dsh-tui-secret-guard

Pasting a snippet of .env, a deployment command carrying a live token, or a debug dump into an agent is the most common way an active credential ends up on the wire. dsh-TUI Secret Guard is a lightweight, local interception layer built for exactly that scenario: it checks outgoing prompts before they ever reach the model.

The plugin recognises known provider tokens, private-key headers, and credential-style assignments such as API_KEY or ACCESS_TOKEN. Everything runs locally. No prompt content is stored, no network, filesystem, or command permission is requested, and the only outward signal is a category-level report of what was blocked. Placeholder values like ${ENV_NAME}, YOUR_API_KEY, redacted, or masked are deliberately passed through, and a blocked prompt must be edited and resubmitted rather than silently rewritten, preventing the model from acting on altered input.

If your dsh-TUI workflow regularly involves pasting code, logs, or configuration text into an agent, especially when production tokens and private keys are in play, Secret Guard adds a zero-side-effect pre-flight check that keeps high-confidence credentials out of the session while leaving your input exactly as you wrote it.