Fix 127.0.0.1:3080 connection refused: start the DSH web UI

127.0.0.1:3080 is the default address of the DeepSeek Harness Web UI started by dsh web. When the page fails to open with connection refused (ECONNREFUSED), the service is almost certainly not running — start it first, then check port usage, system proxy, and the browser in that order, and most issues are resolved within three steps.

What this address is: dsh web and 127.0.0.1:3080

The dsh web: http://127.0.0.1:3080 line in your terminal is the startup notice of the DeepSeek Harness Web UI, not an error. It tells you the Web UI is listening on port 3080 on this machine, and the browser should open it at that address (source).

Key facts:

1. dsh web is an alias of dsh --profile web — in the official CLI definition, web is a shortcut for --profile web (source).
2. 3080 is the default port: http://127.0.0.1:3080 is confirmed in the official README, with no configuration needed.
3. A local launch auto-opens the browser: since v0.1.0-rc.8, starting dsh web opens the page in the default browser; pass --no-open to skip that (source).
4. 127.0.0.1 is local only: only your own machine can reach it. An SSH launch prints only the host URL, and the local address must be forwarded by the SSH client (source).

If the notice appears but the browser did not open, just visit http://127.0.0.1:3080 manually.

Debugging a refused connection (ECONNREFUSED)

Connection refused means nothing is listening on that port — in other words, dsh web is not running. Work through these 5 steps:

1. Confirm dsh web is running: check the terminal that started it. If the window was closed or the process exited, the service has stopped.
2. Restart dsh web:
   bash

   npx @deepseek-ai/dsh web        # one-off run (no global install)
   

   or, if installed globally:
   bash

   dsh web
   

   Wait for the dsh web: http://127.0.0.1:3080 line, then open the browser.
3. Check whether the port is occupied: another program on 3080 can stop dsh web from binding. On macOS / Linux:
   bash

   lsof -i :3080
   

   On Windows:
   powershell

   netstat -ano | findstr :3080
   

   If a process other than dsh holds the port, stop it or switch ports with dsh web --port 8080.
4. Check the system proxy: a global proxy (Clash, VPN, etc.) whose rules also forward 127.0.0.1 can block local addresses. Add the local address to the proxy's direct/whitelist rules, or temporarily disable the global proxy and retry.
5. Try another browser / clear the cache: browser extensions or a stale cache can block local addresses — try an incognito window at http://127.0.0.1:3080.

gateway proxy error: connect econnrefused 127.0.0.1:3080

This error points to the same root cause: the local service is not listening. A model gateway call tried to reach 127.0.0.1:3080 and failed. Fix it the same way: start dsh web; if the port is occupied, free it first. It often happens when the Web UI tab is still open but the background dsh web process has exited — restart the service and refresh the page.

--no-open and other startup flags

Use --no-open to run the server without auto-opening the browser. The official CLI behavior reference confirms web accepts --host, --port, --trusted-host, and --no-open (source):

1. --no-open: run the server only, without opening a browser. Useful for SSH sessions, servers, or when you manage browser windows yourself:
   bash

   dsh web --no-open
   

   The terminal still prints the address — copy it into the browser.
2. --port <n>: change the port. Use it when 3080 is occupied or you need to avoid a proxy rule:
   bash

   dsh web --port 8080
   

   Then visit http://127.0.0.1:8080.
3. --host <ip>: change the listening address; --trusted-host <host>: declare a trusted origin (repeatable). The official CLI behavior reference lists exactly these three web flags (--host, --port, repeatable --trusted-host) and notes that --host 0.0.0.0 is not supported yet — it exits with a usage error. For remote or LAN access, add hostnames via --trusted-host so they join the /api browser-trust fence, instead of opening the listener to every interface (source).
4. Production runs need built artifacts: the npm-installed dsh ships with them; running from a source checkout without pnpm run build makes dsh web fail at startup with an explicit "run build" instruction. This applies to the service itself, not to plugins (source).
5. Stop with Ctrl+C: the first Ctrl+C starts a graceful drain — the plugin tree gets up to five seconds to dispose; a stuck process exits immediately on a second signal. SIGINT exits with code 130 (source).
6. These are web-app arguments and must come after dsh web — dsh web --port 8080, not dsh --port 8080 web. dsh web --help prints the web app's help, not the launcher's.

Notes

1. 127.0.0.1:3080 is a local address — phones and other machines cannot reach it; remote access needs port forwarding.
2. Connection refused almost always means the service is not running — do not change config first.
3. When the port is occupied, locate the process with lsof -i :3080 (macOS/Linux) or netstat -ano | findstr :3080 (Windows).
4. If you use a global proxy, add 127.0.0.1 to direct/whitelist rules so local addresses are not hijacked.
5. Visit the page only after the dsh web startup notice appears; if it never appears, the service did not start.
6. Once the Web UI is open, install plugins from Settings → Plugin Center — the community marketplace DSH Plugin Hub — for a graphical alternative to the command line.

dsh-plugin-hub · Plugin Center

Source: DeepSeek Harness README, dsh CLI behavior reference, v0.1.0-rc.8 Release Notes