Preface

The loopback access of dsh --profile web is suitable for local use. If you need to open the dsh Web UI within a LAN, binding to all interfaces directly would expose the page, /api RPC, and WebSocket downlink over the HTTP service.

studyzy/dsh-web-remote-access is a bundle plugin for the dsh web profile, used to support --host 0.0.0.0 remote access and ensure remote access always goes through the web token gatekeeper. It does not modify the harness source code, and uninstalling the plugin can completely restore default behavior.

What is this

This plugin is maintained by studyzy, licensed under MIT, and requires Node.js >= 18 and the dsh environment. It is installed as a dsh web profile plugin and solves the problem of allowing the dsh Web UI to be accessed remotely while preserving the token-free experience of loopback access.

Core Features

  • Supports --host 0.0.0.0 remote access, always protected by a web token.
  • The page, /api RPC, and WebSocket downlink pass through the web token gatekeeper.
  • Upon first opening with ?web_token=, the server performs a 302 redirect and issues a dsh_web_token session cookie.
  • Loopback access does not require a token.
  • Prints the URL with ?web_token= at startup; also prints LAN addresses when binding to all interfaces.
  • Token validation uses sha256 + timingSafeEqual constant-time comparison.
  • /manifest.webmanifest is exempt from the token requirement, and PWA installation detection is unaffected.
  • Authenticated /api requests are presented with the authority of the loopback, enabling settings.*, credentials.*, agentPreset.*, host.*, and llm.discoverModels to be accessed remotely.
  • Does not modify harness source code; all implemented via the bundle plugin.
  • Uninstalling the plugin can completely restore default behavior.

Installation

Execute in the dsh environment:

dsh plugin --profile web add git@github.com:studyzy/dsh-web-remote-access.git

After installation, the following describes how to start.

Typical Usage

Start remote access with a fixed token:

dsh --profile web --host 0.0.0.0 --web_token <token>

Provide a token via environment variable:

DSH_WEB_TOKEN=<token> dsh --profile web --host 0.0.0.0

Start remote access without specifying a token:

dsh --profile web --host 0.0.0.0

Loopback access:

dsh --profile web

--web_token is only enabled for --host 0.0.0.0 binding. By default, it falls back to $DSH_WEB_TOKEN, and then to a randomly generated token at startup. When a remote token is not explicitly specified, the generated random token will be printed in the startup URL.

First access to a URL with a token:

http://<host>:<port>/?web_token=<token>

After success, it redirects to a clean path and issues a dsh_web_token session cookie.

Access Control and Limitations

  • No TLS, no account system; this is a shared-key gatekeeper over pure HTTP. Except for trusted networks, please use a real reverse proxy in front of the dsh web to terminate TLS.
  • The token appears in the address bar/history upon first opening, and is cleared from the address bar after redirection.
  • /manifest.webmanifest only requires no token for GET/HEAD, used for PWA installation detection.
  • Known limitation: DSH_WEB_URL and web-surface model prompts are still loopback URLs without a token; this bundle does not provide a model-side URL with a token.
  • The plugin runs with the permissions of the current dsh process. You should check the source code and license before installing.

Conclusion

This plugin is suitable for allowing the dsh Web UI to be accessed by a remote browser within a trusted network, while maintaining the simplicity of loopback access.

  • GitHub: https://github.com/studyzy/dsh-web-remote-access
  • Directory page: No specific URL provided in verified sources; can be searched for by plugin name studyzy/dsh-web-remote-access in the DSH Community Directory.