DSH Plugin Registry
中文EN
Submit plugin
Plugins/dsh-ui-auth

dsh-ui-auth

Automated evidence available

Authentication gate for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing, HttpOnly SameSite session cookies and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a password or second-factor step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); admin-only model and API-key configuration guards; per-user isolation on the REST/list APIs and on the WebSocket event streams; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Runs on both DSH transport lines (0.1.1-rc.2 legacy and 0.1.2+ modern) with no configuration; passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Author: 0QwQ0 · Security & Permissions · Catalog snapshot: 2026-09-19

Canonical semantic path

Security, Permissions & GovernanceIdentity & Access Control

One primary path; alternate capabilities remain separate.
auth.totp-two-factordata.per-user-isolationsessions.session-persistenceusage.audit-logweb.websocket-gateway

What it may solve

Authentication gate for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing, HttpOnly SameSite session cookies and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a password or second-factor step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); admin-only model and API-key configuration guards; per-user isolation on the REST/list APIs and on the WebSocket event streams; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Runs on both DSH transport lines (0.1.1-rc.2 legacy and 0.1.2+ modern) with no configuration; passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Imported third-party catalog description; not a Registry verification conclusion.

Sources and public signals

0QwQ0/dsh-ui-auth

3 stars · 616 downloads

Signals were provided by the source catalog and do not imply quality or safety. 2026-09-19

What can currently be confirmed

Active analysis coverage 4/5. Historical chains are retained but do not count toward current coverage.

Analysis complete

Source structure

Conclusion: The source structure check completed without finding a structural issue.

Analysis complete

Repository health

Conclusion: The GitHub repository is reachable and not archived. Public data: 3 stars, 50 commits, 1 forks, and 0 watches; latest commit 2026-09-16.

Analysis complete

npm release

Conclusion: Resolved npm release 0.6.5, published 2026-09-15, license MIT.

Analysis complete

DSH compatibility

Conclusion: Compatibility verification passed. Installation, profile loading, and sustained startup all completed. Test environment: DSH 0.1.6-alpha.2, web profile.

Analysis complete

Dependency audit

Conclusion: This bounded audit reported 0 known vulnerabilities. It covers only the locked versions and audit source; zero reports is not proof of safety.

Not analyzed

Functional verification

The plugin’s advertised feature has not been automatically verified. Passing installation and startup does not prove that feature works.

Analysis complete

Static risk scan

Conclusion: The scan observed 5 code capabilities: contains credential or token handling code, may read environment variables, may create or modify files, may access the network, may start external processes. No predefined elevated-risk condition was triggered; this is not proof of safety.

Analysis complete

Package integrity

Conclusion: Package name, version, entrypoints, and checksum passed validation. Artifact: dsh-ui-auth@0.6.5; SHA-256: 3714d39c45ebbaba5874b554b694fbe3484faf140718c7556f0bfd35ff5e27ae.

Automated evidence is scoped to the named artifact, DSH target and profile. It is not a blanket safety or feature-completeness claim.

Continue with the latest plugin manager

Describe your task in a DSH conversation and mention dsh-ui-auth. After installing or updating the manager from npm latest, it can find this candidate through Registry, then inspect its actual source and version locally.

Install or update the plugin manager (latest)