dsh-bridge

简体中文 | English

Multi-Channel Remote Access & Global Security Gate Plugin for DeepSeek Harness

Scan a QR code on your phone and keep using DeepSeek Harness even when you're not at your computer. Whether you're lounging on the sofa, commuting on a business trip, or collaborating across networks — no need to sit at your desk, and no need to set up a public server yourself. Just scan the code to continue working on your phone, tablet, or any device.

Seamlessly extend your locally running DeepSeek Harness to mobile web pages, PWA native fullscreen apps, secure public-network tunnels, and a WeChat / QQ / Feishu / Telegram bot matrix. Direct AI code writing, task execution, operation approvals, and workspace management from anywhere, at any time.

---

Contents

• ✨ 功能特性
• 📦 环境要求与安装
• 🚀 核心功能与使用指南
  • 1. 🛜 局域网访问与多网卡智能切换
  • 2. 🌐 公网隧道（Cloudflare 临时/固定域名 & 自建隧道）
  • 3. 📱 移动端交互与 PWA 独立全屏 App
  • 4. 🗂️ 远程工作区网页选择器
  • 5. 🔐 全域安全认证与防篡改门禁
  • 6. 🤖 全能 IM 机器人矩阵（微信 / QQ / 飞书 / Telegram）
  • 7. 📊 运维监控看板与一键平滑重启
• 💬 常见问题 (FAQ)
• 🛠️ 开发与贡献
• ⭐ Star History
• 📄 开源协议

---

✨ Features

• 🛜 Smart LAN Multi-NIC Detection & Switching: Automatically detects physical Wi-Fi, Ethernet, and virtual NICs (WSL/VMware/Docker), supports visual one-click switching in the console with persistent memory, thoroughly resolving the issue of multiple NICs having non-communicating IPs;
• 🌐 Dual-Mode Cloudflare Public Tunnels: Get a random temporary domain with one click and no login required, or enter a Cloudflare Token to bind a fixed domain that auto-starts with DSH; supports macOS Gatekeeper quarantine self-healing and global probing;
• 📱 Native-Grade Mobile Interaction & PWA Fullscreen App: Dynamically centered session titles, reuses DSH's native sidebar drawer and [| collapse icon, and a non-overlapping adaptive toolbar; supports adding the phone browser "to Home Screen" to run as a standalone native app;
• 🗂️ Remote Workspace Web Picker: On the phone, tapping to add a workspace opens a tree-based directory drawer browser; on the local computer, clicking automatically diverts to the system's native selection window; supports remote registration via the IM command /addworkspace;
• 🔐 Global Security Authentication & Dual-Line Gate: Exclusive QR code with a 256-bit Token for password-free direct access, external access password gate, and an independent admin anti-tamper lock for the backend; built-in highest privilege for the physical machine (127.0.0.1) and a one-second emergency terminal reset (reset-auth);
• 🤖 All-in-One IM Bot Matrix (WeChat / QQ / Feishu / Telegram): Supports multi-workspace session orchestration, session persistence across restarts, Markdown typewriter streaming output, Card 2.0 native one-click approvals, and bidirectional direct file transfer;
• 📊 Operations Dashboard & Smooth Upgrades: Real-time system CPU / memory / uptime dashboard, one-click network connectivity diagnostics, global config JSON export/restore, fast version checking via npmmirror, and smooth restarts.

---

📦 Requirements & Installation

Requirements

1. Node.js ≥ 22 (DSH requires ^22.19.0 or ≥ 24.0.0)
2. dsh CLI available (the dsh command can be run directly in the terminal)

# 检查 Node 版本
node -v   # 应显示 v22.19+ 或 v24+

# 检查 dsh 是否可用
dsh --version

DSH Version Compatibility

This plugin works with both old and new DSH, no need to pick a plugin version by DSH version:

DSH Version	Status
0.1.0 ~ 0.1.1	✅ Supported (hardened loopback-only RPC channel)
0.1.2 ~ 0.1.4	✅ Supported
0.1.5-alpha.1 ~ 0.1.5-rc.2	✅ Supported (since v2.10.9)

About DSH's Native Authentication: Since 0.1.2, DSH has built-in browser authentication for dsh web — on startup it prints an address with a one-time token (http://127.0.0.1:3080/?token=…), which exchanges for a session cookie bound to the loopback address; after that, /, /api, and each plugin's RPC channel all require that cookie.

This and this plugin's access password gate are two complementary layers of protection — they don't conflict and don't overlap: the native authentication protects "the DSH process on the local loopback," while this plugin's gate protects "remote access entering via LAN / public tunnel." This plugin's reverse proxy automatically injects a valid loopback session cookie when forwarding, so phone / tunnel access does not require manually handling DSH's ?token= — just use it normally as described on this page.

Install the Plugin

# 方式一：从 npm 安装最新版（推荐）
dsh plugin --profile web add @wenbin_wb/dsh-bridge

# 方式二：免全局权限的 npx 方式
npx --yes @deepseek-ai/dsh plugin --profile web add @wenbin_wb/dsh-bridge

# 方式三：从源码安装
git clone https://github.com/wenbin-wb/dsh-bridge.git
dsh plugin --profile web add ./dsh-bridge

Upgrade

# 方式一：在设置页「远程访问」底部点击「🚀 一键升级到最新版并重启」（推荐，全自动）

# 方式二：终端强制覆盖安装最新版
dsh plugin --profile web add @wenbin_wb/dsh-bridge@latest

💡 Tip (for pnpm 11 users): If an older version still shows after upgrading, it's due to pnpm 11's minimumReleaseAge mechanism. Click "One-Click Upgrade" in the web console to automatically bypass the restriction and install the latest version.

---

🚀 Core Features & Usage Guide

After starting DeepSeek Harness, find 「Remote Access」 in the settings panel to enable all features:

---

1. 🛜 LAN Access & Smart Multi-NIC Switching

After start, auto-enabled with service, no config needed.

• Zero-Config Instant QR Scanning: On the same Wi-Fi, open your phone's camera and scan the code to reach the mobile web interface directly;
• Smart Multi-NIC Switching: When the host has multiple network cards (e.g., physical Wi-Fi, Ethernet, WSL virtual NIC, VMware, Docker, etc.), the console automatically shows a 「🛜 LAN NIC / IP Select」 dropdown; smart scoring highlights and recommends the physical NIC, and after selecting, the QR code and access URL are regenerated in seconds and persisted automatically.

---

2. 🌐 Public Tunnels (Cloudflare Temporary/Fixed Domain & Self-Hosted Tunnels)

No public IP or router port mapping required — access the DeepSeek Harness on your computer from the outside network anytime, anywhere:

• Mode 1: Instant No-Login Temporary Tunnel (default)

  1. Simply click the "Enable" button in the "Cloudflare Tunnel" card;
  2. The system fully automates preparation of the cloudflared binary (macOS automatically strips Gatekeeper quarantine attributes and self-heals validation);
  3. Within seconds, a public URL and QR code are generated automatically; click "Reset Link" anytime for a new one.

• Mode 2: Cloudflare Token Fixed Domain (permanent & free)

  1. In the Cloudflare Zero Trust console, create a Tunnel for free and bind a domain (e.g., dsh.yourdomain.com) — 📖 Complete from-scratch application/configuration tutorial (register account → connect domain → create tunnel → get Token → bind subdomain → fill back into panel);
  2. Expand the "⚙️ Advanced Configuration: Fixed Domain (Cloudflare Token)" at the bottom of the card, fill in your custom domain and Tunnel Token, and save;
  3. Check "Auto-start with DSH", and the tunnel will automatically restore on every DSH restart, with the URL permanently fixed!

• Mode 3: Self-Hosted WebSocket Tunnel

  • Supports connecting to a personal VPS tunnel relay server (view self-hosted tunnel deployment tutorial), with end-to-end gzip data compression and SSE response optimization.

Self-Hosted Tunnel Security Notice: The tunnel server side (scripts/install-tunnel-server.sh) only verifies the TOKEN for the "tunnel client control channel"; HTTP/WebSocket forwarding of public visitors to the tunnel domain no longer performs independent authentication — security fully relies on the plugin's local "Access Authentication" (the x-dsh-internal-tunnel marker prevents tunnel traffic from enjoying the local loopback reservation). Be sure to enable "Security Authentication" in the plugin settings and set an access password/QR Token (especially when using scope=all or on the public network); if no password is set at all, any visitor who knows the tunnel address can access your DSH directly.

---

3. 📱 Mobile Interaction & PWA Standalone Fullscreen App

Optimized for phone screens and touch — enjoy a native app experience with no extra configuration:

• Minimal top bar: Keeps the left menu drawer and right quick new-session button, with the session title dynamically centered at top;
• Native sidebar drawer: Reuses DSH's native history and workspace categories, integrates the native [| collapse icon, supports edge swipe and gesture open/close;
• PWA fullscreen support: Add to Home Screen in the phone browser to run as a 100% standalone native fullscreen app (no address bar or bottom bar);
• Adaptive layout: The bottom toolbar flexes with screen width, eliminating overlap between permission presets and the model selector.

Mobile Chat & Workspace Management

     

Remote Access & Mobile Settings Center

     

---

4. 🗂️ Remote Workspace Web Picker

Solving the issue that phones/remote browsers can't open the local file dialog, a responsive web tree browser is built in:

• Smart Diversion: Local computer access (127.0.0.1) clicking to add a workspace directly invokes the system's native file dialog; phone or remote access automatically pops up a responsive bottom directory drawer;
• Instant Access: Supports Windows drive letters (C drive, D drive) and one-click access to common system directories (Desktop, Documents, Downloads, Projects), with hierarchical browsing and manual input validation.

---

5. 🔐 Global Security Authentication & Anti-Tamper Gate

Open "Remote Access" → the "Security Authentication" tab in settings to enable full protection with one click:

1. 🛡️ First Line of Defense: External Access Gate (Protects Who Can Enter the Web Interface)

• Multi-channel enforcement modes:
  • 全部通道开启防护: LAN and all public tunnels require authentication;
  • 仅公网隧道开启防护 (推荐): Devices on the same Wi-Fi keep password-free access, while tunnels exposed to the public internet enforce authentication;
  • 仅局域网开启防护: Only LAN access is gated.
• Three flexible verification modes:
  • 🟢 QR-scan password-free + password auth (default recommended): QR codes generated by the console are pre-injected with a dedicated 256-bit security Token; scanning with your phone grants instant password-free access. Visitors manually typing an IP or public domain in a browser must enter the visitor access password you set;
  • 🔑 Password / PIN only: All external devices are required to enter the access password;
  • 🎫 Dedicated Token only: Access is allowed only via the QR code or dedicated link with the Token generated by the console.
• One-click credential rotation: Click "🔄 重置安全 Token" to instantly invalidate all previously shared QR codes and links.

📱 点击展开外部访问安全认证登录页截图

2. 🔒 Second Line of Defense: Admin Backend Anti-Tamper (Protects Who Can Modify Plugin Settings)

• Independent Admin Password: Visitor access password and admin control password are completely separated — even if you share the access password, others cannot view or modify your plugin settings;
• Three Backend Permission Policies:
  • 🔑 Password Unlock Required (default, recommended): Remote devices entering the console are fullscreen locked; enter the admin password to unlock a temporary session;
  • 🛡️ Local Computer Admin Only (highest security): Remote devices are forbidden from modifying any network, bot config, or Tokens — operations only allowed on the local computer (127.0.0.1);
  • 🌐 Lenient Mode: Allows authenticated remote visitors to manage directly.

🖥️ 点击展开远程设备管理控制台防篡改锁定截图

3. 🛟 Triple Disaster-Recovery Safety System (Never Self-Locks)

• Password-free direct access on the physical host: The host machine running DSH (127.0.0.1 / localhost) has the highest physical privileges globally — it is never asked for the access password, and the settings panel will never be locked;
• One-command server rescue: For headless Linux servers or if you completely forget the password, run a single command in the host terminal:

  touch ~/.dsh/dsh-bridge/reset-auth
  

  The plugin will automatically clear the password and policy and delete the marker within milliseconds, instantly restoring the initial password-free state;
• Forgot-password guidance across all screens: Both the visitor login page and the lock screen provide a ❓ 忘记密码？ rescue expandable card.

---

6. 🤖 All-in-One IM Bot Matrix (WeChat / QQ / Feishu / Telegram)

No browser needed — chat with your local Agent, issue tasks, and approve operations right in your messaging app:

---

🟢 WeChat Bot (ClawBot / iLink)

Based on Tencent's official WeChat ClawBot plugin (using the iLink Bot API), scan to log in with a personal WeChat account — everything runs through Tencent's servers, no public network or tunnel required.

📱 点击展开手机微信对话与审批截图

• Usage Steps: Settings page "Remote Access" → "IM Bots" → select "WeChat" → click "Scan to Log In" and confirm with the scan → sending the first message to that WeChat Bot automatically completes whitelist authorization. See the complete documentation at WeChat Usage Guide.

---

🐧 QQ Bot (OpenAPI v2)

Connects to the official QQ bot, supporting private and group chats (group requires @mention), Markdown rendering, quick-button keyboards, and file transfer.

📱 点击展开手机 QQ 单聊与群聊对话截图

• Usage Steps: Create a bot on the QQ Open Platform to obtain the AppID and ClientSecret → fill them in and save the connection → add the bot as a friend and send the first message (or @mention the bot for the first time in a group) to be automatically whitelisted. See the complete documentation at QQ Bot Usage Guide.

---

🐦 Feishu Bot (Official WebSocket 2.0)

Integrate with a Feishu Open Platform in-house enterprise app using the official WebSocket full-duplex persistent connection — 100% no public IP / no domain / no Webhook configuration required.

📱 点击展开手机飞书对话与卡片审批截图

• Steps: Create an in-house enterprise app on the Feishu Open Platform and enable long-connection event receiving → fill in the App ID and App Secret to connect. Full documentation: Feishu Integration Guide.

---

✈️ Telegram Bot (Official Bot API + Proxy Support)

Integrate with the official Telegram Bot API for real-time 1-on-1 and group chat interaction. Uses the official Long Polling mechanism with a built-in zero-dependency HTTP/HTTPS CONNECT proxy tunnel.

• Steps: Send /newbot to @BotFather to create a bot and get the Bot Token → fill in the Token (in China you may add a proxy such as http://127.0.0.1:7890) and save → the first message you send automatically completes authorization. Full documentation: Telegram Usage Guide.

---

Unified IM Interaction Command Reference

指令	说明
(普通文本)	驱动当前活动 Agent 思考与编码
/sessions（或 /list）	列出所有历史会话（按工作区分组排版）
/use N（或 /resume N）	切换到指定序号的会话
/rename <新标题>	重命名当前活动会话
/workspaces	列出已在 DSH 注册的所有工作区目录
/addworkspace <路径>	远程向电脑注册添加新的项目文件夹
/new <提示词>	在当前工作区创建并开始新会话
/new <提示词> @N	在指定工作区序号下直接新建会话
/stop	立即中断当前正在运行的任务
/end	结束并挂起当前会话上下文
/yes / /no (或 1/2)	响应敏感操作权限审批（或直接点击卡片按钮）
/status	查看 Agent 状态与系统摘要看板
/help	查看完整的指令与快捷帮助

---

7. 📊 Ops Monitoring Dashboard & One-Click Smooth Restart

打开控制台 「运维监控」 Tab，实时掌控系统状态与一键维护：

• 📊 Host System Runtime Monitoring Dashboard: Real-time display of CPU core model, total system memory with live utilization, Node process heap memory, and DSH service continuous uptime;
• 🔍 One-Click Network Connectivity Diagnosis: One-click check of reverse-proxy local port, LAN IPv4, Cloudflare Anycast edge network, and domestic npm mirror latency;
• 🗄️ One-Click Global Config Backup & Migration: Supports exporting/importing a .json backup package containing tokens, allowlists, and tunnel parameters — restore with one click after a system reinstall;
• 🔄 Smooth Graceful Restart: Click one button in the UI to restart the DSH service; it automatically reconnects and refreshes the frontend.

---

💬 FAQ

Q1: 手机扫码后提示无法连接或打不开页面？

1. Check Wi-Fi connection: Make sure the phone and computer are on the same LAN (Wi-Fi), and that the router does not have "AP Isolation" enabled;
2. Multi-NIC switching: If the computer has WSL, VMware, Hyper-V, or a VPN enabled, the default IP may resolve to a virtual network segment. Switch to the physical Wi-Fi / Ethernet IP using the "🛜 LAN NIC / IP Selector" dropdown in the console;
3. Firewall: Confirm the OS firewall allows Node.js to listen on port 3082;
4. Use a public tunnel: If across network segments or on a corporate intranet, it is recommended to enable the "Cloudflare Tunnel" for external QR-code access.

Q2: 微信 / QQ / 飞书 / Telegram 机器人的消息安全如何保障？其他人发消息会被执行吗？

1. Strict allowlist mechanism: The plugin includes a strict sender-ID-based allowlist. Only messages from authorized users on the allowlist will drive the Agent to execute;
2. First-time auto-authorization: After scanning the QR code or completing configuration, the admin's first message to the Bot automatically completes the allowlist binding;
3. Silent blocking of unknown messages: All messages from non-allowlisted users or unauthorized members in group chats are dropped at the lowest layer (never fed to the LLM) — no token consumption and no local command execution.

Q3: Cloudflare 隧道临时域名与固定域名（Token 模式）有什么区别？

1. Temporary no-login mode (default): No Cloudflare account needed — one click instantly generates a random https://*.trycloudflare.com ephemeral URL, ideal for quick connections when on the go;
2. Fixed-domain mode (Token mode): Create a Named Tunnel in the Cloudflare Zero Trust console and fill in the Token to bind your own dedicated fixed domain (e.g. dsh.yourdomain.com). Once "Auto-start with DSH" is enabled, restarting the computer or service will not change the domain.

Q4: 插件升级或重启 DSH 服务后，已有配置和聊天会话会丢失吗？

1. Persistent configuration: All IM credentials, authorization allowlists, public tunnel options, and security passwords are stored in the system home directory (~/.dsh-bridge/) — upgrades and restarts are fully non-destructive;
2. Seamless session recovery: Session history is persistently managed by the DSH core engine. After a restart, simply send a message in your chat app or use the /resume command to automatically restore context;
3. One-click backup & migration: Export the global configuration as a .json file from the "Ops Monitoring" tab for easy cross-device migration.

---

🛠️ Development & Contribution

Feel free to submit Issues and Pull Requests to help improve the plugin!

# 1. 克隆代码仓库
git clone https://github.com/wenbin-wb/dsh-bridge.git
cd dsh-bridge

# 2. 安装依赖并启动构建
npm install
npm run build:client

# 3. 运行全量单元测试
npm test

# 4. 安装到本地 DSH Web Profile 进行联调
dsh plugin --profile web add .

---

⭐ Star History

---

📄 Open-Source License

This project is open-sourced under the MIT License.