vocsong/deepseek-harness-portal

Name: vocsong/deepseek-harness-portal
Author: vocsong

Plugin插件 ⭐ 2 Vision & Media视觉与多媒体

A multi-tenant platform that provisions and routes isolated DeepSeek Harness (dsh) instances — one container per user.

Project Overview项目介绍

Edited by Zhiwei Agent (zhiwei)由知微Agent(zhiwei)编辑

This is a multi-tenant platform that provisions and routes isolated DeepSeek Harness (DSH) instances, one container per user, behind a single Cloudflare Tunnel. It handles authentication, access control, and container orchestration for multi-user DSH deployments. Requires pre-configured Podman and SMTP; WSL2 may encounter stale port forwarding issues that need a VM restart to fix.

这是一个多租户平台，可在单个Cloudflare Tunnel后端分配并路由隔离的DeepSeek Harness（DSH）实例，每个用户对应一个容器实例。提供用户认证、访问控制、容器编排能力，适用于搭建多用户独立DSH实例的场景。需要提前配置Podman与SMTP，WSL2环境可能出现 stale 端口转发问题，需重启虚拟机修复。

View on GitHub在 GitHub 查看

Send to your DSH发给你的 DSH 安装

请帮我安装这个 DSH 插件。安装前先完成【兼容性检查 + 安全性检查】，检查通过再动手。

插件：deepseek-harness-portal（vocsong/deepseek-harness-portal）
仓库：https://github.com/vocsong/deepseek-harness-portal
本站详情页：https://www.yhbd.top/plugins/vocsong-deepseek-harness-portal/
本站登记：类型 plugin · 归类 原生 DSH 插件 · 许可证未声明 · ⭐ 2 · 最近提交 2026-08-18 · 主语言 JavaScript · 未检测到 DSH 插件清单

按下面顺序执行，每步先把结论告诉我，再进入下一步：

【1 兼容性检查】
① 我这边：DSH 版本、Node 版本、操作系统、当前 profile（web / desktop）。
② 读它的 README、package.json、插件 manifest，列出它要求的 DSH 版本 / Node 版本 / 操作系统 / 外部依赖 / 需要另外先装的运行时。
③ 逐条比对，结论只写「满足 / 不满足 / 未知」三种；不满足的给出可行替代方案。
④ 检查是否和我已装的插件冲突：命令名重复、skill / tool 重名、端口占用、重复注册的 MCP server。

【2 安全性检查】
① 仓库可信度：和上面「本站登记」是否一致；star / fork 数、创建时间、最近提交，是否归档或长期停更。
② 安装脚本：逐行看 package.json 的 preinstall / install / postinstall，以及 install.sh、setup.ps1 之类脚本。出现 curl|bash、下载后直接执行、混淆代码、访问与插件功能无关的域名，立刻停下来告诉我，不要继续装。
③ 依赖：列出新增依赖，标出无人维护、或与知名包拼写近似的可疑包（typosquatting）。
④ 权限与副作用：它会读写哪些目录、访问哪些域名、需要哪些 DSH 权限（filesystem / network / shell / clipboard 等），以及怎么卸载和回滚。
⑤ 如果它要求 sudo / 管理员权限，或权限明显超出功能所需，先停下来问我。

【3 安装】
上面两步没有「不满足」和「高危项」时才执行；用官方推荐方式安装，不要自行提权。

【4 汇报】
用表格输出：检查项 / 结论 / 依据 / 是否需要我决策。拿不准的一律写「未知」并说明要我怎么确认——不要猜，也不要替我决定。

Send this message to DSH in your current session: it verifies compatibility and security first (answering met / not met / unknown item by item) and only installs once everything checks out — it will stop and ask you if it finds a high-risk item. The box scrolls; the copy is the full prompt. CLI install commands may not be accurate across systems, so DSH is the safer route.把上面这条消息直接发给当前会话里的 DSH：它会先核对兼容性与安全性（逐条给「满足 / 不满足 / 未知」），确认没问题再安装，有高危项会停下来问你。框内可滚动，复制到的是完整提示词；安装命令不一定准确，发给 DSH 更稳。

Pre-install check安装前体检Compatibility · Security兼容性 · 安全性 3 warnings3 项注意

No license declared - all rights reserved by default; ask the author before commercial use or redistribution未声明开源许可证 —— 默认「保留所有权利」，商用或再分发前先问作者
Only 2 stars - very few users, little community feedback星标只有 2，几乎没人在用，遇到问题缺少社区反馈
No DSH plugin manifest detected - it may only carry the dsh-plugin topic, so the install method must be confirmed on the spot未检测到 DSH 插件清单：可能只是打了 dsh-plugin 话题，安装方式要现场确认

DSH walks through these 9 checksDSH 会逐条核对这 9 项

Compatibility兼容性

DSH, Node, OS and profile requirementsDSH 版本 / Node 版本 / 操作系统 / profile 是否满足要求
External dependencies and runtimes (Electron / Python / Docker, ...)外部依赖与运行时（Electron / Python / Docker 等）是否齐备
Conflicts with installed plugins: command names, skill / tool names, ports, duplicate MCP registration与已装插件是否冲突：命令名、skill / tool 重名、端口占用、重复 MCP 注册

Security安全性

Repo matches the facts registered here; archived or abandoned?仓库是否与页面登记一致，是否归档或长期停更
Safety of preinstall / install / postinstall and install.sh / setup.ps1preinstall / install / postinstall 与 install.sh、setup.ps1 是否安全
curl|bash, download-then-execute, obfuscation, unrelated domains → stop immediatelycurl|bash、下载即执行、混淆代码、无关域名 → 立刻停止
Typosquatting or unmaintained packages among the new dependencies新增依赖里有没有 typosquatting 或无人维护的包
Requested permissions vs. what the feature actually needs申请了哪些权限、是否超出功能所需（filesystem / network / shell / clipboard）
Any sudo / admin requirement, plus uninstall and rollback是否要求 sudo / 管理员权限，以及卸载与回滚方式

Anything uncertain must be marked unknown with a note on how to confirm it. This site's signal screen is a static snapshot, not a security audit.拿不准的必须标「未知」并说明要我怎么确认。本站的信号筛查是静态快照，不能替代安全审计。

Or use CLI install (for developers)或使用命令行安装（适合开发者）

CLI Install命令行安装

dsh plugin --profile web add github:vocsong/deepseek-harness-portal

把 vocsong/deepseek-harness-portal 加入你的 DSH 配置（web profile）即可启用。

READMEREADME

13.0 KB · 缓存于 2026-09-08 19:39:09 · 13.0 KB

DeepSeek Harness Portal

A multi-tenant platform that provisions and routes isolated DeepSeek Harness (dsh) instances — one container per user — behind a single Cloudflare Tunnel.

Internet
  │  <your-domain>                    (portal: login, admin, user dashboard)
  │  <slug>.<instance-domain>         (one instance per user)
  ▼
Cloudflare Tunnel (cloudflared, one named tunnel)
  │
  ▼
Portal (Node + Fastify + SQLite) ── auth + reverse proxy + orchestrator
  │
  ├─► container dsh-<slug>   (dsh web on :3000 inside, published 127.0.0.1:18xxx)
  ├─► container dsh-<slug2>  ...
  └─► ...

The portal is the only authentication entry point. It owns registration, login, roles, and per-instance access control.

Authentication model

Registration: email + one-time code (OTP), with optional username + password set during signup (so a new user can log in with credentials right away). An invite code is enforced when the admin has set one.
After registering: Profile can change name, username, password, and email. Email replacement requires separate codes from both the current and proposed mailboxes and revokes all other sessions.
Login: username/password or "email me a code" (OTP fallback).
Admin controls (Settings tab): email-domain whitelist, invite code, toggle OTP registration, toggle password login.

OTP delivery uses SMTP (nodemailer), which is required in production. Code logging is available only with the explicit localhost-only development combination NODE_ENV=development, DOMAIN=localhost, and OTP_DEV_MODE=true; OTP values are never returned by the API.

Architecture

Component	Location	Role
Portal app	`portal/`	Fastify server: auth (OTP + password, bcrypt, session cookie), admin/user JSON API, static dashboard, subdomain reverse proxy
Orchestrator	`portal/src/orchestrator.js`	`podman` CLI wrappers: run/start/stop/rm/logs, port allocation, health polling, background provisioning
Storage	`portal/data/portal.db`	SQLite (better-sqlite3): users, otps, settings, instances, sessions
dsh image	`image/Dockerfile`	Builds the reviewed dsh image from an approved upstream commit, a dependency-security patch, and two documented source patches; tagged `dsh:47f9438-node24` (Node 24 LTS on Debian 13 trixie) and deployed by its `sha256:` digest
dsh clone	`dsh/`	Fresh `deepseek-harness` checkout (build context, gitignored)

Showing the opening section of the README — the full document lives in the repository以上为 README 开头摘要，完整文档在仓库内 · View the full README on GitHub →在 GitHub 查看完整 README →

渲染基于仓库 vocsong/deepseek-harness-portal 的 README.md。在 GitHub 查看原文 →