Plugins

Remote and mobile access for DeepSeek Harness: provides LAN QR code connection, Cloudflare/custom tunnels, WeChat, QQ, Feishu, Telegram bot integration, and security authentication.

Secure remote access for the DeepSeek Harness Web UI: a login gate, MFA/TOTP, signed session cookies, optional admin/user/guest roles, in-browser workspace selection, and allowlisted remote file previews.

Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.

Remote DeepSeek Harness with full server-side API access (`settings.*` / `credentials.*` / `host.listDirectory`). Token-gated reverse proxy, per-device sessions, phone invite QR, fence self-check, optional approval / CIDR / idle timeout / local TLS, WebSocket/SSE.

Login gate for the dsh web surface: password or shared-token authentication, session cookies, rate limiting, and a user-management CLI (dsh.bundle manifest since 0.4.1, one-command `dsh plugin add` mounting).

Password + TOTP two-factor authentication gateway for the dsh web UI: every HTTP request and WebSocket upgrade is refused until login, with per-source lockout, global rate limits and one-time backup codes.

Fail-closed password authentication proxy bundle for the DeepSeek Harness Web profile

Multi-user login gateway for the DSH web UI: the first visit creates the admin account, admins add and manage users in the GUI settings panel, ordinary users see only their own conversations, and unauthenticated visitors are redirected to /login.

WebUI authentication enforced at the HTTP/transport layer: four-layer login gate (resources, plugin bundles, /api, WebSocket), server-side sessions with HttpOnly cookies.

Caddy forward_auth administrator login for DeepSeek Harness Web, with Argon2id passwords, revocable sessions, bilingual UI, and a native sidebar sign-out action.

Authentication gate for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing, HttpOnly SameSite session cookies and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a password or second-factor step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); admin-only model and API-key configuration guards; per-user isolation on the REST/list APIs and on the WebSocket event streams; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Runs on both DSH transport lines (0.1.1-rc.2 legacy and 0.1.2+ modern) with no configuration; passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Password-gated public access for the DSH Web GUI through quick or named Cloudflare Tunnels, with HTTP/WebSocket proxying and an in-app directory picker.

LLM provider adapter that routes model calls through any ACP (Agent Client Protocol) server — Claude Code, Codex, Gemini CLI, Devin and more — with a registry browser, per-server settings UI, lazy authentication, and dynamic model discovery.

Transport-level authentication gate for the DeepSeek Harness Web GUI with server-side sessions, HttpOnly cookies, IP-based login throttling, and an scrypt password CLI.

OAuth2-capable IMAP email reader for accounts where password authentication is disabled. Microsoft disabled Basic Auth for personal Outlook IMAP in 2024, so this plugin authenticates via refresh-token OAuth2 (XOAUTH2) with automatic token refresh, plus app-password login for Gmail through an optional local HTTP/SOCKS proxy. Registers list/read/search as ol_email_* so it can coexist with the market dsh-email plugin without tool-name clashes.

WebDAV server: turns a shared directory into a WebDAV service that Windows, macOS and Linux can mount as a local disk, with token authentication, optional read-only mode, configurable directory/port/token, and per-platform mounting guides built into the settings page.

Single-password authentication gate for the dsh web surface: configurable session validity, Ctrl+Shift+L lock, CLI password management, brute-force lockout, in-UI password controls.

Instance manager for DSH Web: a Mini Utility Dock panel that lists every local dsh web instance the machine can see (port, PID, uptime, live session count, resident memory, version), starts a new instance on an automatically picked free port in 3080-3129 or on a port you name, opens a row in a new tab, and stops one or all of them through that instance’s own graceful shutdown (appExit). Rows also show what each instance is serving, and read-only instance logs and session summaries are one click away. Where a peer is configured, the same panel lists and queries instances on other machines over a bearer-authenticated link. Every route is loopback-guarded, and a browser-facing action must additionally pass the host’s own browser authentication.

OAuth2-capable IMAP email reader for accounts where password authentication is disabled. Microsoft disabled Basic Auth for personal Outlook IMAP in 2024, so this plugin authenticates via refresh-token OAuth2 (XOAUTH2) with automatic token refresh, plus app-password login for Gmail through an optional local HTTP/SOCKS proxy. Registers list/read/search as ol_email_* so it can coexist with the market dsh-email plugin without tool-name clashes.

Command Code provider plugin for DeepSeek Harness (dsh) — works with every Command Code plan including the $1 Go plan; uses the Studio authentication API key over /alpha/generate, not the Provider API

Dynamically trusts every Host header that actually arrives and flips the default web binding to 0.0.0.0: wildcard or unenumerable entry domains work without editing the start command, the authentication layer is untouched, and hosts are evicted by LRU beyond a capacity cap.

Routes DSH filesystem, shell, subprocess, and PTY operations to local, SSH, and Docker execution nodes, with a node registry, an authentication gate, a mobile-aware management UI, and per-workspace custom project instructions.

Routes DSH filesystem, shell, subprocess, and PTY operations to local, SSH, and Docker execution nodes, with a node registry, an authentication gate, a mobile-aware management UI, and per-workspace custom project instructions.

Adds a structured TextIn xParse tool and document parsing skill to DeepSeek Harness, supporting document parsing, cached-content navigation and durable multi-document tasks, with AppKey or Device OAuth authentication, paid-operation approval and bundled cross-platform CLI binaries.