dsh-dlp 0.1.0 → 0.3.0

package/lib/index.js

@@ -14,6 +14,15 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
+ * 5. `llm/stream` — neutralising remote markdown image destinations in
+ *    assistant output, before the text becomes a session event.
+ *
+ * Three of those registrations mitigate defects in the harness rather than in
+ * a deployment's own configuration: the missing Content-Security-Policy behind
+ * (5), the mutable execution object behind the guard's mutation check, and the
+ * silently inert telemetry seam behind the notice reported at mount. Each one
+ * is partial, none closes its channel, and README.md says so beside the
+ * feature.
  *
  * This plugin is not a containment boundary. It runs in-process at the agent's
  * own uid; anything the agent can execute can read the same files the guard
@@ -25,8 +34,10 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { loadRepoPolicy, resolvePolicy } from "./policy.js";
 import { SpanHasher } from "./redaction.js";
 import { safeEvaluateGuard } from "./guard.js";
+import { neutralizeImageStream } from "./images.js";
+import { ExecutionSnapshots, mutationReason } from "./mutation.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
-import { redactRecord } from "./telemetry.js";
+import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
 export { Config } from "./policy.js";
 /** Display metadata; labels the plugin in Cordis diagnostics. */
@@ -69,6 +80,31 @@ export function loadOrCreateKey(path) {
     writeFileSync(path, created, { mode: 0o600 });
     return created;
 }
+/**
+ * Report a plugin fault on both the deployment's logger and `process.stderr`.
+ *
+ * `ctx.logger`'s default exporter is an in-memory 1000-entry ring buffer and
+ * no shipped bundle mounts a console exporter, so a message that goes only to
+ * the logger is invisible on a stock install — which is what an invalid policy
+ * file and a failed audit write were. `process.stderr` is what the headless
+ * runner itself writes to.
+ * @param ctx - the plugin's context, used for its logger.
+ * @param message - the whole line to report; never carries a matched value.
+ */
+function report(ctx, message) {
+    ctx.logger.error(message);
+    process.stderr.write(`${message}\n`);
+}
+/**
+ * Report something the operator should know that is not a fault, on the same
+ * two channels and for the same reason as {@link report}.
+ * @param ctx - the plugin's context, used for its logger.
+ * @param message - the whole line to report.
+ */
+function notice(ctx, message) {
+    ctx.logger.warn(message);
+    process.stderr.write(`${message}\n`);
+}
 /**
  * Load the repo-local policy tier, if the deployment named one.
  *
@@ -77,7 +113,7 @@ export function loadOrCreateKey(path) {
  * well-formed: the recommended `policyFile` is workspace-relative, so failing
  * the mount would refuse to start `dsh` in every repository without one, and
  * would let a hostile repository disable the plugin by shipping a broken file.
- * @param ctx - the plugin's context, used only for its logger.
+ * @param ctx - the plugin's context, used only to report a bad file.
  * @param policyFile - the configured path, or `undefined` when the deployment named none.
  * @returns the validated policy, or `undefined` when there is none to apply.
  */
@@ -91,7 +127,7 @@ function loadConfiguredPolicy(ctx, policyFile) {
         case 'loaded':
             return load.policy;
         case 'invalid':
-            ctx.logger.error(`dsh-dlp: ignoring the repo-local policy at ${policyFile}: ${load.problem}`);
+            report(ctx, `dsh-dlp: ignoring the repo-local policy at ${policyFile}: ${load.problem}`);
             return undefined;
         /* v8 ignore next 4 -- unreachable while `RepoPolicyLoad` stays closed; the arm exists so adding a variant fails the build. */
         default: {
@@ -110,7 +146,7 @@ export function apply(ctx, config) {
     const hasher = new SpanHasher(loadOrCreateKey(config.redactionKeyFile));
     const correlator = new CallCorrelator();
     const sink = new AuditSink(config.auditLog, (error) => {
-        ctx.logger.error(`dsh-dlp: audit sink write failed: ${String(error)}`);
+        report(ctx, `dsh-dlp: audit sink write failed: ${String(error)}`);
     });
     /** Identity every audit record carries; the session-log envelope carries none of it. */
     const identity = (exec) => {
@@ -123,7 +159,30 @@ export function apply(ctx, config) {
             ...position === undefined ? {} : { turn: position.turn, step: position.step },
         };
     };
+    const snapshots = new ExecutionSnapshots(hasher);
+    /**
+     * Report the telemetry seam's state once.
+     *
+     * At mount only a backend that is already there answers the question: the
+     * backend can load after this plugin, and calling that absence "inert" would
+     * be a false alarm. `conclusive` marks the later call, made once the harness
+     * is running sessions, where an absent backend really means no dispatcher.
+     */
+    let telemetrySeamReported = false;
+    const discloseTelemetrySeam = (conclusive) => {
+        if (telemetrySeamReported)
+            return;
+        const backend = ctx.get('sessionTelemetry');
+        if (backend === undefined && !conclusive)
+            return;
+        telemetrySeamReported = true;
+        const line = telemetrySeamNotice(backend?.sharing);
+        if (line !== undefined)
+            notice(ctx, line);
+    };
     ctx.on('session/event', (_session, event) => {
+        if (policy.telemetryRedaction)
+            discloseTelemetrySeam(true);
         if (event.type === 'tool/call') {
             correlator.note(event.data.callId, { turn: event.data.turn, step: event.data.step });
             return;
@@ -132,9 +191,32 @@ export function apply(ctx, config) {
             correlator.forget(event.data.message.source.callId);
         }
     });
+    // Snapshot each call before the rest of the waterfall can rewrite it. The
+    // prepend is best-effort by construction: a listener registered later with
+    // the same option runs ahead of this one.
+    ctx.on('tools/pre-execute', (exec, next) => {
+        snapshots.record(exec);
+        return next();
+    }, { prepend: true });
     // The floor. Registered on a plain context so it applies globally: to every
     // agent, every `run_code` inner sub-call, and every subagent child.
     ctx.effect(() => ctx.tools.guard((exec) => {
+        // Integrity first: a call whose name or arguments changed after `tool/call`
+        // was appended is denied whatever the policy tables say about it, because
+        // the log no longer describes what would run.
+        const mutation = snapshots.detect(exec);
+        if (mutation !== undefined) {
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'execution-mutation',
+                decisionId: newDecisionId(),
+                ...identity(exec),
+                mutatedFields: mutation.fields,
+                ...mutation.fields.includes('name') ? { originalTool: mutation.originalTool } : {},
+            });
+            return mutationReason(exec, mutation);
+        }
         const verdict = safeEvaluateGuard(exec, policy, hasher);
         if (verdict === undefined)
             return undefined;
@@ -169,11 +251,20 @@ export function apply(ctx, config) {
     }
     if (policy.resultRedaction) {
         ctx.on('tools/post-execute', async (exec, result, next) => {
-            const redacted = await redactDecision(await next(), result, policy, hasher);
+            // The live definition, so a schema the deployment's own tool declares is
+            // read from the registry rather than assumed. `exec.agent` is the scope
+            // key: a scoped tool shadows a global one of the same name.
+            const outputSchema = ctx.tools.get(exec.name, exec.agent)?.output.schema;
+            const redacted = await redactDecision(await next(), result, policy, hasher, outputSchema);
+            const indicators = Object.keys(redacted.indicators).length > 0
+                ? { unicode: redacted.indicators }
+                : {};
             // A truncated scan is recorded even with nothing found: without a record
             // an operator cannot tell "this result was clean" from "this result was
-            // only partly examined".
-            if (redacted.spans.length > 0 || redacted.truncatedScan) {
+            // only partly examined". An invisible-character run is recorded on the
+            // same terms, because the `report` classes are never replaced and the
+            // count is the only trace they leave.
+            if (redacted.spans.length > 0 || redacted.truncatedScan || Object.keys(indicators).length > 0) {
                 sink.write({
                     v: RECORD_VERSION,
                     time: new Date().toISOString(),
@@ -182,12 +273,26 @@ export function apply(ctx, config) {
                     ...identity(exec),
                     spans: redacted.spans,
                     ...redacted.truncatedScan ? { truncatedScan: true } : {},
+                    ...indicators,
                 });
             }
             return redacted.decision;
         });
     }
+    if (policy.remoteImageNeutralization) {
+        ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'assistant-image-neutralized',
+                decisionId: newDecisionId(),
+                ...options.sessionId === undefined ? {} : { sessionId: String(options.sessionId) },
+                host,
+            });
+        }));
+    }
     if (policy.telemetryRedaction) {
+        discloseTelemetrySeam(false);
         ctx.on('session-telemetry/record', (_record, next) => {
             // Throwing here withholds this one record; the coordinator contains it
             // and the agent loop never sees the failure. That is the fail-closed

package/lib/mutation.js

@@ -0,0 +1,102 @@
+/**
+ * Detecting a tool call that was rewritten after it was logged.
+ *
+ * The registry deep-freezes `exec.arguments` but does not freeze the execution
+ * object until results are notified, so a `tools/pre-execute` listener can
+ * reassign `exec.arguments` or `exec.name` — and reassigning `exec.name`
+ * changes which tool body runs. The agent loop appended `tool/call` from the
+ * model's own response block before the waterfall ran, so nothing in the
+ * session log records the change: the durable record then describes a
+ * different call than the one about to execute.
+ *
+ * This module snapshots the call as early in the waterfall as it can and
+ * compares in the guard, which runs after the whole waterfall and cannot be
+ * out-ordered. It is detection, not prevention: preventing the rewrite would
+ * mean freezing an object this plugin does not own, and the snapshot itself is
+ * best-effort — a later `{ prepend: true }` registration runs ahead of ours and
+ * would be snapshotted after its own rewrite.
+ * @module dsh-dlp/mutation
+ */
+/**
+ * Render a JSON value with object keys in a fixed order, so two equal argument
+ * sets hash equally whatever order a listener rebuilt them in.
+ * @param value - the argument value; JSON-serializable by the registry's own snapshot step.
+ * @returns a canonical string for hashing.
+ */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (typeof value === 'object' && value !== null) {
+        return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+    }
+    // `undefined` has no JSON rendering; it reaches here only for an execution
+    // whose arguments never materialized, which the registry fails before the
+    // waterfall. A fixed token keeps the digest total either way.
+    return JSON.stringify(value) ?? 'undefined';
+}
+/**
+ * Remembers what each pending call looked like before the rest of the
+ * `tools/pre-execute` waterfall ran.
+ *
+ * Keyed by the execution object's identity in a `WeakMap`, the way the
+ * registry keys its own per-execution state, so the entry is found again in
+ * the guard and released with the execution.
+ */
+export class ExecutionSnapshots {
+    #snapshots = new WeakMap();
+    #hasher;
+    /**
+     * @param hasher - mints the keyed digest of the arguments; the values themselves are never stored.
+     */
+    constructor(hasher) {
+        this.#hasher = hasher;
+    }
+    /**
+     * Snapshot one pending call.
+     * @param exec - the execution as the earliest listener sees it.
+     */
+    record(exec) {
+        this.#snapshots.set(exec, { name: exec.name, digest: this.#hasher.hash(canonicalJson(exec.arguments)) });
+    }
+    /**
+     * Compare one call against its snapshot.
+     *
+     * A call with no snapshot is not a finding: the listener may never have run
+     * for it, and reporting absence as mutation would deny calls this plugin
+     * simply did not observe.
+     * @param exec - the execution as the guard stage sees it.
+     * @returns what changed, or `undefined` when nothing did.
+     */
+    detect(exec) {
+        const snapshot = this.#snapshots.get(exec);
+        if (snapshot === undefined)
+            return undefined;
+        const fields = [];
+        if (exec.name !== snapshot.name)
+            fields.push('name');
+        if (this.#hasher.hash(canonicalJson(exec.arguments)) !== snapshot.digest)
+            fields.push('arguments');
+        return fields.length === 0 ? undefined : { fields, originalTool: snapshot.name };
+    }
+}
+/**
+ * Denial text for a rewritten call.
+ *
+ * Both tool names are named: a tool name is already in the session log and in
+ * every other denial this plugin writes, and naming them is the whole point —
+ * the operator needs to know which call the log describes and which one was
+ * about to run. No argument value appears.
+ * @param exec - the call as the guard sees it, after the rewrite.
+ * @param mutation - the fields that changed and the recorded tool name.
+ * @returns the model-facing reason.
+ */
+export function mutationReason(exec, mutation) {
+    const changed = mutation.fields.join(' and ');
+    const renamed = mutation.fields.includes('name')
+        ? ` The session log records a call to ${JSON.stringify(mutation.originalTool)}.`
+        : '';
+    return `dsh-dlp denied ${JSON.stringify(exec.name)}: another mounted plugin rewrote this call's ${changed} `
+        + `after the session log recorded it, so the log and the presented call describe something other than what `
+        + `would have run.${renamed} The call is denied because a tool call that cannot be reconstructed from the log `
+        + 'is not auditable. This is a defect in a mounted plugin, not in the call; report it to the deployment operator.';
+}

package/lib/paths.js

@@ -225,3 +225,41 @@ export function isEgressCapable(toolName, extraEgressTools = new Set()) {
         return true;
     return !LOCAL_TOOLS.has(toolName);
 }
+/**
+ * Tools that can only look: they query the filesystem, the language server,
+ * the session store or a running job, and have no operation that changes
+ * anything.
+ *
+ * A `writes-only` rule is lifted for these names and for no others. Every
+ * shell, `run_code`, every editor, every `mcp__*` tool and any tool this build
+ * has never heard of stays on the deny side, so a new tool is denied until it
+ * is classified — the same default as {@link LOCAL_TOOLS}, in the same
+ * direction.
+ */
+export const READ_ONLY_TOOLS = new Set([
+    'read', 'read_image', 'glob', 'grep', 'lsp',
+    'session_search', 'session_trace',
+    'session_event_read', 'session_event_search', 'session_event_trace',
+    'list_agents', 'job_list', 'job_output',
+    'terminal_list', 'terminal_read',
+    'get_goal',
+]);
+/**
+ * Whether a tool is known to be incapable of changing anything.
+ * @param toolName - the executing tool's registered name.
+ * @returns `true` only for a name in {@link READ_ONLY_TOOLS}.
+ */
+export function isReadOnlyTool(toolName) {
+    return READ_ONLY_TOOLS.has(toolName);
+}
+/**
+ * The credential-path rules one tool is judged against.
+ * @param toolName - the executing tool's registered name.
+ * @param rules - the effective rule table.
+ * @returns every rule, minus the `writes-only` ones for a read-only tool.
+ */
+export function rulesForTool(toolName, rules) {
+    if (!isReadOnlyTool(toolName))
+        return rules;
+    return rules.filter(rule => rule.enforcement !== 'writes-only');
+}

package/lib/policy.js

@@ -15,11 +15,11 @@
  * @module dsh-dlp/policy
  */
 import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { resolve } from 'node:path';
 import { JSON_SCHEMA, load } from 'js-yaml';
 import z from '@deepseek-ai/schemastery';
 import { SYNC_RULES, severityRank } from "./detectors.js";
+import { resolveDshHome } from "./home.js";
 import { CREDENTIAL_PATH_RULES } from "./paths.js";
 export const Config = z.object({
     auditLog: z.string().required(),
@@ -29,10 +29,17 @@ export const Config = z.object({
     breadthTier: z.boolean().default(true),
     resultRedaction: z.boolean().default(true),
     telemetryRedaction: z.boolean().default(true),
+    remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
 });
 /** Config toggles a repo-local policy may switch on, and never off. */
-const ENABLEABLE = ['breadthTier', 'resultRedaction', 'telemetryRedaction', 'redactTelemetryWorkspacePaths'];
+const ENABLEABLE = [
+    'breadthTier',
+    'resultRedaction',
+    'telemetryRedaction',
+    'remoteImageNeutralization',
+    'redactTelemetryWorkspacePaths',
+];
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -216,36 +223,35 @@ function escapePattern(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
 }
 /**
- * Deny rules protecting this plugin's own state.
+ * Deny rules protecting this plugin's own state and the harness home.
  *
  * Every one of these is known at mount: the key file whose bytes make a
  * placeholder hash keyed rather than a bare digest, the append-only sink that
  * is the only evidence a decision happened, and the harness home holding the
  * provider credentials, the session logs and the profiles that decide which
  * plugins load at all.
+ *
+ * The harness home is split. **Writing** anywhere under it is denied for every
+ * tool: a prompt-injected agent editing a profile's `cordis.yml` mounts an
+ * arbitrary plugin. **Reading** it is denied only where the contents are
+ * credentials — `.credentials.yaml`, `.env` and `*.key` are already in the
+ * built-in table, and the session logs get a rule here. Everything else under
+ * that directory is the installed plugin tree and the profile manifests, which
+ * a user debugging a plugin has every reason to read; a blanket read denial
+ * there was unoverridable and was the plugin's most likely uninstall reason.
  * @param config - the deployment-controlled configuration.
  * @param dshHome - the resolved harness home.
  * @returns rules appended after the built-in table.
  */
 function selfProtectionRules(config, dshHome) {
+    const home = escapePattern(resolve(dshHome));
     return [
         { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.redactionKeyFile))}$`, 'i') },
         { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.auditLog))}$`, 'i') },
-        { id: 'dsh-dlp/path-dsh-home', version: 1, pattern: new RegExp(`^${escapePattern(resolve(dshHome))}(/|$)`, 'i') },
+        { id: 'dsh-dlp/path-dsh-sessions', version: 1, pattern: new RegExp(`^${home}/sessions(/|$)`, 'i') },
+        { id: 'dsh-dlp/path-dsh-home', version: 2, enforcement: 'writes-only', pattern: new RegExp(`^${home}(/|$)`, 'i') },
     ];
 }
-/**
- * Resolve the harness home the same way the harness does: `$DSH_HOME` when it
- * is set to something other than whitespace, otherwise `~/.dsh`. Read here
- * rather than through `@deepseek-ai/dsh-home-paths` to keep the plugin's
- * runtime imports to the ones a profile is guaranteed to resolve.
- * @param env - environment consulted for `DSH_HOME`; defaults to `process.env`.
- * @returns the absolute harness home.
- */
-export function resolveDshHome(env = process.env) {
-    const configured = env['DSH_HOME'];
-    return resolve(configured !== undefined && configured.trim().length > 0 ? configured : join(homedir(), '.dsh'));
-}
 /**
  * Merge the deployment config with an optional repo-local policy.
  * @param config - the deployment-controlled configuration.
@@ -269,6 +275,7 @@ export function resolvePolicy(config, repo) {
         breadthTier: enabled('breadthTier'),
         resultRedaction: enabled('resultRedaction'),
         telemetryRedaction: enabled('telemetryRedaction'),
+        remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
     };
 }

package/lib/redaction.js

@@ -80,7 +80,15 @@ function expand(text, start, end) {
 /** Detections merged into non-overlapping regions, each attributed to its strictest rule. */
 function mergeSpans(text, detections) {
     const expanded = detections
-        .map(detection => ({ ...detection, ...expand(text, detection.start, detection.end) }))
+        .map(({ ruleId, ruleVersion, severity, exact, start, end }) => ({
+        ruleId,
+        ruleVersion,
+        severity,
+        // An exact detection covers precisely what must go: widening an
+        // invisible character to its delimiters would delete the visible word
+        // around it.
+        ...exact === true ? { start, end } : expand(text, start, end),
+    }))
         .sort((left, right) => left.start - right.start || left.end - right.end);
     const merged = [];
     for (const candidate of expanded) {

package/lib/results.js

@@ -10,9 +10,10 @@
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
  */
-import { DENY_SEVERITY, scanAll, scanSync, severityRank, } from "./detectors.js";
+import { DENY_SEVERITY, countUnicodeIndicators, scanAll, scanSync, severityRank, } from "./detectors.js";
 import { isEgressCapable } from "./paths.js";
 import { nestedStrings, redactContent, redactJson } from "./redaction.js";
+import { redactionBreaksSchema } from "./schema.js";
 /**
  * Separator the strings of one result are rendered with before the
  * cross-string scan. A newline is what the reader of a tool result sees
@@ -38,7 +39,7 @@ const RENDER_SEPARATOR = '\n';
  * is scanned depend on the same accident.
  * @param strings - every string that will be redacted, in render order.
  * @param policy - the effective policy.
- * @returns a memoized lookup and whether tier 2 saw less than the whole rendering.
+ * @returns a memoized lookup, the invisible-character counts, and whether tier 2 saw less than the whole rendering.
  */
 async function prepareScan(strings, policy) {
     const rendered = strings.join(RENDER_SEPARATOR);
@@ -69,7 +70,7 @@ async function prepareScan(strings, policy) {
         }
     }
     /* v8 ignore next -- every string handed to the walkers was collected for this memo. */
-    return { scan: text => memo.get(text) ?? [], truncated };
+    return { scan: text => memo.get(text) ?? [], truncated, indicators: countUnicodeIndicators(rendered) };
 }
 /** Text carried by a content array's text blocks. */
 function contentStrings(blocks) {
@@ -123,10 +124,11 @@ function withheldFeedback(spans) {
  *   carries a secret, or a value that still scans dirty after redaction.
  *   Blocking replaces the whole result, which is the only way to drop `meta`.
  *
- * Replacing the value can fail: the placeholder is re-validated against the
- * tool's `output.schema`, and a schema that constrains the string rejects it,
- * which the registry reports as a `ToolOutputError`. A failed call is the
- * intended outcome there — see README.md.
+ * Replacing the value is re-validated by the registry against the tool's
+ * `output.schema`, and a schema that pins the redacted string rejects it. That
+ * surfaces as a `ToolOutputError` naming a validation failure, which tells the
+ * model nothing it can act on, so the schema is checked here first and the
+ * result is withheld with this plugin's own explanation instead.
  *
  * A downstream `accept{content}` over a dirty value is overruled by the value
  * arm, which discards that listener's presentation choice. Keeping it would
@@ -136,9 +138,10 @@ function withheldFeedback(spans) {
  * @param result - the dispatch outcome the waterfall was called with.
  * @param policy - the effective policy.
  * @param hasher - mints each span's keyed hash.
+ * @param outputSchema - the executing tool's declared output schema, when one could be resolved.
  * @returns the decision to return, the spans replaced, and scan completeness.
  */
-export async function redactDecision(decision, result, policy, hasher) {
+export async function redactDecision(decision, result, policy, hasher, outputSchema) {
     if (decision.kind === 'block') {
         const prepared = await prepareScan(contentStrings(decision.feedback), policy);
         const redacted = redactContent(decision.feedback, prepared.scan, hasher);
@@ -146,6 +149,7 @@ export async function redactDecision(decision, result, policy, hasher) {
             decision: redacted.changed ? { ...decision, feedback: redacted.content } : decision,
             spans: redacted.spans,
             truncatedScan: prepared.truncated,
+            indicators: prepared.indicators,
         };
     }
     const replacedValue = Object.hasOwn(decision, 'value') ? decision.value : undefined;
@@ -164,6 +168,14 @@ export async function redactDecision(decision, result, policy, hasher) {
     const dirty = (strings) => strings.some(text => prepared.scan(text).length > 0);
     if (value !== undefined && dirty(nestedStrings(value))) {
         const redacted = redactJson(value, prepared.scan, hasher);
+        if (redactionBreaksSchema(outputSchema, value, redacted.value)) {
+            return {
+                decision: { kind: 'block', feedback: withheldFeedback(redacted.spans) },
+                spans: redacted.spans,
+                truncatedScan: prepared.truncated,
+                indicators: prepared.indicators,
+            };
+        }
         const remaining = nestedStrings(redacted.value);
         const residual = await prepareScan(remaining, policy);
         if (remaining.some(text => residual.scan(text).length > 0)) {
@@ -171,12 +183,14 @@ export async function redactDecision(decision, result, policy, hasher) {
                 decision: { kind: 'block', feedback: withheldFeedback(redacted.spans) },
                 spans: redacted.spans,
                 truncatedScan: prepared.truncated || residual.truncated,
+                indicators: prepared.indicators,
             };
         }
         return {
             decision: { kind: 'accept', value: redacted.value, ...contexts },
             spans: redacted.spans,
             truncatedScan: prepared.truncated,
+            indicators: prepared.indicators,
         };
     }
     // The value is clean, so the durable result is clean unless `meta` — which
@@ -187,17 +201,19 @@ export async function redactDecision(decision, result, policy, hasher) {
             decision: { kind: 'block', feedback: withheldFeedback(spans) },
             spans,
             truncatedScan: prepared.truncated,
+            indicators: prepared.indicators,
         };
     }
     const blocks = replacedContent ?? result.content;
     const redacted = redactContent(blocks, prepared.scan, hasher);
     if (!redacted.changed) {
-        return { decision, spans: [], truncatedScan: prepared.truncated };
+        return { decision, spans: [], truncatedScan: prepared.truncated, indicators: prepared.indicators };
     }
     return {
         decision: { kind: 'accept', content: redacted.content, ...contexts },
         spans: redacted.spans,
         truncatedScan: prepared.truncated,
+        indicators: prepared.indicators,
     };
 }
 /**

package/lib/schema.js

@@ -0,0 +1,99 @@
+/**
+ * Whether a redacted value still satisfies the tool's declared `output.schema`.
+ *
+ * Replacing a canonical value makes the registry re-validate it, so a schema
+ * that pins the redacted string turns a redaction into a `ToolOutputError` the
+ * model cannot act on. Asking the question first lets the listener withhold
+ * the result with its own explanation instead.
+ *
+ * This is a re-implementation of the harness's own check rather than a call
+ * into it: every harness type this package uses is imported with `import
+ * type`, so nothing from `@deepseek-ai/dsh-*` is emitted as a runtime import
+ * and the plugin resolves from a profile directory that has none of them
+ * installed. The enforced subset is small — `type`, `oneOf`, `properties`,
+ * `required`, `additionalProperties`, `items`, `enum`, `const` — and the
+ * caller guards against any disagreement by checking the *original* value
+ * first: a value this module rejects before redaction means the answer cannot
+ * be trusted, and the redaction proceeds as it did before.
+ * @module dsh-dlp/schema
+ */
+/** Whether a value is a plain JSON object rather than an array or a null. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Whether a scalar passes the node's `enum` and `const` constraints. */
+function allowsScalar(node, value) {
+    if (node.enum !== undefined && !node.enum.includes(value))
+        return false;
+    return node.const === undefined || value === node.const;
+}
+/** Whether every declared property of an object node is satisfied. */
+function satisfiesObject(node, value) {
+    const properties = node.properties ?? {};
+    for (const key of node.required ?? []) {
+        if (!Object.hasOwn(value, key) || value[key] === undefined)
+            return false;
+    }
+    if (node.additionalProperties === false) {
+        for (const key of Object.keys(value)) {
+            if (!Object.hasOwn(properties, key))
+                return false;
+        }
+    }
+    return Object.entries(properties).every(([key, child]) => !Object.hasOwn(value, key) || value[key] === undefined || satisfiesJsonSchema(child, value[key]));
+}
+/**
+ * Whether one value satisfies one schema node.
+ * @param node - a node of the tool's declared output schema.
+ * @param value - the candidate value.
+ * @returns `true` when the registry's own validation would accept it.
+ */
+export function satisfiesJsonSchema(node, value) {
+    if (node.oneOf !== undefined) {
+        return node.oneOf.filter(branch => satisfiesJsonSchema(branch, value)).length === 1;
+    }
+    switch (node.type) {
+        case undefined:
+            return true;
+        case 'object':
+            return isRecord(value) && satisfiesObject(node, value);
+        case 'array': {
+            const items = node.items;
+            return Array.isArray(value) && (items === undefined || value.every(item => satisfiesJsonSchema(items, item)));
+        }
+        case 'string':
+            return typeof value === 'string' && allowsScalar(node, value);
+        case 'number':
+            return typeof value === 'number' && Number.isFinite(value) && allowsScalar(node, value);
+        case 'integer':
+            return typeof value === 'number' && Number.isInteger(value) && allowsScalar(node, value);
+        case 'boolean':
+            return typeof value === 'boolean' && allowsScalar(node, value);
+        case 'null':
+            return value === null && allowsScalar(node, value);
+        /* v8 ignore next 4 -- unreachable while `JsonSchemaType` stays closed; the arm exists so adding a type fails the build. */
+        default: {
+            const unhandled = node.type;
+            throw new TypeError(`dsh-dlp: unhandled JSON schema type ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+/**
+ * Whether replacing a value with its redacted copy would fail the tool's
+ * output validation.
+ *
+ * A schema this module already rejects for the original value is one it does
+ * not model correctly, so the answer is `false` and the registry decides — the
+ * check can withhold a result, and it must never do so on its own confusion.
+ * @param schema - the tool's declared output schema, when one could be resolved.
+ * @param original - the value the tool produced.
+ * @param redacted - the value the redaction pass produced.
+ * @returns `true` only when the original validates and the redacted one does not.
+ */
+export function redactionBreaksSchema(schema, original, redacted) {
+    if (schema === undefined)
+        return false;
+    if (!satisfiesJsonSchema(schema, original))
+        return false;
+    return !satisfiesJsonSchema(schema, redacted);
+}