dsh-vault-plugin: A Privacy Lock for the DeepSeek Harness Sidebar

What Does It Do?

DSH Vault is a DSH plugin for DeepSeek Harness that turns Workspaces and Sessions in the sidebar into password-protected entries. It solves the problem of anyone who borrows your machine being able to open the DSH web page and browse your projects and conversations. Maintained by robbin810130 under the MIT license and written in TypeScript, it runs on the DSH web profile. Note that it only gates front-end access inside DSH; it does not encrypt the underlying Workspace, Session, or project source files, and at-rest encryption is planned for a later phase.

Core Features

• Inline locking: click the lock button on a Workspace or Session row to lock it; on first lock you enter a password and the plugin creates and binds a password group automatically.
• Title concealment: locking a Workspace collapses its session list immediately, and protected sessions appear as an encrypted placeholder so original titles never leak into the sidebar or accessibility text.
• Main-area unlock: unlocking is initiated only from the Unlock button in the main area, never by clicking a list entry, and the unlocked state lasts only for the current runtime.
• Lock policies: supports auto-lock, lock on system sleep, failed-attempt protection with a pause window, and configurable password rules for minimum length plus uppercase, lowercase, digit, and symbol requirements.
• Recovery key: a recovery key is shown exactly once on creation or restore and is never written to settings, logs, or browser storage.
• Local-only state: passwords and recovery keys are stored as salted scrypt verifiers in a private local state directory, with no external services, no outbound network calls, and no uploads.

How to Use This Plugin?

After enabling it in the DSH web profile, find the Workspace or Session you want to protect in the sidebar and click its inline lock button, then enter and confirm a password and choose Save and Lock; the password group is generated and bound for you. From then on, clicking a protected entry shows only a locked placeholder, and you unlock it by clicking Unlock in the main area and entering the password; re-locking a workspace immediately invalidates the current session. Lock policies and the auto-generated password groups are managed under Settings → Plugins → Vault. The plugin targets DSH v0.1.5-rc.1 together with the matching host patch shipped with that release, and its Node.js requirement is declared by the plugin package; do not apply the compatibility patch to unknown DSH versions.

How to Troubleshoot This Plugin?

Migrating from the older scoped package fails if you overwrite in place or load both versions at once; stop DSH first, back up the entire web profile and plugin state directory, remove the old package, then install the new version and confirm the profile contains exactly one new package and one bundle before starting. A dependency manager may regenerate other plugins' directories, so if another plugin stores runtime data under the dependency tree, restore that data directory from the backup after stopping the service and before starting, and verify the remaining plugin files are unchanged. If installation fails, keep DSH stopped and restore the profile backup rather than deleting the Vault state directory, since passwords, policies, and bindings are preserved.