dsh-full-remote

dsh-full-remote

Listed in awesome-dsh-plugin · DeepSeek Harness plugin

Current release: v0.5.0 · Distributed through GitHub Releases

English | 中文

dsh-full-remote is a plugin for DeepSeek Harness. It places an authenticated reverse proxy in front of the Harness Web server, so the Web UI can be used through a public tunnel or from a device on the local network while privileged APIs such as settings, credentials, and directory browsing remain available. New in 0.5.0 A selectable cross-session Task cockpit for approvals, questions, plan review and session navigation; page-lifetime drafts, offline guards and no write replay. Negotiated Brotli/gzip, device-isolated encoded static caching, an owned upstream connection pool, activity-aware expiry and visibility-aware, non-overlapping polling. Keeps DeepSeek Harness 0.2.1-rc.2 compatibility and the existing authentication and loopback-only proxy-management boundary. Measured gains — and trade-offs

Fifteen paired local HTTP rounds against the previous already-gzipped version; these are cumulative request times, not LCP or real mobile page-load measurements. Full method, same-encoding controls, limits and reproduction: English benchmark · 中文完整报告. 60-second quick start

In Settings → Reverse proxy, press Start proxy, then Start Cloudflare quick tunnel and scan the generated QR code. The invite is one-time and never contains the standing access token. For a controlled network, point an existing SSH, frp, ngrok, Tailscale, or cloudflared tunnel at the proxy target shown in the panel instead.

The quick tunnel is optional and temporary, not a managed production deployment. Read Security model before exposing a listener to the Internet. For composition details, see Compatibility and composition. Problem

DeepSeek Harness binds its Web server to a loopback address and only accepts privileged requests when the Host and Origin headers refer to a loopback address. When the UI is reached through a generic tunnel, these headers carry the public hostname and the trust check fails. The page loads, but the following methods return 403: settings.* credentials.* host.listDirectory Solution

The plugin inserts a reverse proxy between the tunnel and the Harness Web server. The proxy: rewrites Host and Origin to 127.0.0.1 before forwarding, so the privileged APIs pass Harness's trust check; requires an access token or a valid device session before any request is forwarded; forwards HTTP, SSE, and WebSocket traffic; compressible HTTP responses negotiate Brotli/gzip when eligible (not SSE or WebSocket); provides a settings page (Settings → Reverse proxy) for starting and stopping the proxy, changing the listen address, rotating the token, and managing device sessions.

Because the rewrite disables Harness's original trust check for remote clients, the plugin provides its own access-control layer in its place. This layer is described under Security model.

The plugin can optionally start a temporary Cloudflare quick tunnel. Any managed tunnel (cloudflared, ngrok, frp, SSH, Tailscale) can also point at the local endpoint it publishes. How it works