Preface¶

DeepSeek Harness (dsh) enables the Web UI by default at http://127.0.0.1:3080. Everything works normally on the local machine: the session list loads and models can be selected. Once you switch to a mobile phone, tablet, or another computer on the same network to open http://192.168.x.x:3080, the common issue is that the page shell loads, but the sidebar is empty, and TypeError: crypto.randomUUID is not a function appears in the console.

This is not a “port not open” problem. The official repository discussion #2396 has broken down the issue: after the server binds to 0.0.0.0, it adds the local machine’s LAN IPv4 to the /api trust fence, and using curl to call session.list will return data normally; the real bottleneck is the browser frontend. The Web UI directly calls crypto.randomUUID() during the startup paths for RPC IDs, message IDs, and draft attachments, but this Web API only exists in secure contexts (HTTPS, or http://localhost / http://127.0.0.1). A plain HTTP LAN address does not count as a secure context, so the API becomes undefined, all subsequent RPC calls throw errors, and sessions and models naturally fail to render.

The new version of harness also explicitly rejects --host 0.0.0.0 via the command line, originally intended to avoid exposing unauthenticated agent interfaces to the entire network. The webserver in the configuration layer still accepts this value, so the path to “bind to all interfaces” is not blocked, only the frontend is missing a patch. The community plugin dsh-web-lan-access was made to solve this: without modifying the product source code, it completes the LAN access functionality.

Plugin Overview¶

dsh-web-lan-access is a UI enhancement plugin maintained by AcidGr under the MIT license, primarily written in JavaScript. The current npm version is 1.1.0 (released 2026-08-16). The GitHub repository is AcidGr/dsh-web-lan-access, which had 18 stars as of 2026-08-18. The community directory lists it under “UI Enhancements”, with an inclusion date of 2026-08-14.

The problem it solves can be summed up in one sentence: it allows DeepSeek Harness’s web interface to properly render sessions and models when accessed from non-loopback, plain HTTP sources such as LAN IPs, Tailscale IPs, or regular hostnames.

DeepSeek Harness itself is the open-source agent runtime from DeepSeek AI, with the architectural slogan of “Everything is a plugin”. The directory site DeepSeek Harness Plugin Repository introduced in this article is an independent community directory, with no affiliation or endorsement relationship with DeepSeek / FunCaptcha, and does not host plugin code. Please refer directly to the maintainer’s repository before installing.

What It Specifically Does¶

The repository’s README and package.json clearly state the capabilities: the plugin is self-contained and includes two layers:

Inject the crypto.randomUUID polyfill. The host-side plugin hooks into the webserver’s official extension point webServer.tapIndex, and every time index.html is served, a short script is inserted at the very beginning of the <head>, before the startup manifest and shell entry point. The polyfill generates UUIDs per RFC 4122 v4 using crypto.getRandomValues — this API is still available in non-secure contexts. If crypto.randomUUID already exists on the current page (HTTPS or localhost), this script will directly return and act as a no-op. After uninstalling the plugin, the tap will be removed along with the bundle, and the page will return to its original state.
Bind the webserver to 0.0.0.0. The bundled cordis.patch.yml directly modifies the host value in the webserver configuration, while the port still follows the CLI’s --port parameter (default 3080). This means you do not need to modify the harness source code or use the rejected --host parameter. After binding to all interfaces, harness will automatically add all non-internal IPv4 addresses of the local machine to the /api trust fence via resolveLanTrust, so LAN access via IP usually does not require configuring trustedHosts.

The README also emphasizes three implementation constraints: no modification of product source code, decoupling from harness versions by only modifying the served HTML, and cross-compatibility with Linux / macOS / Windows / Android.

Installation¶

The installation command given on the directory page can be run directly in the DeepSeek Harness terminal:

dsh plugin add github:AcidGr/dsh-web-lan-access

The maintainer’s README recommends installing it to the web profile to avoid installing it in the default configuration while starting a different profile:

dsh plugin --profile web add github:AcidGr/dsh-web-lan-access

If the environment can resolve npm package names directly, you can also use:

dsh plugin --profile web add dsh-web-lan-access

After installation, restart dsh web and perform a hard refresh (bypass cache) in the browser.

The directory page also reminds users to pin the commit hash for reproducible installations:

dsh plugin add github:AcidGr/dsh-web-lan-access#<commit>

Replace <commit> with the actual commit hash from the repository. The plugin runs with the permissions of the current dsh process, and may execute code during installation. You should inspect the source repository and license before installing.

For offline environments or when pnpm is unavailable, the README provides a manual installation method: copy the plugin to $DSH_HOME/profiles/web/plugins and insert the lan-access line in cordis.patch.yml. The standard bundle installation method above is recommended for daily use.

Startup and Access¶

After installation, start normally without adding --host:

dsh --profile web --port 3080

The local machine can still use http://127.0.0.1:3080. For other devices on the same LAN, open the address using this machine’s LAN IP and port, for example http://192.168.1.66:3080. If there are multiple network interfaces, select the real LAN address, and do not use a virtual network interface that is only reachable locally.

If using Tailscale, MagicDNS, or a custom domain, you need to add the actual Host header sent by the browser during access to trustedHosts. The trust fence uses exact string matching, so short names and full domain names are not interchangeable. The sample structure in the README is as follows:

- id: web-runtime
  config:
    trustedHosts:
      - myhost
      - myhost.tailXXXX.ts.net
      - 100.x.x.x

If the short name is missing, the typical symptom is that the page shell loads, but all /api calls return 403, and the sessions and models are still empty. This looks very similar to the crypto.randomUUID is not a function error, but the cause is the trust fence, not the polyfill.

If you do not want the plugin to take over the binding address, the README suggests removing the webserver override in the patch, keeping the listener bound to 127.0.0.1, then using socat, rinetd, or Tailscale serve for port forwarding, and manually adding the forwarding entry to trustedHosts.

How to Confirm It Is Working¶

Run this command on the local machine:

curl http://127.0.0.1:3080/ | grep lan-access-polyfill

If there is output, the index injection has been enabled. Then use another device to open http://<server-ip>:3080, and the session list and model selection should load normally. If the local curl command returns the grep marker, but the peer browser still reports crypto.randomUUID is not a function, first perform a hard refresh to rule out old HTML cache.

To uninstall:

dsh plugin --profile web remove dsh-web-lan-access

For manual installations, delete the lan-access insertion block in cordis.patch.yml. Patches are layered, so after removal, the webserver will revert to the default loopback binding.

Known Limitations¶

In unmodified harness builds, some sensitive APIs (settings.*, credentials.*, llm.discoverModels) are restricted to only loopback access, regardless of trustedHosts. Remote sources accessing these interfaces will get a 403 error: chat, sessions, and model lists are still available, but the settings page (including plugin configuration cards) and credentials interface will be blank or throw errors. This is a product-side policy that cannot be changed by the polyfill. Please perform these operations on http://127.0.0.1:3080.

Applicable Scenarios and Notes¶

It is suitable for users who are already using the dsh Web UI and want to use their phone or another computer on the same LAN to monitor tasks, edit prompts, or view sessions; it is also suitable for accessing the harness machine at home via Tailscale and other networking tools, but you need to add the actual Host value to trustedHosts.

It is not suitable for directly exposing dsh to a public IP. After binding to 0.0.0.0, any device on the same network can operate this agent without login — the /api only enforces source restrictions, not an account system. If the machine has a public IP address, it will be open to the entire internet. Please only use it on trusted networks, or use a firewall to restrict source IP ranges, for example:

ufw allow from 192.168.0.0/16

A more secure approach is to use Tailscale, or add a reverse proxy with authentication in front. If the reverse proxy provides HTTPS, the browser will be in a secure context, and crypto.randomUUID will already be available natively, so this polyfill is no longer a necessity; at that point, you will need to resolve trust fence and authentication issues, not UUID problems.

Once again, pay attention to installation security: the plugin runs with the same permissions as the current dsh process, and installation may execute code. The community directory is not an official app store, so before installing, open the GitHub repository to review the README, lib/index.js, and the MIT license.

Summary¶

dsh-web-lan-access does not add new chat capabilities; it fills the missing piece in the Web UI for non-secure contexts: a reversible randomUUID polyfill, plus setting the listening address to 0.0.0.0. After installation, LAN devices can truly use the already running DeepSeek Harness interface. When using it, be clear about the security boundaries: no authentication, settings pages are still restricted to local access, do not expose the service directly to the public network.

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-web-lan-access/

GitHub: https://github.com/AcidGr/dsh-web-lan-access

Make DeepSeek Harness Web UI support LAN access via dsh-web-lan-access