ClaudeMods
☰
ZH-CN
● 0 人在线 · 浏览 0 次
赞助提交作品
GitHub 仓库 · 发布者 homieyangg

secret-mask

一个 Claude Code hook 插件,会在模型看到工具输出之前遮盖类似权杖的字符串。

homieyangg@homieyangg

homieyangg/claude-code-mods/tree/main/secret-mask

原帖图片1
已翻译

关于这个 mod

secret-mask 是 claude-code-mods 系列中的一个 Claude Code 插件,以 function hook 形式运行,需要 Claude Code 2.1.287 或更高版本。当 Bash 命令输出看起来像凭证的字符串时,它会在输出发送给模型前替换为前四个字符加上 «…(masked)»;其他工具(例如 MCP 工具和网页抓取)的结果写入对话时也会遮盖。识别范围包括以 sk- 开头的 API 金钥、GitHub 权杖(ghp_、gho_、ghu_、ghs_、ghr_、github_pat_)、Slack 权杖(xoxa-、xoxb-、xoxp-、xoxr-、xoxs-)、JWT、AWS 访问金钥 ID(AKIA…)、Google API 金钥(AIza…)、OAuth 权杖(ya29.…)、Bearer 标头和 PEM 私钥区块,以及名称包含 TOKEN、SECRET、PASSWORD、API_KEY、PRIVATE_KEY、ACCESS_KEY 的 NAME=value 和 JSON 字段(值至少 16 个字符且必须混合字母数字)。Read、Edit、Write 和 NotebookEdit 的结果不会遮盖,因为 Claude 需要真实文件内容才能编辑。命令包括 /secret-mask,用于列出本次会话遮盖的项目,以及 /secret-mask off 和 /secret-mask on,用于暂停或恢复遮盖。作者提醒这是样式比对,可能漏掉部分凭证,应视为防止意外的措施,而不是把整份机密文件交给 Claude 的方法。安装可以先执行 /plugin marketplace add homieyangg/claude-code-mods,再用 /plugin install 安装;也可以用 --plugin-dir 加载目录,或在 ~/.claude/settings.json 中设置 CLAUDE_CODE_PLUGIN_DIRS。插件提供 language 选项(en、zh-TW、zh-CN)。许可证为 MIT。此项目会拦截并改写工具输出,涉及敏感资料处理,建议人工复核后再发布。

安装

请先查看作者 README 确认 marketplace 和插件名称;命令可能随仓库结构改变。

claude plugin marketplace add homieyangg/claude-code-mods
claude plugin install secret-mask
原文 / README

claude-code-mods

English | 繁體中文 | 简体中文

Three mods for Claude Code, built as function hook plugins. Requires Claude Code 2.1.287 or later.

plan-bar, leftovers and secret-mask in one session

| Mod | What it does | Command | | --- | --- | --- | | plan-bar | Progress bars above the prompt while Claude works through a multi-step plan | /plans | | leftovers | Keeps a ledger of services, containers, backups and repos Claude left behind | /leftovers | | secret-mask | Masks token-like strings in tool output before the model sees them | /secret-mask |

Install

From this repo as a marketplace:

/plugin marketplace add homieyangg/claude-code-mods
/plugin install plan-bar@claude-code-mods
/plugin install leftovers@claude-code-mods
/plugin install secret-mask@claude-code-mods
/reload-plugins

Or clone it and load the folders directly. Edits reload while a session is running.

git clone https://github.com/homieyangg/claude-code-mods ~/claude-code-mods
claude --plugin-dir ~/claude-code-mods/plan-bar --plugin-dir ~/claude-code-mods/leftovers

To load them in every session, add the folders to ~/.claude/settings.json:

{
  "env": {
    "CLAUDE_CODE_PLUGIN_DIRS": "~/claude-code-mods/plan-bar:~/claude-code-mods/leftovers:~/claude-code-mods/secret-mask"
  }
}

plan-bar

plan-bar demo

Each plan gets one row above the prompt: the current stage, a bar split by stage, and a percentage. The row turns yellow while Claude is waiting on you and red when a task fails. A short sound plays when a stage finishes, when the plan waits, and when it ends.

Claude drives the bars itself. The mod registers two tools, plan_set and plan_update, and adds a short note to the system prompt asking Claude to use them for work with three or more steps.

| Command | | | --- | --- | | /plans | List the current plans | | /plans demo | Run a 20 second demo | | /plans clear | Remove all plans | | /plans sound off / on | Turn sounds off or on |

leftovers

leftovers demo

leftovers watches the Bash commands Claude runs, locally and over ssh, and writes down anything that keeps running or stays on disk after the session:

| Kind | Recorded from | | --- | --- | | launchd | launchctl bootstrap, launchctl load | | systemd | systemctl enable, systemctl start | | cron | crontab edits | | docker | docker run -d, docker compose up -d | | background | nohup, tmux new -d | | repo | gh repo create, git worktree add | | backup | copies or moves to .bak, .orig, .old |

It also tracks git repos Claude edited and shows the ones with uncommitted changes.

Above the prompt, a yellow dot shows how many are left next to the first item; click the count to expand the rest. /leftovers shows the full list grouped by machine. Clean up asks Claude to remove the item using the undo command it recorded, Done drops it from the ledger. Uncommitted repos get See changes and Ignore. When Claude runs the undo command itself (docker rm -f, systemctl disable, git worktree remove and so on) the item drops off on its own. The ledger is kept across sessions.

leftovers list

| Command | | | --- | --- | | /leftovers | Show the list | | /leftovers drop <n> | Remove item n from the ledger | | /leftovers clear | Empty the ledger |

secret-mask

secret-mask demo

When a Bash command prints something that looks like a credential, secret-mask replaces it with its first four characters and …(masked) before the output reaches the model. Results from other tools, such as MCP tools and web fetches, are masked when they are written to the conversation. A toast says how many were masked, and /secret-mask lists them.

It recognizes:

  • API keys starting with sk-
  • GitHub tokens: ghp_, gho_, ghu_, ghs_, ghr_, github_pat_
  • Slack tokens: xoxa-, xoxb-, xoxp-, xoxr-, xoxs-
  • JWTs, AWS access key IDs (AKIA…), Google API keys (AIza…) and OAuth tokens (ya29.…)
  • Bearer <token> headers and PEM private key blocks
  • NAME=value and JSON fields whose name contains TOKEN, SECRET, PASSWORD, API_KEY, PRIVATE_KEY or ACCESS_KEY, when the value is at least 16 characters and mixes letters and digits

This is pattern matching, so it will miss things. Results from Read, Edit, Write and NotebookEdit are left alone, because Claude needs the real file contents to edit them. Treat it as a guard against accidents, not as a way to hand Claude a file full of secrets.

| Command | | | --- | --- | | /secret-mask | List what was masked in this session | | /secret-mask off / on | Pause or resume masking for this session |

Clicking the buttons

The buttons above the prompt and in /leftovers take mouse clicks only in Claude Code's fullscreen mode. The default renderer does not turn on mouse reporting, so clicks never reach it. Turn fullscreen on in /config, or add "tui": "fullscreen" to ~/.claude/settings.json. In the default mode, press ctrl+x then tab to move into the row above the prompt, tab to pick a button and Enter to press it.

Language

Each mod has a language option: en (default), zh-TW or zh-CN. Change it in /config, or in ~/.claude/settings.json:

{
  "pluginConfigs": {
    "leftovers@claude-code-mods": { "options": { "language": "zh-TW" } }
  }
}

Use leftovers@inline as the key when the mod is loaded with --plugin-dir or CLAUDE_CODE_PLUGIN_DIRS.

/plugin install notes that the option is not set yet. You can ignore that; it falls back to en.

Development

claude plugin validate ./leftovers
claude plugin test ./leftovers

The demo recordings are made with VHS. media/tapes/setup-demo.sh builds a separate Claude Code config in ~/.claude-demo and a sample project in ~/acme-app; log in once with CLAUDE_CONFIG_DIR=~/.claude-demo claude auth login, then run media/tapes/record.sh plan-bar leftovers secret-mask hero.

License

MIT

其他同名作品

更多类似作品