dsh-zen-proxy

A DeepSeek Harness (dsh) plugin: an in-process, OpenAI-compatible proxy that injects the official OpenCode Zen client headers on upstream requests, enabling Zen free models in dsh without the 429 FreeUsageLimitError.

Why

OpenCode Zen's free-tier gateway rate-limits third-party clients by fingerprinting HTTP identity headers. Requests that look like the official opencode CLI get the normal free quota; anonymous or third-party clients are pinned to a very low fallback bucket and immediately rejected with:

{"type":"FreeUsageLimitError","message":"Rate limit exceeded. Please try again later."}

dsh's LLM adapters (e.g. dsh-llm-pi-ai) are designed to always send their own attribution User-Agent (deepseek-harness/ ...) and filter any configured user-agent out — so no dsh configuration can make the gateway see the official client. This plugin closes that gap with a tiny local proxy that lives inside the dsh process (started/stopped with the profile) and rewrites the identity headers before forwarding to https://opencode.ai/zen/v1.

Verified behavior

Smoke-tested against https://opencode.ai/zen/v1/chat/completions:

Headers sent	Result
no official headers	429 FreeUsageLimitError
x-opencode-* only	429 ❌
x-opencode-* + official User-Agent	200 ✅
x-opencode-* + dsh's own UA	429 ❌

The gateway validates the User-Agent content, not just its presence. The x-opencode-* headers alone are not enough.

Install

dsh plugin --profile web add "https://github.com/Yee-h/dsh-zen-proxy.git"

Or from a local checkout:

dsh plugin --profile web add "file:C:/path/to/dsh-zen-proxy"

Configure

1. Register the plugin (profile patch)

Add to $DSH_HOME/profiles/ /cordis.patch.yml:

- insert:
    - id: zen-proxy
      name: 'dsh-zen-proxy'
      config:
        host: 127.0.0.1
        port: 4097
        upstreamHost: opencode.ai
        upstreamBasePath: /zen/v1