us/dsh-crw

README 摘要

dsh-crw fastCRW-backed web search and web fetch for DeepSeek Harness. The harness treats web access as a capability seam ( ctx.web ) with pluggable providers. This package registers two of them under the id crw , so the model keeps the exact same web search / web fetch tools and only the backend changes. Why The base composition ships web search on, and web fetch off . Its own config says why: Fetch stays disabled and no fetch provider is mounted: that provider defers SSRF protection and the model would choose the request target. That is a fair call. The in-box HTTP fetch provider runs fetch() in the harness process, and its README names the gap outright: no blocking of private, loopback, link-local or multicast destinations, no DNS-resolve-then-validate. A model that picks http://169.254.169.254/ gets your cloud metadata endpoint. fastCRW resolves and validates the target server-side and refuses private ranges, so the harness process never opens a connection the model chose. That is what makes turning fetch on reasonable, and it is why fetch: true lives in this bundle rather than upstream. The second reason is that plain HTTP is not how the open web reads any more: URL in-box HTTP…

分类