dsh-secure-context-fix
Fix the DeepSeek Harness Web GUI over plain HTTP on a LAN (e.g. from a phone).
Problem
crypto.randomUUID only exists in secure contexts (HTTPS or localhost).
When you open the dsh Web GUI from another device over plain HTTP on your LAN
(http://192.168.x.x:3080), the browser has no crypto.randomUUID, so every
RPC crashes with:
crypto.randomUUID is not a function
Symptoms: workspace list never loads, the directory picker fails, sessions
cannot be created — while http://127.0.0.1:3080 works fine on the same
machine.
How this plugin fixes it
This plugin is a small host plugin that registers a webServer.tapIndex
transform. When the GUI serves its index.html, the plugin injects a tiny
inline <script> into <head> that installs a crypto.randomUUID
implementation backed by crypto.getRandomValues() — which browsers do
expose on insecure origins — before any dsh bundle code runs.
No official source changes, no polyfill library, no build step for users.
Install
From the directory containing this package (after cloning):
dsh plugin --profile web add ./dsh-secure-context-fix
Or from a git host:
dsh plugin --profile web add github:<you>/dsh-secure-context-fix
Then restart the profile:
dsh --profile web
First
addfrom a git host may ask you to allow the package's build (allowBuilds) if apreparescript is present; this package ships no build step and plain JS, so no allowance is needed.
How to check it works
Serve the GUI on all interfaces so a phone can reach it. The dsh CLI rejects
--host 0.0.0.0for safety, so patch thewebserverrow in the profile instead:# $DSH_HOME/profiles/web/cordis.patch.yml - id: webserver config: host: '0.0.0.0' port: !!js ctx.webStartup.port ?? 3080Allow inbound TCP 3080 in the firewall, ideally restricted to your LAN subnet:
New-NetFirewallRule -DisplayName "dsh web 3080 (LAN)" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow -Profile Private -RemoteAddress 192.168.0.0/24On the phone (same Wi-Fi) open
http://<your-LAN-IP>:3080. Workspace list, directory picker, and new sessions should now work.
Files
index.js— the plugin entry (name,inject,apply).cordis.patch.yml— the bundle layer inserting the plugin row.package.json— npm manifest declaringdsh.bundle.
Security notes
Binding the GUI to 0.0.0.0 exposes remote-code-execution-grade control of
the agent to anyone who can reach the port. Only do this on a trusted network,
and prefer restricting the firewall rule to your LAN subnet as shown above.
Upstream
This is a stop-gap for
deepseek-ai/deepseek-harness discussions #4209
until the official repo replaces its three crypto.randomUUID() call sites
(AbstractApiClient.mintRpcId, ui-conversation image draft ids, and
llm createMessage) with getRandomValues()-based UUIDs. If you can patch
the source, do that instead; this plugin helps users who cannot.
No comments yet. Be the first to write one.