dsh-web-lan: DeepSeek Harness LAN Access Layer

Preface¶

By default, the Web service of DeepSeek Harness (DSH) usually listens only to the local address. To access or debug it directly from other devices on a local area network (LAN), you often need to modify configuration files or set up an SSH tunnel. The dsh-web-lan plugin wraps the Web server’s request handling and provides a solution that requires no additional configuration. It treats LAN traffic as loopback access and adds a password login gate to control access permissions.

Plugin Overview¶

dsh-web-lan is a LAN access layer plugin for the DSH Web service, maintained by the developer yes8080. It addresses compatibility issues in pure HTTP LAN environments, provides a password-authenticated entry point, and supports managing the access password directly from the settings page.

Core Features¶

1. crypto.randomUUID patch: Fixes API-layer failures caused by crypto.randomUUID is not a function in plaintext HTTP LAN environments.
2. Password login gate: Unauthenticated requests can only see the login page. After successful authentication, the client obtains full permissions as a loopback identity, including access to Agent tools.
3. Client isLoopback fix: The patch forces the browser-side isLoopback value to true, fixing the issue where the “Settings → Plugin Configuration” tab appears blank on pages accessed from a LAN.
4. Password management: Supports modifying the password in the Web UI under “Settings → Plugins → Plugin Configuration” in the “LAN Access” card. Changes take effect immediately and are persisted to ~/.dsh/settings.yaml.

Installation and Activation¶

Run the following commands to install the plugin and restart the service:

dsh plugin --profile web add 'git+https://github.com/yes8080/dsh-web-lan.git'
npm exec @deepseek-ai/dsh web

After startup, the terminal prints the LAN access address, usually http://<ip>:3080.

Typical Usage¶

1. Access and login: From another device on the LAN, visit http://<ip>:3080 and log in using the default password 123. It is recommended to change the password immediately after the first login.
2. Set a password via environment variable: Before starting the service, run export DSH_LAN_PASSWORD='strong_password'.
3. Manage it from the settings page: After logging in, go to the “Settings → Plugins → Plugin Configuration” card and change the password in the “LAN Access” section.

Security and Considerations¶

• Default password risk: The default password 123 is weak and publicly known. Change it immediately after installation via the settings page or override it with an environment variable.
• Transport: Passwords and data are transmitted over plaintext HTTP, so this is only suitable for trusted LAN environments.
• Permission scope: A logged-in user has the same full permissions as a local user.
• Runtime dependencies: This plugin requires pnpm. If pnpm is not enabled, run corepack enable pnpm first.

Uninstallation¶

To remove the plugin, run:

dsh plugin --profile web remove dsh-web-lan
npm exec @deepseek-ai/dsh web

After uninstallation, the service automatically reverts to listening on the default 127.0.0.1 address, and LAN access is disabled. You can optionally clean up residual data:

# 编辑 ~/.dsh/settings.yaml，删除 lan-access 段
rm ~/.dsh/dsh-lan-sessions.json

Conclusion¶

By using a plugin-based approach, dsh-web-lan simplifies LAN access for the DSH Web service, resolves compatibility defects, and adds a basic security gate. It is well suited for scenarios that require quick deployment and debugging of DSH applications within a local network.