dsh-secret-ask: A DSH Plugin to Prevent Keys from Entering the Conversation

dsh-secret-ask is a DeepSeek Harness plugin maintained by zayyehtut (MIT, version 1.0.0). It allows agents to apply for API keys, tokens, or passwords using masked cards: values are written to credential storage via local loopback requests and do not enter messages, model context, or session logs. Subsequently, they can be injected into the environment variables of a single command via `run_with_secret`, and any text in the output that exactly matches the stored value will be replaced with ***. The plugin provides three tools: `ask_secret`, `run_with_secret`, and `forget_secret`. The model only sees the names and their configuration status. It supports three installation methods: the Plugins panel in the desktop application, the `dsh plugin` command line, and the community `dsh-market`. It defaults to card mode, but `entryMode`, `timeoutMs`, and `enabled` can be adjusted in `cordis.patch.yml`. Credential files are readable by the same user process and are not an isolated sandbox; users should review the source code and confirm the license before use.