOCKS5.
    - IP / Host: Enter a hostname or IP address without the protocol prefix.
    - Port: An integer between 1 and 65535.
    - Username / Password: Proxy authentication fields; username and password must be entered as a pair.
  4. Advanced settings: Click the “Advanced: Target Domain Rules” collapsible section in the card to configure onlyHosts (proxy only) and bypassHosts (direct connection).
  5. Web Search card: A Web Search card appears in the list. After configuration, web_search tool traffic will be routed through the proxy.
  6. Test connection: On a provider card with proxy enabled, click the test button to verify latency and egress IP.

Known Limitations

  • SOCKS5 limitation: SOCKS5 proxies are implemented by undici’s built-in Socks5ProxyAgent, and the API stability is marked as Experimental.
  • Authentication limitation: Proxy authentication fields username and password must be entered as a pair; entering only one is not supported.
  • Protocol support: SOCKS5 does not support the socks:// alias or SOCKS5 over TLS.
  • DNS resolution: When a host matches bypassHosts, the local machine resolves and connects to the target directly, without going through the proxy.
  • Tool support: web_search can use the proxy; web_fetch does not support it.
  • System compatibility: PAC is not supported, and system proxy settings are not read.
  • Configuration modification: baseURL is not rewritten.
  • Fault tolerance: If the proxy is unreachable, requests fail as usual.
  • Password storage: The password is stored in plaintext with the settings in cordis.patch.yml.

Verification

The plugin itself does not display the egress IP. A reliable way is to check the proxy-side logs, or temporarily change the port to a port that is not being listened on. If the request fails with ECONNREFUSED, it indicates that the request was actually routed through the proxy.

Links