dsh-auth

English | 中文

Authentication plugin for DeepSeek Harness: accessing dsh web requires sign-in
(username + password); idle sessions log out automatically; sessions expire
after a configurable max age; single sign-on mode; the settings UI changes the
username / password / expiry times; dsh web p resets the password and
dsh web u changes the username.

• GitHub: https://github.com/optttt/dsh-auth
• npm: https://www.npmjs.com/package/@tyler9061/dsh-auth

Install

From npm (recommended):

dsh plugin --profile web add @tyler9061/dsh-auth

From a source directory (development; live-links local code):

dsh plugin --profile web add link:/path/to/dsh-auth

Restart dsh web after installing.

Usage

• On first start the server console prints the initial username and
  password (default username admin). Visiting the web UI redirects to /login.
• Settings > Auth: change username / password, idle logout minutes,
  session max age (minutes), single sign-on, and sign out.
• Single sign-on: when enabled, every new login invalidates all other
  sessions. Kicked clients land on the login page with a warning —
  "if this was not you, change the password immediately".
• Forgot credentials: dsh web p prints a new random password (or
  dsh web p mypass); dsh web u newname changes the username
  (3-32 chars, letters/digits/_``-).
• Login history: Settings > Auth lists recent successful logins
  (IP, time, GeoIP location); the last 50 are kept.

Network access (LAN)

The real server binds 127.0.0.1 only; the plugin runs a reverse proxy on
0.0.0.0:<lanPort> (default 3080, override with DSH_AUTH_PORT) that
forwards to loopback and rewrites Host/Origin, so the built-in /api trust fence
accepts every request — all /api RPCs (settings, files, SCM, other plugins)
work from LAN clients. The auth gateway still protects everything.

• LAN URL: http://<LAN-IP>:3080 (printed at startup).
• --host 0.0.0.0 stays rejected by the CLI; use the proxy defaults.
• The proxy forwards the WebSocket upgrade's first data frame correctly (never as an
  HTTP request body); either end closing tears down the other, so no half-open tunnels
  are left behind.

i18n & theme

• UI strings follow the main client language (zh/en via ctx.locale);
  the login page follows the browser language.
• The settings UI uses the main client design tokens (--dsw-alias-*) and
  adapts to light/dark themes automatically.

Data

Stored in $DSH_HOME/auth.json (default ~/.dsh/auth.json):

• Password: scrypt salted hash (node:crypto, zero runtime dependencies),
  AES-256-GCM encrypted at rest. The key lives in $DSH_HOME/auth.key
  (mode 0600, local only; losing it requires dsh web p to reset). Legacy
  plaintext data auto-migrates to ciphertext on the next save.
• Login history: last successful logins (IP, time, GeoIP location; up to 50),
  saved in loginHistory and shown under Settings > Auth.
• Sessions: random tokens + HttpOnly/SameSite cookies; idle timeout and
  max-age expiry are enforced; password/username changes and single sign-on
  invalidate other sessions and notify the kicked clients; the idle activity
  timestamp is throttled-persisted so idle timers survive process restarts
• Username: default admin; change via CLI or the settings UI

Development

npm test        # node:test unit tests

Security notes

• Auth protects the whole web surface (HTTP/API/WebSocket upgrades pass the gateway)
• Change the initial password after first login; use HTTPS in production