dsh-header-injection

When DSH calls third-party inference gateways with its default deepseek-harness User-Agent, WAFs that fingerprint the client will typically reject the request outright. The traditional workaround is a sidecar proxy—an extra process, an extra port, an extra failure mode to debug. dsh-header-injection collapses all of that into a single global fetch patch applied once at startup: every API client created afterwards automatically carries the headers you specify, with no subprocess, no additional port, and no build step.

The core model is multi-rule host-suffix matching with set-semantics override. Each rule pairs a comma-separated list of host suffixes (subdomains match automatically) with a multi-line block of header-name/value pairs. Requests walk the rules in order and the first hit wins; same-named headers are overridden via Headers.set, header names are case-insensitive, headers a rule does not mention are left untouched, and unmatched requests pass through unmodified. The built-in settings panel lets you add, edit, or delete rules visually, and changes take effect immediately without restarting the backend. When the settings service is unavailable, the plugin falls back to environment-variable configuration.

If you run DSH against WAF-protected gateways such as AgentRouter, need per-domain header customization, and would rather not maintain a proxy process, this plugin is the lightest path to getting unblocked.