secret-guard

When a DeepSeek Harness agent works through your project files, it may casually open a .env, an SSH private key, or AWS credentials, pulling raw API keys straight into the conversation context. One leak and every safeguard you put in place is undone. secret-guard exists to close that most common exposure path.

It works as a two-layer shield. The first layer intercepts before execution: before any file tool touches .env, id_rsa, .aws/credentials, or similar sensitive paths, the plugin evaluates a gitignore-style rule table and issues block, block-read, or allow decisions that short-circuit the tool body entirely. The second layer is a post-execution masking fallback: even if content slips past interception via bash, MCP tools, or any ungated tool, the plugin runs shape recognition over the returned text and replaces suspected secrets such as PEM key blocks, JWTs, Bearer tokens, known prefixes like ghp_ or AKIA, and connection strings with embedded passwords with a [redacted::] placeholder. On top of that, a family of sg_* inspection tools lets the agent verify whether a key exists, is empty, or matches a pattern, returning only key names, line numbers, and HMAC fingerprints. Every block, mask, rule reload, and error is appended to a local JSONL audit journal that rotates by size, and the rule file supports hot reload with sub-second polling.

It is built for developers and security-sensitive teams who run agents in dsh, especially when projects carry many secret files and the agent still needs to read and write code freely. It does not migrate, encrypt, or move any secret; it does one job: keeping secrets out of the model context. Pure TypeScript, zero build step, active the moment you install it.