dsh-plugin-remote

Remote access gateway for the DeepSeek Harness (DSH) Web GUI — login auth + HTTP/WebSocket reverse proxy to the loopback DSH server.

中文 · MIT

Install

dsh plugin --profile web add dsh-plugin-remote && dsh web

Note: this is a DSH (DeepSeek Harness) plugin — install it into a profile through dsh plugin (or the profile's dependencies) so the gateway activates; a plain npm i alone does not wire it in.

Screenshots

Login	Main view (对话 / 轨迹 / 远程访问 tabs)

Remote desktop tab	Settings → Remote Access

Features

• Login-gated remote access: scrypt credentials + HttpOnly session cookie; HTTP/WebSocket reverse proxy with Host/Origin rewriting — no --trusted-host needed
• White-themed login page (shadcn/ui, mobile-friendly) with the DeepSeek Harness brand
• Gateway admin API (/admin/*, session-required), managed in the
  Settings → 远程访问 section:
  • Remote-access whitelist (IP / CIDR; loopback always allowed; hot-reloaded)
  • Account password changes (old sessions revoked immediately)
  • Request log: every request persisted to per-day JSONL shards, download + 1/3/7-day retention rules
• Localized zh/en, follows the GUI language
• Zero-install Windows desktop projection: the plugin starts its bundled
  x64 native helper automatically; no .NET, FFmpeg, driver, or separate agent
  installation is required
• Interactive remote desktop as a dedicated 远程访问 tab in the
  conversation view ring (next to 对话/轨迹), projecting the Windows desktop
  full-width with pointer input, keyboard input, and
  weak-network/balanced/sharp quality profiles. The primary WAN transport is
  WebRTC with independent lossy frame/pointer channels and a reliable control
  channel; the original WebSocket viewer remains an automatic fallback
• The gateway keeps its custom HTTP/WebSocket plumbing on Node built-ins; the
  optional native node-datachannel package provides the WebRTC fast path and
  the Next.js login app lives inside gateway/

Usage

• Open http://<server-ip>:4080 — the first visit creates the only account
• Manage accounts: node lib/remote-passwd.mjs add|set-password|list|del <username>
• Data lives under $DSH_HOME/plugin-data/dsh-plugin-remote/ (users.json, whitelist.json, logs/)

Windows desktop

On Windows 10/11 x64, the plugin launches native/windows-x64/dsh-remote-host.exe
after the gateway becomes ready. It connects back with a random process-local
authentication token that is never written to disk. Only logged-in gateway
users can open the viewer/control channel.

The current Windows helper source has two video paths. After native:build,
the primary path captures BGRA frames, encodes H.264 through Media Foundation,
and sends one access unit into a real WebRTC H.264/RTP track. The browser and
libdatachannel then use the media transport's pacing, congestion feedback,
NACKs, and keyframe requests instead of putting every full frame into a TCP
queue. During startup or when H.264 cannot be decoded, the gateway keeps the
JPEG DataChannel path alive and switches to it automatically; the authenticated
WebSocket viewer is the final compatibility fallback. The package prefers the
dsh-remote-host-h264.exe binary when present and keeps the old exe as a legacy
fallback; npm run native:build refreshes both copies.

Pointer motion and wheel events use a disposable low-latency channel, while
keyboard, button transitions, ACKs, and input-reset messages remain ordered and
reliable. This prevents stale video from blocking new input on a weak link.

For clients behind symmetric NAT or UDP-restricted networks, configure a TURN
server in the plugin row. The values use the browser RTCConfiguration shape:

{
  rtcIceServers: [
    'stun:stun.example.net:3478',
    { urls: 'turns:turn.example.net:5349', username: 'user', credential: 'secret' },
  ],
}

STUN is useful for direct paths; TURN is the reliable relay fallback. Keep the
WebSocket fallback enabled when deploying in environments where UDP policy is
unknown.

Windows secure desktops (UAC prompts, sign-in, and locked sessions) cannot be
captured or controlled. Set config.desktop: false to disable projection.

Development verification

npm run native:build
npm run gateway:build
npm run test:desktop

License

MIT