Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configura
Alpha.2 rejects wildcard Web binds and adds native TLS; rc still permits wildcard configuration. The default rc retains a configuration path to an all-interface listener and automatic LAN host trust; alpha.2 replaces it with concrete-interface binds and native TLS. Public URL support arrived in alpha.1. Both heads still use signed-cookie authentication, but that fact does not isolate the signing material from a same-user command (section 18).
Channel: preview-or-beta; new listener protections alpha-only. Half: both. Date: 2026-10-03 (public URL support); 2026-10-09 (concrete binds and native TLS).
Operator consequence: On the rc, remove webserver host: 0.0.0.0 from all composition layers and forward loopback through SSH for remote access. Treat the printed token-bearing URL as a credential. Alpha’s supported remote-listener path adds configuration and migration work (section 21); TLS protects transport, not the inner agent/operator boundary.
Receipt
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/host/webserver/src/index.ts#L127
- https://github.com/deepseek-ai/deepseek-harness/blob/d743267388641bc76f17c45ce8b4c231aed1d32c/packages/host/webserver/src/index.ts#L262-L268
- https://github.com/deepseek-ai/deepseek-harness/blob/d743267388641bc76f17c45ce8b4c231aed1d32c/packages/bundle/web-app/src/startup.ts#L64-L70
- https://github.com/deepseek-ai/deepseek-harness/blob/d743267388641bc76f17c45ce8b4c231aed1d32c/docs/user/guide/public-deployments.md#L27-L35
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/client/connection/src/rpc-host.ts#L103-L112
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configura
Profile citations
- deepseek-harness / claim / web-ui-login
- deepseek-harness / claim / alpha-listener-and-tls
Source links
Primary links, including exact changelog lines when available.
- tagged commit file2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configuradeepseek-ai/deepseek-harness / packages/host/webserver/src/index.ts#L127tagged commit file2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configuradeepseek-ai/deepseek-harness / packages/host/webserver/src/index.ts#L262-L268tagged commit file2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configuradeepseek-ai/deepseek-harness / packages/bundle/web-app/src/startup.ts#L64-L70tagged commit file2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configuradeepseek-ai/deepseek-harness / docs/user/guide/public-deployments.md#L27-L35tagged commit file2026-10-13-deepseek-harness-alpha-2-rejects-wildcard-web-binds-and-adds-native-tls-rc-still-permits-wildcard-configuradeepseek-ai/deepseek-harness / packages/client/connection/src/rpc-host.ts#L103-L112
Versioned source: run artifact