dsh-egress-guard

When building LLM workflows on DeepSeek Harness, system prompts, tool arguments, and conversation history often carry real API keys, database connection strings, or service tokens. A single configuration drift or prompt-assembly mistake can let live credentials ride along with a model request to a remote endpoint, and the developer is none the wiser.

dsh-egress-guard freezes the fully assembled request at the official llm/stream boundary and runs a deterministic scan over it. Using literal-prefix plus fixed-alphabet matching (no regex backtracking), it inspects every provider-facing field layer by layer: system prompts, message text, raw tool-call arguments, tool schemas, reasoning channels, stop sequences, and metadata. Built-in rules cover PEM private keys, mainstream cloud and SaaS tokens, bearer and basic-auth credentials, credentialed PostgreSQL, MySQL, MongoDB, and Redis URLs, and high-confidence assignment patterns. On a hit, it blocks the downstream model adapter call outright, and the matched content never appears in the error, the finding report, or the plugin log. Images, unknown content types, oversized, or unfreezable request graphs are all fail-closed by default. The entire flow is zero-network, zero-rewrite, and fully local.

If you run conversations, compactions, or session-title generation in DSH and your profile genuinely contains real keys or internal connection strings, this plugin is a low-intrusion egress fuse. It does not aim to replace a full secret scanner; it intercepts the most common credential-leak path before send, and in audit mode lets you safely observe request structure without exposing the original material.