GooDAnDReaDY/dsh-lanmode
LAN access, mDNS (dsh.local), PWA, root CA, QR pairing, notifications and auto-TLS for DeepSeek Harness.
dsh-lanmode makes a DeepSeek Harness instance usable over the LAN by working around the browser restrictions that plain-HTTP access from a local IP triggers: isLoopbackHostname disabling plugin settings, crypto.randomUUID() requiring a secure context, blocked clipboard/microphone, and DSH core restricting config and credential APIs to 127.0.0.1 callers. It does this with polyfill injection, a direct TLS bridge, mDNS and a local Root CA, plus an interactive settings card. Features include a sidebar Quick QR popover and /mobileqr chat tool, a PWA manifest for standalone iOS/Android use, an mDNS responder broadcasting dsh.local, and a self-generated 10-year local Root CA issuing a server certificate with SANs for dsh.local, LAN IPs and localhost. It adds background system notifications on turn/end and approval/asked, LAN PIN and password access control (PBKDF2 / scrypt digests, per-IP lockout, admin/guest subnet separation, CSRF mitigation, atomic backups), device/session management, and optional Cloudflare Quick or Named WAN tunnels with a Tunnel PIN.
Install
dsh plugin --profile web add @goodandready/dsh-lanmodeCopied verbatim from the README's '📦 Quick Install' section. Configuration is done in the profile's cordis.patch.yml (the README shows a - id: dsh-lanmode block under ~/.dsh/profiles/web/cordis.patch.yml). The install section gives no restart instruction.
Compatibility
Node 20+; DeepSeek Harness Web. Registers as a DSH plugin via dsh plugin --profile web add, configured through the profile entry - id: dsh-lanmode in cordis.patch.yml. It ships host routes (/dsh-lanmode/*), a settings card, mDNS and a PWA manifest. No DSH version range is stated.
Details
- Repo: GooDAnDReaDY/dsh-lanmode
- Category: Infrastructure & Deployment
- Stars: 6
- Version: GitHub repo GooDAnDReaDY/dsh-lanmode; npm package @goodandready/dsh-lanmode; MIT © GooDAnDReaDY; Node 20+ (README badge). No specific package version is stated.
FAQ
- Why does DSH break over the LAN in the first place?
- The README lists four causes: isLoopbackHostname disables plugin cards and switches settings to read-only memory mode outside loopback; crypto.randomUUID() needs a secure context; navigator.clipboard and getUserMedia are blocked over plain HTTP; and DSH core restricts configuration and credential APIs to 127.0.0.1 callers. The plugin polyfills or bridges around each.
- Can guest subnets change settings or revoke sessions?
- No. The README documents distinct adminAllow and guestAllow CIDR rules: subnets under guestAllow are strictly prohibited from mutating system settings or revoking sessions and get 403, and bridge routes that list or revoke devices require administrator access. Privileged mutation from the LAN is gated by unlockPrivileged, optionally with a LAN PIN.
- How does remote access via Cloudflare work?
- The plugin supports temporary Quick Tunnels (trycloudflare.com) and persistent Named Tunnels (tunnelToken / tunnelTokenRef) without port forwarding or a static IP. Tunnel startup is fail-closed — it verifies the direct listener is active and refuses to start otherwise, never falling back to an unencrypted core port — and when a LAN PIN is configured, inbound requests and WebSocket upgrades through the tunnel require PIN verification (tunnelPin: true, default).
Alternatives
flymysql/dsh-remote · CrazyShout/dsh-ssh-remote · juanwang-buaa/dsh-full-remote