Preface¶

When connecting through an intermediary gateway via the llm-pi-ai provider in DeepSeek Harness, some gateways identify the client based on request headers, while others further validate the request body. If the user-agent explicitly configured on the DSH side is not sent verbatim by the adapter, it may be stripped and overwritten with deepseek-harness/....

dsh-client-masquerade is a DeepSeek Harness plugin that disguises configured llm-pi-ai providers as Claude Code, Codex, or custom header clients. It writes masquerade headers into the provider configuration and sends them with every request; for scenarios requiring request body fingerprinting, it can also inject Claude Code fingerprints into Anthropic protocol request bodies on demand.

What This Is¶

dsh-client-masquerade is maintained by ymh0000123, licensed under MIT, and requires Node >=18.

It targets scenarios where users already use the DSH Web profile and have configured custom model providers through llm-pi-ai routing, addressing two main issues:

1. Client identity headers are not being sent to the upstream gateway as expected.
2. Request headers alone are insufficient, and request body fingerprint validation is required.

Core Features¶

• One-click apply, clear, or switch between Claude Code, Codex, or custom header masquerading for any configured llm-pi-ai provider.
• Writes masquerade headers into the provider configuration’s headers field, which the pi-ai adapter sends verbatim with every request.
• On-demand injection of Claude Code fingerprints into Anthropic protocol request bodies, including metadata.user_id, identity system blocks, and sentinel tool definitions.
• Provides a settings page, the mask_client model tool, and a Run card panel entry in dynamic mode.
• Offers three patches: User-Agent, request body, and vision-toolkit variants.
• The test action makes a real minimal streaming call and reports the request headers the gateway actually received, model responses, or errors.
• The interface supports both Chinese and English, following the Harness language setting.

Installation and Activation¶

Prerequisites¶

First, configure a custom provider in DSH.

Settings → Models → Configure custom provider (llm-pi-ai routing)

If no llm-pi-ai provider is available, the plugin cannot write masquerade configuration to the target provider.

Installation¶

Run the official installation command:

dsh plugin --profile web add github:ymh0000123/dsh-client-masquerade

Patches must be applied after installation. Otherwise, the user-agent explicitly configured in the profile may be stripped and overwritten with deepseek-harness/....

Applying Patches¶

You can click User-Agent Patch → Apply on the settings page, or run the model tool action:

mask_client action=patch

You can also run the patch scripts individually in the profile directory:

node node_modules/dsh-client-masquerade/patches/apply-pi-ai-useragent-patch.mjs
node node_modules/dsh-client-masquerade/patches/apply-pi-ai-body-patch.mjs
node node_modules/dsh-client-masquerade/patches/apply-variant-retry-patch.mjs

All three patches modify third-party package files and require a restart of dsh web to take effect. The patches are idempotent:

dsh web

After running pnpm install or upgrading a patched package, patches need to be re-applied.

Dynamic Plugin Mode¶

If you don’t want a persistent installation, you can use the dynamic plugin approach:

code.host: paste the full content of host.body.js
code.client: paste the full content of client.body.js

Dynamic mode has no filesystem permissions; the settings page only displays patch status, and patch commands still need to be executed manually.

If you previously ran the same code in dynamic plugin mode, disable or delete the dynamic version first to avoid duplicate registration of the settings page entry.

Typical Usage¶

Applying Masquerade¶

Settings page entry:

Settings → Client Masquerade → User-Agent Patch → Apply

Model tool entry:

mask_client action=patch

Clearing Masquerade Headers¶

Settings page entry:

Settings → Client Masquerade → Off

Model tool entry:

mask_client action=off provider=<id>

Testing Requests¶

The test action makes a real minimal streaming call and reports the request headers the gateway actually received, model responses, or errors:

mask_client action=test

Reverting Patches¶

Settings page entry:

Settings → Client Masquerade → Runtime Patches → Revert All

Model tool entry:

mask_client action=unpatch

After reverting patches, restart dsh web as well:

dsh web

Uninstalling the Plugin¶

Run the uninstall command:

dsh plugin --profile web remove dsh-client-masquerade

Uninstalling the plugin does not automatically revert the three patches. The masquerade headers already written to the provider will also remain, requiring individual off commands or manual clearing.

Troubleshooting and Status Diagnosis¶

The results from the test action are suitable for confirming what the gateway actually received.

When encountering 429 / 503, don’t just look at the status code. It may indicate the channel pool is genuinely busy, or it may mean request body fingerprint validation failed. It’s recommended to check in the following order:

1. Whether request body masquerading is enabled.
2. Whether the request body patch has been applied.
3. Whether dsh web has been restarted.
4. Whether the Claude Code preset has been re-applied.

By design, x-claude-code-session-id is not masqueraded.

The values for the claude-code preset come from actual packet captures. After upgrading the plugin, it’s recommended to re-apply the Claude Code preset to avoid continuing to use the old preset.

Applicable Scenarios and Notes¶

Suitable for these usage patterns:

• Using the DSH Web profile.
• Connecting custom models or intermediary gateways through llm-pi-ai providers.
• Gateways identify requests based on Claude Code or Codex client identities.
• Request body fingerprinting is needed, not just header masquerading.

Notes before use:

• The plugin runs with the current dsh process permissions. Review the source code and license before installation. This plugin is licensed under MIT.
• All three patches modify third-party package files, requiring a restart of dsh web to take effect, and the patches are idempotent.
• After running pnpm install or upgrading a patched package, patches need to be re-applied.
• Uninstalling the plugin does not automatically revert patches, and masquerade headers already written to the provider will remain.
• engines.node requires >=18.
• peerDependencies include @deepseek-ai/cordis, @deepseek-ai/dsh-llm, @deepseek-ai/dsh-settings, and @deepseek-ai/dsh-tools; the latter three are marked as optional.

Links¶

GitHub repository:

https://github.com/ymh0000123/dsh-client-masquerade