dsh-http

A generic HTTP/API client plugin for DeepSeek Harness (DSH), built as a dynamic Cordis plugin. It gives the agent one http_request model tool for arbitrary HTTP calls — any method, custom headers, JSON or text bodies, timeouts, redirect policies, and response truncation.

No npm dependencies. Requests run in a tiny subprocess driver that uses Node's built-in fetch (Node ≥ 22), speaking a JSON-lines protocol on stdio.

What it does

Piece	Where	Role
http-driver.mjs	spawned subprocess	One request at a time over Node's global fetch; returns status, headers, body, byte count, elapsed time
Host half (host-half.js)	DSH host process	Spawns/restarts the driver, registers the http_request tool

DSH agent ──http_request──▶ host half ──stdio JSON──▶ http-driver.mjs ──fetch──▶ any HTTP(S) endpoint

Requirements

• DeepSeek Harness with the dynamic-Cordis extension (the cordis_define / cordis_run tools)
• Node.js ≥ 22 (global fetch)

Install

1. Place this repo somewhere on the machine, e.g. C:\dsh-http.

2. In host-half.js, set the DRIVER constant to the absolute path of http-driver.mjs on your machine:

   const DRIVER = 'C:\\dsh-http\\http-driver.mjs'
   

3. In your DSH session, define the plugin — paste the entire content of host-half.js into code.host (there is no Client half, so code.client is omitted and no approval is needed):

   cordis_define(plugin: { kind: "new", idPrefix: "http" },
                 name: "dsh-http",
                 purpose: "Generic HTTP/API client: http_request tool",
                 code: { host: <host-half.js> })
   cordis_run(pluginId, packageId, mode: "run")
   

4. Smoke-test the driver standalone any time:

   node http-driver.mjs --selftest
   

Tool

Tool	What it does
http_request	Arbitrary HTTP call. Params: method (GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS), url, headers (object), json (serialized to body, sets Content-Type) or body (raw text), timeoutMs (default 30 s, max 120 s), maxBytes (response truncation, default 100 KB, max 2 MB), redirect (follow/manual/error). Returns {status, statusText, finalUrl, headers, body, bytes, truncated, elapsedMs}

Privacy & safety

• Everything runs locally: requests are issued by a local Node process; no telemetry, no remote control, no persistence of responses.
• The agent can reach any URL, including localhost services — treat this like giving the agent a network client (standard SSRF caution for whatever the agent is allowed to do).
• Responses are text-only in this version; binary payloads are truncated as text and marked truncated: true.

Known limitations

• One request at a time (serialized through the driver).
• No streaming, no multipart uploads, no cookies jar (stateless requests only).
• The dynamic host sandbox has no process/env, so the driver path must be a literal in host-half.js.

License

MIT