dsh-secure-context-fix
Fix the DeepSeek Harness Web GUI over plain HTTP on a LAN (e.g. from a phone).
Problem
crypto.randomUUID only exists in secure contexts (HTTPS or localhost).
When you open the dsh Web GUI from another device over plain HTTP on your LAN
(http://192.168.x.x:3080), the browser has no crypto.randomUUID, so every
RPC crashes with:
crypto.randomUUID is not a function
Symptoms: workspace list never loads, the directory picker fails, sessions
cannot be created — while http://127.0.0.1:3080 works fine on the same
machine.
How this plugin fixes it
This plugin is a small host plugin that registers a webServer.tapIndex
transform. When the GUI serves its index.html, the plugin injects a tiny
inline <script> into <head> that installs a crypto.randomUUID
implementation backed by crypto.getRandomValues() — which browsers do
expose on insecure origins — before any dsh bundle code runs.
No official source changes, no polyfill library, no build step for users.
Install
From the directory containing this package (after cloning):
dsh plugin --profile web add ./dsh-secure-context-fix
Or from a git host:
dsh plugin --profile web add github:<you>/dsh-secure-context-fix
Then restart the profile:
dsh --profile web
First add from a git host may ask you to allow the package's build
(allowBuilds) if a prepare script is present; this package ships no
build step and plain JS, so no allowance is needed.
How to check it works
-
Serve the GUI on all interfaces so a phone can reach it. The dsh CLI
rejects --host 0.0.0.0 for safety, so patch the webserver row in the
profile instead:
# $DSH_HOME/profiles/web/cordis.patch.yml
- id: webserver
config:
host: '0.0.0.0'
port: !!js ctx.webStartup.port ?? 3080
-
Allow inbound TCP 3080 in the firewall, ideally restricted to your LAN
subnet:
New-NetFirewallRule -DisplayName "dsh web 3080 (LAN)" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow -Profile Private -RemoteAddress 192.168.0.0/24
-
On the phone (same Wi-Fi) open http://<your-LAN-IP>:3080. Workspace
list, directory picker, and new sessions should now work.
Files
index.js — the plugin entry (name, inject, apply).cordis.patch.yml — the bundle layer inserting the plugin row.package.json — npm manifest declaring dsh.bundle.
Security notes
Binding the GUI to 0.0.0.0 exposes remote-code-execution-grade control of
the agent to anyone who can reach the port. Only do this on a trusted network,
and prefer restricting the firewall rule to your LAN subnet as shown above.
Upstream
This is a stop-gap for
deepseek-ai/deepseek-harness discussions #4209
until the official repo replaces its three crypto.randomUUID() call sites
(AbstractApiClient.mintRpcId, ui-conversation image draft ids, and
llm createMessage) with getRandomValues()-based UUIDs. If you can patch
the source, do that instead; this plugin helps users who cannot.
