Overview

The DeepSeek Harness (DSH) web interface runs in the browser, while the actual working directory and process management happen on the host machine. When you need to inspect the current session’s working directory in a local file manager, terminal, or editor, manually switching windows can interrupt the workflow. The DSH plugin ecosystem is designed to solve this kind of integration problem, and dsh-open-in-x is one example. It provides the ability to launch local external applications directly from the web interface.

Features

This plugin is a DSH bundle. Its core feature is to add an “Open in external app” button to the toolbar of the current session. After clicking the button, the session’s working directory is passed to an installed local application on the host machine.

Supported local applications include:
* File managers: macOS Finder, Windows File Explorer, default Linux file manager
* Terminals: macOS Terminal, Windows Terminal, common Linux terminal emulators
* Code editors: Visual Studio Code, Cursor, Windsurf, Zed
* IDEs: IntelliJ IDEA, WebStorm, PyCharm, Android Studio

The plugin automatically detects applications installed on the host and displays them. It only shows software installed on the “local” machine (that is, the machine running dsh web).

Installation and Activation

Before installing, make sure the environment meets the requirements: the host has Node.js 22.19+ or 24+ installed, as well as a compatible DeepSeek Harness version (0.1.0-rc.6 or higher).

  1. Run the installation command:
    npx @deepseek-ai/dsh plugin --profile web add dsh-open-in-x
  1. After installation, restart the dsh web service:
    npx @deepseek-ai/dsh web
  1. In the DSH web interface, select a session that already has a working directory, click the “Open in external app” button that appears in the top toolbar, and choose the target application.

Configuration

After installation, you can modify the configuration file to adjust plugin behavior. All built-in launchers are enabled by default, and applications that are not installed will not be displayed in the interface.

The following configuration options are supported:

apps:
  - finder
  - terminal
  - vscode
  - cursor
  - windsurf
  - zed
  - idea
  - webstorm
  - pycharm
  - android-studio
allowRemote: false
allowLegacyPaths: false
defaultApp: vscode
quickOpen: true
  • allowRemote: Defaults to false. This option controls whether remote web connections are allowed to trigger host GUI processes. It is recommended only if you explicitly understand the risks and access is through a trusted reverse proxy.
  • allowLegacyPaths: Defaults to false. Controls whether it maintains compatibility with legacy DSH Workspace menu path behavior. New sessions resolve directories via the Host, while legacy sessions only provide paths. It is disabled by default for security.
  • quickOpen: When enabled, the main button can open the defaultApp directly, while the dropdown menu still allows choosing other applications.

The application list is detected only once when the DSH web page loads. After installing new applications, refresh the page to update the list.

How It Works

The plugin consists of a Browser half and a Host half:
* Browser half: Preferentially registers to the public conversation.session.header.actions slot and sends only the current session ID to the Host.
* Host half: Registers a unique POST /__dsh/open-in-x route on ctx.webServer, receives requests, and launches the selected application on the host machine.

Security Boundaries

To prevent potential risks, the plugin imposes limits in its security design:
* Request limits: Only accepts JSON POST requests, with a request body limit of 8 KiB and strict rejection of extra fields.
* Access control: By default, only loopback (127.0.0.1) and same-origin requests are accepted.
* Operation limits: The Browser can only submit fixed App IDs and Session IDs, and cannot submit executable file paths, arguments, or command-line text. The working directory is resolved by the Host based on the Session header, and launched processes use an argv array with shell string concatenation disabled.
* Rate limiting: Operations with the same App and working directory are rate limited within a short time window to prevent repeated clicks from launching a large number of processes.

Summary

dsh-open-in-x solves the fragmentation problem between the web interface and local file systems and editors. It is suitable for developers who frequently need to view or edit local projects from the browser. For more details, view the plugin directory: https://www.skillhub.cn/plugins/nikoart-liu/dsh-open-in-x or source repository: https://github.com/nikoart-liu/dsh-open-in-x.