Plugins

Commit-time audit harness for AI coding agents: 28 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and a full MCP toolset. Installable via dsh plugin add.

Detects prompt-injection, jailbreak, and secret-leak patterns on the agent/pre-step, tools/pre-execute, and tools/post-execute seams with allow/ask/block tiers, sanitized defend/detection audit events, a defend_report tool, and a destructive-delete command guard.

Local security audit: config, plugin origins, sessions, network exposure — read-only redacted risk report.

Irreversible secret-scrubbing guard: rewrites access keys, bearer tokens, and private key blocks into `[REDACTED:<category>]` placeholders before they reach the session log and the model.

Privacy guard for git workflows: before git commit, git push or gh repo sync it scans the content that would enter git (local paths, user info, API keys, private keys, connection strings) and blocks anything not approved in the DSH approval UI; approved items go into a manageable, masked whitelist. Native DSH Config schema with live settings, first-push full-repository scan, fail-closed checks, zero npm runtime dependencies.