Preface

Daily operations for DeepSeek Harness (DSH) usually happen on the desktop: the web GUI in a browser or a window of a desktop shell. When a person leaves their desk and wants to check the conversation history of a specific workspace on their mobile phone or send a follow-up prompt, there is usually no ready-made entry point.

dsh-mobile solves this problem. It sets up a mobile connection bridge within the local area network: the desktop side displays a QR code, the mobile phone scans and pairs, and after the desktop approves, the mobile phone directly opens a DSH client optimized for mobile devices. Below is an introduction to the plugin’s positioning, features, installation, and usage.

What is it

dsh-mobile is a plugin for the DeepSeek Harness core, maintained by s17179XTY, licensed under MIT, and currently version 1.0.1. In short: a LAN mobile connection bridge (QR code pairing + desktop approval + mobile DSH client), providing a mobile entry and connection status indicator in the Web GUI settings row.

DSH’s philosophy is “everything is a plugin.” This plugin is only for the DSH core and does not bind to any specific shell application: as long as a DSH web profile is deployed and running—whether via the command line dsh web, Bigfish, a DSH Desktop-like desktop shell, or any wrapper—it can be installed and used. The package does not contain code specific to Bigfish or DSH Desktop.

Core Features

QR Code Pairing and Desktop Approval

The mobile phone scans the QR code to complete pairing; tokens rotate every 30 minutes, using a timing-safe comparison method; after the desktop confirms, the mobile phone receives an HttpOnly session cookie.

Mobile DSH Client

On the mobile side, users can access workspaces, session lists, and chat history, and can send prompts and stop generation. The client is served by the bridge and is fully usable within the local area network.

Mobile Entry in Settings Row

The mobile phone icon is located on the right side of the Web GUI settings row. It displays a green connection dot when a phone is paired. Clicking the icon opens the pairing/manage dialog, containing actions such as QR code, copy, countdown, approve/reject, and disconnect.

Three-Part Structure

The plugin consists of three parts:

  • LAN Bridge (lan-bridge.mjs): An independent Node HTTP server bound to 0.0.0.0 on a random port, responsible for pairing, the mobile client, RPC forwarding, and /desktop* JSON/QR endpoints (including CORS).
  • Host Plugin (lib/index.js): Generates and monitors the bridge (auto-restart with a limit), exposing /phone-connect/bridge and /phone-connect/config.
  • Client Plugin (lib/client.js): An __ModuleLoader__ bundle providing the settings row mobile entry (green dot), pairing dialog, and copy/countdown/approval UI.

Installation and Activation

The plugin requires the DeepSeek Harness web profile; any deployment running the web profile can install it. First, execute the installation command:

dsh plugin --profile web add https://github.com/s17179XTY/dsh-mobile

It can also be installed via the DSH Plugin Market / dshmarket UI.

After installation, restart the harness (or the profile) to mount the corresponding line in cordis.patch.yml. The package depends on qrcode (^1.5.4), which is automatically installed by the profile’s package manager.

Typical Usage

  1. Open the web GUI and find the mobile phone icon on the right side of the settings row (bottom left sidebar).

  2. Click the icon to open the pairing dialog. The QR code is valid for 30 minutes and refreshes automatically upon expiration; a Copy button is next to the URL.

  3. Keep the mobile phone on the same trusted Wi-Fi as the desktop, scan the code with the camera, or open the copied URL.

  4. The dialog shows the phone waiting to be paired; click “Allow”.

  5. The mobile phone opens the mobile DSH client. The connection stays active in the background, and the icon displays a green dot; reopening the dialog can disconnect the connection or refresh the QR code.

The pairing URL is valid across dialog sessions throughout its full lifecycle; only expired tokens are rotated.

Shell Integration

Plugin integration with the shell happens on two levels.

For pure browser deployments, no extra work is needed: the settings row mobile entry and pairing dialog are provided by the client plugin and automatically appear in the web GUI with the plugin.

For native desktop shells (e.g., Electron apps like DSH Desktop), note that the plugin cannot inject menu items into the shell’s native menu bar, as this belongs to the shell’s own code. As an alternative, the plugin provides a desktopUrl hook. The host plugin exposes a snapshot of the bridge via GET /phone-connect/bridge, where desktopUrl points to:

http://127.0.0.1:<port>/desktop

This page is accessible only via loopback and contains the full pairing/manage interface (QR code, auto-refresh, approve/reject, disconnect). The shell can discover this URL with a single same-origin HTTP call, then open a small window in its own “Connect Phone” menu or tray item, requiring no extra configuration or credentials.

Security Design

The plugin’s default configuration prioritizes security:

  • The bridge binds to 0.0.0.0 on a random port and rejects non-private network clients (10/8, 172.16/12, 192.168/16, ULA, and link-local IPv6).
  • The /desktop* endpoints are restricted to loopback; CORS is granted only to the harness GUI origin.
  • Pairing tokens are 32 random bytes, compared using timing-safe methods, with a 30-minute TTL.
  • Mobile sessions use HttpOnly and SameSite=Strict cookies.
  • The mobile client can only call RPC methods in a whitelist: workspace.list, session.list, session.history, session.create, session.prompt, session.cancel.
  • The client enables strict CSP headers.

Please only use this in a trusted network. When you do not need mobile access, remove the dsh-mobile line from cordis.patch.yml or uninstall the plugin directly.

Notes

  • The plugin runs with the permissions of the current DSH process. It is recommended to check the repository source code and license (MIT, LICENSE included in the repo) before installation.
  • If the bridge crashes, the host automatically restarts it, up to 5 times with a 3-second interval; the error field of /phone-connect/bridge carries the reason for the last exit.
  • The operations the mobile end can perform are limited by the RPC whitelist, i.e., the six method types listed above.

Summary

dsh-mobile extends DSH’s usage from the desktop to mobile devices within the same local area network: scan, pair, approve, and use the mobile client in three steps, with secure configuration enabled by default. For developers who often need to follow up on sessions outside their desk, this is a worthy addition.

  • Directory Page: https://www.skillhub.cn/plugins/s17179XTY/dsh-mobile
  • GitHub: https://github.com/s17179XTY/dsh-mobile

It should be noted that skillhub.cn is a community-maintained plugin directory site, independently operated, with no official affiliation to DeepSeek / Fenxiang.