Introduction

DSH (DeepSeek Harness) can extend Web-side capabilities through plugins. For scenarios where DSH Web needs to be accessed via a public domain or LAN IP, unauthenticated remote /api access would expose remote access directly. dsh-access-gate is an authentication gate plugin designed for such scenarios: it restricts non-local direct access after configuring a password, while preserving the local user experience, and cleans up side effects upon uninstallation.

The DSH plugin ecosystem mentioned here emphasizes “everything is a plugin”; the community directory is an independent site and does not represent the official app store.

What is this

dsh-access-gate is DSH’s remote access authentication gate plugin, maintained by bamboostrip, with an MIT license. It primarily provides password protection for remote /api access, defaults to no password, and offers native directory selection on local machines and zero-residue uninstall capability.

Core Capabilities

The following introduces verified capabilities.

  • Default No Password: Remote access is allowed directly when no password is configured.
  • Remote Password Gate: After configuring a password, non-local direct access requires login. Login uses HttpOnly Cookies, valid for 7 days by default.
  • Local Directory Selection: When adding a workspace locally, the official native directory dialog can be opened; remote access automatically degrades to the in-app browser.
  • Alternative to dsh-lan-access: Provides webserver 0.0.0.0 binding and crypto.randomUUID polyfill.
  • Security Handling: Password comparison uses sha256 and timingSafeEqual, and includes security measures like preventing open redirects and blocking Host spoofing.
  • Source Code and Uninstall: Provides TypeScript source and compiled artifacts; external API contracts are centralized in src/types.ts; side effects are restored upon uninstallation via ctx.effect cleanup callbacks; claims not to modify DSH source code or write to user configuration files.

Installation and Enablement

First, install the plugin:

dsh plugin --profile web add dsh-access-gate

Restart DSH after installation for changes to take effect. By default, there is no password, and remote access is possible directly.

To enable password protection, you can choose one of two methods:

  1. Set the password via the DSH Settings Interface → Plugin Configuration → Access Authentication card. Once saved, it writes to ~/.dsh/.credentials.yaml and takes effect immediately.
  2. Set the password using the environment variable DSH_GATE_PASSWORD. This source takes precedence over the file layer and takes effect after restarting DSH.

The verified priority of password sources is:

config.password > DSH_GATE_PASSWORD > ~/.dsh/.credentials.yaml > .env

If there is a delay in the npm domestic mirror sync causing a “package not found” error during installation, refer to the documentation to switch to the GitHub installation method.

Typical Usage

Login Behavior

  • Remote access can proceed directly when there is no password by default.
  • Non-local direct access requires password login after a password is configured.
  • Login state is saved in memory; re-login is required after restarting the DSH process.
  • The login validity period defaults to 7 days and can be adjusted via tokenTtlMs.

Optional Configuration

Optional configuration items are centralized in auth-gate, including password, trustedRemotePrefixes, and tokenTtlMs. Example:

- id: auth-gate
  config:
    # password: 'xxx'
    trustedRemotePrefixes: ['10.144.144.0/24']
    tokenTtlMs: 604800000

Among these, trustedRemotePrefixes can be used for password-free access within LAN segments, tokenTtlMs is for setting the login validity period; password can serve as a password source at the configuration layer.

Suitable Scenarios

  • Access DSH Web via an nginx public domain name.
  • Access DSH via a LAN IP.
  • Need to replace the 0.0.0.0 binding and crypto.randomUUID polyfill provided by dsh-lan-access.
  • Wish to use the native directory dialog when adding a workspace locally.

Notes

  • The plugin runs with the permissions of the current DSH process; it is recommended to check the source code and license before installing.
  • When there is no password by default, remote access is equivalent to local operation permissions. It is recommended to configure a strong password and add an IP whitelist / Basic Auth at the nginx layer before exposing to the public network.
  • It is recommended to use HTTPS with nginx to prevent plaintext transmission of passwords and Cookies.
  • The login interface does not limit the number of failed attempts; this is a known boundary and can be referenced in NOTES §5.
  • package.json declares engines.node as >=22.
  • Starting from v0.6.0, DSH 0.1.0-rc.7+ is required; if DSH is rc.6, please use v0.5.0.
  • Login state is stored in memory; re-login is required after the DSH process restarts.

Uninstall

dsh plugin --profile web remove dsh-access-gate

After uninstallation, related side effects are restored via ctx.effect cleanup callbacks; the plugin claims not to modify DSH source code or write to user configuration files.

Links

  • GitHub: https://github.com/bamboostrip/dsh-access-gate
  • Directory Page: https://www.skillhub.cn/plugins/bamboostrip/dsh-access-gate (This URL comes from plugin clues and did not directly appear in the current fetched materials)