The DSH Web client determines whether to enable host-specific settings persistence based on whether the hostname is loopback (localhost / 127.x). When accessing via a remote domain, the settings mirror degrades to memory, causing the Models page to report an error when resolving provider catalogs. This plugin provides a visual configuration entry in the settings panel. By configuring trusted domains, it coordinates API allowlisting and page trust evaluation to fix this issue.

What Is It

This is a DSH Web remote trusted access plugin maintained by liujuntao123. It fixes the problem where remote access to DSH Web via a reverse tunnel or custom domain causes the Models / Settings page to report settings are unavailable in this browser.

Core Features

  • Visual configuration in the settings panel: In Settings panel → General → “Remote Trusted Domains”, add or remove trusted domains as a tag list (supports host or host:port). Each domain tag displays the trust status of the current page (Trusted / Not trusted).
  • One configuration, two linked effects: The configuration takes effect immediately after being written, with no restart required.
    1. API allowlisting: The domain list is merged into connection.trustedHosts, used for Host/Origin fence validation on /api.
    2. Page trust check: Each time index is rendered, an inline script is injected. If location matches the list, it declares window.__DSH_TRANSPORT__ = { ownsHost: true }, allowing settings persistence for that page.
  • Matching semantics consistent with the server: Entries without a port match any port; entries with a port require an exact port match. Supports IPv6 literals (e.g., [::1]:8080).
  • Input tolerance: Automatically strips the https:// prefix, path, and query parameters, and normalizes the value to lowercase. Rejects illegal characters, userinfo (such as user@host), and non-numeric ports.

Installation

Install using the official command:

dsh plugin --profile web add git+https://github.com/liujuntao123/dsh-trusted-page.git

Usage Steps

  1. Open DSH Web on localhost (http://127.0.0.1:<port>).
  2. Go to Settings → General → “Remote Trusted Domains”, enter your remote domain (e.g., dsh.example.com), then press Enter or click “Add”.
  3. Open DSH Web using that domain (ensure the domain is already routed to your DSH service), then perform a hard page refresh (Ctrl+F5).
  4. Go to Settings → Models. The provider catalog should load normally and no longer report errors.

At this point, the corresponding settings row is also visible on the remote page (the displayed status depends on whether the current page is trusted).

Notes

  • Permissions and routing: This plugin only relaxes access for “domains declared in the authenticated settings panel”. The domain must already be routed to the DSH service (e.g., Cloudflare Tunnel, nginx reverse proxy, direct LAN connection). The plugin does not handle routing configuration.
  • Security model:
    • /api requests from outside trusted domains are still blocked by Host/Origin fence (403).
    • The page itself still requires browser session cookies or a startup token exchange. Index requests from unauthorized origins are blocked (401).
  • Dependency version: Developed and verified with @deepseek-ai/dsh 0.1.5-rc.1. The plugin depends on the webserver/index-inject injection event and the __DSH_TRANSPORT__.ownsHost read convention. If upstream semantics change, the plugin degrades safely.