sorsama/deepseek-harness-relay

README 摘要

dsh-relay Authenticated remote access for a DeepSeek Harness web profile — reach your harness from your phone over Wi-Fi, or from anywhere if you forward a port, without leaving an unauthenticated coding agent open on the network. Built on DeepSeek Harness. Not an official DeepSeek project. Why this exists The harness serves its browser API on loopback and is explicit about what it does not do: - packages/client/connection/src/api-request-trust.ts — the /api fence "is not an auth layer". - packages/client/connection/src/index.ts — the configuration plane stays loopback-only "until a real authentication layer exists". - packages/bundle/web-app/src/startup.ts — dsh web --host 0.0.0.0 is refused, because "it would expose remote code execution to the network". The workaround people use today is a config patch that rebinds the web server to 0.0.0.0 with no authentication at all. Anyone on the same Wi-Fi can then drive the agent, which means running commands on your computer. dsh-relay is the missing layer, mounted beside the harness rather than inside it. The harness keeps its loopback bind; the relay is a second listener that terminates TLS, authenticates, and forwards. Because the har…

分类