@local/dsh-deepseek-web

Unofficial community plugin. Not affiliated with DeepSeek. It uses a normal DeepSeek web account and does not bypass sign-in, quotas or paid plans.

Features

• Button sits directly above the Workspace section and follows DSH sidebar tokens.
• Uses an isolated Electron webview, not an iframe, so X-Frame-Options is not a problem.
• Follows the DSH light/dark theme.
• Saves the DeepSeek web sign-in locally and restores it on a same-origin warmup page before the chat app boots, so an existing session does not flash a login screen.
• Avoids DeepSeek's repeated “abnormal usage environment” advisory by writing its own closeUnsafeEnvWarn preference on a same-origin page before the chat app boots (the same state its X button writes). It does not spoof the User-Agent or change the actual isolation. The advisory is DeepSeek's warning about non-official embedding; use the official web/app if you do not accept it.
• Closing the panel keeps the DeepSeek tab and page state; reopening returns to the same page.
• No Host routes, no Harness API-key access, no model-facing tools.

Requirements

• DSH Desktop with the right Sidebar and Electron webview support.
• Tested with DSH Desktop 0.2.1-rc.3 on Windows.
• Web-only DSH cannot run this plugin: the button is disabled without an isolated webview.
• No build step and no runtime npm dependencies.

Install

1. Download or clone this repository to a stable folder.
2. Install the folder through DSH Desktop's plugin manager (“install from local directory”), if available, or follow the manual install guide.
3. Fully quit and relaunch DSH Desktop.
4. Open a session and click DeepSeek Web above Workspace.

The manual path links this repository to:

<DSH_HOME>/profiles/desktop/node_modules/@local/dsh-deepseek-web

and adds @local/dsh-deepseek-web to the profile's dsh.profile.bundles.

The package name @local/dsh-deepseek-web is the local DSH bundle identity; this project is not published to npm. The GitHub repository name can differ (for example dsh-deepseek-web-dock).

Usage

1. Open any session (an empty one is created if needed).
2. Single click for half width; double click within 175 ms for fullscreen.
3. Sign in to DeepSeek once in the embedded page.
4. Single click again or press Esc to collapse the Sidebar.
5. Click the button again to return to the same page without reloading.

The 175 ms check means a single click is intentionally delayed before it opens or closes the panel.

How it works

Workspace button
   │  click / 175 ms decision
   ├── single → openTab + normal half-width layout
   ├── double → openTab + fullscreen
   └── open + click / Esc → click native collapse control → slide-out
                                      │
                                      └── webview stays mounted, state preserved

• Host half: empty Cordis bundle entry.
• Client half: injects the button, registers the deepseek-web Sidebar tab and hosts chat.deepseek.com through the Desktop browser bridge.
• Webview lifecycle: acquires a guest lease, starts on about:blank#<lease>, loads DeepSeek after dom-ready, releases the lease on unmount.
• Sign-in: reads DeepSeek's own userToken / __appKit_userInfo, stores the logical value in DSH localStorage under dsh.deepseek-web.auth.v1, and restores it after the next load.
• Theme: mirrors DSH dark/light state into the guest.

See docs/ARCHITECTURE.md for details.

Security and privacy

• The web login token is stored only in the local DSH renderer's localStorage.
• The plugin never reads or sends a DeepSeek API key or Harness credentials into the guest.
• The guest runs sandboxed without Node, preload or Harness privileges.
• Web content belongs to DeepSeek; the plugin only hosts and restores the page.

See SECURITY.md.

Limitations

• Desktop only; the Web build has no isolated webview.
• Tested on Windows; macOS/Linux use the same Electron/DOM APIs but have not been verified on-device.
• DSH automatically makes the right Sidebar fullscreen below 768 px, so half width cannot be forced there.
• A double click must finish within 175 ms; slower clicks are treated as two single clicks.
• Login restoration depends on DeepSeek's current storage shape and may break after upstream changes.
• DSH right-Sidebar / webview APIs may change in future major releases.
• No conversation scraping, composer insertion or auto-send.

Development

There is no build step.

npm run check

The check validates the bundle manifest, client loader id, required files and JavaScript syntax without third-party dependencies. CI is in .github/workflows/check.yml.

For a no-Git upload through the GitHub web UI, see the Chinese guide GITHUB_WEB_UPLOAD.md.

License

MIT. The icon and the “store and restore the web sign-in” approach are inspired by S-anZZz/dsh-deepseek-web-sync (MIT). This is an independent implementation without its conversation-capture features.

DeepSeek, DeepSeek Harness and related marks belong to their respective owners.