dsh-http-tools

HTTP / API debugging tools for DeepSeek Harness (DSH).

dsh-http-tools gives your DeepSeek Harness agent a complete REST client: send any request with full control over method, headers, body, and auth, paste a curl command and let the agent run or tweak it, and review or compare past requests — all inside the chat.

Comes with an optional UI companion package (dsh-http-tools-ui) that renders every http_request / curl_parse call as a DeepSeek-branded card in the web UI.

Features

• http_request — full REST client: GET/POST/PUT/PATCH/DELETE/HEAD, custom headers, body, basic/bearer auth. Returns status, duration, size, response headers, truncated body, and an equivalent redacted curl command.
• curl_parse — parse a curl command into structured parts, or execute it in one step (execute: true).
• request_history — query in-session requests, inspect one, or diff two responses.
• Pagination-aware — the Link response header is surfaced to the model, so it can follow rel="next" / rel="last" without re-reading raw headers.
• Preview-slimmed logging — persisted session logs carry a 6000-char body preview, so logs stay readable as request volume grows.
• DeepSeek-branded UI cards (with dsh-http-tools-ui) — fish logo, brand-colored method badge, official state dot (running chase animation), theme-aware colors, collapsible JSON body (JsonTree), and copy-body / copy-curl buttons.

Tools

Tool	Description
http_request	Send an HTTP request (GET/POST/PUT/PATCH/DELETE/HEAD) with custom headers, body, and auth. Returns status, duration, size, response headers, truncated body, and an equivalent curl command.
curl_parse	Parse a curl command into its structured parts (method, URL, headers, body, auth). Optionally execute it in one step with execute: true.
request_history	Query requests made in the current session, inspect one in detail, or compare two responses side by side.

Install

dsh plugin --profile web add dsh-http-tools
# optional: DeepSeek-branded UI cards for the web client
dsh plugin --profile web add dsh-http-tools-ui

Works out of the box with zero configuration. Node.js >= 22 is required (uses the native fetch).

UI cards

dsh-http-tools-ui is a separate package that registers keyed tool views for http_request and curl_parse. Once installed, each call renders as a card in the conversation:

• Fish logo + brand-colored method badge (GET / POST / …)
• Official state dot: green on success, amber on non-2xx, red on error, animated chase while running
• Status · duration · size · truncated summary on the row head
• Expandable response: key headers inline, JSON body as a collapsible tree (with copy actions), non-JSON bodies as text
• Copy / Copy curl buttons, all colors theme-aware (--dsw-* tokens)

Try it

Tell your agent things like:

用 http_request 调 https://api.github.com/repos/deepseek-ai/deepseek-harness 看看 star 数

POST https://httpbin.org/post，body 传 {"hello":"world"}，看看返回什么

粘贴这个 curl 命令解析一下，然后改个 header 再重发：
curl -X POST https://api.example.com/v1/users -H "Content-Type: application/json" -d '{"name":"ada"}'

用 request_history 对比 #1 和 #3 两次请求的响应差异

Configuration

All options are optional. Set them in your profile's cordis.patch.yml:

- id: http-tools
  name: dsh-http-tools
  config:
    maxBodyChars: 524288   # cap on response body characters returned to the model
    timeoutMs: 10000       # per-request timeout in milliseconds
    blockedHosts: []       # hostnames the plugin refuses to contact (e.g. ['169.254.169.254'])
    localOnly: false       # true = only loopback / private-network targets
    historyLimit: 50       # in-session request history retention
    auditHeader: true      # tag every request with an X-DSH-Request audit header

Security model

• By default every URL is allowed; the request is tagged with an X-DSH-Request audit header so the server can identify agent traffic.
• blockedHosts rejects exact hostnames and their subdomains before any network I/O (e.g. block cloud metadata endpoints like 169.254.169.254).
• localOnly: true restricts requests to loopback and private networks — a one-switch "local debugging mode".
• Response bodies are capped at maxBodyChars (default 512 KB) and timeouts at timeoutMs (default 10 s) so a runaway call can never flood the model context.
• Credentials (Bearer tokens, basic-auth pairs) are sent only as request headers. Generated curl commands redact authorization, cookie, proxy-authorization, and x-api-key values as ***, so secrets do not leak into session logs or request history.

Development

pnpm install
pnpm test          # vitest unit tests
pnpm run typecheck
pnpm run build     # tsdown -> lib/
pnpm --filter dsh-http-tools-ui run build   # UI client bundle -> ui/lib/

To smoke-test against a local DeepSeek Harness checkout, mount the built plugin with a patch overlay that references the built file:

pnpm run build

# http-tools.patch.yml — reference the built entry
# (on Windows, absolute paths must be file:// URLs, percent-encoded)
- insert:
  - id: http-tools
    name: /absolute/path/to/dsh-http-tools/lib/index.js   # POSIX
    # name: file:///C:/Users/.../dsh-http-tools/lib/index.js   # Windows

# from the deepseek-harness repo root:
pnpm dsh web --patch /absolute/path/to/http-tools.patch.yml

License

MIT