dsh-webstack

Local reasoning models locked into 32k-to-90k token windows still need real web access, yet the typical setup hits three walls at once: tool parameters that bloat the context, static fetching that dies at anti-bot walls, and SSRF or cross-origin redirect risks nobody intercepts. dsh-webstack folds all three into a single transparent layer. The model sees only the native web_search and web_fetch interfaces; every stealth flag, scraping parameter, and DNS validation stays encapsulated inside the provider, invisible to the reasoning loop.

On the retrieval side, SearXNG powers metasearch discovery while a three-tier Scrapling pipeline escalates automatically with target complexity. Tier 1 uses curl_cffi with a Chrome TLS fingerprint to grab documentation, GitHub, Wikipedia, and REST endpoints at roughly 531 ms mean latency. When the target is a client-rendered SPA built on React, Vue, or Next.js, the pipeline shifts to Tier 2 Playwright headless Chrome. Cloudflare Turnstile and interactive WAF challenges route to Tier 3 StealthyFetcher, which includes a Turnstile coordinate-humansation click solver, canvas noise injection, WebRTC IP-leak suppression, genuine WebGL contexts, and blocking of roughly 3,500 tracker domains. Security runs pre-flight: every request undergoes DNS address validation before a single byte leaves the machine, immediately denying loopback, RFC 1918, link-local, and cloud-metadata endpoints, rejecting split-horizon hostnames, and terminating cross-origin or cross-protocol redirects with a hard WEB_REDIRECT_BLOCKED verdict, all with zero additional DNS latency.

This is built for developers running Qwen 2.5/3.8 27B, DeepSeek R1/V3, or similar local models inside DeepSeek Harness who want the model to search and read the web naturally without context pollution. Once SearXNG and Scrapling are deployed and the cordis.patch.yml layer is mounted, the model issues web queries the same way it calls any local tool, while engine selection, anti-bot countermeasures, and security filtering run silently underneath, keeping the context clean and the tool list lean.