dsh-network

DeepSeek Harness listens on 127.0.0.1 by default, which means a phone or a laptop on a different network simply cannot connect. dsh-network places an authenticated gateway (default port 3081) in front of the Host so all remote traffic is vetted at the gateway, while the DSH core web server stays bound to loopback and is never exposed to the network directly.

Its central idea is one Host, many routes: use a LAN address at home, a Tailscale private-network URL away from home, or your own public HTTPS endpoint, all under a single Host entry in the client instead of duplicating it per network. Pairing is as simple as generating a single-use QR code from the terminal or the Settings page, valid for five minutes. Access and refresh credentials rotate automatically, and the Host persists only their hashes, never the plaintext. For long agent sessions that emit tens of thousands of streaming deltas, the plugin trims history chunks that never surface as display rows, typically cutting the wire size by 80 to 95 percent while keeping the rendered conversation identical in both the web and iOS clients.

It is built for developers who need to reach the same DSH Host from multiple network contexts, especially those juggling the iOS app and the web client simultaneously and would rather manage one Host record than several. It also suits operations-minded users who want DSH behind a firewall with the minimal possible attack surface, exposing only the authenticated gateway rather than the core service.