DSH Remote

Independent, mobile-first PWA for controlling the DSH instance already running on your computer. It does not start a second DSH and it does not publish DSH's native API.

phone /m PWA -> your HTTPS identity gate -> loopback DSH plugin -> ctx.apiProxy

The first release supports session browsing, bounded history, text queue/steer, stop, allow-once/reject approvals, structured questions, pairing, revocation, and an optional Cloudflare setup wizard.

Install

Requirements: DSH 0.1.0-rc.7 or newer compatible 0.1.x, Node.js 22+, and a DSH profile whose web server remains bound to 127.0.0.1.

dsh plugin --profile web add @ruby1304/dsh-remote

Restart that DSH profile, then open the local control page:

http://127.0.0.1:3080/remote/

If the profile uses another port, set localDshOrigin in the plugin config. You may configure publicBaseUrl manually, or run the local HTTPS wizard.

Cloudflare wizard

The wizard uses an already installed cloudflared; it never downloads a binary, invokes a package manager, changes DSH trusted hosts, or stores an API Token. On macOS it can create an exact launchd job. Other systems receive the generated config and exact command for their own service manager.

It requires a scoped Cloudflare API Token with:

• Account: Cloudflare Tunnel Write
• Account: Access Apps and Policies Write
• Account: Access Organizations, Identity Providers, and Groups Write
• Zone: Zone Read
• Zone: DNS Write

The UI performs preflight, shows the plan, requires exact-hostname confirmation, writes durable ownership records, verifies the Access challenge, and can roll back only unchanged resources proven to be wizard-owned. An OTP identity provider is account-global and is always retained.

For a full Cloudflare DNS setup, the one-click path requires a direct child of the active zone, such as dsh.example.com. Deeper names require Total TLS or an advanced/custom certificate and belong in the manual path.

See Cloudflare deployment, the security model, and uninstall.

Tailscale is optional, not a second mandatory gate. Owners who require no public edge entry point may use a tailnet-only HTTPS reverse proxy instead of Cloudflare Access, while retaining the plugin's pairing and /m-only rules. That deployment is manual in v0.1.

Manual configuration

Start from plugin.example.yml and cloudflared.named.example.yml. Your public proxy must expose only /m and descendants, end in a 404 rule, and preserve the public Host header. Never add the public hostname to DSH trusted-host.

Development and release checks

pnpm install
pnpm check
pnpm release:check

The repository has independent history and does not contain another remote plugin's source, assets, prose, tests, generated output, or commit history. See clean-room provenance.

中文说明

这个插件连接的是电脑上已经在跑的那套 DSH，不会再启动第二套。手机只能 访问 /m 下的窄接口，不能透传原生 /api。电脑在本地页面生成一次性配对 链接；Cloudflare Access 先做邮箱 OTP，插件再校验设备凭证。

安装后在 http://127.0.0.1:3080/remote/ 运行向导：先检查，再看变更清单， 输入完整域名确认，最后等待 60–90 秒验证。API Token 只在当前请求内使用； 如果本机配置了 Keychain 项，向导也可以每次临时读取，但不会把 Token 放进 仓库、浏览器存储、日志或安装包。

License

Apache-2.0. See LICENSE and NOTICE.

DeepSeek Harness and related package names belong to their respective owners. This is an independent community project with no implied affiliation.