dsh-inline-media-viewer

Inline image, video, and audio previews for DeepSeek Harness Web

English · 简体中文

Turn media paths and URLs mentioned in a DSH conversation into secure inline
previews—without copying them out of the chat log.

https://…/view?filename=frame.png  →  <img>
exports/demo.mp4                   →  <video controls>
audio/sound.mp3                    →  <audio controls>

Contents

• Features
• Supported media
• Installation
• Configuration
• Security
• Development
• License

Features

[!NOTE]
ComfyUI is not required. Workspace files and regular HTTP(S) media URLs work
when ComfyUI is not installed or running; its proxy is activated only for
recognized ComfyUI URLs.

Supported media

Installation

From npm

Install and activate the bundle in your Web profile:

dsh plugin --profile web add @wisdoverse/dsh-inline-media-viewer

Restart the Web profile after installation.

From source

1. Clone the plugin into a location available to your Web profile:

   git clone https://github.com/Wisdoverse/dsh-inline-media-viewer-plugin.git \
    /path/to/local-plugins/dsh-inline-media-viewer

2. Add the bundle to profiles/web/package.json:

   {
    "dependencies": {
      "@wisdoverse/dsh-inline-media-viewer": "link:/path/to/local-plugins/dsh-inline-media-viewer"
    },
    "dsh": {
      "profile": {
        "bundles": ["…", "@wisdoverse/dsh-inline-media-viewer"]
      }
    }
   }

3. Rebuild or restart the Web profile.

The plugin mounts its host RPC channel, client projection, and settings section
through cordis.patch.yml.

Configuration

Open Settings → 媒体预览 / Media preview.

The navigation label and all setting copy follow DSH's active UI language and
switch live between English and Chinese.

Settings are stored in the DSH settings document. Writes are available only on
loopback connections; remote browsers can read settings but cannot persist
changes.

ComfyUI origin

• Skip this setting entirely if you do not use ComfyUI.
• Leave the field empty to use http://127.0.0.1:8188.
• Accepted forms are http://host[:port], https://host[:port], and bare
  host[:port] (http is assumed).
• The default port is 8188 for HTTP and 443 for HTTPS.
• Credentials, paths, query strings, and fragments are rejected.
• The origin must be reachable from the DSH host process. For a containerized
  host, use the address visible from inside the container.

Local aliases (127.0.0.1:8188 and localhost:8188) and the configured origin
are recognized as ComfyUI sources. A non-empty invalid address fails explicitly
instead of silently falling back to another target.

Security

The plugin is designed as a local trust helper, not a general-purpose file or
network proxy:

• Local reads are confined to the active session's workspace and known media
  extensions.
• Remote reads can target only the configured ComfyUI origin; redirects are
  refused.
• Local files and remote responses are capped at 48 MiB.
• Settings writes are restricted to loopback connections.
• The browser receives media as data: URLs rather than filesystem paths.

See SECURITY.md for the complete trust model and known
limitations.

Development

Commands

Project structure

The running Web profile serves a bundled copy. Rebuild or restart it after
changing the source files.

License

Released under the MIT License.