secrets 7

Fail-closed canonical tool-output tokenization for DeepSeek Harness

DeepSeek Harness plugin for SecurStack security scans, policy checks, doctor diagnostics, and JSON CLI results.

Secret-scrubbing guard plugin: irreversible regex redaction of secrets before session-log persistence and model requests

DeepSeek Harness plugin: manage a local sops+age encrypted credential vault from a sidebar panel. Agents see structure only; plaintext flows only on human click.

Deny an AI agent access to .env files, credential stores, keys and any path you hide — across file tools, shell commands, search selectors and run_code. A DeepSeek Harness (dsh) plugin.

Secure credential vault for DeepSeek Harness: store GitHub/npm/API tokens (secrets never leave the host), run gh/npm/npx/node/git with the token injected in the environment, and manage tokens from a Settings page.

密码本 for the DeepSeek Harness: an end-to-end encrypted personal secrets book on a private gist (age format, node:crypto only), with a browser page for people and value-free tools for the agent.