Preface¶

The philosophy of DSH is “everything is a plugin.” The plugin directory is an independent site and has no official affiliation with DeepSeek / High-Flyer; it should not be understood as an official app store.

For agent developers, a specific issue is: how to expose a local DeepSeek Harness Web GUI to the public internet while avoiding direct public requests hitting the Web server, and without directly modifying the deepseek-harness source code. The approach of ai-eks/dsh-auth-tunnel is to place a loopback password gate in front of the Web server, and then use cloudflared to establish a Cloudflare Tunnel. Below are its installation and usage instructions.

What This Is¶

ai-eks/dsh-auth-tunnel is an MIT-licensed plugin maintained by ai-eks. It consists of two parts:

• A loopback password gate that provides a login page and HMAC cookies;
• A publishing channel launched via cloudflared, supporting quick or named-tunnel modes.

The plugin’s goal is to expose the DeepSeek Harness Web GUI to the public internet without modifying deepseek-harness itself.

Core Features¶

Public Exposure¶

• Exposes the DeepSeek Harness Web GUI via a Cloudflare Tunnel.
• Adds a loopback password gate in front of the Web server, including a login page and HMAC cookies.
• Prints the public Cloudflare tunnel URL once the tunnel is ready.

Two Publishing Modes¶

• Quick mode.
• Named/tunnel token mode.

Configuration and Maintenance¶

• Provides an Auth Tunnel configuration card under Web Settings → Plugins → Plugin configuration.
• Supports allowRemoteSettings, allowing authenticated public pages to update settings, and separately updates the write-only access password.
• Supports in-place updates for passwordRef and sessionTtlHours.

Installation and Activation¶

Prerequisites¶

1. dsh CLI and pnpm are available in PATH.

2. cloudflared is available in PATH or configured as an absolute executable path in the plugin.

3. Prepare a sufficiently long random shared password and save it as a DSH credential.

4. The Node requirement declared in package.json is ^22.19 || >=24.

Installation¶

Install the latest published prerelease bundle from npm:

dsh plugin --profile web add dsh-auth-tunnel@next

You can also install the current source code from Git:

dsh plugin --profile web add github:ai-eks/dsh-auth-tunnel

The current branch targets DeepSeek Harness 0.1.1-rc.2. If you are using 0.1.0-rc.8 or earlier, you need to pin a compatible immutable tag or revision.

If you are using pnpm 10 or higher, you may need to allow the build in the profile’s pnpm-workspace.yaml.

Saving the Access Password¶

Save the access password as a DSH credential:

DSH_WEB_PASSWORD: 'replace-with-a-long-random-password'

Save it in:

$DSH_HOME/.credentials.yaml

Start the Web profile:

dsh web

Typical Usage¶

Quick Mode¶

After startup and tunnel establishment, the terminal will print:

cloudflare tunnel: https://<random>.trycloudflare.com

Open this URL and enter DSH_WEB_PASSWORD on the login page.

Named Tunnel / Token Mode¶

If publicHostname is configured, token mode is used. In the example, DSH_TUNNEL_TOKEN is used and configured in cordis.patch.yml:

mode: token
tokenRef: DSH_TUNNEL_TOKEN
publicHostname: gui.example.com
gatePort: 7677

publicHostname should only contain the DNS hostname; do not include https://, ports, or paths.

Use Cases and Considerations¶

Suitable for users who need to expose a local DeepSeek Harness Web GUI to the public internet without directly modifying deepseek-harness.

Things to note before use:

• DSH plugins run with the permissions of the current dsh process. You should review the source code and license before installation; this plugin is licensed under MIT.
• allowRemoteSettings is enabled by default. If the authenticated public page should not manage the tunnel itself, disable it.
• Access password and configuration changes are not committed as a single transaction; the access password is updated separately via a write-only button.
• Remote pages cannot save changes that would allocate a new random Quick URL; such changes need to be made locally.
• For authenticated public pages, the gate proxies settings.*, credentials.*, and llm.* to the Host; core setting writes targeting the auth-tunnel namespace are rejected and must go through the plugin’s fenced endpoint.

References¶

• Plugin directory: https://www.skillhub.cn/plugins/ai-eks/dsh-auth-tunnel
• GitHub: https://github.com/ai-eks/dsh-auth-tunnel