DeepSeek Harness’s plugin ecosystem allows feature extensions. When using the DSH Web or Desktop profile on shared devices or in public workspaces, Workspace and Session are open by default. The dsh-vault-plugin provides the ability to directly lock a Workspace or Session from the sidebar, automatically creates and binds a password group, and offers basic access control at the UI layer. This is a community plugin maintained by robbin810130 and is not affiliated with DeepSeek AI or the official DeepSeek Harness team.

Core Features

The plugin provides the following capabilities:

  • Direct sidebar locking: Click the inline lock button in a Workspace or Session row to lock it.
  • Automatic password group creation: Enter a password on the first lock; the plugin automatically creates a password group and completes the binding, without requiring you to create one manually in the settings page first.
  • Unlock flow: Unlocking is initiated only from the “Unlock” button in the main area, and no password dialog pops up automatically when clicking a list entry. Clicking a protected entry displays a locked placeholder page.
  • Password policy and automatic locking: Supports configuring password policies (minimum length, uppercase/lowercase, digits, and symbol requirements). Supports automatic locking, locking on system sleep, failed-attempt protection, and pause time.
  • Session invalidation: Re-locking the workspace immediately invalidates the current session, preventing continued browsing of already opened protected content.
  • Recovery key: The recovery key is displayed only once upon successful creation or restoration. This key is not written to settings, logs, or browser storage.

Installation and Configuration

Use the native DSH command to install the plugin. Ensure that DSH is installed and available in the PATH.

dsh plugin --profile web add github:robbin810130/dsh-vault-plugin#v0.2.11

After installation, restart the DSH Web profile. In the DSH interface, go to Settings → Plugins → Vault to adjust the locking policy or manage automatically generated password groups.

Usage Flow

  1. In the sidebar, locate a Workspace or Session and click the inline lock button.
  2. Enter and confirm the password, then click “Save and Lock”. The password group is automatically generated and bound.
  3. Later, clicking a protected entry displays the locked placeholder page; when access is needed, click “Unlock” in the main area and enter the password.
  4. Go to Settings → Plugins → Vault to adjust the locking policy or manage automatically generated password groups.

Notes

  • Security boundary: The plugin only controls front-end access in DSH and does not encrypt the persisted data of the original Workspace, Session, or project source files. On-disk encryption is planned for phase two; this plugin should not be treated as a disk encryption or data loss prevention product.
  • Privacy and dependencies: It does not rely on external services, does not initiate network connections, and does not upload passwords, recovery keys, or session content.
  • Version compatibility: The Web profile requires DSH 0.1.7-rc.1 or higher; the Desktop profile requires 0.2.0-rc.2. Unknown versions are unverified.
  • Permission management: The dependency manager may regenerate directories for other plugins. If other plugins write runtime data under node_modules, pay attention to backup and restoration.