dsh-mask

dsh plugin --profile web add dsh-mask

<div align="center">

dsh-mask

• 1024 store channel: npm i -g dsh1024 once, then dsh1024 plugin --profile web add dsh-mask (counts toward the deepseek1024.com install ranking).




PII masking middleware for DeepSeek Harness — anonymize personal data before it reaches the model, keep it reversible host-side.

Phones, emails, ID cards, bank cards, keys, and more become placeholders at the model boundary; the plaintext never enters your session log.










[English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)

dsh plugin --profile <name> add dsh-mask

</div>

---

📖 Ecosystem knowledge base — measured data, not marketing: plugin development guide · plugin-selection data · maintenance criteria.

<!-- star-cta -->

Install & uninstall

• git channel (latest main): dsh plugin --profile web add github:PerryLink/dsh-mask (equivalent to installing from git+https://github.com/PerryLink/dsh-mask.git). No build step — index.mjs and lib/ are the shipped artifacts.
• npm channel (published releases): dsh plugin --profile web add dsh-mask.
• tarball channel: pnpm pack in this repo, then dsh plugin --profile web add ./dsh-mask-<version>.tgz.
• uninstall: dsh plugin --profile web remove dsh-mask (or remove the row from the profile patch).

dsh-mask no longer bundles the storage stack. Profiles that already compose it (the web profile does, via @deepseek-ai/dsh-web-app) provide storageDomain, so persistence works out of the box. On a bare profile without storage the plugin still mounts and masks, but the restore table is memory-only (lost on restart) — compose the storage stack in your profile patch, or set persistRestoreTable: false.

⭐ 如果它帮到了你

这个插件是 DSH 插件家族的一员（95 个，全部 Apache-2.0）。如果你在用，给个 star —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。

English: part of a 95 plugin family for DeepSeek Harness. If it is useful, a star helps the next person find it — nothing is gated behind it.

What is dsh-mask?

PII masking middleware for DeepSeek Harness — anonymize personal data before it reaches the model, keep it reversible host-side.

Phones, emails, ID cards, bank cards, keys, and more become placeholders at the model boundary; the plaintext never enters your session log.

Workflow overview: call → plugin → result. The examples below use the real command surface.

Comparison

108 synthetic samples (60 positive, 48 negative) · from benchmark/RESULTS.md

Compatibility

Surface · Status

Harness · DeepSeek Harness dsh-v0.2.1-alpha.1 (adapted 2026-09-18): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. Verified 2026-09-18 against the dsh-v0.1.7-alpha.1 master checkout (full gate chain + profile install smoke).

Node · ^22.19.0 \ · \ · >=24.0.0

Platforms · Anywhere DSH runs (pure host, zero-dependency regex; no browser half)

Model · Text models fully supported; no extra model capability required

What you get

dsh-mask anonymizes personal data at the model boundary — before a message reaches the model — and keeps a restore table host-side so placeholders stay reversible:

• Request-time masking — agent/pre-step messages are rewritten so phones, emails, ID cards, bank cards, and keys (on by default) and IPs (opt-in) become <PHONE_1>-style placeholders. The masked text is what gets logged and sent to the model.
• Restore table — the placeholder → original map lives only in memory and a controlled storage domain (dsh_mask); the plaintext never enters the session log.
• Audit, not plaintext — the mask/applied session event records only "replaced N values + type distribution", never the original text or the mapping.
• /mask command — status (counts + distribution), on/off (runtime toggle), restore <text> (unmap placeholders and deliver the plaintext as a file, never as logged text), help.
• mask_test tool — run a snippet through the detector and see the placeholder result; it nev

…(truncated)