deepseekplugins

DeepSeek Harness plugin

dsh-tunnelmux-remote

Mobile remote control for the DSH web GUI with TunnelMux as the tunnel backend: scan-to-pair QR entry, one-time pairing tokens, live device status, revocable mobile sessions, and an auto-tunnel

UI Enhancements
Jump to install

Source facts

Repository
kexuejin/dsh-tunnelmux-remote
Latest update
Aug 16, 2026
Category
UI Enhancements
GitHub stars
0
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/kexuejin/dsh-tunnelmux-remote
Plugin: dsh-tunnelmux-remote
Author: kexuejin

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer2 files
README.mdSource · read only

dsh-tunnelmux-remote

Mobile remote control for the DeepSeek Harness web GUI, with TunnelMux as the tunnel backend. Scan a QR code beside the sidebar to pair your phone, chat with your sessions from /m, and revoke any device at any time. The public URL comes from the local TunnelMux control API (cloudflared/ngrok) — no embedded tunnel binary in the plugin.

Built from scratch (2026-08-16) following the design in TunnelMux docs/plans/2026-08-16-dsh-tunnelmux-remote-design.md and referencing @linxin666/dsh-remote-web-ui (Apache-2.0) for the pairing model.

Features

  • Scan-to-pair QR beside the official sidebar footer: one-time token, first

accept consumes it, refresh invalidates the old QR immediately.

  • Device sessions: HttpOnly cookie gate, presence tracking with offline

detection, max 4 devices (oldest evicted), revoke all with one click.

  • Mobile surface at /m: session list (cursor pagination), create /

rename / history / prompt / models — bridged through the host apiProxy with a strict method allowlist.

  • TunnelMux backend: POST /v1/tunnel/start returns the public URL

synchronously (daemon waits for provider startup); the plugin observes status for the panel and never restarts the tunnel itself — the daemon owns auto_restart.

  • Live updates: SSE /api/pair/events for the desktop panel and

/m/api/events.mux for the phone.

Install

Requires a running TunnelMux daemon (control API on 127.0.0.1:4765) and the DSH web profile:

cd ~/.dsh/profiles/web
dsh plugin add github:kexuejin/dsh-tunnelmux-remote   # or link:/path/to/this/repo

Or add to cordis.patch.yml manually:

- insert:
    - id: tunnelmux-remote
      name: dsh-tunnelmux-remote

Configuration (settings namespace tunnelmux-remote)

keydefaultmeaning
enabledtruemaster switch
tunnelmuxBaseUrlhttp://127.0.0.1:4765TunnelMux control API
tunnelmuxApiToken'' (secret)optional Bearer token
targetUrlhttp://127.0.0.1:3080local GUI the tunnel exposes
tunnelProvidercloudflaredcloudflared or ngrok
autoTunnelfalsestart the tunnel on plugin load
publicBaseUrl''existing public entry (skips auto-tunnel)
tokenTtlMs / offlineAfterMs / maxDevices10min / 25s / 4pairing tuning
cookieNamedsh_pairdevice cookie
mobileEnterToSendtrueEnter sends in the phone chat box

Security model

  • One active token; issue() replaces it, so a fresh QR invalidates the

previous link immediately.

  • One-time accept; reuse returns used (409). Tokens expire (default

10 min). stop() revokes every session and clears the token — the phone's next gated request gets 403.

  • Fences: control endpoints (issue/stop/events) are loopback-only;

phone endpoints (accept/heartbeat/status) allow loopback, LAN literals, or the public tunnel Host. Accept is rate-limited per IP (10 attempts / 30 s).

  • Mobile allowlist: only workspace.list, session.* and

mobile.preferences are exposed over /m/api; everything else 403s. settings.* / credentials.* remain loopback-only host methods and are never reachable from a phone.

Development

npm install
npm run typecheck   # tsc client + host
npm test            # vitest (48 tests)
npm run build       # tsdown: lib/index.js (host) + lib/mobile.js + client/client.js
node test/smoke-live.mjs   # read-only probe of a live daemon at 127.0.0.1:4765

License

Apache-2.0.

Back to searchOpen GitHub repository

More related plugins

View category