
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
dsh-lan-mobile
Advanced tools
DeepSeek Harness bundle: serve the Web GUI on the LAN and adapt the frontend for phones — LAN bind switch, insecure-origin crypto polyfill, and a mobile navigation frame.
English | 中文
A DeepSeek Harness bundle that serves the Web GUI on your LAN and adapts the frontend for phones.
dsh --profile web --lan) binds the web server to all interfaces; the /api browser-trust fence automatically accepts every LAN literal. No firewall, no config surgery.http://<lan-ip>:3080, which is not a secure context: crypto.randomUUID does not exist there and every RPC crashed with crypto.randomUUID is not a function. This bundle installs a getRandomValues-based polyfill before anything mints an id, on top of the upstream fix.viewport-fit=cover for notched screens and a theme-color meta driven by the active theme; add the page to your home screen for an app-like experience.From a DSH checkout or installation:
dsh plugin --profile web add dsh-lan-mobile
The @deepseek-ai/* runtime pieces (cordis, dsh-cmdline,
dsh-client-runtime, …) and react come from the DSH installation itself
(in-box bundles / platform modules) — this package declares only commander
as an installable dependency, so the registry dependency chain stays intact.
Then boot with LAN serving:
dsh --profile web --lan
Open http://127.0.0.1:3080 locally, or http://<this-machine-lan-ip>:3080 from any phone on the same network.
--lan-only <cidr>(e.g.--lan-only 192.168.0.0/24) declares the intended LAN scope for documentation; the bind currently serves every interface, so treat the LAN as trusted.
The bundle contributes one patch layer (cordis.patch.yml). The stock
web-startup rejects unknown options and the stock ui-layout owns the root
layout exclusively, so both rows are disabled and one dsh-lan-mobile row
(host half + client half) takes over:
| Row | Change |
|---|---|
web-startup | disabled — its flags are parsed by dsh-lan-mobile's startup instead |
dsh-lan-mobile | inserted: parses --host/--port/--trusted-host plus --lan/--lan-only (unknown options pass through), provides the webStartup + lanStartup services, prints LAN URLs once the server binds |
webserver | bind host resolves to 0.0.0.0 only when --lan is passed; otherwise the deployment default (127.0.0.1) |
ui-layout | disabled — the client half of dsh-lan-mobile registers the adaptive frame into root with the same child slots (sidebar / conversation / details / shell.overlay), so ui-sidebar and ui-conversation register unchanged |
The client half (browser bundle) installs the crypto.randomUUID polyfill
(insecure-origin LAN serving), patches the mobile viewport
(viewport-fit=cover, no double-tap zoom), projects the theme
(theme-color), provides ctx.layout (the same toggleSidebar /
openDetails / closeDetails face other plugins use), and renders the
adaptive frame: the stock three columns on desktop, bottom-tab navigation
with a full-screen details page below 768 px.
pnpm install
pnpm build # tsc + tsdown: lib/*.js host half, lib/client.js browser bundle
pnpm typecheck
pnpm test
Test against a checkout without touching your real profile — copy the web
profile, add this bundle, boot with --lan:
# one-time: create a throwaway profile
mkdir -p "$DSH_HOME/profiles/lan-test" # $DSH_HOME defaults to ~/.dsh
# package.json: { "dependencies": { "dsh-lan-mobile": "link:/path/to/dsh-lan-mobile" },
# "dsh": { "profile": { "bundles": ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app", "dsh-lan-mobile"] } } }
# cordis.patch.yml: []
pnpm --dir "$DSH_HOME/profiles/lan-test" install
node --import tsx/esm apps/cli/src/bin.ts --profile lan-test --lan --port 3099
Or overlay the patch directly on the web profile without installing:
node --import tsx/esm apps/cli/src/bin.ts --profile web --patch /path/to/dsh-lan-mobile/cordis.patch.yml --lan --port 3099
⚠️ Multi-instance warning: every
dsh webprocess appends to the shared$DSH_HOMEsession logs. When testing, give each test instance its own home (DSH_HOME=/tmp/dsh-test-home ...) so concurrent instances never write the same session log — and never point a second instance at a home whose sessions are actively being written by another one.
DSH's interrupt-recovery can occasionally replay already-committed sequence
numbers, leaving a session log with a duplicated seq range that fails to
load (corrupt session log: seq gap in committed region). The tools/
scripts in this repository repair such a log: decompress the zstd frames,
drop rows whose seq falls back to an already-seen value, and re-encode.
A .corrupt-backup of the original is kept next to the file.
MIT. Desktop layout, store, and theme-presenter code are derived from
@deepseek-ai/dsh-client-ui-layout (MIT).
FAQs
DeepSeek Harness bundle: serve the Web GUI on the LAN and adapt the frontend for phones — LAN bind switch, insecure-origin crypto polyfill, and a mobile navigation frame.
We found that dsh-lan-mobile demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.