[RFC] Native Headless & Container Support: --no-auth, configurable workspace root, and flexible workbench width

[Bebbolus]

Feature Request / RFC: Native Headless & Container Support (--no-auth), Configurable Workspace Root, and Extended Workbench Width

1. Problem Statement

When running DeepSeek Harness (@deepseek-ai/dsh) inside Docker containers, remote development workstations, or behind local reverse proxies (OrbStack, Docker Desktop, WSL2), several ergonomics issues arise:

1. Browser Token Exchange in Headless Environments:
   dsh web currently generates a single-use process launch token (?token=...) and binds tightly to interactive desktop browsers. In headless containers, navigating to http://localhost:3080 (or http://host.docker.internal:3080) results in 401 Unauthorized unless the user parses the token from container logs.
2. Loopback Hostname Check & 0.0.0.0 Binding:
   isLoopbackHostname() in @deepseek-ai/dsh-client-connection rejects non-loopback hostnames even when passed via --trusted-host, and startup.ts throws an error on --host 0.0.0.0. This prevents clean access across container bridge networks (*.orb.local, 172.17.x.x) without relying on reverse proxies or port forwarders (like socat).
3. Default Directory in File Browser:
   @deepseek-ai/dsh-host-directory-picker-browse hardcodes os.homedir(), which in containers defaults to /root or /home/node rather than the mounted project workspace (e.g. /workspace).
4. Sidebar / Details Panel Max Width (520px):
   @deepseek-ai/dsh-client-ui-layout clamps the details workbench panel to max 520px. For plugins that render comprehensive task boards (like Plan Sidebar), Markdown deliverable diffs, or terminal logs, 520px is severely constrained.

2. Proposed Solution

1. Introduce --no-auth CLI option and DSH_DISABLE_AUTH=true env var:
   • When enabled, BrowserAuth.isAuthenticated() and authorizeIndex() return true, allowing direct browser access to the Web UI in secure, local container networks without token friction.
   • Defaults to false to preserve full local desktop security.
   • Permits --host 0.0.0.0 when auth is explicitly disabled.
2. Respect Workspace Environment Variable in Directory Picker:
   • Check process.env.DSH_WORKSPACE_DIR || process.env.WORKSPACE_DIR || homedir() as the initial browse directory.
3. Expand & Make Responsive the Details Panel Clamp:
   • Increase DETAILS_MAX from 520px to 800px.

---

Implementation Ready in Fork:

We have implemented, tested, and pushed this complete patch to our fork branch:
👉 https://github.com/Bebbolus/deepseek-harness/tree/feat/container-headless-support

Commit: 97d913f963

The patch introduces zero breaking changes for existing desktop users. We would love to get feedback from the maintainers and can contribute this via PR or cherry-pick!