# dsh-mobile-access > A PIN-protected, chat-only mobile web client for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH), served on an isolated port over your LAN or a self-provided tunnel — without ever exposing the desktop web surface. [English](./README.md) · [中文](./README.zh-CN.md) [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE) [![node: >=20](https://img.shields.io/badge/node-%3E%3D20-green.svg)](./package.json) [![dsh-plugin](https://img.shields.io/badge/dsh-plugin-remote-8b5cf6.svg)](https://github.com/topics/dsh-plugin) --- ## What it does DSH's web UI binds to `127.0.0.1` for good reason — it exposes files, terminals and settings, so opening it to the network means opening all of that. This plugin keeps that desktop surface untouched and instead runs its own, deliberately narrow HTTP listener that only ever offers **chat**: view sessions, keep talking, and see the same stats the desktop shows. Access it from your phone on the same Wi-Fi, or through a tunnel when you are away. ## Features ### Mobile client (`/m/`) - **PIN login** → workspace-grouped session list → live chat. - **Streaming replies** with tool-call steps rendered inline. - **Per-session model and permission-preset switching**, without leaving the chat. - **Session stats matching desktop** — turns, steps, LLM time, tokens, and cost. - **Round navigation rail** — jump to any turn, with a hover preview and auto-loading of older history. - **Pagination** (load older), **light/dark theme** (light by default), and **toasts**. ### Desktop settings page A standard DSH settings card, reachable from the desktop UI: - Master switch, port, network mode (`lan` / `tunnel` / `both`), tunnel host, and idle timeout. - Set or reset the PIN (with show/hide), scan a QR code to connect a phone, revoke sessions, review login history, and follow tunnel tutorials (Tailscale / cloudflared / cpolar). ### Security - **Off by default**; loopback-only until a PIN is set, so the surface cannot be reached before it is configured. - **PIN**: 8 digits, weak PINs rejected, stored as scrypt (`N=2^14, r=8, p=1`) with a random salt, compared in constant time. - **Tokens**: 256-bit random values; only `sha256(token)` is persisted; 7-day expiry plus an idle timeout (default 60 min). - **Brute-force protection**: 6 login attempts per IP per minute; 5 failures lock the IP out for 15 minutes, doubling on repeat (persisted). - **Host allowlist** on the isolated listener; **CSRF protection** on every write request. - The desktop web surface stays loopback-only — no `--host 0.0.0.0`, no changes to DSH's own trust boundary. ## Architecture ``` ┌─────────────────────────── DSH host (loopback only) ───────────────────────────┐ │ desktop web UI (127.0.0.1:3080) ← unchanged, never exposed │ │ dsh-mobile-access host plugin │ │ settings · sessionQuery · agents · apiProxy · permissionPresets · ... │ └──────────────────────────────────────┬─────────────────────────────────────────┘ │ in-process service calls ┌──────────────────────────────────────▼─────────────────────────────────────────┐ │ isolated HTTP listener (0.0.0.0:3081 for LAN, 127.0.0.1 for tunnel) │ │ PIN auth · host allowlist · CSRF · SSE │ │ /m/ mobile SPA (preact, served statically) │ │ /m/api/* chat / sessions / stats / models / permissions │ │ /m/api/admin/* loopback-only admin (PIN, sessions, login history) │ └────────────────────────────────────────────────────────────────────────────────┘ ▲ LAN (HTTP) or tunnel (Tailscale / cloudflared / cpolar, HTTPS) │ 📱 phone browser ``` The plugin bridges to DSH's own host services (`sessionQuery`, `agents`, `apiProxy`, `permissionPresets`, `sessionProjections`, …) in-process. It does not re-implement DSH; it exposes a small, curated slice of it. ## Requirements - DeepSeek Harness `0.1.1-rc.2` (the `@deepseek-ai/*` packages are declared as `peerDependencies`). - Node.js ≥ 20. ## Installation The repository ships prebuilt `lib/` and `dist-webapp/`, so a Git install works without a build step: ```sh dsh plugin --profile web add github:huanlanmie/dsh-mobile-access ``` Restart `dsh web`. A **Mobile access** card appears in the desktop settings — use it to set the PIN, enable the surface, and scan the QR code. Until a PIN is set, the surface stays loopback-only. > Local development install: `dsh plugin --profile web add link:` (or `./dsh-mobile-access` from the checkout's parent directory). ## Quick start 1. On the host machine, open the desktop web UI's **Mobile access** settings card and set an 8-digit PIN. 2. Enable the surface and pick a mode: - **`lan`** — the listener binds `0.0.0.0`; scan the QR code on your phone over the same Wi-Fi. - **`tunnel`** — fill in your tunnel authority (see below) and reach it over HTTPS. - **`both`** — LAN for home, tunnel for away. 3. On the phone, open `/m/`, enter the PIN, and continue your sessions. ### Tunnels | Provider | What to put in **tunnel host** | Notes | | --- | --- | --- | | Tailscale | `mypc.tail12345.ts.net` | tailnet traffic is already encrypted; recommended. | | cloudflared | the temporary `*.trycloudflare.com` host | HTTPS terminated at Cloudflare, forwarded locally. | | cpolar | the assigned `*.cpolar.top` / `*.cpolar.io` host | HTTPS tunnel; keep the token in `.cpolar/`. | ## Configuration | Key | Type | Default | Description | | --- | --- | --- | --- | | `enabled` | boolean | `false` | Master switch. Disabled = no listener at all. | | `port` | number | `3081` | Port of the plugin's isolated HTTP surface (1024–65535). | | `mode` | `lan` \| `tunnel` \| `both` | `lan` | Which networks may reach the surface. | | `tunnelHost` | string | `""` | Tunnel authority (hostname) served over HTTPS. | | `idleTimeoutMin` | number | `60` | Session idle timeout in minutes (5–10080). | These are DSH settings under the `mobile-access` namespace; they can be edited from the desktop settings card. ## Security notes - **LAN mode is plaintext HTTP.** The PIN and bearer token can be sniffed by anyone on the same network. Use it only on a network you trust; use a tunnel for anything else. - Setting or resetting the PIN revokes all existing sessions. - This is third-party code, not part of DSH. Review the source before installing it on a machine that hosts your sessions. ## Development ```sh npm install npm run build # esbuild bundles the mobile SPA + desktop client, then tsc compiles the host npm test # node:test — PIN format, token hashing, lockout, host allowlist npm run typecheck # tsc --noEmit ``` Layout: ``` src/ host plugin (TypeScript): auth, server, settings, storage, net (allowlist/URLs), mux (question/approval bridge), API routes src/client/ desktop settings section (React) webapp/src/ mobile SPA (preact): main.tsx, api.ts, styles.css scripts/ build-webapp.mjs (esbuild + client-bundle envelope) test/ node:test suites ``` Prebuilt `lib/` and `dist-webapp/` are committed so Git installs need no build step; they are regenerated by `npm run build`. ## Screenshots ## License [MIT](./LICENSE)