dsh-fakeip-http

LIMITATIONS

已知限制

- It wraps only the built-in `http` fetch provider. If `web.fetchProvider` is changed, the plugin has no effect. - It only affects `web_fetch`. `web_search`, model requests, MCP servers, and other HTTP clients do their own resolution and do not need this plugin. - If the forwarder maps a public name to a private address, that is the forwarder's policy. The plugin stops the application from directly reaching private space; it does not audit the forwarder's rules. - It depends on `resolveAddresses` being an own property of the provider instance. A Harness release that changes that internal structure requires a plugin update. The better long-term fix is an upstream `fakeIp` config in `dsh-web-fetch-http` (see below). - A synthetic range that is not routed by the TUN will fail at connect time. That is a forwarder configuration problem, not a policy failure. - Split DNS that returns both fake and real answers for one name is refused by design; fix the split-horizon rule instead of forcing the plugin to guess.