Introduction¶

When running the DeepSeek Harness (hereinafter referred to as DSH) Web interface on a shared machine or LAN environment, anyone who can access the address can directly enter the interface and operate it. If you only want to add a basic layer of account access control, you don’t need to modify the core DSH; a plugin bundle can achieve this. The @dsh-login-gate/auth-gate introduced below (repository javaxiaov/deepseek-herness-login) is such a plugin: when not logged in, it covers the entire application with a full-screen login page; after logging in, you can change the account, password, and logout within the system settings.

What is it¶

It is a plugin bundle providing login access control and account management for the DeepSeek Harness Web interface, authored by javaxiaov, version 1.0.0, and licensed under MIT. The Host side is responsible for account storage and HTTP routing, while the Browser side is responsible for the login mask and account settings page; the client bundle declares platform: web and immediately: true.

The repository directory structure is as follows:

dsh/
  index.js           Host side: HTTP routing (login/status/logout/update password)
  account-store.js   Host side: scrypt hash + local persistent storage
  client.js          Browser side: login mask + account settings page (lazy-CJS bundle)
cordis.patch.yml     Plugin loading configuration
package.json         Package declaration (dsh.bundle / dsh.client)

Core Features¶

The following capabilities are all derived from the repository README:

• Login Access Control: When not logged in, the full-screen login page covers the entire application, preventing any operation.
• Account Settings: A new “Account Settings” page is added to the system settings, allowing you to modify the username and password.
• Logout: Both the top of the settings page and the account settings page feature a red “Logout” button. Clicking it immediately switches back to the login page, logging out the account only without affecting the application.
• Multi-language: Automatically switches based on the DeepSeek Harness interface language (Settings → Appearance → Language), supporting both Chinese and English.
• Secure Storage: Passwords are persisted to local files using salted scrypt hashing; plaintext passwords are not stored.
• Persistence: Account and password modifications are retained after restarting the application.

Installation and Usage¶

This plugin is installed as a bundle within a user profile. Its package.json declares private: true; the installation method is a local link within the profile (bundle reference + pnpm install), not an npm install, and the README does not provide commands like dsh plugin add.

The specific steps are as follows:

1. Place the repository content into the profile’s bundles directory, for example ~/.dsh/profiles/web/bundles/auth-gate/.

2. Add a bundle reference to the profile’s package.json:

{
  "dsh": {
    "profile": {
      "bundles": [
        "@dsh-login-gate/auth-gate"
      ]
    }
  },
  "dependencies": {
    "@dsh-login-gate/auth-gate": "link:./bundles/auth-gate"
  }
}

3. Execute the following command in the profile directory to establish the link:

pnpm install

4. Restart the DeepSeek Harness application. After the steps above, accessing the Web interface while not logged in will first display the full-screen login page, with the default account admin and password admin123.

Account Data and Interfaces¶

Account data is saved in <profile directory>/login-gate-accounts.json, and the password field stores only a salted scrypt hash:

{
  "username": "admin",
  "password": "scrypt$16384$8$1$<salt>$<hash>",
  "sessionToken": null
}

The Host side (dsh/index.js + account-store.js) exposes four interfaces:

Use Cases and Precautions¶

Suitable for scenarios where the DeepSeek Harness Web interface is run on a shared machine or LAN and requires an account access control layer; it only handles login and account management and does not require introducing additional services.

Please note the following points before use:

1. The default account admin / password admin123 is openly listed in the README; the first thing to do after installation should be to change them via “Account Settings”.
2. When modifying the username or password, the interface requires the current password to be provided.
3. The plugin runs with the permissions of the current DSH process; before installation, it is recommended to read the repository source code thoroughly and confirm the license terms (MIT, see the repository LICENSE file for details).
4. The client bundle platform is web and is suitable for the Web interface.

Summary¶

The auth-gate plugin uses a single bundle to solve the access control and account management for the DSH Web interface: place it in the bundles directory, add a reference in package.json, execute pnpm install, and restart; passwords are saved to disk using salted scrypt hashing and are retained after restart.

Repository address: https://github.com/javaxiaov/deepseek-herness-login ; Community plugin directory listing page: https://www.skillhub.cn/plugins/javaxiaov/deepseek-herness-login (an independent community site with no official affiliation with DeepSeek or Huanfang).