lijx122/dsh-plugin-auth-guard
dsh-plugin-auth-guard is a zero-trust authentication, LAN/public access-control and security gate for DeepSeek Harness: it resolves the loopback 403 fence for privileged calls, fixes mobile RPC crypto gaps over plain HTTP, and adds authentication in front of DSH's unauthenticated remote code execution surface so exposing port 3080 is survivable.
dsh-plugin-auth-guard is a zero-trust authentication, LAN/public access-control and security gate for DeepSeek Harness. It targets the barriers that appear when DSH (designed for local 127.0.0.1 workflows) is exposed to LAN devices or remote servers: the hardcoded loopback fence that returns 403 for privileged calls such as settings.describe and llm.providers from non-localhost requests (which makes remote model switching impossible), mobile browsers' lack of Secure Context over plain HTTP that leaves crypto.randomUUID undefined and breaks RPCs, the missing built-in authentication that otherwise lets anyone on the network create sessions and execute arbitrary shell commands through the coding agent once port 3080 is open, and third-party plugin escapes such as sidebar PTY terminal sockets and arbitrary file access.
Install
dsh plugin --profile web add github:lijx122/dsh-plugin-auth-guardCopied verbatim from the README's install block; no npm package is documented, so the GitHub form is used.
Compatibility
A DeepSeek Harness plugin bundle that runs in front of the Web Host. It addresses DSH's loopback-only design so LAN/WAN exposure is survivable. The README reports an eight-round zero-trust security audit.
Details
- Repo: lijx122/dsh-plugin-auth-guard
- Category: Infrastructure & Deployment
- Stars: 1
- Version: GitHub repo lijx122/dsh-plugin-auth-guard (1★, MIT); v0.2.0, README states readiness for DSH v0.1.2-rc.1 and Node.js >= 20. English README with a Simplified Chinese translation.
Alternatives
1m01m0/deepseek-harness-desktop · AIcivilization/dsh-vps-manager · AlliotTech/deepseek-harness-docker