dsh-secret-scrub
DeepSeek Harness 插件：将工具参数和结果中的已知机密形状替换为稳定的占位符，并追加不含原像的 JSONL 事件记录
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:jwilson411/dsh-secret-scrub#1028bc9933296dca3d8405901eaaa94f6acf6119Secret Scrub 以 dsh-secret-scrub 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A DeepSeek Harness function plugin that redacts known secret shapes on the way in and out of tool execution, and writes an append-only JSONL incident line for each one — without the preimage.
A tool argument holding a token is redacted before the tool runs, and a tool result holding one is redacted before the model sees it. Each distinct secret becomes a stable placeholder:
$SECRET_GITHUB_PAT_3f9a1c04
The same bytes produce the same placeholder for the rest of the session, so the model can still reason about "the token in the argument came back in the result" — and the bytes themselves are gone, from the transcript and from the log alike.
This is pattern redaction. It is not a secret manager.
Redaction is damage limitation, not a control. The control is not putting credentials where a model can read them.
dsh-telemetry-redactor scrubs the export copy: the transcript you ship
somewhere else. This plugin scrubs the live copy, before the model or the
tool sees it. They are complementary and neither replaces the other.
The pinned release candidate 0.1.1-rc.2 exposes no tool-execute middleware
seam, so this package does not pretend to have one. It registers exactly one
model-facing tool, secret_scrub_report, and exports wrapExecute for a host
to apply where it owns the call. Nothing is monkey-patched and no private
API is reached into.
dsh plugin --profile default add github:jwilson411/dsh-secret-scrub
dsh plugin forwards to pnpm inside $DSH_HOME/profiles/default, then
reconciles the profile: because this package's manifest declares
dsh.bundle.patch, it is appended to the profile manifest's ordered
dsh.profile.bundles list and its cordis.patch.yml becomes a layer. Remove it
the same way, with remove in place of add.
This package is written and tested against the pinned release candidate
0.1.1-rc.2 — @deepseek-ai/dsh-tools@0.1.1-rc.2 is pinned exactly in
devDependencies so tests run against one known API, and the peer range is
^0.1.1-rc.2, matching how the harness's own tool packages declare it.
| Cordis plugin id | secret-scrub (the row id in cordis.patch.yml) |
| Injects | tools — a hard dependency; the plugin waits rather than degrading |
| Tool | secret_scrub_report |
| Arguments | n (integer, optional; default 20, capped at 200) |
Each pattern has a stable name that appears verbatim inside every placeholder and every incident line, a version bumped whenever its regex changes shape, and the date it was added. Names are public API — renaming one would orphan every stored incident. Regexes are not.
| name | version | since | matches |
|---|---|---|---|
GITHUB_PAT | 1 | 2026-08-31 | GitHub classic personal access token, ghp_ + 36 |
GITHUB_FINE_GRAINED_PAT | 1 | 2026-08-31 | GitHub fine-grained personal access token, github_pat_ + 40 or more |
AWS_ACCESS_KEY_ID | 1 | 2026-08-31 | AWS long-lived access key id, AKIA + 16 |
SLACK_BOT_TOKEN | 1 | 2026-08-31 | Slack bot user OAuth token, xoxb- + two numeric segments + a secret segment |
PEM_PRIVATE_KEY | 1 | 2026-08-31 | A PEM private key block, or its header alone |
SK_LIVE_TOKEN | 1 | 2026-08-31 | Generic sk- prefixed live API token |
The regexes, verbatim from src/scrub.js:
GITHUB_PAT /\bghp_[A-Za-z0-9]{36}\b/g
GITHUB_FINE_GRAINED_PAT /\bgithub_pat_[A-Za-z0-9_]{40,}\b/g
AWS_ACCESS_KEY_ID /\bAKIA[0-9A-Z]{16}\b/g
SLACK_BOT_TOKEN /\bxoxb-[0-9]{8,}-[0-9]{8,}-[A-Za-z0-9]{16,}\b/g
PEM_PRIVATE_KEY /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g
SK_LIVE_TOKEN /\bsk-[A-Za-z0-9_-]{20,}\b/g
PEM_PRIVATE_KEY has two branches, longest first: a complete armoured block
collapses to one placeholder, so the key material inside goes with the
header rather than being left behind under a redacted header. The second branch
catches a header whose body was truncated before it arrived.
$SECRET_<PATTERN>_<8hex>
<PATTERN> is the name from the table. <8hex> is
sha256(salt || 0x00 || secret) truncated to eight hex characters, where the
salt is generated per scrub session.
The tool is a side channel. The functions are the product:
import { createScrubState, wrapExecute, scrub } from 'dsh-secret-scrub'
// One state per session. It holds the salt and the placeholder memo, and no
// preimages beyond the life of the process.
const state = createScrubState({ session: sessionId })
// Wrap a tool's execute: arguments in, result out, incidents appended.
const execute = wrapExecute(tool.execute, state, {
tool: tool.name,
incidentLog: '/var/log/dsh/secret-scrub.jsonl',
})
// Or scrub one value directly.
const { value, findings } = scrub(payload, state)
// findings: [{ pattern: 'AWS_ACCESS_KEY_ID', placeholder: '$SECRET_…', count: 2 }]
| export | |
|---|---|
createScrubState({ session, salt }) | opens a session; thread it through every call |
scrub(value, state) | recursive walk; returns { value, findings } |
wrapExecute(execute, state, meta) | scrubs arguments in, result out, and appends incidents |
scrubToolArgs(args, state, meta) | one direction, returning { args, incidents } |
scrubToolResult(result, state, meta) | one direction, returning { result, incidents } |
appendIncidents(path, incidents) | append-only JSONL write |
readIncidents(path, limit) | the tail of the log, sanitized |
countByPattern(incidents) | { pattern, count } rows |
PATTERNS | the table above, as data |
scrub walks strings, arrays, and plain objects, including object keys — a
payload keyed by a token leaks as surely as one that holds it. Arrays and
objects are rebuilt rather than mutated, cycles are handled, and anything that
is not a string, array, or plain object (a Date, a Map, a class instance) is
passed through untouched rather than flattened.
Append-only JSONL, one line per distinct secret per direction per call:
{"ts":"2026-08-31T12:00:00.000Z","session":"s-1","tool":"read_file","pattern":"AWS_ACCESS_KEY_ID","placeholder":"$SECRET_AWS_ACCESS_KEY_ID_1a2b3c4d"}
Five fields, and only these five: ts, session, tool, pattern,
placeholder. No preimage, no prefix, no length, no character count — a
redaction log that leaks a little of every secret it saw is worse than no log.
The file is created 0600.
The reader is defensive in the same direction: readIncidents reduces every
line to exactly those five fields and drops any line whose placeholder is not
placeholder-shaped, so a log appended to by something else cannot smuggle a
preimage back out through the report tool.
| key | type | default | |
|---|---|---|---|
incidentLog | string | .dsh-secret-scrub.jsonl | path of the append-only JSONL log, relative to the process working directory |
Resolution order is patch config, then environment, then default: a patch
row is the deployment's stated intent, so it is not silently overridden by an
ambient variable. The environment fallback is DSH_SECRET_SCRUB_LOG, used only
when the patch row omits the key entirely.
- id: secret-scrub
config:
incidentLog: /var/log/dsh/secret-scrub.jsonl
secret_scrub_report answers one question: what did this session redact?
{ n: 20 } // optional; default 20, hard cap 200 — a larger ask is clamped, not refused
It returns { incidents, counts, total, log, plugin }: the most recent
incidents oldest-first, counts by pattern across that window, and the log path
that was read. Placeholders and pattern names only. There is no tool, flag, or
export that returns a preimage, because none is kept.
package.json manifest + `dsh.bundle.patch` — what makes this a bundle
cordis.patch.yml the bundle's patch layer: one insert, one plugin row
src/scrub.js the library: patterns, placeholders, the walk, the log
src/index.js the plugin: `name`, `inject`, `apply(ctx, config)`, the tool
test/ offline tests: the walk, the wrapper, the log, a hygiene scan
package-lock.json the pinned dependency tree `npm ci` installs in CI
npm install
npm test
Fully offline. No network, no secret-scanning API, no profile boot: apply is
handed a stub context that records registrations, the tool is driven through the
same execute the registry calls with results validated against the real
@deepseek-ai/dsh-tools, and every incident log is written into a fresh
directory under the OS temp directory and removed afterwards.
Every fake secret is built from fragments inside the test, so no committed file ever holds a contiguous token of any shape — GitHub push protection has nothing to reject, and neither does any other scanner:
| pattern | fragments |
|---|---|
GITHUB_PAT | ghp_ + fake + 32 × x |
GITHUB_FINE_GRAINED_PAT | github + _pat_ + fake + 18 × 0 + _ + 59 × y |
AWS_ACCESS_KEY_ID | AKIA + FAKESECRET + 111111 |
SLACK_BOT_TOKEN | xoxb + - + 1111111111 + - + 2222222222 + - + fake + 20 × z |
PEM_PRIVATE_KEY | the header words joined with spaces, a TEST KEY body, and the footer words |
SK_LIVE_TOKEN | sk- + live + - + fake + 24 × K |
None of these were ever credentials. They are the right shape and nothing else — which is the whole point of a pattern redactor, and its whole limit.
test/hygiene.test.js asserts that rather than claiming it: it runs the
redactor's own pattern table over its own tree and fails if any committed file
holds a whole token, scans for machine names, mount paths, and credential
variable names, checks that src/ contains no socket, fetch, or subprocess
construct and imports nothing but the pinned tools package and the two node
builtins it uses, and checks that CI needs no credentials.
CI (.github/workflows/ci.yml) runs npm ci and npm test on Node 22 and 24
from the committed lockfile, against the public registry only. It holds no
secrets and reaches no network beyond that install.
MIT — see LICENSE.