dsh-access-gate

When you put the DeepSeek Harness Web UI behind a public nginx domain or a LAN IP, remote users quickly hit a dead end: the browser-trust fence blocks every loopback-pinned privileged endpoint (settings., credentials., host.pickDirectory, agentPreset.*) with a 403, leaving remote sessions nearly useless. dsh-access-gate is built to break through that wall. Once you set an access password, every request from outside the local machine must pass a password login (HttpOnly cookie, 7-day validity by default), and after authentication all previously blocked endpoints become fully functional while local 127.0.0.1 access remains untouched.

Beyond the authentication gate, the plugin bundles the complete feature set of dsh-lan-access into a single package: 0.0.0.0 webserver binding, an idempotent crypto.randomUUID polyfill, and the official native directory dialog for local workspace selection (Windows IFileOpenDialog, macOS choose folder, Linux zenity-kdialog), with remote clients automatically falling back to the in-app browser. Security is handled with sha256 + timingSafeEqual password comparison, open-redirect protection, and Host-spoofing defence. Every side effect is reverted through ctx.effect cleanup callbacks, so uninstalling leaves zero residue and never writes to user config files.

This plugin is ideal for teams or individual developers who expose DSH on a LAN or public network and want remote collaborators to use the full feature set including workspace management, model discovery, and credential configuration. It ships passwordless by default for immediate remote access, and a single configuration line activates the gate without requiring a restart or any source-code modifications.