dsh-secret-scrub

In tool-augmented LLM pipelines, credentials and API tokens are routinely carried into tool arguments and echoed back in results, ending up in both the model context and the transcript. The leak is already done the moment the model sees the bytes. dsh-secret-scrub sits at the narrowest seam in that chain: it pattern-matches tool arguments before execution and tool results after, so the raw bytes are replaced before the model or the log ever touch them.

Each matched secret is swapped for a session-stable placeholder. Identical bytes within the same session always map to the same placeholder, so the model can still reason about which argument produced which result. Across sessions an independent per-session salt guarantees no cross-session correlation. The append-only JSONL incident log records exactly five fields per event: timestamp, session, tool, pattern name, and placeholder. It never stores the preimage, any prefix, any length, or any other fragment.

It is not a vault, not a DLP engine, and not an ML classifier. It matches six predefined credential shapes (GitHub PATs, AWS access keys, Slack bot tokens, PEM private keys, and generic sk- prefixed tokens) and redacts on sight or passes through silently. Teams that route credentials through LLM tool calls will find this a practical last-line scrub: if a known secret shape crosses the wire, it is gone from the transcript before anyone can read it.