Introduction

The DeepSeek Harness (DSH) web version is at risk of being directly operated when the machine is unattended or shared by multiple users. The dsh-lock plugin adds an access gate before a user can reach DSH, using a full-screen overlay and password verification. Only by entering the correct password can the user enter the workspace.

Function Overview

  • Full-screen overlay: Covers the entire interface when locked, preventing direct session manipulation.
  • Manual lock: Locks immediately at any time via the sidebar button or keyboard shortcut.
  • Automatic lock: Configurable idle duration; automatically locks after timeout.
  • Password security: Stores only a scrypt one-way hash (N=2^15, r=8, p=1); plaintext is never stored.
  • Bilingual UI (Chinese/English): Switches in real time according to DSH’s interface language setting.

Installation and Activation

Run the following command in the terminal to install the plugin:

dsh plugin --profile web add github:felixpu/dsh-lock

After installation, the host process needs to be restarted.

Usage

  • Unlock: When the page is opened, the locked interface is displayed. Enter the password to unlock.
  • Lock immediately:
    • Click the “Lock” button at the bottom of the sidebar.
    • Use the keyboard shortcut: Ctrl/Cmd + Shift + L on macOS / Windows; Ctrl/Cmd + Shift + . on Linux.
  • Automatic lock duration: Configure it in the “Settings → Plugins → dsh-lock” panel.

Security Mechanisms

  • Storage method: The password is stored as a salted hash using the scrypt algorithm. Comparison is performed with constant-time comparison. Only the hash is stored; plaintext is not saved.
  • Token mechanism: After unlocking, a short-lived token is issued rather than storing the password itself.
  • Uninstallation safety: Data is stored in the plugin’s private directory. Uninstalling the plugin does not leave the password in the session or configuration.
  • Security boundary: This is a UI access gate, not disk encryption. It prevents someone from sitting at your computer and directly operating DSH, but it cannot stop attackers who can read files in your user directory.

Notes

  • Error codes: User-facing natural language is not produced. Routing responses return only machine-readable codes, such as invalid-password / too-many-attempts / locked.
  • Locale configuration: To ensure Chinese/English localization works correctly, locale/*.json must be exported in the exports field of package.json, and the files field must include the locale directory. These are two easily overlooked points; missing them can cause the feature to fail silently.

Summary

dsh-lock is a lightweight UI security plugin, suitable for protecting DSH sessions when temporarily stepping away from public devices or collaborating with multiple users. Its code is hosted on GitHub and follows the MIT license.