Skip to content
dsh.fish
Bundle

dsh-secure-context-fix

Fix the DeepSeek Harness Web GUI over plain HTTP on a LAN: injects a crypto.randomUUID polyfill (getRandomValues-backed) before dsh bundle code runs. No official source changes needed.

Source
Li-Mingshuang
License
MIT
Updated
Updated yesterday

Readme

# dsh-secure-context-fix

> Fix the DeepSeek Harness Web GUI over plain HTTP on a LAN (e.g. from a phone).

## Problem

`crypto.randomUUID` only exists in **secure contexts** (HTTPS or `localhost`).
When you open the dsh Web GUI from another device over plain HTTP on your LAN
(`http://192.168.x.x:3080`), the browser has no `crypto.randomUUID`, so every
RPC crashes with:

```
crypto.randomUUID is not a function
```

Symptoms: workspace list never loads, the directory picker fails, sessions
cannot be created — while `http://127.0.0.1:3080` works fine on the same
machine.

## How this plugin fixes it

This plugin is a small **host plugin** that registers a `webServer.tapIndex`
transform. When the GUI serves its `index.html`, the plugin injects a tiny
inline `<script>` into `<head>` that installs a `crypto.randomUUID`
implementation backed by `crypto.getRandomValues()` — which browsers *do*
expose on insecure origins — **before any dsh bundle code runs**.

No official source changes, no polyfill library, no build step for users.

## Install

From the directory containing this package (after cloning):

```sh
dsh plugin --profile web add ./dsh-secure-context-fix
```

Or from a git host:

```sh
dsh plugin --profile web add github:<you>/dsh-secure-context-fix
```

Then restart the profile:

```sh
dsh --profile web
```

> First `add` from a git host may ask you to allow the package's build
> (`allowBuilds`) if a `prepare` script is present; this package ships no
> build step and plain JS, so no allowance is needed.

## How to check it works

1. Serve the GUI on all interfaces so a phone can reach it. The dsh CLI
   rejects `--host 0.0.0.0` for safety, so patch the `webserver` row in the
   profile instead:

   ```yaml
   # $DSH_HOME/profiles/web/cordis.patch.yml
   - id: webserver
     config:
       host: '0.0.0.0'
       port: !!js ctx.webStartup.port ?? 3080
   ```

2. Allow inbound TCP 3080 in the firewall, ideally restricted to your LAN
   subnet:

   ```powershell
   New-NetFirewallRule -DisplayName "dsh web 3080 (LAN)" -Direction Inbound -Protocol TCP -LocalPort 3080 -Action Allow -Profile Private -RemoteAddress 192.168.0.0/24
   ```

3. On the phone (same Wi-Fi) open `http://<your-LAN-IP>:3080`. Workspace
   list, directory picker, and new sessions should now work.

## Files

- `index.js` — the plugin entry (`name`, `inject`, `apply`).
- `cordis.patch.yml` — the bundle layer inserting the plugin row.
- `package.json` — npm manifest declaring `dsh.bundle`.

## Security notes

Binding the GUI to `0.0.0.0` exposes remote-code-execution-grade control of
the agent to anyone who can reach the port. Only do this on a trusted network,
and prefer restricting the firewall rule to your LAN subnet as shown above.

## Upstream

This is a stop-gap for
[deepseek-ai/deepseek-harness discussions #4209](https://github.com/deepseek-ai/deepseek-harness/discussions/4209)
until the official repo replaces its three `crypto.randomUUID()` call sites
(`AbstractApiClient.mintRpcId`, ui-conversation image draft ids, and
`llm createMessage`) with `getRandomValues()`-based UUIDs. If you can patch
the source, do that instead; this plugin helps users who cannot.

Install

dsh plugin --profile web add github:Li-Mingshuang/dsh-secure-context-fix

Profile: web

  • This source has no pinned commit, so a later push upstream changes what installs. Prefer pinning a commit.
Source