> **Multi-Channel Remote Access & Comprehensive Security Gateway Plugin for DeepSeek Harness**
>
> Scan a QR code on your phone to continue using DeepSeek Harness anywhere. Whether relaxing on the sofa, commuting, or working across networks—no need to stay at your PC or set up complex servers.
>
> Seamlessly extends your local DeepSeek Harness instance to mobile web, standalone PWA app, secure public tunnels, and **WeChat / QQ / Feishu / Telegram** bot matrix. Drive AI coding, run tasks, approve operations, and manage workspaces anytime, anywhere.
---
## Table of Contents
- [✨ Key Features](#-key-features)
- [📦 Requirements & Installation](#-requirements--installation)
- [🚀 Core Features & Usage Guide](#-core-features--usage-guide)
- [1. 🛜 LAN Access & Multi-NIC Smart Selection](#1-🛜-lan-access--multi-nic-smart-selection)
- [2. 🌐 Public Tunnels (Cloudflare & Custom)](#2-🌐-public-tunnels-cloudflare--custom)
- [3. 📱 Mobile Experience & Standalone PWA](#3-📱-mobile-experience--standalone-pwa)
- [4. 🗂️ Web Remote Workspace Directory Picker](#4-🗂️-web-remote-workspace-directory-picker)
- [5. 🔐 Comprehensive Access Security & Admin Lock](#5-🔐-comprehensive-access-security--admin-lock)
- [6. 🤖 All-in-One IM Bot Matrix (WeChat / QQ / Feishu / Telegram)](#6-🤖-all-in-one-im-bot-matrix-wechat--qq--feishu--telegram)
- [7. 📊 Maintenance Dashboard & Graceful Restart](#7-📊-maintenance-dashboard--graceful-restart)
- [💬 FAQ](#-faq)
- [🛠️ Development & Contribution](#️-development--contribution)
- [⭐ Star History](#-star-history)
- [📄 License](#-license)
---
## ✨ Key Features
- **🛜 Multi-NIC Smart Detection & Switching**: Automatically detects physical Wi-Fi, Ethernet, and virtual NICs (WSL/VMware/Docker); provides visual switching with persistent memory;
- **🌐 Dual-Mode Cloudflare Public Tunnels**: Zero-login 1-click random temporary domains or Cloudflare Named Tunnel Token with auto-start on boot;
- **📱 Native-Grade Mobile UI & PWA**: Centered session header, native drawer sidebar with `[|` fold icon, anti-overlap responsive layout, PWA install support;
- **🗂️ Web Remote Workspace Directory Picker**: Mobile/remote visits pop up responsive tree directory browser; localhost visits route to OS native dialogs; supports `/addworkspace` IM command;
- **🔐 Comprehensive Access Security & Dual Defenses**: QR code secret Token login, visitor password gate, independent admin anti-tamper lock; host physical privilege (`127.0.0.1`) & emergency terminal reset (`reset-auth`);
- **🤖 All-in-One IM Bot Matrix (WeChat / QQ / Feishu / Telegram)**: Multi-workspace dispatching, cross-restart session persistence, streaming Markdown typewriter, Card 2.0 interactive approvals, and bidirectional file sharing;
- **📊 Maintenance & Smooth Upgrades**: Host CPU / RAM / Uptime metrics, 1-click network diagnosis, JSON configuration backup & restore, npmmirror fast check & graceful restart.
---
## 📦 Requirements & Installation
### Requirements
1. **Node.js ≥ 22** (DSH requires `^22.19.0` or `≥ 24.0.0`)
2. **dsh CLI available** (runnable directly in terminal)
```bash
# Verify environment
node -v # v22.19+ or v24+
dsh --version
```
### DSH version compatibility
This plugin supports **both old and new DSH releases** — there is no need to pick a plugin version to match your harness.
| DSH version | Status |
| --- | --- |
| `0.1.0` ~ `0.1.1` | ✅ Supported (loopback-only RPC channel hardening) |
| `0.1.2` ~ `0.1.4` | ✅ Supported |
| `0.1.5-alpha.1` ~ `0.1.5-rc.2` | ✅ Supported (since v2.10.9) |
> **About the built-in DSH authentication**: since `0.1.2`, `dsh web` ships browser authentication — it prints a URL carrying a one-time token (`http://127.0.0.1:3080/?token=…`), which is exchanged for a session cookie bound to the loopback address. Afterwards `/`, `/api` and every plugin RPC channel require that cookie.
>
> This is **complementary to, not a duplicate of**, this plugin's access-password gate: the built-in auth protects "the DSH process on local loopback", while this plugin's gate protects "remote access arriving over LAN or a public tunnel". The plugin's reverse proxy injects a valid loopback session cookie while forwarding, so phone / tunnel access needs **no** manual handling of DSH's `?token=` — just use it as documented on this page.
### Installation
```bash
# Method 1: Install from npm (Recommended)
dsh plugin --profile web add @wenbin_wb/dsh-bridge
# Method 2: Global-permission-free npx installation
npx --yes @deepseek-ai/dsh plugin --profile web add @wenbin_wb/dsh-bridge
# Method 3: Install from source
git clone https://github.com/wenbin-wb/dsh-bridge.git
dsh plugin --profile web add ./dsh-bridge
```
### Upgrade
```bash
# Recommended: Click "🚀 1-Click Upgrade & Restart" in Web Settings > Remote Access
# Or force install latest version via CLI:
dsh plugin --profile web add @wenbin_wb/dsh-bridge@latest
```
---
## 🚀 Core Features & Usage Guide
Launch DeepSeek Harness, open Settings in the left sidebar, and click **"Remote Access"**:
---
### 1. 🛜 LAN Access & Multi-NIC Smart Selection
Starts **automatically with DSH service**, zero configuration required.
* **Instant QR Code Scan**: Connect phone and PC to the same Wi-Fi, scan the QR code with phone camera to access mobile web UI;
* **Multi-NIC Detection & Switching**: Automatically detects multiple network interfaces (physical Wi-Fi, Ethernet, WSL, VMware, Docker) and presents **"🛜 Network Interface / IP Selection"** dropdown; instantly regenerates QR codes upon selection and **persists choice across restarts**.
---
### 2. 🌐 Public Tunnels (Cloudflare & Custom)
Access DeepSeek Harness from anywhere outside your home network without public IP or router port forwarding:
- **Mode 1: Zero-Login Temporary Tunnel (Default)**:
- Click "Start"; automatically prepares `cloudflared` binary with permission self-healing;
- Instantly generates `https://*.trycloudflare.com` URL and QR code.
- **Mode 2: Cloudflare Token Fixed Domain (Permanent · Free)**:
- Create a Tunnel in [Cloudflare Zero Trust Console](https://one.dash.cloudflare.com/) and bind your custom domain;
- Enter Tunnel Token & hostname in Advanced Settings, enable **"Auto-start with DSH"** for permanent fixed URL!
- **Mode 3: Custom WebSocket Tunnel**:
- Connect to your personal VPS reverse proxy server ([View Setup Guide](docs/custom-tunnel.md)), equipped with per-message gzip and SSE optimization.
> **Custom tunnel security note**: The tunnel server (`scripts/install-tunnel-server.sh`) only authenticates the *tunnel client control channel* with `TOKEN`; public HTTP/WebSocket requests forwarded through the tunnel domain are **not independently authenticated** — security relies entirely on the plugin's local Access Auth (the `x-dsh-internal-tunnel` marker prevents tunnel traffic from using the loopback exemption). Always enable **Access Auth** with a password/QR Token in the plugin settings (especially with `scope=all` or when exposed publicly); with no password set, anyone who knows the tunnel URL can reach your DSH.
---
### 3. 📱 Mobile Experience & Standalone PWA
Deeply optimized for mobile screens and touch interactions:
- **Clean Top Header**: Retains left drawer and right new session button, with centered dynamic session title;
- **Native Sidebar Drawer**: Full DSH history & workspace grouping with native `[|` fold icon and swipe gestures;
- **Standalone PWA Support**: Click "Add to Home Screen" in mobile browser to run as a 100% standalone fullscreen app;
- **Anti-Overlap Responsive Layout**: Bottom toolbar adapts to screen width, preventing button collision.
#### Mobile Chat & Workspace Experience
#### Remote Settings Center on Mobile
---
### 4. 🗂️ Web Remote Workspace Directory Picker
Solves the pain point of mobile browsers being unable to trigger PC native folder dialogs:
* **Smart Routing**: PC localhost visits (`127.0.0.1`) invoke OS native file dialogs; mobile/remote visits pop up responsive bottom directory browser;
* **Quick Access**: 1-click access to Windows drives (C:, D:) and standard system folders (Desktop, Documents, Downloads, Projects).
---
### 5. 🔐 Comprehensive Access Security & Admin Lock
Open **"Security"** tab to establish bank-grade protection for your local development environment:
#### 1. 🛡️ Line 1: External Access Gateway
- **QR Token Passwordless + Password Verification**: QR codes carry 256-bit encrypted Token for instant access; manual IP/domain visits require password;
- **Channel Isolation**: Choose between "All Channels / Public Tunnels Only (LAN Passwordless) / LAN Only".
📱 Click to view Remote Access Login Page
#### 2. 🔒 Line 2: Admin Console Anti-Tamper Lock
- **Independent Admin Password**: Remote devices enter locked console, requiring admin password to view or modify tokens and bot configs;
- **Strict Host Policy**: Option to restrict management solely to host machine (`127.0.0.1`).
🖥️ Click to view Admin Console Lock Screen
#### 3. 🛟 Triple Disaster Recovery (Never Locked Out)
- **Host Physical Privilege**: PC localhost (`127.0.0.1`) enjoys permanent highest privilege, never locked;
- **Terminal Emergency Reset**: Run `touch ~/.dsh/dsh-bridge/reset-auth` in terminal to reset passwords instantly;
- **Interactive Guidance**: Built-in interactive recovery guides on all auth pages.
---
### 6. 🤖 All-in-One IM Bot Matrix (WeChat / QQ / Feishu / Telegram)
Interact with local AI agents directly inside your favorite messaging apps without opening a browser:
---
#### 🟢 WeChat Bot (ClawBot / iLink)
Scan QR code with personal WeChat account to chat, manage sessions, and approve permissions via official Tencent servers without public IP.
📱 Click to view WeChat Chat & Approval
* **Quick Setup**: Remote Access > IM Bot > WeChat > Scan QR code > Send first message to auto-authorize. See [WeChat Guide](docs/wechat-usage.md).
---
#### 🐧 QQ Bot (OpenAPI v2)
Official QQ Bot with direct/group @chat, Markdown rendering, interactive button keyboards, and rich media transfers.
📱 Click to view QQ Direct & Group Chat
* **Quick Setup**: Create bot on [QQ Open Platform](https://q.qq.com), fill AppID & Secret > Send first message to auto-authorize. See [QQ Guide](docs/qq-usage.md).
---
#### 🐦 Feishu (Lark) Bot (WebSocket 2.0)
Enterprise self-built app via official full-duplex WebSocket long connection—**100% No Public IP / No Webhook required**.
📱 Click to view Feishu Chat & Card Approval
* **Quick Setup**: Create self-built app on [Feishu Open Platform](https://open.feishu.cn/app), enable long connection > Fill App ID & Secret. See [Feishu Guide](docs/feishu-usage.md).
---
#### ✈️ Telegram Bot (Bot API + Proxy Support)
Official Telegram Bot API with Long Polling and **built-in zero-dependency HTTP/HTTPS proxy tunnel**.
* **Quick Setup**: Create bot with [@BotFather](https://t.me/BotFather) > Fill Bot Token (and optional proxy) > Send first message to auto-authorize. See [Telegram Guide](docs/telegram-usage.md).
---
#### Standardized IM Commands
| Command | Description |
| :--- | :--- |
| *(Direct Text)* | Drives current active agent to think and code |
| `/sessions` (or `/list`) | List all sessions grouped by workspace |
| `/use N` (or `/resume N`) | Switch context to session number N |
| `/rename ` | Rename active session title |
| `/workspaces` | List all registered workspaces in DSH |
| `/addworkspace ` | Remotely register a local project folder |
| `/new ` | Start a new session in current workspace |
| `/new @N` | Start a new session in workspace N |
| `/stop` | Immediately abort current running task |
| `/end` | End and suspend active session |
| `/yes` / `/no` (or `1`/`2`) | Respond to sensitive operation permission approvals |
| `/status` | View agent status and system summary |
| `/help` | View full command and shortcut button help |
---
### 7. 📊 Maintenance Dashboard & Graceful Restart
Open **"Maintenance"** tab to monitor health and manage operations:
