Introduction¶

The default outbound network for DSH (DeepSeek Harness) follows the network policy at startup, typically a direct connection. When you need to temporarily direct Model API, web_search, web_fetch, MCP, plugin downloads, and bash subprocess traffic to a proxy, the common practice is to modify the system proxy or the .env file, then restart the process. The problem with changing the system proxy is that other programs on the same machine (browsers, NAS services) are also affected; changing .env requires a restart and cannot be switched on-demand at runtime.

dsh-proxy-gate solves this problem: using the /proxy command in the plugin settings page or a session, you can one-click switch the DSH process’s outbound proxy without changing the system proxy, modifying .env, or restarting DSH, ensuring other programs on the same machine remain directly connected.

What is it¶

dsh-proxy-gate is a DSH plugin maintained by elliotsu1107, categorized as a networking tool, with a directory page on the community site SkillHub. It only affects the traffic of the DSH process itself: when enabled, it replaces the undici global dispatcher with one pointing to the specified proxy; when disabled, it restores the network policy used at DSH startup.

There are two points that need to be clarified first:

• It is not a system proxy switch; other programs on the NAS are not affected.
• It modifies runtime state. The command will error directly if the address is invalid, without silently falling back to direct connection.

Installation and Activation¶

The installation command provided in the README is:

dsh plugin --profile web add "$PWD" --ignore-scripts

It can also be installed via plugin_manager pointing to the current directory with ID include:proxy-gate. It is recommended to read the source code before installing or uninstalling. Runtime dependencies are resolved from DSH, installing @deepseek-ai/dsh-http-proxy and @deepseek-ai/schemastery, both of which are optional peerDependencies. There are no third-party runtime dependencies.

After installation, open Settings → Plugins → Outbound Proxy. The top of the panel is the status capsule (Enabled / Disabled / Enabled (Not effective)). Below is the proxy address input field and the ‘Enable Proxy’ / ‘Disable Proxy’ buttons, as well as ‘Test Connectivity’. The panel reads and writes to the same configuration as the /proxy command, and operations are visible on both sides. The panel refreshes the status every 2.5 seconds.

The uninstall command is:

dsh plugin --profile web remove dsh-proxy-gate

During uninstallation, the plugin’s dispose calls the restore function obtained during installation, restoring the process’s original dispatcher and environment variables.

Typical Usage¶

The route below does not rely on a graphical interface and is suitable for scripting or headless environments.

1. View current status. The current exit comes from DSH’s own routing judgment proxyRouteFor, using the same logic as real requests, not reading environment variables:

/proxy
# or
/proxy status

2. Set proxy address and enable:

/proxy set http://192.168.1.100:7890
/proxy on

http:// can be omitted. The proxy address can be another machine on the LAN, for example, a router or virtual machine running Clash in the same network segment.

3. Perform a connectivity test by making an HTTP request through the current channel to output the status code, duration, and response snippet:

/proxy test
# You can also specify a URL
/proxy test https://www.google.com

4. Disable proxy and restore direct connection:

/proxy off

/proxy off remains usable when the proxy is down: the command is executed on the Host side and does not go through the model; the Web UI reverts to loopback direct connection.

Configuration¶

Configuration items can be modified in the plugin settings or used via commands. All four fields are volatile, taking effect immediately after saving without needing to restart the plugin:

Behavioral Details¶

There are a few edge cases worth knowing before using.

• Loopback addresses (localhost / 127.0.0.1 / ::1 / [::1]) are always directly connected; the Web UI does not route them through the proxy.
• Child processes (bash tools, curl, git, pnpm) inherit the same strategy via proxyEnvironmentForChild(), with HTTP_PROXY/HTTPS_PROXY/NO_PROXY written regardless of case.
• When the proxy is unreachable, the plugin will not automatically change the configuration; you need to manually /proxy off to return to direct connection or /proxy set to switch proxies.

The README records two verification methods for reference: unit tests node --test test/*.test.mjs (total of 6 items, covering address validation, volatile reading, enable/disable/invalid address/release state machine); manual switch using a temporary proxy started on the local machine for comparison. After enabling, child process environment appears with HTTP_PROXY/HTTPS_PROXY=http://127.0.0.1:18090 and NO_PROXY=localhost,127.0.0.1,::1,[::1]. The comparison proxy records the CONNECT for model API domains and test requests. After disabling, these variables disappear and the comparison proxy no longer receives new connections. As of the current README, the author also marks unverified parts: the actual execution result of /proxy after manual submission in the chat box, and the actual rendering and interaction of the panel in the browser.

Use Cases and Notes¶

Suitable for scenarios requiring temporary switching of outbound channels at runtime: Model API and tool calls want to go through a proxy without affecting other programs on the same machine; or the proxy source changes frequently and you don’t want to modify .env to restart the process.

There are three things to note. First, the plugin runs with the permissions of the current DSH process and can control all outbound traffic within the process, including environment variables for bash child processes. Its permissions are greater than they appear, so you should check the source code and license before installing. Second, proxyUrl only supports http(s). SOCKS, embedded username/password, and addresses with paths will be rejected; confirm the proxy type matches before using. Third, the community directory is an independent site with no official affiliation with DeepSeek or Huafan. Installation and versioning are based on the GitHub repository.

Links and Documentation¶

• Directory page: https://www.skillhub.cn/plugins/elliotsu1107/dsh-proxy-gate
• GitHub: https://github.com/elliotsu1107/dsh-proxy-gate
• Project documentation: https://github.com/elliotsu1107/dsh-proxy-gate/blob/main/docs/README.md
• Changelog: https://github.com/elliotsu1107/dsh-proxy-gate/blob/main/CHANGELOG.md