把 DeepSeek Harness 接到任意 SSH 主机、WSL 发行版或 Docker 容器：远程常驻服务加本地原生界面，关掉客户端任务也不停。
这个项目解决的是「远程工作区」的常驻问题：本地客户端只负责选设备、显示聊天和监控状态，真正的 agent、工具和文件都跑在远程主机、WSL 或 Docker 里。只要远程服务在，关掉客户端甚至断开 SSH，任务都继续跑。
工程上的难点是把三种完全不同的通道统一成一套命令层：SSH 的密钥、代理与交互式认证，WSL 的发行版与用户切换，Docker 的容器命名与存活检查，最后都收敛到同一套「准备 Node 运行时 → 安装 dsh → 起服务 → 健康检查」的流程；状态监控也不做伪数据，全部从 /proc 采样。
GitHub 仓库的元信息、README 与最近提交会随部署同步；源码仍在 GitHub 查看。
ZCode-style remote workspaces for DeepSeek Harness (dsh): SSH, WSL and Docker.
The remote dsh runs as a persistent systemd service (or setsid session) inside the SSH host, WSL distribution or Docker container, and remote sessions are executed by a detached dsh --profile headless runner there. The local app selects the workspace, shows the native chat, and monitors status; there is no local console proxy. Closing the local app does not stop the remote dsh.
Target: DeepSeek Harness Desktop
0.2.1-rc.5. Validated end-to-end against203.0.113.10(AlmaLinux 9.5).
The Add-connection dialog is a 1:1 rebuild of ZCode's renderer components (OVn / xVn / yVn / nVn / Smt / rmt / hmt / Cmt): the same DOM structure, spacing, type scale and ZCode design tokens (light palette by default, dark palette under body[data-ds-dark-theme]), with device-first interaction:
| New connection (Settings → Remote devices) | SSH config import |
|---|---|
| Create project (device picker) | Select folder |
|---|---|
The three surfaces — new connection, create project and the centered folder picker — are rebuilt from the 3.17.2 renderer with the same DOM structure, class values, type scale and copy as ZCode. The screenshots use documentation-range addresses (192.0.2.0/24, 203.0.113.0/24).
| Area | What it does |
|---|---|
| Targets | SSH (password / private key / passphrase / agent / keyboard-interactive), WSL distributions on Windows (wsl.exe --exec bash -lc, default or named distro/user) and Docker containers (docker exec -i ... sh -lc, name/id/prefix, must be running) |
| SSH hosts | TOFU host-key check; connection test with latency and remote Node detection |
| Add connection | 1:1 ZCode device flow: wizard steps 选择设备 / 连接 / 选择目录, 已保存的设备, SSH config 中的 Host, WSL 发行版 and 运行中的容器 sections, plus 新建 SSH 连接 / 手动输入 WSL / 手动输入 Docker; the settings step uses ZCode's exact per-kind forms (WSL distribution datalist + Linux user hints/root warning; Docker select/manual picker); minimize is available on every step and parks the wizard in a ZCode-style background card |
| Recent workspaces | clicking a recent path opens that native workspace directly, including from the status panel; a stopped service is started in the background |
| Background connect | both connecting and workspace creation can continue in the background; a bottom-right pill shows progress and opens the workspace on completion, and reopening it resumes the wizard |
| SSH config import | parses ~/.ssh/config Host blocks and fills host, port, username and IdentityFile |
| One-click create | the connect phase installs/reuses the shared dsh runtime; the directory step then only starts the service. Full chain: channel (SSH/WSL/Docker) → Node ≥ 22 (portable download when absent) → @deepseek-ai/dsh → credentials → launcher → systemd/setsid → health check |
| Persistence | systemd Restart=always (system unit, or user unit + linger) or setsid nohup + @reboot cron. Survives SSH disconnect and local app exit |
| Status monitor | running / starting / stopped / error / unreachable; PID, uptime, RSS, CPU, HTTP status, port, last check. CPU is sampled from /proc/<pid>/stat over 0.5 s and RSS from /proc/<pid>/status (no lifetime-average or fabricated values) |
| Native workspace | each remote workspace is projected into the native sidebar; its agent is bridged to a detached remote headless session; device chips and the status panel select that same native row |
| Lifecycle | start, stop, restart, logs (journalctl/tail), remove (service + runtime dir only; project dir kept) |
| Credentials | optionally copies local $DSH_HOME/.credentials.yaml (0600) into each remote workspace's own DSH home |
| Legacy import | imports hosts from ZCode's ~/.dsh/dsh-ssh.json on first load |
The local side stays a monitor and chat surface: the agent process, tools and files live on the server.
After DeepSeek Harness has started at least once:
node C:workdsh-ssh-remote\bin\install.mjs --profile desktopThe script adds a link: dependency and the bundle to ~/.dsh/profiles/desktop/package.json, then creates a junction in the profile's node_modules. Fully restart DeepSeek Harness afterwards.
Manual install: add
"dsh-ssh-remote": "link:C:/work/dsh-ssh-remote"to dependencies, append "dsh-ssh-remote" to dsh.profile.bundles, and create
cmd /c mklink /J "%USERPROFILE%\.dsh\profiles\desktop\node_modules\dsh-ssh-remote" "C:workdsh-ssh-remote"Local: $DSH_HOME/ssh-remote/state.json (hosts, workspaces, settings; mode 0600), known_hosts.json.
Remote: ~/.dsh-remote/runtime/dsh-<version>/, ~/.dsh-remote/workspaces/<id>/{home,logs,run}/.
The remote Web listener binds 127.0.0.1 only; no LAN port is opened.
@deepseek-ai/dsh@0.2.1-rc.5 in ~1 minute.dsh web: ...?token=...; an unauthenticated HTTP request without the token returns 401 (used as readiness evidence only).ps: RSS matches VmRSS in /proc/<pid>/status; CPU is a 0.5 s /proc/<pid>/stat delta, not the misleading lifetime pcpu average.systemctl is-active = active.loaded 2 model(s)) all work./root, to avoid SELinux 209/STDOUT on RHEL-family hosts.当前系统未检测到可用的 WSL 环境 / 当前系统未检测到可用的 Docker 环境), including the per-kind forms and badges. Full deploy inside a live WSL distribution or container still needs a host that provides one.Linux remotes only: WSL distributions and Docker containers must provide a Linux bash/sh, Node ≥ 22 or a way to download the portable runtime (curl, wget or an existing Node).
WSL requires a Windows desktop with the WSL optional feature installed; Docker requires a running daemon and a running container.
The remote host needs access to an npm registry (default npmmirror).
Credentials are synced, but local model selection/settings are not yet mapped to the remote headless runner.
Background connect progress is in-memory: restarting the local app drops the pill (created workspaces are restored from state.json); there is no cancel button for an in-flight install/create.
No local mirror of remote project files; the agent and tools run inside the target.
Docker workspaces do not survive removal of their container; WSL workspaces survive until the distribution is terminated/unregistered.
WSL2 HTTP proxy auto-rewriting (ZCode maps a loopback proxy to the Windows host gateway) is not implemented; use a reachable registry/proxy inside the distribution.
node C:workdsh-ssh-remote\bin\uninstall.mjs --profile desktopThis removes the local link/dependency selection only. Delete remote workspaces from the UI to stop their services.
See docs/zcode-ssh-reverse-engineering.md for the ZCode 3.17.2 SSHBackend / WSL / Docker backends, remote asset deployment, the 3.17.2 connect wizard (stages, install confirmation, error card, log panel), the device-management "新建连接" dialog, the "创建项目" dialog and the embedded "选择文件夹" picker, plus the rea evidence summary.
MIT