dsh-dlp

dsh-dlp

Data-loss prevention for DeepSeek Harness,
built as an out-of-repo plugin.

It does six things:

1. Denies credential-file access and secrets bound for the network — unconditionally, from
ctx.tools.guard(). It tests the path-typed arguments of a call against a table of
credential stores, following symlinks first.
2. Redacts secrets out of tool results before the model reads them and before the session
log records them, and withholds a result it cannot clean.
3. Redacts secrets out of exported telemetry, patching a hole where DSH_TELEMETRY_MODE=FULL
ships message text, tool arguments, tool results and workspace paths in the clear.
4. Strips the invisible characters that carry hidden instructions ou