dsh-outbound-proxy

让 DeepSeek Harness 的出站 HTTP(S) 请求走本机 HTTP 代理（Clash / mihomo 等）。端口跟随启动环境，插件行可单独覆盖。

安装

dsh plugin --profile desktop add github:Dax233/dsh-outbound-proxy

也可在 DSH 插件页添加该 GitHub 地址，安装后重启 DSH Desktop。

配置见 INSTALL.md 与 env/proxy.env 示例；默认代理 http://127.0.0.1:7890。

@local/dsh-outbound-proxy

Host plugin for DeepSeek Harness that installs an outbound HTTP proxy policy in
the running Host process.

Why

The Harness resolves its proxy policy once from the launch environment. A
desktop launch without HTTP_PROXY / HTTPS_PROXY leaves every Node-side
request (web_fetch, HTTP MCP transports, account calls) connecting directly.
On a machine whose DNS answers come from a Clash-style fake-IP pool
(198.18.0.0/15), web_fetch refuses the request before it is sent:

URL hostname "www.google.com" resolves to a non-public IP address

What

The plugin calls installProxyFromEnvironment from
@deepseek-ai/dsh-http-proxy with the configured proxy URL. That replaces
undici's global dispatcher, which web_fetch consults through proxyRouteFor;
requests then tunnel through the proxy, which resolves the origin itself, so the
local fake-IP answer no longer matters. The installer also publishes the policy
through HTTP_PROXY/HTTPS_PROXY/NO_PROXY for child processes.

The module is imported from the Host's own runtime by file URL, so it is the
same instance web_fetch already uses — not a second, disconnected copy.
Candidates are derived from the launched script and its ancestor directories
(the desktop Host passes the runtime root as process.argv[2]), then resolved
through the runtime's own Node resolution. No installation path is hard-coded.

Loopback traffic always stays direct. Hosts in noProxy keep their direct route
(model provider, account API), so stopping the proxy cannot strand a session.

Configuration

Invalid explicit configuration fails activation with a message instead of
silently connecting directly.

Which port is used

The local mixed port differs per machine and per proxy client (Clash for
Windows defaults to 7890, Clash Verge to 7897, others differ again), so the
plugin resolves the URL at mount time instead of baking one port into the
bundle:

1. config.proxyUrl in the row — an explicit per-device override, validated;
2. https_proxy / HTTPS_PROXY / http_proxy / HTTP_PROXY from the launch
   environment — on the desktop that is %USERPROFILE%\.dsh\.env, which the
   launcher reads once at Host start; unusable entries are skipped;
3. http://127.0.0.1:7890 — the Clash for Windows default, only when neither
   of the above names a proxy.

The Host console line states which one won:

[outbound-proxy] installed http://127.0.0.1:7897 (noProxy=deepseek.com,opencode.ai, source=environment:https_proxy)

To set another port on a device, either put it in ~/.dsh/.env
(env/proxy.env in this repository is a template) or add proxyUrl to the
row — see INSTALL.md.

Files

• index.js — Host plugin (apply, URL resolution, validation, module location).
• cordis.patch.yml — inserts the outbound-proxy row; leaves proxyUrl out so
  each device follows its own environment, and sets the direct-connect list
  (deepseek.com,opencode.ai).
• locale/{en,zh}.json — display title/description.
• icon.svg — plugin icon.
• INSTALL.md — install/verify/uninstall notes.