# dsh-remote-mobile **DeepSeek Harness (DSH) Remote & Mobile Secure Access Proxy Plugin** [![npm version](https://img.shields.io/npm/v/dsh-remote-mobile.svg?style=flat-square&color=3b82f6)](https://www.npmjs.com/package/dsh-remote-mobile) [![npm downloads](https://img.shields.io/npm/dm/dsh-remote-mobile.svg?style=flat-square&color=22c55e)](https://www.npmjs.com/package/dsh-remote-mobile) [![node](https://img.shields.io/badge/node-%3E%3D18.0.0-8b5cf6?style=flat-square)](https://nodejs.org) [![license](https://img.shields.io/npm/l/dsh-remote-mobile.svg?style=flat-square&color=10b981)](https://github.com/IceApriler/dsh-remote-mobile/blob/master/LICENSE) [![DSH](https://img.shields.io/badge/DSH-Web%20Profile-0ea5e9?style=flat-square)](https://github.com/IceApriler/dsh-remote-mobile) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://github.com/IceApriler/dsh-remote-mobile/pulls)

No DSH Source Changes · Secure LAN / Tailscale Access · QR Pairing · Mobile UI Adaptation · Workspace Parity · Real-Time Push

📱 Desktop-grade mobile workspace: create / switch workspaces and run terminal commands on your phone
🛡️ Multi-tier auth: QR pairing · persistent password · passwordless bypass + RSA encryption + brute-force lockout
🎨 Mobile style snippets: three built-in presets, fully customizable with your own CSS

English Documentation · [简体中文](./README.md)

About • Key Advantages • Quick Start • Access Modes • Configuration • UI Preview • Features • Installation & Update • Advanced Configuration • Local File Storage • FAQ

---
## 📖 About `dsh-remote-mobile` is a dedicated remote and mobile security governance plugin designed specifically for **DeepSeek Harness (DSH)**. By default, DSH strictly listens only to the local loopback address (`127.0.0.1`), preventing mobile devices, tablets, or external computers from accessing the Web console. This plugin uses **access control middleware** and **request isolation** to securely open up **Tailscale Private Network** and **Local Area Network (LAN / Wi-Fi)** access, complete with RSA-encrypted login credentials, QR code pairing, persistent password auth, and automated brute-force defense. The plugin does not provide full TLS; use Tailscale or an outer HTTPS proxy for complete transport encryption. When accessed from a phone, the plugin also adapts the DSH interface for **mobile styles**: a collapsible sidebar drawer with a draggable floating toggle, compatibility with the official 3-column Grid layout & right sidebar, a centered/scaled settings dialog, and dense conversation typography — so the mobile experience feels closer to the desktop. --- ## ⚡ Key Advantages * 🚀 **Break Network Barriers with Desktop-Grade Workspace**: For accessing DSH Web over LAN / Tailscale. On mobile devices, **common desktop operations such as creating / switching workspaces and running terminal commands are supported**. * 📱 **Dedicated Mobile Adaptations & Same-Origin Reuse**: Directly reuses the official DSH Web frontend (the very same UI as desktop) and the wider plugin ecosystem (sidebars, task boards, terminal panels, etc.) without maintaining a separate mobile backend. Includes out-of-the-box mobile adaptations (sidebar drawer toggle, centered settings modal, and compact chat font scaling for higher information density), alongside a built-in **Style Snippet Override system** to toggle presets or inject custom CSS snippets on demand. * 🛡️ **Secure Access Proxy & Credential Encryption**: Login credentials use client-side RSA asymmetric encryption, `scrypt` salted slow-hashing password persistence, and automated IP lockout upon consecutive brute-force failures, blocking unauthorized access over public/LAN networks. * 📲 **Quick QR Pairing**: Auto-detects Tailscale CGNAT and LAN IP addresses to generate dedicated pairing QR codes. Scan to open a pre-filled login page; confirm to complete authorization. * 🔄 **SSE Real-Time Push**: Device connection, reconnection, revocation, and IP-lock events are pushed via SSE; the settings page retains low-frequency polling as a fallback. * 🤝 **Generic Plugin Coexistence Protection**: Starts safely alongside other remote/Web access plugins by automatically yielding the shared service; the settings panel shows a conflict banner with a one-click copyable diagnosis & fix report. --- ## 🚀 Quick Start ### 1. One-Command Installation Run the DSH official plugin management command in your terminal (Recommended): ```bash dsh plugin --profile web add dsh-remote-mobile ``` > [!IMPORTANT] > **Ecosystem Plugin Advice**: **Installing `@linxin666/dsh-web-all` (all-in-one package) is not recommended**. We suggest **installing individual standalone plugins on demand**. The all-in-one package bundles multiple frontend modules together, which may result in duplicated mobile floating buttons and conflicting gesture handlers. If you need task boards, pet widgets, or other tools, install their standalone packages directly (see [FAQ Q6](#faq) for the rationale, recommended commands, and coexistence notes). --- ### 2. Configuration (Plugin 1.10.0+ Requires No webserver Config) Plugin 1.10.0+ does not require changes to `webserver` or `cordis.patch.yml`: - DSH 0.2.1+ keeps the default `127.0.0.1:3080`; - this plugin starts the `3081` secure access proxy automatically; - phones connect via QR pairing or the persistent password. > This section applies to plugin 1.10.0+. > **Security Considerations**: The secure access proxy binds to `0.0.0.0:3081` by default without built-in TLS. In public or untrusted networks, use Tailscale (WireGuard encryption) or an outer HTTPS proxy.
Migration for configurations created before plugin 1.9.0 (DSH 0.2.1+) Configurations created before plugin 1.9.0, or configurations that manually set `webserver.host: 0.0.0.0`, require the migration below. Plugin 1.10.0+ can skip this section. DSH 0.2.1+ rejects `0.0.0.0` and fails before plugins load. Remove or comment out the entire `webserver` block: ```yaml # ❌ This fails to start on DSH 0.2.1+ # - id: webserver # host: '0.0.0.0' # ✅ Keep the default loopback listener: # no webserver config is needed; DSH uses 127.0.0.1:3080 # and dsh-remote-mobile uses the 3081 secure access proxy. ``` If unsure about the current config: ```bash grep -n -A5 'id: webserver' ~/.dsh/profiles/web/cordis.patch.yml ``` If `host: '0.0.0.0'` is present, remove that block; otherwise no action is needed. DSH 0.1.7 ~ 0.2.0 may keep `0.0.0.0` and the plugin falls back to `direct` mode; for custom domains or public IPs, configure `trustedHosts`.
If you have installed other plugins that might conflict, we recommend disabling them in `~/.dsh/profiles/web/cordis.patch.yml` (on Windows: `%USERPROFILE%\.dsh\profiles\web\cordis.patch.yml`): ```yaml # (Recommended) Keep only ONE remote/Web access plugin to avoid duplicated entries. # This plugin starts normally alongside other remote-access plugins: when it # detects the shared pairing service is already taken by another plugin, it # yields automatically and shows a warning banner at the top of its settings panel. # Example: disable the legacy remote plugin bundled in @linxin666/dsh-web-ui-all - id: web-ui-remote-web-ui disabled: true ``` > **💡 Note**: Plugin self-registration is automatically handled by the DSH Bundle system. You do **not** need to add `id: remote-mobile` manually. Windows users can press `Win + R` and enter `%USERPROFILE%\.dsh\profiles\web` to quickly jump to the configuration folder. > [!WARNING] > **Installing the all-in-one bundle (`@linxin666/dsh-web-all`) is not recommended**: it compiles the frontend logic of multiple sub-plugins into a single `client.js` that self-executes on load, which may duplicate mobile entry points and cause gesture conflicts with this plugin. Install only the standalone plugins you need (task board, pet, etc.). See [FAQ Q6](#faq) for the full rationale, recommended commands, and coexistence notes. --- ### 3. Launch & Pair ```bash dsh web --no-open ``` Open the DSH Web Console in your browser, navigate to **Settings ⚙️ -> Remote & Mobile Access**, and scan the QR code with your mobile camera or WeChat to open the pairing/login page. After authorization, DSH is ready on mobile. --- ## 🧭 Version & Access Modes Plugin 1.10.0+ uses `proxy` by default and does not require `webserver` configuration: | Scenario | DSH core listener | Effective mode | Phone access | |---|---|---|---| | DSH 0.2.1+ + plugin 1.10.0+ | `127.0.0.1:3080` | `proxy` | `3081` | | DSH 0.1.7 ~ 0.2.0 + `0.0.0.0` config | `0.0.0.0:3080` | `direct` (automatic fallback) | `3080` | | DSH 0.2.1+ + concrete NIC IP | `192.x.x.x:3080` | `direct` | `3080` | | Same-host reverse proxy | `127.0.0.1:3080` + explicit `direct` | `direct` | Proxy entry | - **`proxy`**: recommended; the core stays on loopback and the plugin provides auth/forwarding on `3081`. - **`direct`**: no proxy; the core itself must be externally reachable. Intended for DSH 0.1.7 ~ 0.2.0 `0.0.0.0` configurations or advanced deployments. - **`direct` + loopback core**: DSH only listens on `127.0.0.1`, so phones cannot reach it directly. It only makes sense when a same-host Nginx / Caddy / Tailscale Serve reverse proxy forwards to `3080`; otherwise it is local-only. #### Access Path & Authentication The decision cannot rely on the TCP source IP (socket address) alone: Host and `X-Forwarded-*` also affect the result. `socket IP` is the TCP peer address seen by the server; it is neither Host nor `X-Forwarded-For`. | Access path | Path | Decision | Plugin login | |---|---|---|---| | A Local direct | PC → `127.0.0.1:3081` | Local loopback (loopback) | Not required | | B Phone direct | Phone → `192.x.x.x:3081` / `100.x.x.x:3081` | External direct (external) | Required (can enable `allowLan`/`allowTailscale` bypass) | | C Same-host reverse proxy | Phone → Nginx → `127.0.0.1:3081` | Reverse proxy (reverse-proxy) | Required (no bypass) | “Reverse proxy” here means user-side Nginx / Caddy / Tailscale Serve, not the plugin's `3081` secure access proxy. `127.0.0.1` skips plugin login only for a local direct request with no external Host/Forwarded headers; **there is no switch for this**. Only plugin login is skipped; Host/Origin/CSRF checks still apply. LAN/Tailscale require auth by default, unless `allowLan` / `allowTailscale` is enabled; reverse-proxy traffic does not receive these bypasses.
Expand: request headers, Nginx config, and common mistakes Header examples (A/B/C as in the table): - A: `Host: 127.0.0.1:3081` - B: `Host: 192.x.x.x:3081` or `Host: 100.x.x.x:3081` - C: `Host: dsh.example.com` with `X-Forwarded-For: 100.x.x.x` / `X-Forwarded-Host` / `X-Forwarded-Proto: https` Even though Nginx connects from `127.0.0.1`, case C is treated as reverse-proxy traffic and requires authentication. ```nginx location / { proxy_pass http://127.0.0.1:3081; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Proto $scheme; } ``` Add custom domains to `trustedHosts`: ```json { "trustedHosts": ["dsh.example.com"] } ``` Common mistake: rewriting Host to `127.0.0.1` and stripping all `X-Forwarded-*` makes the plugin treat the request as case A and skip login. Tailscale Serve is also a same-host proxy and must preserve these headers.
--- ## 🖼️ UI Preview ### Desktop DSH Plugin Control Panel | Network Access & QR Pairing | Devices & Security | | :---: | :---: | | ![PC Settings - Network & QR](images/pc-dsh-setting-1.png) | ![PC Settings - Devices & Security](images/pc-dsh-setting-2.png) | | **Style Snippets Override** | **Local Data Storage** | | ![PC Settings - Style Snippets](images/pc-dsh-setting-3.png) | ![PC Settings - Local Data Storage](images/pc-dsh-setting-4.png) | --- ### Mobile Live Demonstration (Same-Origin Auth & Workspace Control) | Login & Auth | Chat Font Scaling | Mobile Sidebar Styling | Official Trajectory / Trace | | :---: | :---: | :---: | :---: | | ![Login & Auth](images/mobile-auth.jpg) | ![Chat Font Scaling](images/mobile-dsh-1.jpg) | ![Mobile Sidebar Styling](images/mobile-dsh-2.jpg) | ![Official Trajectory / Trace](images/mobile-dsh-3.jpg) | --- ## 🌟 Features ### 1. Network Access - **Tailscale Private Network**: Automatically detects local Tailscale IP (`100.64.0.0/10` CGNAT subnet), creates pairing QR codes, and supports direct passwordless bypass (transport encryption provided by Tailscale's WireGuard tunnel). - **Local Area Network (LAN / Wi-Fi)**: Automatically detects RFC 1918 private IPs (`192.168.x.x`, `10.x.x.x`, `172.16-31.x.x`), generates LAN pairing QR codes with direct link previews and prominent high-risk security warnings. - **Instant QR Pairing**: Scan QR codes directly with any mobile camera or scanner app to authenticate. ### 2. Multi-Tier Authentication - **Dynamic 6-Digit Pairing Codes**: Generates 6-digit short codes (5-minute validity, single-use) that exchange for 365-day persistent authentication cookies on mobile. - **Persistent Access Passwords**: Set customizable persistent passwords (minimum 6 characters with letters and numbers) for convenient long-term logins across multiple devices. - **Direct Bypass Mode**: Enable passwordless direct bypass independently for Tailscale or LAN. Disabling bypass immediately cleans up temporary credentials and resets device state. - **Device Session Management**: Real-time inspection of connected device types, OS, browser, source IP, and last active timestamp, with single-device revocation and one-click bulk revocation. ### 3. Security & Cryptography - **Application-Layer Login Credential Encryption**: The Web login page encrypts credentials on the client before submitting them, so sensitive passwords and pairing codes are sent as ciphertext. If encryption fails, submission stops with an error instead of falling back to plaintext. - **Secure contexts (HTTPS)**: prioritizes native Web Crypto `RSA-OAEP-SHA256`; - **DSH default HTTP LAN/Tailscale access (browser non-secure context; Tailscale's WireGuard tunnel is still encrypted)**: falls back to a pure JS shim using `crypto.getRandomValues()` for cryptographically secure random padding. > The plugin does not provide TLS itself; page/API/WebSocket traffic needs Tailscale or an outer HTTPS proxy for full transport encryption. - **scrypt Slow Hash Storage**: Server persists passwords with `scrypt` salted slow-hashing (`scrypt:${salt}:${hash}`). Verification uses `crypto.timingSafeEqual` constant-time comparison to prevent timing side-channel attacks. - **Brute-Force Defense & Rate Limiting**: - Automatically locks out IPs for 15 minutes after reaching consecutive failed attempt thresholds (default: 5), returning HTTP 429; - Sliding-window rate limiting (default: 60 visits/min) to prevent high-frequency brute-force scraping; - Audit logs and lockout states persist to disk and restore across restarts; - Administrators can manually unlock blocked IPs with one click in the panel. - **Intelligent Static Asset Whitelisting**: The authentication gate allows known frontend asset extensions (`.js`, `.css`, `.png`, `.svg`, `.woff2`, etc., 20 types) while blocking extensionless or dynamic API routes (e.g. `/plugins/xxx/admin`), reducing the exposed dynamic-API surface while remaining compatible with third-party frontend assets, without manual whitelist configuration. (The DSH core static directory `/assets/` is an official resource and is allowed unconditionally.) - **Resilient Atomic Persistence & Debounce**: Millisecond-level debounce write-throttling to safeguard disk I/O (500ms for session data, 300ms for style snippets), coupled with `beforeExit` process flush hooks and atomic temporary file replacement (`renameSync`) for `settings.json` and `style-snippets.json`. - **Source IP Extraction**: By default only the underlying Socket address is trusted; when a request is recognized as a trusted reverse proxy (via Host / `X-Forwarded-*`), the first valid `X-Forwarded-For` IP is used instead, balancing real-source attribution with anti-spoofing. - **Cross-Site Write Defense**: All write requests carrying browser same-origin signals validate (`Origin` / `Sec-Fetch-Site`). Cross-site writes driven by malicious webpages against `127.0.0.1` are rejected outright; non-browser clients (curl / local scripts) are not subject to this check. Note: this policy also blocks cross-origin webhooks / OAuth callbacks from third-party plugins and legacy WebViews that send `Origin: null`; validate compatibility before using such integrations. - **Context & Proxy Boundary**: Same-origin/local-variant Host and Origin are normalized as a pair, while malicious cross-site Origins are preserved for downstream CSRF checks. A same-host `127.0.0.1` proxy is recognized via an external Host, and a LAN/Tailscale proxy via `X-Forwarded-*`, so neither is mistaken for a passwordless local client; they must authenticate with the plugin token. The plugin's own trusted proxy is exempted via an internal secret. Loopback requests carrying the plugin's own 127-valued Forwarded headers are recognized as internal and do not break the local 3080 root connection auth. The SSE event stream accepts same-origin connections only, with no cross-origin reads. ### 4. Real-Time Sync & Internationalization - **SSE Real-Time Push**: Push notifications for new device pairing, reconnections, revocations, and security alerts via Server-Sent Events, with bidirectional close listeners and idempotent cleanup. - **Adaptive Bilingual UI**: Automatically switches between English and Simplified Chinese based on DSH settings and browser language preferences. - **Non-HTTPS Compatibility Patch**: Injects `crypto.randomUUID` and `navigator.clipboard` Polyfills into HTML templates to address missing native Web Crypto / Clipboard APIs in HTTP non-secure mobile browser contexts (the clipboard polyfill provides copy and snippet-copy support in non-secure contexts). ### 5. Mobile Style Snippets (style mini-plugins) The DSH web UI still carries many desktop-oriented styles on phones. This plugin ships a built-in **Mobile Style Snippets** module that splits mobile adaptation into toggleable CSS snippets: - **Three area-based built-in presets** (mobile on / PC off by default): - `preset-sidebar` **Sidebar Drawer**: the collapsed sidebar occupies 0 width, with a draggable floating toggle, adaptive drawer width, and touch-friendly 44px tap targets; - `preset-settings` **Settings Panel**: vertically stacked layout with horizontally scrollable nav tabs and natural vertical scrolling; - `preset-main` **Dense Conversation Typography**: compact 12.5px text, tight line-height and margins for more content per line; built on stable HTML elements and localName suffixes, with no layout scaling and no right-side gaps; - **Separate PC / Mobile toggles (viewport-width based, device-independent)**: every preset and custom snippet has independent PC and Mobile switches; "Mobile" = applies at narrow viewports (≤900px) — **a PC browser with a narrow window gets it too**; "PC" = applies at wide viewports (>900px); both on = applies at all widths; - **About the `html[data-dsh-mobile]` selector**: that marker is only written for **mobile-UA** requests. If your custom CSS starts with `html[data-dsh-mobile]`, it only matches phone/mobile-UA clients; to also target a narrow desktop window, write the selector directly (without the `html[data-dsh-mobile]` prefix) and the injection layer wraps it in the media query automatically. - **Custom snippets (your own mini-plugins)**: paste your CSS in **Settings ⚙️ → Remote & Mobile → 🎨 Mobile Style Snippets** to add a snippet, with edit/toggle/delete/**one-click copy** support (every snippet has a "📋 Copy CSS" button next to "View CSS"). Persisted to `~/.dsh/remote-mobile/style-snippets.json`; changes apply on the next page load without restart; - **UA-based marker + width-based styling**: styles apply by viewport-width band (see above), independent of device UA; mobile UA requests additionally add `data-dsh-mobile="1"` to `` as a scope hook (using it as a selector only matches mobile UA — see the note above), and the draggable toggle script is injected for all clients (it only activates while the sidebar is collapsed). ### 6. Generic Plugin Coexistence Protection - **Automatic coexistence yield**: when the shared pairing service `remoteWebUiPairing` is already registered by another remote/Web access plugin, this plugin yields automatically (deferred arbitration: it waits until the activation window settles, then checks who owns the service name), avoiding the whole-tree rollback caused by service-name collisions — installing from the plugin market usually works without manually disabling the other plugin; - **Visible coexistence status**: when a conflict is detected, a dismissible warning banner (Chinese/English) appears at the top of the settings panel, explaining the yield behavior and the "keep only one" recommendation; refresh after resolving and it disappears; - **One-click diagnosis report**: the **"📋 Copy diagnosis & fix"** button in the banner copies a full report — the conflicting plugin's package name and loader entry id are auto-detected at runtime, and the report includes line-exact fix configuration and commands (disable the other / remove this one), ready to paste to an AI assistant. --- ## 📦 Installation & Update
Expand to view all 4 installation methods ### Method 1: DSH CLI One-Command Install (Recommended) ```bash dsh plugin --profile web add dsh-remote-mobile ``` ### Method 2: Web GUI Plugin Marketplace Install 1. Open DSH Web console in your browser; 2. Navigate to **Settings ⚙️ -> Plugins**; 3. Switch to the **Plugin Management** tab at the top; 4. Enter the npm package name **`dsh-remote-mobile`** and click **Install**; 5. Restart DSH after installation completes. ### Method 3: Install via Package Manager in Profile Directory ```bash # 1. Navigate to DSH Web Profile directory cd ~/.dsh/profiles/web # 2. Install using pnpm pnpm add dsh-remote-mobile ``` ### Method 4: Local Source Development (Instant Symlink Sync) ```bash # 1. Clone source code git clone https://github.com/IceApriler/dsh-remote-mobile.git cd dsh-remote-mobile # 2. Install dependencies & build npm install npm run build ``` **Create symlink to DSH runtime (changes take effect instantly on `npm run build`):** * **macOS / Linux**: ```bash rm -rf ~/.dsh/profiles/web/node_modules/dsh-remote-mobile ln -s $(pwd) ~/.dsh/profiles/web/node_modules/dsh-remote-mobile ``` * **Windows (PowerShell)**: ```powershell Remove-Item -Recurse -Force "$HOME\.dsh\profiles\web\node_modules\dsh-remote-mobile" New-Item -ItemType Junction -Path "$HOME\.dsh\profiles\web\node_modules\dsh-remote-mobile" -Target (Get-Location) ``` * **Windows (CMD)**: ```cmd rmdir /s /q %USERPROFILE%\.dsh\profiles\web\node_modules\dsh-remote-mobile mklink /J %USERPROFILE%\.dsh\profiles\web\node_modules\dsh-remote-mobile %CD% ```
### 🔄 Updating Plugin Run the update command in your terminal and restart DSH: ```bash # Method 1: DSH CLI One-Command Update (Recommended) dsh plugin --profile web update dsh-remote-mobile # Method 2: Update via Package Manager in Profile Directory cd ~/.dsh/profiles/web && pnpm update dsh-remote-mobile ``` > **💡 Tip**: You can also click the update button in the Web console under **Settings ⚙️ -> Plugins -> Plugin Management**, or run `dsh plugin --profile web add dsh-remote-mobile@latest`. ### 🗑️ Uninstalling ```bash dsh plugin --profile web remove dsh-remote-mobile ``` --- ## ⚙️ Advanced Configuration Configurations persist in the plugin-owned file `~/.dsh/remote-mobile/settings.json`. In the Web settings page: | Configuration | Location | Apply | |---|---|---| | `mode` / `proxyPort` / `proxyHost` / `trustedHosts` | Access → Access Proxy Configuration | Restart DSH | | Tailscale / LAN bypass switches | Access → Network Access & Bypass Management | Immediate | | Persistent access password | Access → Configure Persistent Password (Optional) | Immediate | | Rate limit / failure threshold / lockout | Devices & Security → Global Security Policy Configuration | Immediate | | Style snippets | Style Overrides | Next page load | You can also edit `settings.json` directly. Restart DSH after changing the access mode or listener settings: ```jsonc { "allowTailscale": false, // boolean, default false: allow passwordless access via Tailscale "allowLan": false, // boolean, default false: allow passwordless access via LAN (High Risk) "secretHash": "", // string, default empty: scrypt salted hash of the persistent password "maxVisitsPerMinute": 60, // number, default 60: max login page visits per minute per IP "maxFailedAttempts": 5, // number, default 5: max consecutive failed attempts before IP lockout "lockDurationMs": 900000, // number, default 900000 (15 mins): IP lockout duration in ms "proxyPort": 3081, // number, default 3081: secure proxy port "proxyHost": "0.0.0.0", // string, default 0.0.0.0: secure proxy listen address "mode": "proxy", // proxy | direct: proxy is the default (recommended) "trustedHosts": [ // string[], default []: trusted domain whitelist (e.g. Tailscale MagicDNS or reverse proxy domain) "my-device.tailnet.ts.net" ] } ``` > **Terminology**: In this document, “Secure Access Proxy” refers to the reverse-proxy entry point provided by this plugin on port `3081`; it handles authentication, Host/Origin validation, and request forwarding. It is **not** a network default gateway. > > **About `trustedHosts`**: If accessing DSH via Tailscale MagicDNS (e.g. `xxx.tailnet.ts.net`) or an external reverse proxy domain, add bare hostnames to this array. Both the secure proxy and core will accept them in the host whitelist and plugin trust fences, preventing 400 or 403 errors. The same whitelist applies to **direct mode**: when accessing via a custom domain, public IP, or a non-local hostname, the actual Host must be listed here; local NIC IPs and loopback are recognized automatically. > > **About `proxyPort` / `proxyHost` / `mode`**: defaults are usually sufficient. `mode: 'proxy'` is the default and requires the core to listen on loopback; if the core is externally bound (`0.0.0.0` or a concrete NIC IP), the plugin automatically falls back to `direct` with a warning. `mode: 'direct'` starts no secure proxy and requires the core to be externally reachable; with a loopback core, `direct` only works behind a same-host reverse proxy and phones cannot connect directly. Restart DSH after changing these advanced options. > > **HTTPS reverse proxy note**: When using Nginx/Caddy/Tailscale Serve with HTTPS, make sure to: > 1. **Preserve the external Host** (Nginx: `proxy_set_header Host $host`; do not rewrite it to `127.0.0.1`); > 2. Forward `X-Forwarded-For`, `X-Forwarded-Host`, and `X-Forwarded-Proto: https` (Caddy/Tailscale usually do this automatically). > > The plugin uses these headers for protocol/source-aware same-origin checks and 302 redirects. When a proxy carries Forwarded headers and is recognized as proxied traffic, `allowLan`/`allowTailscale` bypass is disabled even if the proxy sits on a LAN/Tailscale address, so normal token auth applies. If a proxy rewrites Host to `127.0.0.1` and sends no `X-Forwarded-*` headers, the plugin cannot distinguish a local browser from a same-host proxy; a LAN/Tailscale proxy without these headers may also be mistaken for a real LAN client. Configure it as above. > **About config storage**: Since DSH **0.1.7** (first noted in the v0.1.7-alpha.1 release notes; continued in 0.2.x), `~/.dsh/settings.yaml` is no longer a live configuration source — on boot it is imported once into the active profile's `cordis.patch.yml` and renamed to `settings.yaml.imported` (see [Q8](#faq)). This plugin therefore no longer writes to settings.yaml and persists to its own `settings.json` above; on first launch it automatically migrates once from the legacy `settings.yaml` / `settings.yaml.imported` (recovering your old persistent password, rate limits, etc.). ### 🎨 Mobile Style Snippets (optional) Custom snippets (style mini-plugins) and their enabled states are persisted in `~/.dsh/remote-mobile/style-snippets.json`. Manage them from the settings panel or edit the file directly: ```json { "version": 2, "presetStates": { "preset-sidebar": { "pc": false, "mobile": true }, "preset-settings": { "pc": false, "mobile": true }, "preset-main": { "pc": false, "mobile": true } }, "custom": [ { "id": "custom-xxx", "name": "My style mini-plugin", "css": "html[data-dsh-mobile] .my-selector { ... }", "pcEnabled": false, "mobileEnabled": true } ], "customOrder": ["custom-xxx"] } ``` > Enabled snippets are merged into a single `