litestartup-com/dsh-api-gateway

Name: litestartup-com/dsh-api-gateway
Author: litestartup-com

Plugin插件 Native原生 ⭐ 11 MIT Notifications & Remote通知与远程

DeepSeek Harness 的 API 网关插件：任何第三方客户端均可与您的 DSH Agent 交互。

Project Overview项目介绍

Edited by Zhiwei Agent (zhiwei)由知微Agent(zhiwei)编辑

It is a native DeepSeek Harness plugin that provides an authenticated, fail-closed loopback reverse proxy for local DSH instances. It exposes the local DSH /api endpoint to remote clients, most commonly dsh-agent-manager, enabling cross-machine access that is both secure and controllable. By default, DSH’s own /api only accepts connections from the loopback interface for security, so this plugin runs inside the DSH process to add authentication and access controls before proxying requests through to the native endpoint.

Installation is handled directly through the DSH command line interface. To install, you run the command dsh plugin --profile web add github:litestartup-com/dsh-api-gateway to pull the plugin code. Next, you add a single line entry for the plugin to your host combination configuration file. Finally, you restart DSH to activate the plugin. The plugin does not handle agent or session logic itself; all of that is processed by DSH’s native apiproxy, and the plugin only handles authentication, whitelist checking, and request forwarding.

The plugin follows a strict security model to prevent unauthorized access. It uses constant-time comparison for API keys, generates all provisioned keys via cryptographically secure CSPRNG, and never logs keys to any output. Keys are automatically desensitized in the DSH settings UI, and any request for a method not on the default whitelist is rejected immediately with a 403 error, never forwarded upstream. The project is open source under the MIT License, and includes a full test suite and automated acceptance scripts to verify functionality after deployment.

这是一个专为 DeepSeek Harness 开发的原生插件，提供带鉴权的 fail-closed 回环反向代理能力，可将本地 DSH 实例的 /api 接口暴露给远程机器上的客户端（典型场景是配合 dsh-agent-manager 使用）。DSH 原生 /api 默认只接受回环连接，本插件运行在 DSH 进程内，通过 API 密钥鉴权和白名单机制，实现了安全可控的跨机器 API 访问。

可通过 DSH 命令行工具一键安装：执行 dsh plugin --profile web add github:litestartup-com/dsh-api-gateway，之后在宿主组合配置中添加一行插件声明，重启 DSH 即可激活。插件本身只处理鉴权、白名单校验和透传，会话、消息等业务逻辑全部由 DSH 原生 apiproxy 处理，支持自定义路由前缀、CORS 配置、动态密钥管理和一次性自助密钥发放。

插件提供健康检查、密钥管理、管理员操作、代理转发和事件WebSocket等多种端点，采用恒定时间比较、CSPRNG 安全生成密钥的安全模型，非白名单方法直接返回 403 不转发，密钥永不落日志且在设置界面脱敏展示。项目基于 MIT 协议开源，仓库内自带完整测试和自动化验收脚本，可验证部署后的功能正确性。

View on GitHub在 GitHub 查看

Send to your DSH发给你的 DSH 安装

请帮我安装这个 DSH 插件。安装前先完成【兼容性检查 + 安全性检查】，检查通过再动手。

插件：dsh-api-gateway（litestartup-com/dsh-api-gateway）
仓库：https://github.com/litestartup-com/dsh-api-gateway
本站详情页：https://www.yhbd.top/plugins/litestartup-com-dsh-api-gateway/
本站登记：类型 plugin · 归类 原生 DSH 插件 · 许可证 MIT · ⭐ 11 · 最近提交 2026-10-03 · 主语言 JavaScript

按下面顺序执行，每步先把结论告诉我，再进入下一步：

【1 兼容性检查】
① 我这边：DSH 版本、Node 版本、操作系统、当前 profile（web / desktop）。
② 读它的 README、package.json、插件 manifest，列出它要求的 DSH 版本 / Node 版本 / 操作系统 / 外部依赖 / 需要另外先装的运行时。
③ 逐条比对，结论只写「满足 / 不满足 / 未知」三种；不满足的给出可行替代方案。
④ 检查是否和我已装的插件冲突：命令名重复、skill / tool 重名、端口占用、重复注册的 MCP server。

【2 安全性检查】
① 仓库可信度：和上面「本站登记」是否一致；star / fork 数、创建时间、最近提交，是否归档或长期停更。
② 安装脚本：逐行看 package.json 的 preinstall / install / postinstall，以及 install.sh、setup.ps1 之类脚本。出现 curl|bash、下载后直接执行、混淆代码、访问与插件功能无关的域名，立刻停下来告诉我，不要继续装。
③ 依赖：列出新增依赖，标出无人维护、或与知名包拼写近似的可疑包（typosquatting）。
④ 权限与副作用：它会读写哪些目录、访问哪些域名、需要哪些 DSH 权限（filesystem / network / shell / clipboard 等），以及怎么卸载和回滚。
⑤ 如果它要求 sudo / 管理员权限，或权限明显超出功能所需，先停下来问我。

【3 安装】
上面两步没有「不满足」和「高危项」时才执行；用官方推荐方式安装，不要自行提权。

【4 汇报】
用表格输出：检查项 / 结论 / 依据 / 是否需要我决策。拿不准的一律写「未知」并说明要我怎么确认——不要猜，也不要替我决定。

Send this message to DSH in your current session: it verifies compatibility and security first (answering met / not met / unknown item by item) and only installs once everything checks out — it will stop and ask you if it finds a high-risk item. The box scrolls; the copy is the full prompt. CLI install commands may not be accurate across systems, so DSH is the safer route.把上面这条消息直接发给当前会话里的 DSH：它会先核对兼容性与安全性（逐条给「满足 / 不满足 / 未知」），确认没问题再安装，有高危项会停下来问你。框内可滚动，复制到的是完整提示词；安装命令不一定准确，发给 DSH 更稳。

Pre-install check安装前体检Compatibility · Security兼容性 · 安全性 1 note1 项提示

11 stars - an early-stage project星标 11，属于早期项目

DSH walks through these 9 checksDSH 会逐条核对这 9 项

Compatibility兼容性

DSH, Node, OS and profile requirementsDSH 版本 / Node 版本 / 操作系统 / profile 是否满足要求
External dependencies and runtimes (Electron / Python / Docker, ...)外部依赖与运行时（Electron / Python / Docker 等）是否齐备
Conflicts with installed plugins: command names, skill / tool names, ports, duplicate MCP registration与已装插件是否冲突：命令名、skill / tool 重名、端口占用、重复 MCP 注册

Security安全性

Repo matches the facts registered here; archived or abandoned?仓库是否与页面登记一致，是否归档或长期停更
Safety of preinstall / install / postinstall and install.sh / setup.ps1preinstall / install / postinstall 与 install.sh、setup.ps1 是否安全
curl|bash, download-then-execute, obfuscation, unrelated domains → stop immediatelycurl|bash、下载即执行、混淆代码、无关域名 → 立刻停止
Typosquatting or unmaintained packages among the new dependencies新增依赖里有没有 typosquatting 或无人维护的包
Requested permissions vs. what the feature actually needs申请了哪些权限、是否超出功能所需（filesystem / network / shell / clipboard）
Any sudo / admin requirement, plus uninstall and rollback是否要求 sudo / 管理员权限，以及卸载与回滚方式

Anything uncertain must be marked unknown with a note on how to confirm it. This site's signal screen is a static snapshot, not a security audit.拿不准的必须标「未知」并说明要我怎么确认。本站的信号筛查是静态快照，不能替代安全审计。

Or use CLI install (for developers)或使用命令行安装（适合开发者）

CLI Install命令行安装

dsh plugin --profile web add github:litestartup-com/dsh-api-gateway

把 litestartup-com/dsh-api-gateway 加入你的 DSH 配置（web profile）即可启用。

READMEREADME

15.4 KB · 缓存于 2026-09-30 22:10:21 · 15.4 KB

ohdsh-api-facade

A DeepSeek Harness host plugin: an authenticated, fail-closed in-process HTTP facade that serves the host's session surface (the 0.1.2 typertGateway remotes + follow/control streams + question/approval waterfalls) to remote clients under the frozen legacy apiproxy contract (typical client: dsh-agent-manager).

The plugin does exactly three things: authentication, whitelisting, and contract translation. The 0.1.1-era loopback HTTP forwarding was removed with the 0.1.2 rebuild; envelopes, frame shapes, and receipts remain identical to 0.1.1 — every version difference is absorbed here, so clients need zero changes.

Why it exists

DSH's /api surface sits behind a two-layer gate (trust fence + browser auth) that remote clients cannot pass, and its in-process seams are not exported. This plugin runs inside the DSH process and calls the host domain services directly (typertGateway dispatcher, session streams, waterfalls), guarded by API-key auth and a deny-by-default whitelist.

Supported DSH versions

The facade runs inside a DSH host, so its compatibility surface is the host version. The declared range lives in package.json peerDependencies (^0.1.2-rc.1 || ^0.2.0-0 — dual-range since facade 0.2.4: the 0.2.0 corridor broke the old ceiling, and the DSH host enforces peers at install and startup); the pairings below are the ones verified end-to-end — wire contract, question/approval card chains, and GUI token capture — not merely semver-declared:

DSH	Status	Evidence
`0.2.0-rc.2`	✅ verified	Full-chain smoke + question/approval card chains + V3→V4 session-volume migration on the standalone Docker stack (facade 0.2.4, host 192.168.33.11); npm `latest` line
`0.1.5-rc.2`	✅ verified	Full-chain + card-chain smoke on facade 0.2.4 (dual-compat regression of the 0.2.0 corridor work) and on `#b592b4f` before it; see the install note below
`0.1.2-rc.1`	✅ verified	Full-chain smoke (`dsh-agent-manager/scripts/smoke-proxy-b.ts`, real model turn)
`0.1.1-rc.2`	⚠️ legacy	Wire contract frozen from this era; not the supported base

0.1.5 install note: npm's strict peer resolution rejects the default install (ERESOLVE) even though the range covers 0.1.5 semantically — compose 0.1.5 profiles with npm install --legacy-peer-deps. Consumers track this in their version matrix (dsh-agent-manager src/dsh-matrix.ts, needsLegacyPeerDeps). The same posture applies to the 0.2.0 line.

Showing the opening section of the README — the full document lives in the repository以上为 README 开头摘要，完整文档在仓库内 · View the full README on GitHub →在 GitHub 查看完整 README →

渲染基于仓库 litestartup-com/dsh-api-gateway 的 README.md。在 GitHub 查看原文 →