Introduction

In the dsh-TUI ecosystem, pasting .env snippets, deployment commands, or debug logs into an agent is a common way to leak active secrets. dsh-TUI Secret Guard aims to address this problem. It is a plugin that blocks high-confidence credentials before they are sent to the model and is compliant with DSH ecosystem manifest v0.15.

What It Is

It is a plugin for the dsh-TUI ecosystem. It scans input content, never stores prompt content, and only reports credential categories. It intercepts decision events to block sending. If needed, it has a compatibility fallback that rejects the latest user message at agent/pre-step before the model request.

Installation and Permissions

Installing the plugin requires running the official command.

dsh plugin --profile dsh-tui add ./dsh-tui-secret-guard

In Community v0.15, decision interception defaults to deny. Permissions must be declared in ~/.dsh-tui/extension-grants.json:

{
  "grants": {
    "community.dsh-tui.secret-guard": [
      {
        "name": "session.input.intercept",
        "scope": "tui/input"
      }
    ]
  }
}

The plugin requests the following permissions: no storage, no observation of messages, no network access, no filesystem access, no command execution.

Configuration

The plugin controls its behavior through YAML configuration options:

enabled: true
genericAssignments: true
minGenericLength: 24
showStatus: true
  • genericAssignments: detects values assigned to names such as API_KEY, CLIENT_SECRET, ACCESS_TOKEN, and PASSWORD.
  • minGenericLength: controls only generic assignments. Provider-specific formats keep their own strict length limits.
  • showStatus: displays secret guard: armed and local process counts. It does not persist counts or content.

Placeholders (including ${ENV_NAME}, YOUR_API_KEY, redacted, and masked values) are ignored. Blocked prompts must be edited and resubmitted; automatic rewriting is deliberately avoided because silently changing code or credentials can produce misleading model outputs.

Core Features

  • Local scanning: checks input before sending.
  • No content storage: the plugin does not save prompt content.
  • Category-only reporting: reports only credential categories.
  • Decision event interception: intercepts decisions through tui.dsh/v1alpha1#DecisionEvents.
  • Compatibility fallback: falls back to agent/pre-step to reject the latest user message.

Notes

The plugin runs with the permissions of the current dsh process. Review the source code and license before installation. Blocked prompts must be edited manually.