Plugins

WebUI authentication enforced at the HTTP/transport layer: four-layer login gate (resources, plugin bundles, /api, WebSocket), server-side sessions with HttpOnly cookies.

HTTPS + login gateway for the DeepSeek Harness web surface: access your DSH Web UI securely from another machine on your LAN, or from the internet via port forwarding. Fail-closed defaults (loopback-only, no accounts until configured); setup and security notes in the README.

Authentication gate for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing, HttpOnly SameSite session cookies and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a password or second-factor step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); admin-only model and API-key configuration guards; per-user isolation on the REST/list APIs and on the WebSocket event streams; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Runs on both DSH transport lines (0.1.1-rc.2 legacy and 0.1.2+ modern) with no configuration; passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Drives a real Chrome through a local MCP server so the agent can search Google/Bing/Sogou, read any page including JS-rendered and login-only content, automate click/scroll/type/key-press/select in a background window, and run platform search/detail/comment/download for Zhihu, Xiaohongshu, Douyin, Bilibili, X and Reddit; resumable comments, SHA-256-verified downloads, cookies never returned, localhost only.

Caddy forward_auth administrator login for DeepSeek Harness Web, with Argon2id passwords, revocable sessions, bilingual UI, and a native sidebar sign-out action.

Identity-gated Tailscale access to the Web GUI with dsh still bound to loopback: a 127.0.0.1 proxy published by `tailscale serve` admits a request only when the Tailscale login it stamps is allowed, with an optional per-device allowlist, so the privileged /api methods behind the loopback check — Settings, Models, Plugins — answer without dsh being told to trust a remote host.

Windows system-tray launcher for dsh web: console-free background start (VBS/powershell chain), a tray menu with open UI / logs / icon presets / launch-at-login / restart Harness, one-click install and update of the bundled dsh-plugin-usage-meter, and a dsh plugin half that starts the tray together with the harness.

OAuth / subscription-plan LLM login (Grok, GitHub Copilot, OpenAI Codex, Anthropic, OpenRouter): durable credential store with on-request token refresh, no repo patches (Grok/Copilot verified; use Codex with caution).

Codex App Server model provider using a local Codex login, with session reuse, Harness tool bridging, native action traces, and durable generated-image projection.

Visual GitHub login without a terminal: in-window device flow, token synced into the gh CLI, and host status/launch endpoints.

DSH 插件:直接复用 Codex CLI 本地登录订阅凭证,在 DeepSeek Harness 中使用 ChatGPT 订阅模型,无需 API Key | DSH plugin: reuse your Codex CLI local subscription login to use ChatGPT subscription models in DeepSeek Harness, no API key required

Tripo 3D generation skills driving the tripo-cli through the shell: text-to-3D, image-to-3D, rigging with locomotion clips, decimation and LOD chains, and export to GLB/FBX/OBJ/STL/USDZ/3MF, with headless device login for both China-mainland and international accounts; installable as `tripo-dsh`.

Tokenrhythm (基元律动) finance dashboard for DeepSeek Harness: account balance & expiring credits, category-filtered model price cards (with discounted prices), service status and platform key management; login via platform account or session cookie — credentials stay on the local host.

Phone access to DSH over a self-hosted relay (WSS via your own TLS-terminating proxy): bundle plugin with bridge supervisor and QR login, a native Android app, and server-side device revocation.

Import local Claude, Codex, Grok, Gemini, Copilot, OpenCode, and CC Switch config into DeepSeek Harness with OAuth login for supported providers.

Codex-backed `web_search`, `image_gen`, and `image_vision` tools for DeepSeek Harness, reusing ChatGPT OAuth login state.

Floating NetEase Cloud Music player for DSH Web: draggable collapsible window with mini mode, playlist discovery with search and hot lists, synced lyrics with translations, persistent playback queue, QR-code or Cookie login, colors following the DSH skin theme.

Listen to Ximalaya podcasts and audiobooks inside the DSH web UI: search albums, browse paginated tracks, and play through a now-playing bar (prev/play/next, seek, volume, rate). After QR login the "Mine" page lists your liked tracks (click to play), subscribed albums with latest-episode hints, and followed anchors with their public albums; the host relays audio streams with Range support and registers an `ximalaya_play` tool so the agent can search and play on request.

Complete LAN/remote access for the Web UI: 0.0.0.0 binding, crypto.randomUUID polyfill, token gate (401 login page + WebSocket interception, loopback exempt), privileged-fence and settings-persistence exemptions, and an idempotent installer with upgrade recovery.

Google Antigravity CLI (agy) as a DSH product subagent: delegate tasks to a Gemini coding agent with your Antigravity login (no API key), with conversation follow-ups, background streaming progress, image analysis by path, and a pop-up login window.

Drive the user's real browser through the local Kimi WebBridge daemon: navigate, find-tab, snapshot, click, fill, evaluate, CDP, screenshot, network, upload, PDF export and tab-management tools that reuse existing login sessions.

Import local Codex, Grok, Claude, OpenCode, and CC Switch logins into DSH; pick sources and enable models in Settings.

Tauri 2 desktop application for Windows that detects (or installs) the global @deepseek-ai/dsh package, launches the DSH Web server and embeds it in its own window, with system tray management, login autostart, a global hotkey and desktop shortcuts.

Bundles the remote-shell skill for secure SSH, SFTP, Telnet, and WinRM remote operations, with an encrypted credential vault whose login and execution scripts never accept plaintext passwords.