DeepSeek Harness (DSH) is a powerful AI coding agent runtime designed natively for local desktop workflows (127.0.0.1). When developers attempt to expose DSH across local area networks (LAN) to mobile devices (iOS/Android) or host it on remote cloud servers, they encounter critical barriers:
Privileged Interface 403 Blocking: DSH natively enforces hardcoded loopback fences. Any non-localhost request calling settings.describe or llm.providers is blocked with 403 Forbidden, making remote model switching impossible.
Mobile RPC Crashes: Mobile browsers (iOS Safari / Chrome Android) lack Secure Context over plain HTTP, rendering crypto.randomUUID undefined and breaking all RPCs.
Severe Remote Code Execution (RCE) Risks: DSH lacks built-in authentication. Opening port 3080 to LAN or WAN allows anyone on the network to create sessions and execute arbitrary shell commands via the coding agent.
Third-Party Plugin Escapes: Sidebar plugins (dsh-better-sidebar) and package managers expose PTY terminal sockets (/sidebar/ws/terminal) and arbitrary file access without authentication.
It unblocks remote access, injects mobile polyfills dynamically, and establishes a with cryptographic credential lifecycle management.
dsh-plugin-auth-guard · DSH Hub
dsh-plugin-auth-guard is the zero-intrusion, production-ready solution.
Password Fingerprint Binding: HMAC-SHA256 tokens embed current password fingerprints. Changing the password instantly revokes all tokens globally in milliseconds.
Active WebSocket Purge: Automatically terminates all active remote terminal/event WebSockets upon password change or logout.
4. 🚫 Anti-Spoofing & DoS Protection
Physical Socket Validation: Validates req.socket.remoteAddress to prevent Host: 127.0.0.1 spoofing and proxy loopback inversion.
IP Sliding Window Rate-Limiting: Blocks IPs for 15 minutes after 5 consecutive failed attempts (HTTP 429) with auto-garbage collection (GC).
Global Burst Throttling: Restricts total login frequency to 40 req/min across all IPs to defeat distributed botnets.
64KB Request Body Cutoff: Aborts payloads exceeding 64KB to prevent stream-based OOM denial-of-service attacks.
Q1: What should I do if I forget the administrator password?
Open ~/.dsh/settings.yaml on the host machine.
Under auth-guard:, clear passwordHash and salt (set to "").
Restart DSH and open http://127.0.0.1:3080 locally to initialize a new password.
Q2: Why are other devices logged out when the password is changed?
This is by design. Changing the password updates the password fingerprint in tokens and triggers the active WebSocket purge to ensure compromised credentials cannot be reused.
Q3: Why does mobile Safari work over plain HTTP without HTTPS certificates?
The plugin injects a crypto.randomUUID polyfill dynamically on the fly during HTML serving, allowing seamless mobile operation without local SSL setup.
