dsh-cliproxy
Routes cliproxy-claude and cliproxy-openai in DeepSeek Harness through one local CLIProxyAPI instance, so the agent reaches your own CLI subscriptions over an OpenAI-compatible endpoint.
Install
dsh plugin --profile web add github:DevViking-Persike/dsh-cliproxy
Restart dsh. Both routes appear in the model catalog once a key is available.
Requirements
- A running CLIProxyAPI instance. The default endpoint is
http://127.0.0.1:8317/v1.
- The proxy's API key, read per request from
CLIPROXY_API_KEY — through the harness credential store when one is mounted, otherwise from the environment.
Without a key the routes still mount; each model call fails with MISSING_CREDENTIAL naming the variable to set. That is deliberate: a credential is not a load-time fact, and a rotated key must take effect on the next call rather than at the next restart.
Configuration
Every field is optional.
| Field | Default | Meaning |
|---|
baseURL | http://127.0.0.1:8317/v1 | Endpoint including the /v1 prefix. |
apiKeyEnv | CLIPROXY_API_KEY | Credential reference and environment variable holding the proxy key. |
claudeModels | six Claude entries | Catalog for cliproxy-claude. A supplied array replaces the default. |
openaiModels | five GPT entries | Catalog for cliproxy-openai. |
streamIdleTimeoutMs | 300000 | Budget between reads before the transport gives up. |
defaultContextWindow | 200000 | Context assumed for a model absent from the catalog. |
maxTokens | 32000 | Output cap when neither request nor catalog states one. |
retryPolicy | normal, 3 retries | Merged over the default; read field by field by the harness retry plugin. |
- id: dsh-cliproxy
name: 'dsh-cliproxy'
config:
baseURL: http://127.0.0.1:8317/v1
claudeModels:
- id: claude-opus-5
name: Claude Opus 5
contextWindow: 1000000
maxTokens: 128000
A supplied catalog replaces rather than merges: naming three models means those three, and merging would silently reintroduce models your proxy does not serve.
Model Experience
The adapter is transparent to the model: it registers provider routes and streams responses, adding no tool, prompt section, or context.
What it does affect is accounting. Usage counts are reported disjoint — inputTokens excludes cache reads, which the wire reports inside prompt_tokens. Passing the raw number through would double-count every cache hit in the cost display.
Text only. Image content is refused before any request is sent, because the serialization path would otherwise drop it and the model would answer a question it never saw.
Safety
- The key is read per request and never enters an error message; a key that cannot be sent as a header names the reference, not the value.
- A truncated stream raises
STREAM_CLOSED rather than presenting as a normal finish, so a cut-off response is never mistaken for a complete one.
- A
400 whose message names the context window is reported as CONTEXT_WINDOW_EXCEEDED, not INVALID_REQUEST — the caller can recover from one by compacting and not from the other.
- A provider's
retry-after is carried through to the harness retry plugin, so backoff follows the provider's schedule instead of a local guess.
- The idle budget covers silence from the server, not deliberation by the consumer: the timer runs only while a read is outstanding, so a slow reader never trips it.
Known Limitations and Deferred Work
- Version-sensitive by construction. This plugin lives outside the harness repository, which states it makes no compatibility promise before its first release. The chunk vocabulary it emits is therefore verified at load against a fixed payload, and a mismatch refuses to mount with a message naming the drifted field — a renamed field would otherwise corrupt output with nothing reported.
- No image or audio input. The endpoint may accept them; this adapter does not serialize them.
- No
registerConfigurableProviders entry, so the routes do not appear in the settings-driven provider directory. That directory requires a settings namespace whose section configures the route, and this plugin is configured from cordis.yml instead.
- Model catalogs are static configuration, not discovered from the proxy.
listModels reports what is configured; a model your proxy serves but the catalog omits still works when named explicitly, resolving with the default context window.
- The test suite runs entirely against a local
node:http server. It proves this plugin's behavior, not that CLIProxyAPI speaks exactly this dialect — the fixtures encode the harness's belief about the wire, recorded from its own implementation.
Tests
npm install && node --test test/*.test.js
59 tests, no network and no key required. The translator and serializer fixtures are recorded output from the harness's own implementations, so a divergence between this port and the reference fails the suite rather than reaching a model call.
License
MIT — see LICENSE and NOTICE.md.
