dsh-plugin-ssh

When DeepSeek Harness runs on a remote box, you are usually stuck between two unappealing choices: expose the web port to the internet (against dsh security design) or duplicate the entire stack locally. dsh-plugin-ssh offers a third path. The local machine does exactly one job — open an SSH tunnel and view the remote GUI in a browser tab. All agents, tool calls, sessions, and workspace operations stay on the remote, with essentially zero local overhead.

The plugin ships two entry points: a standalone dsh-ssh CLI with the full subcommand set (add, list, connect, setup, start, stop, logs, and more), and an SSH Remotes panel built into the dsh web Settings page. The setup command checks the remote Node version, installs dsh if needed, creates the workspace directory, and launches dsh web under nohup bound strictly to 127.0.0.1. The connect command picks a free local port, spawns a detached ssh -L tunnel, polls the remote boot marker, and then points your browser at the local loopback address. Every API call in the page transparently lands on the remote harness — tools, sessions, and jobs all execute on the remote side.

This is built for developers who deploy Harness on cloud servers, dev boxes, or cluster nodes and want to pick up a remote workspace from a browser tab on any laptop without opening a single public port. Tunnels use BatchMode key-based auth, the remote process only ever listens on its own loopback interface, and the security model stays clean and predictable.