dsh-full-remote

dsh-full-remote addresses a practical problem: DeepSeek Harness Web is designed around loopback trust, so when the UI is reached through a generic tunnel or a non-loopback network address, privileged APIs such as settings, credentials, and directory browsing fail with 403. The plugin places an authenticated reverse proxy between the remote client and the Harness Web server, rewriting Host and Origin to loopback before forwarding, so the protected APIs remain usable while remote access is possible.

Instead of merely bypassing the original trust check, the plugin replaces it with its own access-control layer. It supports access tokens, per-device sessions, optional first-visit approval, one-time phone invites, failed-login lockouts, CIDR allowlists, structured audit logging, and runtime control of the listener. A panel makes it easy to start or stop the proxy, rotate tokens, review devices, and optionally launch a temporary Cloudflare quick tunnel for short-lived remote access.

This plugin is a good fit for users who need to operate DeepSeek Harness Web from a phone, another machine on the local network, or a temporary public tunnel. It is especially useful for administrators and individual users who want remote access to settings, credentials, directory browsing, tool approvals, and plan reviews without exposing the underlying local service directly.