dsh-rgate

The Harness ships a trustedHosts fence that defends against DNS-rebinding, but it is explicitly not an authentication mechanism. The moment you expose the Web UI on a LAN, a Tailscale network, or a public domain, every request whose Host header clears that fence gets full access to your agent. dsh-rgate fills that gap by putting a single-password gate in front of the entire browser surface.

On every page load the plugin injects a gate script that redirects anonymous non-loopback visitors to a self-contained login page. Behind the scenes it shadows all 52 unary RPC routes as well as the respond and session.export endpoints, so any /api call without a valid session cookie receives a 401 before the request body is even parsed. Passwords are stored as scrypt hashes (N=16384, r=8, p=1) with a random salt and constant-time comparison in a 0600 file; login is throttled with exponential backoff after five failures; audit events for success, failure, lockout, and password changes are appended to the harness log; and a Remote Access section in Settings lets you check status, log out, or change the password. Loopback addresses always pass through, so local development and the admin workflow stay friction-free.

The plugin is designed for self-hosted solo developers and small teams who run the Harness on a VPS, a home server, or behind a Cloudflare Tunnel and want a simple, auditable authentication layer without pulling in OIDC or a full IAM stack. One password, one gate, MIT-licensed, no build step, no install script. Local users never see the wall at all.