dsh-secret-paste
DeepSeek Harness 插件：自动检测粘贴到编辑器中的机密信息，将其存储到官方凭据接口中，并向模型发送 [secret:REF] 占位符，而不是实际值。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:zhujiaqi/dsh-secret-paste#3876baea3685786124faaa76f14a4b8db4618a4cSecret Paste 以 dsh-secret-paste 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A DeepSeek Harness plugin that detects secrets pasted into the composer, stores them in the official credentials seam, and sends a
[secret:REF]placeholder to the model instead of the plaintext. The real value never reaches the message, the session history, or any transcript.
🌐 中文：README.zh.md ｜ English
You paste an API key or a token into the chat. Without protection it goes straight
to the model and into the session log — which is exactly where a secret should
never land. This plugin intercepts the paste, stores the value in the official
DSH credential seam (~/.dsh/.credentials.yaml, mode 0600), and replaces it in
the draft with [secret:REF]. The model only ever sees the placeholder, and can
read the real value on demand through a dedicated tool.
| Step | What happens |
|---|---|
| Detect | @sanity-labs/secret-scan (1,100+ rules derived from gitleaks / TruffleHog) runs on the pasted text. |
| Store | The value is written with the official credentials.set Web API — no new server route. |
| Replace | The matched range becomes [secret:PASTE_N] in the draft. |
| Resolve | The model calls the secret_resolve(ref) tool when it actually needs the value. |
The plaintext value lives in exactly two places: (1) this tab's memory, and
(2) ~/.dsh/.credentials.yaml (mode 0600). Every other surface — the sent
message, session history, transcripts — sees only [secret:REF].
web).dsh CLI and pnpm on your PATH (dsh plugin is a thin pnpm forwarder).dsh plugin --profile web add dsh-secret-paste
What this command does:
pnpm add dsh-secret-paste inside the profile directory.@sanity-labs/secret-scan).dsh.bundle.patch, it is auto-registered in
dsh.profile.bundles as a profile layer.No build step runs on install — the browser bundle is prebuilt and shipped.
The server half (the secret_resolve tool) loads at boot, so restart the dsh web
process after installing, then force-refresh the browser tab
(Cmd+Shift+R / Ctrl+Shift+R) to load the client bundle:
# restart the dsh web process you manage (Ctrl-C + relaunch, or your process manager)
dsh-secret-paste.ghp_...) into the composer: it is immediately replaced
by [secret:PASTE_N] and a chip appears.The exact same steps work when an AI agent or a CI job installs the plugin:
dsh plugin --profile web add dsh-secret-pastedsh web (required for the secret_resolve tool to register).ghp_... and expect [secret:PASTE_N], or confirm the served
page's window.__DSH_BOOT__ contains a dsh-secret-paste entry.Paste text that contains a high-confidence secret (ghp_..., sk-proj-..., JWT, …).
It is stored and replaced with [secret:PASTE_N] immediately, and a chip shows:
🔒 Hidden · · PASTE_N · Undo
confidence === 'medium' hits (e.g. a Bearer <token>) stay in the draft as-is
and a "Suspected secret" chip asks you to confirm (Hide) or ignore (Ignore).
Formats the detector does not recognize (ark-..., some sk-...) are never
guessed. Select the text and use the "Mark selection as secret" action, then "Hide & store".
A selection that already contains [secret:REF] can be wrapped again. The
secret_resolve tool resolves such chains recursively down to plaintext
(cycles or missing inner refs return found: false).
secret_resolveWhen the model needs the real value, it calls the secret_resolve(ref) tool:
{ found, value, source }.[secret:REF] appears in the message, history, or
transcripts. Values exist only in tab memory and the 0600 credential file.high auto-hides, medium waits for a confirm,
and unknown formats are never guessed (manual marking is the fallback).secret_resolve brings the value into model
context only when the model asks for it.node scripts/build.mjs # rebuild lib/client.js (no external bundler)
npm test # node --test tests/*.test.mjs
dsh-secret-paste/
├── package.json # dsh.bundle.patch + dsh.client declarations
├── cordis.patch.yml # mounts the server row
├── lib/
│ ├── index.js # server: secret_resolve tool (recursive resolution)
│ └── client.js # prebuilt browser bundle
├── src/
│ ├── resolve.js # nested-placeholder resolver (shared with server)
│ ├── scan.js # detection helpers (shared with tests)
│ └── client/index.js # paste interception, chips, credentials.set
├── vendor/secret-scan.cjs # vendored @sanity-labs/secret-scan@1.1.0 (MIT)
├── scripts/build.mjs # assembles lib/client.js
└── tests/ # node:test unit tests
MIT. vendor/secret-scan.cjs is the compiled dist/index.cjs of
@sanity-labs/secret-scan
v1.1.0 (MIT), whose rules derive from
gitleaks (MIT) and TruffleHog detectors;
its license is preserved at vendor/secret-scan.LICENSE.