[Plugin]: secret-guard

[JohnXu22786]

Plugin repository URL

https://github.com/JohnXu22786/secret-guard

Primary value

A dsh security plugin that intercepts agent reads/writes of sensitive files (.env, credentials, key material) via tools/pre-execute, masks leaked secret-shaped values in tool results as a fallback, keeps an audit journal, and exposes safe sg_* inspection tools (keys/fingerprints/boolean probes) that never return raw values.

Primary category

Automation & Agents

Installation and removal

Install: dsh plugin --profile demo add github:JohnXu22786/secret-guard

Remove: dsh plugin --profile demo remove dsh-secret-guard

Compatibility and verification

Cordis bundle plugin (dsh.bundle.patch → cordis.patch.yml), entry src/index.ts with name / inject / Config / apply. Requires dsh ≥ 0.1.0-rc.6 and Node ≥ 22.19. Not yet verified against a released dsh version; tests cover the rule engine, masking, interception matrix, and audit rotation (71 node:test cases).

Checklist

• Plugin is a public repository
• README documents installation, configuration, and the plugin's hooks/tools
• Released under the MIT license

[JohnXu22786]

/recheck

[github-actions]

🔎 已进入自动复核

系统将从主仓库的可信工作流定向复核 https://github.com/JohnXu22786/secret-guard。
复核只读取公开元数据、目录结构和 README，不会检出、安装或执行贡献者分支及插件代码。

通过后会自动更新正式目录、双语 README 和 CHANGELOG，并生成内部运行报告，再回到本 Issue 回复结果并关闭。系统异常会重试，不会被当作审核拒绝。

[github-actions]

✅ 已通过自动目录收录

该插件已经在远端正式目录中确认。

• 插件：secret-guard
• 分类：tools
• 正式目录：https://github.com/HackSing/dsh-plugins/blob/main/README.zh.md
• 收录提交：a2c4815

本 Issue 作为收录申请自动关闭；后续信息修正请使用仓库的信息更新表单。