dsh-hidden-paths

Dsh's built-in permission model gates writes through sandbox modes and approval policies, yet reads remain effectively unconfined. An AI agent working inside your project can cat .env, open ~/.ssh/id_rsa, or stream .git-credentials straight into the model context with nothing in the way. dsh-hidden-paths closes that gap: it is a policy guard, not a kernel sandbox, that intercepts sensitive reads before the agent ever touches the bytes.

The plugin operates in two registered layers. Layer 1 is a monotonic path-denial guard evaluated after the extensible pre-execute waterfall. It covers file tools (read, write, edit, glob, grep, read_image), shell commands (cat, ls, cp, rm, and their glob expansions), search selectors (glob/grep patterns, include/exclude), and literal path spellings inside run_code. Once the guard returns a denial reason the tool body never executes, and no later listener can reverse the verdict. Layer 2 is the outermost post-execute filter that masks hidden path names as [hidden] in results and redacts recognizable credential shapes (OpenAI/Anthropic keys, GitHub/GitLab tokens, Stripe keys, PEM private-key blocks, JWTs, and more) as [redacted:kind] before the model sees them, so a secret hiding in a file whose name gives nothing away, say notes.txt or a log line, still gets scrubbed.

Default name rules are deliberately precise rather than broad. .env and its variants, .npmrc, .netrc, .git-credentials, .pgpass, .ssh, .aws, .kube, .gnupg, and common private-key extensions are protected, while ordinary source files such as secrets.ts, credentials-manager.py, and tokenizer.py stay readable, and template files (.env.example, .env.sample) are explicitly excluded. Users add further paths via hiddenPaths; the entire subtree is covered, symlinks are resolved and denied, the rule outranks any allow-list entry, and the policy applies to every agent in the tree. The plugin has zero runtime dependencies, uses only Node built-in modules, makes a single realpathSync call per decision, and performs no network I/O or process spawning.

This plugin is for developers who run dsh-driven AI agents inside real project workspaces where the agent must read source, run tests, and edit configuration, but must never be able to walk into .env, .git-credentials, or .ssh on its own or under a prompt-injected instruction. It complements, rather than replaces, heavier isolation such as containers, Landlock, or running dsh under a dedicated user; it targets the most frequent and most exploitable gap in a cooperative runtime: unrestricted reads.