dsh-remote

DeepSeek Harness's built-in web surface is designed to trust only the local loopback. When accessed remotely through a reverse proxy, it breaks in several ways: privileged methods are hard-coded to localhost, the native OS directory picker appears on the host machine instead of the remote browser, and remote settings fail to persist. dsh-remote solves these problems by adding a complete account/password and TOTP two-factor authentication gate in front of dsh web. Once authenticated, remote requests are safely normalized and passed to the native trust fence, giving external users full functionality without ever popping up a native window on the host.

The plugin's core capabilities include secure session management (HMAC-signed cookies, scrypt password hashing, rate limiting by IP+username), standard TOTP with one-time recovery codes, optional admin/user/guest role-based permissions, an in-browser two-pane directory dialog that replaces the native picker, a remote file preview sidebar, gzip compression for authenticated responses, and official API-level fixes for remote settings amnesia and recurring welcome notice popups. The entire UI supports both Chinese and English and automatically follows DSH's light/dark theme.

It is ideal for individuals and small teams who want to run DeepSeek Harness on a server or NAS and access it remotely via reverse proxy, SSH tunnel, Tailscale, or Frp. Headless servers without a local browser can bootstrap the first administrator through configuration. If you need reliable login protection, MFA, and account management for remote DSH access, dsh-remote is the most direct completion layer available.