Foreword

When developing agents with DSH (DeepSeek Harness), dsh web launches a browser interface on the local machine. To access the same interface from another device on the local network, the service needs to be bound to 0.0.0.0. The original @deepseek-ai/dsh-web-app/startup hard-blocks the --host 0.0.0.0 option for security reasons, effectively shutting down the possibility of remote access.

This introduces the community plugin dsh-web-startup-auth: it replaces the original launcher and includes username/password authentication, making dsh web --host 0.0.0.0 usable in local network scenarios.

What is This

dsh-web-startup-auth is maintained by GDWhisper and categorized as a “networking tool” plugin in the DSH community directory. It is a DSH bundle: after installation, it automatically patches the original startup logic via cordis.patch.yml, requiring no manual configuration file edits.

One-line summary: Remote web startup + username/password authentication, allowing the DSH browser interface to be exposed on non-loopback interfaces while protecting the API with sessions.

Core Features

Remote Startup

Allows using --host 0.0.0.0, replacing the original launcher’s hard rejection of this parameter.

Login and Registration

On first access, it guides you to set up an administrator username and password, then redirects to the login page; the interface style matches the DSH black-white-blue theme. After login, a signed cookie dsh_sid is issued (valid for 14 days, HttpOnly + SameSite=Lax).

API Protection

All /api/* routes and third-party plugin RPC routes (except /api/auth/* and /login) require a valid session; otherwise, they return 401 or reject the handshake.

Settings Panel

Injects an “Authentication” tab into the DSH settings panel, providing logout and password change functionality. A standalone endpoint /api/auth/logout can clear the session cookie.

Remote Scenario Fixes

Patches two issues related to local network HTTP access:

  1. crypto.randomUUID polyfill—this API is missing in insecure contexts, causing RPC failures.
  2. Privileged API loopback bypass—DSH restricts sensitive domains like settings.* and credentials.*, third-party RPC channels with authority: "loopback", and WebSocket event streams to loopback hosts only; after authentication, this plugin bypasses this restriction in loopback mode.

Upstream Compatibility (dsh ≥ rc.8)

When accessing the browser remotely, the frontend settings mirror required by the settings panel originally reported settings are unavailable in this browser. This plugin injects a script via webServer.tapIndex to override connection.isLoopback to always true when the connection plugin activates, allowing the mirror and configuration scope to be created in host mode without refreshing the page.

Installation and Activation

This plugin is a DSH bundle. package.json’s dsh.bundle.patch declares the distributed cordis.patch.yml. After installing with dsh plugin, the package is added to the profile’s dsh.profile.bundles, and the patch layer takes effect automatically.

Install from npm registry (current version 0.1.2):

dsh plugin --profile web add dsh-web-startup-auth@latest

Install from source:

git clone https://github.com/GDWhisper/dsh-web-startup-auth
cd dsh-web-startup-auth
npm install
npm run build
dsh plugin --profile web add .

dsh plugin is a pnpm forwarder, --profile <name> is required; add . installs the current directory into the profile via link:.

Start the service:

dsh web --host 0.0.0.0

The patch is automatically applied during installation, so no need to use --patch again—repeated patching would reinsert the plugin.

Typical Usage

  1. Access http://<host-IP>:<port>/ in a browser.
  2. On first access, you are redirected to /login, which displays a “Set Administrator Username and Password” registration form.
  3. After successful registration, you are automatically logged in and taken to the main interface; subsequent access requires login.
  4. To log out or change password: Main interface → Settings panel → Authentication tab.

Credentials and session keys are saved in ~/.dsh/web-auth.json:

  • Passwords are hashed with scrypt (random salt, 64 bytes).
  • Session cookies are signed with HMAC-SHA256 using a random key.

If you forget your password, run the following on the server’s local machine:

dsh --profile web auth-reset

Non-interactive mode:

dsh --profile web auth-reset --password <new-password>

Resetting will rotate the session key, invalidating all issued sessions. As a fallback, delete ~/.dsh/web-auth.json and restart to re-register (this also invalidates all sessions but requires a service restart).

Applicable Scenarios and Notes

Who is it for: Developers who need to access the DSH Web interface from a phone, tablet, or another computer on the local network; scenarios requiring shared DSH sessions on a trusted internal network.

Security Boundaries (from README security notes):

  • This plugin provides authentication, not transport encryption. Credentials and traffic can be captured over plain HTTP on the same network. Use only on trusted internal networks or deploy an HTTPS reverse proxy in front.
  • Sessions are valid for 14 days; dsh_sid is a self-contained signed cookie and cannot be individually revoked if leaked for 14 days. auth-reset or “Change Password” in the settings panel rotates the session key, invalidating all sessions at once.
  • If no credentials are set, any visitor can register as an administrator. Complete the initial registration before exposing the service to untrusted networks.
  • Failed logins are rate-limited by client IP: 5 consecutive failures lock for 30 seconds (in-memory only, no persistence); registration requires passwords of at least 8 characters.
  • --trusted-host is retained only for backward compatibility with the original CLI and passed through without participating in this plugin’s authentication check—remote clients always require a valid session.
  • The plugin runs with the current dsh process permissions; review the source code and license (MIT) before installation.

Links

  • Community Directory Page: https://www.skillhub.cn/plugins/GDWhisper/dsh-web-startup-auth
  • GitHub Repository: https://github.com/GDWhisper/dsh-web-startup-auth