dsh-pocket 0.0.5

Phone UI fixes:

• Settings now opens full-screen on phone widths: navigation sits above the content, tabs wrap, cards use the full width, and the account card stays readable at 320–412 px.
• Hid the dead right-sidebar toggle on phones; preset dropdowns wrap instead of clipping at narrow widths.
• 64 tests pass; desktop layout is unchanged.

Install: @awbuilds/dsh-pocket@0.0.5 or awbuilds-dsh-pocket-0.0.5.tgz.

dsh-pocket 0.0.4

Fixed the blank phone view after pairing. The fixed drawer left the app frame's CSS grid flow, so the chat column auto-placed into the zero-width rail. The main and right columns are now pinned to their tracks, and the layout tagging is covered by a test.

• Session history, composer, session sheet, and drawer render correctly on the phone.
• Desktop layout is unchanged.
• Tests: 64 passed.

Install

• npm: @awbuilds/dsh-pocket@0.0.4
• release tarball: awbuilds-dsh-pocket-0.0.4.tgz

dsh-pocket 0.0.3

dsh-pocket 0.0.3

Connected-device visibility, per-device removal, and the Moto reconnect fixes.

What changed

• Paired devices are now visible. The Link phone dialog lists every paired
  phone/tablet with a friendly label, last-seen time, address, and a Remove
  action. A small allowlist at $DSH_HOME/pocket/devices.json (mode 0600) is
  keyed by the signed cookie's sid; removing one device invalidates just that
  cookie, while Revoke devices still rotates the secret for all.
• Real model labels. Chrome on Android freezes its User-Agent to
  Android 10; K; the pairing page now sends the navigator.userAgentData
  model hint, so the Moto shows as moto g(40) fusion · Chrome. Last-seen
  touches preserve the pairing label.
• Reconnect fixes. The gateway mints a fresh DSH launch token for every
  login exchange instead of reusing a consumed one, and rewrites DSH's
  SameSite=Strict auth cookie to Lax so a home-screen PWA launch no longer
  loops with ERR_TOO_MANY_REDIRECTS. The unauthenticated pairing page also
  accepts a GET from an external camera/app navigation; only the POST is fenced.
• 64 tests; typecheck and both bundles clean.

Verified on a physical Moto

A moto g40 fusion (Android 12, Chrome 156) was paired over adb reverse to a
0.0.3 dev host:

• the app loaded with the plugin's bottom bar (Sessions / New / More);
• no page or console errors;
• the device appeared in the desktop dialog as
  moto g(40) fusion · Chrome, with Remove;
• reopening after a host restart worked with a fresh DSH session.

The screenshots are in the README. The dev host had no model credentials, so the
phone shows DSH's "Get started" card; the navigation bar is the plugin surface.

Upgrade from 0.0.2

The installed Desktop app is still 0.0.2. Update it from Plugins in the left
sidebar using the attached awbuilds-dsh-pocket-0.0.3.tgz, then restart DeepSeek
Harness so the new host bundle loads. The current gateway/session ends with the
restart. Pair the phone to the restarted Desktop gateway; the dialog then lists
it on every subsequent open.

npm 0.0.3 is not published yet — the npm account requires a one-time
password for writes. 0.0.2 is live on npm. To use the npm update path, run
npm publish in packages/dsh-pocket with your authenticator code.

Known limitations

• LAN-only; plain HTTP by default. Use TLS for an untrusted network.
• Pairing is one operator identity. Device removal is per cookie; "Revoke
  devices" is all-devices.
• Physical iOS Safari and other Android browsers remain on the device checklist.
• DSH 0.2.1-rc.5 pinned.

Docs

• Install
• Security
• Troubleshooting

MIT.

dsh-pocket 0.0.2

dsh-pocket 0.0.2

Scoped package, corrected Desktop install, and a ready-to-install tarball.
This release supersedes 0.0.1's installation instructions.

What changed

• Renamed the package to @awbuilds/dsh-pocket as 0.0.2. The unscoped
  dsh-pocket name on npm belongs to an unrelated, similar project, so a scope
  avoids the collision. The runtime VERSION and bundle row are updated too.
• Discovered that DSH 0.2.1 rejects dsh plugin --profile desktop from a
  terminal, whether or not the app is running: the Desktop profile is managed
  exclusively by the app. The README, install guide, and install-desktop.mjs
  now use the app's Plugins page instead of the blocked CLI.
• The installer's app-running guard now uses ps; macOS pgrep was missing the
  app's main process.
• Added a validated manifest-level fallback:
  node scripts/install-desktop.mjs --manual after quitting the app. It packs
  the tarball, updates the profile with a backup, and installs with the app's
  bundled Node/pnpm (v11.28.5).
• Re-validated the scoped build against a real DSH 0.2.1-rc.5 host: pairing,
  boot graph (@awbuilds/dsh-pocket/client.js), combo bundle, WebSocket mux,
  mobile bar/sheet/drawer.

Install

1. Open Plugins in the left sidebar of DeepSeek Harness.
2. Install a bundle from a path or file, using:
   • the attached awbuilds-dsh-pocket-0.0.2.tgz, or
   • the local package directory from a source checkout.
3. Enable the @awbuilds/dsh-pocket bundle.
4. If Link phone does not appear at the bottom of the sidebar, restart the
   app once.

If the Plugins page does not accept a local path or tarball, quit the app and
run node scripts/install-desktop.mjs --manual from the source checkout.

npm status: the scoped package is prepared but not yet published; the npm
account requires a 2FA one-time password for writes. Once published, the same
Plugins page can install @awbuilds/dsh-pocket@0.0.2 by name.

Verification

• 52 unit/integration/component tests; typecheck and both bundles clean.
• Real-host validation as described above.
• Manual profile install validated in a copy of the Desktop profile with the
  app's bundled pnpm.
• Physical iOS Safari / Android Chrome checks remain on the device checklist.

Known limitations

• LAN-only v1; plain HTTP by default. Enable TLS for an untrusted network.
• Pairing is one operator identity; revocation is all-devices.
• The Desktop profile is installed from the app, not the CLI. The tarball/local
  path must remain available because the profile references it.
• DSH 0.2.1-rc.5 pinned.

Docs

• Install
• Security
• Architecture
• Troubleshooting

MIT.

dsh-pocket 0.0.1

Install note: DSH 0.2.1 rejects dsh plugin --profile desktop from a terminal. Install this release from the app's Plugins page, or use the corrected 0.0.2 release. The 0.0.1 asset uses the original unscoped dsh-pocket package name; prefer 0.0.2.

dsh-pocket 0.0.1

The first public release of dsh-pocket: a pairing-authenticated LAN gateway
and mobile surface for DeepSeek Harness Desktop. The phone runs the real DSH
web client — chat, streaming tools, approvals, questions, files — with a
phone-sized navigation layer. The DSH server stays on loopback; only the gateway
is reachable on the LAN.

Highlights

• QR pairing from a Link phone dialog in the desktop sidebar: six-digit
  code, signed HttpOnly device cookie, 30-day lifetime, one-click revoke.
• Stable gateway on 0.0.0.0:7317 (fallbacks 7318–7326) proxying to the
  app's random loopback port. Upstream Host is rewritten to loopback and
  browser provenance headers are stripped; the gateway enforces its own Origin
  checks on writes and WebSocket upgrades.
• Self-healing sessions: a missing or expired upstream cookie is re-exchanged
  through the process launch token once, so a desktop restart does not require
  re-pairing.
• Mobile UI: bottom bar (Sessions / New / More), session sheet, off-canvas
  sidebar, safe-area and keyboard handling, iOS 16px input guard, desktop UI
  untouched above 900px.
• Installable PWA metadata and icons, served by the gateway. Optional TLS via
  tlsCertFile / tlsKeyFile.
• Contained failures: port conflicts, missing TLS material, or an unreachable
  upstream never stop the desktop app; the dialog reports the problem.

Install

From source (recommended)

git clone https://github.com/awbuilds/dsh-pocket.git
cd dsh-pocket
pnpm install
pnpm build
pnpm test

# Quit DeepSeek Harness completely, then:
node scripts/install-desktop.mjs

Reopen DeepSeek Harness, click Link phone at the bottom of the sidebar, and
scan the QR with a phone on the same network.

Prebuilt tarball

This release includes dsh-pocket-0.0.1.tgz (the built plugin: host gateway,
browser bundle, icons, patch). Quit DeepSeek Harness, then either:

• install it from Settings → Plugins in the app, or
• run npx @deepseek-ai/dsh@0.2.1-rc.5 plugin --profile desktop add /path/to/dsh-pocket-0.0.1.tgz
  and enable the dsh-pocket bundle in the profile (the source install script
  does this automatically). Keep the downloaded tarball at that path: the
  profile references it, just as the source install references the repository.

Requirements

• DeepSeek Harness Desktop 0.2.1-rc.5 (the runtime this bundle pins).
• Node.js 22+ and pnpm for the source install.
• Phone and Mac on the same LAN, without guest-network client isolation.
• Allow incoming connections for DeepSeek Harness in the macOS firewall.

Verification in this release

• 52 unit / integration / component tests; typecheck and both builds clean.
• End-to-end against a real DSH 0.2.1-rc.5 host: QR pairing, proxied app, boot
  graph containing the plugin, plugin bundle served, api/remote.mux WebSocket
  through the gateway, mobile bar/sheet/drawer at 390×844, desktop dialog, and
  revocation.
• Not yet verified: physical iOS Safari / Android Chrome (keyboard, safe areas,
  background reconnect) and the Desktop-profile install itself (requires quitting
  the app). See docs/mobile-checklist.md.

Known limitations

• v1 is LAN-only and plain HTTP by default; enable TLS before using an
  untrusted network. Chrome's PWA install prompt requires TLS; iOS Add to Home
  Screen works over HTTP.
• Pairing is one operator identity. Revocation is all-devices by design; there is
  no per-device audit list.
• The local path install is a link: dependency; keep the repository in place,
  or use the tarball / Plugins page for a copy.
• The Desktop install requires fully quitting the app. The gateway binds all
  interfaces by default; set bindHost to one LAN literal to restrict it.

Docs

• Install
• Security model
• Architecture
• Troubleshooting
• Security policy

License

MIT. See LICENSE.