Introduction¶

The plugin mechanism of DSH emphasizes “everything is a plugin,” allowing Web-side capabilities to be broken down into independent plugins to load. For DSH Web, a common requirement is to temporarily expose local pages to the public network so that mobile phones or other devices can access them via a browser; existing approaches usually require registering third-party accounts, configuring domains, or manually running tunnel programs.

Below, I introduce 13323232dong/dsh-tunnel-qr-plugin. It is an integrated plugin for DeepSeek Harness Web that provides public network access. It generates QR codes via Cloudflare Quick Tunnel and a local authentication proxy. After scanning the QR code with a phone, users can log in and access the interface without entering a username or password, and without registering third-party accounts or configuring domains.

What is this¶

dsh-tunnel-qr-plugin is maintained by 13323232dong with an MIT license; the current version is 0.1.0-rc.5.

Its functionality is concentrated in the following areas:

1. Automatically download and verify cloudflared.
2. Start Cloudflare Quick Tunnel.
3. Provide a QR code entry point in the bottom-right corner of DSH.
4. Automatically log in after a phone scans a QR code containing a one-time security key.

This plugin does not install LaunchAgent, Windows Service, or systemd services; it does not require administrator privileges and runs only alongside the DSH process.

Core Capabilities¶

The verified capabilities are as follows:

• Automatically download and verify cloudflared.
• Start Cloudflare Quick Tunnel.
• Provide a QR code entry point in the bottom-right corner of DSH.
• The QR code carries a one-time security key.
• Automatically complete login after a phone scans the QR code, without needing to enter a username or password.
• The QR code popup automatically refreshes every 15 seconds while open, but can also be manually refreshed.
• Each security key can be used only once and expires by default after 5 minutes.
• After successful login, HTTP and WebSocket access uses HttpOnly, Secure, and SameSite=Strict cookies.
• No need to register third-party accounts or configure domains.
• The public network entry connects only to the authentication proxy on the loopback address and does not directly expose DSH’s local ports.
• The plugin does not write QR code tokens, session cookies, or temporary public network addresses to the repository.
• All status and QR code interfaces use Cache-Control: no-store.

Installation and Enabling¶

First, ensure your local Node.js version is not lower than 22.19.

Then use the DSH official profile plugin command to install a specific commit:

npx -p @deepseek-ai/dsh dsh plugin --profile web add "github:13323232dong/dsh-tunnel-qr-plugin#88d36735b54cfe28bb16d4f72058f96bf43df53d"

After installation is complete, restart the Web profile.

On first launch, the plugin downloads the fixed version for the corresponding platform from the official Cloudflare GitHub Release, verifies the SHA-256 hash, and caches it to the DSH plugin data directory. After the download and tunnel startup are complete, you can view the QR code button in the bottom right corner.

Typical Usage¶

After completing the steps above, the typical flow is to start DSH Web first, and then let the plugin establish the tunnel:

1. A QR code will automatically pop up once the tunnel is available.
2. You can also click the “QR Code” button in the bottom right corner at any time to view it again.
3. Automatically complete login after scanning the QR code with a phone.
4. The QR code popup automatically refreshes every 15 seconds while open, but can also be manually refreshed.
5. After successful login, the browser accesses HTTP and WebSocket using HttpOnly, Secure, and SameSite=Strict cookies.
6. The Quick Tunnel address may change after DSH or the tunnel restarts; old addresses, QR codes, and sessions will become invalid.

For development verification, you can run the following in the plugin repository:

pnpm install --frozen-lockfile
pnpm verify

verify runs Host/Client type checking, offline unit and integration tests, Host/Client builds, and Git artifact drift checking.

Supported Platforms¶

If the current system or architecture has no clearly mapped Cloudflare release, the plugin will indicate platform not supported and will not attempt to run files for other architectures.

Status and Troubleshooting¶

Common statuses can be handled as follows:

• Starting: Verifying or downloading the program and establishing a tunnel.
• Reconnecting: Temporary connection interrupted; the plugin is retrying with a limited number of attempts.
• Start Failed: You can refresh the QR code to re-read the status. If it still fails, check the GitHub download network and your local firewall.
• Platform Not Supported: The current system or architecture has no clearly mapped Cloudflare release, and the plugin will not attempt to run files for other architectures.

Dependencies and Runtime Boundaries¶

The plugin’s peer dependencies are as follows:

@deepseek-ai/cordis >=4.0.1 <5
@deepseek-ai/dsh-client-runtime ^0.1.0-rc.5
@deepseek-ai/dsh-host-webserver ^0.1.0-rc.5

Notes for runtime:

• The plugin runs only alongside the DSH process and does not install system services.
• No administrator privileges are required.
• The public network entry connects to the authentication proxy on the loopback address and does not directly expose DSH’s local ports.
• QR code tokens, session cookies, or temporary public network addresses are not written to the repository.
• The Quick Tunnel address, QR code, and session will change when DSH or the tunnel restarts.

Applicable Scenarios and Precautions¶

This plugin is suitable for scenarios where you need to temporarily expose DSH Web to a mobile phone, laptop, or other network devices, especially for local development environments that wish to avoid manually configuring domains, third-party accounts, or tunnel services.

Before installation, it is recommended to review the source code and license. The plugin runs with the permissions of the current DSH process, so you should ensure trust in the DSH runtime environment itself. If your local network cannot access GitHub, Cloudflare Releases, or the Quick Tunnel address, the plugin may fail to complete the download, startup, or access.

Reference Links¶

The directory page can serve as a reference for the plugin; please refer to the platform directory for specific information:

https://www.skillhub.cn/plugins/13323232dong/dsh-tunnel-qr-plugin

GitHub repository:

https://github.com/13323232dong/dsh-tunnel-qr-plugin