dsh-deeppilot

English | 简体中文

The open-source DSH companion plugin for DeepPilot, a native iPhone client for using DeepSeek Harness remotely. It connects the app directly to the DSH Host on your own Mac and does not replace or modify the DSH Web UI.

DeepPilot is currently in TestFlight review. The invitation link will accept testers after Apple approves the build.

Join the DeepPilot TestFlight

What you get

• Browse projects, sessions, history, and live agent output from iPhone.
• Send prompts, switch models, create sessions, and answer approvals/questions.
• Pair with a five-minute single-use code and a per-device P-256 key; physical iPhones keep the private key in Secure Enclave.
• Connect over the LAN (TLS with a Host-issued certificate pinned during pairing) or the optional embedded Tailscale Funnel.
• Receive live notifications and optional APNs notifications while offline.
• Self-update hint: the settings page footer shows the installed plugin version, with an inline "new version" link to the matching GitHub release when one exists (background check, stable releases only, no third-party dependency).

Install from npm

This source checkout targets Node.js 22+ and DSH 0.1.7-rc.1 with a web profile. The package includes Funnel helpers for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode does not require the helper.

The current working tree pins its DSH packages and compatibility checks to 0.1.7-rc.1. A previously published plugin package may still carry its own older compatibility declaration until a release is made from this tree.

dsh plugin --profile web add dsh-deeppilot
dsh web

After DSH restarts, open Settings → DeepPilot, enable the connection, show the pairing QR code, and scan it in the DeepPilot app. Below the QR code the same panel shows one copyable piece of pairing info (address, single-use code and certificate fingerprint) that can be pasted into the app in one step — useful for Simulator or when the camera is unavailable. Switching between the LAN and public address issues a matching new QR code and string immediately, with the panel staying open.

LAN access is enabled by default on the plugin's independent TCP port 3098 and is TLS-only. The plugin generates a self-signed certificate on first start (key under $DSH_HOME/deeppilot/lan-tls/), and the pairing QR code carries its public-key fingerprint so the app pins that exact Host. DSH may continue listening only on 127.0.0.1:3080; the plugin no longer registers any /phone routes on the DSH web server. If a firewall is enabled, allow inbound TCP 3098 on the networks you use. The port can be changed under Advanced settings.

Upgrading from a plugin version that served plain ws:// on the LAN: devices paired over the LAN must pair again so they receive the certificate fingerprint. Devices paired through Funnel are unaffected.

Package: npmjs.com/package/dsh-deeppilot

Update or uninstall

dsh plugin --profile web update dsh-deeppilot
dsh plugin --profile web remove dsh-deeppilot

Restart DSH after updating. Uninstalling the package does not delete the local DeepPilot state under $DSH_HOME/deeppilot/.

Publishing (maintainers)

Release from this branch only after validating against DSH 0.1.7-rc.1:

1. Bump version in package.json and in the root "" entry of package-lock.json, then run npm test && npm run typecheck && npm run build and inspect npm pack --dry-run --json. The compatibility metadata test enforces the exact rc.1 peer and development dependency versions.

2. Commit the release and push it. npm publish runs prepack (build) and prepublishOnly (test + typecheck) automatically.

3. Publish pre-releases without touching latest:

   npm publish --tag alpha
   

   After a successful publish, verify the dist tag and install the package in a DSH 0.1.7-rc.1 profile before pointing users at it.

4. Tag the release commit vX.Y.Z and prepare a GitHub Release (English + 简体中文 notes) that links this README section.

5. Publish stable releases with npm publish --tag latest, which moves latest to the new version. Stable releases must never be published with --tag alpha.

Never run npm publish from a copy that still has an older version.

Connection and privacy

Conversation traffic travels directly between the iPhone and your DSH Host and is always encrypted: the LAN listener on port 3098 serves TLS with a self-signed certificate whose fingerprint the app receives during pairing, and Funnel mode uses Tailscale-issued certificates. The app refuses plain ws://. Both the LAN listener and optional Funnel mode expose only the DeepPilot connection, one-time pairing, and health endpoints, not the complete DSH Web UI.

The DeepPilot settings page exposes Connections per public source under the collapsed Advanced settings section. It defaults to 8, accepts 1–16, and briefly restarts the Funnel helper when changed, so connected remote clients reconnect once.

Offline push is optional. Relay mode sends only the target APNs device token and a limited notification payload; full conversation history and live output do not pass through the relay. Read PRIVACY.md and SECURITY.md before enabling remote access or push. Protocol-v2 implementation status and remaining release validation are tracked in docs/SECURITY_ROADMAP.md.

Screenshots

Home	Sidebar	Chat	Settings

Compatibility

See COMPATIBILITY.md for the tested baseline and current limitations. DSH is still evolving; include exact DSH and plugin versions when reporting an issue.

Protocol

PROTOCOL.md is the normative DeepPilot bridge protocol. Any wire change must update that document and src/protocol.ts together and be coordinated with the private iOS client. Protocol v2 is the only supported wire version; upgrades from v1 require re-pairing.

Development

npm ci
npm test
npm run typecheck
npm run build
cd helper && go test ./...

Community and feedback

• GitHub Issues
• GitHub Releases
• npm package
• Linux.do 社区

DeepPilot is an independent community project and is not affiliated with or endorsed by DeepSeek.

License

MIT — see LICENSE.