dsh-pii-anonymizer
在 DeepSeek Harness 代理循环开始时运行的确定性、单向 PII 匿名化器
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-pii-anonymizer@0.1.0Pii Anonymizer 以 dsh-pii-anonymizer 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →A native DeepSeek Harness plugin that puts a deterministic, one-way PII shield at the start of the agent loop.
Your prompt is scanned by fixed rules and checksums (never by a model) and every detected value is replaced with a stable placeholder before the message is committed and sent. The real values live only in process memory — never in the session log, never on disk, never on the wire. When something is shielded, a local notice tells you.
you type: email a@x.com or call +31 6 1234 5678
model sees: email [[EMAIL_1]] or call [[PHONE_1]]
you see: 🔒 PII shield: 2 item(s) anonymized locally (1 EMAIL, 1 PHONE).
Real values did not leave this computer.
Anonymization is intentionally irreversible: there is no reverse map and no restore path, so nothing in the system can put the real values back.
agent/pre-step — the loop's step-admission waterfall
(@deepseek-ai/dsh-agent). A listener calls next(), maps the returning
decision.messages through the anonymizer, and returns a decision whose
messages carry the placeholders. That is the last moment before the accepted
user batch is committed and sent to the provider.
The Claude Code / Codex hook bridges cannot do this. HookOutput in
@deepseek-ai/dsh-hook-protocol exposes only additionalContext; its
updatedInput is documented as "PARSED but NOT honored." There is no
prompt-rewrite channel. Only a native Cordis plugin on agent/pre-step can
replace the messages that enter the model request.
Deterministic means structural. The detectors find things with a grammar or a checksum:
| Type | Trigger | Validation |
|---|---|---|
API_KEY | known prefixes (sk-, sk-ant-, AKIA…, ghp_…, github_pat_…, xox…, AIza…) | — |
IBAN | CC00…, compact or space-grouped | mod-97 checksum |
CREDIT_CARD | 13–19 digits, spaces/dashes allowed | Luhn checksum |
SSN | DDD-DD-DDDD | none |
EMAIL | RFC-ish address shape | none |
IPV6 / IPV4 | address shapes | octet range for IPv4 |
PHONE | digit run with + ( ) . - space, optional leading (, 7–15 digits | rejects ISO dates and version strings |
Free-form names, postal addresses, and other context-dependent PII are not detected — a deterministic rule cannot catch them without unacceptable false positives. Adding an ML/NER stage would break the "deterministic" property.
Overlaps are resolved by priority (checksum types beat the loose phone rule), then span length, then position.
PiiPseudonymizer keeps, per session:
forward: original value → placeholder (stable across turns, so the model can
keep referring to [[EMAIL_1]] consistently)[[EMAIL_1]], [[PHONE_2]], …There is no reverse map. The originals are held only in volatile memory for the life of the process, so they cannot be restored by anyone, including this plugin. This is a deliberate trade: the shield is safe by construction at the cost of the transcript showing placeholders.
Only human user messages (source.kind === 'user') are rewritten.
Harness-injected context — runtime context, skill catalogs, tool results — is
left untouched, because it is not the user's prompt and redacting it can clobber
values the agent legitimately needs (for example a sandbox host IP).
- id: pii-anonymizer
name: dsh-pii-anonymizer
config:
enabled: true # master switch
notify: true # emit the local notice when something was shielded
debug: false # log load/shield events (counts only, never values)
This package is a DSH bundle: package.json declares dsh.bundle.patch, and
cordis.patch.yml inserts the pii-anonymizer row. A profile lists it in both
dependencies and dsh.profile.bundles — which is what the moqi-tui /plugins
picker reads (it reads the manifest, not the Cordis loader).
Install it from the registry into a profile:
npm install dsh-pii-anonymizer # inside ~/.dsh/profiles/<name>
# or, from the terminal app:
/plugins add dsh-pii-anonymizer
tools/register-profile.mjs <profileDir> makes the manifest edit for a local
checkout, and writes a package.json.bak beside it:
node tools/register-profile.mjs ~/.dsh/profiles/tui
The package must also be resolvable from the profile. On this machine it is symlinked into the shared resolution root:
~/.dsh/profiles/node_modules/dsh-pii-anonymizer -> /home/joeri/Projects/dsh-pii-anonymizer
Install status: registered and enabled in all six profiles (dev-tui,
headless, jev-dev, tui, tui-dev, web). Restart the app to load it.
Rollback per profile: restore its package.json.bak.
node --test # 16 detector + pseudonymizer + message-scope unit tests
node_modules/@deepseek-ai is a dev-only symlink into the local harness install
so src/index.mjs resolves its peer dependencies for module-load smoke tests.
An installed plugin resolves them from the profile instead.
tools/mock-provider.mjs is a tiny OpenAI-compatible SSE server; tools/e2e.patch.yml
routes the deepseek adapter at it and loads this plugin. A real harness loop then
runs against the mock, and tools/requests.jsonl records exactly what the
provider received.
# 1. throwaway harness home inside this project (never ~/.dsh)
DSH_HOME=$PWD/../.dsh-scratch dsh --profile pitest \
--from-default-profile headless --dump-config
# 2. mock provider
node tools/mock-provider.mjs & # writes tools/requests.jsonl
# 3. one real turn
DSH_HOME=$PWD/../.dsh-scratch DSH_E2E_KEY=dummy \
dsh --profile pitest --patch tools/e2e.patch.yml \
"My email is jane.doe@corp.example and my IBAN is DE89 3704 0044 0532 0130 00"
# 4. confirm the provider only ever saw placeholders
grep -o '\[\[[A-Z_0-9]*\]\]' tools/requests.jsonl | sort -u
Verified output: the provider received My email is [[EMAIL_1]] and my IBAN is [[IBAN_1]] plus the notice; the raw email and IBAN appear nowhere.
agent/pre-step wiring — unit-simulated and run through a real
headless harness against a mock providernotice to the user/plugins picker