yh4922/dsh-workspace

dsh-workspace is a remote-workspace plugin purpose-built for DeepSeek Harness (DSH), shipped as a cordis bundle that registers through the standard dsh plugin add @yh4922/dsh-workspace command against a named profile, with alternate installation from GitHub Releases .tgz artifacts via local path, and a manual add flow inside the Desktop client's plugin manager since the desktop profile is not CLI-manageable. The plugin centers on SSH host orchestration: multi-level host groups with inherited defaults, jump-host chains, SOCKS5 and HTTP proxy support, and TOFU fingerprint pinning that blocks silently-rotated host keys. It ships an interactive terminal whose page and sidebar share one session with automatic reconnect, a Monaco-based file manager offering syntax highlighting, Ctrl+S save with conflict detection, Markdown/HTML/image previews, and full right-click tree operations, plus an inline Git view with stage/discard/commit, diff, and a forked commit graph.

In normal use the operator opens the Remote Workspace sidebar, sets a master password on first launch, then creates host entries inside groups and verifies reachability with the built-in Test Connection button before opening file, terminal, or log tabs. To edit remote code, the user clicks DSH's native Add Workspace dialog (the takeover toggle defaults on) and picks a remote host plus path, which mounts the remote directory as a first-class workspace; the session sidebar then exposes File Manager, Git Repository, and SSH Terminal tabs, and any Agent read, write, edit, glob, grep, or bash call issued inside that remote session executes against the remote machine rather than the local box, leaving local sessions untouched.

Dependencies are DSH >= 0.1.5-rc.2 (covering both the 0.1.x and 0.2.x lines, validated against DSH Desktop 2.0.16 and host 0.2.0-rc.1), Node.js >= 20, and the mandatory npm sibling dsh-better-sidebar which must be added first or the sidebar tabs will not render; the underlying ssh2 module has native build scripts that pnpm will block, so ssh2 and cpu-features must be allowed, and a Git-source install is unsupported because the repository does not ship compiled lib/ output. The license is MIT, secrets live locally under AES-256-GCM plus scrypt with optional DPAPI-backed auto-unlock on Windows, and remote commands bypass the local sandbox so read-only sandbox mode will reject writes and bash. Upgrades require remove-then-add because the manager cannot distinguish repeat installs, the legacy dsh-workspace package name from 0.7.7 and earlier must be uninstalled first to avoid two coexisting copies, and uninstalling or upgrading while DSH Desktop is running has previously crashed the host, so users are advised to quit first.