dsh-3301

DeepSeek Harness binds its Web GUI to 127.0.0.1 only, so a phone, tablet, or second machine on the same LAN has no direct route to it. dsh-3301 runs as a native DSH plugin, opening a 0.0.0.0:3301 reverse proxy inside the DSH process so any device that can reach that port gets a full browser-based DSH console, while DSH itself keeps listening on loopback alone and never exposes itself to the LAN.

The proxy forwards both HTTP and WebSocket traffic, so streaming output, tool-call interactions, and other real-time features work unmodified. Authentication is a form login backed by a salted scrypt verifier; the session rides in an HMAC-SHA256-signed, HttpOnly cookie with a configurable lifetime (30 days by default). Repeated wrong passwords trigger a per-IP lockout. The plugin ships zero external dependencies beyond what DSH already bundles, starts and stops with DSH, and exposes every setting through the DSH settings card — no separate daemon, no launchd entry, no cron job.

This is the right fit for anyone who wants to monitor or drive DeepSeek Harness from a phone or a second computer on a trusted LAN. If the network itself is not fully trusted, the README recommends placing port 3301 behind a VPN such as Tailscale or WireGuard so the password and cookie are not the only line of defence.