WZZNNE/DSH-CyberWorkStation--plugins-dsh-lan-fence ↗★ 11
dsh-lan-fence
Deny unpaired LAN devices the bare /api when the DeepSeek Harness web server binds all interfaces: removes the auto-derived LAN IP authorities from the connection trust list in place, without any core change, so pairing-fronted remote access is safe by default and a core upgrade never reopens the hole.
安装
此插件尚未提供可验证的 bundle，或兼容性检查未通过。请先阅读仓库说明。 阅读完整 README ↗
说明文档
阅读完整 README ↗dsh-lan-fence
中文 | English below
开手机远程(@linxin666/dsh-remote-web-ui,绑 0.0.0.0)时,本体会把本机自动推导出的局域网 IP 授信到 /api 防线上——未配对的局域网设备就拿到了完整桌面 API。这个插件在防线读取授信列表的地方就地剥掉那些自动推导的 LAN 授权,不改本体一行代码;配对通道 /remote 不受影响。
- 只在服务器绑到所有网卡时起作用;
127.0.0.1/ 显式配置的trustedHosts原样保留。 - 未授信的 LAN 请求拿到的是本体自己的 403,不是本插件的。
安装(不是 bundle)
它就地编辑本体的连接防线,没有 dsh.bundle.patch,是 profile 自己 cordis.patch.yml 的一层(setup.cmd 经 launcher/dsh-patch-layers.mjs 幂等写入):
- insert:
- id: lan-fence
name: 'dsh-lan-fence'
启动器「自检」按 patch 文件识别它。
When the server binds every interface (mobile remote), the core trusts this machine's auto-derived LAN IP literals on the /api fence, handing an unpaired LAN device the whole desktop API. This plugin removes exactly those authorities from the list the fence reads — in place, with zero core change; loopback and explicitly configured trustedHosts stay. It is a layer of the profile's own cordis.patch.yml (written by launcher/dsh-patch-layers.mjs from setup.cmd), not a bundle.