Data, privacy, and security

Locate local data and understand backup scope, models, plugins, and remote-access boundaries.

Harness listens on loopback by default, and the desktop embeds its Web interface. Local storage does not mean fully offline operation: models, plugins, tools, and updates can use the network.

Data locations

Data	Release location or boundary
Harness user data	~/.dsh by default; release builds can honor DSH_HOME
Profile configuration, plugins, and patches	$DSH_HOME/profiles/<id>; first installation uses tauri, with web as fallback
Local plugin source	The directory you choose; it is not copied into the profile, which only stores a link: declaration
Local plugin hot-reload patch layer	cordis.hmr.patch.yml in application data; absent when no local plugin is mounted
Session and workspace records	Directories outside profiles in Harness data; switching profiles does not isolate all history
Repository files and Git worktrees	Your chosen workspace directories, outside profile backups
Default managed runtime and dependencies	runtime/ and dependencies/ in application data; the core uses dependencies/dsh/
Desktop settings	.store.dat in application data
Harness service log	logs/dsh-web.log in application data
Profile backups	$DSH_HOME/.backups/; contents cover only the active profile directory
Recovery archives	recovery-backups/ in application data, outside $DSH_HOME; includes sessions, shared storage, and all profiles
Service address	Prefer http://127.0.0.1:3080; another port may be used if it is busy

Open the actual data directory from desktop Running → Data Directory. Do not infer the active environment from a directory name alone.

Back up and restore

1. Create a profile backup in Running → Profiles → Backup; prefer Restore as New and verify it.
2. Use Export recovery archive to preserve sessions. Follow its included manual recovery instructions, not the profile restore button.
3. Back up workspaces and uncommitted changes separately; migrate or roll back directories in Running → Data Directory. See Data management for directory migration steps.

Profile backups exclude sessions outside the profile. Recovery archives also exclude workspace files, dependencies, and existing backups. Include credentials only controls .credentials.yaml; other configuration can still contain secrets. Treat all backups as sensitive. Stop relevant clients and check scope before deleting, resetting, restoring over data, or migrating.

Network and remote access

Operation	Network and trust boundary
First installation and updates	Download runtimes, the core, and tools from release or fallback sources
Model requests	Send requests and necessary context to the chosen provider; check its data policy first
Plugin installation and execution	Access npm/GitHub during installation; plugins can execute local code and contact remote services
Remote use	The Remote access plugin provides SSH, authenticated LAN sharing, and Cloudflare tunnels; authorize only trusted devices

Enable sharing through desktop Share or Harness Settings → Remote access; see Mobile remote access. Paired authorization persists. Disabling sharing or rotating an access code does not revoke issued sessions. Use Revoke paired access to withdraw device access; never expose an unauthenticated service. Host trust is not authentication, and pairing does not replace tool permissions.

Profiles, workspaces, and Git worktrees are not operating system sandboxes. For untrusted code or plugins, use a separate user, container, or virtual machine, least-privilege credentials, and reviewed tool authorization. Keep keys and private data out of chat, screenshots, logs, and issues.

Development environment isolation

• Debug forces ~/.dsh.dev, ignoring inherited DSH_HOME.
• Default managed runtime and dependencies use dev/runtime/ and dev/dependencies/ in application data; the core uses dev/dependencies/dsh/.
• The log is dev/logs/dsh-web.dev.log; settings use .store.dev.dat at the application data root.
• Preferred ports are 3081 for debug and 3080 for release; either can fall back to another available port.