Introduction

DSH (DeepSeek Harness) uses a plugin-based architecture and runs in local mode by default. In development, debugging, or demo scenarios, you may sometimes need to preview the WebUI on a mobile device. Since DSH does not expose LAN access by default, direct browser access to the local port is usually restricted by security policies or network isolation. Below is an introduction to the hw-cola/dsh-remote-control plugin, which exposes the local DSH WebUI to LAN devices through a reverse proxy and a QR code authorization mechanism.

Overview

This is a DSH client plugin for mobile remote control.

It is maintained by hw-cola and open-sourced under the MIT License. The plugin starts a separate Node child process to listen on a LAN port and forwards traffic to the local DSH service. Its core feature is adding a “Remote Control” page to the settings panel, with support for automatic LAN IP detection, QR code generation, QR scan-based verification, and device whitelist management.

Core Features

Settings Panel and LAN Detection

After installation, the DSH settings panel will include a new “Remote Control” page (displayed only on desktop).

  1. Enable toggle: Click the “Allow LAN Access” toggle, and the plugin will automatically detect and list the local machine’s LAN IPv4 addresses.
  2. Multi-NIC switching: If multiple network interfaces are present, users can switch the selected IP address in the list.
  3. QR code generation: The QR code is generated in real time based on the selected address. The plugin includes a pure JavaScript QR encoder (Byte mode, ECC-M, versions 1–10) with no third-party dependencies, and supports offline use.
  4. Automatic refresh: The QR code refreshes automatically every 60 seconds, and the old code is invalidated immediately to prevent man-in-the-middle replay attacks.

QR Scan Verification and Security Blocking

To prevent unauthorized LAN access, the plugin implements a strict verification mechanism.

  1. QR code authorization: Access from a non-local source (not 127.0.0.1 or localhost) must first scan the code. The QR code URL carries a one-time verification token (?rcnt_t=<token>). After token validation passes, the server issues an rcnt_auth Cookie and redirects to a clean address.
  2. Cookie validity: Authorized devices can continue accessing through the Cookie, with a maximum validity of 7 days.
  3. 403 blocking: Unauthorized direct access returns a 403 notice page, and the plugin blocks the WebSocket handshake to ensure no connection can be established.
  4. Local access: Access to the local machine using localhost or 127.0.0.1 is unaffected and connects directly to DSH; however, accessing the local machine via its LAN IP also requires QR scan verification (because the source is not loopback, it is treated as a “non-local” access).
  5. Whitelist mechanism: Supports whitelisting up to 32 devices. The whitelist is persisted in ~/.dsh/remote-control/devices.json. It displays device name (parsed from User-Agent), IP, authorization status, and last active time, and supports removing an individual device.

Proxy and Compatibility Handling

  1. Reverse proxy: A separate Node child process listens on 0.0.0.0:<port>, forwards requests to 127.0.0.1:<port>, and rewrites the Host/Origin headers to the loopback address to bypass DSH’s browser trust boundary.
  2. Non-secure context: Mobile access is usually in a non-secure context (HTTP), where crypto.randomUUID is unavailable. The proxy automatically injects a polyfill into HTML responses.
  3. Windows Firewall: On Windows, when enabled, the plugin automatically creates and reuses an inbound TCP rule named “DSH Remote Control”, so no manual configuration is required.

Installation and Enablement

Installation Commands

After installing pnpm and DSH, run the following command:

dsh plugin --profile web add "git+https://github.com/hw-cola/dsh-remote-control.git"

To pin to a specific version:

dsh plugin --profile web add "git+https://github.com/hw-cola/dsh-remote-control.git#v1.0.0"

Local development mode:

dsh plugin --profile web add "link:${PATH}/dsh-remote-control"

Start and Refresh

After installation, you must restart dsh web so that the plugin’s cordis patch layer takes effect. Then refresh the browser page, and the “Remote Control” page will appear in the settings panel.

Notes

  1. Security: Traffic is still plain HTTP, and tokens or Cookies may be sniffed by devices on the same network segment. Authorized devices effectively share equivalent access. The DSH WebUI itself has no login authentication, so only use it in trusted networks and make sure to turn off the toggle when done.
  2. Data persistence: The toggle state is stored only in the host process memory and defaults to off after restarting dsh; however, the device whitelist is persisted in ~/.dsh/remote-control/devices.json, so authorized devices do not need to scan again after a restart.
  3. Uninstall cleanup: Uninstalling terminates the proxy child process. The device whitelist file is not deleted automatically; delete it manually when needed.
  4. Compatibility: The plugin was developed and tested with DSH 0.1.1-rc.2. The client API is still evolving; if features behave abnormally after a major version upgrade, check the repository for a compatible version.

Summary

This plugin solves the problem of being unable to access DSH directly on a mobile device during local development. Through QR code authorization and QR code refresh, it provides convenience while restricting unauthorized access. When using it, pay attention to the security of the network environment and the management of the whitelist file.