Install verification: sandbox install ok, web smoke failed (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it doesAI
Scan a QR code to open the deepseek-harness web UI on your phone via a cloudflared quick tunnel, no database required.
- Scannen QR to open web UI on phone
- Uses cloudflared quick tunnel
- Cross-platform: Windows/macOS/Linux
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add dsh-remote-tunnel-easyInstall method: npm · sandbox install ok, web smoke failed (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
Based on 1 requirement(s) across 1 @deepseek-ai/dsh-* packages. raw ranges
>=0.1.0-rc.6 ×1
✓ Running dsh 0.2.1-rc.2 is within the declared range — install is not blocked by version.
Whether it actually runs is a separate question → see the measured matrix below (L1–L5).
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 | dsh 0.2.0-rc.2 | dsh 0.2.0-rc.1 |
|---|---|---|---|---|---|
| 1.4.2 | ✗ | ✗ | ✗ | ✗ | ✗ |
| v1.4.2 | · | · | · | · | · |
1.4.2npm11 failed2026-10-19
dsh-remote-tunnel-easy
✗dsh 0.2.1-rc.2current2026-10-19L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.1-alpha.42026-10-16L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-16 · expires: 2026-10-23
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.1-alpha.22026-10-11L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-11 · expires: 2026-10-18
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.0-rc.22026-10-08L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.2.0-rc.2 · profile: l4-sandbox
Issued: 2026-10-08 · expires: 2026-10-15
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.0-rc.12026-09-29L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.1
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.2.0-rc.1 · profile: l4-sandbox
Issued: 2026-09-29 · expires: 2026-10-06
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.7-rc.22026-09-25L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.1.7-rc.2 · profile: l3-fullscan
Issued: 2026-09-25 · expires: 2026-10-02
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.6-alpha.22026-09-20L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.1.6-alpha.2 · profile: l3-fullscan
Issued: 2026-09-20 · expires: 2026-09-27
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.6-alpha.12026-09-16L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.1
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.1.6-alpha.1 · profile: l4-sandbox
Issued: 2026-09-16 · expires: 2026-09-23
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.5-rc.22026-09-11L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.5-rc.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.1.5-rc.2 · profile: l4-sandbox
Issued: 2026-09-11 · expires: 2026-09-18
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.3-alpha.22026-09-09L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.3-alpha.2
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dsh0.1.3-alpha.2 · profile: l4-sandbox
Issued: 2026-09-09 · expires: 2026-09-16
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗prehistory2026-10-05L5 · failed
- • Node.js: v24.14.0
- • DSH: unknown
- • Plugin artifact: npm · dsh-remote-tunnel-easy@1.4.2
ID: dsh-remote-tunnel-easy@1.4.2@dshunknown · profile: l4-sandbox
Issued: 2026-10-05 · expires: 2026-10-12
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
v1.4.2github2026-09-08
https://github.com/Raiyan007-gb/dsh-remote-tunnel-easy
No runtime install test for this version (static scan only) — compatibility unknown, never assumed.
Only the latest 3 published versions are shown; source-snapshot (commit hash) groups, unstated groups and older versions are omitted — the full archive stays in the data layer (snapshot/unstated groups appear only when a plugin has no published version).
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-remote-tunnel-easy/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low; dynamic medium (authoritative when present) → overall medium.
v1.4.2dsh manifest1.4.2npm2026-10-241.4.2same versionclean · npmVet is an AST static scan (npm artifact or git source).
show static findings (8)
- warningchildProcess · code-exec
index.js:744const child = cp.spawn(cloudflaredBin, [ - warningnetIp · network
index.js:97return `http://127.0.0.1:${String(webServer.port)}` - warningnetIp · network
index.js:745'tunnel', '--no-autoupdate', '--url', `http://127.0.0.1:${String(upstream.port)}`, - warningnetIp · network
lib/client.js:490placeholder: autoTarget || "http://127.0.0.1:3080", - warningshellExec · shell
lib/cloudflared.js:78execFile('cloudflared', ['--version'], { windowsHide: true, timeout: 8000 }, (error) => { - warningshellExec · shell
lib/cloudflared.js:112execFile('/usr/bin/tar', ['-xzf', tgzPath, '-C', destDir], (error) => { - warningchildProcess · code-exec
lib/update.js:225const child = spawn('pnpm', ['add', effectiveSpec], { - warningchildProcess · code-exec
lib/update.js:261const child = spawn('pnpm', ['remove', OLD_PACKAGE_NAME], {
show 2 audit findings
- mediumEdge proxy rewrites Host/Origin for every tunneled request, defeating the harness /api browser-trust fence
index.js:671Every request and WebSocket upgrade arriving through the public trycloudflare URL is presented to the harness as if it originated from the desktop loopback origin (the upgrade handler repeats the same rewrite). The /api Origin==Host trust fence documented in api-request-trust.ts can therefore never reject tunneled traffic, so the origin-binding/CSRF defence is silently removed for the whole public entry path; anything that reaches the tunnel URL reaches /api as a trusted same-origin client.
- medium'Loopback-only' bridge guard is satisfied by the plugin's own proxy; /status leaks the launch token and /mutate persists a binary path that is later spawned
index.js:290isLoopbackRequest authorises on socket address plus the Host/Origin headers — exactly the two values startEdgeProxy rewrites to the loopback authority. Requests that enter over the public tunnel therefore pass the guard (a curl-style request without Origin short-circuits to true at line 303), so the seven /api/dsh-remote-handoff-settings routes are not limited to the machine: /status returns accessUrl, which embeds the launch token (line 751) to a caller that never presented it; /mutate persists `cloudflaredPath`, which resolveCloudflared returns verbatim (lib/cloudflared.js:134) and startTunn
Edge proxy coerces Host/Origin so the harness /api trust fence never rejects tunneled traffic, and the 'loopback-only' bridge is reachable through that proxy (token leak, persistable spawned binary path).
Rule (2026-10-24): when a dynamic conclusion exists it is authoritative (it may raise or lower the level); without one, the static/vet fused tier applies. The audit never writes the exemption list (exemptions are manual only); a wrong conclusion is withdrawn by human review and the tier falls back to static/vet.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-05 · activity: Stable
• Repo created: 2026-08-28
• Stars: ★ 2 · Forks: 0
• Health: Stable — committed within 90 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).