The Enterprise Gateway — What Your Server Does Behind the Scenes

The gateway is a single-process Node.js service on your own server. Every conversation, login and heartbeat from employee devices lands here — and it decides what passes, what gets blocked, and what gets remembered.

The Last Check Before a Conversation Leaves

• Regex rule engine: up to 50 rules, each with one action — block, mask, or allow
• Factory rules: API keys (sk-...) blocked; card / phone / ID numbers masked with first and last 4 kept
• Scans the current message only: sensitive data in history degrades to [REDACTED]
• Rules apply instantly — no client restarts

Security: factory rules block API keys and mask ID numbers; edits take effect immediately

Production-Grade Forwarding

• OpenAI-compatible (chat/completions + responses), streaming
• Same-request failover to backup providers, 60s circuit breaker
• Provider health patrol: auto-disable after 2 consecutive failures, auto-recover
• Thinking parameter injection across 7 levels, auto-configured via probing

Providers & Models: failover config, per-million pricing, thinking levels

Logs That Survive Scrutiny

• Every request: who, which model, tokens, DLP hits — all recorded
• Every login: who, from which IP, success or failure
• Append-only SQLite; a daily integrity anchor at 23:59 makes history tamper-evident
• Retention you set (default 90 days), auto-purged

Audit Logs: filter by user, model or DLP flag; one-click CSV export

Billing: Add Prices, Get a Bill

• Token usage aggregated per user per day (input / output / cache)
• Enter per-million prices; the payable amount computes itself
• Employees see only their own usage — cost is your data, not theirs

Bills: daily detail, by-model summary and model prices — three views

The Admin Console: 11 Pages Out of the Box

Overview · Providers & Models · Users · Billing · Security · Client Control (policy / plugins / rules / receipts) · Audit Logs · Plugins · Collaboration · Alerts · Style Guide

• Wrong policy? One-click rollback to any version
• Unsure? Canary by device percentage, check receipts, then promote
• Incident to broadcast? DLP blocks push to WeCom / DingTalk via webhook
• Client access URL: configure once, login pages pick it up — fresh machines need zero typing

Users: account overview, enable/disable, activity tracking

Operations That Don't Add Work

• Zero dependencies: Node 22.5+ only, built-in SQLite — no database service
• One-command install: npm i -g dsh-enterprise-gateway, run dsh-enterprise-gateway from any directory on a 2C4G box
• Pluginized: 17 built-ins, disable at will; load your own
• Keys off disk: JWT secret and provider keys via environment variables

---

Want hands-on? The live demo is one click away. Deploying? The five-minute guide.