Plugins

PII masking for DeepSeek Harness — anonymizes names, phones, emails, ids, and keys before requests and restores them at the display layer, keeping plaintext out of session logs.

Patched build of dsh-pocket for DeepSeek Harness: the access password is embedded in the QR code so the phone signs in with one scan, a read-only /dsh-pocket/entry.json endpoint lets the app re-sync the current public URL and password from the LAN, and LAN / Tailscale / Cloudflare routes fail over automatically. This is a patched derivative of shaobeichen/dsh-pocket — install it instead of the upstream plugin, never alongside it.

Telegram mobile remote that attaches the phone to a live DeepSeek Harness Web session: workspace-then-session picker (/sessions), /last for the previous Q/A, /model switch, and native Rich Message replies.

Patched build of dsh-pocket for DeepSeek Harness: a password-protected entry has its access password embedded in the QR code so the phone signs in with one scan, and a read-only /dsh-pocket/entry.json endpoint lets the phone app re-sync the current public URL and password while still on the LAN.

Authentication gateway for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing with per-user salts, HttpOnly SameSite session cookies named per DSH_HOME and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); per-user model and API-key configuration whose private entries are encrypted with a key derived from the login password and stay unreadable by any admin, with admin sharing to selected users (usable, balance visible, key never shown, revocation immediate) and unconfigured users blocked rather than falling back to the deployment configuration; per-user isolation on the REST and list APIs and per-frame ownership filtering on the WebSocket mux; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Requires the DSH 0.2.0 line (the 0.1.1-rc.2 transport line was removed in 0.7.0); passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Host-side connector for the DSH Mobile iOS app: dials a self-hostable WSS relay so the phone can reach the DSH sessions on this computer over 4G/5G, without a public IP or a VPN; the relay only authenticates and forwards.

One-command VPS deployment for DeepSeek Harness: a zero-dependency login gateway with automatic HTTPS that proxies the native web UI, a token-protected setup wizard, and one-click DSH upgrades with automatic rollback; as a plugin it adds Settings → VPS Deploy to install DSH on (or remove it from) a VPS over SSH from a form, plus version, upgrade, gateway status and a QR code to add DSH to a phone's home screen.

Pair a phone with this computer's DSH instance by QR code or a six-digit code, then drive it remotely — send instructions, view images, answer approvals — from the panel, with public-tunnel support for pairing across networks.

Control a HarmonyOS phone from the DSH web UI with AI: live H.264 screen mirroring, mouse touch and system keys, hilog streaming, and agentic tools that let the model read the screen, locate UI controls, then tap, long-press, press keys, or type.

Voice input for DeepSeek Harness: speak into the microphone and the recognized text is submitted as a normal chat message, via local or browser speech recognition.

Rings your phone over CallKit: `call_me` and `text_me` tools, plus optional turn-end and approval calls whose spoken answer is transcribed back into the session.

Phone access to DSH over a self-hosted relay (WSS via your own TLS-terminating proxy): bundle plugin with bridge supervisor and QR login, a native Android app, and server-side device revocation.

Self-healing Cloudflare quick-tunnel pool for the dsh web GUI: floating widget with QR phone access, generational rotation, chase service worker and prompt-free credential handoff.

Automated data masking tool based on national standards, automatically identifying sensitive fields like ID cards and phone numbers.

Requires the phone app, not just this plugin: the phone half is a separate APK and must be installed first — download it from https://github.com/Zoragyx/dsh-phone-pair/releases — otherwise the computer side has nothing to pair with. This package is the computer half: it enables the upstream remote-web-ui pairing plugin with a Cloudflare quick tunnel and a fixed relay subdomain, so one scan keeps the phone connected from anywhere.

Open and drive every dsh on your tailnet from any dsh, with a complete phone layout.

Drive your local DSH from WeChat: a self-hosted iLink bridge over a persistent ACP session (context lives in DSH and is resumable), phone conversations grouped into the desktop workspace, with image recognition, file messages (Excel/Word/PDF, parsed by the agent itself) and voice transcripts. Tool approvals are answered inside WeChat itself (numbered card; ask/allow/reject policy; 120s timeout means reject), and any process can push a message to your phone through the outbox helper. Access defaults to strict (only registered devices are served); the phone channel's permission preset is configurable - see the README security section before sharing the bot.

A minimal phone remote control for DeepSeek Harness: the phone page carries only the instruction you send and the AI's final conclusion, while tool calls, file access, sub-agent dispatch, and reasoning traces stay on the computer, reachable over LAN, Tailscale, or a Cloudflare tunnel with a QR code, link, and password for each route.

Phone and remote access to the DSH Web UI: scan a LAN QR code, or reach your PC from anywhere through a self-hosted relay server you run yourself instead of a cloudflared tunnel. Per-device credentials that pair, list, and revoke individually, and several PCs sharing one relay with automatic failover.

Use DSH from iPhone/iPad: an explicit-opt-in LAN reverse proxy (Host/Origin rewrite through the loopback trust fence, WebSocket upgrades included), iOS PWA chrome (home-screen icon, standalone meta, viewport-fit), and touch/mobile CSS (safe areas, keyboard lifting, composer row fit).

Multi-window wall for the DSH Web UI: run and monitor N conversations side-by-side in one screen, with auto-discovery, per-window controls, and an authenticated LAN gateway for phone/tablet access.

Your DeepSeek Harness web UI, rebuilt for the phone in your hand. Built for developers who code in Termux on Android: single-column layout, sidebar drawer, one-line composer, fullscreen scrollable settings & trajectory details, tap-to-open session stats. Desktop untouched.

Exposes the local DSH web GUI to one chosen CIDR range only (Tailscale by default) instead of binding 0.0.0.0: the proxy listens on addresses inside that range, rejects peers outside it, and admits clients by either a tokenised URL or a 4-12 character alphanumeric access code. Remote pages can be forced into a phone layout without changing the local UI, and the official appearance, font size, transcript view, code view and performance settings can be stored in the plugin config and re-applied on every remote page load.

Vault button beside the DSH composer: save keys, servers, phone numbers, addresses and URLs, auto-collected from conversations, password-protected with WebDAV backup; click to insert, Ctrl+click to send.