dsh-auth-plugin

DeepSeek Harness ships with a Web GUI that has no built-in authentication. Once the instance is exposed beyond a single workstation, anyone on the network can invoke the model API. The dsh-auth-plugin plugs this gap: it is a single-file Cordis plugin that wraps the web server as a unified gatekeeper, redirecting unauthenticated visitors to a login page while leaving the existing SPA and API behavior completely untouched once a valid session is established.

Login options span several practical scenarios. Username and password verification uses scrypt hashing with zero external dependencies. Solana developers can sign in through Phantom or Solflare via an ed25519 challenge-response flow guarded by a mandatory public-key allowlist. EVM users can follow the same pattern through MetaMask with EIP-191 personal_sign, provided the optional pure-JS @noble libraries are installed. For teams that prefer third-party identity, the plugin implements a generic OAuth 2.0 authorization-code flow with built-in templates for GitHub, Google, Discord, GitLab, Microsoft, and Bitbucket, or fully explicit endpoint configuration for any standard OAuth provider. All sessions are carried in a self-contained HMAC-SHA256 token over an HttpOnly, SameSite-Strict cookie; logout revokes the token server-side and a one-time nonce or state is consumed and discarded to block replay and CSRF.

At runtime the plugin relies only on Node's built-in crypto module and the global fetch API, so there is no package-manager step and no dependency tree to maintain. Drop the file into the profile directory, add a few lines of configuration, restart, and the login gate is live. It is a good fit for small teams upgrading Harness from a local single-user tool to a shared service, for Solana or EVM developers who prefer on-chain identity as their credential, and for organizations that want to funnel access control through an existing GitHub or Google account.