Introduction

The Web GUI of DeepSeek Harness (DSH) provides a convenient interactive interface, but browser security policies restrict some features. crypto.randomUUID is only available in secure contexts (HTTPS or localhost). When you access DSH over plain HTTP within a local network (for example, from a phone at http://192.168.x.x:3080), browsers cannot recognize this function, causing RPC calls to fail. This appears as workspace lists failing to load, directory selectors becoming unavailable, and session creation failing, while local access to http://127.0.0.1:3080 works normally.

What This Is

dsh-secure-context-fix is a lightweight DSH plugin maintained by Li-Mingshuang. It registers a webServer.tapIndex transform and injects a script into the Web GUI HTML page before the DSH bundle code runs. This script provides a crypto.randomUUID implementation based on crypto.getRandomValues(), restoring the function’s availability in non-secure contexts (HTTP).

Core Features

  • Inject polyfill: Injects an implementation of crypto.randomUUID before the DSH bundle code executes.
  • HTTP LAN support: Allows the Web GUI to work properly in non-HTTPS environments (such as LAN HTTP).
  • Register transform: Intercepts and modifies HTML output through the webServer.tapIndex mechanism.
  • Non-invasive: Requires no changes to the official source code and no build steps.

Installation and Enablement

Run the following command to install in the directory containing the plugin package:

dsh plugin --profile web add ./dsh-secure-context-fix

After installation, restart the Web profile to load the plugin:

dsh --profile web

Configuration and Usage

To allow the Web GUI to be accessed from within a local network, the service must be bound to all network interfaces. Because the DSH CLI rejects --host 0.0.0.0 by default for security reasons, this must be changed through a configuration file.

  1. Configure the bind address:
    Add or modify the following cordis.patch.yml contents in the web configuration profile:
    # $DSH_HOME/profiles/web/cordis.patch.yml
    - id: webserver
      config:
        host: '0.0.0.0'
        port: !!js ctx.webStartup.port ?? 3080
  1. Configure the firewall:
    It is recommended to allow access only from the local network subnet to avoid direct exposure. The following PowerShell command restricts the rule to the 192.168.0.0/24 subnet:
    New-NetFirewallRule -DisplayName "dsh web 3080 (LAN)" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow -Profile Private -RemoteAddress 192.168.0.0/24
  1. Access:
    Ensure the phone and the DSH device are on the same Wi-Fi network, then open a browser and access http://<your-LAN-IP>:3080. At this point, workspace lists, directory selectors, and session creation should work normally again.

Security and Notes

  • Permission risk: Binding the Web GUI to 0.0.0.0 exposes remote-code-execution-level control to anyone who can reach the port.
  • Network isolation: Use firewall rules to restrict allowed source addresses, permitting only trusted local network subnets to access port 3080.
  • Installation source: When installing from a Git repository, if the package contains a prepare script, the first installation may need to allow builds. This plugin does not contain build steps, so this is not required.

Conclusion

This is a temporary fix intended to resolve issues reported in GitHub Discussions until the official repository replaces crypto.randomUUID calls with getRandomValues(). For users who cannot modify the source code, this plugin provides a directly usable solution.

Directory Page: dsh-secure-context-fix - SkillHub
Source Code Repository: dsh-secure-context-fix - GitHub