dsh-secure-context-fix

Fix the DeepSeek Harness Web GUI over plain HTTP on a LAN (e.g. from a phone).

Problem

crypto.randomUUID only exists in secure contexts (HTTPS or localhost). When you open the dsh Web GUI from another device over plain HTTP on your LAN (http://192.168.x.x:3080), the browser has no crypto.randomUUID, so every RPC crashes with:

crypto.randomUUID is not a function

Symptoms: workspace list never loads, the directory picker fails, sessions cannot be created — while http://127.0.0.1:3080 works fine on the same machine.

How this plugin fixes it

This plugin is a small host plugin that registers a webServer.tapIndex transform. When the GUI serves its index.html, the plugin injects a tiny inline <script> into <head> that installs a crypto.randomUUID implementation backed by crypto.getRandomValues() — which browsers do expose on insecure origins — before any dsh bundle code runs.

No official source changes, no polyfill library, no build step for users.

Install

From the directory containing this package (after cloning):

dsh plugin --profile web add ./dsh-secure-context-fix

Or from a git host:

dsh plugin --profile web add github:<you>/dsh-secure-context-fix

Then restart the profile:

dsh --profile web

First add from a git host may ask you to allow the package's build (allowBuilds) if a prepare script is present; this package ships no build step and plain JS, so no allowance is needed.

How to check it works

1. Serve the GUI on all interfaces so a phone can reach it. The dsh CLI rejects --host 0.0.0.0 for safety, so patch the webserver row in the profile instead:

   # $DSH_HOME/profiles/web/cordis.patch.yml
   - id: webserver
     config:
       host: '0.0.0.0'
       port: !!js ctx.webStartup.port ?? 3080
   

2. Allow inbound TCP 3080 in the firewall, ideally restricted to your LAN subnet:

   New-NetFirewallRule -DisplayName "dsh web 3080 (LAN)" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow -Profile Private -RemoteAddress 192.168.0.0/24
   

3. On the phone (same Wi-Fi) open http://<your-LAN-IP>:3080. Workspace list, directory picker, and new sessions should now work.

Files

• index.js — the plugin entry (name, inject, apply).
• cordis.patch.yml — the bundle layer inserting the plugin row.
• package.json — npm manifest declaring dsh.bundle.

Security notes

Binding the GUI to 0.0.0.0 exposes remote-code-execution-grade control of the agent to anyone who can reach the port. Only do this on a trusted network, and prefer restricting the firewall rule to your LAN subnet as shown above.

Upstream

This is a stop-gap for deepseek-ai/deepseek-harness discussions #4209 until the official repo replaces its three crypto.randomUUID() call sites (AbstractApiClient.mintRpcId, ui-conversation image draft ids, and llm createMessage) with getRandomValues()-based UUIDs. If you can patch the source, do that instead; this plugin helps users who cannot.