dsh-tui-secret-guard

Pasting a fragment of .env, a deployment command that carries a live token, or a debug log into an agent is the most common way an active credential leaks onto the wire. dsh-TUI Secret Guard is a small, local interception plugin that checks outgoing prompts before they reach the model.

It detects known provider tokens, private-key headers, and credential-style assignments like API_KEY or ACCESS_TOKEN. All scanning is local: no prompt content is stored, no network, filesystem, or command permission is requested, and the only output is a category-level blocked report. Placeholders such as ${ENV_NAME}, YOUR_API_KEY, redacted, or masked values are intentionally ignored. A blocked prompt must be manually edited and resubmitted — automatic redaction is deliberately avoided because silently rewriting code or credentials can mislead the model.

If your dsh-TUI workflow regularly involves pasting code snippets, logs, or configuration text into an agent, especially when production tokens and private keys are in play, Secret Guard adds a zero-side-effect pre-flight check that keeps high-confidence credentials out of the session while preserving exactly what you typed.