dsh-plugins

Where the plugins went

This repository used to be a monorepo that also carried the dsh plugins. Each plugin now lives (and is developed) in its own repository, installable straight from GitHub:

A passkey (WebAuthn) reverse proxy that guards a DeepSeek Harness web app.

Not a cordis plugin — a companion process. dsh's webserver exposes only named routes and a single fallback (owned by the core app); there is no middleware or global gate a plugin could use to guard the UI, RPC, and event websockets. So authentication has to sit in front of dsh web, which is what this does.

Flow

browser ──TLS──> nginx ──> dsh-auth-gateway ──(authed only)──> dsh web (127.0.0.1:3080)
                                │
                                └─ passkey register → pending → `dsh-approve` in a terminal → session cookie

A freshly registered passkey is pending until someone with shell access runs dsh-approve approve <label>. After that it signs in on its own until revoked. The unit of trust is the passkey, not the login, so an expired session cookie is refreshed by re-proving the passkey — no second terminal round trip.

Run

npm install
DSH_GW_RP_ID=example.com DSH_GW_STATE_DIR=/var/lib/dsh-gateway/state node server.js

Then point nginx (which terminates TLS for DSH_GW_RP_ID) at 127.0.0.1:3090, forwarding Host, Origin, and X-Forwarded-For.

Configuration (environment)

Terminal trust management

dsh-approve (run with the same DSH_GW_STATE_DIR) manages which passkeys are trusted:

dsh-approve list                  passkeys awaiting approval (default)
dsh-approve passkeys              all passkeys with status
dsh-approve approve <id|label>    trust a passkey — it can sign in from now on
dsh-approve reject  <id|label>    refuse a not-yet-trusted passkey (deletes it)
dsh-approve revoke  <id|label>    withdraw trust; every session it minted dies too
dsh-approve sessions             active browser sessions
dsh-approve session-revoke <sid> drop one session (passkey stays trusted)
dsh-approve cleanup              remove expired pending logins / sessions