English · 简体中文

dsh-remote

Turn DeepSeek Harness into a scan-and-go web app — no apps, no VPN, no public ports.

dsh-remote puts DeepSeek Harness behind a scan-to-pair gateway and an outbound-only Cloudflare tunnel. Any device — iPhone, iPad, Android, Mac, Windows, ChromeOS — connects straight from the browser and can be added to the home screen as an app (PWA). The pairing experience is modeled on the Paseo relay: pair once, and stay signed in.

What is it? dsh-remote is a standalone companion app for DeepSeek Harness — not itself a DSH plugin. It installs next to DSH (gateway + tunnel + watchdog + ops CLI) and ships one DSH plugin of its own, dsh-remote-plugin, which pushes task notifications to your phone.

• Zero-install clients — the camera scan auto-pairs the device and drops you into DSH; add the PWA to the home screen and stay signed in for a year.
• QR pairing — a one-time 8-character code (10-minute expiry, single use, rate-limited).
• No public ports — an outbound-only cloudflared tunnel; the host never listens publicly and your router stays untouched.
• Security closed loop — HMAC-signed sessions, per-device revocation, audit logging, and loopback Host enforcement. See SECURITY.md.
• One-command setup — install, supervision, heartbeat watchdog, log rotation, and an ops CLI — on Linux, macOS, and Windows alike.

┌─ Host (Linux / macOS / Windows — any of them can be the host) ──────────┐
│  dsh-web         DSH, listening on 127.0.0.1:3080 only                  │
│  dsh-gateway     Security gateway on 127.0.0.1:8080:                    │
│                    QR pairing / HMAC sessions / rate limit / revocation │
│  dsh-tunnel      cloudflared outbound → HTTPS tunnel URL                │
│  watchdog        heartbeat checks every 5 minutes (all platforms)       │
└─────────────────────────────────────────────────────────────────────────┘
        ▲ outbound HTTPS (Cloudflare tunnel)
   ┌────┴──────────────┬──────────────────┐
   │ iPhone / iPad / Android │ Mac / Windows / Linux │
   │ camera scan = zero typing │ browser + pairing code │ ← zero installs
   └───────────────────┴──────────────────────┘

Quick Start

Linux (Ubuntu 20.04+ / Debian)

curl -fsSL https://raw.githubusercontent.com/hadan8977/dsh-remote/main/server/install.sh -o install.sh && sudo bash install.sh --api-key sk-your-key

systemd daemons, 5-minute heartbeat watchdog, log rotation, and the dsh-remote ops CLI. --api-key configures and validates your key at install time (omit it to be prompted, --no-api-key to skip).

macOS

bash <(curl -fsSL https://raw.githubusercontent.com/hadan8977/dsh-remote/main/host/macos/install-macos.sh)

Requires Homebrew. launchd daemons with KeepAlive, a 5-minute watchdog, and the same sudo dsh-remote ops CLI. Same feature set as Linux.

Windows

Set-ExecutionPolicy -Scope Process Bypass
Invoke-WebRequest https://raw.githubusercontent.com/hadan8977/dsh-remote/main/host/windows/install-windows.ps1 -OutFile install-windows.ps1
.\install-windows.ps1

Run in an elevated PowerShell. Task Scheduler services with auto-restart, a 5-minute watchdog, and the dsh-remote.ps1 ops CLI (with QR codes). Same feature set as Linux.

Every platform is a full host — any of them can serve all the others.

How it works

First setup (host):   installer → terminal shows the pairing code + URL

Phone (once):         camera scan → auto pair → straight into DSH → "Add to Home Screen"
Computer (once):      open the URL → type the 8-character code → install the PWA / bookmark

Every day after:      tap the icon — chat directly, no login (1 year)

New device:           sudo dsh-remote pair          (Windows: dsh-remote.ps1 pair)
Lost phone:           sudo dsh-remote revoke        (Windows: dsh-remote.ps1 revoke)

Pairing works two ways — a camera is never required:

• Scan — the phone camera scans the QR code printed by dsh-remote pair.
• Copy & paste — send the invite link (or the 8-character code) to the new device: pasting the link into any browser pairs it instantly, or type the code on the pairing page. The Devices page (/devices) has a one-click Copy invite link button.

Client devices

Documentation

• Security & threat model — pairing, sessions, audit, honest boundaries, reporting.
• Operations & maintenance — CLI reference, updates and rollback, permanent URL, troubleshooting, plugins & remote access FAQ.
• Migrating from other tools — Claude Code, Codex, Kimi Code, OpenCode/Cursor, and generic guides.
• Contributing · Code of Conduct

Related projects

License

MIT