dsh-share-webui

English | 中文

Share this harness instance's Web GUI over a stable address. The plugin runs a fixed-port forwarder inside the Host process, so a bookmark or phone keeps working even though the harness port and launch token change on every restart.

• Loopback is always served (http://127.0.0.1:47524), one listener per selected host — LAN and Tailscale addresses are opt-in.
• Fully open is possible but guarded: disabling the Host check requires an explicit confirmation in the settings page and logs a warning on every start.
• Switch hosts live from Settings → Web sharing; the choice is persisted and applied without restarting the harness.
• Works in both the Desktop and dsh web profiles.

Why

dsh web and the Desktop shell mint a random port and a one-shot launch token on every start. The printed URL therefore changes constantly, which makes it useless for bookmarks, home-screen shortcuts, or a phone. This plugin keeps the address stable and performs the token handshake internally.

Install

# from GitHub
dsh plugin --profile desktop add github:vantoo/dsh-share-webui

# or from a local checkout (development)
dsh plugin --profile desktop add link:/absolute/path/to/dsh-share-webui

Restart the app after installing. For the web profile use --profile web instead.

Usage

Open Settings → Web sharing:

Row	What it does
Allowed hosts	Appearance-style cubes showing the address and name: this machine (127.0.0.1, always on), LAN (192.168.x.x), Tailscale (100.x.x.x), Any host (0.0.0.0, dangerous). Multi-select; changing them rebinds the forwarder immediately.
Host	Which hostname the fixed entry uses; the dropdown lists only selected hosts.
Fixed entry	Stable URL, copy button.
Session link	Tokenized URL for this session, copy button.

The selection is persisted to $DSH_HOME/share-webui.json, so it survives restarts; the hosts config below only seeds the first run.

Configuration

Optional — the settings page covers normal use. In the profile's cordis.patch.yml:

- id: share-webui
  name: dsh-share-webui
  config:
    fixedPort: 47524        # 0 disables the fixed entry entirely
    fixedHost: 127.0.0.1    # force one bind interface instead of per-host
    hosts:                  # initial defaults when no persisted selection exists
      - loopback
      - tailscale

hosts accepts the keywords loopback, lan, tailscale, any (and *), plus literal host names. The bind interface is derived per selection: loopback only → 127.0.0.1, otherwise one listener per concrete IPv4, and 0.0.0.0 only for any.

Security

• The fixed entry carries an already authenticated session: whoever can reach the port controls this harness (tools, files, everything).
• LAN access has no extra password. Prefer Tailscale (device-authenticated) or loopback when you are not on a trusted network.
• Any host skips the inbound Host allow-list. It is off by default and asks for confirmation; treat it as remote code execution exposure.

How it works

The forwarder calls connection.authenticatedUrl(loopback) in-process — the same API dsh web uses to build the URL it prints — performs the normal ?token= exchange, and keeps the resulting dsh-auth-* cookie in memory. Browsers only ever talk to the fixed port: the proxy rewrites Host/Origin to the harness authority, swaps in the held cookie, strips Set-Cookie, and forwards WebSocket upgrades (/api/remote.mux). A 401 triggers one re-handshake and a replay.

Development

lib/ is the built artifact that DSH loads; src/ is the TypeScript source. The bundle was produced with the harness monorepo's tsdown preset, so rebuilding requires checking this package into deepseek-harness under packages/client/ and running:

pnpm --filter dsh-share-webui typecheck
pnpm --filter dsh-share-webui bundle

Editing lib/index.js or lib/client.js directly also works for quick iteration (restart the app afterwards).

License

MIT © 2026 vantoo.