DSHPilot — Desktop Workstation for DeepSeek Harness

DSHPilot is a Tauri desktop host for the official DeepSeek Harness Web UI.

It keeps the upstream Harness runtime isolated and adds desktop lifecycle, runtime updates, compatibility checks, and native integration without maintaining a fork of the Harness core.

Status

Developer preview. Phase 1/2 desktop integration and the Phase 3 self-hosted control plane are implemented. The official Harness Web UI remains authoritative; DSHPilot adds a Tauri OS shell, signed runtime lifecycle, restricted remote API, encrypted relay transport, and optional Remote PWA.

Principles

• Official Harness Web UI remains the UI foundation.
• Upstream source is pinned and physically isolated under vendor/.
• Desktop App and Harness Runtime are updated independently.
• Failed upstream candidates never replace the last known good runtime.
• MCP configuration is written as an explicit, reviewable Harness patch; imported secrets are omitted or represented by environment references.
• Document attachments are stored content-addressed below DSH_HOME, exposed as manifests first, and read on demand with archive/path limits.
• Remote mode is opt-in. Loopback is the default; non-loopback binding requires TLS, one-time pairing, per-device scopes, expiring access tokens, refresh-token rotation, and revocation.

Development

Prerequisites: Node.js 22.19+ and pnpm 11.7.0.

pnpm install
pnpm run typecheck
pnpm run build
pnpm test
pnpm smoke

Build a self-hosted control plane for LAN/VPN use:

pnpm remote:serve -- --data ./app-data --port 6767

An independently deployable blind relay is available for networks where the desktop cannot accept inbound connections. It authenticates a channel and forwards opaque E2E relay frames; it does not store or inspect Harness data:

DSHPILOT_RELAY_TOKEN='use-a-long-random-base64url-token' \
DSHPILOT_RELAY_HOST=0.0.0.0 \
DSHPILOT_RELAY_TLS_KEY=/etc/dshpilot/relay.key \
DSHPILOT_RELAY_TLS_CERT=/etc/dshpilot/relay.crt \
DSHPILOT_RELAY_ALLOWED_HOSTS=relay.example.com \
DSHPILOT_RELAY_ALLOWED_ORIGINS=https://remote.example.com \
pnpm relay:serve

The relay requires a 16–512 character base64url authentication token and native TLS for non-loopback binds. The desktop and PWA also share a separate 16+ character out of band; it is never sent to the relay and derives the end-to-end AES key. The desktop/client peers use with the relay auth token, while the relay only sees opaque frames. The relay itself is intentionally not an HTTP/RPC proxy. Relay requests are timestamped and single-use within a bounded replay window, and the tunnel exposes pairing, read-only projections, and explicitly admitted control routes only.