The core design of DeepSeek Harness is plugin-based, but plugins typically run locally or in specific network environments. When you need to operate Harness from mobile devices or when away from a computer, direct interaction becomes difficult. dsh-wechat-channel solves this problem: it allows you to control Harness by sending commands through a WeChat Official Account and pushes execution results back to WeChat via the customer service message interface.

Core Features

This plugin primarily provides the following capabilities:

  • WeChat command control: Send a message in WeChat to control Harness.
  • Result push: Execution results are pushed back to WeChat via the customer service message interface.
  • Security verification: Includes callback signature verification and an openid whitelist mechanism.
  • Zero runtime dependencies: Does not depend on additional runtime environments.
  • Independent routing: Uses the standalone prefix /wechat-mp, avoiding conflicts with same-named third-party plugins.

Installation and Activation

Installing from npm is recommended. After installation, you must restart the dsh web process to load the new plugin.

Install from npm (recommended)

dsh plugin --profile web add dsh-wechat-channel

Install from a local directory (for development)

dsh plugin --profile web add link:<本目录绝对路径>

After installation, DSH Desktop automatically registers the plugin in dsh.profile.bundles.

Configuration

Add the configuration in the profile user patch layer <DSH_HOME>/profiles/web/cordis.patch.yml. A standard configuration example is shown below:

- id: wechat
  config:
    # Token 是你自己编的，不是微信给你的。需与公众号后台「服务器配置」一致
    token: 你的自定义Token
    # 测试号页面的 appID / appsecret（异步回复必需）
    appId: wx********
    appSecret: ********
    # 回调路径，默认 /wechat-mp。此路径需与公网 URL 后缀一致
    path: /wechat-mp
    # 允许下指令的 openid 白名单（首次使用需留空获取 openid 后填写）
    allowFrom: []
    # 是否开启白名单验证
    requireWhitelist: true
    # Agent 预设配置
    agentPreset: standard
    # 会话超时时间
    turnTimeoutMs: 600000
    # 开启诊断日志
    diagnostics: true

Note: The name dsh-wechat-channel is chosen to avoid a conflict with another same-named plugin dsh-wechat on npm (which uses the iLink protocol). That same-named plugin registers the /wechat/status route, and a conflict with DSH’s web server route can cause this plugin to fail silently. Therefore, this plugin uses the /wechat-mp prefix.

Network and Public Internet Requirements

WeChat message callbacks are initiated by Tencent servers, so the following conditions must be met:

  • The callback URL must be reachable from the public internet.
  • It must use the HTTPS protocol and have a valid certificate.
  • Having a phone and a computer on the same WiFi within a LAN does not satisfy these requirements; Tencent servers cannot access internal network addresses.

LAN alternative: If you need to operate DSH from a phone within a LAN, use the @linxin666/dsh-remote-web-ui plugin (phone browser QR code pairing). This plugin does not cover that scenario.

Tunnel Configuration

To enable public internet access, tunneling tools are usually required. This project ships with the cloudflared binary.

Notes for networks in China: On networks in China, QUIC (UDP) is often blocked, which may cause the tunnel to register successfully but then immediately return 502/530 errors. It is recommended to use the http2 protocol:

bin/cloudflared.exe tunnel --url http://127.0.0.1:<dsh web 端口> --no-autoupdate --protocol http2

WeChat Official Account backend configuration:
1. Use the temporary tunnel address you obtain (for example, https://xxxx.trycloudflare.com) as the URL.
2. The path suffix must include the plugin’s path configuration, i.e., /wechat-mp.
3. Enter the same value as the token in the configuration file.

Note: The trycloudflare.com address is temporary and changes after a restart. For production, use a fixed domain.

First-Time Use and Whitelist

1. Configure the whitelist:
allowFrom is empty by default, and all users are rejected in that state. For first-time use:

  • Submit the server configuration (URL and Token) in the Official Account backend, and ensure it shows “Configuration successful”.
  • Follow the test account and send any message.
  • The plugin returns your openid via a customer service message.
  • Add the returned openid to the allowFrom list in the configuration file.

2. Restart the service:
After modifying the configuration, you must restart the dsh web process.

Security Model

  • Whitelisting means control: Once an openid is added to the whitelist, that device effectively holds the credentials for full control of Harness (command execution, reading and writing files).
  • Signature verification: The callback entry point includes SHA1 signature verification; invalid signatures result in a 403 response.
  • Status endpoint: GET <path>/status?key=<token> can be used for troubleshooting, but it never echoes the token.

Source Code and Directory

This plugin uses a layered architecture (lib/protocol.js, lib/server.js, lib/wechat-api.js, lib/bridge.js, lib/index.js), with each layer kept independent for easier testing and maintenance.