zhujiaqi/dsh-secret-paste

README excerpt

dsh-secret-paste A DeepSeek Harness plugin that detects secrets pasted into the composer, stores them in the official credentials seam, and sends a [secret:REF] placeholder to the model instead of the plaintext. The real value never reaches the message, the session history, or any transcript. 🌐 中文：README.zh.md ｜ English Why You paste an API key or a token into the chat. Without protection it goes straight to the model and into the session log — which is exactly where a secret should never land. This plugin intercepts the paste, stores the value in the official DSH credential seam ( /.dsh/.credentials.yaml , mode 0600), and replaces it in the draft with [secret:REF] . The model only ever sees the placeholder, and can read the real value on demand through a dedicated tool. How it works Step What happens Detect @sanity-labs/secret-scan (1,100+ rules derived from gitleaks / TruffleHog) runs on the pasted text. Store The value is written with the official credentials.set Web API — no new server route. Replace The matched range becomes [secret:PASTE N] in the draft. Resolve The model calls the secret resolve(ref) tool when it actually needs the value. The plaintext value lives in exactl…

Category