dsh-webgate

The DeepSeek Harness Web GUI ships without any login step, so any browser that can reach the port can immediately browse workspaces, start sessions, and read content. dsh-webgate closes that gap by injecting a guard script into every index.html: unauthenticated or expired visitors are instantly redirected to a dedicated login page, and only after successful credentials are they released back to the original URL. The guard executes synchronously and temporarily hides the document, so no unprotected content ever flashes on screen.

At the core, the plugin issues an absolute 12-hour session token, refreshed by a 30-second client-side poll plus a re-validation check whenever the page regains visibility. Because the gate operates purely at the browser view layer, host-side background tasks, sub-agents, and live sessions continue running undisturbed; after re-login everything is exactly as it was left. An experimental admin / member role model, managed through /grant and /revoke commands, lets administrators grant members visibility into specific workspaces by full path or title. Ungranted entries are filtered client-side, and member sessions automatically hide settings, workspace search, and list-header actions. All account-change commands require an admin password in sudo mode, and passwords are kept out of the session log. Credential hashing uses built-in PBKDF2-HMAC-SHA256 (20,000 iterations), the entire plugin is a single zero-dependency JavaScript file, and the bilingual UI defaults to Chinese with a one-click English toggle and Accept-Language-aware API messages.

It is best suited for local personal use or small-team setups sharing a single Harness instance where a lightweight login gate on the web entry point is desired. It is positioned as a local-tool entry gate rather than an enterprise security solution and listens on 127.0.0.1 by default. If you plan to expose the service on a LAN or the public Internet, place a reverse proxy in front for true server-side authentication. The initial admin password is a public default, so changing it immediately after first login is essential.