dsh-ios-control

DSH explicitly refuses --host 0.0.0.0, so the Web UI stays locked behind loopback. There is no official path to steer your desktop agent from a phone or fork a session mid-meeting. dsh-ios-control closes that gap with a standalone auth-then-proxy gateway that reuses the official frontend as-is: zero core patches, zero runtime dependencies, and the browser chat box becomes your remote control.

Security does not assume a trusted network. One-time QR pairing secrets live only in the URL fragment and never hit the server; HMAC challenge-response plus a short-code path cover both scan and manual entry, and each token expires in five minutes. Session cookies are HttpOnly with SameSite=Strict, the server stores only SHA-256 digests, and any device can be revoked instantly. Idle WebSocket gets frame-boundary pings; three missed replies trigger a clean teardown and client reconnect. The /status page surfaces per-connection RTT, device identity, full-stack upstream health, and tunnel heartbeat age in real time. Non-DSH upstreams such as MiMo Code are shape-detected and silently accommodated.

On the model side, a fork_session tool lets the agent create a child session at the last completed turn boundary, inheriting full context and reattaching to the same workspace in one step. When you are offline, approval bell-pushes via Bark, ntfy, or a generic webhook nudge you back. A long-lived recovery code restores access if every device is lost. Who is connected, whether links are healthy, and whether the upstream is truly alive are all visible at a glance.

Built for developers and researchers who run DSH agents daily: kick off a task at the office, check progress from your phone, fork a side-branch when a new idea strikes, and pick everything back up over Cloudflare Tunnel while travelling. If you already use the MiMo Code source build, the same gateway plus a two-file patch brings the mobile UI online right away.