dsh-safe-web-fetch
抗 SSRF 的 HTTP(S) 获取提供程序，适用于 DeepSeek Harness
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-safe-web-fetch@0.1.0-next.0Safe Web Fetch 以 dsh-safe-web-fetch 发布，当前版本为 0.1.0-next.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
dsh-safe-web-fetch gives DeepSeek Harness a safer way to use its web_fetch capability. It plugs into DSH's existing ctx.web service, so it works with the normal tool and profile system instead of introducing a second web-search API.
The idea is simple: a hostname must resolve to a public address before a connection is opened. Each request hop is pinned to the addresses that were checked, redirects stay on the same origin, and responses are kept within predictable size and time limits.
The package includes a DSH bundle, so one command installs it and adds the profile layer:
dsh plugin --profile safe add dsh-safe-web-fetch@next
dsh --profile safe --dump-config
The bundle registers a safe-http provider, enables DSH's existing web_fetch tool, and leaves search on the base profile's provider. For a deployment, pin the version you have tested:
dsh plugin --profile production add dsh-safe-web-fetch@0.1.0-next.0
You can install a reviewed Git revision instead:
dsh plugin --profile safe add github:MostlyHarmlessxyz/dsh-safe-web-fetch#<commit-sha>
Git installs build the package locally. If pnpm asks you to approve that build, follow the profile-specific instruction it prints; an npm package or tarball is the simpler option when you want prebuilt files.
For every fetch, the provider:
*.example.com when subdomains are intended);It does not add cookies, authorization headers, browser state, or request bodies. A public address is not automatically trustworthy content: prompt injection, malware, and HTML sanitization remain application concerns.
The defaults are deliberately modest:
| Option | Default | Maximum |
|---|---|---|
maxUrlLength | 2048 | 16384 |
maxResponseBytes | 5000000 | 100000000 |
maxBodyChars | 100000 | 10000000 |
timeoutMs | 30000 | Node timer limit |
maxRedirects | 5 | 20 |
maxConcurrentRequests | 16 | 128 |
allowHosts, denyHosts, and userAgent are also configurable. DSH replaces a row's complete config when a patch targets it, so include every value you want to keep:
- id: safe-web-fetch
name: dsh-safe-web-fetch
config:
maxUrlLength: 4096
maxResponseBytes: 10000000
maxBodyChars: 200000
timeoutMs: 30000
maxRedirects: 3
maxConcurrentRequests: 8
allowHosts:
- '*.docs.example.com'
denyHosts: []
userAgent: my-company-fetch/1.0
If you mount the function plugin yourself instead of using the bundle, set fetchProvider: safe-http on the web row. When more than one provider is available, always select one by id; DSH will otherwise report WEB_PROVIDER_AMBIGUOUS rather than guessing.
The built-in resolver is raced against the request deadline, but a third-party resolver cannot always be stopped at the operating-system level. A custom resolver or transport is an extension point for tests and trusted integrations, not a way to make an untrusted network client safe.
This package deliberately follows only same-origin redirects and handles text responses. It is not an egress firewall, content scanner, approval screen, or proxy policy. For an organization-wide zero-trust network, keep those controls at the network boundary and use this provider as an additional check.
The published peer range covers DSH 0.1.0-rc.5 through the 0.1.x line and Cordis 4.x. DSH is still a developer preview, so test the exact versions used by your profile.
Requires Node ^22.19.0 or >=24.0.0 and pnpm 11:
pnpm install
pnpm run typecheck
pnpm test
pnpm run build
npm pack --dry-run
The tests include address-range and malformed-DNS cases, redirect revalidation, cancellation, response limits, lifecycle disposal, and a local HTTP server that verifies the socket is pinned while the original Host header is retained.
Release notes and the maintainer checklist live in RELEASE.md. The project is MIT licensed.