📦 @goodandready/dsh-lanmode

---

⚡ Overview & Features

dsh-lanmode brings seamless and secure local network (LAN) and WAN remote access to DeepSeek Harness:

1. 📱 Quick QR Popover: Tap the smartphone icon in the sidebar footer (Quick QR in sidebar.footer / sidebar.rail) to open an interactive SVG QR code. Supports the /mobileqr chat tool and ASCII QR output.
2. 📲 PWA & Standalone Mode: Serves /dsh-lanmode/manifest.json with viewport-fit=cover for full-screen mobile experience.
3. 🌐 Automatic mDNS (dsh.local): Built-in UDP 5353 responder announces dsh.local across the LAN automatically.
4. 🔐 Local Root CA & HTTPS: Generates a 10-year Root CA and trusted SAN certificates (dsh.local, LAN IP, localhost). One-click download via /dsh-lanmode/ca.crt.
5. 🔔 Background Web Push & Notifications API: Delivers system push notifications on agent turn end and approval requests.
6. 🛡️ Comprehensive Security & Authentication:
   • Authentication passwords support plaintext and scrypt key derivation. Verified in constant time via timingSafeEqual.
   • LAN PIN protection with plaintext or PBKDF2 stretching (pbkdf2$sha512$100000$salt$hash). Auto-lockout for 15 minutes after 5 consecutive failures.
   • Device and session tokens stored exclusively as salted SHA-256 digests.
   • Subnet role separation (adminAllow and guestAllow). Guest subnets cannot mutate settings or revoke sessions.
7. ☁️ Cloudflare WAN Tunnels & Tailscale Funnel:
   • Supports zero-config Quick Tunnels (trycloudflare.com) and persistent Named Tunnels via token (passed securely via TUNNEL_TOKEN env, hidden from ps aux).
   • The tunnelPin option enforces LAN PIN verification for all requests arriving over WAN tunnels.
   • 1-click Tailscale Funnel integration providing public HTTPS with automated trusted Let's Encrypt certificates.
8. 📱 Device Registry & Session Revocation: Track connected devices and revoke active sessions individually or all-at-once.

---

📦 Installation

dsh plugin --profile web add @goodandready/dsh-lanmode

---

⚙️ Configuration (cordis.patch.yml)

- id: dsh-lanmode
  config:
    mode: direct
    directPort: 3080
    tunnel: off              # off, quick, or named
    tunnelPin: true
    tailscaleFunnel: false
    passwordAuth: false

---

📄 License

MIT © GooDAnDReaDY