@qipenglin/dsh-web-access

Optional loopback token and Cookie authentication for a DeepSeek Harness Web profile. This release supports official DSH 0.1.0-rc.7 only.

Install

dsh plugin --profile web add @qipenglin/dsh-web-access
dsh web

After restart, dsh web prints one fragment-token URL:

dsh web: http://localhost:3080/#token=<random-token>

Open the complete URL the first time. Before its first asynchronous operation, the browser removes the fragment, exchanges the Bearer token for a host-only, HttpOnly, SameSite=Strict session Cookie, and only then activates the DSH Connection. The bare URL works later in the same browser session.

Security behavior

• The WebServer must bind 127.0.0.1; --host 0.0.0.0 fails after this plugin is installed.
• Static HTML, shell assets, the boot manifest, /plugins Client bundles, and /plugins/events HMR graph metadata remain public so browser startup can run in parallel with authentication.
• Anonymous /api, custom Connection RPC channels, and both Connection WebSocket downlinks receive 401.
• Host, Origin, or Fetch Metadata mismatches receive 403.
• Query tokens, WebSocket subprotocol tokens, duplicate target Cookies, and duplicate Authorization fields are rejected.
• Every process start creates a new token, Cookie name, and session secret, invalidating earlier Cookies.
• The token is not stored in the Cookie, Web Storage, history state, DSH_WEB_URL, or model context.

This plugin protects a local Web profile. It is not a remote identity system and does not support LAN or public deployment.

Remove

dsh plugin --profile web remove @qipenglin/dsh-web-access
dsh web

Removal followed by restart restores the official unauthenticated 0.1.0-rc.7 Web composition. An installed but incompatible or misconfigured plugin fails profile startup; it never silently falls back to unauthenticated transport during that launch.

Desktop integration

The Host publishes ctx.webAccess with token-free origin, token-bearing interactiveUrl, accessToken, and synchronous authorize(request). A future desktop runtime may consume this optional service and perform Cookie bootstrap outside its WebView. When the service is absent, the desktop runtime owns any unauthenticated loopback fallback.

Development

Node ^22.19.0 || >=24.0.0 and pnpm 11.7.0 are required:

pnpm install --frozen-lockfile
pnpm test
pnpm run test:coverage
pnpm run test:installed
pnpm run typecheck
pnpm run lint
pnpm run pack:check

pnpm run pack:check replaces dist/ with the single verified dist/qipenglin-dsh-web-access-0.1.0.tgz tarball.

test:installed installs the packed artifact into an isolated official rc.7 Web profile and verifies HTTP, WebSocket, restart invalidation, and removal behavior.

License

MIT