Introduction¶

The Web UI of DeepSeek Harness (DSH) is by default designed for use on a local machine or in an HTTPS environment. If the service is exposed on a LAN IP, Tailscale address, or a non-loopback hostname and accessed via plain HTTP, the page may fail during the startup phase: the session list and model selection areas will be blank, and RPC calls will continuously throw errors.

The root cause is that the Web UI calls crypto.randomUUID() in a critical startup path, an API only available in secure contexts (HTTPS, or http://localhost / http://127.0.0.1). On addresses like http://192.168.x.x:3080, crypto.randomUUID is undefined, causing subsequent RPC operations to malfunction.

This introduces the community plugin dsh-web-lan-access: it allows LAN and Tailscale access to load sessions and models normally by injecting a polyfill from the host side and automatically relaxing the /api trust boundary, all without modifying the DSH product source code.

What This Is¶

dsh-web-lan-access is a DSH Web-side plugin maintained by AcidGr, categorized as a networking tool. It is published on npm as dsh-web-lan-access (current version 1.2.1, MIT license), with about 25 stars on its GitHub repository.

The plugin does three things:

Via the webServer.tapIndex extension point, it injects a script based on crypto.getRandomValues for an RFC 4122 v4 polyfill at the very beginning of the <head>; on secure origins, this script is a no-op.
Through a bundle patch, it sets the webserver bind address to 0.0.0.0, eliminating the need to pass --host 0.0.0.0, which is now rejected by newer CLI versions.
It automatically expands the /api trust fence based on the host’s current non-internal IPv4 addresses (including 192.168.x, Tailscale 100.x, VPN interfaces).

All operations only modify the server’s output index.html and configuration; no product source code is changed, and rolling back is as simple as uninstalling.

Core Features¶

crypto.randomUUID Polyfill¶

The DSH Web UI relies on crypto.randomUUID() for RPC IDs, message IDs, draft attachments, and other paths. The plugin injects a small script before the boot manifest and shell entry, implementing a v4 UUID using crypto.getRandomValues (which remains available on non-secure origins). On HTTPS or localhost access, the script remains inactive.

Automatic Binding and Trust Fence¶

The bundle patch binds the webserver to listen on 0.0.0.0. Upon startup, the plugin derives all non-internal IPv4 addresses from the host’s network interfaces, merges them with the existing results from resolveLanTrust, and writes them into the /api trust fence. Therefore, accessing via LAN IP and Tailscale IP literals typically requires no additional configuration—provided the remote interface is ready before dsh web starts.

MagicDNS Hostname Support¶

The trust fence can only discover IP literals and cannot automatically identify hostnames like xxx.tailXXXX.ts.net. To access via domain names instead of IPs, you must add both the short name and the full domain to the trustedHosts in web-runtime, or use the CLI:

dsh --profile web --trusted-host myhost --trusted-host myhost.tailXXXX.ts.net

Note: The Host header is matched literally. When accessing with http://myhost:3080, the short name myhost must be listed separately; otherwise, the page shell will load, but /api will return 403. Do not place hostname configuration on the connection line—this would override the bundle’s dynamic fence expression, causing the automatically derived LAN/Tailscale IP trust to fail.

Installation and Enabling¶

It is recommended to install via npm to the web profile:

dsh plugin --profile web add dsh-web-lan-access

For offline or local development, you can point to the GitHub repository:

dsh plugin --profile web add github:AcidGr/dsh-web-lan-access

After installation, restart dsh web and perform a hard refresh in the browser.

For offline manual installation, copy the plugin directory to $DSH_HOME/profiles/web/plugins/lan-access, create a @dsh-profile/lan-access symlink, and insert the corresponding ID in cordis.patch.yml. Specific paths and YAML snippets are available in the repository’s README.

Before installation, read the plugin source code and MIT license; the plugin runs with the permissions of the current dsh process.

Typical Usage¶

After installation, start normally without passing --host:

dsh --profile web --port 3080

Open http://<server-ip>:3080 or http://<tailscale-ip>:3080 on another device on the same LAN; the sessions and models should load.

Verify if the polyfill is injected:

curl http://127.0.0.1:3080/ | grep lan-access-polyfill

If there is matching output, the script has been written to the home page.

If you do not want the plugin to manage the bind address (e.g., you only want loopback with port forwarding), remove the webserver line override from the configuration tree and use socat, rinetd, or Tailscale serve for forwarding, while manually maintaining trustedHosts.

Use Cases and Notes¶

Who is this for: Developers who need to access the DSH Web UI from a phone or other computer via HTTP in a home or office LAN, Tailscale network, or similar environment; for scenarios where you don’t want to set up a separate HTTPS reverse proxy for internal debugging.

Security: Binding to 0.0.0.0 with /api having only a source fence and no login authentication means anyone on the same network segment can access the agent. Never expose this directly on a public IP host; use a firewall (e.g., ufw allow from 192.168.0.0/16), Tailscale, or an authenticated reverse proxy. If you are already using a TLS reverse proxy, this polyfill is typically unnecessary.

Known limitations: In unmodified upstream harness builds, sensitive APIs like settings.*, credentials.*, llm.discoverModels are still fixed to allow only loopback; remote access may result in empty or erroring settings and credential UIs. Chat and session functionality remain unaffected. Manage these items locally at http://127.0.0.1:3080, or modify the upstream isTrustedApiRequest line of code yourself.

Rollback:

dsh plugin --profile web remove dsh-web-lan-access

For manual installations, remove the lan-access insertion block from cordis.patch.yml.

Conclusion¶

dsh-web-lan-access addresses the issue where the DSH Web UI cannot start on insecure HTTP origins by injecting a polyfill via a host plugin and automatically configuring the listener and API trust, making LAN and Tailscale access work out-of-the-box. The plugin comes from the DSH community ecosystem; the SkillHub directory page and GitHub repository are independent and have no official affiliation with DeepSeek or High-Flyer.

Directory page: https://www.skillhub.cn/plugins/AcidGr/dsh-web-lan-access
GitHub: https://github.com/AcidGr/dsh-web-lan-access

dsh-web-lan-access: Enable DSH Web UI for LAN HTTP Access