deepseekplugins

DeepSeek Harness plugin

dsh-network

Secure LAN, Tailnet, and remote connectivity for DeepSeek Harness.

Tools & Capabilities
Jump to install

Source facts

Repository
baixianger/dsh-network
Latest update
Aug 19, 2026
Category
Tools & Capabilities
GitHub stars
0
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/baixianger/dsh-network
Plugin: dsh-network
Author: baixianger

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer3 files
README.mdSource · read only

DSH Network

> One secure connection layer for a DeepSeek Harness Host on a LAN, Tailnet, or public HTTPS route.

dsh-network is an independent DSH Host plugin. It keeps DSH bound to 127.0.0.1, places an authenticated gateway in front of it, and gives every Host a persistent hostId so clients can merge multiple routes to one Host.

RouteDiscoveryAddress
Home / LANQR or pasted pairing linkGateway on the local machine
TailnetQR or manualTailscale Serve MagicDNS URL
Public HostQR or manualUser-managed HTTPS URL

Install

dsh plugin --profile web add dsh-network@next
dsh web

The plugin starts its authenticated gateway on port 3081. DSH itself remains on loopback port 3080.

In another terminal, run the setup assistant. With no mode supplied it always asks which route to place in the QR code; it never silently selects one:

dsh plugin --profile web exec dsh-network setup

# 1. LAN / home network
# 2. Tailscale / Tailnet
# 3. Custom address

Optional iOS download card

Once the iOS app has a real App Store or TestFlight HTTPS URL, set iosAppDownloadURL in the dsh-network plugin config. The local Web client then shows one small, dismissible download card on its first eligible browser launch. It uses DSH's additive shell.overlay slot and never replaces or reflows the application shell. With no URL configured, no card is shown.

# ~/.dsh/profiles/web/cordis.patch.yml
- id: dsh-network
  config:
    iosAppDownloadURL: https://apps.apple.com/app/id6802863224

Pair on the LAN

With the DSH Host running, generate a QR containing a private LAN address and scan it in the iOS app:

npx dsh-network setup lan

Use --url http://HOST:3081 if the machine has multiple private interfaces and the automatically selected address is not the one the phone can reach. LAN mode authenticates the client but uses the trusted local network for transport; do not use its HTTP URL over the public internet.

Configure a Tailnet

Tailscale must already be installed and signed in. This command configures Tailscale Serve to forward the private MagicDNS HTTPS URL to the authenticated gateway, then prints a pairing QR code:

npx dsh-network setup tailscale

The QR code supplies the MagicDNS URL to the iOS app once; the app then remembers the route.

Custom address

Choose option 3 in the setup assistant and paste an address that already reaches the authenticated gateway, or provide it explicitly:

npx dsh-network setup custom --url https://dsh.example.com

Public HTTPS Host

Public discovery is intentionally unsupported. Put port 3081 behind a trusted HTTPS reverse proxy, then generate a QR code containing that URL:

npx dsh-network pair --url https://dsh.example.com

Do not expose DSH port 3080 itself. Public mode requires TLS and should also use provider firewall and rate-limit controls.

The plugin does not install or edit a reverse proxy, container, firewall, certificate, DNS record, or hosting panel. It only accepts the working HTTPS address that the user already operates. See [docs/internet-compatibility.md](docs/internet-compatibility.md) for the public Host boundary.

Credential lifecycle

1. The QR contains a random, single-use pairing ticket valid for five minutes. 2. Pairing issues a device refresh credential and a one-hour access token. 3. The client refreshes automatically and both credentials rotate. 4. Only credential hashes are stored under ~/.dsh/network/state.json. 5. Pairing links are generated on demand and are never broadcast.

When an authenticated iPhone browser opens DSH, the web client can mint a new one-minute, app-only ticket and hand the same Host to the DSH iOS app. Browser cookies and iOS Keychain credentials remain separate.

The gateway rate-limits pairing attempts. Device listing and revocation will be exposed in the DSH settings UI before a stable release.

Platform support

LAN setup uses ordinary HTTP addressing and Tailnet setup uses Tailscale's HTTPS Serve. Linux and Windows may require allowing the DSH process through the host firewall for TCP 3081 on trusted private interfaces.

Development

npm test
npm run check

License

MIT © Xiang Bai

Back to searchOpen GitHub repository

More related plugins

View category