dsh-whale-dive
Read Bilibili and Douyin from inside DeepSeek Harness: nine model-facing tools, two very different transport problems, one read-only surface.
whale_dive_status pacer health, cool-downs, cookie presence, WBI key age
whale_dive_bili_video one video: metadata, parts, uploader, counters
whale_dive_bili_feed the popular board, or one video's related rail
whale_dive_bili_search keyword search: video / user / article / bangumi
whale_dive_bili_author uploader profile plus a page of their uploads
whale_dive_bili_comments a comment page with each thread's top replies
whale_dive_bili_danmaku the danmaku track of one part
whale_dive_bili_subtitles subtitle tracks per part, bodies when a cookie allows
whale_dive_douyin hot / feed / video / search / status / close
Why two transports
Bilibili answers plain HTTPS — but it signs its newer routes with a rotating w_rid (the "WBI" scheme) and it answers a sustained burst with an IP-scoped HTTP 412 that outlives the burst by minutes. Measured on one machine: 20 threads × 10 requests passed cleanly; 8 threads of mixed view+search+reply for 30 seconds (≈51 req/s) produced 1372 × HTTP 412 out of 2128 requests, and the block was still in force 90 seconds later. So the plugin ships a pacing layer rather than a bare fetch: a token bucket keyed per host, a concurrency cap, and a circuit breaker whose cool-down doubles on each consecutive trip.
The same measurement run also showed which routes survive without a signature, so the plugin prefers those and keeps the signed route as the fallback:
| Route | Signed? | Read by |
|---|
x/web-interface/view | no | bili_video |
x/web-interface/popular | no | bili_feed (popular) |
x/web-interface/related | no | bili_feed (related) |
x/v2/reply | no | bili_comments |
x/player/v2 | no | bili_subtitles |
x/v1/dm/list.so | no | bili_danmaku |
x/web-interface/card | no | bili_author (profile) |
x/relation/stat | no | bili_author (counts) |
x/series/recArchivesByKeywords | no | bili_author (uploads, default order) |
x/web-interface/wbi/search/type | WBI | bili_search |
x/space/wbi/arc/search | WBI | bili_author (uploads, explicit order) |
Douyin cannot be read over HTTP at all. Its API calls carry a_bogus, X-Bogus and __ac_signature, all computed at runtime inside an obfuscated VM, and a plain client gets 403s, empty bodies, or a captcha interstitial. Headless browsers get the captcha too. The only route that works is a real, headful Edge/Chrome whose page computes its own signatures — so whale_dive_douyin launches one in its own profile directory, drives it over the Chrome DevTools Protocol, and reads the rendered DOM.
That path costs several seconds per call, and one detail is not obvious: a window parked off-screen is treated by Chromium as occluded, and an occluded window stops painting — the feed never hydrates and the DOM stays empty. The launcher therefore passes --disable-backgrounding-occluded-windows, --disable-renderer-backgrounding and --disable-background-timer-throttling, which is what makes the parked window actually render.
Install
dsh plugin --profile desktop add dsh-whale-dive
The package ships its own cordis.patch.yml, so the loader row is inserted for you. Nothing else in the composition is touched: no base row config is replaced, no search provider is registered, so this patch cannot collide with another plugin that selects a provider.
Restart DSH after installing — profile changes are picked up at startup.
Configuration
All fields live under the plugin's settings section and are read on every tool call, so an edit applies to the next call without a reload.
| Key | Default | Meaning |
|---|
requestsPerSecond | 4 | Per-host request rate. The measured safe band is 5–10 req/s; 4 leaves headroom. |
burst | 8 | Token-bucket capacity — how much idle time can be spent at once. |
maxConcurrent | 3 | Requests in flight at one time. |
cooldownMs | 120000 | How long one risk signal parks a host. Doubles per consecutive trip. |
maxCooldownMs | 600000 | Ceiling for the doubling cool-down. |
timeoutMs | 20000 | Per-request timeout. |
cookie | "" | A SESSDATA=... string. Only needed for subtitle bodies and the handful of routes that answer -101 without a session. |
douyinBrowser | "" | Explicit path to Edge/Chrome. Empty auto-detects. |
douyinPort | 47821 | DevTools port for the helper browser. |
douyinUserDataDir | "" | Profile directory. Empty uses a temp directory. |
douyinKeepAliveMs | 900000 | How long an idle helper browser stays alive. |
douyinWaitMs | 11000 | Settle time after loadEventFired on Douyin. Not padding — the feed hydrates asynchronously. |
danmakuLimit | 500 | Default cap on danmaku rows. |
commentPageSize | 20 | Default comment page size. |
Douyin sign-in (optional)
hot and feed need no account. Keyword search does: Douyin gates it behind a login wall and shows "登录后即可搜索更多精彩视频" to anonymous visitors. To unlock it, run whale_dive_douyin with action: "video" once — this starts the helper browser — then scan the QR code in the window that appears. The session is stored in the plugin's own profile directory (never your normal browser profile) and reused afterwards.
Output conventions
Two rules run through every tool:
- A field is only ever omitted, never invented. When a surface is gated, the tool still succeeds and explains the gate in
note, because "this is gated and here is the way in" is a useful answer and a thrown error is not.
- Every number is coerced. Upstream sends
null, missing keys and "1.2万", all of which would violate the output schema; each is projected to a typed value before the harness validates it.
Rate-limit failures are the exception: they throw an HttpError with code: "RISK" and risk: true, carrying the cool-down window. That distinction is deliberate — a model that reads "intercepted, stop calling this host" behaves differently from one that reads "request failed" and retries into a longer ban.
Requirements
- DSH
>= 0.2.0-rc.1 < 0.3.0-0
- Node
>= 20 (the Douyin path uses the global WebSocket)
- Microsoft Edge or Google Chrome for the Douyin path; the Bilibili path needs neither
Scope
Both backends are read-only. Nothing here posts, likes, follows or writes.
License
MIT.
