Preface¶

For scenarios where you need to access the local DeepSeek Harness (DSH) Web UI from a phone on the same LAN, you typically need to handle issues such as device approval, token binding, rate limiting, and mobile layout. dsh-mobile-gate provides an independent Node gateway that reverse-proxies the DSH Web UI and adds first-visit approval, per-device tokens, per-IP rate limiting, and mobile layout injection to the access path.

What This Is¶

dsh-mobile-gate is maintained by Bernardxu123 and is licensed under MIT. Its role is to serve as a LAN mobile gateway for DSH: the gateway listens on 0.0.0.0, reverse-proxies the DSH Web UI; first visits require local approval; after approval, devices receive a token via Cookie; and it injects mobile adaptation content into proxied HTML responses.

Core Capabilities¶

Below are the verified capabilities:

• Injects data-lan-device markers, compact layout CSS, and a crypto.randomUUID polyfill when proxying HTML.
• First-visit approval: A phone’s first visit displays a “waiting for local approval” page, which requires manual approval on the computer.
• Generates a one-time token after approval; a single approval binds to only one browser, and the token cannot be reused by other devices.
• Per-IP rate limiting, with a default of 120 requests per minute; exceeding the limit returns a 429.
• Loopback addresses and the local LAN IP are allowed directly.
• The gateway runs as an independent subprocess and does not modify the main DSH service configuration or touch the trust fence.
• Supports installation via dsh plugin add, cordis.patch.yml static mounting, or dynamic plugin methods; removal terminates the gateway.

Installation and Activation¶

If you already have the plugin directory on your local machine, you can run the installation command in that directory:

dsh plugin --profile web add ./dsh-mobile-gate

The project also supports installation via cordis.patch.yml static mounting or dynamic plugin methods. Regardless of the method used, removing the plugin terminates the gateway.

Typical Usage¶

After enabling it, first open the admin page in a desktop browser:

http://127.0.0.1:3088/lan-gate/admin

Then, connect your phone to the same Wi-Fi and visit the address listed on the admin page, for example:

http://192.168.31.108:3088

The phone’s first visit will show a “waiting for approval” page. Return to the “Pending Devices” section on the desktop admin page and choose the access method for this device:

• Phone
• Computer
• Auto

After clicking Approve, refresh the page on the phone to receive the token and enter the DSH Web UI.

If you want to check the gateway status directly from the local machine, you can run:

curl http://127.0.0.1:3088/lan-gate/status

An example approval request, where kind is phone, is as follows:

curl -X POST http://127.0.0.1:3088/lan-gate/action -H 'Content-Type: application/json' -d '{"action":"approve","ip":"192.168.31.125","kind":"phone"}'

Configuration and Status¶

The default environment variables are as follows:

LAN_GATE_PORT=3088
LAN_GATE_HOST=0.0.0.0
LAN_GATE_TARGET_PORT=3080
LAN_GATE_RATE_LIMIT=120

LAN_GATE_PORT indicates the gateway listening port, LAN_GATE_HOST indicates the listening address, LAN_GATE_TARGET_PORT indicates the DSH Web UI target port, and LAN_GATE_RATE_LIMIT indicates the per-IP request limit per minute.

If the port is occupied, the gateway will automatically increment and try the next port, up to a maximum of 20 additional ports. Device approval records are persisted in:

~/.dsh/lan-gate-state.json

The pending approval list is kept in memory; after a restart, devices need to trigger access again.

Applicable Scenarios and Notes¶

Suitable for connecting the DSH Web UI to phones within a trusted LAN, especially when you want to keep local approval, device tokens, and rate limiting. Usage notes:

• The gateway does not have a standalone authentication layer and should only be used on trusted LANs.
• The DSH Web UI uses plaintext HTTP, and tokens are passed via Cookie. Do not use it across untrusted networks.
• It is recommended to periodically perform a full revocation on the admin page and re-approve devices.
• The plugin runs with the current dsh process permissions. Before installation, inspect the source code and confirm that the MIT license meets your usage requirements.

Project Address¶

GitHub:

https://github.com/Bernardxu123/dsh-mobile-gate.git