The plugin architecture of DeepSeek Harness (DSH) is flexible, but during local development and debugging, if you need to access the DSH Web UI from other devices on a local area network (LAN), the default configuration is often inconvenient. The dsh-public-proxy plugin bypasses security restrictions to expose the Web UI directly to the LAN.

This is a DeepSeek Harness plugin maintained by SpringNyan and licensed under the MIT License. It modifies the underlying configuration of DSH so that the Web UI can be accessed by other devices on the LAN.

Core Features

  • LAN Access: Exposes the DSH Web UI to other devices on the LAN.
  • Default Port: Listens on port 3081 by default.
  • Authentication and Control: Supports cookie authentication and bypassing the launch token. It can be managed by configuring parameters such as host, port, and accessKey.
  • Configuration Flexibility: Supports custom host, port, accessKey, enableCookieAuth, and bypassLaunchToken.

Installation and Enablement

Install the plugin via the DSH command line:

dsh plugin --profile web add dsh-public-proxy@latest

Typical Usage

After installing and running the plugin, it listens on port 3081 by default. Other devices on the LAN can access the Web UI at the following address:

http://<本机局域网IP>:3081

For example, http://192.168.1.100:3081

By default, the proxy does not enable access control. To protect the proxy, you can configure an access key in $DSH_HOME/profiles/web/cordis.patch.yml:

- id: public-proxy
  config:
    accessKey: "your-secret-key"
    enableCookieAuth: true

After enabling it, accessing the proxy will require the access key. The key is stored in a cookie and does not need to be entered again within 30 days.

Configure Bypassing the Launch Token

The DSH Web UI is protected by a launch token by default, requiring the token to be included in the URL when accessing it. After enabling bypassLaunchToken, clients can access the proxy directly without including the token in the URL:

- id: public-proxy
  config:
    bypassLaunchToken: true

Security Warning

The plugin transmits data in plaintext over HTTP, and the access key may be intercepted by network listeners. Please use it only in trusted LAN environments.

Because the plugin binds the host to 0.0.0.0, it exposes the Web UI to the entire network. For security reasons, DSH officially prohibits binding to 0.0.0.0. This plugin intentionally bypasses this restriction. Do not expose the proxy directly to the public internet.

Notes

This plugin runs with the privileges of the current DSH process. Before use, please inspect the source code and license to ensure compliance with your usage policies.

Summary

This plugin facilitates the use of DSH on a local LAN, allowing developers to debug and manage it through a standard Web interface. See the GitHub repository for more details.