Plugins

Remote control for dsh web from a phone browser, from anywhere (no public IP needed): hosted cloud relay works over 4G, or self-host the router; one command installs the desktop bridge and this in-harness Settings panel (cloud/self-hosted tabs, account login, bridge start/stop, feedback); the tunnel data plane is end-to-end encrypted (E2EE phone↔desktop, with a QR / one-time-link desktop grant so you never re-type the password), with HTTP/WebSocket pass-through, access-key auth, a live device list and optional traffic quotas.

Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.

Replaces the dsh web startup to allow binding 0.0.0.0, gated by username/password login: signed session cookies, /api route protection, an auth tab in the settings panel, and a reset CLI that rotates the signing key to invalidate all sessions.

Terminal panel for the DSH Web GUI: a sidebar "Terminal" entry opens a multi-tab xterm.js interactive terminal over a real PTY (node-pty), with SSH remote tabs (ssh2, agent / key / password auth), a cwd following the current session, and tty_list / tty_capture / tty_send agent tools.

Cross-platform Computer Use for DeepSeek Harness: virtual-mouse human-like operation (screen_observe + computer_click + type + key + scroll + drag, 11 tools), AX-tree zero-vision-cost mode with free GLM-4V-Flash vision fallback, safety guards (snapshot TTL / app whitelist / dangerous-action approval / password-box protection).

Login gate for the dsh web surface: password or shared-token authentication, session cookies, rate limiting, and a user-management CLI (dsh.bundle manifest since 0.4.1, one-command `dsh plugin add` mounting).

Password + TOTP two-factor authentication gateway for the dsh web UI: every HTTP request and WebSocket upgrade is refused until login, with per-source lockout, global rate limits and one-time backup codes.

Fail-closed password authentication proxy bundle for the DeepSeek Harness Web profile

Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.

Publishes the DSH Web GUI to LAN or internet with dsh kept on loopback. Every source must sign in for an HMAC session cookie unless passwordless LAN is opted into. Adds self-signed or custom TLS, a secureCookies override for plaintext-HTTP proxies, and a UUID shim for plain-HTTP origins.

Authentication gate for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing, HttpOnly SameSite session cookies and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a password or second-factor step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); admin-only model and API-key configuration guards; per-user isolation on the REST/list APIs and on the WebSocket event streams; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Runs on both DSH transport lines (0.1.1-rc.2 legacy and 0.1.2+ modern) with no configuration; passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Caddy forward_auth administrator login for DeepSeek Harness Web, with Argon2id passwords, revocable sessions, bilingual UI, and a native sidebar sign-out action.

Credential provider for DSH with password-protected AES-256-GCM storage, Argon2id key derivation (legacy scrypt v2 auto-upgrade), SHA3-256 integrity checks, and temporary runtime decryption.

Vault button beside the DSH composer: save keys, servers, phone numbers, addresses and URLs, auto-collected from conversations, password-protected with WebDAV backup; click to insert, Ctrl+click to send.

LAN / remote-access control, frpc NAT tunneling, a panel password gate, and mobile UI adaptation for the DSH Web GUI.

Password-gated public access for the DSH Web GUI through quick or named Cloudflare Tunnels, with HTTP/WebSocket proxying and an in-app directory picker.

A minimal phone remote control for DeepSeek Harness: the phone page carries only the instruction you send and the AI's final conclusion, while tool calls, file access, sub-agent dispatch, and reasoning traces stay on the computer, reachable over LAN, Tailscale, or a Cloudflare tunnel with a QR code, link, and password for each route.

Zero-credential Outlook automation: 13 tools that drive the local desktop Outlook client via COM — search/read mail, drafts, reply/forward, calendar, address book, rooms, free/busy — plus a sidebar new-mail badge. No Graph API registration, no SMTP passwords; anything that leaves the machine passes a three-layer human approval gate.

Bundles the remote-shell skill for secure SSH, SFTP, Telnet, and WinRM remote operations, with an encrypted credential vault whose login and execution scripts never accept plaintext passwords.

Transport-level authentication gate for the DeepSeek Harness Web GUI with server-side sessions, HttpOnly cookies, IP-based login throttling, and an scrypt password CLI.

OAuth2-capable IMAP email reader for accounts where password authentication is disabled. Microsoft disabled Basic Auth for personal Outlook IMAP in 2024, so this plugin authenticates via refresh-token OAuth2 (XOAUTH2) with automatic token refresh, plus app-password login for Gmail through an optional local HTTP/SOCKS proxy. Registers list/read/search as ol_email_* so it can coexist with the market dsh-email plugin without tool-name clashes.

Proxies the loopback-only dsh web onto a LAN port so phones and other machines can reach it, with an optional access password that browsers type in and the bundled Android client unlocks with biometrics. Adds a LAN-access settings page with QR codes, inlines dsh-web-mobile (MIT, attribution kept) for the mobile layout, and the Android client in the same repository adds finish/approval notifications, voice input and a home-screen widget.

Password-protected HTTPS login gate that lets LAN devices securely access the DeepSeek Harness web UI over the network.

Native RSS monitor for DeepSeek Harness: multi-source subscription, keyword filtering, scheduled polling with smart dedup, and email notifications for new items (HTML template with thumbnail cards), with SMTP passwords stored only in the credential store.