deepseekplugins

DeepSeek Harness plugin

dsh-lan-gate

Password + CIDR gate for DeepSeek Harness web / DeepSeek Harness 局域网密码门禁

Security & Permissions
Jump to install

Source facts

Repository
maxesisnclaw/dsh-lan-gate
Latest update
Aug 15, 2026
Category
Security & Permissions
GitHub stars
0
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/maxesisnclaw/dsh-lan-gate
Plugin: dsh-lan-gate
Author: maxesisnclaw

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer4 files
README.mdSource · read only
README language

dsh-lan-gate

English | 中文

Password gate + CIDR allowlist + proxy-header deny for DeepSeek Harness web.

dsh web --host 0.0.0.0 is rejected by the CLI. This bundle sets webserver.host to 0.0.0.0 through the official composition layer, then requires a password before the UI or /api is reachable from the LAN.

Install

dsh plugin --profile web add dsh-lan-gate

Or from GitHub:

dsh plugin --profile web add github:maxesisnclaw/dsh-lan-gate

Then open http://127.0.0.1:3080/dsh-lan-full/login and set a password (loopback only). After that, LAN clients get the login page.

Settings → LAN access / LAN 访问 edits CIDRs, proxy-header policy, and the password. The settings section and login page follow dsh's official zh/en locale.

What it does

ControlDefault
Listen on all interfacesyes (bundle patch)
Passwordunset until you set it from loopback
Inbound IPv4 CIDRs10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Reject X-Forwarded-* / Forwarded / Viayes
Loopback bypasses passwordyes (recovery)

Policy file: $DSH_HOME/lan-gate.json (mode 0600). The password is stored as a scrypt verifier, never as plaintext. Session tokens are random 32-byte values; only their SHA-256 is kept in memory.

Residual risk

This is not a TLS terminator. On plain HTTP a LAN observer can still sniff the password and cookie. Do not put this on the public internet. Do not sit it behind a reverse proxy that adds forwarding headers — those requests are rejected on purpose.

See [SECURITY.md](SECURITY.md).

License

MIT

Back to searchOpen GitHub repository

More related plugins

View category