fake-ip 4

DeepSeek Harness web_fetch with operator-approved non-public destinations (fake-IP proxies, intranet docs) and a provider architecture for future fetch backends

fake-ip-aware WebFetchProvider for the DeepSeek Harness web seam — keeps the web_fetch tool working under mihomo/Clash fake-ip DNS without disabling fake-ip or setting proxy environment variables.

IP/domain allowlist web_fetch provider for DeepSeek Harness: lets web_fetch reach allowlisted hosts/IPs freely (incl. proxy fake-IP addresses like 198.18.x.x) while keeping the default public-IP safety check for everything else.

DSH host plugin: let web_fetch reach domains the local Clash/mihomo TUN resolves into its fake-ip pools (IPv4 198.18.0.0/15, IPv6 2001:2::/48), while every other non-public address stays blocked.