Introduction¶

The core design philosophy of DeepSeek Harness (DSH) is plugin-based. For personally hosted Web instances on a local machine or LAN, relying solely on the default configuration makes it difficult to prevent unauthorized access. The dsh-totp plugin adds a TOTP layer in front of the DSH Web service, providing time-based one-time password access control for personal instances. It does not rely on Google or Microsoft account login, nor does it require setting up an additional authentication service.

Core Capabilities¶

The plugin primarily provides the following capabilities:
1. Provides TOTP access verification for DSH Web instances, supporting standard apps such as Google Authenticator and Microsoft Authenticator.
2. Supports QR code binding in DSH’s “Settings → Access Verification,” and provides binding, a protection switch, recovery codes, and locking features.
3. One-click lockout for all authorized pages and devices.
4. Supports LAN or remote access.
5. Does not rely on Google/Microsoft account login and does not require an additional authentication service.
6. The plugin distributes JavaScript directly, without a build step.
7. Supports DSH’s Fetch, XHR, / API, WebSocket, and restricted resource requests.

Installation and Enablement¶

Install the plugin using the published npm package:

dsh plugin --profile web add dsh-totp

The plugin is installed per profile. The command above adds it to web; if using another Web profile, replace web with the corresponding name.

After installation, start DSH to apply the plugin configuration:

dsh --profile web --no-open