A native HarmonyOS companion for DeepSeek Harness, with browser-based Passkey pairing, a private DSH bridge, and a durable Huawei Push Kit notification relay.

Source alpha. The native project builds with official DevEco Studio 26.0.0.851 / SDK 26.0.0.105, and a developer-signed debug HAP installs on a physical device; the signing configuration stays machine-local and untracked. This is not a ready-to-install App: production registration, Push Kit delivery, DSH runtime integration and most runtime behavior are still unverified. It does not modify an existing server, configure DNS, issue certificates, or open ports automatically. No automated tests have been added or run.

What's here

Component	Implementation in this alpha
Native App	Server configuration, Passkey device pairing, session list and creation, text prompts, recent transcript, cancellation, activity inbox, approval UI, device revocation
Authentication	Browser OIDC with PKCE/state/nonce, explicit pairing-code confirmation, proof-bound one-time credential claim, revocable device tokens, maximum 90 days and 7 days idle by default
DSH plugin	HMAC-authenticated loopback RPC, session-controller adapter, turn/approval event outbox, optional mobile-owned one-shot approvals
Notification relay	SQLite queue, deduplication, bounded retention, retry/backoff, PS256 Huawei service-account signing, generic lock-screen content
Native credential storage	Asset Store, accessible while unlocked and requiring a device password; no token in preferences or source

Current conversation updates use foreground snapshots every 10 seconds, with a cursor that suppresses unchanged history bodies. There is no token-by-token stream renderer yet. Notification clicks open the referenced session (falling back to the activity inbox), and the activity feed drives a tab badge plus per-kind in-app notices. Local testing has a device helper, a loopback end-to-end check, a debug-build mock relay for the phone UI, and a private-CA LAN lab for the real pairing flow (see docs/local-testing.md and docs/lan-testing.md).

Not included yet: image/file uploads, full rich tool cards, complete history pagination, question answering, streaming rendering, background live views, or an app-store release. See status and next steps.

Architecture

flowchart LR
  Phone[HarmonyOS native App] -->|HTTPS / existing FRP| TLS[TLS ingress]
  Browser[System browser / Passkey] --> Identity[OIDC identity provider]
  Browser --> TLS
  TLS --> Relay[Pocket relay]
  Relay <-->|Signed loopback RPC / events| Plugin[DSH Pocket plugin]
  Plugin --> DSH[Harness sessions and tools]
  Relay -->|Generic notification| Push[Huawei Push Kit]
  Push --> Phone

The identity provider and TLS ingress can live on the virtualization host. The relay and DSH plugin should share the guest and communicate over loopback. The App never needs SSH or a model-provider API key. This alpha serves one explicitly configured owner, with owner-level access to the corresponding DSH instance; it is not multi-tenant software.

Repository map

apps/harmony/          ArkTS / ArkUI application and resources
packages/dsh-plugin/   DSH bundle, private RPC, durable event outbox
packages/relay/        OIDC pairing, device sessions, API, notification worker
deploy/               Example systemd, Caddy, and DSH configuration
docs/                 Architecture, protocol, setup, status, and threat model
tools/                Secret generation and staged-file publication guard

Getting started

Relay source

Requires Node.js 24 or later. The relay uses Node's built-in SQLite API and one pinned external dependency, openid-client. The plugin has no external runtime dependencies.

npm ci --ignore-scripts
cp .env.example .env
npm run secrets
# Fill .env outside version control; create a separate confidential OIDC client.
npm start

Register the exact callback https://pocket.example.com:9443/pocket/auth/callback with your identity provider. Configure OWNER_SUBJECT using the stable OIDC subject, not a display name. The browser confirms the App's pairing code before a device is granted access. Deployment details are in the setup guide.

HarmonyOS source

Open apps/harmony in official DevEco Studio. Configure developer signing and Push Kit capability using your own Huawei developer account. No SDK, signing private key, service-account JSON, or generated HAP is committed here. The build profile targets SDK 26.0.0 and requires API 23 or later so authenticated HTTP requests can explicitly reject redirects. On Windows, tools/build-harmony.ps1 uses the official bundled tools via DEVECO_STUDIO_HOME without replacing global Node.js or Java. See HarmonyOS setup.

DSH adapter

The adapter was written against official source revision 22ddee3, not runtime-tested against it. DSH plugin APIs can change. Confirm the installed version before enabling the plugin; missing controller methods stop activation instead of pretending to work.

Keep mobile approval ownership off initially. Enabling it deliberately gives this plugin the approval seat; web and mobile do not race to answer the same request. Timeouts, cancellation, or plugin unload do not approve anything.

Contributing

Start with development, API, and security. Keep hostnames, accounts, inventories, runtime state, and credentials out of issues and commits. The project is independent and is not an official DeepSeek or Huawei product.

MIT licensed. The original Pocket artwork is included as editable SVG source.