Preface

When starting dsh web, DeepSeek Harness (DSH) generates a random launch token to authorize browser access. On the local machine, this is usually handled automatically by the GUI, but when accessing from an iPad, iPhone, or other LAN devices, the tokenized URL can typically only be found by inspecting the server logs. This approach is not only inconvenient but also error-prone.

The dsh-remote-auth plugin mounts a public route GET /mobile-auth on the webserver. After a device visits this page, it can enter a PIN or scan a QR code to obtain the browser session authorization link for the current dsh web process and generate a persistent Cookie with a 30-day validity period.

Plugin Overview

  • Name: dsh-remote-auth
  • One-liner: Remotely obtain a dsh web browser session via one click or QR code scanning
  • Author: wentao75
  • License: MIT

Core Features

  • Remote Session Retrieval: Obtain the current dsh web browser session by clicking a link or scanning a QR code.
  • Multi-Scenario Support: Supports access from LAN, Tailscale, and remote devices such as iPad/iPhone.
  • No Log Searching: Eliminates the need to look up the token in server logs.
  • Security Verification: Supports PIN-based access control.
  • Access Control: Supports Host header allowlists and source IP subnet allowlists (CIDR).
  • Persistent Cookie: The Cookie is issued by a persistent signing key; restarting dsh does not invalidate already authorized devices, and the Cookie remains valid for 30 days.

Installation and Enablement

Add the plugin using the official installation command:

dsh plugin --profile web add dsh-remote-auth -w

After installation, restart dsh web for the changes to take effect (the GUI will disconnect briefly and then recover automatically).

Usage

After installation, open one of the following URLs from any authorized device:

  • Local Machine: http://127.0.0.1:3080/mobile-auth
  • LAN: http://<Mac-name>.local:3080/mobile-auth
  • Tailscale: http://<host>.tailXXXX.ts.net:3080/mobile-auth

On the page, enter the PIN (if enabled), then click “Open the authorization link on this device” or let another device scan the QR code. Once authorization succeeds, the device will receive a browser session consistent with the current access authority.

Configuration Items

The following parameters can be configured in the profile’s cordis.patch.yml:

  • allowedAuthorities: Host header allowlist. Supports bare hostnames (any port) or exact host:port. Loopback addresses are always allowed.
  • allowedSubnets: Source IP subnet allowlist (CIDR). Loopback addresses are always allowed.
  • pin: An 8-character alphanumeric PIN. Set it to an empty string "" to disable the PIN gate (not recommended for use on the public internet).
  • lockAfterFails: Lock threshold, defaults to 5.
  • lockSeconds: Lock duration in seconds, defaults to 60.
  • originProtocol: When the service is behind a TLS reverse proxy, set this to "https".

Notes and Compatibility

  • Restart Required: The plugin takes effect after restarting dsh web.
  • Kernel Dependencies: Depends on kernel extension points ctx.webServer.register and ctx.connection.authenticatedUrl.
  • Kernel Versions: Verified for compatibility with kernel versions 0.1.2-rc.1 and 0.1.6-alpha.1.
  • Polyfill: In cleartext HTTP environments (LAN/Tailscale IPs), a crypto.randomUUID polyfill is required.
  • Package Type: The package.json contains "type": "module". Do not rename the vendored lib/qrcode.cjs to .js, otherwise it will fail to load.

Conclusion

dsh-remote-auth addresses the pain point of having to search through logs to find the Token when accessing the DSH Web service from non-local environments. A simple QR code scan or click is enough to establish a remote session. It is well suited for scenarios where DSH Web needs to be used continuously on a LAN or remote devices such as an iPad.

More information and source code:
* GitHub Repository
* SkillHub Directory Page