When a small team wants “one shared DeepSeek Harness Web,” split three layers: the local agent process, the path to the Web UI, and egress to npm/APIs. The public one-liner is often npx @deepseek-ai/dsh web, defaulting to 127.0.0.1:3080—fine for solo trials, not for an unauthenticated bind to the whole group. Remote teammates should use SSH local forward or run their own instance; KuaiLian only steadies egress for installs and model calls—it does not replace one workspace and one key per person. Connected KuaiLian ≠ team Web deploy done. Commands and bind behavior follow deepseek.com/harness and deepseek-ai/deepseek-harness.
Last week a group port-forwarded the meeting-room dsh through the office router and pasted http://public-IP:3080 into chat. Ten minutes later someone saw another person’s workspace paths in Settings, and API spend started jumping. The failure was not “teams shouldn’t collaborate”—it was treating an unauthenticated local agent UI like a shared whiteboard. Below: what you can deploy, team habits, and how KuaiLian fits—no company-policy bypass, no cracks.
Install/clone timeouts → Harness npx network split (that page only). KuaiLian won’t connect → connection fix; device kicks → device limit. This page is team Web / sharing boundaries only—no node-speed or unlock claims.
Three layers before you “share Harness”
People say “share Harness” while mixing three needs:
- Shared egress — stable paths to registry, GitHub, model APIs (network; KuaiLian or another VPN/proxy can help)
- Shared conventions — Node line, plugin allowlist, workspace habits, acceptance cases (docs + repo)
- Shared process — many people clicking one machine’s Web UI (process + permissions; highest risk)
Do the first two. The third has no account system in developer preview. Opening the page means the starter user’s rights on files and shell. Writing “shared process” as “open a port” is how most incidents start.
Web / intranet deploy: loopback, bastion, never bare 3080
Solo laptop: Node per README, then official npx @deepseek-ai/dsh web (or source path with pnpm run build then pnpm dsh web). Open the documented loopback URL. Pin a version tag in the team so half the room is not on a newer RC with different bind rules.
Bastion / always-on box, laptop elsewhere: keep the server on loopback; on the laptop use SSH local forward so remote 127.0.0.1:3080 lands on a local port, then browse localhost. Traffic rides SSH—scanners never see an open agent port on the public IP.
LAN “intranet” demos are the same rule with a sharper edge: binding only to a private NIC without auth is still “whoever on that VLAN can drive your agent.” Prefer SSH from the same LAN, or a reverse proxy that authenticates before traffic reaches 3080. A reverse proxy with no auth is just a longer URL.
OK
Loopback + SSH -L; one dsh per person; reverse proxy with real login in front.
Not OK
Router map of 3080; bind-all “for convenience”; paste a public URL as the “team door.”
Verify
On the host, listener stays on 127.0.0.1; public IP:3080 must fail. If the CLI refuses all-interface bind, treat that as protection—don’t patch it away.
Stop
A stranger opens Settings, sees workspace paths, or fires tool calls—kill the process, close the port, rotate API keys.
Honest limit: this page does not turn an unauthenticated UI into multi-user SaaS. If policy forbids self-hosted agents, follow policy.
Team habits: one instance each; share conventions, not keys
- Version pin — document Node major + dsh version next to the README; align before calling preview quirks “bugs.”
- Plugin allowlist — plugins share the process and the starter user’s rights. Install only reviewed sources; no “install ten plugins” scripts without review.
- Workspace — agree default cwd; never point at Downloads or key stores. Wrong systemd WorkingDirectory hands the agent a home directory.
- Keys — per-person spend limits; never paste into chat or commit .env. Treat Harness home credential files like password files.
- Sessions — scrub paths and key fragments before sharing logs; never zip the whole credential tree as an “env sync pack.”
Put acceptance cases in the repo: one minimal tool call, one explicit file edit with rollback, one intentional network drop with a readable error. Each person runs them locally—better than “your Web tab loads, so the team is green.”
Multi-person proxy notes with KuaiLian
On restricted networks the usual pain is npm timeouts on @deepseek-ai/dsh, jittery clones, flaky TLS to model APIs. KuaiLian’s job is egress so official commands can finish—not turning Harness Web into a “VPN chat room.”
- Fetch vs post-connect failures: only the npx network article; change one variable class at a time.
- One subscription for many seats: check device limits—someone kicked looks like “Harness can’t reach the API” when the tunnel died.
- Domestic docs, banking, meetings dragged into the tunnel: use split / bypass; don’t Global the whole machine “for the agent” then blame slowness.
- Connected but almost nothing loads: connected, no internet—don’t thrash Harness model settings to hide network faults.
- Hotel/airport captive portals before any team bastion SSH: captive portal—finish portal auth, then VPN, then tunnel.
Mnemonic: KuaiLian = is the path up; Harness = how the agent runs; repo conventions = how the team aligns. Do not accept one layer for another.
Acceptance and rollback
- Each laptop: pinned start command brings up UI; loopback works; public IP:port does not
- Bastion path: after SSH forward, browse only the local forwarded port; closing the tunnel must kill access
- KuaiLian up: same minimal tool call succeeds; tunnel down: failure is obvious, not silent file corruption
- Keys: no shared plaintext; rotate on spend anomalies
- Rollback: stop dsh → confirm no surprise listeners → reinstall KuaiLian from the download page if needed
Still stuck: record OS / Node / dsh version, laptop vs bastion, whether KuaiLian stayed Connected, and whether failure was fetch or tool call. Also see Guides and FAQ.