dsh-dispatch

Dispatch tasks to DeepSeek Harness from your phone. Approve tool calls with one tap. Command every machine you own.

从手机给 DeepSeek Harness (dsh) 派任务、审批一键批、一部手机指挥所有机器。中文说明 →

Like Claude Code's Dispatch + Remote Control, but for dsh — open source, end-to-end encrypted, self-hostable.

Why this exists

dsh web binds to 127.0.0.1 with no auth — by design. Every existing remote tool wraps that web page in a WebView. dsh-dispatch is not a mirror. It is a command center:

	WebView mirrors	dsh-dispatch
See sessions from the couch	✅	✅
Dispatch a new task from your phone	❌	✅ into an isolated git worktree
Approval push notifications, tap to allow/deny	❌	✅ for every session, even desk-started ones
Many machines on one screen	❌ one tunnel each	✅ one board
Relay can read your traffic	usually	never — zero-knowledge, E2E encrypted

• 📤 Dispatch — type a prompt on your phone; the machine creates a git worktree, spins up a fresh dsh session, and reports the final answer back with a push notification.
• ✅ Approvals on your lock screen — the plugin joins dsh's approval/request waterfall. Phone and desktop race; first decision wins; nothing is ever auto-approved.
• ❓ Questions forwarded — ask_user_question choices show up on your phone; answer from anywhere and the session continues (also rescues the upstream no-answerer hang).
• ⚡ Optional full-access tier — dispatch under dsh's danger-full-access to skip approvals for fully-trusted tasks; off by default, machine-gated, permanent red badge on every such session.
• 🖥️ Multi-machine — one phone, N machines, one board with live session states.
• 🔒 Zero-knowledge relay — routes ciphertext it cannot read. The 32-byte pairing secret travels only inside the QR code. Self-host the relay with one command.

How it works

┌────────────┐  E2E encrypted   ┌───────┐  E2E encrypted   ┌──────────┐
│ dsh plugin │ ───── wss ─────► │ relay │ ◄──── wss ────── │ PWA      │
│ (machine)  │                  │ (dumb │                  │ (phone)  │
│            │                  │ pipe) │                  │          │
└────────────┘                  └───────┘                  └──────────┘
  approval/request waterfall      sees only                approve / dispatch
  ctx.agents.create + worktree    ciphertext               web push alerts

package	npm	what it is
dsh-dispatch		the dsh plugin — event-bus listener, approval race, worktree dispatch
dsh-dispatch-relay		stateless ciphertext router + Web Push, Docker/npx one-liner
@dsh-dispatch/pwa	—	installable phone app (PWA) — no app store needed

Quickstart

On the machine that runs dsh:

# 1. Run a relay — yours, or any you trust (it can't read your traffic)
npx dsh-dispatch-relay            # listens on :8787

# 2. Install the plugin into your dsh profile
dsh plugin --profile web add dsh-dispatch

# 3. Configure it — ~/.dsh/profiles/web/cordis.patch.yml
- id: dsh-dispatch
  config:
    relay: 'ws://localhost:8787/ws'          # wss:// for anything non-local
    allowedRoots: ['/path/you/allow']        # dispatch stays OFF until you set this

# 4. Boot dsh, then run /dispatch-pair and open the printed link on your phone
dsh web

Approval forwarding works immediately after pairing; dispatch activates once allowedRoots is set. Relay self-hosting (Docker, VAPID push keys) and every config key: see packages/relay and packages/plugin.

Security model

• Pairing = trust. The QR/pairing code contains a 32-byte secret; whoever scans it controls the machine within allowedRoots. Treat it like an SSH key. Rotate anytime with /dispatch-repair.
• E2E encryption (nacl.secretbox, per-message nonce). The relay stores room presence and push endpoints — never plaintext, never keys.
• No timeout-approve exists anywhere in this codebase. Unanswered approvals stay pending and re-remind.
• Dispatch is allowlisted. Requests outside allowedRoots are rejected visibly. Worktrees are never auto-deleted.

Status & roadmap

v0.1 — developer preview tracking dsh 0.1.x (upstream warns of breaking changes; every harness API touchpoint is isolated in one adapter layer). The full loop — phone dispatch → worktree session → real tool execution → sandbox-escalation approval pushed to the phone → allow → command runs — is verified end-to-end against dsh 0.1.1-rc.2 with the real DeepSeek API.

v0.2 adds ask_user_question forwarding and the optional full-access dispatch tier, both verified end-to-end against dsh 0.1.1-rc.2 with the real DeepSeek API (a question answered from the phone flows back into the running session; a full-access dispatch runs under danger-full-access and writes outside the workspace with no approval prompts).

Known limitations (v0.2):

• A full-access session runs under dsh's danger-full-access preset, which sets approval: 'never' — so it raises no approval cards at all. Full access and phone approvals are mutually exclusive per session, by dsh's own preset semantics. That's the trade: speed for no review surface.
• Web Push works through the relay, but lock-screen delivery has only been verified in desktop browsers so far, not on a physical phone over HTTPS.
• Each dispatch gets a fresh worktree from the repo's HEAD — files created by a previous dispatch live in that dispatch's own worktree.
• A pending question doesn't survive a phone reload (no questions.get in the protocol yet); the machine re-reminds until answered.

Roadmap: hosted PWA → real-device push polish → session steering → fleet views.

中文

这是什么：dsh 官方没有手机端、没有远程方案。现有第三方全是"把 localhost:3080 套壳进 WebView"。dsh-dispatch 走的是 Claude Code Dispatch 那条路——一个指挥中心：

• 手机派任务：输入一句话，机器自动开独立 git worktree 跑一个新会话，跑完推送结果。
• 审批推送：任何会话（包括你在电脑上开的）的工具审批都会推到手机，锁屏一键允许/拒绝；手机和桌面竞速，先答先赢，永不超时自动批准。
• 多机看板：一部手机管 N 台机器，会话状态实时同屏。
• 零知识中继：relay 只转发密文（端到端加密，密钥只存在于配对二维码里），一条命令自托管。

快速开始：npx dsh-dispatch-relay → dsh plugin --profile web add dsh-dispatch → 在 profile 的 cordis.patch.yml 里配 relay 和 allowedRoots → dsh 里执行 /dispatch-pair，手机打开链接即配对。

安全：配对码即信任边界（当 SSH 私钥对待，可随时 /dispatch-repair 轮换）；派任务只进你白名单的目录；审批永不自动通过。

Contributing

Issues and PRs welcome. The wire protocol is frozen in docs/PROTOCOL.md; product boundaries in docs/PRODUCT.md; every dsh API claim is sourced in docs/dsh-plugin-groundtruth.md.

Keywords: DeepSeek Harness plugin, dsh-plugin, dsh remote control, mobile approvals, phone dispatch, agent remote control, E2E encrypted relay, Claude Code Dispatch alternative, DeepSeek 手机远程控制, 手机审批, 远程派任务.

License

MIT