dsh-remote-runtime

DeepSeek Harness runs locally out of the box, so if you have a remote Linux box where you want an isolated DSH instance that you can manage from a browser, there is no native path to that. dsh-remote-runtime fills that gap without touching a single line of Harness source code. SSH connections, file operations, process management, and credential storage all stay on the plugin Host side; the browser only ever receives bounded JSON summaries and never reads a stored key.

In practice, you add an OpenSSH host and an optional remote workspace from the DSH Settings panel, run a read-only Doctor check to verify the remote environment, and then install the SHA-256-verified official DSH rc.8 runtime (bundled with Node 22.19) with one click. Credentials are imported through a write-once form, persisted with 0600 permissions, and never surface in browser state, logs, screenshots, or process arguments. Every tunnel listener binds to loopback only, and the client-proxy egress allows public HTTP(S) while failing closed on private, link-local, CGNAT, metadata, and similar ranges. SSH itself acts as the access-control boundary.

This plugin is aimed at developers who have a remote Linux workstation or small server, want the DSH instance fully isolated from their local dev environment, and would rather not fork or patch DSH source. It is currently pinned to DSH 0.1.0-rc.8; later versions will be supported once official peer versions, Typert generation, and assembled-profile CI have moved forward together.