dsh-plugin-auth-guard

DeepSeek Harness is natively designed for local desktop workflows. The moment a developer tries to expose it across a LAN for mobile access or host it on a cloud server, hard loopback fences trigger 403 blocks, mobile browsers lack the Secure Context that RPCs depend on, and the complete absence of authentication opens the door to remote code execution. dsh-plugin-auth-guard closes every one of those gaps with zero intrusion: it automatically binds the Web GUI to 0.0.0.0, enumerates active LAN interfaces, securely proxies privileged RPCs such as settings.describe and llm.providers for authenticated clients, and dynamically injects crypto.randomUUID and other mobile polyfills into the HTML response so that iOS Safari and Android Chrome work seamlessly over plain HTTP.

On the security front, the plugin intercepts HTTP requests and WebSocket upgrade events at the lowest TCP server level, enforcing a default-deny whitelist across /api/, /api2/, and /sidebar/* routes. Passwords are stored as 32-byte Scrypt hashes with random salts; tokens embed HMAC-SHA256 password fingerprints so that changing the password instantly revokes every token globally and purges all active remote WebSockets within milliseconds. IP sliding-window rate limiting, global burst throttling, a 64 KB request body cutoff, CSRF/CSWSH protection, and physical socket address validation round out a deep-defense posture against spoofing and DoS attacks.

It is built for developers who need to turn DSH from a single-machine desktop tool into a shared or remotely accessible service, and who want a production-grade security gateway, mobile compatibility, and full credential lifecycle management with a single CLI command and no source modifications.