dsh-cloak

A context firewall for DeepSeek Harness: credentials in tool results are replaced with opaque placeholders before they reach the model. The secret never enters context — the task keeps going.

中文文档

$ cat .env                          ← the agent reads a config file
DEEPSEEK_API_KEY=sk-0123…cdef

→ what the model actually sees:
DEEPSEEK_API_KEY=⟦cloak:deepseek-api-key:1⟧

Why

Your agent reads .env files, config dumps, cloud CLI output, and log tails. Every credential in those results flows into the conversation — and from there into every request sent to your model provider. Export-time redaction (sharing, handoff) is too late: the secret already left your machine while the agent was working.

dsh-cloak guards the boundary where tool results enter model context:

• Detect — 24 built-in high-precision signatures (AWS/Aliyun/GCP keys, DeepSeek/OpenAI/Anthropic/OpenRouter keys, GitHub/GitLab/npm tokens, Slack/Discord/飞书/企业微信 webhooks, Stripe/Shopify/Linear, JWTs, PEM private-key blocks, credentialed DB URLs, Authorization: Bearer …), plus key-name rules (password/secret/api_key/…) that catch unknown formats in .env, JSON, and YAML shapes. Custom regex rules via a JSON file.
• Replace — matches become stable placeholders ⟦cloak:<category>:<n>⟧. The original values live only in a process-memory, agent-scoped vault. They never enter session logs, audit events, or model requests.
• Inform — a system-prompt note and a per-result context message tell the model what placeholders mean: don't guess, don't reconstruct, don't re-read the source to recover them; ask the user when a real value is genuinely needed.

Pagination cursors (next_token, page_token, …) and placeholder values (${VAR}, changeme, …) are deliberately excluded, so paging and templates keep working.

Install

# GitHub channel (latest main):
dsh plugin --profile web add "github:zhangmiao03/dsh-cloak#main"
# GitHub channel (pinned release, recommended for stability):
dsh plugin --profile web add "github:zhangmiao03/dsh-cloak#v0.1.0"
# npm channel (after npm publish):
dsh plugin --profile web add dsh-cloak
# local development:
dsh plugin --profile web add /path/to/dsh-cloak

Uninstall: dsh plugin --profile web remove cloak.

Verify the mount, then restart dsh:

dsh --profile web --dump-config | grep -A2 'id: cloak'

Config

Per-row config in the profile cordis.patch.yml:

- id: cloak
  config:
    enabled: true
    dryRun: false          # audit-only mode: report what would be redacted
    builtins:
      enabled: true
    rulesFile: ~/.dsh/cloak-rules.json
    note: true             # attach the placeholder-semantics note for the model
    audit:
      maxEntries: 200
      logFile:             # optional JSONL audit trail

Custom rules file format:

[
  { "id": "internal-prefix", "pattern": "mycorp-[a-z0-9]{32}", "flags": "g" }
]

Surfaces

Surface	Kind	Notes
tools/post-execute	listener	Redacts successful plain-text tool results (content projection)
systemPrompt context	injection	Placeholder semantics for the model, before it ever sees one
/cloak	command	/cloak stats · /cloak scan <text> dry-scan
/cloak/api/*	HTTP	GET stats · GET recent · POST test {text}

Security properties

• Original values never appear in audit events, logs, or API responses — categories and counts only.
• The vault is agent-scoped and in-memory only; a restart makes old placeholders intentionally unrestorable.
• Fail-open on scanner faults (a broken rule file or a scanner bug never turns a successful tool call into an error). Every fault is audited.
• Zero runtime dependencies — Node builtins and the DSH host packages only.

Deliberate exclusions (v0.1)

Honest scope, same spirit as the host's own spill-policy:

• Successful plain-text results only. Failed tool results and non-text blocks pass through untouched (replacing error text would corrupt error semantics).
• The model cannot use a redacted credential: restoring secrets into tool arguments is impossible by platform design (PreToolDecision excludes input rewriting). When a task needs a real value, the model is instructed to ask the user. An approval-gated reveal (riding the host's ask/authorization seams) is planned.
• User messages are not rewritten; outbound request bodies are not separately scanned (tool results are the dominant leak channel and are covered at the source). Both are candidate follow-ups.
• dryRun audits without replacing; it is the recommended first rollout step.

Compatibility

Built and verified against DeepSeek Harness 0.1.2-rc.1 (developer-preview host; expect to re-pin on breaking host changes). Node ^22.19 || >=24.

Development

npm install --legacy-peer-deps
npm test            # 51 unit tests
npm run build       # links @deepseek-ai/* peers from the global dsh install, then tsc

License

MIT