Reach your DeepSeek Harness host from your LAN, Tailnet, or an existing HTTPS endpoint. Pair a client once and keep multiple routes attached to the same host identity.

One host, several ways to connect

| Route | Address | Setup | | --- | --- | --- | | LAN | A reachable local gateway address | Choose LAN and scan the pairing QR. | | Tailnet | A Tailscale Serve MagicDNS HTTPS URL | Choose Tailscale on an already signed-in host. | | Custom HTTPS | Your working reverse-proxy URL | Supply the address when creating the QR. |

DSH stays on loopback. The plugin puts an authenticated gateway in front of it, with short-lived pairing tickets, rotating device credentials, and a persistent host ID.

Quick start

dsh plugin --profile web add dsh-network@latest
dsh web

Open Settings → Network to see the host and create a pairing QR, or use the setup assistant in another terminal:

dsh plugin --profile web exec dsh-network setup

Choose LAN, Tailscale, or Custom address. The assistant asks when no mode is supplied. Scan the result with a compatible client.

The default gateway listens on port 3081. DSH's underlying Web server remains bound to loopback at its configured port.

Choose your route

# LAN: both devices must be able to reach each other
dsh plugin --profile web exec dsh-network setup lan

# Tailnet: requires Tailscale already installed and signed in
dsh plugin --profile web exec dsh-network setup tailscale

# A working HTTPS gateway you already operate
dsh plugin --profile web exec dsh-network setup custom --url https://dsh.example.com

Use --url http://HOST:3081 if LAN detection selects the wrong interface. Tailscale setup configures Serve to forward to the authenticated gateway. A custom public route must already provide trusted HTTPS and HTTP/WebSocket forwarding; this plugin does not configure DNS, certificates, firewalls, or a reverse proxy.

Settings that explain the current state

The Network page groups host identity and device pairing separately, with labelled inputs, pending states, and inline errors. It follows DSH's English/Chinese locale and light/dark theme. Pending settings requests stop when the panel unmounts.

An optional iosAppDownloadURL displays a dismissible app-download card when configured with a valid HTTPS URL. Without one, the card stays hidden.

Configuration

| Field | Default | Purpose | | --- | --- | --- | | gatewayPort | 3081 | Authenticated gateway port. | | bindHost | 0.0.0.0 | Gateway interfaces; 127.0.0.1 limits it to loopback. | | hostName | System hostname | Host display name. | | statePath | $DSH_HOME/network/state.json | Pairing and device state. | | historyChunkTrim | true | Remove redundant settled streaming chunks from history responses. | | historyTrustedHosts | [] | Additional allowed direct-Web Host values for history routes. | | iosAppDownloadURL | Unset | App Store or TestFlight HTTPS URL for the optional card. |

DSH_HOME defaults to ~/.dsh. History trimming preserves rendered messages, first-token timing, and current partial output while reducing redundant deltas; savings depend on the session. Its routes retain the host's origin and cross-site checks.

Pairing & credentials

Pairing tickets are single-use and expire after five minutes. A paired client receives a refresh credential and a one-hour access token; refresh rotates both. The host stores hashes, not the original credentials. Pairing links are generated on demand rather than broadcast.

LAN HTTP relies on a trusted local network. For a public route, expose the authenticated gateway through HTTPS, not the underlying DSH Web port. See public deployment boundaries.

Troubleshooting

| Symptom | Check | | --- | --- | | LAN address does not open | Device reachability, private-interface firewall rules, and the selected IP. | | Tailscale setup fails | tailscale status and the host's existing sign-in. | | Public route fails | Trusted TLS and both HTTP/WebSocket reverse-proxy forwarding. | | Pairing QR expired | Generate a new single-use ticket. |

Full device listing and revocation controls in settings remain future work; the current panel exposes host status, paired-device count, and pairing.

Development & feedback

npm ci
npm run check

Report an issue · Release notes · MIT license