Connect explicitly trusted DeepSeek Harness hosts through Iroh. Keep pairing, peer identity, reachability, and the remote session directory in one transport layer.
What you get
| Capability | Behavior |
|---|
| Persistent identity | The same host identity survives restarts. |
| Explicit pairing | Exchange endpoint tickets and trust each peer locally. |
| Encrypted transport | Iroh provides QUIC connections, direct paths, and relay fallback. |
| Remote directory | Discover workspaces and sessions on paired hosts. |
| Visible state | Host reachability is separate from agent idle/running/offline state. |
| Native settings | Grouped identity and pairing controls, copy feedback, and removal confirmation. |
Quick start
On each host:
dsh plugin --profile web add dsh-weave@latest
dsh web
- Open Settings → Weave on both hosts.
- Exchange their tickets through a channel you trust.
- Add and explicitly trust the other host's ticket on each side.
- Use a higher-level plugin such as DSH Chat to select remote sessions.
Add DSH Bridge when messages should reach local agents on a receiving host. Bridge is optional for transport startup.
One transport, separate responsibilities
flowchart LR
A[Host A · Bridge] --> WA[Weave]
WA <-->|Iroh · QUIC| WB[Weave]
WB --> B[Host B · Bridge]
Iroh owns encrypted connectivity. Weave owns host trust, endpoint refresh, reachability, and authenticated requests. Chat owns rooms, membership, and room capabilities. Knowing a ticket alone does not grant trust or agent access.
Configuration
| Field | Default | Purpose |
|---|
hostName | System hostname | Display label for the host. |
relayMode | default | Iroh default relay selection, or disabled. |
persistIdentity / persistPeers | true | Keep identity and trusted peers across restarts. |
acknowledgementTimeoutMs | 10000 | Default acknowledgement deadline. |
maxConcurrentInbound | 64 | Bound concurrent incoming requests. |
shutdownTimeoutMs | 1000 | Bound transport shutdown. |
Identity and trusted peers are stored under $DSH_HOME/dsh-weave (~/.dsh by default), with owner-only permissions. identityPath and peersPath can override their locations.
Cancellation & delivery
Outbound requests accept a cancellation signal. Cancellation closes their connection; the receiving listener is also notified when the peer disconnects. Cancelling a request does not mark an otherwise reachable host offline. Chat's longer polling requests use matching acknowledgement deadlines.
The current release is a transport MVP. It provides pairing, directory access, and authenticated request delivery. A general remote task approval workflow and durable transport outbox/reconnect replay are not implemented. Application-level persistence belongs to the consuming plugin.
Protocol & architecture
Architecture · Protocol · Security · Room authority
The design documents include planned capabilities; use this README and the release notes for current behavior.
Development & feedback
npm ci
npm run check
Report an issue · Release notes · MIT license
