dsh-provider-proxy

DeepSeek Harness LLM middleware that sends only selected provider routes through an HTTP or HTTPS forward proxy. Other providers keep using the normal network path, including when requests run concurrently.

The plugin targets DSH 0.1.1-rc.2 and Node ^22.19.0 || >=24. It is useful when HTTP_PROXY plus NODE_USE_ENV_PROXY=1 is too broad because that switch changes networking for the whole DSH process.

Install

dsh plugin --profile web add /absolute/path/to/dsh-provider-proxy

The package installs as a DSH bundle but stays dormant until a provider proxy is enabled.

Settings UI

After restarting dsh web, open Settings → Provider 代理. Every available provider has its own:

• on/off switch;
• proxy URL or proxy-URL environment variable;
• optional proxy-authorization environment variable;
• save and reset controls.

Turning a switch off takes effect for new requests immediately and retains the fields for later use. Streams already in progress are allowed to finish on the dispatcher they started with. No YAML edit or DSH restart is required for settings changes.

Configure one provider

Edit $DSH_HOME/profiles/web/cordis.patch.yml:

- id: provider-proxy
  config:
    providers:
      openrouter:
        enabled: true
        proxyUrl: http://127.0.0.1:7890

The key under providers must be the DSH provider route, not the upstream hostname or model name. For example, a request whose selection is openrouter / anthropic/claude-... uses the openrouter key.

To keep the proxy URL outside the profile:

- id: provider-proxy
  config:
    providers:
      anthropic:
        enabled: true
        proxyUrlEnv: DSH_ANTHROPIC_PROXY_URL

Then start DSH from a shell containing:

export DSH_ANTHROPIC_PROXY_URL=http://127.0.0.1:7890
dsh web

For an authenticated proxy, keep the authorization header in another environment variable:

- id: provider-proxy
  config:
    providers:
      anthropic:
        enabled: true
        proxyUrl: https://proxy.example.com:8443
        proxyAuthorizationEnv: DSH_ANTHROPIC_PROXY_AUTH

DSH_ANTHROPIC_PROXY_AUTH contains the complete Proxy-Authorization value, for example Basic <base64-user-colon-password>. Credentials embedded in a proxy URL are rejected so they cannot appear in profile dumps.

Set enabled: false (or turn off the UI switch) to keep a provider direct without deleting its proxy fields.

Scope and limitations

• Supports HTTP and HTTPS forward proxies using Undici ProxyAgent.
• Does not support SOCKS or PAC proxy URLs.
• Covers provider implementations that use globalThis.fetch, including the native DSH DeepSeek adapter and the common fetch-based pi-ai providers.
• Also wraps DSH's llm.discoverModels() path, so Models → “Fetch available models” uses the selected Provider's proxy when that request names a provider route.
• If that Provider already has a non-empty static models list, DSH returns the catalog without network I/O by design; clear that list when you want to probe the provider endpoint and observe the proxy connection.
• It does not rewrite baseURL. API relays/reverse proxies should be configured directly on the provider instead.
• Provider SDKs that bypass Fetch and open sockets directly need a dedicated transport integration; this middleware deliberately does not enable a process-wide proxy fallback.