dsh-bridge-gateway
以 dsh-bridge 为根基的 DSH 远程访问网关：局域网 / Cloudflare 隧道 / Tailscale 隧道 / 自建隧道 / 公网直连网关 / IM Bot，全部在 Web 面板中配置。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-bridge-gateway@0.2.0Bridge Gateway 以 dsh-bridge-gateway 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 简体中文
Remote-access plugin for DeepSeek Harness (DSH). Built on top of wenbin-wb/dsh-bridge, it adds a public direct-connect gateway and a Tailscale tunnel, so phones and other out-of-network devices can either connect straight to your machine or reach it over a stable Tailscale HTTPS hostname.
LAN access, Cloudflare tunnels, custom tunnels, and the IM bots all keep working exactly as before. The plugin is fully inert until you enable the features you want.
Lineage: this repository is an enhanced fork of wenbin-wb/dsh-bridge and keeps tracking its fixes. See Relationship to upstream.
This project's upstream is wenbin-wb/dsh-bridge, which provides all of the plugin's foundational capabilities. This repository adds two things and fixes two classes of problems on top of it.
| Repository | wenbin-wb/dsh-bridge |
| Role | Multi-channel remote access and security plugin for DSH |
| Capabilities | LAN QR direct-connect, Cloudflare / self-built tunnels, WeChat / QQ / Feishu / Telegram bots, full-protocol access authentication |
| License | MIT |
| Relationship | The fork source for this repository. LAN access, tunnels, IM bots, and security authentication all come from upstream. |
Upstream is the pioneering implementation of this class of plugin: it made "keep using DSH from your phone" work the easy way — scan into the LAN, tunnel out to the internet, talk straight from an IM app. This plugin stands on its shoulders.
1. New: public direct-connect gateway (not in upstream)
Upstream solves "access from outside" with tunnels (Cloudflare or self-built). Tunnels require a third-party relay, and the free temporary hostname changes on every restart.
This plugin adds a direct gateway: the computer listens on 0.0.0.0:<port> with its own self-signed HTTPS certificate and a forced login gate, and outside devices connect without any third party in the middle. It fits deployments that have a public IP / port-forwarding, or that simply do not want traffic routed through someone else's infrastructure.
2. New: Tailscale tunnel (not in upstream)
Upstream's tunnels either go through Cloudflare or require your own server. This plugin adds a Tailscale Serve channel: reuse the tailnet you already have and publish the local WebUI as https://<host>.<tailnet>.ts.net.
tailscale status / tailscale serve status to fill in the Serve address; manual editing is also supported.tailscale serve for you. When Serve is not configured it only offers a copyable command for you to run yourself.3. Fixed: conflicts with native DSH capabilities (still present upstream)
| Problem | Upstream state | This repository |
|---|---|---|
| Directory picker | Claims DSH's native directoryFlow slots with priority:-10, plus a capture-phase click interceptor that hijacks the "Add workspace" button | Uses the official browse directory picker (mounts the host backend and browser surface as a pair). No slot claiming, no DOM interception. |
| Proxy-layer HTML rewriting | Intercepts HTML responses during reverse proxying and does string replacement to inject PWA metas | Uses the official webserver/index-inject mechanism so the host renders it; the proxy is a pure transparent forwarder. |
| Directory-picker service name | Calls ctx.workspaces.pickDirectory (the official service is ctx.uiWorkspace) | No longer depends on that service; directory picking is fully handed back to native. |
Upstream describes the first two as features in its CHANGELOG, but they cause "clicking Add workspace does nothing". This repository fixes them and would welcome upstream adopting the fix.
4. Tracking: continuously porting upstream fixes
Upstream iterates quickly and this repository keeps up. Ported fixes are listed in CHANGELOG, notably:
/rename durability;Both sides evolve, so feature coverage may lead on either side. When in doubt, check upstream's README to see which side owns a given capability.
The plugin was renamed from dsh-bridge to dsh-bridge-gateway (reflecting the added gateway capability). Existing users need no manual work — the data directory, configuration, passwords, certificates, and login state all migrate automatically:
| Path | Change |
|---|---|
<DSH_HOME>/dsh-bridge/ | → <DSH_HOME>/dsh-bridge-gateway/ (migrated automatically at startup) |
~/.dsh-bridge/ | → ~/.dsh-bridge-cloudflared/ (cloudflared cache; migrated automatically, no re-download) |
RPC channel /dsh-bridge | → /dsh-bridge-gateway, with both channels served, so stale cached pages keep working |
0.0.0.0:<port> with its own HTTPS self-signed certificate and a forced login gate, so outside devices connect straight to your machine. The link is terminated at the gateway and proxied to the DSH loopback, so plugin pages and RPC channels work unchanged.https://<host>.<tailnet>.ts.net: address detection is automatic (read-only queries, never modifies your Tailscale config), manual editing is supported, and a scan-to-connect QR code is generated. TLS is issued by Tailscale.isLocalhost is never trusted.The panel has 5 tabs: Access / Visitors / IM Bots / Security / Ops.
| Tab | Contents |
|---|---|
| Access | Direct gateway · Cloudflare tunnel · Tailscale tunnel · Custom tunnel · LAN access (only the direct gateway is expanded by default) |
| Visitors | Live connections (source IPs visible) · persistent blacklist |
| IM Bots | WeChat / QQ / Feishu / Telegram platform cards |
| Security | Global control · First line (external access gate) · Second line (admin tamper protection) |
| Ops | System metrics · network diagnostics · backup/restore · restart DSH |
^22.19.0 || >=24.0.0.0.1.5-rc.2; adapted for the 0.1.5 RPC/webServer entry points).# Preferred: install straight from GitHub (no npm involved)
dsh plugin --profile web add github:lament-z/dsh-bridge-gateway
# Alternative: from npm
dsh plugin --profile web add dsh-bridge-gateway
# From a local clone / working copy
dsh plugin --profile web add link:<this directory>
Upgrade to the newest build: dsh plugin --profile web add github:lament-z/dsh-bridge-gateway again (or append @latest for the npm source). Then restart dsh web.
Nothing changes on install: the gateway is off by default and the original LAN/tunnel/IM behavior is untouched.
No tunnel needed — the computer exposes a port itself and outside devices connect directly.
7443) and click save.https://<public-IP-or-domain>:<port> from outside.First visit shows a certificate warning because the HTTPS certificate is self-signed — choose "always allow" to continue. External visitors must pass the login gate configured under Security; the gate policy is independent of your LAN settings.
For when you already use Tailscale and want a stable, trusted HTTPS address (no self-signed certificate, no domain of your own).
tailscale serve --bg 3082 once on this machine (3082 is this plugin's reverse-proxy port — substitute your actual port). You must run this yourself — the plugin only performs read-only detection and will not modify your Tailscale configuration.https://<host>.<tailnet>.ts.net.You can also skip detection and click Edit manually to type the address. When detection fails the card shows a copyable serve command along with the current Tailscale state (not installed / offline / Serve not configured).
To undo the publish: run
tailscale serve --bg off.
The Visitors tab lists the source IPs currently connected to this machine (aggregated across LAN / direct gateway / tunnel, showing the real visitor IP behind a tunnel) and lets you maintain an IP blacklist.
Open the remote-access panel in DSH Web and scan the QR code with the phone on the same Wi-Fi.
LAN reachability is also delegated to DSH's native
--host/trustedHosts. The plugin's own LAN reverse proxy is off by default and can be started from the panel when needed.
In the same panel choose Cloudflare (temporary or fixed hostname) or a self-built tunnel. See docs/custom-tunnel.md for the custom-tunnel protocol.
Tunnels are self-healing: cloudflared restarts with exponential backoff after an unexpected exit, and its 24h self-replacing autoupdate is disabled. The custom tunnel answers DSH's WebSocket heartbeats at the frame layer so long-lived connections are not terminated.
"Add workspace" opens DSH's official directory browser (Miller two-column layout, breadcrumb, editable path, new folder, show hidden files) with identical behavior locally and remotely — it works on phones too.
Settings -> Security: enable protection, set the password, manage the password-free token, and unlock/lock the admin surface. Unauthorized visitors are rejected before any page content is served.
Login state is persisted to <DSH_HOME>/dsh-bridge-gateway/sessions.json (mode 600), so already-signed-in devices survive a host restart without re-entering the password. Changing the password, switching mode, or regenerating the token still revokes every existing session.
WeChat / QQ / Feishu / Telegram guides: docs/wechat-usage.md, docs/qq-usage.md, docs/feishu-usage.md, docs/telegram-usage.md.
Each platform card has an "Advanced settings" section where you can configure that platform's remote-session workspace directory, agent preset, and provider / model (leave blank to use DSH defaults). These survive host restarts.
Nothing manual is required: the data directory, configuration, access password, self-signed certificate, and login state all migrate automatically. Migration is idempotent — an existing new directory is never overwritten, and the old directory is never deleted (clean it up yourself whenever you like). If migration hits a problem the plugin still starts, the old data stays where it was, and the log explains what happened.
As of v0.2.0 the dsh-mobile protocol cabin (
/ws/mobiledevice pairing) and its bundled Linux one-shot deploy CLI (init/setup/status/remove) were removed. Use Tailscale Serve or a Cloudflare tunnel for public access instead. The web UI's mobile layout adaptation is unaffected and remains in place.
public_only-style gating: external visitors authenticate through the same AuthManager as LAN access, and loopback-only resources stay loopback-only.600; a missing or corrupt file degrades safely to empty (equivalent to signing in once more).tailscale serve on the user's behalf.checkAdminAuth, not by a client-claimed identity.git clone https://github.com/lament-z/dsh-bridge-gateway
cd dsh-bridge-gateway
npm install
npm run build:client
npm test
dsh plugin --profile web add .
Tests point DSH_HOME at a throwaway temporary directory via test/isolate-home.mjs, so they never touch your real environment.
This project is forked from wenbin-wb/dsh-bridge. Report general issues upstream and direct-gateway issues to this repository.
Pushing a v* tag to GitHub triggers automatic npm publish (GitHub Actions; the repository needs an NPM_TOKEN secret).