DeepSeek Harness Plugin: dsh-dual-checkin

DeepSeek Harness (DSH) adopts a plugin-based architecture to provide developers with flexible feature extension capabilities. dsh-dual-checkin is a workflow plugin maintained by G57651 (MIT License). Its core value lies in performing daily check-ins on Trae, WorkBuddy, and Qoder simultaneously by reading local login sessions, and providing a unified sidebar dashboard for credit and status monitoring.

Core Features¶

The plugin focuses on automating the check-in process and visualizing status:

Three-Platform Status Cards: Adds a “Check-in” entry to the main sidebar; clicking it opens a full-width panel that displays the check-in status (checked in / not checked in), 24-hour check-in time, and latest notes for Trae, WorkBuddy, and Qoder separately.
Credits and Expiration Tracking: A persistent credits row shows remaining / used credits and credits expiring within three days. When a credit package is close to expiration, a prominent reminder appears in the card. Credit changes after check-in are exposed via creditsBefore / creditsAfter.
Automatic Check-in on Startup: Automatically runs only when the DSH process starts and is idempotent. Platforms already checked in for the day are skipped automatically; there is no manual check-in entry inside the plugin.
Initial PAT Entry and Expiration Reminders: Fill in qoderPat (token) and qoderPatExpiresAt (expiration time) in the plugin configuration or cordis.yml to enable Qoder check-in. The panel shows a yellow warning when remaining time is ≤ 7 days (default), and a red warning when expired.
Non-blocking Execution: Uses Promise.allSettled to run the three platforms in parallel; failures, timeouts, or unauthenticated states on one platform do not affect execution on the others.
Refreshable Status Panel: Data is provided through the status route /plugins/dsh-dual-checkin/status. GET requests read the snapshot (default TTL: 5 minutes), and POST requests force a recheck of credits and status.

Installation¶

It can be installed via CLI, Web UI, or local clone:

Install from GitHub via CLI

dsh plugin --profile desktop add github:G57651/dsh-dual-checkin

Web UI
On the Plugins page, enter the Git URL github:G57651/dsh-dual-checkin, or download the tarball produced by a Release / pnpm pack, then run:

dsh plugin --profile desktop add dsh-dual-checkin-1.3.10.tgz

Local Installation After Cloning

git clone https://github.com/G57651/dsh-dual-checkin.git
dsh plugin --profile desktop add ./dsh-dual-checkin

Usage¶

Configure Qoder Credentials¶

Qoder check-in depends on a PAT (Personal Access Token). For initial enablement, configure the following in the plugin configuration (or cordis.yml):

qoderPat: Token string.
qoderPatExpiresAt: Expiration timestamp.
qoderRegion: Optional, switches between cn and intl regions.

If no PAT is provided, the plugin falls back to reading qoderCredentialRef from the DSH credential service (default: QODER_MANAGED_CREDENTIAL). The plugin includes built-in PAT validity checks and prompts for updates in the notes when the PAT is invalid.

The plugin strictly follows the local-read-only principle, and does not read Qinglong environment variables or write sensitive information:

Trae: Reads local files (such as ~/Library/Application Support/TRAE SOLO CN/User/globalStorage/storage.json) or the CLI’s trae-jwt-token.
WorkBuddy: Reads local files (such as ~/Library/Application Support/CodeBuddyExtension/Data/Public/auth/workbuddy-desktop.info). If decryption of WorkBuddy encrypted data is required, the plugin starts the local WorkBuddy.app (Electron) to obtain the AES-256-GCM key for decryption.
Qoder: Reads no local login files, does not access the system keychain, has zero decryption code, and spawns zero subprocesses. All credentials only reuse the PAT already configured in DSH and exchange it in memory for a short-lived token via POST /api/v1/jobToken/exchange.

Data and Security¶

Data Files¶

Check-in results and credit snapshots are stored under the ~/.dsh/ directory, with profile-scoped file names (e.g., …-trae-<profile>.json):

~/.dsh/.dsh-dual-checkin-trae.json
~/.dsh/.dsh-dual-checkin-workbuddy.json
~/.dsh/.dsh-dual-checkin-qoder.json

On the first run after an upgrade, the plugin first looks for the new file names and falls back to reading the old names if not found, so renaming does not cause duplicate check-ins. All snapshots strip fields that contain credentials (such as token and pat) before writing and before reading them back.

Interface Security¶

The status route /plugins/dsh-dual-checkin/status has strict access guards:

Source Validation: Serves only loopback addresses (127.0.0.0/8, ::1) and loopback Host values.
Host Validation: Rejects invalid authority values (containing @, /, or non-numeric-only ports).
Protocol Validation: Origin must be loopback or use the dsh-app: protocol.
Security Headers: Responses include cache-control: no-store, x-content-type-options: nosniff, and referrer-policy: no-referrer.

In addition, WorkBuddy login domains must match (^|\.)(workbuddy|codebuddy)\.cn$, and URLs must not include a username/password. All platform requests explicitly set redirect: 'error' and do not follow 3xx redirects.

Notes¶

No Settings Page: The plugin does not register settings.section and does not support manual configuration or check-in triggering via the UI.
Activity Window: When the Qoder activity window (rolling daily at 00:40 UTC+8) has not opened, the plugin treats the check-in as “not completed” and automatically retries on the next startup.
Concurrent Execution: The check-in logic for Trae, WorkBuddy, and Qoder is independent of one another.