dsh-redact
Fail-closed canonical tool-output tokenization for DeepSeek Harness.
dsh-redact replaces common credentials with opaque, Agent-scoped tokens before the final tool result reaches model context or durable Session history. It replaces the successful canonical value through tools/post-execute, so Harness validates the replacement against the tool's declared output schema and renders model content from the accepted value again.
password=FAKE_PASSWORD
→ password=⟦dsh:redact:550e8400-e29b-41d4-a716-446655440000⟧
The token mapping exists only in process memory. Agent disposal clears it, and a restart makes old tokens intentionally unrestorable.
Install
From a Harness environment:
dsh plugin --profile web add dsh-redact
dsh --profile web --dump-config
For local development, run the same command from this directory and replace the package name with ..
The bundle patch registers the plugin as redact; version 1 has no user configuration.
Protected shapes
- password, passwd, and pwd fields;
- secret, API-key, app-key, access-key, and signature fields;
- token and access-token fields;
- authorization and bearer/basic headers;
- webhook and robot URL fields;
- private-key fields and PEM private-key bodies;
- credentials in URL query parameters;
- recursively nested arrays, objects, and JSON-encoded strings.
Source references such as environment-variable reads, function calls, type annotations, and declaration placeholders remain visible. JSON-encoded strings are parsed structurally and serialized back as valid JSON. Encoding deeper than 8 string layers is blocked instead of falling back to unsafe pass-through.
Runtime guarantees
- The prepended
tools/post-execute listener wraps later post policies and sanitizes their effective decision.
- Successful output is returned as a canonical value replacement. Harness output-schema validation remains authoritative.
- Failed results with sensitive immutable
error, meta, or deferred context fields become safe blocked results instead of retaining the original structure.
- Sanitizer, vault, downstream-policy, and audit-append failures block with constant secret-free feedback.
- Tokens are stable for the same secret only within one live Agent. Different Agents never share a mapping.
redaction/applied is appended only after a replacement and contains exactly a count and sorted category list:
{
"count": 2,
"categories": ["password", "token"]
}
No original value, replacement token, tool name, arguments, or error detail enters that event.
Deliberate exclusions
Version 1 does not:
- inspect or rewrite user messages before they enter the Session inbox;
- restore tokens into tool arguments or commands;
- persist or encrypt the token mapping;
- rewrite assistant messages—the model sees tokens, so canonical assistant output remains tokenized;
- guarantee sanitization of content a tool-owned
finalizeContent callback introduces after tools/post-execute;
- emit a durable audit event for an Agentless, same-process
ToolRuntime.execute() call.
Tools that need an original credential cannot consume a returned token in version 1. Tool definitions and plugins that run after the canonical boundary remain trusted code and must not synthesize secrets into later presentation content.
A successful downstream post policy that replaces only rendered content is superseded by the canonical value replacement, because retaining a raw canonical value would weaken the confidentiality boundary. Downstream security or spill policies should transform canonical values when they must compose with dsh-redact.
Trusted presentation restoration
Restoration is available only as an explicit in-memory primitive; the default plugin does not reveal tokens. A trusted same-process host can retain its own policy instance:
import { RedactionPolicy, installRedactionPolicy } from 'dsh-redact'
const policy = new RedactionPolicy()
installRedactionPolicy(ctx, policy)
// Presentation only. Never append this value to the Session log.
const visible = policy.restore(agent, tokenizedText)
restore() replaces only tokens owned by that Agent's live vault. Unknown token-looking strings stay unchanged.
Development
pnpm install --frozen-lockfile
pnpm --filter dsh-redact run check
pnpm --filter dsh-redact run pack:check
See the repository security policy for vulnerability reporting.
