king-bcolor/dsh-multi-tenant-projects

README excerpt

dsh-multi-tenant-projects 简体中文 English Multi-tenant "Projects & Users" for a single DeepSeek Harness (DSH) instance: bind real workspace directories to projects , hand out per-user symlinked workspaces inside each project, and gate the Web UI behind password login — so several people can share one DSH deployment without seeing each other's sessions or files. Threat model — read this first. This plugin is a soft boundary, not a hard security perimeter. The cwd filter is a query projection, browser tokens can be forged by a technical user, and the agent-layer isolation is prompt-level. For anything exposed to the public internet, put a real boundary (reverse-proxy auth, ngrok basic auth, VPN…) in front of DSH and treat this plugin as convenience isolation between trusted-ish teammates. Features - Projects bound to real directories (auto-created, or bind an existing workspace path via the host-native directory picker). - One-shot users per project with password login; Bearer tokens with sha256 fingerprints, TTL, and instant invalidation when a user is disabled. - Same-name users across projects — storage key is / ; log in as project/user when a bare name is ambiguous. - Per-user works…

Category