dsh-mobile-access

A PIN-protected, chat-only mobile web client for DeepSeek Harness (DSH), served on an isolated port over your LAN or a self-provided tunnel — without ever exposing the desktop web surface.

English · 中文

---

What it does

DSH's web UI binds to 127.0.0.1 for good reason — it exposes files, terminals and settings, so opening it to the network means opening all of that. This plugin keeps that desktop surface untouched and instead runs its own, deliberately narrow HTTP listener that only ever offers chat: view sessions, keep talking, and see the same stats the desktop shows. Access it from your phone on the same Wi-Fi, or through a tunnel when you are away.

Features

Mobile client (/m/)

• PIN login → workspace-grouped session list → live chat.
• Streaming replies with tool-call steps rendered inline.
• Per-session model and permission-preset switching, without leaving the chat.
• Session stats matching desktop — turns, steps, LLM time, tokens, and cost.
• Round navigation rail — jump to any turn, with a hover preview and auto-loading of older history.
• Pagination (load older), light/dark theme (light by default), and toasts.

Desktop settings page

A standard DSH settings card, reachable from the desktop UI:

• Master switch, port, network mode (lan / tunnel / both), tunnel host, and idle timeout.
• Set or reset the PIN (with show/hide), scan a QR code to connect a phone, revoke sessions, review login history, and follow tunnel tutorials (Tailscale / cloudflared / cpolar).

Security

• Off by default; loopback-only until a PIN is set, so the surface cannot be reached before it is configured.
• PIN: 8 digits, weak PINs rejected, stored as scrypt (N=2^14, r=8, p=1) with a random salt, compared in constant time.
• Tokens: 256-bit random values; only sha256(token) is persisted; 7-day expiry plus an idle timeout (default 60 min).
• Brute-force protection: 6 login attempts per IP per minute; 5 failures lock the IP out for 15 minutes, doubling on repeat (persisted).
• Host allowlist on the isolated listener; CSRF protection on every write request.
• The desktop web surface stays loopback-only — no --host 0.0.0.0, no changes to DSH's own trust boundary.

Architecture

┌─────────────────────────── DSH host (loopback only) ───────────────────────────┐
│  desktop web UI (127.0.0.1:3080)   ← unchanged, never exposed                  │
│  dsh-mobile-access host plugin                                                 │
│    settings · sessionQuery · agents · apiProxy · permissionPresets · ...       │
└──────────────────────────────────────┬─────────────────────────────────────────┘
                                       │ in-process service calls
┌──────────────────────────────────────▼─────────────────────────────────────────┐
│  isolated HTTP listener (0.0.0.0:3081 for LAN, 127.0.0.1 for tunnel)          │
│  PIN auth · host allowlist · CSRF · SSE                                        │
│     /m/            mobile SPA (preact, served statically)                      │
│     /m/api/*       chat / sessions / stats / models / permissions              │
│     /m/api/admin/* loopback-only admin (PIN, sessions, login history)          │
└────────────────────────────────────────────────────────────────────────────────┘
        ▲ LAN (HTTP) or tunnel (Tailscale / cloudflared / cpolar, HTTPS)
        │
      📱 phone browser

The plugin bridges to DSH's own host services (sessionQuery, agents, apiProxy, permissionPresets, sessionProjections, …) in-process. It does not re-implement DSH; it exposes a small, curated slice of it.

Requirements

• DeepSeek Harness 0.1.1-rc.2 (the @deepseek-ai/* packages are declared as peerDependencies).
• Node.js ≥ 20.

Installation

The repository ships prebuilt lib/ and dist-webapp/, so a Git install works without a build step:

dsh plugin --profile web add github:huanlanmie/dsh-mobile-access

Restart dsh web. A Mobile access card appears in the desktop settings — use it to set the PIN, enable the surface, and scan the QR code. Until a PIN is set, the surface stays loopback-only.

Local development install: dsh plugin --profile web add link:<path-to-checkout> (or ./dsh-mobile-access from the checkout's parent directory).

Quick start

1. On the host machine, open the desktop web UI's Mobile access settings card and set an 8-digit PIN.
2. Enable the surface and pick a mode:
   • lan — the listener binds 0.0.0.0; scan the QR code on your phone over the same Wi-Fi.
   • tunnel — fill in your tunnel authority (see below) and reach it over HTTPS.
   • both — LAN for home, tunnel for away.
3. On the phone, open /m/, enter the PIN, and continue your sessions.

Tunnels

Provider	What to put in tunnel host	Notes
Tailscale	mypc.tail12345.ts.net	tailnet traffic is already encrypted; recommended.
cloudflared	the temporary *.trycloudflare.com host	HTTPS terminated at Cloudflare, forwarded locally.
cpolar	the assigned *.cpolar.top / *.cpolar.io host	HTTPS tunnel; keep the token in .cpolar/.

Configuration

Key	Type	Default	Description
enabled	boolean	false	Master switch. Disabled = no listener at all.
port	number	3081	Port of the plugin's isolated HTTP surface (1024–65535).
mode	lan | tunnel | both	lan	Which networks may reach the surface.
tunnelHost	string	""	Tunnel authority (hostname) served over HTTPS.
idleTimeoutMin	number	60	Session idle timeout in minutes (5–10080).

These are DSH settings under the mobile-access namespace; they can be edited from the desktop settings card.

Security notes

• LAN mode is plaintext HTTP. The PIN and bearer token can be sniffed by anyone on the same network. Use it only on a network you trust; use a tunnel for anything else.
• Setting or resetting the PIN revokes all existing sessions.
• This is third-party code, not part of DSH. Review the source before installing it on a machine that hosts your sessions.

Development

npm install
npm run build      # esbuild bundles the mobile SPA + desktop client, then tsc compiles the host
npm test           # node:test — PIN format, token hashing, lockout, host allowlist
npm run typecheck  # tsc --noEmit

Layout:

src/            host plugin (TypeScript): auth, server, settings, storage,
                net (allowlist/URLs), mux (question/approval bridge), API routes
src/client/     desktop settings section (React)
webapp/src/     mobile SPA (preact): main.tsx, api.ts, styles.css
scripts/        build-webapp.mjs (esbuild + client-bundle envelope)
test/           node:test suites

Prebuilt lib/ and dist-webapp/ are committed so Git installs need no build step; they are regenerated by npm run build.

Screenshots

License

MIT