dsh-custom-header

DeepSeek Harness does not expose a per-request header hook, yet controlling outbound HTTP headers is often essential when you need to present a specific client identity—Codex, Claude Code, opencode—to an LLM provider. dsh-custom-header sits at the fetch transport layer, one layer below the LLM SDK, and inserts a shared middleware pipeline so every outgoing provider request can be shaped without touching upper-level logic.

The plugin ships nine preset profiles that faithfully replicate the exact header sets of real Codex desktop, CLI, TUI, Claude Code plugin, pi agent, and opencode clients. Beyond header injection it strips X-Stainless SDK fingerprint headers, rewrites request URLs via path matching and appendQuery, and patches Anthropic Messages request bodies with identity or billing system blocks. Every modification is gated by an explicit host allowlist, and the safe default (auto profile with an empty allowlist) passes all requests through completely untouched. Per-conversation session scoping uses AsyncLocalStorage so that x-opencode-session and X-Claude-Code-Session-Id stay isolated even when multiple agents run concurrently in a single process.

This plugin is designed for administrators or authorized users of a DSH gateway who need to present provider-specific client identities, remove SDK fingerprints to pass edge checks, or restructure Anthropic request payloads for billing and session policies. If you simply call DSH without header-level concerns, leave the defaults and the plugin is effectively invisible. When a 403 response appears, the stream observer logs a clear distinction between Cloudflare HTML interstitials and JSON rejection responses, making root-cause identification straightforward.