dsh-proxy-routing

English | 中文

A DeepSeek Harness egress-routing plugin that connects to an already running HTTP or SOCKS5 proxy in the environment, routing shell commands and LLM provider traffic per execution without mutating the host process environment.

This plugin does not provide proxy functionality. It does not create a proxy service, manage nodes or subscriptions, or implement split-routing rules. An accessible HTTP or SOCKS5 proxy endpoint must already exist before using it.

Overview

• Connects to an existing local HTTP (including CONNECT) or SOCKS5 proxy.
• Keeps direct connection as the default. NO_PROXY excludes loopback addresses and api.deepseek.com by default.
• Routes foreground and background Bash/PowerShell subprocesses, including nested git, curl, npm, and pnpm commands.
• Applies provider-specific routes to LLM streams while isolating concurrent direct and proxied requests.
• Persists configuration through the official proxy-routing settings namespace in $DSH_HOME/settings.yaml and applies changes without restarting DSH.
• Requires human approval for enabling or disabling a proxy route (except under the Full Access permission tier).

Pain Points and Use Cases

Concrete examples

Scenario	Direct-connection pain point	What this plugin does
gh repo clone, git clone from GitHub	Failed to connect to github.com port 443: Connection timed out	After enabling, every git/gh subprocess the Agent spawns inherits HTTP(S)_PROXY; no ~/.gitconfig or git config http.proxy changes
curl/wget downloads of external files	Downloads hang or drop (connect timed out)	Command-line subprocesses started by DSH inherit the injected proxy environment for both foreground and background runs
Agent installs dependencies with npm/pnpm/cargo	ETIMEDOUT, ESOCKETTIMEDOUT, interrupted downloads	Dependency-install subprocesses go through the proxy automatically; prefer package mirrors when available
LLM provider API domains blocked or rate-limited	Interrupted streaming, provider unreachable	Configure a per-provider proxy route without touching direct traffic
docker pull image pulls	dial tcp ... i/o timeout, net/http: TLS handshake timeout	Not applicable: the Docker daemon performs image pulls, not this plugin; configure the proxy or a registry mirror in Docker Desktop / the daemon

Not applicable

• Docker daemon image pulls and BuildKit-side network traffic.
• Programs that ignore proxy environment variables, such as browsers and WinHTTP/WinINET applications.
• Providing a proxy service: this plugin only connects to a proxy already running in the environment.

Install

For development or local use, add the plugin directory to the profile's cordis.patch.yml using an absolute path:

- insert:
    - id: proxy-routing
      name: '/path/to/dsh-proxy-routing'

After release:

dsh plugin --profile web add github:<owner>/dsh-proxy-routing

Restart DSH after installation so the plugin can load and register the net_proxy_* tools.

Configuration

Default state

A new v2 settings namespace resolves to a default structure that works out of the box in direct mode:

…