DSH Mobile Remote

August 18, 2026 · View on GitHub

English | 中文

Control your desktop DeepSeek Harness (DSH) from your phone over an encrypted Tailscale tailnet — no public exposure, no port forwarding.

What is this

DeepSeek Harness is a local desktop agent workbench with a built-in web console (default http://127.0.0.1:3080). But that address is loopback-only — your phone cannot reach it.

This project provides Path A: publish DSH's web console to your phone over a Tailscale tailnet. Run DSH on your computer, and from your phone's browser you can:

✅ View session and project lists
✅ Start conversations, read history, switch models
✅ Browse / add workspace directories
✅ Watch agent output in real time

The actual "work" (running agents, reading files, using your subscription) always happens on your computer — the phone is just a remote control.

Tailscale builds an encrypted "private LAN" between your phone and computer; the computer publishes DSH's port 3080 into that network as https://<machine>.xxx.ts.net; opening that URL on your phone opens the DSH console. Nothing crosses the public internet, and only devices on your account can connect.

See docs/architecture.md for details.

Prerequisites

A computer running DeepSeek Harness (verified on Windows; macOS/Linux work the same way)
A phone (Android / iOS)
A Tailscale account (free; sign in with Google / GitHub / Microsoft)

Quick start (5 steps)

Windows computer + Android phone, default port 3080. Or run the interactive wizard: powershell -ExecutionPolicy Bypass -File .\scripts\setup.ps1

Step	Action	Who
1	Install and sign in to Tailscale on the computer	you
2	Install Tailscale on the phone, sign in with the same account	you
3	Run `tailscale serve --bg 3080` on the computer	you
4	Add the ts.net host to DSH's trusted-host allowlist (see below)	you / script
5	Restart DSH, open the ts.net URL on the phone	you

Steps 1–2: Install Tailscale

See docs/installers.md for download sources and checksums, or download automatically:

powershell -ExecutionPolicy Bypass -File .\scripts\download-installers.ps1

Computer: run the downloaded tailscale-setup-*.exe and sign in.
Phone: transfer tailscale-android-*.apk and install (allow "unknown sources"), then sign in with the same account.
- On Android, enable Always-on VPN for Tailscale (Settings → VPN → Tailscale) to avoid disconnects when the screen locks.

Step 3: Publish the port

powershell -ExecutionPolicy Bypass -File .\scripts\setup-serve.ps1 -Port 3080

Equivalent command: tailscale serve --bg 3080. On first use it prints Serve is not enabled; open the printed https://login.tailscale.com/f/serve?node=... link, click Enable, then run it again.

You will get a URL like https://jin.xxx.ts.net/.

Step 4: Add the ts.net host to DSH's trusted-host allowlist (critical!)

DSH's web API only trusts localhost by default (DNS-rebinding protection). Over Tailscale the Host header changes and the API returns 403. Add the host to the allowlist:

powershell -ExecutionPolicy Bypass -File .\scripts\patch-trusted-host.ps1 -Authority "jin.xxx.ts.net"

Or edit %DSH_HOME%\profiles\web\cordis.patch.yml manually (see config/cordis.patch.yml.example):

- id: connection
  config:
    trustedHosts: !!js "['jin.xxx.ts.net', ...ctx.webRuntime.trustedHosts]"

Step 5: Restart DSH and open on the phone

Fully quit and reopen the DeepSeek Harness desktop app (the composition is loaded at boot). Open https://jin.xxx.ts.net/ on the phone — you should see the same UI as on the computer.

Troubleshooting

Symptom	Cause	Fix
Page loads but "no sessions", directory picker fails with `transport failure ... HTTP 403`	ts.net host missing from DSH trusted allowlist	Patch (step 4) and restart
`tailscale serve` says `Serve is not enabled`	Serve not enabled for the tailnet	Enable via the printed link, rerun
Phone shows offline / drops after a while	Android suspends the VPN on lock	Enable Always-on VPN
Can't reach it when away	Computer asleep / DSH closed / no network	Disable sleep, keep DSH running

See docs/troubleshooting.md for the full diagnosis (curl probes, source tracing).

Security

The URL is tailnet-only (private network); it is not reachable from the public internet. Don't share it, and don't enable Tailscale funnel.
Even when trusted, DSH keeps sensitive operations (settings / credentials / presets) loopback-only — trustedHosts is a DNS-rebinding fence, not authentication. See docs/security.md.

Project structure

dsh-mobile-remote/
├── README.md
├── README.zh.md
├── LICENSE
├── .gitignore
├── config/
│   └── cordis.patch.yml.example   # DSH trusted-host patch example
├── docs/
│   ├── architecture.md            # architecture and data flow
│   ├── troubleshooting.md         # the 403 issue, end to end
│   ├── security.md                # security boundaries and advice
│   └── installers.md              # download sources and checksums
└── scripts/
    ├── setup.ps1                  # interactive one-click wizard
    ├── download-installers.ps1    # download + verify official installers
    ├── setup-serve.ps1            # configure tailscale serve
    ├── patch-trusted-host.ps1     # write the trusted-host patch
    └── verify-remote.ps1          # diagnose whether /api is still 403