dsh-expose：把运行中的 DSH 实例开放到局域网或公网
DSH Web 默认只监听 127.0.0.1，不宜用 --host 0.0.0.0 直接暴露。社区插件 dsh-expose（WONGIII，v0.1.0，MIT）在实例外增加可开关的 HTTP 转发：默认 0.0.0.0:3080，保留 Host/Origin 护栏与令牌登录，提供局域网/公网地址复制、连通性自检与 Windows 防火墙辅助。安装可通过插件页粘贴 GitHub 地址，或 dsh plugin --profile web add github:WONGIII/dsh-expose。鉴权仍由 DSH 会话负责，插件只解决可达性。
Read Moredsh-web-relay：不经端口转发，把本机 dsh web 交给远程设备
dsh-web-relay 是 LFF28 维护的 DSH 联网插件。内网主机经 SSH 反向隧道连自建中继，Caddy 终止 TLS 并校验网关口令，浏览器无需 VPN 与端口转发即可访问仍只监听 127.0.0.1 的 dsh web。安装命令为 dsh plugin --profile web add dsh-web-relay；首次须在服务器本机设置页部署。MIT 许可，含四层认证与安全文档，中继仅依赖 sshd 与 Caddy。
Read Moredsh-plugin-remote-access：DSH 远程访问（限网段）
`dsh-plugin-remote-access` 插件旨在解决 DeepSeek Harness (DSH) 本地访问限制问题，允许用户将 Web GUI 暴露给 Tailscale 等选定网段。该插件支持自定义监听范围、端口自动回退、令牌 URL 及数字密码（30天免密）两种访问方式。它适配 DSH 0.2.1+，支持热重载配置，并针对远程页面提供了移动端布局和专用 UI 设置。配置文件仅存储于单用户目录，无硬编码，确保安全性与灵活性。
Read Moredsh-simple-remote：通过 Tailscale 远程访问 DeepSeek Harness
`dsh-simple-remote` 是 DeepSeek Harness (DSH) 的一个插件，利用 Tailscale 网络隧道，将本地 DSH Web 界面安全暴露给连入同一 Tailnet 的设备。该插件通过反向代理将流量隔离在 Tailscale 地址上，支持自动登录、流式传输及 Host/Origin 防护。安装后，用户可在移动端通过 `http://<你的 tailnet 地址>:3080/` 访问。默认开启 `autoToken`，等同于完全控制权，建议在共享网络中设为 `false`。目前仅支持 IPv4。
Read MoreDeepSeek Harness Remote Access Plugin (dsh-guard-messenger)
`dsh-guard-messenger` is a Cordis plugin for DeepSeek Harness that provides a secure remote access solution through a Telegram Bot and Cloudflare Tunnel. The service runs on the local address `127.0.0.1`, exposes only a key-authenticated proxy entry point, and supports passwordless access, tunnel toggling, and key rotation. This plugin is suitable for accessing the Web UI to perform coding from mobile devices in restricted network environments. Note that content is transmitted over Cloudflare; for extremely high security requirements, using SSH or Tailscale is recommended.
Read Moredsh-remote-frp: Remotely Access the DSH Web GUI Using Your Own Cloud Server
`dsh-remote-frp` is a DeepSeek Harness (DSH) plugin designed to enable external access to the local Mac DSH Web interface through an frp reverse tunnel. No public IP is required; you only need a cloud server as a relay. The plugin manages the Mac-side configuration, including generating a token, installing a LaunchAgent for auto-start, writing `trustedHosts`, and optionally keeping `caffeinate` running to prevent sleep. The installation process includes adding the plugin on the DSH Settings page and running an installation script on the server to configure `frps`, the Web service, and a TLS certificate. Users need to provide parameters such as the server address, port, and token. The plugin provides commands for status checking and log viewing, and emphasizes the security model (permissions
Read MoreDeepSeek Harnesses the Cloudflare Zero Trust Access Plugin
The DeepSeek Harness (DSH) plugin `sevoniva-labs/dsh-cloudflare-access` leverages Cloudflare Zero Trust to enable secure remote access to locally deployed models. It uses Cloudflare Access for authentication and Cloudflare Tunnel for routing, requiring no public IP address or open ports. Installation requires DSH 0.1.6-alpha.2 and Node.js 22.19.0 or later. Configuration involves creating a Cloudflare API token, selecting a domain, and setting up an access subdomain. The plugin supports file browsing, model management, and connection recovery, but is intended only for host owners, provides no user isolation, and requires attention to compatibility and security considerations.
Read Moredsh-relay: Expose Your Locally Running DeepSeek Harness to the Public Internet
dsh-relay is a DeepSeek Harness (dsh) off-tree plugin based on the Cordis ecosystem, designed to enable secure remote access to local dsh instances by combining a cloud relay with a host-agent plugin. The solution adopts a Wire-Trunk architecture to replay local process requests under a loopback identity without exposing public ports, supporting real-time session synchronization, streaming output, and HTTPS encryption. Before use, ensure Node.js version >= 22 is installed; setup and configuration are completed by generating a token and a pairing code.
Read MoreDeepSeek Harness Remote Configuration Compatibility and Access Gateway Plugin
`lemoncat7/dsh-remote-settings-compat` is a remote access compatibility plugin for DeepSeek Harness (DSH), designed to address the separation between Origin and password gateway configuration in remote deployments. Through a unified access entry point, the plugin provides trusted browser Origin management, a standalone password gateway on port 3081, anonymous Knowledge sharing, and machine API compatibility. Installation requires a Node.js environment and supports deployment via Docker. The plugin forwards traffic through an Nginx proxy and includes login rate limiting, session expiration, and security policies. During upgrades, it remains compatible with legacy settings, but the old Bundle must be removed. Users should pay attention to Nginx configuration and adhere to the configuration separation principle.
Read MoreDSH Remote: A macOS Plugin for Mobile Access to DeepSeek Harness Web
DSH Remote is a plugin that provides mobile remote access to the DeepSeek Harness (DSH) web interface. It starts a managed FRPC process on macOS and uses a QR code pairing mechanism to bridge local DSH web endpoints to remote networks, reusing existing interfaces without additional development. The plugin uses an explicit authorization mechanism, is not automatically enabled by default, and supports key rotation and revocation of individual devices. Installation and activation must be performed via command-line operations. It currently supports macOS only and is in Beta. Note that although its transport layer uses TLS encryption, it does not provide application-layer end-to-end encryption, and the hosted service does not offer SLAs or a data deletion feature.
Read Moredsh-remote-access: Make the dsh Web Interface Listen on All Interfaces
The `dsh-remote-access` plugin overrides the default listen address via the `DSH_WEB_HOST` environment variable, allowing the DSH Web interface to bind to `0.0.0.0` and enabling access from other devices on the local network. The plugin is lightweight and non-intrusive, reusing DSH’s built-in `BrowserAuth` authentication mechanism without requiring additional configuration. After installation, it listens on all interfaces by default, and the logs automatically print the LAN address. Users should keep the token secure and be mindful of the security risks associated with network exposure.
Read Moredshost-plugin: DSHost Official Remote Cloud Relay Plugin
`dshost-plugin` is the official remote cloud relay plugin for DeepSeek Harness (DSH), designed to solve the challenge of accessing the dsh Web UI in internal network environments. It creates a secure WebSocket tunnel by having the Agent actively connect outward to a relay server, enabling secure remote access with no public IP required. Core features include DSH multi-version compatibility, security mechanisms that comply with trust barriers, mandatory WSS encrypted transmission, and automatic reconnection upon service startup. Installation requires Node.js >= 22.5.0. Users must first obtain a Token from dshost.me, configure it in `cordis.patch.yml`, and restart the service.
Read Moredsh-maestro-remote: DSH Remote Access and Tunnel Management Plugin
`dsh-maestro-remote` is a plugin that provides remote access capabilities for DeepSeek Harness. It uses Cloudflare Tunnel to expose local services to the public internet, supports PIN-based authentication to protect the proxy entry point, and allows receiving Webhooks from services such as GitLab. The plugin offers features including tunnel lifecycle management, automatic download of `cloudflared`, traffic distribution, and configuration reloading. Configuration is managed through a shared namespace, and the plugin depends on a Node.js environment. It is designed to address the limitation of local sessions being inaccessible from external systems or unable to receive externally triggered requests.
Read Moredsh-tailscale-sync: Continue Your Desktop DeepSeek Harness Work on a Phone with Zero Configuration
By default, DeepSeek Harness listens locally only, and remote access requires SSH or port forwarding configuration. The `dsh-tailscale-sync` plugin uses a Tailscale encrypted tunnel to enable zero-configuration, secure cross-device access. This plugin ensures that only devices within the same Tailnet can access the web service by implementing port locking, automatic trust for MagicDNS domains, and automatic configuration of a fence. After installation, starting the tunnel with `tailscale serve` allows secure access to Harness from a mobile device via `<machine name>.ts.net`.
Read Moredsh-remote-access: Secure Access to the DeepSeek Harness WebUI
dsh-remote-access is a DeepSeek Harness plugin maintained by RedreamR, designed to address the WebUI's default inability to listen on public network addresses and associated security concerns. It enables secure public remote access through port forwarding, password authentication, and CAPTCHA policies (with daily and 5-hour attempt limits). Users can install it via the command line. Configuration options include the listening address, port, password, and security policy, and can be configured in the DSH settings interface or `cordis.patch.yml`. Note that pnpm restrictions apply during installation.
Read Moredsh-remote-access: TLS Proxy Plugin for Secure Remote Access to DeepSeek Harness
dsh-remote-access is a DSH plugin that acts as a TLS edge entry point for the DSH web service, solving its default local-only access limitation. It provides independent port listening, automatic self-signed certificate generation, username and password login, and session protection. It supports hot configuration of TLS, ports, and accounts via the GUI, as well as transparent HTTP/WebSocket reverse proxying. Users can expose it remotely over LAN or through tunnels such as FRP or Cloudflare. After installation, configure the username and password in the GUI settings panel and start it, then access `https://127.0.0.1:3081`.
Read Moredsh-remote-access: Multi-Mode Remote Access Plugin for DeepSeek Harness
The dsh-remote-access plugin provides a secure remote access solution for local DSH through a Caddy reverse proxy. It supports three modes: LAN, Tailscale, and Cloudflare Tunnel, and features API allowlist policies, unified gateway handling, automatic TLS, and authentication. Users can install it via a command, configure policies on the settings page, and use a diagnostic script to check network status. The plugin addresses the need to expose local DSH over a LAN or the public internet, but note that the API allowlist is not a sandbox, and the Tunnel-only mode lacks identity authentication.
Read MoreDSH Remote Console: Enabling Mobile Access to Web Profile via Tailscale Serve
DSH Remote Console is a mobile-enhancement plugin maintained by ZSLsherly, designed to securely expose a local DSH debug environment to mobile browsers via Tailscale Serve. The plugin integrates status monitoring, session management, PWA support, touch optimization, and a sleep-prevention mechanism. It also addresses the mobile limitation of lacking a native directory picker, allowing workspaces to be opened directly by entering an absolute path. Before using it, install Corepack and Tailscale and ensure the computer and phone are on the same Tailnet.
Read MoreIntroducing the DSH Remote Access Plugin
This plugin adds remote access to the DSH Web profile. It supports accessing it from other devices via LAN or an frpc tunnel and generates authenticated links. Users must configure the frpc path and server information for public network access, and should pay attention to permissions, version compatibility, and security.
Read MoreDeepSeek Harness Plugin: dsh-rgate Remote Access Gateway
`dsh-rgate` is an identity authentication plugin for DeepSeek Harness that provides a full-page password wall, API restrictions, and session management for the Web UI. It addresses the security gap where `trustedHosts` only mitigates DNS rebinding rather than enforcing identity authentication, making login mandatory for non-loopback access. Core features include HMAC cookie authentication, login rate limiting, password audit logging, and scrypt-encrypted storage. Changes take effect after installation and a restart, making it suitable for enhancing security in self-hosted deployments.
Read Moreomdsh-remctrl: Adding a Remote Access Entry Point to DeepSeek Harness
`omdsh-remctrl` is a remote control plugin for DeepSeek Harness, designed to address the inconvenience of operating from mobile devices. By using a reverse proxy and a Cloudflared tunnel, it exposes the full DSH interface to the public internet, allowing users to view sessions, approve requests, and assign tasks from a phone. Core features include HTTP/WebSocket forwarding, password authentication, automatic tunnel generation, and mobile optimization. The plugin is disabled by default and must be manually enabled in the Plugin Center. Security relies on DSH’s session mechanism and rate limiting. Installation requires a Node.js environment, involves minimal configuration options, and supports using either the default Cloudflare tunnel address or a custom domain.
Read Moredsh-webroad: Free Remote Access to DSH Web (Tailscale Funnel)
dsh-webroad is a DeepSeek Harness plugin that leverages Tailscale Funnel to provide a free and simplified web-based remote access solution. It supports QR code login over LAN and public networks, and includes secure and stable features such as PIN authentication, transparent WebSocket forwarding, automatic reconnection, and traffic compression. The `-w` parameter is required during installation. Once installed, you can manage its status via the settings page entry or the CLI. It is ideal for home and general users who want to avoid domain name configuration.
Read Moredsh-remote-access: Public Internet HTTPS Remote Access for DSH Web
The dsh-remote-access plugin is designed to solve the issue that the DeepSeek Harness web interface cannot be accessed from outside in an intranet environment. Using technologies such as Cloudflare tunnels, a password proxy, and mobile compatibility patches, it provides DSH with public HTTPS remote access. The plugin runs with the permissions of the current process, making it suitable for advanced users who need a stable public endpoint. Consult the plugin directory or GitHub repository for installation instructions, and be sure to review the source code and security before use.
Read Moredsh-remote-tailscale: Access the Local DSH Web UI Across Devices via Tailscale
`dsh-remote-tailscale` is a DSH plugin that uses the Tailscale virtual network to expose the local Web UI to other devices under the same account, without requiring a public network or LAN sharing. It provides an HTTPS secure channel, Loopback proxy, account authentication, and status monitoring. After installation, users only need to enable remote access in DSH settings and connect via the HTTPS port (default 8455) or a QR code. This solution supports port configuration via environment variables; Windows firewall settings should also be checked.
Read Moredsh-guard-messenger: Securely Expose DeepSeek Harness via Telegram/Discord
The DeepSeek Harness (DSH) plugin `dsh-guard-messenger` uses Cloudflare Quick Tunnel to provide secure remote access to a local Harness instance from a mobile device. It leverages an edge connection to forward traffic to the local `127.0.0.1` address without exposing local ports. The plugin supports one-click toggling via Telegram or Discord and offers passwordless access to a Web UI along with Agent runtime capabilities. While it reduces the attack surface, users should note that TLS terminates at the edge, no SLA is provided, and prompt injection risks remain. Developers should protect the source code and rotate keys promptly if a key leak occurs.
Read Moredsh-discord-bot: Project dsh to Discord without opening any inbound ports
dsh runs on a machine at home or the office, allowing you to track session progress or assign tasks to a workspace when you are away. The conventional approach involves SSH port forwarding or exposing the web UI to the public internet; the former requires routing access to that machine, while the latter requires a public IP address or a reverse proxy. Alternatively, one might set up a tunnel service, which essentially holds the keys to your machine. dsh-discord-bot takes a different path: it uses Discord as the control plane. The machine initiates a single outbound WebSocket connection to the Discord gateway and maintains it, with commands coming in through this existing connection. It does not listen on ports, forward ports, or introduce any new inbound attack surface. The following section introduces what this plugin can do and how to use it.
Read Moredsh-remote-dirpicker: Make directory selection consistent for DSH Web's remote "Add Workspace"
dsh-remote-dirpicker is an MIT-licensed DSH plugin designed to address the issue where the "Add Workspace" directory selection feature fails to function properly when accessing DSH Web via nginx reverse proxy, public network, or LAN IP. By adjusting plugin configuration through a combination layer patch, this plugin avoids modifying the DSH core code. Its core mechanism involves disabling the automatic picker `directory-picker-auto` and forcing the mount of the `browse` host capability, ensuring that both remote and local access utilize a unified in-browser directory browser interface. The plugin supports browsing the host file system within the browser, including features such as breadcrumb navigation, absolute path navigation, path editing, hidden file display, and creating new folders, while exposing these capabilities via DSH's own RPC channel.
Read Moredsh-gateway: Remote access gateway providing HTTPS and login for the DSH Web Interface.
dsh-gateway is an MIT-licensed plugin for DeepSeek Harness (DSH) designed to address encryption and login protection issues when accessing the web interface remotely. Running as a built-in plugin, it eliminates the need for deploying a standalone reverse proxy or certificate service. It defaults to a 'fail-closed' mechanism, listening only on the local machine (127.0.0.1:3443) without requiring authentication, ensuring remote access is impossible before configuration. The plugin offers self-contained HTTPS encryption (supporting automatic or custom certificates), account login protection (including password hashing, failure rate limiting, and session management), multi-site whitelisting, and hot-reload configuration capabilities. By changing the listening address to 0.0.0.0 and configuring an account, it supports access via Local Area Networks (LAN) or the internet through port mapping. Its reverse proxy employs loopback spoofing.
Read Moredsh-web-remote-frp: DSH Mobile / External Network Remote Access Plugin (frp Intranet Penetration Version)
dsh-web-remote-frp is a remote access plugin for DSH, designed to address the need for accessing Web interfaces on mobile devices or the external network. It utilizes frp for intranet penetration to provide public network access, while also supporting direct LAN HTTP/HTTPS connections. Its core features include: automatically downloading frpc and supporting TCP/HTTP/HTTPS proxies; automatically generating self-signed certificates for zero-configuration HTTPS; independent switches for LAN and public network access; secure authentication based on random tokens and HttpOnly cookies, with token authentication being mandatory for public network access; automatic gzip compression via reverse proxy to improve loading speed; permanent sidebar shortcuts for mobile devices; and support for bot channels such as WeChat, QQ, Telegram, and DingTalk. Installation requires adding the plugin to the profile via pnpm.
Read Moredsh-web-remote-access: Enabling remote access to dsh Web UI with token protection
`studyzy/dsh-web-remote-access` is a bundle plugin for dsh Web profiles designed to address the limitation where local loopback access cannot be shared across a local area network (LAN). This plugin enables remote access via `--host 0.0.0.0` while enforcing a Web Token guard mechanism to ensure the security of web pages, APIs, and WebSocket connections. Core features include: 1. **Secure Access**: Remote access requires verification via the `?web_token=` parameter, issuing session cookies upon successful authentication. Token validation employs SHA256 and constant-time comparison to prevent timing attacks. 2. **Experience Optimization**: Local loopback access does not require a token, preserving the original seamless experience; it auto-starts upon initialization.
Read Moredsh-web-remote: Mobile and External Network Remote Access Plugin for DSH
dsh-web-remote is a DeepSeek Harness (DSH) plugin maintained by godchen520, designed to address remote access and control issues for the local DSH Web on mobile devices, external networks, and social media applications. Its core features include: leveraging Cloudflare Quick Tunnel for public network access without configuration or a public IP; supporting direct LAN HTTP/HTTPS connections with automatically generated self-signed certificates; enhancing security through random tokens and HttpOnly cookies. Additionally, it supports custom public network links (such as ngrok) and LAN ports, and accelerates large history loading via reverse proxy gzip compression. The plugin deeply integrates with WeChat and Feishu bots, allowing users to engage in AI conversations, session control, and module management through commands.
Read Moredsh-bridge: Extending DeepSeek Harness to Mobile Devices, Public Networks, and Instant Messaging
dsh-bridge (@wenbin_wb/dsh-bridge) is a DSH networking tool plugin maintained by wenbin-wb, currently at version v2.8.3. It supports local area network QR code scanning, Cloudflare/self-built tunnels, and official Bot integration for WeChat, QQ, Feishu, and Telegram; it also features built-in access Token/password authentication, management console tamper-proofing, and RPC authentication. This article introduces installation commands, typical usage scenarios, and security considerations based on the GitHub README and SkillHub directory page.
Read Moredsh-full-remote: An Auditable Remote Access Gateway for DeepSeek Harness
dsh-full-remote is a DeepSeek Harness plugin maintained by JUANWANG-BUAA. It inserts a token-authenticated reverse proxy in front of the Harness Web service, rewrites the Host/Origin to loopback addresses, and prevents privileged APIs such as settings, credentials, and host.listDirectory from returning 403 errors during public network tunneling or local area network remote access. It supports device sessions, mobile QR code invitations, JSONL audit logs, and optional Cloudflare Quick Tunnel. The installation command is: dsh plugin --profile web add dsh-full-remote.
Read Moredsh-remote: Adding a Remote Access Authentication Layer for DeepSeek Harness
Add account password login, TOTP MFA, signed session cookies, and role-based permissions before the DSH web interface. Replace workspace selection with an in-browser directory dialog. After authentication, allow DSH's originally loopback-only privileged APIs to be accessed. Suitable for scenarios where DSH is exposed to a local network or the internet via a reverse proxy or tunnel. Install with the command: dsh plugin --profile web add @xgone/dsh-remote. MIT license, maintained by xgone.
Read More