dsh-network-continue

dsh-network-continue

An independently maintained continuation of dsh-network (MIT), for DeepSeek Harness.

Upstream stopped at 0.1.0-rc.9 (2026-09-14). This continuation keeps the same plugin, configuration and pairing flow, adds the fixes current DSH releases need, and stays installable from source with dsh plugin add.

What it does

DSH stays on loopback. The plugin puts an authenticated gateway (default 0.0.0.0:3081) in front of it and gives you:

• LAN — reachable local gateway address, paired with a QR code.
• Tailnet — a Tailscale Serve HTTPS URL.
• Custom HTTPS — your own reverse-proxy URL.

Pairing tickets are single-use and expire after five minutes. A paired client receives a rotating refresh credential and a one-hour access token; the host stores hashes, not the tokens. The gateway keeps a persistent host ID in $DSH_HOME/network/state.json.

Install

Remove the upstream plugin first — both register the same /dsh-network/* gateway routes, and the continuation deliberately reuses the same state file so existing pairings survive the switch.

dsh plugin --profile desktop remove dsh-network
dsh plugin --profile desktop add github:AyahaShirane/dsh-network-continue

For a web profile replace desktop with web. Then open Settings → Network to create a pairing QR, or run the setup assistant:

dsh plugin --profile desktop exec dsh-network-continue setup

Paired devices

Settings → Network lists every paired device — browser sessions and access-token clients — with its name, kind, pairing time and expiry. Each row can be:

• made permanent — the server-side credential stops expiring, and the next time that browser loads the app its pairing cookie is re-issued with a 400-day lifetime (the longest browsers accept, and what Chrome caps at). Restoring expiry hands the device a fresh 30-day window.
• deleted — the device is revoked on the spot; its cookie or token is no longer accepted by the gateway.

The panel reads GET /dsh-network/devices and posts to POST /dsh-network/devices/remove and POST /dsh-network/devices/expiry. The inventory never returns hashes or raw tokens.

What this edition changes

Every change is additive and keeps the upstream public behaviour:

• Browser-login exchange for the Web runtime (new in 0.2.0-continue.1). Current DSH Web runtimes authenticate the index with a one-shot /?token= exchange and a signed dsh-auth-* cookie. The gateway now completes that exchange in-process through connection.authenticatedUrl(), replays the cookie on proxied HTTP requests and upgrades, and translates a same-authority Origin/Referer to the loopback authority. Paired phones and other browsers now reach the app instead of dsh web authentication required. Cross-site origins are still refused by the upstream fence, and the browser's pairing cookie is still stripped.
• Paired-device inventory and controls (new in 0.2.0-continue.2). The Network settings panel lists paired devices (newest first) and can revoke one or make it permanent — see Paired devices.
• The regression test for that flow ships as test/browser-auth-proxy.test.mjs.
• The release workflow is replaced by a check workflow: this edition is installed from source, not published to npm.

Everything else — configuration, routes, UI, history trimming, the CLI — is the upstream code at 0.1.0-rc.9.

Configuration

Field	Default	Purpose
gatewayPort	3081	Authenticated gateway port.
bindHost	0.0.0.0	Gateway interfaces; 127.0.0.1 limits it to loopback.
hostName	System hostname	Host display name.
statePath	$DSH_HOME/network/state.json	Pairing and device state (shared with upstream, so pairings survive a switch).
historyChunkTrim	true	Remove redundant settled streaming chunks from history responses.
historyTrustedHosts	[]	Additional allowed direct-Web Host values for history routes.
iosAppDownloadURL	Unset	App Store or TestFlight HTTPS URL for the optional card.

Security

• The upstream session cookie stays inside the host process: it is never forwarded to clients and never written to disk.
• Requests carry a paired device credential; the gateway strips it before proxying.
• The upstream Host/Origin and cross-site fences are preserved.
• LAN HTTP assumes a trusted local network. For a public route, expose this gateway through HTTPS, not the DSH Web port.

Maintenance

The main branch carries the continuation. Upstream fixes are merged when they land; the upstream project remains the origin of the design and most of the code. See docs/continuation.md and RELEASES.md.

License

MIT. Original work Copyright (c) 2026 Xiang Bai; continuation modifications Copyright (c) 2026 AyahaShirane and dsh-network-continue contributors. See LICENSE.