dsh-web-fetch-proxy

If your proxy stack uses fake-ip or TUN-mode DNS, every hostname resolves into the 198.18.0.0/15 reserved range, and DSH's built-in web_fetch provider hard-checks for public unicast IPs before connecting, so every page request fails with resolves to a non-public IP address. dsh-web-fetch-proxy exists for exactly this scenario: it registers a new provider (id http-proxy) on ctx.web that routes all outbound requests through an explicitly configured HTTP(S) proxy built on undici ProxyAgent, delegating DNS resolution and network egress entirely to the proxy side. No DSH core files are touched; the extension is purely a registry entry, and removing two profile patches restores the built-in provider.

Security semantics stay aligned with the built-in provider: no cookies, no ambient credentials, no embedded URL credentials, same-origin redirect following only, 5 MiB byte cap, 30 s timeout, 5-hop limit. The one difference is that local DNS validation is skipped. Your proxy address is the trust boundary, and whatever it resolves and routes is what you get. Missing or invalid configuration fails loudly with no hidden environment-variable fallback. Error codes follow the ctx.web seam vocabulary (WEB_FETCH_TIMEOUT, WEB_REDIRECT_BLOCKED, etc.) and are surfaced as isError results without interrupting the session.

It suits developers who run a fake-ip or TUN DNS proxy and still need reliable page fetching inside DSH, as well as teams that want the egress path to be explicit and auditable. The plugin does not promise HMR; after swapping candidates, restart the affected profile and hard-refresh the GUI.