dsh-llmasking
Transport-layer data masking for deepseek-harness (dsh): sensitive values never leave the process — the model sees placeholders, you see real values restored live in the stream.
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:yolorouter/dsh-llmasking说明文档
阅读完整 README ↗Configuration
Defaults are deliberate; most users need none of this. Override per profile in cordis.patch.yml (row config replaces wholesale, no deep merge):
- replace:
- id: llmasking
config:
keywords: ["acme-corp-token"]
regions: ["CN", "US"]
maskSystem: true
teachModel: true
| Option | Default | Meaning |
|---|---|---|
mode | enforce | enforce masks the wire. monitor is a shadow mode — counts and logs what WOULD be masked but sends real values to the provider; useful for building trust before enforcing |
keywords | [] | Extra literal keywords to mask (added to all built-in detectors) |
regions | all | Geo rule packs to enable: CN, US (universal rules are always on) |
maskSystem | true | Mask the system prompt slot too — project instructions (AGENTS.md etc.) can carry secrets |
teachModel | true | Add a short system-prompt section telling the model what placeholders are and to reproduce them verbatim |