dsh-pocket-console

Step out — the task won't stall.

You drop a task on DeepSeek Harness before heading out, expecting to review the result when you get back — and it is stuck on the plan-confirmation question.

dsh-pocket-console exists for that: it keeps a stalled session moving while nobody is at the desk.

It turns the two moments that need a human — tool-call approvals and ask_user_question prompts — into Feishu cards on your phone once the desktop has had its chance to answer; one tap and the agent continues. The phone gets that one decision and nothing else: approve, reject, or answer. The desk, the session, the settings and the credentials stay where they are, and one outbound long connection is all it takes — no public IP, no domain, no tunnel.

English · 简体中文

Install and uninstall

The published tarball carries its Feishu transport inside it, so the install resolves nothing that needs a build permission and runs no install-time script:

dsh plugin --profile web add dsh-pocket-console

Then restart dsh web and open Settings → Plugins → Plugin configuration → Pocket console:

1. Click Scan to create an app. If you already have one, click Use an existing app and enter its App ID and App Secret.
2. Scan the QR code with Feishu (the link is valid for 10 minutes and can be used once).
3. The card reports Bound and lists the App, the Recipient and the Connection (established / dropped, reconnecting…).

Credentials and the recipient live in the credentials store, so every later dsh start reconnects the long connection by itself — no settings visit, no second scan. Use another app switches apps; Unbind stops the phone side. Installing straight from GitHub needs one build script allowed through, which troubleshooting covers.

To remove it:

dsh plugin --profile web remove dsh-pocket-console

Tuning it

It works out of the box: the Settings card exposes three settings and nothing else.

Every row can be Reset, and an edit has to be saved (the card marks it Unsaved first).

Anything the card does not show belongs to the deployment. The channel, the interface language, the mirror lifetime and the like stay out of the card and are overridden in the profile layer — a patch replaces the row's entire config, so restate every key you want to keep:

$DSH_HOME/profiles/web/cordis.patch.yml

- id: pocket-console
  config:
    channel: dsh-pocket-console/providers/feishu.js
    channelConfig: {}
    delaySeconds: 120
    titlePrefix: DSH
    resultNotify: idle
    resultNotifyCooldownSeconds: 0
    mirrorTtlSeconds: 60
    locale: zh

That is every key at the value the code already ships, so copying it changes nothing. Every setting documents the rest.

Security

An approval card is a remote code-execution authorization channel, so it is built like one:

• Grants are single-use. allowed-once applies to that call only; the random id that carries it dies the moment the request settles.
• The blast radius of a lost phone is one answer — or one task. The card is itself a credential, so only the bound recipient can press: a private chat only binds an unbound deployment, and group messages never bind. Answering a card decides something the desk already started. Starting a new task from the phone is larger than that: it begins work in the current session's workspace, so a lost phone is a way to run a turn in that project, within whatever the agent's own approval rules allow. It still cannot choose a workspace, reach another project, or touch settings and credentials.
• Secrets never go in environment variables. Every command the agent runs inherits the process environment, so credentials live in $DSH_HOME/.credentials.yaml.
• The app asks for the minimum. Three permissions, one event and one callback, from the minimum base rather than the default template's cloud-doc permissions.
• There is no server of ours in the path. Feishu sees the card, because Feishu is the transport.

Full invariants, threat model and reporting: SECURITY.md.

What it deliberately does not do

• No GUI mirroring. Moving the interface would move the workspace, the session, the settings and the credentials — so you also cannot browse sessions, read history, or change settings from the phone. What you can do is start the next task: when a run finishes while the phone holds you, the result card itself carries the form that opens a new session in that same workspace — no second card, and no second notification.
• No push to the phone by default. A card goes out only when the desktop has not answered in time — with two deliberate exceptions, because both are somebody being blocked, not a status update: an approval or question, and the result of a finished run.
• No auto-approval, ever. The plugin never decides in your place: silence never approves.
• No inbound listener. No port, tunnel, relay or third-party server — so also no "reachable from anywhere".
• No changes to DSH. It ships as a dsh.bundle profile layer and registers on two documented waterfalls. Nothing in the harness is patched or forked, and a DSH upgrade cannot break it.

How it breaks

These are honest gaps, not choices.

• Mirroring to the desktop needs the page open. After a phone answer, the open page settles the way a click there would; with no page open the answer still reaches the model and the session log, but a page opened later will not replay it — the mirror is valid for one minute.
• One Feishu app serves one DSH instance. Long-connection events are not broadcast, so two instances sharing one bot send approvals to a random side.
• Card text is limited by bytes, not characters. The documented cap is 30 KB, and that figure is wrong: measured against a real tenant, this plugin's own app accepted a 131 KB request body and was refused at 164 KB. What the body carries is also not the text's own size — the text is escaped into the card JSON and the card JSON is escaped again, so a quote or a backslash costs more each time. Text is therefore held under 32 KB as the request will count it, which is measured rather than copied, and it is truncated explicitly when it does not fit. That is roughly 11,000 Chinese characters at the measured rate (a 60-step plan costs about 4.6 KB), so a long plan arrives whole rather than as a fragment.

Which of these is this?

If you want the computer in your hand, install one of the first three. This plugin is for the other case: the computer stays where it is, and only the decision travels.

For developers

• Shape: a dsh.bundle profile layer, plain ESM, no build step; the published package is about 4 MB because the Feishu transport and its dependencies are bundled inside the tarball.
• Tests: npm test. No install, no network and no credentials — the production dependencies are replaced by in-repo stubs.
• Gates: npm run check:parity (one setting has to agree in six places) and npm run e2e (installs the packed artifact into a real dsh web to prove it activates). That is what CI runs: verify on two Node versions, real composition, publish payload.
• Before changing something: docs/decisions/ records why it is shaped this way; docs/development.md covers the suite and debugging.
• How a change lands: CONTRIBUTING.md; what changed when is in CHANGELOG.md. Writing a transport other than Feishu: the channel contract.

Going further

License

MIT