dsh-deeppilot
English | 简体中文
The open-source DSH companion plugin for DeepPilot, a native iPhone client
for using DeepSeek Harness remotely. It connects the app directly to the DSH
Host on your own Mac and does not replace or modify the DSH Web UI.
DeepPilot is currently in TestFlight review. The invitation link will accept
testers after Apple approves the build.
Join the DeepPilot TestFlight
What you get
- Browse projects, sessions, history, and live agent output from iPhone.
- Send prompts, switch models, create sessions, and answer approvals/questions.
- Pair with a five-minute single-use code and a per-device P-256 key; physical
iPhones keep the private key in Secure Enclave.
- Connect over the LAN (TLS with a Host-issued certificate pinned during
pairing) or the optional embedded Tailscale Funnel.
- Receive live notifications and optional APNs notifications while offline.
- Self-update hint: the settings page footer shows the installed plugin
version, with an inline "new version" link to the matching GitHub
release when one exists (background check, stable releases only, no
third-party dependency).
Install from npm
Requirements: Node.js 22+ and DSH with a web profile. The package includes
Funnel helpers for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode
does not require the helper.
| Plugin version | Required DSH | How to install |
|---|
0.7.x (current stable, latest) | DSH 0.1.5-rc.1 or newer | dsh plugin --profile web add dsh-deeppilot |
0.6.x (previous stable) | DSH 0.1.5-rc.1 or newer | dsh plugin --profile web add dsh-deeppilot@0.6.2 |
0.5.x (legacy) | DSH 0.1.1-rc.2–0.1.2-alpha.1 | dsh plugin --profile web add dsh-deeppilot@0.5.0 |
0.7.x is built and typechecked against the DSH
0.1.5-rc.1
Host and client package family. It uses the Gateway multi-client Remote Events
routing that keeps Web and DeepPilot independently answerable. Earlier plugin
alphas remain historical artifacts; users installing the alpha tag for
pre-release testing should update DSH to 0.1.5-rc.1 or newer.
# DSH 0.1.5-rc.1 or newer (recommended):
dsh plugin --profile web add dsh-deeppilot
# DSH 0.1.1-rc.2 through 0.1.2-alpha.1 (previous stable):
dsh plugin --profile web add dsh-deeppilot@0.5.0
dsh web
After DSH restarts, open Settings → DeepPilot, enable the connection, show
the pairing QR code, and scan it in the DeepPilot app. Below the QR code the same
panel shows one copyable piece of pairing info (address, single-use code and
certificate fingerprint) that can be pasted into the app in one step — useful for
Simulator or when the camera is unavailable. Switching between the LAN and
public address issues a matching new QR code and string immediately, with the
panel staying open.
LAN access is enabled by default on the plugin's independent TCP port 3098
and is TLS-only. The plugin generates a self-signed certificate on first start
(key under $DSH_HOME/deeppilot/lan-tls/), and the pairing QR code carries its
public-key fingerprint so the app pins that exact Host. DSH may continue
listening only on 127.0.0.1:3080; the plugin no longer registers any /phone
routes on the DSH web server. If a firewall is enabled, allow inbound TCP
3098 on the networks you use. The port can be changed under Advanced
settings.
Upgrading from a plugin version that served plain ws:// on the LAN: devices
paired over the LAN must pair again so they receive the certificate
fingerprint. Devices paired through Funnel are unaffected.
Package: npmjs.com/package/dsh-deeppilot
Update or uninstall
dsh plugin --profile web update dsh-deeppilot
dsh plugin --profile web remove dsh-deeppilot
Restart DSH after updating. Uninstalling the package does not delete the local
DeepPilot state under $DSH_HOME/deeppilot/.
Publishing (maintainers)
0.7.x targets DSH 0.1.5-rc.1+; 0.6.x keeps the pre-TLS LAN transport for
the same DSH family during the migration window, and 0.5.x stays compatible
with DSH 0.1.1-rc.2–0.1.2-alpha.1. Keep them published:
-
Bump version in package.json and in the root "" entry of
package-lock.json, then run npm test && npm run typecheck && npm run build
and inspect npm pack --dry-run --json (the check
tests/compatibility-metadata.test.ts enforces the peer range and asserts it
admits both the 0.1.5-rc.* and the 0.1.6-* lines).
-
Commit the release and push it. npm publish runs prepack (build) and
prepublishOnly (test + typecheck) automatically.
-
Publish pre-releases without touching latest:
npm publish --tag alpha
After a successful publish, npm view dsh-deeppilot dist-tags --json shows
"latest": "0.7.x" and "alpha": "0.7.x-alpha.y". Verify the published
package by installing it into a DSH 0.1.5-rc.1 profile before pointing
users at it.
-
Tag the release commit vX.Y.Z and prepare a GitHub Release
(English + 简体中文 notes) that links this README section.
-
Publish stable releases with npm publish --tag latest, which moves
latest to the new version. Stable releases must never be published
with --tag alpha.
Never run npm publish from a copy that still has an older version.
Connection and privacy
Conversation traffic travels directly between the iPhone and your DSH Host and
is always encrypted: the LAN listener on port 3098 serves TLS with a
self-signed certificate whose fingerprint the app receives during pairing, and
Funnel mode uses Tailscale-issued certificates. The app refuses plain ws://.
Both the LAN listener and optional Funnel mode expose only the DeepPilot
connection, one-time pairing, and health endpoints, not the complete DSH Web UI.
The DeepPilot settings page exposes Connections per public source under
the collapsed Advanced settings section. It defaults to 8, accepts
1–16, and briefly restarts the Funnel helper when changed, so connected
remote clients reconnect once.
Offline push is optional. Relay mode sends only the target APNs device token
and a limited notification payload; full conversation history and live output
do not pass through the relay. Read PRIVACY.md and
SECURITY.md before enabling remote access or push. Protocol-v2
implementation status and remaining release validation are tracked in
docs/SECURITY_ROADMAP.md.
Screenshots
Compatibility
See COMPATIBILITY.md for the tested baseline and current
limitations. DSH is still evolving; include exact DSH and plugin versions when
reporting an issue.
Protocol
PROTOCOL.md is the normative DeepPilot bridge protocol. Any
wire change must update that document and src/protocol.ts together and be
coordinated with the private iOS client. Protocol v2 is the only supported wire
version; upgrades from v1 require re-pairing.
Development
npm ci
npm test
npm run typecheck
npm run build
cd helper && go test ./...
Community and feedback
DeepPilot is an independent community project and is not affiliated with or
endorsed by DeepSeek.
License
MIT — see LICENSE.
