dsh-simple-remote 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ivan Lam
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,133 @@
+# dsh-simple-remote
+
+[中文](README.md) | English
+
+Reach DSH from your phone with a single tool. Tailscale alone builds the network: any device with it installed
+joins the tailnet and can reach the others.
+This plugin opens the DeepSeek Harness Web GUI (the GUI of `dsh --profile web`) **only** to your own Tailscale
+tailnet: it starts a second listening port on the Tailscale interface address and reverse proxies it to the GUI
+on loopback. A phone that is on the tailnet simply opens the page and it works, while other devices on the LAN,
+in WSL, or on a virtual switch cannot even see the port.
+
+## What it does
+
+```
+phone (Tailscale) ──►  100.x.y.z:3080  ┐
+                                        │ dsh-simple-remote reverse proxy (rewrites Host/Origin to loopback)
+local browser     ──►  127.0.0.1:3080  ─┴─►  dsh's own Web server (still bound to loopback only)
+```
+
+- It does **not** change the bind of dsh's own Web server: that server still listens on `127.0.0.1` only, so neither
+  the LAN nor the virtual adapters are exposed.
+- It does **not** loosen the shipped Host/Origin fence: the proxy rewrites the forwarded Host to the loopback
+  address, so no new "trusted authority" is added. `Origin` is rewritten only when it was same-origin with the
+  request that arrived, and a cross-site request keeps its own Origin and is refused (403) by the fence.
+- It **keeps** the shipped authentication: session cookies and `/api` token checks are unchanged; the proxy merely
+  performs the first login for you (`autoToken`).
+- WebSocket (terminal, remote streams) and SSE event streams pass through untouched.
+
+## Install
+
+The plugin is a local bundle (this directory is the package). Install it with the plugin manager inside the Harness:
+
+```
+plugin_manager { "action": "install_bundle", "target": "C:\\Users\\ivan\\Documents\\projects\\dsh-simple-remote" }
+```
+
+Or install this directory from the "Plugins" page of the Web GUI. After installing:
+
+- A new Loader row `simple-remote` appears (package name `dsh-simple-remote`).
+- One line shows up in the startup log:
+  `dsh web: tailnet http://100.111.128.100:3080 (Tailscale; auto-login)`
+- Settings → General gains a "Phone access (Tailscale)" row that shows the address and copies it in one click.
+
+On the **phone**: connect to Tailscale and open `http://<your tailnet address>:3080/` directly.
+The plugin completes the login on the first visit (see below), and the browser then remembers it for 30 days.
+
+## Configuration
+
+Row config lives in `cordis.patch.yml` (after installing it is
+`~/.dsh/profiles/web/node_modules/dsh-simple-remote/cordis.patch.yml`; you can also override it from the profile's
+own patch layer — note that a patch replaces the whole `config`, so every key you want to keep must be restated):
+
+```yaml
+- id: simple-remote
+  name: dsh-simple-remote
+  config:
+    enabled: true      # false = off entirely, no tailnet port is opened
+    autoToken: true    # see "Security"
+    address: ''        # empty = detect the Tailscale address (100.64.0.0/10); or pin an address or MagicDNS name
+    port: 0            # 0 = mirror the loopback GUI's port (3080 by default)
+    log: true          # also print the address line to the dsh process output
+```
+
+## Security
+
+`autoToken: true` (the default) means: **anyone who can connect to this port has full control of this machine**
+(arbitrary command execution). The boundary therefore rests entirely on Tailscale — only your own tailnet devices
+can connect, and Tailscale's ACLs and device authorization are that door. On a shared tailnet (a team, a family),
+set `autoToken: false`:
+
+```yaml
+- id: simple-remote
+  name: dsh-simple-remote
+  config:
+    autoToken: false
+```
+
+The phone must then open the full `?token=…` link (copy it from the startup log or the settings row), and its
+behaviour is exactly that of the loopback address; a tailnet device that does not know the token only gets a 401.
+
+In either mode the port is bound to the Tailscale address alone — `0.0.0.0` is never used — so devices on the LAN
+or a public network cannot reach it. That is also the red line behind dsh's official refusal of `--host 0.0.0.0`.
+
+## Verification
+
+`node test/smoke.mjs` runs the plugin itself outside the Harness (13 checks): the browser half's factory and
+rendering (auto-login, token and disabled states, plus the copy button), the proxy's token redirect, cookie
+pass-through, `/api` Host/Origin rewriting, a cross-site Origin left untouched, the WebSocket upgrade, page-state
+injection, and the listener closing on disposal.
+
+It was also exercised against a live Harness (reached from this machine through the Tailscale address):
+
+| Check | Result |
+| --- | --- |
+| Listening addresses | `100.111.128.100:3080` (plugin) + `127.0.0.1:3080` (dsh's own, unchanged) |
+| Navigation without a cookie (`Sec-Fetch-Mode: navigate`) | 200, the 35 KB index page, and a `dsh-auth-…` session cookie |
+| `POST /api/<unknown endpoint>` (with cookie) | 404 — the Host/Origin fence and authentication both passed |
+| Same, without a cookie | 401 |
+| Same, with `Origin: https://evil.example` | 403 |
+| Plugin asset `plugins/??dsh-simple-remote/client.js` | 200 |
+| WebSocket `GET /api/remote.mux` (with / without cookie) | 101 / 401 |
+| Loopback `http://127.0.0.1:3080/` (no cookie) | 401, as before the plugin was installed |
+
+Only one item could not be verified on this machine: **a real connection from another device (a phone) over the
+network**, because the local firewall rules require administrator rights to inspect. If the phone times out, see the
+troubleshooting table below.
+
+## Troubleshooting
+
+| Symptom | What to do |
+| --- | --- |
+| The phone cannot connect, and this machine cannot reach the address either | Check the dsh log for `simple-remote: ... listener failed`; confirm Tailscale is connected and this machine has a `100.x.y.z` address |
+| The log says "no Tailscale address found" | Tailscale is not running, or the address is outside `100.64.0.0/10`; pin it with the `address` config |
+| This machine works, the phone times out | Windows Firewall is blocking inbound. In an administrator PowerShell (replace `<node.exe path>` with the output of `where.exe node`): `New-NetFirewallRule -DisplayName "DSH Tailscale Remote" -Direction Inbound -Program "<node.exe path>" -Action Allow -Profile Any`; or allow just the port: `New-NetFirewallRule -DisplayName "DSH Web Tailscale" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow` |
+| The phone shows 401 | `autoToken` is off; open the link with `?token=` once |
+| The page opens on the phone but API calls return 403 | You are using a different host name or address (for example a renaming reverse proxy); add `--trusted-host` or use the address the plugin prints |
+| You want another port | Change `port`, or run `dsh --profile web --port 8080` (the plugin follows the loopback port by default) |
+
+## Picking up code changes
+
+- `client.js` (the settings row): just refresh the page — the browser re-fetches plugin assets.
+- `index.js` (the proxy half): ESM modules are cached, so **dsh must be restarted** (or the bundle disabled and
+  re-enabled on the Plugins page) before the new code loads. Run `node test/smoke.mjs` before changing it, and do not
+  feed broken code to a running server.
+
+## Known limits
+
+- Only IPv4 tailnet addresses are supported (Tailscale always assigns one in `100.64.0.0/10`).
+- The phone gets plain HTTP, which is not a secure context (Tailscale HTTPS certificates need another mechanism,
+  such as `tailscale serve`). The features tested here are unaffected, but browser APIs that require a secure
+  context (for example Service Workers) are unavailable.
+- The address is detected once at startup; after Tailscale changes it, dsh must be restarted (or the plugin row
+  reloaded).

package/README.md

@@ -1,3 +1,132 @@
-# Temporary Holding Version
+# dsh-simple-remote
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[English](README.en.md) | 中文
+
+只用一个插件就可以手机也访问到DSH。安装即用，不用配置。
+
+只使用Tailscale，安装了这个软件的设备就组网了，可以互相访问。
+把 DeepSeek Harness 的网页界面（`dsh --profile web` 的 GUI）**只**开放给本机的 Tailscale tailnet：
+在 Tailscale 网卡地址上另开一个监听端口，反向代理到本机回环上的 GUI。
+于是「连上 Tailscale 的手机」直接打开网页就能用，而局域网、WSL、虚拟网卡上的其他设备连端口都看不到。
+
+## 它做什么
+
+```
+手机 (Tailscale)  ──►  100.x.y.z:3080  ┐
+                                        │ dsh-simple-remote 反向代理（改写 Host/Origin 为回环）
+本机浏览器        ──►  127.0.0.1:3080  ─┴─►  dsh 自带的 Web 服务（保持只监听回环）
+```
+
+- **不改变** dsh 自带 Web 服务的绑定：它仍然只监听 `127.0.0.1`，LAN 与虚拟网卡都不会被暴露。
+- **不放宽**自带的 Host/Origin 防护栅栏：代理把转发请求的 Host 改写为回环地址，因此没有新增任何「受信域名」；
+  `Origin` 仅在它与收到的请求同源时才改写，跨站请求保留原 Origin 并被栅栏拒绝（403）。
+- **保留**自带认证：会话 cookie、`/api` 令牌校验全部照旧，只是由代理代为完成首次登录（`autoToken`）。
+- WebSocket（终端、远程流）与 SSE 事件流按原样透传。
+
+## 安装
+
+npm（默认）
+
+```
+dsh plugin --profile web add @ivanant/dsh-simple-remote@latest
+```
+
+Github方式
+
+```
+dsh plugin --profile web add github:ivanant/dsh-simple-remote
+```
+
+或在 Web 界面「插件」页里安装这个包名 `dsh-simple-remote`。
+
+安装后：
+
+- 新增 Loader 行 `simple-remote`（包名 `dsh-simple-remote`）。
+- 启动日志里会出现一行：
+  `dsh web: tailnet http://100.111.128.100:3080 (Tailscale; auto-login)`
+- 设置 → 通用 里多出一行「手机访问（Tailscale）」，显示地址并可一键复制。
+
+装完后**手机端**：连上 Tailscale，直接打开 `http://<你的 tailnet 地址>:3080/` 即可。
+首次访问时插件自动完成登录（见下），浏览器随后记住 30 天。
+
+## 配置
+
+安装后直接使用就行。特殊情况可以配置：
+
+行配置写在 `cordis.patch.yml` 里（安装后是 `~/.dsh/profiles/web/node_modules/dsh-simple-remote/cordis.patch.yml`，
+也可以用 profile 自己的 patch 层覆盖，注意 patch 是整体替换 `config`，要保留的键都得重写）：
+
+```yaml
+- id: simple-remote
+  name: dsh-simple-remote
+  config:
+    enabled: true # false = 完全关闭，不监听任何 tailnet 端口
+    autoToken: true # 见「安全」一节
+    address: "" # 留空 = 自动探测 Tailscale 地址（100.64.0.0/10）；也可写死地址或 MagicDNS 名
+    port: 0 # 0 = 与回环 GUI 同端口（默认 3080）
+    log: true # 是否把地址行同时打印到 dsh 进程输出
+```
+
+## 安全
+
+`autoToken: true`（默认）意味着：**能连上这个端口的人，就等于拿到了这台机器的完全控制权**（可执行任意命令）。
+边界因此完全落在 Tailscale 上——只有你自己的 tailnet 设备能连上，Tailscale 的 ACL / 设备授权就是这道门。
+如果你在共享 tailnet（团队、家人）里，建议改成 `autoToken: false`：
+
+```yaml
+- id: simple-remote
+  name: dsh-simple-remote
+  config:
+    autoToken: false
+```
+
+此时手机必须打开带 `?token=…` 的完整链接（启动日志 / 设置页可复制），行为与回环地址完全一致；
+不知道令牌的 tailnet 设备只会收到 401。
+
+无论哪种模式，端口都只绑在 Tailscale 地址上，`0.0.0.0` 从未被使用，
+所以局域网 / 公共网络里的设备无法访问（这也是 dsh 官方拒绝 `--host 0.0.0.0` 的那条红线）。
+
+## 验证
+
+`node test/smoke.mjs` 会在 Harness 之外跑一遍插件本体（共 13 项）：浏览器半段的工厂与渲染（自动登录 / 令牌 / 关闭三种状态 + 复制按钮）、
+代理的令牌跳转、cookie 透传、`/api` 的 Host/Origin 改写、跨站 Origin 保持原样、WebSocket 升级、页面状态注入、以及卸载时关闭监听。
+
+装到活的 Harness 之后也实测过（本机经 Tailscale 地址访问）：
+
+| 检查                                                | 结果                                                                 |
+| --------------------------------------------------- | -------------------------------------------------------------------- |
+| 监听地址                                            | `100.111.128.100:3080`（插件）+ `127.0.0.1:3080`（dsh 自带，未改动） |
+| 无 cookie 的导航（带 `Sec-Fetch-Mode: navigate`）   | 200，返回 35 KB 首页，并拿到 `dsh-auth-…` 会话 cookie                |
+| `POST /api/<未知端点>`（带 cookie）                 | 404 —— 说明 Host/Origin 栅栏与认证都通过了                           |
+| 同上但无 cookie                                     | 401                                                                  |
+| 同上但 `Origin: https://evil.example`               | 403                                                                  |
+| 插件资源 `plugins/??dsh-simple-remote/client.js`    | 200                                                                  |
+| WebSocket `GET /api/remote.mux`（带 cookie / 不带） | 101 / 401                                                            |
+| 回环地址 `http://127.0.0.1:3080/`（无 cookie）      | 401，与装插件前一致                                                  |
+
+未能在此机器上验证的只有一项：**另一台设备（手机）经网络真实连入**——本机防火墙规则需要管理员权限才能查看。
+若手机超时，见下面的排错表。
+
+## 排错
+
+| 现象                                     | 处理                                                                                                                                                                                                                                                                                                                                                                           |
+| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 手机连不上、本机也访问不了该地址         | 看 dsh 日志里有没有 `simple-remote: ... listener failed`；确认 Tailscale 已连接且本机有 `100.x.y.z` 地址                                                                                                                                                                                                                                                                       |
+| 日志里出现「no Tailscale address found」 | Tailscale 未运行，或地址不在 `100.64.0.0/10`；用 `address` 配置写死地址                                                                                                                                                                                                                                                                                                        |
+| 本机可访问、手机超时                     | Windows 防火墙拦了入站。管理员 PowerShell 里执行（把 `<node.exe 路径>` 换成 `where.exe node` 的结果）：`New-NetFirewallRule -DisplayName "DSH Tailscale Remote" -Direction Inbound -Program "<node.exe 路径>" -Action Allow -Profile Any`；或只放行端口：`New-NetFirewallRule -DisplayName "DSH Web Tailscale" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow` |
+| 手机打开是 401                           | `autoToken` 被关掉了；用带 `?token=` 的链接打开一次                                                                                                                                                                                                                                                                                                                            |
+| 手机页面能开但接口 403                   | 你在用别的域名/地址访问（例如反向代理改名）；请加 `--trusted-host` 或改用插件打印的地址                                                                                                                                                                                                                                                                                        |
+| 想换端口                                 | 改 `port`，或用 `dsh --profile web --port 8080`（回环换端口后插件默认跟随）                                                                                                                                                                                                                                                                                                    |
+
+## 改代码后如何生效
+
+- `client.js`（设置页那一行）：改完刷新页面即可，浏览器会重新拉取插件资源。
+- `index.js`（代理那一半）：ESM 模块有缓存，**必须重启 dsh**（或在插件页里禁用再启用该 bundle）才会加载新代码；
+  所以改动前先跑 `node test/smoke.mjs` 自检，别把坏代码喂给正在跑的服务。
+
+## 已知边界
+
+- 只支持 IPv4 的 tailnet 地址（Tailscale 一定会分配一个 `100.64.0.0/10` 地址）。
+- 手机上是普通 HTTP，不是安全上下文（Tailscale 的 HTTPS 证书需要另一套机制，例如 `tailscale serve`）；
+  测过的功能不受影响，但浏览器 API 里要求安全上下文的能力（如 Service Worker）不可用。
+- 只在启动时探测一次地址；Tailscale 换地址后需要重启 dsh（或重载该插件行）。

package/client.js

@@ -0,0 +1,136 @@
+/**
+ * Browser half of dsh-simple-remote: the General-settings row that shows the
+ * tailnet address of this harness and copies it.
+ *
+ * The host half injects `globalThis.__DSH_SIMPLE_REMOTE__` into the page
+ * (`webserver/index-inject`), so the row needs no RPC: it renders nothing when
+ * that state is absent, which is the case for every deployment without a
+ * Tailscale address.
+ */
+window.__ModuleLoader__.load({
+	id: 'dsh-simple-remote',
+	factory(require) {
+		const React = require('react')
+		const h = React.createElement
+		const NS = 'simple-remote'
+
+		const zh = {
+			title: '手机访问（Tailscale）',
+			autoDesc: '同一 tailnet 内的手机可直接打开下面的地址，登录由插件自动完成。',
+			tokenDesc: '请在手机上打开下面这条带令牌的链接；登录后浏览器会记住 30 天。',
+			copy: '复制',
+			copied: '已复制',
+			copyToken: '复制带令牌的链接',
+		}
+		const en = {
+			title: 'Mobile access (Tailscale)',
+			autoDesc: 'A phone on the same tailnet can open the address below; the plugin signs it in automatically.',
+			tokenDesc: 'Open the tokenized link below on the phone; the browser then remembers it for 30 days.',
+			copy: 'Copy',
+			copied: 'Copied',
+			copyToken: 'Copy tokenized link',
+		}
+
+		const CSS_ID = 'dsh-simple-remote/RemoteAccessRow.css'
+		const css = [
+			'.dsr-row{border-bottom:.5px solid var(--dsw-alias-border-l2);padding:16px 0}',
+			'.dsr-title{font-size:14px;line-height:20px;color:var(--dsw-alias-label-primary)}',
+			'.dsr-desc{color:var(--dsw-alias-label-secondary);margin-top:4px;font-size:12px;line-height:18px}',
+			'.dsr-line{display:flex;align-items:center;gap:8px;margin-top:8px;flex-wrap:wrap}',
+			'.dsr-url{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;line-height:18px;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);border-radius:6px;padding:4px 8px;color:var(--dsw-alias-label-primary);word-break:break-all}',
+			'.dsr-button{font-size:12px;line-height:18px;padding:4px 10px;border-radius:6px;border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);cursor:pointer;font-family:inherit}',
+			'.dsr-button:hover{border-color:var(--dsw-alias-brand-primary);color:var(--dsw-alias-brand-primary)}',
+			'.dsr-secondary{margin-top:8px}',
+		].join('')
+		if (typeof document !== 'undefined' && document.querySelector('style[data-plugin-css=' + JSON.stringify(CSS_ID) + ']') === null) {
+			const tag = document.createElement('style')
+			tag.dataset.plugin = 'dsh-simple-remote'
+			tag.dataset.pluginCss = CSS_ID
+			tag.textContent = css
+			document.head.appendChild(tag)
+		}
+
+		/** Copy through the async clipboard, falling back to the selection command. */
+		function copyText(text) {
+			const clipboard = typeof navigator === 'undefined' ? undefined : navigator.clipboard
+			if (clipboard !== undefined && typeof clipboard.writeText === 'function') return clipboard.writeText(text)
+			return new Promise((resolve, reject) => {
+				try {
+					const area = document.createElement('textarea')
+					area.value = text
+					area.setAttribute('readonly', '')
+					area.style.position = 'fixed'
+					area.style.top = '-1000px'
+					area.style.opacity = '0'
+					document.body.appendChild(area)
+					area.select()
+					const copied = document.execCommand('copy')
+					document.body.removeChild(area)
+					if (copied) resolve()
+					else reject(new Error('copy refused'))
+				} catch (error) {
+					reject(error)
+				}
+			})
+		}
+
+		/** One General-settings row: the tailnet address and its copy control. */
+		function RemoteAccessRow(props) {
+			const t = typeof props.t === 'function' ? props.t : (key) => en[key] ?? key
+			const state = globalThis.__DSH_SIMPLE_REMOTE__
+			const [copied, setCopied] = React.useState('')
+			const timer = React.useRef(0)
+			React.useEffect(() => () => {
+				if (timer.current !== 0) clearTimeout(timer.current)
+			}, [])
+			if (state === null || state === undefined || state.enabled !== true) return null
+			const urls = Array.isArray(state.urls) ? state.urls : []
+			if (urls.length === 0) return null
+			const auto = state.autoToken === true
+			const primary = urls[0]
+			const tokenUrl = typeof state.loginUrl === 'string' ? state.loginUrl : primary
+			const copy = (value, which) => {
+				copyText(value).then(() => {
+					setCopied(which)
+					if (timer.current !== 0) clearTimeout(timer.current)
+					timer.current = setTimeout(() => setCopied(''), 1600)
+				}).catch(() => {})
+			}
+			const rows = [
+				h('div', { className: 'dsr-title', key: 'title' }, t('title')),
+				h('div', { className: 'dsr-desc', key: 'desc' }, auto ? t('autoDesc') : t('tokenDesc')),
+				h('div', { className: 'dsr-line', key: 'line' }, [
+					h('code', { className: 'dsr-url', key: 'url' }, auto ? primary : tokenUrl),
+					h('button', {
+						className: 'dsr-button',
+						type: 'button',
+						key: 'copy',
+						onClick: () => copy(auto ? primary : tokenUrl, 'main'),
+					}, copied === 'main' ? t('copied') : t('copy')),
+				]),
+			]
+			if (!auto) {
+				rows.push(h('button', {
+					className: 'dsr-button dsr-secondary',
+					type: 'button',
+					key: 'token',
+					onClick: () => copy(tokenUrl, 'token'),
+				}, copied === 'token' ? t('copied') : t('copyToken')))
+			}
+			return h('div', { className: 'dsr-row' }, rows)
+		}
+
+		return {
+			inject: ['slots', 'locale'],
+			apply(ctx) {
+				ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'simple-remote: dictionaries')
+				ctx.slots.inject('settings.general.item', () => ctx.slots.register({
+					name: 'settings.general.item',
+					id: 'simple-remote',
+					order: 95,
+					locale: NS,
+				}, RemoteAccessRow))
+			},
+		}
+	},
+})

package/cordis.patch.yml

@@ -0,0 +1,30 @@
+# The dsh-simple-remote bundle patch: a tailnet-only listener beside the
+# loopback Web GUI, plus the settings row that shows its address.
+#
+# `enabled` turns the whole bridge off; `autoToken` completes the login for a
+# phone navigation; `address` overrides Tailscale detection; `port` mirrors the
+# loopback GUI's port when it is 0.
+#
+# A patch replaces the targeted row's whole `config`, never merges it, so an
+# override in the profile's own cordis.patch.yml restates every key it keeps:
+#
+#   - id: simple-remote
+#     name: dsh-simple-remote
+#     config:
+#       autoToken: false
+
+- insert:
+    - id: simple-remote
+      name: dsh-simple-remote
+      config:
+        enabled: true
+        # On: a phone on the tailnet opens the plain address and is signed in.
+        # Off: the printed `?token=…` URL is required, as on loopback.
+        autoToken: true
+        # Empty: detect the Tailscale address. Set one to pin a MagicDNS name
+        # or an address the interface scan does not see.
+        address: ''
+        # 0: mirror the loopback GUI's port.
+        port: 0
+        # Mirror the URL lines to the dsh process output.
+        log: true

package/icon.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Tailscale remote access">
+  <rect x="2" y="2" width="60" height="60" rx="14" fill="#1f6feb"/>
+  <g fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round" stroke-linejoin="round">
+    <circle cx="20" cy="42" r="6"/>
+    <circle cx="44" cy="22" r="6"/>
+    <path d="M25 38 L39 26"/>
+    <path d="M14 30 A18 18 0 0 1 30 14"/>
+    <path d="M50 34 A18 18 0 0 1 34 50"/>
+  </g>
+  <circle cx="52" cy="12" r="4" fill="#ffffff"/>
+</svg>

package/index.js

@@ -0,0 +1,341 @@
+/**
+ * dsh-simple-remote — serve the DeepSeek Harness Web GUI to a Tailscale tailnet.
+ *
+ * The shipped Web composition binds `@deepseek-ai/dsh-host-webserver` to a
+ * loopback-only host (`host` accepts exactly `127.0.0.1` or `0.0.0.0`), and its
+ * `/api` browser-trust fence admits loopback or declared authorities. Neither
+ * expresses "reachable by my own tailnet and by nothing else", so this plugin
+ * adds that missing posture without weakening either one:
+ *
+ * - A second listener, bound to the machine's Tailscale address only, reverse
+ *   proxies every request to the loopback GUI. The LAN, WSL and virtual-switch
+ *   addresses never listen, so nothing off the tailnet can even open a socket.
+ * - Forwarded requests keep their path, body, cookies and streaming semantics.
+ *   The proxy rewrites the upstream authority to the loopback GUI, which keeps
+ *   the shipped Host/Origin fence exactly as strict as before (no authority is
+ *   granted), and rewrites `Origin` only when it was same-origin with the
+ *   request it received — a cross-site request keeps its foreign Origin and is
+ *   refused by the fence.
+ * - `autoToken` (on by default) completes the launch-token exchange for a
+ *   browser navigation that has no session cookie yet, so a phone on the
+ *   tailnet can open the plain `http://<tailnet-address>:<port>/` address.
+ *   With `autoToken: false` the printed `?token=…` URL is required, and the
+ *   tailnet behaves exactly like the loopback address does.
+ *
+ * @module dsh-simple-remote
+ */
+
+import { createHash } from 'node:crypto'
+import { createServer, request as httpRequest } from 'node:http'
+import { connect as netConnect } from 'node:net'
+import { networkInterfaces } from 'node:os'
+
+/** Stable Cordis plugin name. */
+export const name = 'simple-remote'
+
+/** The listener needs the composed Web server (its port and its loopback bind). */
+export const inject = ['webServer']
+
+/** The loopback literal the shipped Web composition binds. */
+const LOOPBACK = '127.0.0.1'
+/** Tailscale's CGNAT range, 100.64.0.0/10: the addresses the tailnet hands out. */
+const TAILNET_V4 = /^100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./
+/** Interface-name hint for tailnets whose addresses are not in the CGNAT range. */
+const TAILNET_INTERFACE = /^tailscale/i
+/** Browser-session cookie prefix owned by `@deepseek-ai/dsh-client-connection`. */
+const COOKIE_PREFIX = 'dsh-auth-'
+/** Request headers that describe one hop and must not be forwarded verbatim. */
+const HOP_BY_HOP = ['connection', 'keep-alive', 'proxy-connection', 'transfer-encoding', 'upgrade', 'expect']
+
+/**
+ * Resolve the row config, applying defaults without a schema dependency.
+ * @param config - the raw row config from the bundle patch.
+ * @returns normalized options.
+ */
+function readOptions(config) {
+	const source = config ?? {}
+	return {
+		enabled: source.enabled !== false,
+		/** Explicit tailnet address; empty means detect from the interfaces. */
+		address: typeof source.address === 'string' ? source.address.trim() : '',
+		/** Tailnet port; 0 (the default) mirrors the loopback GUI's port. */
+		port: Number.isInteger(source.port) && source.port >= 0 && source.port <= 65535 ? source.port : 0,
+		/** Complete the launch-token exchange for a cookieless browser navigation. */
+		autoToken: source.autoToken !== false,
+		/** Mirror the plugin's URL lines to stdout. */
+		log: source.log !== false,
+	}
+}
+
+/**
+ * Tailnet IPv4 addresses of this machine, in interface order.
+ * @param explicit - a configured address, which replaces detection entirely.
+ * @returns the addresses a listener should bind, deduplicated.
+ */
+function detectAddresses(explicit) {
+	if (explicit !== '') return [explicit]
+	const found = []
+	for (const [iface, list] of Object.entries(networkInterfaces())) {
+		for (const info of list ?? []) {
+			if (info.family !== 'IPv4' || info.internal) continue
+			if (TAILNET_V4.test(info.address) || TAILNET_INTERFACE.test(iface)) found.push(info.address)
+		}
+	}
+	return [...new Set(found)]
+}
+
+/** Bracket an IPv6 literal so it composes into a URL authority. */
+function formatHost(address) {
+	return address.includes(':') ? `[${address}]` : address
+}
+
+/** The `dsh-auth-…` cookie name this deployment's loopback authority mints. */
+function sessionCookieName(upstreamPort) {
+	const digest = createHash('sha256').update(`${LOOPBACK}:${upstreamPort}`).digest('base64url')
+	return `${COOKIE_PREFIX}${digest}`
+}
+
+/** Whether the request already carries a browser-session cookie for this GUI. */
+function hasSessionCookie(request, upstreamPort) {
+	const cookie = request.headers.cookie
+	return typeof cookie === 'string' && cookie.includes(`${sessionCookieName(upstreamPort)}=`)
+}
+
+/** Whether the request is a browser navigation, the only flow `autoToken` helps. */
+function isNavigation(request) {
+	if (request.method !== 'GET') return false
+	const mode = request.headers['sec-fetch-mode']
+	if (typeof mode === 'string') return mode === 'navigate'
+	const accept = request.headers.accept
+	return typeof accept === 'string' && accept.includes('text/html')
+}
+
+/** The process launch token, read from the live Connection service. */
+function launchToken(ctx, upstreamPort) {
+	const connection = ctx.get('connection')
+	if (connection === undefined) return undefined
+	try {
+		const url = new URL(connection.authenticatedUrl(`http://${LOOPBACK}:${upstreamPort}`))
+		return url.searchParams.get('token') ?? undefined
+	} catch {
+		return undefined
+	}
+}
+
+/** Add the launch token to a base URL. */
+function withToken(base, token) {
+	return token === undefined ? base : `${base}?token=${encodeURIComponent(token)}`
+}
+
+/**
+ * Rewrite the forwarded authority to the loopback GUI.
+ *
+ * `Origin` is rewritten only when it named the authority this request arrived
+ * on (a same-origin browser request); anything else keeps its value so the
+ * shipped fence can reject it.
+ * @param headers - the mutable headers about to be forwarded.
+ * @param request - the request as received on the tailnet listener.
+ * @param upstreamPort - the loopback GUI port.
+ */
+function rewriteAuthority(headers, request, upstreamPort) {
+	const received = request.headers.host
+	const origin = headers.origin
+	if (typeof origin === 'string') {
+		try {
+			if (new URL(origin).host === received) headers.origin = `http://${LOOPBACK}:${upstreamPort}`
+		} catch {
+			/* An unparsable Origin keeps its value and is refused downstream. */
+		}
+	}
+	headers.host = `${LOOPBACK}:${upstreamPort}`
+}
+
+/** Forward one HTTP request to the loopback GUI. */
+function forwardRequest(ctx, state, request, response) {
+	const headers = { ...request.headers }
+	rewriteAuthority(headers, request, state.upstreamPort)
+	for (const header of HOP_BY_HOP) delete headers[header]
+
+	const upstream = httpRequest({
+		host: LOOPBACK,
+		port: state.upstreamPort,
+		method: request.method,
+		path: request.url,
+		headers,
+	}, (upstreamResponse) => {
+		upstreamResponse.on('error', () => response.destroy())
+		response.writeHead(upstreamResponse.statusCode ?? 502, upstreamResponse.headers)
+		upstreamResponse.pipe(response)
+	})
+	upstream.on('error', (error) => {
+		ctx.logger.warn(`simple-remote: tailnet proxy could not reach ${LOOPBACK}:${state.upstreamPort} (${error.code ?? error.message})`)
+		if (response.headersSent) {
+			response.destroy()
+			return
+		}
+		response.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })
+		response.end('simple-remote: the Harness Web server on the loopback address is unreachable.\n')
+	})
+	request.on('error', () => upstream.destroy())
+	response.on('error', () => upstream.destroy())
+	response.on('close', () => upstream.destroy())
+	request.pipe(upstream)
+}
+
+/** Forward one WebSocket handshake and then the raw socket both ways. */
+function forwardUpgrade(ctx, state, request, socket, head) {
+	const headers = { ...request.headers }
+	rewriteAuthority(headers, request, state.upstreamPort)
+	delete headers['proxy-connection']
+
+	const upstream = netConnect(state.upstreamPort, LOOPBACK, () => {
+		const lines = [`${request.method ?? 'GET'} ${request.url ?? '/'} HTTP/1.1`]
+		for (const [key, value] of Object.entries(headers)) {
+			if (value === undefined) continue
+			if (Array.isArray(value)) for (const item of value) lines.push(`${key}: ${item}`)
+			else lines.push(`${key}: ${value}`)
+		}
+		upstream.write(`${lines.join('\r\n')}\r\n\r\n`)
+		if (head !== undefined && head.length > 0) upstream.write(head)
+		upstream.pipe(socket)
+		socket.pipe(upstream)
+	})
+	const fail = (error) => {
+		ctx.logger.warn(`simple-remote: tailnet upgrade proxy failed (${error.code ?? error.message})`)
+		socket.destroy()
+		upstream.destroy()
+	}
+	upstream.on('error', fail)
+	socket.on('error', fail)
+	socket.on('close', () => upstream.destroy())
+	upstream.on('close', () => socket.destroy())
+}
+
+/** The value the browser page reads to render its remote-access row. */
+function clientState(state) {
+	const base = state.urls[0]
+	return {
+		enabled: true,
+		autoToken: state.autoToken,
+		urls: [...state.urls],
+		loginUrl: base === undefined ? undefined : withToken(base, state.token),
+	}
+}
+
+/** Print the remote-access lines once per fact, to the log and to stdout. */
+function announceBase(ctx, state) {
+	if (state.announcedBase || state.urls.length === 0) return
+	state.announcedBase = true
+	const line = `dsh web: tailnet ${state.urls[0]}${state.autoToken ? ' (Tailscale; auto-login)' : ''}`
+	ctx.logger.info(line)
+	if (state.log) console.log(line)
+}
+
+/** Print the tokenized remote URL once the launch token is known. */
+function announceToken(ctx, state) {
+	if (state.announcedToken || state.urls.length === 0 || state.token === undefined) return
+	state.announcedToken = true
+	const line = `dsh web: tailnet with token ${withToken(state.urls[0], state.token)}`
+	ctx.logger.info(line)
+	if (state.log) console.log(line)
+}
+
+/**
+ * Mount the tailnet bridge: one listener per tailnet address, the launch-token
+ * handshake for cookieless navigations, and the page state the Client half reads.
+ * @param ctx - the plugin context carrying `webServer`.
+ * @param config - the row config.
+ */
+export function apply(ctx, config) {
+	const options = readOptions(config)
+	if (!options.enabled) return
+
+	const upstreamPort = ctx.webServer.port
+	if (upstreamPort === undefined) {
+		ctx.logger.warn('simple-remote: the Web server has no listening port yet; no tailnet listener started')
+		return
+	}
+
+	const addresses = detectAddresses(options.address)
+	if (addresses.length === 0) {
+		ctx.logger.warn('simple-remote: no Tailscale address found on this machine; is Tailscale connected? no tailnet listener started')
+		return
+	}
+
+	const state = {
+		upstreamPort,
+		autoToken: options.autoToken,
+		log: options.log,
+		token: undefined,
+		urls: [],
+		announcedBase: false,
+		announcedToken: false,
+	}
+	const servers = []
+	// Upgraded sockets outlive their request, so disposal has to end them too.
+	const upgradedSockets = new Set()
+
+	for (const address of addresses) {
+		const server = createServer((request, response) => {
+			// The first navigation of a device that holds no session cookie gets
+			// the launch token, which mints the cookie for this authority.
+			if (options.autoToken && isNavigation(request) && state.token !== undefined) {
+				let direct
+				try {
+					direct = new URL(request.url ?? '/', 'http://dsh.invalid')
+				} catch {
+					direct = undefined
+				}
+				if (direct !== undefined && direct.pathname === '/' && !direct.searchParams.has('token') && !hasSessionCookie(request, upstreamPort)) {
+					response.writeHead(302, {
+						location: `/?token=${encodeURIComponent(state.token)}`,
+						'cache-control': 'no-store',
+						'referrer-policy': 'no-referrer',
+					})
+					response.end()
+					return
+				}
+			}
+			forwardRequest(ctx, state, request, response)
+		})
+		server.on('upgrade', (request, socket, head) => {
+			upgradedSockets.add(socket)
+			socket.once('close', () => upgradedSockets.delete(socket))
+			forwardUpgrade(ctx, state, request, socket, head)
+		})
+		server.on('error', (error) => {
+			ctx.logger.warn(`simple-remote: tailnet listener on ${address} failed (${error.code ?? error.message})`)
+		})
+		server.listen(options.port > 0 ? options.port : upstreamPort, address, () => {
+			const assigned = server.address()
+			const port = typeof assigned === 'object' && assigned !== null ? assigned.port : state.upstreamPort
+			state.urls.push(`http://${formatHost(address)}:${port}/`)
+			announceBase(ctx, state)
+		})
+		servers.push(server)
+	}
+
+	ctx.effect(() => () => {
+		for (const socket of upgradedSockets) socket.destroy()
+		upgradedSockets.clear()
+		for (const server of servers) {
+			// Idle keep-alive sockets would otherwise hold `close()` open forever.
+			server.close()
+			server.closeAllConnections?.()
+		}
+	}, 'simple-remote: tailnet listeners')
+
+	ctx.on('webserver/index-inject', (table) => {
+		table.push({ kind: 'global', name: '__DSH_SIMPLE_REMOTE__', value: clientState(state) })
+	})
+
+	// The launch token lives in the Connection service, which may activate
+	// before or after this row; resolve it whenever it appears.
+	ctx.inject(['connection'], (connectionCtx) => {
+		state.token = launchToken(connectionCtx, upstreamPort)
+		announceToken(connectionCtx, state)
+		if (state.token === undefined) {
+			ctx.logger.warn('simple-remote: Connection exposed no launch token; auto-login stays inactive')
+		}
+	})
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Simple Remote",
+    "description": "Serve the Web GUI to your own tailnet only: a Tailscale-bound listener proxies to the loopback server, so a phone with Tailscale can open the page."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "简易远程访问",
+    "description": "只对自有 tailnet 提供网页界面：在 Tailscale 网卡上开一个监听端口，反向代理到本机回环服务，手机连上 Tailscale 即可打开网页。"
+  }
+}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "dsh-simple-remote",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "private": false,
+  "type": "module",
+  "description": "Expose the DeepSeek Harness Web GUI to your Tailscale tailnet, and to nothing else.",
+  "license": "MIT",
+  "author": "Ivan Lam",
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "tailscale",
+    "remote-access"
+  ],
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "icon": "./icon.svg",
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "icon.svg",
+    "locale/*.json",
+    "README.md",
+    "README.en.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true
+    }
+  }
+}