@ddtcorex/dsh-maestro-remote
Remote access plugin for the DeepSeek Harness:
a Cloudflare tunnel (quick or named) plus a LAN remote proxy so a DSH session can be reached
from outside the machine, gated by a second PIN with QR provisioning.
Part of the Maestro Harness suite (dsh-maestro-*). Cordis patch row id: dsh-maestro-remote
(short alias maestro-remote in the meta bundle).
What it provides
- Tunnel lifecycle (
maestroTunnel service): start/stop/status of a cloudflared
quick tunnel or a named tunnel (ingress /hooks/* → gitlab webhook, everything else → the
remote proxy), auto-restore of a previously running named tunnel on boot.
- Remote proxy: request handler for the tunnel target with PIN auth
(constant-time comparison), reloadable config.
- cloudflared fetcher: resolves the binary from PATH or installs it into a cache dir.
Settings
Config persists through the shared namespaced settings store
(~/.dsh/maestro/settings.json, owned by @ddtcorex/dsh-maestro-config-lib) via a flat
MaestroUserConfig adapter — see src/config-store.ts. Machine runtime state
(lastTunnelRunning) deliberately lives in this package's own sidecar
(~/.dsh/dsh-maestro-remote/runtime.json) so editing settings can never silently flip
tunnel state.
Install
dsh plugin --profile web add @ddtcorex/dsh-maestro-remote
# or everything at once:
dsh plugin --profile web add @ddtcorex/dsh-maestro-meta
Development
pnpm install
pnpm verify # tsc --noEmit
pnpm test # vitest run
pnpm build # tsc -> lib/
A tunnel change must be validated live (real start/stop + proxy round-trip), not just by unit
tests — see AGENTS.md.
License
MIT
