deepseek-harness-remote: A Secure Remote Access DSH plugin for DeepSeek Harness

DeepSeek Remote Connection (DSH Remote) is a remote access plugin (DSH plugin) for DeepSeek Harness (DSH), maintained by liguobao, licensed under MIT, and last updated in 2026-08. It solves the problem of securely connecting to and operating a local Harness from a phone or browser: the Host only establishes outbound HTTPS/WSS connections, no public ports need to be opened, and the transport layer supports WebSocket Relay, with reserved protocol capabilities for WebRTC, STUN/TURN, and adaptive transport after network switching. Core capabilities include end-to-end encryption based on X25519 and the Noise IK protocol, the Server only forwards ciphertext, remote endpoints can only access explicitly allowed ApiProxy capabilities (no Shell, arbitrary file access, or remote desktop), and multiple Clients can connect concurrently with isolated connections. The current release runs as a Remote Host Plugin and is still in development preview, requiring an external Server compatible with Remote Protocol v1.

What core features does the DeepSeek Remote Connection DSH plugin support?

This plugin supports secure remote access: the Host and Client use long-term X25519 device identity keys and the Noise IK protocol for authentication and encryption, while the Server only handles account authorization, online status, and Relay, and cannot read session content. Remote endpoints can only access explicitly allowed Harness ApiProxy capabilities, without Shell, arbitrary file access, remote desktop, or general tool calls. The same Host supports multiple Clients (e.g., mobile Web, desktop Web) concurrently, and each connection's encrypted channel, RPC state, and event stream are isolated.

How to install the DeepSeek Remote Connection DSH plugin?

Install a fixed version via DSH Desktop's "Extensions → Manage Plugins…", or use the command line. The installation command is as follows:

dsh plugin --profile web add github:liguobao/deepseek-harness-remote

To install a specific version, replace the repository address with a tagged address, e.g., github:liguobao/deepseek-harness-remote#v0.2.13.

How to configure the DeepSeek Remote Connection DSH plugin?

After installation, restart Harness, go to "Settings → Plugins → Plugin Configuration → DeepSeek Remote Connection", configure the Server address, enter the one-time device authorization code generated after logging into the Server web page (only used for this HTTPS access), and restart Harness to make the Host persistent connection take effect. Configuration is stored in the dsh-remote namespace of $DSH_HOME/settings.yaml, and the default Server can be overridden via the DSH_REMOTE_SERVER environment variable. Production deployments must use HTTPS/WSS.

What are the security boundaries of the DeepSeek Remote Connection DSH plugin?

The Host only establishes outbound connections and does not listen on public ports; business messages use Noise IK authenticated encryption, and the Server only handles account authorization, membership, online status, and Relay. Clients can only access explicitly allowed ApiProxy capabilities, without Shell, arbitrary file access, remote desktop, or general Harness tool RPC. Both Client and Host pin the peer's public key through membership-protected device details, and Server membership and local trusted peers must both hold.

What is the compatibility and status of the DeepSeek Remote Connection DSH plugin?

This plugin is maintained by liguobao, licensed under MIT, last updated in 2026-08, currently with 3 Stars and 0 Forks. It is still in development preview, requires an external Server compatible with Remote Protocol v1, and has not completed production-grade interoperability or independent security review, so it should not be used in production.

See more DSH plugins at dsh-plugin.org