dsh-rgate

The Harness's built-in trustedHosts fence is a DNS-rebinding defense, not an authentication layer. If you expose the Web UI over Tailscale, a LAN, or a public domain, anyone whose Host header clears the fence can drive your agent directly. dsh-rgate adds the missing authentication in front of the entire browser surface.

The plugin injects a gate script into every index.html so that anonymous non-loopback visitors land on a self-contained login page. At the same time it shadows all 52 unary RPC routes plus respond and session.export, returning a 401 before the request body is even parsed unless a valid session cookie is present. Passwords are stored as scrypt hashes with a random salt and constant-time comparison; login is throttled with exponential backoff after five failures; audit events are written to the harness log; and a Settings panel exposes gate status, logout, and password change. Loopback addresses always bypass the wall, preserving the local admin path.

It is aimed at self-hosted users who expose the Harness beyond localhost for a solo developer or a small team of three or five: one password, one gate, no enterprise auth stack required. Local development is completely unaffected.