Preface¶

DeepSeek Harness (DSH) runs by default in a local browser and disconnects when the user leaves the computer. To continue conversations on a phone over the same Wi-Fi network, connect back to a home machine from a public network while traveling, or invoke an Agent directly in WeChat/QQ/Feishu, one typically has to set up reverse proxies, port mappings, and Bot frameworks manually, while also considering the risk of access passwords and configurations being remotely altered.

The dsh-bridge (npm package name @wenbin_wb/dsh-bridge) introduced below is a DSH networking tool plugin maintained by community contributor wenbin-wb. It integrates local area network (LAN) QR code scanning, Cloudflare/self-built tunnels, and WeChat/QQ/Feishu/Telegram bots into a single settings page, with built-in access authentication and anti-tampering for the administration panel. The current latest npm version is v2.8.3 (consistent with the SkillHub directory page and GitHub package.json), and it has approximately 19 stars on GitHub.

What Is This¶

dsh-bridge is a multi-channel remote access and security gatekeeper plugin for DeepSeek Harness: it generates QR codes or tunnel addresses in the DSH Web settings page under “Remote Access,” allowing phones, tablets, or IM clients to call the local DSH Agent. It also supports enabling password or Token verification for public/LAN access separation, as well as administrator authentication for RPCs like file tree and workspace registration.

The plugin is released under the MIT license. Source code and documentation are available on GitHub, and the community directory page can be found at SkillHub. SkillHub is an independent community site with no official affiliation to DeepSeek or High-Flyer.

Core Features¶

Remote Access and Tunnels¶

• LAN QR Code Scanning: Scan the QR code on the settings page from a phone connected to the same Wi-Fi to directly open the DSH Web interface and continue conversations.
• Cloudflare Tunnel: One-click exposure of a public network address; supports Named Tunnel Token mode for fixed domains and can auto-start with DSH.
• Self-Built Tunnel: Connect to your own tunnel server to obtain a fixed domain. Setup steps are documented in docs/custom-tunnel.md in the repository.
• PWA Full Screen: After adding to the home screen via a mobile browser, it can run in full screen, adapting to the mobile top bar, drawer, and settings center.

IM Bots (Full Lifecycle Conversations)¶

Each platform uses its respective official API, with documentation available in the repository’s docs/ directory:

Common capabilities listed in the README include: workspace selection and switching, session persistence across restarts, media sending/receiving, permission approval cards, streaming output (Telegram), and more. The v2.8.3 release notes also mention WeChat iLink media protocol alignment, QQ rich media direct transmission, and multi-endpoint session artifact broadcasting.

Common IM commands (already described in the README):

• /addworkspace <absolute computer path> — Register or switch a workspace in the chat
• /rename <new title> — Rename the current session and sync with the Web interface

Remote Workspace Selection (v2.8.0)¶

When clicking “Add Workspace” on a mobile device or remote browser, a web-based tree directory selector pops up (supporting drive letters, shortcut directories, search, and manual path entry); the local localhost / Electron client still uses the system’s native folder dialog. The IM endpoint can specify an absolute path using /addworkspace.

Security and Disaster Recovery¶

The settings page under “Remote Access → Security Authentication” allows configuration of:

1. External Access Gatekeeper: A 256-bit Token embedded in the QR code enables password-free access via scanning; manually entering an IP/domain requires a visitor password. Protection scope can be set to “All Channels / Public Network Only / LAN Only.”
2. Admin Console Anti-Tampering: A separate admin password allows remote devices to lock network configurations and IM keys (modes include password-required unlock, local-only management, and relaxed direct management).
3. RPC Hardening: Endpoints like file tree, drive, and workspace registration require administrator authentication; sensitive system directory blacklists, symlink escape detection, and sliding window rate limiting.
4. Disaster Recovery: Local 127.0.0.1 retains the highest privileges; running touch ~/.dsh/dsh-bridge/reset-auth in the terminal resets authentication; the interface provides a “forgot password” guide.

Passwords are stored using PBKDF2 + SHA-256 with salted hashing; session cookies are HttpOnly SameSite for 30 days; a single IP is banned for 60 seconds after 5 consecutive incorrect attempts.

Operations and Migration¶

• Network Diagnostics: One-click detection of local reverse proxy ports, LAN IPv4, Cloudflare edge, and domestic npmmirror connectivity.
• Configuration Backup/Restore: Export/import .json packages containing Tokens, whitelists, and tunnel parameters for machine migration.
• System Monitoring Dashboard: CPU, memory, Node heap memory, and DSH service uptime.
• Version Check and Upgrade: Prioritizes npmmirror; the settings page supports one-click upgrade and restart of DSH; the terminal can use dsh plugin --profile web add @wenbin_wb/dsh-bridge@latest to force an update.

Installation and Enablement¶

Prerequisites¶

1. Node.js: ^22.19.0 or ≥ 24.0.0 (consistent with DSH requirements)
2. dsh CLI available: The terminal should be able to execute dsh --version

node -v
dsh --version

If DSH is not installed:

npm install -g @deepseek-ai/dsh

Installation Commands¶

Recommended installation from npm (SkillHub / README official command):

dsh plugin --profile web add @wenbin_wb/dsh-bridge

Example specifying a version:

dsh plugin --profile web add @wenbin_wb/dsh-bridge@2.6.1

Without global permissions, use npx:

npx --yes @deepseek-ai/dsh plugin --profile web add @wenbin_wb/dsh-bridge

After installation, restart DSH and configure it in the Web settings page under “Remote Access.”

Typical Usage¶

LAN Mobile Access¶

1. After restarting DSH, go to the settings page under “Remote Access.”
2. View the QR code in the LAN area; connect the phone to the same Wi-Fi and scan to open.
3. If “Public Network Only Protection” is enabled, LAN QR code scanning typically still allows password-free access via the QR code Token; if “All Channels Protection” is enabled, input the visitor password as configured in the Security Authentication tab.

Exposing to Public Network (Cloudflare)¶

1. Enable the Cloudflare tunnel under “Remote Access” and follow the interface instructions (Token mode allows fixed domains).
2. It is recommended to set external access protection to “Enable Protection Only for Public Network Tunnels,” keeping LAN access password-free while enforcing passwords on the public network.
3. Copy the generated public URL and use it in an external browser or IM Bot callback.

Integrating Telegram Bot (No Public IP Required)¶

1. Create a Bot with @BotFather and obtain a Token.
2. Enter the Token in the corresponding tab under “Remote Access”; the plugin receives messages via long polling getUpdates, requiring no public IP.
3. If the network is restricted, configure a built-in HTTP/HTTPS proxy in the settings. Detailed steps are in docs/telegram-usage.md.

Switching Workspaces in IM¶

In a bound WeChat/QQ/Feishu/Telegram session, send:

/addworkspace D:\Projects\my-repo

The path must be an absolute local path; after registration, you can continue the Agent conversation for that workspace in the IM channel.

Use Cases and Considerations¶

Who It’s For

• Developers who frequently continue DSH sessions on phones or tablets.
• Users who need a fixed public network entry point but don’t want to build an entire reverse proxy setup (using Cloudflare or self-built tunnels).
• Scenarios where Agent operations need approval and files need to be sent/received in enterprise IM (Feishu) or daily IM (WeChat/QQ/Telegram).

Before Using, Please Note

• The plugin runs with the current OS user permissions of the dsh process, and the Agent’s file read/write scope is consistent with this; before installing, it’s recommended to browse the source code and MIT license to confirm acceptance of its network exposure and IM integration behavior.
• Exposing the DSH Web interface via a public network tunnel is equivalent to exposing it to the internet; be sure to enable security authentication and set a strong password. IM Bot Tokens, Cloudflare Tokens, and other secrets are only stored in local configurations—do not commit them to version control.
• If add @latest doesn’t install the newly released version, the README indicates this might be related to pnpm 11’s minimumReleaseAge (default 24 hours); you can use the “One-Click Upgrade” in the settings page or adjust the profile’s pnpm-workspace.yaml.

Conclusion¶

dsh-bridge extends DSH from “can only be used in front of a computer” to support QR code scanning, public network tunnels, and mainstream IM platforms, integrating access control, backend locking, and disaster recovery reset into a single settings page. If you are already using DSH and need remote or multi-endpoint access, you can install it using the commands above and enable the desired channels one by one from “Remote Access.”

• Community Directory: https://www.skillhub.cn/plugins/wenbin-wb/dsh-bridge
• GitHub Repository: https://github.com/wenbin-wb/dsh-bridge