dsh-lan-proxy

dsh binds only to loopback by default, and the project explicitly forbids running with --host 0.0.0.0. dsh-lan-proxy is an in-process reverse proxy designed for exactly this gap: it listens on HTTP and HTTPS inside the dsh process and forwards traffic to the dsh loopback backend, so you can expose the service to your LAN or the public internet without maintaining a separate nginx, frp, or Caddy sidecar.

Security is the plugin's central concern. It ships with IP whitelisting (prefix and exact-match rules), Basic Auth backed by a Cookie session (so browser WebSocket connections, which cannot carry an Authorization header, still authenticate), optional TLS on port 3443, and per-request access logging that can be appended to a file. The decision order is straightforward: whitelisted IPs get through directly, everything else must present valid credentials or is rejected with 403. Sessions are stateless and changing the password instantly invalidates all of them; for public deployments, set a long random authSecret to resist offline password-guessing.

Written in pure ESM with zero build steps, the plugin cleans up after itself on uninstall via ctx.effect() and leaves no stray processes or ports behind. All security features default to off, so you start from a safe baseline and enable only what you need. It is a good fit for developers who need multi-device access on a LAN, remote debugging, or a public endpoint for dsh, especially when they would rather not babysit another long-running proxy process.