DeepSeek Harness Plugin Hub

Publish and manage complete Harness Profiles. Discover Plugins for your next setup.

Explore

PluginsPresetsDocsNews

Community

Publish a pluginContactReport an issue

Resources

Plugin Hub on GitHubDeepSeek HarnessSystem statusPrivacy notice
© 2026 DeepSeek Harness Plugin HubPowered byPaxTech

Independent and unofficial. Not affiliated with, authorized by, or endorsed by DeepSeek.

Settings Remote — DSH Plugin for DeepSeek Harness
DeepSeek Harness Plugin Hub
ProfilesPluginsCategoriesNewsDocsSign inManage Profiles
ProfilesPluginsCategoriesNewsDocsSign in
← Plugins

dsh-settings-remote

Settings Remote

dsh web 客户端插件：settings.* 配置平面（describe/update/replace/mutate/openDocument）在非 loopback 页面也可读可写——修复经域名反向代理访问时，模型/提供方目录页报 “settings are unavailable in this browser” 与 “/api/settings.mutate: HTTP 403”

The plugin will be installed here. Keep web if you are unsure.

npx -y @deepseek-ai/dsh plugin --profile web add dsh-settings-remote@0.0.6
READMECompatibilityVersions

Compatibility and provenance

Settings Remote is published as dsh-settings-remote and currently resolves to version 0.0.6. The Hub verifies its manifest and preserves the exact installation source for reproducible installs.

DSH compatibility
*
Runtime surfaces
web
Release source
npm
Registry updated
9/20/2026

Versions

0.0.6stable
8/24/2026
0.0.5stable
8/24/2026
0.0.4stable
8/24/2026
Show 1 more versionCollapse versions
0.0.3stable
8/24/2026

Related plugins

Loading related plugins…

Latest
0.0.6
DSH
*
HMR
Process restart
Tree shaking
Safe tree shaking not declared
Unpacked size
12.5 kB
Files
5
Surface
web
License
MIT
Source
npm
GitHub
★ 1
Weekly downloads
73
Last push
8/24/2026
View source ↗Project homepage ↗
README badge

Click the badge to copy Markdown for your README.

Do you maintain this Plugin?Claim benefit · Priority security scan

Verify the GitHub repository declared in package.json to manage this listing. After you claim it, Hub will prioritize a security scan of the current version and publish the result when it passes.

Claim this Plugin →
Report an issue

Related plugins

More verified plugins in ui-customization.

Web App@deepseek-ai/dsh-web-appThe dsh browser-surface bundle: the web patch layer over dsh-base plus the runtime glue plugin (frontend dist serving, web-surface prompt, bash runtime variables, URL line)Experimental Agent Team Web Profile@deepseek-ai/dsh-experimental-agent-team-web-profileExperimental Web profile layer for Agent Teams Remote and UI pluginsRemote Web Ui@linxin666/dsh-remote-web-uiScan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and rClient Ui Task Board@linxin666/dsh-client-ui-task-boardHost-authoritative task board for the DSH Web GUI with real session execution, Host cron scheduling, and optional cross-platform idle-sleep protection; mounted without DSH source changes.

README

dsh-settings-remote

独立 npm 包 / GitHub 仓库；与 dsh-weixin-gateway 配套，源码副本随其 plugins/ 维护。

dsh web 客户端插件：让 settings.* 配置平面（settings.describe / settings.update / settings.replace / settings.mutate / settings.openDocument）在非 loopback 页面也可读可写。

修复经域名反向代理访问 dsh web 时，模型/提供方目录页的两个报错：

  • settings are unavailable in this browser（客户端镜像门控）
  • transport failure for /api/settings.mutate: HTTP 403（服务端特权方法硬钉 loopback）

背景

dsh 的 dsh-client-connection 把 settings.* 等配置平面方法硬编码在 PRIVILEGED_METHODS 中，对它们用空信任列表做 isTrustedApiRequest 判定——即使通过 --trusted-host 配置了域名也强制 loopback（DNS-rebinding 防御设计）。因此经域名访问时：

  • settings.describe 被客户端镜像门控（connection.isLoopback 判定）挡在页面外
  • settings.mutate 等写操作被服务端 trust fence 直接 403

本插件从两侧绕过（保持信任边界）：

服务端半边（lib/index.js）：利用 webServer exact 路由匹配优先于 /api 前缀路由的特性，为五个 settings.* 方法注册 exact 路由，用与 /api 前缀路由相同的 trustedHosts 信任墙（Host ∈ loopback ∪ trustedHosts，Origin 同源，sec-fetch-site ≠ cross-site）放行请求，再原样委托 apiProxy 分派。credentials.* / host.* / agentPreset.* 等其他特权方法的 loopback 保护不变。

客户端半边（lib/client.js）：把设置镜像的持久化强制切到 "host" 并主动加载一次，使非 loopback 页面真正发起 settings.describe。

安装

dsh plugin --profile web add dsh-settings-remote

需要服务端以 --trusted-host <域名> 启动 dsh web（IP 与域名都加），并在反向代理处透传 Host 头。

安全边界

  • 仅放行 settings.* 配置平面五个方法；credentials.*、host.openPath、agentPreset.* 等仍保持 loopback 硬钉
  • 放行依赖 trustedHosts 信任墙：管理员显式配置的域名 + 浏览器同源检查（Origin / sec-fetch-site）

License

MIT