A one-command DeepSeek Harness web bundle that brings QR-based remote handoff to the Settings page. It starts a cloudflared quick tunnel, loops your phone into the exact session the desktop is using, and draws the QR code plus settings right next to your other plugins — no terminal noise, no database, no Firebase, no app install.

• Scan to open — a real QR code in Settings → Plugins, fresh every run
• Same session — the phone lands inside the chat and workspace you are already in
• Self-installing — detects cloudflared, and downloads it (SHA-256 verified) when missing
• Regenerate — one click mints a fresh tunnel URL for the same session, without restarting
• Editable settings — tunnel target, cloudflared path, and session handoff from the page
• Nothing stored — the tunnel URL is random per run; nothing is saved anywhere
• Everywhere — Windows (x64/x86), macOS (Intel/Apple Silicon), and Linux (x64/arm64)

At a Glance

Get Started

Run dsh web once so a profile exists — that is the only prerequisite. cloudflared is no longer something you install by hand: on first tunnel start the bundle probes your PATH, and when no cloudflared is found it downloads the official pinned binary (SHA-256 verified), caches it under your user cache directory, and reuses it from then on. Prefer your own install? Put it on PATH, or set the cloudflared path field in the card to an absolute path — an explicit path disables both probing and downloading.

The simplest path — install from the npm registry with the plugin name:

dsh plugin --profile web add qrcode-hassle-free@latest --config.minimumReleaseAge=0

The --config.minimumReleaseAge=0 flag bypasses pnpm's ~24-hour release-age gate, so a freshly published version installs immediately. Without it, a plain dsh plugin --profile web add qrcode-hassle-free still works but may hold off until the freshness window lapses.

Or, if you prefer, install straight from the GitHub repository URL:

dsh plugin --profile web add https://github.com/Raiyan007-gb/dsh-qrcode-hassle-free

For a local checkout instead, clone it and add the folder:

git clone https://github.com/Raiyan007-gb/dsh-qrcode-hassle-free
dsh plugin --profile web add ./dsh-qrcode-hassle-free

These initialize the profile if needed, link the package, and register the bundle. No build step — the package ships plain ESM with zero runtime dependencies (the QR encoder and cloudflared resolver are vendored in-tree), so add and remove stay fast and never run install scripts.

Security note: installing from a git URL asks for permission to run the package's install scripts. This package has none (plain ESM, no postinstall), but pin a commit — #<sha> on the URL — to freeze what runs. To skip install permissions entirely, pnpm pack a tarball and dsh plugin --profile web add ./qrcode-hassle-free-1.1.0.tgz.

Then restart dsh web — the QR and settings appear on Settings → Plugins → DSH Remote on every start.

What it does

On every dsh web start the bundle:

1. Spawns a loopback edge proxy (127.0.0.1, ephemeral port) that forwards every request and WebSocket upgrade to the harness, rewriting Host and Origin to the loopback authority. This is what makes the harness's /api browser-trust fence accept tunneled traffic — the fence requires Origin == Host, and a phone's Origin is the tunnel hostname, which --http-host-header rewriting alone can never satisfy. Without the proxy the app loads but every API call 403s.
2. Locates cloudflared — the configured cloudflared path override, else a binary on PATH, else a pinned download (2026.8.2) SHA-256 verified and cached under the user cache directory. It then spawns cloudflared tunnel --no-autoupdate --url http://127.0.0.1:<proxy-port> pointed at that proxy.
3. Waits for cloudflared to print the random https://<name>.trycloudflare.com URL.
4. Resolves this process's launch token via the harness connection service (authenticatedUrl — the same mint the console line prints).
5. Seeds the most recently active session id into every served index page (via the webserver's index-injection table), gated to non-loopback origins and once per tab — so any tunnel entry lands inside the session the desktop is working in. The id is resolved on the Host at render time (cached, refreshed every 15s); the phone makes no /api call for the seed itself.
6. Registers a token-gated /remote-handoff route as a fallback entry path: same seeding, then the normal token→cookie login (SHA-256 constant-time compare). Prefix-matched, so /remote-handoff and /remote-handoff/ both work.
7. Registers a remote-handoff settings namespace and a loopback-only bridge (/api/dsh-remote-handoff-settings). The card in Settings → Plugins → DSH Remote reads the tunnel status (QR matrix + access link) from that bridge and draws them in the page, alongside the editable tunnelTarget / cloudflaredPath / sessionHandoff settings. The Regenerate button restarts the tunnel in place for a brand-new URL on the same session, and an empty tunnel target auto-fills the harness's own loopback address. The dsh web terminal prints nothing.

Requirements

• No manual cloudflared install — downloaded automatically when missing (Windows x64/x86, macOS Intel/Apple Silicon, Linux x64/arm64); any other platform needs a cloudflared on PATH or an explicit cloudflared path.
• Network access on first run (to reach GitHub for the binary download)
• Node — already present where dsh runs
• Phone on any network — the tunnel is public; the token in the URL is the only gate, so treat the shown link like a password.

Removing

dsh plugin --profile web remove qrcode-hassle-free

and restart dsh web.

License

MIT — use it, modify it, ship it. See LICENSE.