dsh-secure-context-fix
在局域网上通过普通 HTTP 修复 DeepSeek Harness Web GUI：在 dsh bundle 代码运行前注入一个由 getRandomValues 支持的 crypto.randomUUID polyfill。无需修改官方源代码。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Li-Mingshuang/dsh-secure-context-fix#6ef7a104d111064242b5200cf2745312bb4c1f2dSecure Context Fix 以 dsh-secure-context-fix 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Fix the DeepSeek Harness Web GUI over plain HTTP on a LAN (e.g. from a phone).
crypto.randomUUID only exists in secure contexts (HTTPS or localhost).
When you open the dsh Web GUI from another device over plain HTTP on your LAN
(http://192.168.x.x:3080), the browser has no crypto.randomUUID, so every
RPC crashes with:
crypto.randomUUID is not a function
Symptoms: workspace list never loads, the directory picker fails, sessions
cannot be created — while http://127.0.0.1:3080 works fine on the same
machine.
This plugin is a small host plugin that registers a webServer.tapIndex
transform. When the GUI serves its index.html, the plugin injects a tiny
inline <script> into <head> that installs a crypto.randomUUID
implementation backed by crypto.getRandomValues() — which browsers do
expose on insecure origins — before any dsh bundle code runs.
No official source changes, no polyfill library, no build step for users.
From the directory containing this package (after cloning):
dsh plugin --profile web add ./dsh-secure-context-fix
Or from a git host:
dsh plugin --profile web add github:<you>/dsh-secure-context-fix
Then restart the profile:
dsh --profile web
First
addfrom a git host may ask you to allow the package's build (allowBuilds) if apreparescript is present; this package ships no build step and plain JS, so no allowance is needed.
Serve the GUI on all interfaces so a phone can reach it. The dsh CLI
rejects --host 0.0.0.0 for safety, so patch the webserver row in the
profile instead:
# $DSH_HOME/profiles/web/cordis.patch.yml
- id: webserver
config:
host: '0.0.0.0'
port: !!js ctx.webStartup.port ?? 3080
Allow inbound TCP 3080 in the firewall, ideally restricted to your LAN subnet:
New-NetFirewallRule -DisplayName "dsh web 3080 (LAN)" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow -Profile Private -RemoteAddress 192.168.0.0/24
On the phone (same Wi-Fi) open http://<your-LAN-IP>:3080. Workspace
list, directory picker, and new sessions should now work.
index.js — the plugin entry (name, inject, apply).cordis.patch.yml — the bundle layer inserting the plugin row.package.json — npm manifest declaring dsh.bundle.Binding the GUI to 0.0.0.0 exposes remote-code-execution-grade control of
the agent to anyone who can reach the port. Only do this on a trusted network,
and prefer restricting the firewall rule to your LAN subnet as shown above.
This is a stop-gap for
deepseek-ai/deepseek-harness discussions #4209
until the official repo replaces its three crypto.randomUUID() call sites
(AbstractApiClient.mintRpcId, ui-conversation image draft ids, and
llm createMessage) with getRandomValues()-based UUIDs. If you can patch
the source, do that instead; this plugin helps users who cannot.