dsh-secret-paste

Usage

Auto-detect and hide

Paste text that contains a high-confidence secret (ghp_..., sk-proj-..., JWT, …). It is stored and replaced with [secret:PASTE_N] immediately, and a chip shows:

🔒 Hidden · · PASTE_N · Undo

• Hover the chip to reveal the value in a tooltip — no layout shift.
• Undo restores the plaintext while you are still drafting.
• After you send, the chip stays visible but the undo button disappears; once the answer arrives, the chip is removed.

Medium confidence

confidence === 'medium' hits (e.g. a Bearer ) stay in the draft as-is and a "Suspected secret" chip asks you to confirm (Hide) or ignore (Ignore).

Manual marking

Formats the detector does not recognize (ark-..., some sk-...) are never guessed. Select the text and use the "Mark selection as secret" action, then "Hide & store".

Nested placeholders

A selection that already contains [secret:REF] can be wrapped again. The secret_resolve tool resolves such chains recursively down to plaintext (cycles or missing inner refs return found: false).