dsh-dlp 0.1.0 → 0.2.0

package/README.md

@@ -3,7 +3,7 @@
 Data-loss prevention for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness),
 built as an out-of-repo plugin.
 
-It does four things:
+It does five things:
 
 1. **Denies credential-file access and secrets bound for the network** — unconditionally, from
    `ctx.tools.guard()`. It tests the path-typed arguments of a call against a table of
@@ -12,8 +12,12 @@ It does four things:
    log records them, and withholds a result it cannot clean.
 3. **Redacts secrets out of exported telemetry**, patching a hole where `DSH_TELEMETRY_MODE=FULL`
    ships message text, tool arguments, tool results and workspace paths in the clear.
-4. **Writes an audit record for every decision** to its own sink — rule id, rule version,
+4. **Strips the invisible characters that carry hidden instructions** out of tool results —
+   the Tags block and bidi overrides — and counts the classes it will not touch because they
+   also appear in legitimate text.
+5. **Writes an audit record for every decision** to its own sink — rule id, rule version,
    offsets, and a keyed hash. Never the secret, and never the path or command that matched.
+   `dsh-dlp report` reads that sink back.
 
 ---
 
@@ -43,12 +47,30 @@ More limits worth stating up front:
   the session log and already presented to the model, so rewriting them would desynchronise
   the log from what actually ran. Argument-level DLP here is *denial with a reason the model
   can act on*.
-- **Outbound prompts cannot be rewritten.** `llm/stream` options are deep-frozen and `next()`
-  takes no arguments. A secret already in the conversation reaches the provider.
+- **Already-logged history cannot be rewritten; a not-yet-logged inbound message can.** At
+  `llm/stream` the options are deep-frozen and `next()` takes no arguments, so a request the
+  agent has assembled goes out as it stands and a secret already in the conversation reaches
+  the provider. That is not the whole rule, though: `agent/pre-step` is an async waterfall
+  returning `{ kind: 'enter'; messages }`, and the only production append of `user/message`
+  happens *after* it, so a message arriving from outside can still be rewritten before it is
+  logged or presented. This release does not do that; it is recorded here because the earlier
+  flat claim that outbound redaction is impossible was too strong.
+- **A redacted value is not restored when the agent runs a command.** `ctx.shellEnv` rebuilds a
+  trusted `DSH_*` namespace for every model shell call, which is a way to hand `bash` and
+  `pwsh` — and only those two — the real value behind a placeholder without the model ever
+  seeing it. Planned work, not implemented here.
 - **Detection is pattern-based.** A password, an internal token format, or a customer record
   has no recognisable structure and is not detected. Neither is any encoded form: base64,
   hex, URL-escaping and reversal all pass both tiers, as does a secret split across two
-  content blocks.
+  content blocks. **A homoglyph defeats every rule in this package**, including the
+  invisible-character ones.
+- **There is no entropy rule, and that was measured rather than assumed.** Shannon entropy is
+  bounded by log₂L for a string of length L, so a 20-character token cannot score above 4.32
+  bits per character however random it is. At the threshold where ordinary tool output —
+  hashes, minified bundles, base64 blobs, UUIDs — produces no false positives, the miss rate
+  is 100% for anything up to 22 characters, which is most of the credential formats worth
+  catching. A detector that fires on the long ones the prefix rules already catch and misses
+  the rest is not worth the false positives it costs.
 
 The full list is in [PLAN.md §8](PLAN.md).
 
@@ -129,11 +151,11 @@ raiseSeverity:
 enable: [telemetryRedaction]
 ```
 
-Any other key, and any downgrade, makes the **whole file invalid**: it is logged on the
-deployment's logger and ignored, never obeyed in part. There is no `disable`, no
-`removeCredentialPaths`, and no way to redirect the audit sink. The file is parsed with
-`js-yaml` under `JSON_SCHEMA`, so a `!!js/function` tag is a parse error rather than code
-execution, and it never goes near the Cordis loader.
+Any other key, and any downgrade, makes the **whole file invalid**: it is reported on
+`process.stderr` and the deployment's logger, then ignored, never obeyed in part. There is no
+`disable`, no `removeCredentialPaths`, and no way to redirect the audit sink. The file is
+parsed with `js-yaml` under `JSON_SCHEMA`, so a `!!js/function` tag is a parse error rather
+than code execution, and it never goes near the Cordis loader.
 
 A missing `policyFile` is not an error — it means the workspace ships no policy. The
 recommended value is workspace-relative, so failing the mount would stop `dsh` from starting in
@@ -159,10 +181,24 @@ directories (but not `.env.example`), anything under `.ssh/`,
 documentation extensions are excluded from that last rule, so `src/auth/token.ts` stays
 readable.
 
-Also denied: this plugin's own `redactionKeyFile` and `auditLog`, and everything under
-`$DSH_HOME`. The harness home holds the provider credentials, the session logs, and the
-profiles that decide which plugins load at all; keep the files an agent is meant to work on
-somewhere else.
+Also denied for every tool: this plugin's own `redactionKeyFile` and `auditLog`.
+
+**`$DSH_HOME` is split by direction.** Every *write* under the harness home is denied, for
+every tool: editing a profile's `cordis.yml` mounts an arbitrary plugin, which is the exact
+threat that makes the directory worth protecting. *Reads* are denied only where the contents
+are credentials — `$DSH_HOME/.credentials.yaml`, `$DSH_HOME/sessions/**`, `$DSH_HOME/.env`,
+this plugin's key file and audit log, and any `*.key` — so the installed plugin tree under
+`profiles/node_modules/` and every profile manifest stay readable. A blanket read denial there
+made debugging a plugin, reading a profile, and running the sibling `dsh-plugin-inspector`
+against an installed tree impossible, with a message saying the denial could not be overridden.
+
+Which side of that split a call lands on is decided by the tool's name, from a table of tools
+that can only look: `read`, `read_image`, `glob`, `grep`, `lsp`, the session-query tools,
+`job_list`, `job_output`, `terminal_list`, `terminal_read`, `list_agents`, `get_goal`.
+Every other name — every shell, every editor, every `mcp__*` tool, and any tool this build has
+never heard of — is treated as able to write, so a new tool is denied until it is classified.
+A shell is never on the read side even for a command that only reads: a shell that can `cat` a
+profile can also rewrite it.
 
 Paths are normalised first — `..` traversal, `~`, Windows separators, quoting and a trailing
 slash do not evade the table — and then resolved with `realpathSync`, so a symlink named
@@ -228,10 +264,13 @@ is the only decision that replaces the whole result, so it is the only way to dr
 
 Two consequences worth knowing:
 
-- Replacing a value re-validates it against the tool's `output.schema`. A schema that
-  constrains that string (a length, a pattern, an enum) rejects the placeholder and the call
-  fails with a `ToolOutputError`. A failed call is the intended outcome; the alternative is
-  writing the secret to the log.
+- Replacing a value re-validates it against the tool's `output.schema`, and a schema that pins
+  that string — an `enum`, a `const`, a `oneOf` branch it selects — would reject the
+  placeholder. The plugin asks that question first and withholds the result with the message
+  above, rather than letting the registry raise a `ToolOutputError` that names a validation
+  failure and tells the model nothing it can act on. The call still fails; it fails
+  comprehensibly. Where the plugin cannot answer the question — no schema resolved, or a
+  schema whose own value it cannot validate — the registry decides as before.
 - Redaction is per-detection, and each span grows to the nearest delimiter — whitespace,
   quotes, `=`, `:`, `,`, brackets. A line of minified JSON loses the field that matched, not
   the whole line.
@@ -258,6 +297,51 @@ A tool result is scanned twice: each of its strings on its own by tier 1, and al
 joined by newlines through both tiers. The joined pass finds what no single string reproduces —
 a PEM block arriving as one line per array element, which is exactly the shape `read` produces.
 
+### Invisible characters
+
+Tier 1 also looks for characters that hide text from the person reading a tool result while
+the model still reads it. The harness strips directional controls in exactly one place —
+session titles — and never on the tool-result path.
+
+| Class | Code points | What happens |
+|---|---|---|
+| Tags block | `U+E0000–U+E007F` | replaced |
+| Bidi overrides and isolates | `U+202A–U+202E`, `U+2066–U+2069` | replaced |
+| Zero-width | `U+200B–U+200D`, `U+2060`, `U+FEFF` | counted only |
+| Bidi marks | `U+061C`, `U+200E–U+200F` | counted only |
+| Variation selectors | `U+FE00–U+FE0F`, `U+E0100–U+E01EF` | counted only |
+
+The first two have no legitimate use in tool output — the Tags block is a full invisible ASCII
+alphabet, which is what makes it the standard carrier for a hidden instruction. The last three
+do: `U+200D` joins an emoji sequence and a variation selector picks a glyph, so replacing them
+would corrupt ordinary text. They are counted in the audit record's `unicode` field and left
+alone, as a `medium` finding.
+
+Every class is `medium`, below the severity at which the guard floor denies, so an invisible
+character is never turned into a denial. A replaced run becomes an ordinary placeholder and,
+unlike a secret, is replaced exactly: an invisible character is not widened to its surrounding
+delimiters, so the visible word it hid inside survives.
+
+**A homoglyph defeats all of this**, and every other rule in this plugin. A Cyrillic `а` in
+`аdmin` is a normal, visible, legitimately-encoded character; detecting it means UTS #39
+confusable tables, which is a data set and a different cost class. This plugin does not attempt
+it, and no rule here should be read as covering it.
+
+Measured cost of the invisible-character scan over 512 KB, median of 30 runs on an i9-12900H
+under Node 22.23.2:
+
+| Input | Cost |
+|---|---|
+| clean Latin-1 text | 0.002 ms |
+| one hidden instruction (69 characters) | 0.355 ms |
+| 7,653 separate runs | 7.9 ms |
+| 512 KB of alternating invisible characters (524,286 runs) | 56–113 ms |
+
+Clean text is free because every character in the table is above `U+00FF`: the regular
+expression engine rejects a Latin-1 string on its encoding without scanning it. The last row is
+a crafted input, not a plausible one, and it is the only case that leaves the ≤10 ms per result
+budget; `maxScanBytes` caps tier 2 only, so tier 1 always sees the whole result.
+
 Measured cost of a tier-2 scan: 0.78 ms at 1 KB, 0.91 ms at 16 KB, 2.22 ms at 128 KB, 5.11 ms
 at 512 KB. `maxScanBytes` caps **tier 2 only**, once per result, over the joined rendering;
 tier 1 always scans everything. When tier 2 saw less than the whole result the audit record
@@ -300,11 +384,52 @@ its own identity.
 ```
 
 `kind` is one of `guard-deny`, `pre-execute-deny`, `result-redaction`, `telemetry-redaction`.
+A `result-redaction` record may also carry `unicode`, a count of invisible-character runs per
+class — counts only, because a hidden instruction is exactly the content this file must not
+repeat. A record is written whenever there is something to say, including a result that was
+only counted and a result whose tier-2 scan was truncated.
 A record carries no free-text reason: the spans are the whole description of what matched, so
 nothing built from a candidate path or command line can reach the file. An audit write failure
-is logged and swallowed rather than turned into a denial: the sink is evidence, not
+is reported and swallowed rather than turned into a denial: the sink is evidence, not
 enforcement, and a full disk should not take the agent down.
 
+Reported means `process.stderr` **and** `ctx.logger`, for that failure and for an invalid
+policy file. The logger alone is not enough: its default exporter is an in-memory 1000-entry
+ring buffer and no shipped bundle mounts a console exporter, so a message sent only there is
+invisible on a stock install. `process.stderr` is what the headless runner itself writes to.
+
+---
+
+## Reading the audit log
+
+The package installs a `dsh-dlp` command that reads the JSONL sink and summarises it. It
+imports nothing from the harness, so it runs wherever the package is installed, with no profile
+and no `dsh` on the path:
+
+```sh
+dsh-dlp report                      # everything in $DSH_HOME/dsh-dlp.audit.jsonl
+dsh-dlp report --since 24h          # or an ISO timestamp
+dsh-dlp report --session <id>
+dsh-dlp report --would-have         # only the calls that were let through
+dsh-dlp report --log /var/log/dsh-dlp.audit.jsonl
+```
+
+It prints counts by decision, by rule, by tool and by invisible-character class, then the ten
+most recent decisions. `--would-have` drops the denials and leaves the redactions and the
+invisible-character findings: those are the calls that ran, with their results rewritten, and
+they are what a policy that denied instead of rewriting would have blocked.
+
+The sink is append-only and a run can be interrupted mid-append, so a line that does not parse
+as a record is counted and reported rather than trusted. If the deployment set `auditLog` to
+somewhere other than the default, pass `--log`; the command says which file it looked at.
+
+A plugin installed into a profile puts its bin in that profile's `node_modules/.bin`, which is
+not on `PATH`. Run it from there, or install the package globally:
+
+```sh
+"$DSH_HOME/profiles/<name>/node_modules/.bin/dsh-dlp" report
+```
+
 ---
 
 ## Development

package/lib/cli.js

@@ -0,0 +1,307 @@
+#!/usr/bin/env node
+/**
+ * `dsh-dlp report` — read this plugin's audit JSONL and say what it decided.
+ *
+ * The sink is the only evidence a decision happened, and nothing read it: a
+ * user could not answer "what did this block today?". This command reads the
+ * file directly and imports nothing from the harness, so it runs wherever the
+ * package is installed, with no profile and no `dsh` on the path.
+ *
+ * The file is a durable boundary — written by an older version of this
+ * package, appended to under crash — so every line is parsed defensively and a
+ * line that is not a record is counted rather than trusted.
+ * @module dsh-dlp/cli
+ */
+import { readFileSync, realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { defaultAuditLog } from "./home.js";
+/** Decision kinds that stopped a call, as opposed to rewriting its result. */
+const DENYING_KINDS = new Set(['guard-deny', 'pre-execute-deny']);
+/** How many decisions the report lists individually. */
+const RECENT_LIMIT = 10;
+/** Read one string field, or `undefined` when the line does not carry it. */
+function stringField(record, key) {
+    const value = record[key];
+    return typeof value === 'string' ? value : undefined;
+}
+/** Rule ids named by a record's spans, in file order and without repeats. */
+function ruleIdsOf(record) {
+    const spans = record['spans'];
+    if (!Array.isArray(spans))
+        return [];
+    const ids = spans.flatMap((span) => {
+        if (typeof span !== 'object' || span === null)
+            return [];
+        const ruleId = span['ruleId'];
+        return typeof ruleId === 'string' ? [ruleId] : [];
+    });
+    return [...new Set(ids)];
+}
+/** Invisible-character counts a record carries, keeping only numeric entries. */
+function unicodeOf(record) {
+    const counts = record['unicode'];
+    if (typeof counts !== 'object' || counts === null || Array.isArray(counts))
+        return {};
+    return Object.fromEntries(Object.entries(counts).flatMap(([key, value]) => typeof value === 'number' ? [[key, value]] : []));
+}
+/**
+ * Parse one JSONL line into the fields this command reports on.
+ * @param line - one line of the audit file.
+ * @returns the record, or `undefined` when the line is not one.
+ */
+export function parseRecord(line) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        // A torn final line from an interrupted append is the expected cause.
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return undefined;
+    const record = parsed;
+    const kind = stringField(record, 'kind');
+    const written = stringField(record, 'time');
+    if (kind === undefined || written === undefined)
+        return undefined;
+    const time = Date.parse(written);
+    if (Number.isNaN(time))
+        return undefined;
+    const tool = stringField(record, 'tool');
+    const sessionId = stringField(record, 'sessionId');
+    return {
+        time,
+        kind,
+        ...tool === undefined ? {} : { tool },
+        ...sessionId === undefined ? {} : { sessionId },
+        ruleIds: ruleIdsOf(record),
+        unicode: unicodeOf(record),
+    };
+}
+/** Text printed for `--help` and alongside a usage error. */
+export const USAGE = [
+    'Usage: dsh-dlp report [options]',
+    '',
+    'Reads the JSONL audit sink this plugin writes and summarises what it decided.',
+    '',
+    'Options:',
+    '  --log <path>     audit file to read (default: $DSH_HOME/dsh-dlp.audit.jsonl)',
+    '  --since <when>   only decisions at or after an ISO timestamp, or a span back',
+    '                   from now written as 30m, 24h or 7d',
+    '  --session <id>   only decisions from one session',
+    '  --would-have     only the decisions that let the call through: the redactions',
+    '                   and invisible-character findings, which is what a policy that',
+    '                   denied instead of rewriting would have blocked',
+    '  -h, --help       print this text',
+].join('\n');
+/** Milliseconds in one `--since` suffix; {@link parseSince} accepts no other. */
+function spanUnitMs(unit) {
+    switch (unit) {
+        case 's': return 1000;
+        case 'm': return 60_000;
+        case 'h': return 3_600_000;
+        default: return 86_400_000;
+    }
+}
+/**
+ * Read `--since`: an ISO timestamp, or a span back from now.
+ * @param value - the argument as written.
+ * @param now - epoch milliseconds a relative span counts back from.
+ * @returns epoch milliseconds, or `undefined` when the value is neither.
+ */
+export function parseSince(value, now) {
+    if (/^\d+[smhd]$/.test(value))
+        return now - Number(value.slice(0, -1)) * spanUnitMs(value.slice(-1));
+    const absolute = Date.parse(value);
+    return Number.isNaN(absolute) ? undefined : absolute;
+}
+/**
+ * Read the command line.
+ * @param argv - arguments after the program name.
+ * @param env - environment used for the default sink path.
+ * @param now - epoch milliseconds a relative `--since` counts back from.
+ * @returns what to run, or the usage error to print.
+ */
+export function parseArguments(argv, env, now) {
+    const [command, ...rest] = argv;
+    if (command === undefined || command === '-h' || command === '--help')
+        return { kind: 'help' };
+    if (command !== 'report')
+        return { kind: 'error', message: `dsh-dlp: unknown command ${JSON.stringify(command)}` };
+    let log = defaultAuditLog(env);
+    let since;
+    let session;
+    let wouldHave = false;
+    let consumed = false;
+    for (const [index, flag] of rest.entries()) {
+        if (consumed) {
+            consumed = false;
+            continue;
+        }
+        switch (flag) {
+            case '--log':
+            case '--since':
+            case '--session': {
+                const value = rest[index + 1];
+                if (value === undefined)
+                    return { kind: 'error', message: `dsh-dlp: ${flag} needs a value` };
+                consumed = true;
+                if (flag === '--log')
+                    log = value;
+                else if (flag === '--session')
+                    session = value;
+                else {
+                    const parsed = parseSince(value, now);
+                    if (parsed === undefined) {
+                        return {
+                            kind: 'error',
+                            message: `dsh-dlp: --since ${JSON.stringify(value)} is neither a timestamp nor a span like 24h`,
+                        };
+                    }
+                    since = parsed;
+                }
+                break;
+            }
+            case '--would-have':
+                wouldHave = true;
+                break;
+            case '-h':
+            case '--help':
+                return { kind: 'help' };
+            default:
+                return { kind: 'error', message: `dsh-dlp: unknown option ${JSON.stringify(flag)}` };
+        }
+    }
+    return {
+        kind: 'report',
+        options: {
+            log,
+            ...since === undefined ? {} : { since },
+            ...session === undefined ? {} : { session },
+            wouldHave,
+        },
+    };
+}
+/**
+ * Read and parse the audit file.
+ * @param path - the file to read.
+ * @returns its records, its absence, or the problem to print.
+ */
+export function readAuditFile(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { kind: 'absent' };
+        return { kind: 'unreadable', problem: `dsh-dlp: cannot read ${path}: ${String(error)}` };
+    }
+    const lines = text.split('\n').filter(line => line.trim().length > 0);
+    const records = lines.flatMap((line) => {
+        const record = parseRecord(line);
+        return record === undefined ? [] : [record];
+    });
+    return { kind: 'read', records, unreadable: lines.length - records.length };
+}
+/** Count each label over the records, most frequent first. */
+function tally(records, label) {
+    const counts = new Map();
+    for (const record of records) {
+        for (const key of label(record))
+            counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    return [...counts].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]));
+}
+/** One `name  count` line per entry, padded so the column lines up. */
+function countLines(entries) {
+    const width = Math.max(...entries.map(([name]) => name.length));
+    return entries.map(([name, count]) => `  ${name.padEnd(width)}  ${count}`);
+}
+/** A heading and its counts, or nothing when there are none. */
+function section(heading, entries) {
+    return entries.length === 0 ? [] : ['', heading, ...countLines(entries)];
+}
+/**
+ * Render the report.
+ * @param records - every record the file yielded.
+ * @param unreadable - how many of its lines were not records.
+ * @param options - the filters the invocation asked for.
+ * @returns the lines to print.
+ */
+export function formatReport(records, unreadable, options) {
+    const selected = records.filter((record) => {
+        if (options.since !== undefined && record.time < options.since)
+            return false;
+        if (options.session !== undefined && record.sessionId !== options.session)
+            return false;
+        if (options.wouldHave && DENYING_KINDS.has(record.kind))
+            return false;
+        return true;
+    });
+    const lines = [`dsh-dlp: ${selected.length} decision(s) in ${options.log}`];
+    if (options.since !== undefined)
+        lines.push(`  since ${new Date(options.since).toISOString()}`);
+    if (options.session !== undefined)
+        lines.push(`  session ${options.session}`);
+    if (options.wouldHave)
+        lines.push('  only decisions that let the call through');
+    if (unreadable > 0)
+        lines.push(`  ${unreadable} line(s) were not readable as records`);
+    if (selected.length === 0)
+        return lines;
+    lines.push(...section('by decision', tally(selected, record => [record.kind])), ...section('by rule', tally(selected, record => record.ruleIds)), ...section('by tool', tally(selected, record => record.tool === undefined ? [] : [record.tool])), ...section('results carrying invisible characters', tally(selected, record => Object.keys(record.unicode))));
+    const recent = [...selected].sort((left, right) => right.time - left.time).slice(0, RECENT_LIMIT);
+    lines.push('', `most recent ${recent.length}`);
+    for (const record of recent) {
+        const rules = record.ruleIds.length === 0 ? '-' : record.ruleIds.join(', ');
+        lines.push(`  ${new Date(record.time).toISOString()}  ${record.kind}  ${record.tool ?? '-'}  ${rules}`);
+    }
+    return lines;
+}
+/**
+ * Run one invocation.
+ * @param argv - arguments after the program name.
+ * @param write - receives each line of output.
+ * @param fail - receives each line of error output.
+ * @param env - environment used for the default sink path.
+ * @param now - epoch milliseconds a relative `--since` counts back from.
+ * @returns the process exit code.
+ */
+export function main(argv, write, fail, env = process.env, now = Date.now()) {
+    const invocation = parseArguments(argv, env, now);
+    if (invocation.kind === 'help') {
+        write(USAGE);
+        return 0;
+    }
+    if (invocation.kind === 'error') {
+        fail(invocation.message);
+        fail(USAGE);
+        return 2;
+    }
+    const file = readAuditFile(invocation.options.log);
+    switch (file.kind) {
+        case 'absent':
+            write(`dsh-dlp: no audit file at ${invocation.options.log}`);
+            write('Nothing has been recorded yet, or the deployment set `auditLog` elsewhere — pass --log <path>.');
+            return 0;
+        case 'unreadable':
+            fail(file.problem);
+            return 1;
+        case 'read':
+            for (const line of formatReport(file.records, file.unreadable, invocation.options))
+                write(line);
+            return 0;
+        /* v8 ignore next 4 -- unreachable while `AuditFileRead` stays closed; the arm exists so adding a variant fails the build. */
+        default: {
+            const unhandled = file;
+            throw new TypeError(`dsh-dlp: unhandled audit file read ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+/* v8 ignore start -- the process entry, exercised by tests/e2e/report.e2e.ts against the built CLI rather than by the instrumented unit run. */
+if (process.argv[1] !== undefined && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    process.exitCode = main(process.argv.slice(2), line => process.stdout.write(`${line}\n`), line => process.stderr.write(`${line}\n`));
+}
+/* v8 ignore stop */

package/lib/detectors.js

@@ -58,11 +58,94 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/teams-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/[A-Za-z0-9.-]*webhook\.office\.com\/webhookb2\/[A-Za-z0-9@/_-]{10,}/g },
     { id: 'dsh-dlp/secret-assignment', version: 1, severity: 'medium', pattern: /\b(?:api[_-]?key|secret[_-]?key|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token)\b\s*[=:]\s*["']?[A-Za-z0-9/+=_-]{16,}["']?/gi },
 ];
+/** Build one class's run pattern from its ranges, so the two cannot drift apart. */
+function unicodeRule(id, action, ranges) {
+    return { id, version: 1, severity: 'medium', action, ranges, pattern: new RegExp(`[${ranges}]+`, 'gu') };
+}
+/**
+ * Character classes that hide text from the reader while the model still reads
+ * it, verified against the Unicode character database.
+ *
+ * Every class is `medium`. These are injection *indicators*, not credentials:
+ * the guard floor denies at `high` and above, so an argument carrying one is
+ * never denied on that basis. What they buy is a redaction and an audit record
+ * on a path the harness does not cover — it strips directional controls in
+ * exactly one place, session titles, and never on the tool-result path.
+ *
+ * Not attempted here: UTS #39 confusables. A Cyrillic `а` needs a data table
+ * to detect and is a different cost class, and it defeats every rule in this
+ * file. README.md says so rather than implying coverage.
+ */
+export const UNICODE_RULES = [
+    // Tags block: a full ASCII alphabet with no rendering, the standard carrier
+    // for instructions meant for the model and not for the reader.
+    unicodeRule('dsh-dlp/unicode-tag-characters', 'strip', String.raw `\u{E0000}-\u{E007F}`),
+    // Bidi overrides and isolates reorder what is displayed without changing the
+    // characters a model reads.
+    unicodeRule('dsh-dlp/unicode-bidi-override', 'strip', String.raw `\u{202A}-\u{202E}\u{2066}-\u{2069}`),
+    // U+200D joins legitimate emoji sequences, so stripping this class has a
+    // real false positive.
+    unicodeRule('dsh-dlp/unicode-zero-width', 'report', String.raw `\u{200B}-\u{200D}\u{2060}\u{FEFF}`),
+    // Bidi marks, unlike the overrides above, appear in real right-to-left text.
+    unicodeRule('dsh-dlp/unicode-bidi-mark', 'report', String.raw `\u{061C}\u{200E}\u{200F}`),
+    unicodeRule('dsh-dlp/unicode-variation-selector', 'report', String.raw `\u{FE00}-\u{FE0F}\u{E0100}-\u{E01EF}`),
+];
+/**
+ * One run of any indicator class. The scan is a single pass over the input
+ * with this pattern; the per-class patterns then run over the matched runs
+ * only, which are a handful of characters each.
+ */
+const UNICODE_RUN = new RegExp(`[${UNICODE_RULES.map(rule => rule.ranges).join('')}]+`, 'gu');
+/**
+ * Find every invisible or direction-changing character in one string.
+ *
+ * Offsets are UTF-16 indices into `text`, so a caller can splice them
+ * directly; they are exact rather than advisory, and {@link Detection.exact}
+ * says so.
+ * @param text - the string to scan.
+ * @returns every indicator run, ordered by start offset.
+ */
+export function scanUnicode(text) {
+    const findings = [];
+    for (const run of text.matchAll(UNICODE_RUN)) {
+        for (const rule of UNICODE_RULES) {
+            for (const match of run[0].matchAll(rule.pattern)) {
+                const start = run.index + match.index;
+                findings.push({
+                    ruleId: rule.id,
+                    ruleVersion: rule.version,
+                    severity: rule.severity,
+                    start,
+                    end: start + match[0].length,
+                    exact: true,
+                    action: rule.action,
+                });
+            }
+        }
+    }
+    findings.sort(byPosition);
+    return findings;
+}
+/**
+ * How many runs of each indicator class one string carries.
+ * @param text - the string to scan.
+ * @returns a count per rule id; absent means none were found.
+ */
+export function countUnicodeIndicators(text) {
+    const counts = {};
+    for (const finding of scanUnicode(text)) {
+        counts[finding.ruleId] = (counts[finding.ruleId] ?? 0) + 1;
+    }
+    return counts;
+}
 /**
  * Scan text with tier 1. Pure, synchronous, no I/O, and never capped: a table
  * of anchored regular expressions costs a linear pass, so there is no reason
  * to stop scanning where tier 2 has to. `truncated` is therefore always
  * `false` here and only tier 2 can set it.
+ *
+ * The `strip` half of {@link UNICODE_RULES} is included, so every seam reading
+ * tier 1 — including the synchronous telemetry waterfall — gets it.
  * @param text - the string to scan.
  * @param rules - the rule table to apply; defaults to {@link SYNC_RULES}.
  * @returns every match, ordered by start offset.
@@ -82,6 +165,10 @@ export function scanSync(text, rules = SYNC_RULES) {
             });
         }
     }
+    for (const finding of scanUnicode(text)) {
+        if (finding.action === 'strip')
+            detections.push(finding);
+    }
     detections.sort(byPosition);
     return { detections, truncated: false };
 }