seek://plugins/dsh-overleaf
dsh-overleaf — an Embedded Overleaf Workbench for DSH Sessions
#overleaf #latex #reverse-proxy #writing #academic
TL;DR
Per its README, dsh-overleaf embeds Overleaf as a fourth DSH session tab via a same-origin reverse proxy: editing, compiling and PDF preview stay operable, the composer sits below, selections become structured quotes, agent LaTeX lands at the caret after review, and an assist panel adds compile fixes and .bib/.tex sync. Framing headers block plain iframes; the proxy strips them for one origin.
dsh-overleaf embeds a complete Overleaf workbench as a fourth tab on DSH session pages: a reverse proxy inside the host process serves your Overleaf site same-origin — the framing headers that block plain iframes are stripped for exactly one configured origin — so editing, compiling and PDF preview all stay live beside the untouched composer. Structured quotes flow from editor selections into the chat, agent-written LaTeX flows back to the caret after review, and an assist panel handles compile-log fixes plus bidirectional .bib/.tex sync for both overleaf.com and TeXPage. Per its README it is GitHub-install only (the npm name belongs to another project), targets DSH 0.1.7-rc.2 on the web profile, and keeps its routes loopback-fenced.
Facts
- install
- dsh plugin --profile web add github:gychen-NJU/dsh-overleaf
- license
- MIT
- note
- 据其 README：npm 包名 dsh-overleaf 已被另一项目占用，本插件不发 npm、仅 GitHub 安装（仓库内置构建产物）；DSH 桌面壳需 desktop 分支。目标运行时 0.1.7-rc.2 web profile，peer 范围自 0.1.0-rc.5 起走旧设置入口。
Key points
- Per its README, the shape is a fourth session-page tab (id overleaf, order 30, visible whenever the tab bar shows): a toolbar offers reload / open window / login / cookie / panel; the iframe runs the full Overleaf editor, compiler and PDF preview with a split source-plus-PDF view and Recompile; only the message area is replaced — the composer, workspace recording and deliverables stay untouched
- Why the proxy exists, per its README: Overleaf sends X-Frame-Options / CSP frame-ancestors on every response, so a plain iframe is refused; the plugin ships an HTTP/1.1 reverse proxy inside the DSH host process, forwarding browser traffic at /overleaf-proxy/<original-path> to the configured upstream — one fixed origin, locked by configuration, no open SSRF surface; a single shared origin is what makes the browser-level bridges possible at all
- Selection quoting and caret insertion (R5/R6): selectionchange in the iframe surfaces a floating quote button that inserts a structured quote chip through the official inputTriggers.registerSource({name:'quote-ref'}) pipeline, falling back to plain-text block quotes when absent; template and agent-generated LaTeX write to the live cursor through CodeMirror APIs with editable fallbacks, with agent output captured into a review box before insertion
- The assist panel triples plus sync: ai-insert (describe the change, the agent writes, output auto-captured into the custom-content box for review, then inserted at the caret), selection-ai (ask about or rewrite a selection with reviewed replacement, drift checks on by default) and compile-fix (read the post-Recompile log's errors and warnings, let the agent propose fixes for the open document); .bib sync auto-detects workspace bibliographies recursively, and the current .tex syncs bidirectionally — Overleaf-to-local by default, with reverse whole-document replacement behind explicit confirmation plus document-ID, revision, snapshot, write-verification and save-event checks
- Security model per its README: every plugin route is loopback-fenced at the socket level — non-loopback callers get 403 before handlers read bodies; the proxy targets exactly one configured origin and URL parsing rejects scheme/path/host overrides; framing protections are relaxed only for that user-chosen upstream while other headers pass through; cookies are forwarded but never echoed in API responses, and logout removes the stored credential immediately; the README advises treating baseUrl like any tool holding your LaTeX session — configure private or internal instances only inside your trust boundary
FAQ
Why not just iframe Overleaf directly?
Per its README: Overleaf sends X-Frame-Options / CSP frame-ancestors on every response, and browsers refuse the direct iframe; the plugin runs a same-origin reverse proxy inside the DSH host (under the /overleaf-proxy/ prefix) that strips framing headers and rebases links and assets in small HTML bodies, targeting exactly one configured upstream with no open relay surface.
Which Overleaf sites are supported?
Per its README, v1.0.0 consolidates two-site support for overleaf.com and TeXPage (tex.nju.edu.cn) — Overleaf keeps its document-ID and save-event lifecycle while TeXPage separately adapts its file tree, CM6 editor and server readback; both require a unique same-named bibliography and preserve a pre-write snapshot.
How do I install it, and does the desktop app work?
Per its README: the npm package name dsh-overleaf is occupied by another project, so this plugin is not published to npm — install from GitHub (the repository commits the prebuilt lib/ bundle, so git installs need no build step and no allowBuilds); the DSH desktop shell needs the desktop branch, which fixes dsh-app:// scheme routing and TeXPage's Socket.IO origin construction — everything outside the desktop shell behaves identically on both branches.
Official references
- docsRepository ↗
- docsREADME (English) ↗
- docs中文 README ↗
- docsOverleaf ↗
Embed this badge
[](https://dshseek.com/plugins/dsh-overleaf/)Shows the month this entry was last human-verified — it changes only on re-verification, never with daily stats.