Plugins

Remote control for dsh web from a phone browser, from anywhere (no public IP needed): hosted cloud relay works over 4G, or self-host the router; one command installs the desktop bridge and this in-harness Settings panel (cloud / self-hosted / WeChat-bot tabs, account login, bridge start/stop, feedback); the tunnel data plane is end-to-end encrypted (E2EE phone↔desktop, with a QR / one-time-link desktop grant so you never re-type the password), with HTTP/WebSocket pass-through, access-key auth, a live device list and optional traffic quotas; the WeChat bot channel is bound by QR scan and pushes task-finished / error / stopped events to WeChat, where one number in reply approves or denies a pending decision and continues the current task — WeChat messages travel only between Tencent ilink and the local bridge, never through the relay.

Remote control for dsh web from a phone browser: the plugin adds an in-harness Settings panel (cloud/self-hosted mode tabs, account login, bridge start/stop, feedback) with same-origin /dsh-remote relay routes; the desktop bridge and self-hosted relay-router in this repo tunnel the local dsh web to a phone PWA with access-key auth, a live device list and optional traffic quotas.

Remote DeepSeek Harness with full server-side API access (`settings.*` / `credentials.*` / `host.listDirectory`). Token-gated reverse proxy, per-device sessions, phone invite QR, fence self-check, optional approval / CIDR / idle timeout / local TLS, WebSocket/SSE.

Fail-closed password authentication proxy bundle for the DeepSeek Harness Web profile

Rewrites the blocked at-sign and four channel fingerprints in system messages at the fetch layer, so WorkBuddy's China gateway stops answering DSH requests with HTTP 400 code 11128; dry-run mode only observes and never modifies the request.

LAN and reverse-proxy access to the DeepSeek Harness web UI: returns the settings service on pages that are not localhost, fills in the web APIs a browser withholds over plain HTTP, and can open a listener of its own.

Use DSH from iPhone/iPad: an explicit-opt-in LAN reverse proxy (Host/Origin rewrite through the loopback trust fence, WebSocket upgrades included), iOS PWA chrome (home-screen icon, standalone meta, viewport-fit), and touch/mobile CSS (safe areas, keyboard lifting, composer row fit).

LAN mobile gateway: isolated child-process reverse proxy with first-visit approval, per-device token binding, rate limiting, and mobile layout injection (compact composer pills, randomUUID polyfill).

Password-gated public access for the DSH Web GUI through quick or named Cloudflare Tunnels, with HTTP/WebSocket proxying and an in-app directory picker.

DeepSeek Harness plugin: makes a reverse-proxied (non-loopback) dsh web page count as a trusted host, so the Settings surface loads instead of reporting "settings are unavailable in this browser".

Exposes any local service on a LAN address and a public cloudflared quick-tunnel domain behind one password login, with per-route open/block gates managed from the plugin settings page. Requires Python 3 and cloudflared on the machine, and reports either of them being missing or misconfigured in the settings page before you start; LAN and local access are passwordless by default, while the public tunnel requires the passcode.

Password gate for the DeepSeek Harness Web UI that also removes the 403 a reverse proxy causes, with revocable sessions, an admin page and zero dependencies.

A QR-code button above Settings that lets phones connect to the web UI through an auth-gated reverse proxy.

DeepSeek Harness 内建的内网穿透面板：托管 SakuraFrp frpc，隧道列表 / 端口自动同步 / 流量统计 / 公网密码门。

把 Tailnet / 反向代理页面当作「本机」来用：启用 host 持久化设置，并按需关闭浏览器会话校验（Host/Origin 栅栏保持不动）。

Use DSH from your phone anywhere: a self-hosted relay plus a desktop host plugin form a token-authenticated tunnel (order-preserving HTTP reverse proxy + WebSocket bridging) with QR pairing, an admin console for device/token management, and an injected mobile adaptation layer (full-width chat, full-screen settings sheet, sidebar drawer).

A five-stage engineering loop for agent-built projects — spec, build, verify, ship, learn — with one artifact and one gate per phase, so an agent always knows the single next action. Role policy, project templates and deployment sit behind explicit ports: swap the implementation without rewriting the loop. Its scaffold generator lays out the internal layers of a project — `init --layout {none,webapp,service,plugin} --stack {python,node,none}` — from nine layers sampled out of three unrelated production projects: entry docs, an OpenSpec plan face, a spec truth layer (INDEX, one file per domain, TESTING, CONSTITUTION), a wiki split into knowledge / progress / runbook, the six `.agents/` slots, server+web, scripts/deploy/config, tests+e2e and a gitignored out/. Non-none layouts also gate the directory contract and compile every source root. Ships a Python CLI (init/next/check/ship/new) plus a local command adapter and an SSH/systemd adapter with release directories, an atomic current/previous switch, a deploy lock, a commit-versioned JSON probe and automatic rollback on a failed probe; bootstrap and teardown provision and remove the unit and the reverse-proxy block idempotently and refuse to delete a root they did not create. Includes a runnable example workspace and a skill that keeps the agent on one phase at a time. Requires Python 3.10+ and PyYAML; remote deploys need SSH access, rsync, systemd and Caddy on the target.

LAN access portal for DeepSeek Harness running on a NAS or other always-on host, letting a phone browser reach the DSH instance on that device; intranet penetration is supported through external tunnels such as frps or EasyTier. Its HTTP/WebSocket reverse proxy is specifically optimized for subdomains, subpaths and second-level directories (login entry, Location and Cookie Path adapt automatically), and adds opt-in visitor/administrator password protection plus remote workspace registration. Derived from wenbin-wb/dsh-bridge v2.17.8 (MIT, several modules reused verbatim); both default to port 3082, so change one port before running both.

给 DSH 一个固定的本地端口：在宿主进程内监听你指定的端口，转发到 DSH 每次启动都会变的随机 web 端口。

Kiro (AWS CodeWhisperer/Amazon Q) provider route for DeepSeek Harness, plus an OpenAI/Anthropic reverse proxy. Reuses the existing Kiro IDE/CLI sign-in.

Control surface for the dsh-lan-gate LAN gateway: a button beside Settings that shows whether the gateway is running and how many phones or tablets are waiting for approval, opens the loopback-only approval page in one click instead of typing its URL, and starts the gateway through its scheduled task first when it is not running. Not rendered on phone or tablet surfaces.

Restores Host-persisted settings when dsh web is reached through a reverse proxy on a non-loopback hostname: marks the page connection as host-owning so the Settings and model pages load instead of reporting "settings are unavailable in this browser". For dsh 0.1.7 – 0.2.x.

DSH Web trusted-domain bootstrap for reverse-proxy and tunnel deployments.

Remote control and mobile overlay for DeepSeek Harness: LAN and public (cloudflared) tunnels with QR-code access, a phone-first mobile UI under 768px, and a LAN reverse-proxy CLI.