dsh-workspace-lock: A UI Password Lock for DeepSeek Harness Workspaces

What Does It Do?

Workspace Lock is a DSH plugin for DeepSeek Harness that puts a password lock on an entire workspace folder. It solves the problem of anyone who casually opens your DSH seeing every conversation: once locked, the folder collapses in the sidebar and all of its session rows are hidden, so they cannot be seen or opened. Because the lock covers the whole folder rather than individual sessions, you are not hit with a password page over and over; it also re-locks automatically after 15 minutes of inactivity by default, and a forgotten password can be reset through a QQ Mail verification code.

Core Features

• Whole-folder locking: one lock action collapses the folder in the sidebar and hides all of its session rows at once, avoiding per-session password prompts.
• Three levels of control: each folder gets a row in the panel with Lock, Unlock (this page only), and Permanently unlock (requires password); a page refresh returns everything to the locked state.
• Automatic re-lock: the workspace locks itself again after 15 minutes without activity by default, and the interval is editable in the panel, with 0 disabling auto-lock.
• Email password recovery: after configuring a QQ Mail SMTP authorization code, recovery can be started from either the lock screen or the panel, with a 6-digit code valid for 10 minutes and at most 5 attempts.
• Full-screen fallback gate: sessions created from other entry points into a locked folder are stopped by a full-screen password page, so nothing leaks through.
• Local secure storage: the state file uses 0600 permissions, only a scrypt-derived password value is stored, and the SMTP authorization code is never sent back to the page.

How to Use This Plugin?

After enabling it in DSH and restarting the web service, a lock icon appears in the left sidebar; click it to open the Workspace Lock panel. Each folder has one row: choose Lock to collapse the folder and hide its sessions, choose Unlock (this page only) for temporary access that reverts on refresh, or choose Permanently unlock to remove the lock record, which requires the master password. To enable email recovery, enter your QQ Mail address and SMTP authorization code in the panel (generate the code after enabling POP3/SMTP in QQ Mail settings; it is not your login password), then send a test email to confirm the connection works. If the password is lost and no email is configured, stop DSH and manually clear the password and locked path entries from the state file before starting again. Note that this is a UI gate, not disk encryption: other local programs and the command line can still read the plaintext.

How to Troubleshoot This Plugin?

When the page shows only HTTP 400, the host side is usually reading a service that was not declared in inject; fix it by retrieving services through ctx.get as the official guidance describes. If UI changes do not appear after editing host code, that is because hot replacement only covers browser-side modules, so restart dsh web to load the new host code. If a locked folder stops collapsing after a DSH upgrade, the sidebar DOM structure has changed; the worst case is that it is no longer hidden rather than an error being thrown.