When using DeepSeek Harness (DSH), accessing the Web interface through a domain name or reverse proxy (such as nginx) is a common need. Local access works normally, but once accessed via a domain name, entering the “Settings → Models” page usually shows the message “settings are unavailable in this browser”. This is not a server-side block; it is a client-side security policy check based on isLoopback.

dsh-remote-trust is a plugin for DeepSeek Harness, maintained by deepseekv41flash. It injects a script when the page loads to mark the current page as a “trusted local host”, thereby bypassing the client-side isLoopback check so that the mirror persistence feature in the settings interface works properly.

Core Features

  • Script injection: Uses ctx.webServer.tapIndex() to inject a script into index.html.
  • Modified detection: Sets globalThis.__DSH_TRANSPORT__.ownsHost = true so that the client treats the current page as local (loopback).
  • Clean implementation: Does not modify DSH source code and does not override server.emit.
  • Graceful degradation: Supports silent fallback and does not throw errors when dependencies are missing.

Installation and Enablement

Install the plugin via the command line:

dsh plugin --profile web add dsh-remote-trust

After installation, restart the DSH service for the changes to take effect.

Verification

  1. After installing and restarting, open the browser console.
  2. Check whether globalThis.__DSH_TRANSPORT__ contains { ownsHost: true }.
  3. Open “Settings → Models” and verify that the provider catalog loads normally.

Use Cases and Notes

  • Relaxed gating: The plugin intentionally relaxes a designed gate. Declaring ownsHost causes the page to be treated as a “trusted local host”, which also enables other client-side features that depend on the isLoopback condition (such as opening config files, native directory selection, etc.).
  • Security requirement: The page must remain protected by a dsh token or browser session cookie. For public deployments, add extra authentication (such as nginx Basic Auth).
  • Server-side configuration: It does not change server-side trust guardrails; when deploying, you must still start dsh web with --trusted-host <domain>.
  • Scope of application: Only applicable to deployments that you can reach and that are already protected by other mechanisms.

This plugin only resolves the client-side detection issue and does not change server-side permission logic. To learn more details or view the source code, visit GitHub.