ddtcorex/dsh-maestro-remote
Reach a DeepSeek Harness session from outside the machine through a Cloudflare tunnel plus a LAN proxy, gated by a second PIN.
dsh-maestro-remote is a remote-access plugin for DeepSeek Harness: a Cloudflare tunnel (quick or named) plus a LAN remote proxy, so a DSH session can be reached from outside the machine, gated by a second PIN with QR provisioning. The README lists three Cordis patch rows (a loopback RPC row, the tunnel/LAN-proxy provider, and a zero-fork patch shim) and describes the tunnel lifecycle (start/stop/status, auto-restore of a previously running named tunnel on boot), a PIN-auth request handler with constant-time comparison and reloadable config, and a cloudflared binary fetcher that resolves from PATH or installs into a cache dir. GitLab webhook paths are exempted from the PIN so GitLab can post merge-request hooks.
Install
dsh plugin --profile web add @ddtcorex/dsh-maestro-remoteCopied verbatim from the README's Install block. The README says the package ships its own cordis.patch.yml applied automatically (do not copy it into the profile patch and do not add the rows by hand, because duplicate ids crash the loader), then restart dsh web. An exact release can be pinned with @<version>.
Compatibility
The README's Requirements section lists Node.js ^22.19.0 || >=24.0.0 and pnpm 11+, warning that a shell defaulting to Node 20 fails with No such built-in module: node:sqlite, and DSH 0.1.x or 0.2.x (peer range <0.3.0-0). Config persists through an embedded settings store at ~/.dsh/dsh-maestro-config/settings.json, while machine runtime state lives in this package's own sidecar so editing settings cannot silently flip tunnel state.
Details
- Repo: ddtcorex/dsh-maestro-remote
- Category: Infrastructure & Deployment
- Stars: 1
- Version: GitHub repo ddtcorex/dsh-maestro-remote (MIT, per the README's License section); npm package @ddtcorex/dsh-maestro-remote at 0.5.3 (registry check 2026-10-07). It is one package of the Maestro Harness suite (dsh-maestro-*).
FAQ
- Does the remote proxy require the PIN for everything?
- No — the README says the two GitLab merge-request hook paths are exempted from the PIN so GitLab can post webhooks; the rest of the tunnel target is PIN-gated with constant-time comparison.
- What Node version do I need?
- The README requires Node.js ^22.19.0 || >=24.0.0 and pnpm 11+, noting that a shell defaulting to Node 20 fails on node:sqlite.
Alternatives
AIcivilization/dsh-vps-manager · Big-Dao/dsh-plugin-wsl-env · ben7am1n/dsh-mcp-proxy