Overview
dsh-fakeip-http
README / EN
Package documentation
Registry summary
dsh.pub verifies the pinned bundle contract, runtime facts, and distribution semantics. The complete README remains in the source repository.
Read the full README on GitHubLIMITATIONS
Known limitations
- It wraps only the built-in `http` fetch provider. If `web.fetchProvider` is changed, the plugin has no effect. - It only affects `web_fetch`. `web_search`, model requests, MCP servers, and other HTTP clients do their own resolution and do not need this plugin. - If the forwarder maps a public name to a private address, that is the forwarder's policy. The plugin stops the application from directly reaching private space; it does not audit the forwarder's rules. - It depends on `resolveAddresses` being an own property of the provider instance. A Harness release that changes that internal structure requires a plugin update. The better long-term fix is an upstream `fakeIp` config in `dsh-web-fetch-http` (see below). - A synthetic range that is not routed by the TUN will fail at connect time. That is a forwarder configuration problem, not a policy failure. - Split DNS that returns both fake and real answers for one name is refused by design; fix the split-horizon rule instead of forcing the plugin to guess.