Plugins

Replaces the dsh web startup to allow binding 0.0.0.0, gated by username/password login: signed session cookies, /api route protection, an auth tab in the settings panel, and a reset CLI that rotates the signing key to invalidate all sessions.

Authentication gateway for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing with per-user salts, HttpOnly SameSite session cookies named per DSH_HOME and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); per-user model and API-key configuration whose private entries are encrypted with a key derived from the login password and stay unreadable by any admin, with admin sharing to selected users (usable, balance visible, key never shown, revocation immediate) and unconfigured users blocked rather than falling back to the deployment configuration; per-user isolation on the REST and list APIs and per-frame ownership filtering on the WebSocket mux; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Requires the DSH 0.2.0 line (the 0.1.1-rc.2 transport line was removed in 0.7.0); passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Customize the username (phone number or email) and avatar shown at the bottom-left account row — for personalization, or to keep screenshots from exposing them. The editor opens from the menu you get by clicking that row.

Manage Proxmox VE through conversation: 116 read + 116 write tools covering VMs, containers, storage, nodes, clusters, backups and firewalls, with API-token or username/password (ticket) auth.

Read GeoServer WMS services and render map images in the dsh web GUI, with a settings card for server, username, and password.

Public-username checks over a pinned 481-site Sherlock manifest; six states, random negative-sample verification for claimed results, default core 41, all capped at 120, NSFW off by default.

Device-pairing gateway for DeepSeek Harness: by default it listens on 127.0.0.1:3443 over plain HTTP and reverse-proxies the local dsh at http://127.0.0.1:3080, so a loopback-only install works without any certificate. Production, cross-machine and app pairing require TLS: configure tlsCert/tlsKey plus an https publicUrl (self-signed is fine). A fronting Caddy/Nginx may terminate the public TLS, but the gate itself still needs tlsCert/tlsKey and the proxy must connect back over HTTPS. Features TOTP-authorised QR device pairing, username/password login, sliding sessions with absolute caps, device revocation, a WebUI admin panel and audit log, and a reverse proxy with WebSocket tunnelling. First-run setup is completed in the WebUI wizard. Tests: 171/171 unit tests, 29-step e2e.

Login gate for the DeepSeek Harness web GUI: username/password entry page (DeepSeek style), 12-hour session tokens, slash commands for user management. Background tasks keep running while logged out.

Password gate for dsh-web: opening the web port requires a username/password login; account credentials are stored salted+scrypt-hashed and AES-256-GCM encrypted in a local config file under $DSH_HOME. Host-only cordis plugin, no dsh source changes.