Plugin repository URL
https://github.com/JohnXu22786/secret-guard
Primary value
A dsh security plugin that intercepts agent reads/writes of sensitive files (.env, credentials, key material) via tools/pre-execute, masks leaked secret-shaped values in tool results as a fallback, keeps an audit journal, and exposes safe sg_* inspection tools (keys/fingerprints/boolean probes) that never return raw values.
Primary category
Automation & Agents
Installation and removal
Install: dsh plugin --profile demo add github:JohnXu22786/secret-guard
Remove: dsh plugin --profile demo remove dsh-secret-guard
Compatibility and verification
Cordis bundle plugin (dsh.bundle.patch → cordis.patch.yml), entry src/index.ts with name / inject / Config / apply. Requires dsh ≥ 0.1.0-rc.6 and Node ≥ 22.19. Not yet verified against a released dsh version; tests cover the rule engine, masking, interception matrix, and audit rotation (71 node:test cases).
Checklist
Plugin repository URL
https://github.com/JohnXu22786/secret-guard
Primary value
A dsh security plugin that intercepts agent reads/writes of sensitive files (
.env, credentials, key material) viatools/pre-execute, masks leaked secret-shaped values in tool results as a fallback, keeps an audit journal, and exposes safesg_*inspection tools (keys/fingerprints/boolean probes) that never return raw values.Primary category
Automation & Agents
Installation and removal
Install:
dsh plugin --profile demo add github:JohnXu22786/secret-guardRemove:
dsh plugin --profile demo remove dsh-secret-guardCompatibility and verification
Cordis bundle plugin (
dsh.bundle.patch→cordis.patch.yml), entrysrc/index.tswithname/inject/Config/apply. Requires dsh ≥ 0.1.0-rc.6 and Node ≥ 22.19. Not yet verified against a released dsh version; tests cover the rule engine, masking, interception matrix, and audit rotation (71 node:test cases).Checklist