dsh-privacy-mask
仅用于显示的 DeepSeek Harness 聊天隐私遮罩：正则表达式 → ***，悬停即可显示；复制内容和 LLM 上下文不变。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Huauauaa/privacy#75bcb66bd8aa6c740c34503c88b78f94204049a6Privacy Mask 以 dsh-privacy-mask 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Display-only privacy mask for the DeepSeek Harness (dsh) web UI. Regex matches in chat text render as a placeholder (default ***); hover reveals the original. Copy, selection, and LLM context are unchanged.
Config still lives in browser localStorage (not Host settings.plugin.item); see Configuration storage.
From a checkout of this repo:
dsh plugin --profile web add /absolute/path/to/privacy
Then restart (or reload) the web profile so the client bundle loads.
lib/client.js is a classic-script ModuleLoader factory (window.__ModuleLoader__.load, id dsh-privacy-mask), self-contained for the browser.
Dev overlay (optional): dsh web --patch ./cordis.patch.yml with absolute plugin paths per dsh docs.
Open the bottom-left Settings control, then choose Privacy mask in the settings nav.
| Field | Description |
|---|---|
| Enabled | Master switch. Off unwraps all masks and stops scanning. |
| Placeholder | Text shown instead of matches (default ***). |
| Rules | Ordered list. Each rule has an enable toggle, name, and regex pattern. |
Per rule:
Actions:
Storage key: dsh-privacy-mask:v1 in localStorage. After changing package.json client injects, restart the web profile so __DSH_BOOT__ picks up slots.
All enabled by default:
| Name | Pattern (JS RegExp source) |
|---|---|
| API key-like | \b(?:sk-or-|sk-|rk-)[A-Za-z0-9_\-]{16,}\b |
| Bearer token | \bBearer\s+[A-Za-z0-9\-._~+/]+=* |
\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b | |
| PEM private key header | -----BEGIN [A-Z0-9 ]*PRIVATE KEY----- |
The API-key rule is intentionally conservative; disable it if you see false positives.
npm test
Runs Node node:test suites for mask-core (match/segment contract), writeConfig (persist + invalid/empty-pattern rejection), and conversation selectors. Tests import ESM sources (lib/mask-core.js, lib/settings-store.js, lib/selectors.js); the browser file inlines those.
DSH web UI markup can change between versions. If masking misses the chat or hits the wrong area, edit lib/selectors.js (keep the inlined copy in lib/client.js in sync):
conversationRoots() — scan start: prefers [data-conversation-scroll], then [role="log"] / [data-testid="conversation"], then main, then document.bodyshouldSkip() — ignores composer ([data-composer-seat] / [data-composer-card]), sidebar ([data-slot="sidebar"]…), inputs/contenteditable, shell overlays, the settings panel, and nodes already maskedPrefer stable data-* / roles over hashed class names. On first install, still verify in DevTools that the transcript root and composer markers match your dsh build.
The Privacy mask page is registered as a Settings nav section (settings.section). Values still persist in browser localStorage, not Host settings.plugin.item.
Public dsh rc builds enforce a WEB_SETTINGS_NAMESPACES allowlist that blocks third-party plugin namespaces from the Host settings store. Until that allowlist includes privacy-mask, localStorage remains the persistence path. The Host entry (lib/index.js) is a no-op mount marker only.
After install into a web profile:
Authorization: Bearer abc.def-123) — UI should show the placeholder.***.