dsh-keyring

When working with DeepSeek Harness, API keys, access tokens, database connection strings and other secrets tend to bleed into environment variables, config files, or even the model context, where they can be logged or inadvertently exposed. dsh-keyring tackles this gap by intercepting sensitive values before they reach the model: it auto-detects and masks a broad set of credential patterns drawn from the Hermes redaction rules, including vendor-prefixed tokens (GitHub, OpenAI, Google, AWS, Slack, GitLab, npm, PyPI, Stripe, Telegram), KEY=value environment lines, YAML/JSON fields, Authorization and x-api-key headers, database connection strings, bare URL tokens, and E.164 phone numbers. Once masked, the credentials are collected into a built-in password book accessible from a dedicated settings page, so you can review and reuse them without hunting through scattered configs. The entire store persists as an official profile bundle (npm package), meaning your keyring survives dsh web restarts with zero manual migration.