DSH Mobile puts a DeepSeek Harness session on your phone over a paired HTTPS channel
DeepSeek Harness 的 Android App 与安全远程访问插件，支持局域网/远程连接和高度自定义的移动界面与扩展能力。
At a glance
- What is it?
- DSH Mobile is a community plugin for the DeepSeek Harness that lets a phone browser or an Android app reach the same sessions, workspace, messages and tools running on your computer, over a local network or a remote tunnel, without modifying the harness source. It suits someone who wants their harness session in their pocket, and it asks you to treat a paired phone as a fully trusted device.
- Who is it for?
- DSH Mobile fits a DeepSeek Harness user who wants the same session, workspace and tools reachable from a phone over a paired HTTPS channel, whether on the same Wi-Fi or through a tunnel. It does not fit anyone unwilling to treat their phone as a fully trusted device, because the README says paired devices can operate the harness on the computer and should be considered completely trusted.
- Can I use it commercially?
- Yes. Apache-2.0 is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository received new commits within the last day.
- What is it written in?
- Mainly TypeScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on October 23, 2026, and from our analysis. They are not legal advice.
Editorial analysis
The plugin and the app version separately
DSH Mobile is a DeepSeek Harness community plugin, and the native app supports Android only.
The version scheme is the first thing to understand, because the README makes a point of it. The current official version is 0.6.13, and that release distinguishes a gateway HTTP receive timeout from a request header too large error, adds a privacy-limited rejection diagnostic, and covers an image and text send failure regression. The Android app stays at 0.6.5 and does not need to be upgraded in step.
Since plugin 0.6.2 the Android app and the plugin are numbered and released independently, so their version numbers do not have to match and a plugin upgrade does not mean the app needs upgrading. That is a sensible decision for a plugin that a phone talks to over the network, since the two halves are deployed on different machines and often at different times.
The release cadence behind that is visible in the tag list: v0.6.13 on 2026-10-19, v0.6.12 on 2026-10-18 and v0.6.11 on 2026-10-17. Three releases in three days for a plugin that is still changing its behaviour in ways users will notice.
The repository is TypeScript, licensed under Apache-2.0, and the package is published to npm as dsh-mobile. It also carries a badge linking to an awesome-dsh-plugin list, which tells you there is a wider plugin ecosystem around the harness rather than just this one project.
What it actually gives you
The pitch is that you use the DeepSeek Harness on your computer from your phone, safely and in real time, and the feature list is specific about what that means.
The same session, workspace, messages and tools are synchronised in real time, so you are not looking at a separate mobile chat client. You can ask for the mobile layout to be customised from inside a DSH conversation with the /mobile command, describing layout, interaction or feature requirements, and once the files are changed the phone page usually refreshes by itself.
The mobile interface is genuinely reorganised rather than shrunk. The session drawer, tool details, settings, question cards and input bar are all restructured for a touchscreen. The app follows the system language, Simplified Chinese, English or Italian, while the plugin interface follows the language of DSH itself, which is an unusual split and a deliberate one.
On the channel side there is a list of options: Tailscale, cpolar, cloudflared quick and named tunnels, a self-hosted FRP, or your own reverse proxy, chosen according to the network you are on. On Windows and Linux x64 the plugin can also host Caddy HTTPS and certificates for you.
Pairing works by scanning a code, following a link or using a key, once. After that, switching Wi-Fi, a hotspot or an IP address usually reconnects on its own, and the app shows all paired computers in one list with reachability checks, plus switching, re-pairing and deleting local records.
There are also two operational features worth calling out. A one-click diagnostic checks versions, gateway, network interfaces, firewall and remote channels and produces a redacted report, and blocked third-party plugin connections can be allowed on an exact path with one click. Task completion and pending input come through as Android system notifications, with lock screen text redacted, and can be enabled in the general settings inside DSH.
Installing the plugin and the app
The order is plugin first, then pairing with the Android app or a phone browser, and the install path depends on how you run the harness.
With the official DSH Desktop, you install and enable dsh-mobile on the plugin page and then open the mobile access panel to configure a LAN or remote channel. The README notes that the Desktop profile is managed by the application, so the --profile web command below does not apply, and that after installing or updating you should quit and reopen the Desktop from the application menu without clearing the session or pairing data.
With DSH Web, where the dsh command is already installed, the commands are these.
dsh plugin --profile web add dsh-mobile@latest
dsh plugin --profile web exec dsh-mobile setup
dsh --profile webIf you run the DeepSeek Harness from source, or use the community plugin marketplace, the commands run through pnpm instead.
pnpm install
pnpm dsh plugin --profile web add dsh-mobile@latest
pnpm dsh plugin --profile web exec dsh-mobile setup
pnpm dsh --profile webAnd the marketplace route installs dshmarket first.
dsh plugin --profile web add dshmarketAfter that, restart DSH, search for dsh-mobile in the settings plugin marketplace and install it. The setup step auto-selects and remembers the current LAN, and it usually recovers on its own after a switch of Wi-Fi, hotspot or IP, with --address used only when auto-selection fails. Settings, certificates, devices and custom files are stored under $DSH_HOME/mobile-access/.
On the phone, you download the release Android APK or open the pairing link generated on the computer, then follow the connection guide to choose LAN or remote access. The phone does not need a separate tunnel client installed.
The security model, stated plainly
The README is unusually direct about the trust model, and this is the section to read before pairing a phone.
Paired devices can operate the DSH on your computer and should be treated as fully trusted devices. Only enable LAN access on a trusted network. Remote access should use a reliable HTTPS channel. If you lose your phone, revoke the device immediately from the computer side.
The transport design follows from that. Mobile access uses a separate HTTPS listener and device pairing. The Android app pins a private CA for the LAN, while a public remote channel uses a system-trusted certificate. A self-signed FRP entry point additionally needs the 0.4.6 app to pin the remote CA during pairing.
The management port is guarded separately from the mobile port. The management API still requires the TCP peer to be the local machine, for example a local socat or reverse proxy connecting to 127.0.0.1, so the plugin does not expose itself to the public internet. The browser Host may be localhost, an RFC1918 address or an IPv4 link-local address, while a public IP or an arbitrary domain still returns 403. A reverse proxy must only be open to trusted local or internal requests and must not forward the /api/mobile-access management path to the internet. The separate HTTPS entry point the phone uses, on port 3443 by default, remains the mobile interface and does not become the desktop management port.
Credentials live in the Android Keystore, the device token is only ever sent to an exact Origin, and third-party WebSocket connections are blocked by default.
That last set of defaults is the difference between this and a browser-based remote shell. The failure mode of a wrong-host request is a 403 rather than a page that leaks.
Ports, certificates and the diagnostic docs
Two ports matter and the README explains both, including which one changes what.
`dsh web --port` changes the DSH Web upstream port, which defaults to 3080, and the plugin follows it automatically. `dsh-mobile setup --port` changes the Mobile HTTPS listening port, which defaults to 3443, and the pairing QR code includes the actual port.
The port distinction matters because the two listeners serve different things. DSH Web on 3080 is the upstream that the harness serves, and the mobile access management path lives there for the desktop panel. The Mobile HTTPS listener on 3443 is what the phone connects to and it only ever presents the mobile interface.
The documentation set in the repository is unusually thorough and each file covers one deployment shape: docs/TRUSTED_NETWORKS.md for extra trusted source CIDRs, docs/SLOW_CONNECTIONS.md for slow links and repeated reconnection, docs/CPOLAR_SUBDOMAIN.md, docs/CLOUDFLARE_TUNNEL.md, docs/SELF_HOSTED_FRP.md, docs/ATTACH_EXISTING_FRPS.md, docs/SELF_HOSTED_ORIGIN.md, docs/CADDY_MANAGED.md, docs/CLIENT_MODULES.md and docs/SKIN_COMPATIBILITY.md, mostly with English counterparts alongside.
Two of those deserve a mention. The trusted networks feature, from 0.6.0, only appends explicit source CIDRs, and it does not establish a VPN, create routes or change the Windows firewall. And the slow connections guide exists because a page that loads but stays on reconnecting has three possible causes, WebSocket upgrade failure, slow data synchronisation and heartbeat timeout, and telling them apart is the difference between fixing a proxy and changing a timeout.
The repository also has a native/ directory with the bundled tunnel binaries, including win32-x64, linux-x64 and linux-arm64 builds listed in the package files, and a FUNNEL_THIRD_PARTY_LICENSES.txt alongside THIRD_PARTY_NOTICES.md for the tunnelling components.
Where DSH Mobile is the wrong choice
Four cases argue against it.
The first is if you do not want your phone trusted. The README is explicit that paired devices can operate the harness on the computer and should be treated as fully trusted devices. There is no read-only pairing mode described, so the security model is all or nothing.
The second is a platform other than Android. The native app supports Android only. A phone browser works on anything, and the README notes that the browser pairing and reconnection pages follow the browser's Accept-Language header for Simplified Chinese, English or Italian, but the browser path uses a private certificate on the LAN, so the first visit shows an untrusted certificate warning that you have to consciously accept.
The third is a remote link with a tight bandwidth allowance. The README names the limits: the cpolar free plan is currently 1 Mbps, Tailscale Funnel has bandwidth limits that are not configurable, and the cloudflared quick tunnel is free from Cloudflare but has a random address and rate limiting. DSH Mobile uses gzip for static assets, WebSocket long connections and on-demand loading at the top to work around this, but it cannot raise a provider's limit, and the session history window and page size are decided by DSH rather than the plugin.
The alternative in the same direction is to run the harness on a server rather than on your desktop and reach it over a normal client. The difference in approach is that DSH Mobile is a bridge to a machine you already own, which means the trust boundary is your own network and your own phone, while a server-hosted harness has one well-known security perimeter but requires you to run the machine continuously. If you already run the harness on a server, this plugin solves a problem you do not have. If you run it on a laptop, this is the thing that makes it usable away from the desk.
Editorial conclusion
DSH Mobile fits a DeepSeek Harness user who wants the same session, workspace and tools reachable from a phone over a paired HTTPS channel, whether on the same Wi-Fi or through a tunnel. It does not fit anyone unwilling to treat their phone as a fully trusted device, because the README says paired devices can operate the harness on the computer and should be considered completely trusted. Install the plugin with `dsh plugin --profile web add dsh-mobile@latest`, then run `dsh plugin --profile web exec dsh-mobile setup`, and note that the plugin and the Android app version independently from 0.6.2, so a plugin upgrade does not require an app upgrade.
Frequently asked questions
What is DSH Mobile?
It is a DeepSeek Harness community plugin that lets a phone browser or Android app reach the same sessions, workspace, messages and tools running on your computer, over the local network or a remote channel such as Tailscale, cpolar, cloudflared, a self-hosted FRP or your own reverse proxy. The plugin does not modify the DeepSeek Harness source.
Do the DSH Mobile plugin and the Android app have to be the same version?
No. Since plugin 0.6.2 the Android app and the plugin are numbered and released independently, so their version numbers do not have to match and a plugin upgrade does not mean the app needs upgrading. The current plugin is 0.6.13 and the Android app stays at 0.6.5.
How do I install the dsh-mobile plugin?
With DSH Web, run `dsh plugin --profile web add dsh-mobile@latest` then `dsh plugin --profile web exec dsh-mobile setup`, then `dsh --profile web`. From a harness source checkout, prefix the same commands with `pnpm`. With the official DSH Desktop you install and enable dsh-mobile on the plugin page instead.
How secure is pairing a phone with DSH Mobile?
The README states that paired devices can operate the harness on your computer and should be treated as fully trusted devices. Mobile access uses a separate HTTPS listener with device pairing, credentials live in the Android Keystore, the device token is only sent to an exact Origin, and the management API requires the TCP peer to be the local machine, with public IPs and arbitrary domains returning 403.
Which ports does DSH Mobile use?
`dsh web --port` changes the DSH Web upstream port, 3080 by default, and the plugin follows it automatically. `dsh-mobile setup --port` changes the Mobile HTTPS listening port, 3443 by default, and the pairing QR code includes the actual port.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/saya-ch-dsh-mobile)Was this useful?