dsh-dlp 0.1.0 → 0.3.0

package/lib/telemetry.js

@@ -27,6 +27,35 @@
  */
 import { scanSync } from "./detectors.js";
 import { placeholderFor, redactJson, redactText } from "./redaction.js";
+/**
+ * What to tell the operator when the redaction seam will never dispatch.
+ *
+ * A `session-telemetry/record` listener mounts successfully and never runs
+ * unless a backend built a coordinator, and the shipped default builds none:
+ * the mode is `DISABLED`, so nothing is exported and nothing is dispatched.
+ * That is the safe posture, not a leak — but an operator who mounts a redactor
+ * under it sees every signal of success and has verified nothing. The
+ * backend's own `sharing` disclosure is the resolved answer, so this never
+ * guesses at `DSH_TELEMETRY_MODE`, which is only the base patch's default
+ * expression for a `mode` a deployment can also set directly.
+ * @param sharing - the mounted backend's disclosure, or `undefined` when no backend is mounted.
+ * @returns the line to report, or `undefined` when the seam does dispatch.
+ */
+export function telemetrySeamNotice(sharing) {
+    const consequence = 'nothing dispatches the session-telemetry/record waterfall and this plugin\'s telemetry'
+        + ' redaction never runs. Nothing is exported in this state, so this is not a leak — it means the redaction'
+        + ' rules are unverified, and they begin running the moment telemetry is turned on. Informational only: the'
+        + ' plugin\'s other seams are unaffected.';
+    switch (sharing) {
+        case 'disabled':
+            return 'dsh-dlp: telemetryRedaction is enabled, but the mounted session-telemetry backend reports sharing'
+                + ` "disabled", so ${consequence}`;
+        case undefined:
+            return `dsh-dlp: telemetryRedaction is enabled, but no session-telemetry backend is mounted, so ${consequence}`;
+        default:
+            return undefined;
+    }
+}
 /** Attribute keys whose values are filesystem paths rather than payload text. */
 const PATH_ATTRIBUTES = ['session.cwd'];
 /** Rule identity recorded when a workspace path is replaced. */

package/lib/types/cli.d.ts

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+/**
+ * `dsh-dlp report` — read this plugin's audit JSONL and say what it decided.
+ *
+ * The sink is the only evidence a decision happened, and nothing read it: a
+ * user could not answer "what did this block today?". This command reads the
+ * file directly and imports nothing from the harness, so it runs wherever the
+ * package is installed, with no profile and no `dsh` on the path.
+ *
+ * The file is a durable boundary — written by an older version of this
+ * package, appended to under crash — so every line is parsed defensively and a
+ * line that is not a record is counted rather than trusted.
+ * @module dsh-dlp/cli
+ */
+/** One line of the audit file, after the fields this command reads are checked. */
+export interface ReportRecord {
+    /** Epoch milliseconds parsed from the record's ISO time. */
+    readonly time: number;
+    readonly kind: string;
+    readonly tool?: string;
+    readonly sessionId?: string;
+    /** Rule ids named by the record's spans, without repeats. */
+    readonly ruleIds: readonly string[];
+    /** Invisible-character runs by rule id. */
+    readonly unicode: Readonly<Record<string, number>>;
+}
+/**
+ * Parse one JSONL line into the fields this command reports on.
+ * @param line - one line of the audit file.
+ * @returns the record, or `undefined` when the line is not one.
+ */
+export declare function parseRecord(line: string): ReportRecord | undefined;
+/** What `report` was asked for. */
+export interface ReportOptions {
+    readonly log: string;
+    /** Epoch milliseconds; records before it are left out. */
+    readonly since?: number;
+    readonly session?: string;
+    /** Keep only the decisions that let the call through. */
+    readonly wouldHave: boolean;
+}
+/** The outcome of reading the command line. */
+export type Invocation = {
+    readonly kind: 'report';
+    readonly options: ReportOptions;
+} | {
+    readonly kind: 'help';
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+/** Text printed for `--help` and alongside a usage error. */
+export declare const USAGE: string;
+/**
+ * Read `--since`: an ISO timestamp, or a span back from now.
+ * @param value - the argument as written.
+ * @param now - epoch milliseconds a relative span counts back from.
+ * @returns epoch milliseconds, or `undefined` when the value is neither.
+ */
+export declare function parseSince(value: string, now: number): number | undefined;
+/**
+ * Read the command line.
+ * @param argv - arguments after the program name.
+ * @param env - environment used for the default sink path.
+ * @param now - epoch milliseconds a relative `--since` counts back from.
+ * @returns what to run, or the usage error to print.
+ */
+export declare function parseArguments(argv: readonly string[], env: NodeJS.ProcessEnv, now: number): Invocation;
+/** Outcome of reading the audit file. */
+export type AuditFileRead = 
+/** No file at that path: nothing has been recorded, or the sink is elsewhere. */
+{
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'unreadable';
+    readonly problem: string;
+} | {
+    readonly kind: 'read';
+    readonly records: readonly ReportRecord[];
+    /** Lines that were not records; a torn final append is the expected cause. */
+    readonly unreadable: number;
+};
+/**
+ * Read and parse the audit file.
+ * @param path - the file to read.
+ * @returns its records, its absence, or the problem to print.
+ */
+export declare function readAuditFile(path: string): AuditFileRead;
+/**
+ * Render the report.
+ * @param records - every record the file yielded.
+ * @param unreadable - how many of its lines were not records.
+ * @param options - the filters the invocation asked for.
+ * @returns the lines to print.
+ */
+export declare function formatReport(records: readonly ReportRecord[], unreadable: number, options: ReportOptions): string[];
+/**
+ * Run one invocation.
+ * @param argv - arguments after the program name.
+ * @param write - receives each line of output.
+ * @param fail - receives each line of error output.
+ * @param env - environment used for the default sink path.
+ * @param now - epoch milliseconds a relative `--since` counts back from.
+ * @returns the process exit code.
+ */
+export declare function main(argv: readonly string[], write: (line: string) => void, fail: (line: string) => void, env?: NodeJS.ProcessEnv, now?: number): number;
+//# sourceMappingURL=cli.d.ts.map

package/lib/types/detectors.d.ts

@@ -37,6 +37,13 @@ export interface Detection {
     readonly start: number;
     /** Exclusive end offset into the scanned string. */
     readonly end: number;
+    /**
+     * Set when the offsets cover exactly what must be replaced, so redaction
+     * must not widen them to the surrounding delimiters. Only the Unicode
+     * indicators set it: their matches are the characters themselves, while a
+     * secret's reported span is advisory and verified to under-cover (ADR §4).
+     */
+    readonly exact?: true;
 }
 /** Outcome of one scan. */
 export interface ScanResult {
@@ -59,11 +66,70 @@ export interface SyncRule {
  * tier 2, where a false positive costs a redaction rather than a denial.
  */
 export declare const SYNC_RULES: readonly SyncRule[];
+/**
+ * What the scan does with one class of invisible or direction-changing
+ * characters.
+ *
+ * `strip` classes have no legitimate use in tool output, so they are replaced
+ * like any other detection. `report` classes do: `U+200D` joins an emoji
+ * sequence and a variation selector chooses a glyph, so replacing them would
+ * corrupt ordinary text. They are counted and never rewritten.
+ */
+export type UnicodeAction = 'strip' | 'report';
+/** One class of invisible or direction-changing characters. */
+export interface UnicodeRule {
+    readonly id: string;
+    readonly version: number;
+    readonly severity: Severity;
+    readonly action: UnicodeAction;
+    /** Global, unicode-flagged, matching one run of this class. */
+    readonly pattern: RegExp;
+    /** The class's ranges as a character-class body, for the combined run pattern. */
+    readonly ranges: string;
+}
+/**
+ * Character classes that hide text from the reader while the model still reads
+ * it, verified against the Unicode character database.
+ *
+ * Every class is `medium`. These are injection *indicators*, not credentials:
+ * the guard floor denies at `high` and above, so an argument carrying one is
+ * never denied on that basis. What they buy is a redaction and an audit record
+ * on a path the harness does not cover — it strips directional controls in
+ * exactly one place, session titles, and never on the tool-result path.
+ *
+ * Not attempted here: UTS #39 confusables. A Cyrillic `а` needs a data table
+ * to detect and is a different cost class, and it defeats every rule in this
+ * file. README.md says so rather than implying coverage.
+ */
+export declare const UNICODE_RULES: readonly UnicodeRule[];
+/** One indicator match and what the caller should do with it. */
+export interface UnicodeFinding extends Detection {
+    readonly action: UnicodeAction;
+}
+/**
+ * Find every invisible or direction-changing character in one string.
+ *
+ * Offsets are UTF-16 indices into `text`, so a caller can splice them
+ * directly; they are exact rather than advisory, and {@link Detection.exact}
+ * says so.
+ * @param text - the string to scan.
+ * @returns every indicator run, ordered by start offset.
+ */
+export declare function scanUnicode(text: string): UnicodeFinding[];
+/**
+ * How many runs of each indicator class one string carries.
+ * @param text - the string to scan.
+ * @returns a count per rule id; absent means none were found.
+ */
+export declare function countUnicodeIndicators(text: string): Record<string, number>;
 /**
  * Scan text with tier 1. Pure, synchronous, no I/O, and never capped: a table
  * of anchored regular expressions costs a linear pass, so there is no reason
  * to stop scanning where tier 2 has to. `truncated` is therefore always
  * `false` here and only tier 2 can set it.
+ *
+ * The `strip` half of {@link UNICODE_RULES} is included, so every seam reading
+ * tier 1 — including the synchronous telemetry waterfall — gets it.
  * @param text - the string to scan.
  * @param rules - the rule table to apply; defaults to {@link SYNC_RULES}.
  * @returns every match, ordered by start offset.

package/lib/types/guard.d.ts

@@ -43,10 +43,12 @@ export interface GuardVerdict {
  * Credential paths are denied for every tool, not only readers: a shell that
  * can `cat` a key can also copy it. Only path-typed arguments are tested —
  * running the table over every string matches file content and denies writing
- * a `.gitignore` that mentions `.env`. Argument secrets are denied only for
- * egress-capable tools, because denying a local editor for holding the text it
- * was asked to write would break ordinary work without closing an exfiltration
- * path.
+ * a `.gitignore` that mentions `.env`. The one exception is a `writes-only`
+ * rule, which a tool classified read-only is exempt from; that is how
+ * `$DSH_HOME` stays readable while every write to it is denied. Argument
+ * secrets are denied only for egress-capable tools, because denying a local
+ * editor for holding the text it was asked to write would break ordinary work
+ * without closing an exfiltration path.
  * @param exec - the pending call as the guard stage sees it.
  * @param policy - the effective policy after the tighten-only merge.
  * @param hasher - mints the keyed hashes quoted in a denial reason.

package/lib/types/home.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Where the harness keeps its state, and where this plugin's audit sink lands
+ * by default.
+ *
+ * Its own module so the `dsh-dlp report` command can resolve the sink without
+ * importing the plugin: `policy.ts` pulls in `@secretlint/core`, `js-yaml` and
+ * the schema library, none of which a reader of a JSONL file needs.
+ * @module dsh-dlp/home
+ */
+/**
+ * File name the bundle patch gives the audit sink under the harness home.
+ * `cordis.patch.yml` spells the same name; a deployment that sets `auditLog`
+ * itself must tell `dsh-dlp report` where it put it.
+ */
+export declare const DEFAULT_AUDIT_LOG_NAME = "dsh-dlp.audit.jsonl";
+/**
+ * Resolve the harness home the same way the harness does: `$DSH_HOME` when it
+ * is set to something other than whitespace, otherwise `~/.dsh`. Read here
+ * rather than through `@deepseek-ai/dsh-home-paths` to keep the plugin's
+ * runtime imports to the ones a profile is guaranteed to resolve.
+ * @param env - environment consulted for `DSH_HOME`; defaults to `process.env`.
+ * @returns the absolute harness home.
+ */
+export declare function resolveDshHome(env?: NodeJS.ProcessEnv): string;
+/**
+ * Where the audit sink sits when the deployment did not name one.
+ * @param env - environment consulted for `DSH_HOME`; defaults to `process.env`.
+ * @returns the absolute path the bundle patch configures.
+ */
+export declare function defaultAuditLog(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=home.d.ts.map

package/lib/types/images.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Neutralising remote markdown images in assistant output, on the `llm/stream`
+ * waterfall.
+ *
+ * The web UI renders any absolute `http:`/`https:` markdown image a model
+ * emits as a real `<img src>`, and the harness sets no Content-Security-Policy,
+ * so the fetch happens in the user's browser where no host-side listener can
+ * see it. This module rewrites the destination out of the assistant's text
+ * before it becomes an `assistant/chunk` or `assistant/message` session event,
+ * so the log and the rendered answer stay in agreement.
+ *
+ * Two properties this module exists to hold:
+ *
+ * - **A destination split across chunks is still caught.** The mock and real
+ *   adapters both emit text in small deltas, so `![alt](https://host/x)` is
+ *   routinely spread over several of them and the browser renders the
+ *   accumulation. Text that could still be the start of an image is held back
+ *   until it either completes or exceeds {@link MAX_HELD_CHARACTERS}.
+ * - **Only the destination is replaced.** The alt text survives, so the
+ *   sentence the model wrote still reads, and the renderer's own
+ *   non-absolute-URL arm shows that alt text instead of fetching anything.
+ *
+ * This does not close the channel. It matches inline image syntax only:
+ * reference-style images, an alt text carrying a `]`, and any destination form
+ * the pattern does not model still reach the renderer. Raw HTML needs no
+ * handling — the renderer keeps it as literal text and no HTML enters the DOM
+ * (`packages/client/ui-primitives/src/markdown/render.tsx:261-263`). The
+ * upstream fix is one `img-src` directive.
+ * @module dsh-dlp/images
+ */
+import type { StreamChunk } from '@deepseek-ai/dsh-llm';
+/**
+ * Destination substituted for a remote image URL.
+ *
+ * It is deliberately not a URL: `new URL()` throws on it, which is the
+ * renderer's own "not an absolute destination" arm, and that arm renders the
+ * alt text as a `<span>` instead of emitting an `<img>`.
+ */
+export declare const BLOCKED_IMAGE_DESTINATION = "dsh-dlp-blocked-remote-image";
+/**
+ * Longest suffix held back waiting for an image to complete.
+ *
+ * Held text is text the user cannot see yet, so the wait is bounded: past this
+ * many characters the suffix is emitted as it stands and a destination that
+ * completes later is caught only by the assembled block. A protocol bound on
+ * this module's own buffering, not a deployment choice.
+ */
+export declare const MAX_HELD_CHARACTERS = 4096;
+/** One string after its remote image destinations were replaced. */
+export interface NeutralizedText {
+    readonly text: string;
+    /** Hostnames of the replaced destinations, in match order; never the full URL. */
+    readonly hosts: readonly string[];
+}
+/**
+ * Replace every absolute HTTP(S) inline image destination in one string.
+ * @param text - assistant text, whole or partial.
+ * @returns the rewritten text and the hosts whose destinations were replaced.
+ */
+export declare function neutralizeRemoteImages(text: string): NeutralizedText;
+/**
+ * Where the held suffix of a partially streamed string starts.
+ * @param text - everything accumulated for one block and not yet emitted.
+ * @returns the offset to emit up to; the string's length when nothing is held.
+ */
+export declare function heldSuffixStart(text: string): number;
+/**
+ * Wrap one model stream, replacing remote image destinations in its text.
+ *
+ * Text deltas are rewritten as they pass, with a possible image start held
+ * back until it resolves, and the assembled block on `block-end` — which is
+ * what the agent loop turns into the assistant message — is rewritten too. A
+ * held suffix is always flushed as a delta before the block closes and before
+ * the terminal finish, so no text is lost and the emitted chunks still satisfy
+ * the stream grammar.
+ * @param source - the stream from the rest of the waterfall.
+ * @param onNeutralized - notified once per host per text block.
+ * @returns the rewritten stream.
+ */
+export declare function neutralizeImageStream(source: AsyncIterable<StreamChunk>, onNeutralized: (host: string) => void): AsyncIterable<StreamChunk>;
+//# sourceMappingURL=images.d.ts.map

package/lib/types/index.d.ts

@@ -14,6 +14,15 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
+ * 5. `llm/stream` — neutralising remote markdown image destinations in
+ *    assistant output, before the text becomes a session event.
+ *
+ * Three of those registrations mitigate defects in the harness rather than in
+ * a deployment's own configuration: the missing Content-Security-Policy behind
+ * (5), the mutable execution object behind the guard's mutation check, and the
+ * silently inert telemetry seam behind the notice reported at mount. Each one
+ * is partial, none closes its channel, and README.md says so beside the
+ * feature.
  *
  * This plugin is not a containment boundary. It runs in-process at the agent's
  * own uid; anything the agent can execute can read the same files the guard

package/lib/types/mutation.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Detecting a tool call that was rewritten after it was logged.
+ *
+ * The registry deep-freezes `exec.arguments` but does not freeze the execution
+ * object until results are notified, so a `tools/pre-execute` listener can
+ * reassign `exec.arguments` or `exec.name` — and reassigning `exec.name`
+ * changes which tool body runs. The agent loop appended `tool/call` from the
+ * model's own response block before the waterfall ran, so nothing in the
+ * session log records the change: the durable record then describes a
+ * different call than the one about to execute.
+ *
+ * This module snapshots the call as early in the waterfall as it can and
+ * compares in the guard, which runs after the whole waterfall and cannot be
+ * out-ordered. It is detection, not prevention: preventing the rewrite would
+ * mean freezing an object this plugin does not own, and the snapshot itself is
+ * best-effort — a later `{ prepend: true }` registration runs ahead of ours and
+ * would be snapshotted after its own rewrite.
+ * @module dsh-dlp/mutation
+ */
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+import type { SpanHasher } from './redaction.ts';
+/** The parts of an execution this module compares. */
+type Comparable = Pick<ToolExecution, 'name' | 'arguments'>;
+/** One rewritten field. */
+export type MutatedField = 'name' | 'arguments';
+/** A call whose identity changed between the snapshot and the guard. */
+export interface ExecutionMutation {
+    /** Which fields differ, in a stable order. */
+    readonly fields: readonly MutatedField[];
+    /** The tool name the session log recorded. */
+    readonly originalTool: string;
+}
+/**
+ * Render a JSON value with object keys in a fixed order, so two equal argument
+ * sets hash equally whatever order a listener rebuilt them in.
+ * @param value - the argument value; JSON-serializable by the registry's own snapshot step.
+ * @returns a canonical string for hashing.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * Remembers what each pending call looked like before the rest of the
+ * `tools/pre-execute` waterfall ran.
+ *
+ * Keyed by the execution object's identity in a `WeakMap`, the way the
+ * registry keys its own per-execution state, so the entry is found again in
+ * the guard and released with the execution.
+ */
+export declare class ExecutionSnapshots {
+    #private;
+    /**
+     * @param hasher - mints the keyed digest of the arguments; the values themselves are never stored.
+     */
+    constructor(hasher: SpanHasher);
+    /**
+     * Snapshot one pending call.
+     * @param exec - the execution as the earliest listener sees it.
+     */
+    record(exec: Comparable): void;
+    /**
+     * Compare one call against its snapshot.
+     *
+     * A call with no snapshot is not a finding: the listener may never have run
+     * for it, and reporting absence as mutation would deny calls this plugin
+     * simply did not observe.
+     * @param exec - the execution as the guard stage sees it.
+     * @returns what changed, or `undefined` when nothing did.
+     */
+    detect(exec: Comparable): ExecutionMutation | undefined;
+}
+/**
+ * Denial text for a rewritten call.
+ *
+ * Both tool names are named: a tool name is already in the session log and in
+ * every other denial this plugin writes, and naming them is the whole point —
+ * the operator needs to know which call the log describes and which one was
+ * about to run. No argument value appears.
+ * @param exec - the call as the guard sees it, after the rewrite.
+ * @param mutation - the fields that changed and the recorded tool name.
+ * @returns the model-facing reason.
+ */
+export declare function mutationReason(exec: Comparable, mutation: ExecutionMutation): string;
+export {};
+//# sourceMappingURL=mutation.d.ts.map

package/lib/types/paths.d.ts

@@ -6,12 +6,25 @@
  * the repo-local policy tier may only add to them.
  * @module dsh-dlp/paths
  */
+/**
+ * Which calls a credential-path rule is enforced for.
+ *
+ * `every-call` is the default and the only setting a rule protecting
+ * credential *contents* may use. `writes-only` exempts the tools
+ * {@link READ_ONLY_TOOLS} classifies as unable to change anything: it exists
+ * for a directory whose contents are ordinary work to read and dangerous to
+ * modify, which is `$DSH_HOME` — it holds the installed plugin tree and every
+ * profile's `cordis.yml`.
+ */
+export type RuleEnforcement = 'every-call' | 'writes-only';
 /** One credential-path pattern. */
 export interface CredentialPathRule {
     readonly id: string;
     readonly version: number;
     /** Matched against a normalized, forward-slash path. */
     readonly pattern: RegExp;
+    /** Defaults to `every-call`; the repo-local tier cannot set it. */
+    readonly enforcement?: RuleEnforcement;
 }
 /**
  * Paths whose contents are credentials. Reading any of them through a tool is
@@ -120,4 +133,29 @@ export declare const LOCAL_TOOLS: ReadonlySet<string>;
  * @returns `true` when the tool is not a known local-only tool.
  */
 export declare function isEgressCapable(toolName: string, extraEgressTools?: ReadonlySet<string>): boolean;
+/**
+ * Tools that can only look: they query the filesystem, the language server,
+ * the session store or a running job, and have no operation that changes
+ * anything.
+ *
+ * A `writes-only` rule is lifted for these names and for no others. Every
+ * shell, `run_code`, every editor, every `mcp__*` tool and any tool this build
+ * has never heard of stays on the deny side, so a new tool is denied until it
+ * is classified — the same default as {@link LOCAL_TOOLS}, in the same
+ * direction.
+ */
+export declare const READ_ONLY_TOOLS: ReadonlySet<string>;
+/**
+ * Whether a tool is known to be incapable of changing anything.
+ * @param toolName - the executing tool's registered name.
+ * @returns `true` only for a name in {@link READ_ONLY_TOOLS}.
+ */
+export declare function isReadOnlyTool(toolName: string): boolean;
+/**
+ * The credential-path rules one tool is judged against.
+ * @param toolName - the executing tool's registered name.
+ * @param rules - the effective rule table.
+ * @returns every rule, minus the `writes-only` ones for a read-only tool.
+ */
+export declare function rulesForTool(toolName: string, rules: readonly CredentialPathRule[]): readonly CredentialPathRule[];
 //# sourceMappingURL=paths.d.ts.map

package/lib/types/policy.d.ts

@@ -33,12 +33,14 @@ export interface Config {
     resultRedaction: boolean;
     /** Whether `session-telemetry/record` redaction runs. */
     telemetryRedaction: boolean;
+    /** Whether remote markdown image destinations are neutralised in assistant output. */
+    remoteImageNeutralization: boolean;
     /** Whether telemetry's `session.cwd` attribute is replaced with a keyed hash. */
     redactTelemetryWorkspacePaths: boolean;
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "redactTelemetryWorkspacePaths"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -59,6 +61,7 @@ export interface ResolvedPolicy {
     readonly breadthTier: boolean;
     readonly resultRedaction: boolean;
     readonly telemetryRedaction: boolean;
+    readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
 }
 /** Thrown when a policy file is malformed or attempts to loosen the policy. */
@@ -108,15 +111,6 @@ export type RepoPolicyLoad =
  * @returns the validated policy, its absence, or the problem to report.
  */
 export declare function loadRepoPolicy(path: string): RepoPolicyLoad;
-/**
- * Resolve the harness home the same way the harness does: `$DSH_HOME` when it
- * is set to something other than whitespace, otherwise `~/.dsh`. Read here
- * rather than through `@deepseek-ai/dsh-home-paths` to keep the plugin's
- * runtime imports to the ones a profile is guaranteed to resolve.
- * @param env - environment consulted for `DSH_HOME`; defaults to `process.env`.
- * @returns the absolute harness home.
- */
-export declare function resolveDshHome(env?: NodeJS.ProcessEnv): string;
 /**
  * Merge the deployment config with an optional repo-local policy.
  * @param config - the deployment-controlled configuration.

package/lib/types/results.d.ts

@@ -10,7 +10,7 @@
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
  */
-import type { PostToolDecision, PreToolDecision, ToolExecution, ToolExecutionResult } from '@deepseek-ai/dsh-tools';
+import type { JsonSchemaNode, PostToolDecision, PreToolDecision, ToolExecution, ToolExecutionResult } from '@deepseek-ai/dsh-tools';
 import type { ResolvedPolicy } from './policy.ts';
 import { type RedactedSpan, type SpanHasher } from './redaction.ts';
 /** What a redaction pass produced, before an arm is chosen. */
@@ -18,6 +18,13 @@ export interface ResultRedaction {
     readonly decision: PostToolDecision;
     readonly spans: readonly RedactedSpan[];
     readonly truncatedScan: boolean;
+    /**
+     * Runs of each invisible-character class the result carried, by rule id.
+     * The `strip` classes also appear in `spans`; the `report` classes appear
+     * only here, because rewriting them would corrupt legitimate emoji and
+     * right-to-left text.
+     */
+    readonly indicators: Readonly<Record<string, number>>;
 }
 /**
  * Redact whatever the downstream decision settled on.
@@ -36,10 +43,11 @@ export interface ResultRedaction {
  *   carries a secret, or a value that still scans dirty after redaction.
  *   Blocking replaces the whole result, which is the only way to drop `meta`.
  *
- * Replacing the value can fail: the placeholder is re-validated against the
- * tool's `output.schema`, and a schema that constrains the string rejects it,
- * which the registry reports as a `ToolOutputError`. A failed call is the
- * intended outcome there — see README.md.
+ * Replacing the value is re-validated by the registry against the tool's
+ * `output.schema`, and a schema that pins the redacted string rejects it. That
+ * surfaces as a `ToolOutputError` naming a validation failure, which tells the
+ * model nothing it can act on, so the schema is checked here first and the
+ * result is withheld with this plugin's own explanation instead.
  *
  * A downstream `accept{content}` over a dirty value is overruled by the value
  * arm, which discards that listener's presentation choice. Keeping it would
@@ -49,9 +57,10 @@ export interface ResultRedaction {
  * @param result - the dispatch outcome the waterfall was called with.
  * @param policy - the effective policy.
  * @param hasher - mints each span's keyed hash.
+ * @param outputSchema - the executing tool's declared output schema, when one could be resolved.
  * @returns the decision to return, the spans replaced, and scan completeness.
  */
-export declare function redactDecision(decision: PostToolDecision, result: Readonly<ToolExecutionResult>, policy: ResolvedPolicy, hasher: SpanHasher): Promise<ResultRedaction>;
+export declare function redactDecision(decision: PostToolDecision, result: Readonly<ToolExecutionResult>, policy: ResolvedPolicy, hasher: SpanHasher, outputSchema?: JsonSchemaNode): Promise<ResultRedaction>;
 /**
  * Decide whether the breadth tier denies one call before dispatch.
  *

package/lib/types/schema.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Whether a redacted value still satisfies the tool's declared `output.schema`.
+ *
+ * Replacing a canonical value makes the registry re-validate it, so a schema
+ * that pins the redacted string turns a redaction into a `ToolOutputError` the
+ * model cannot act on. Asking the question first lets the listener withhold
+ * the result with its own explanation instead.
+ *
+ * This is a re-implementation of the harness's own check rather than a call
+ * into it: every harness type this package uses is imported with `import
+ * type`, so nothing from `@deepseek-ai/dsh-*` is emitted as a runtime import
+ * and the plugin resolves from a profile directory that has none of them
+ * installed. The enforced subset is small — `type`, `oneOf`, `properties`,
+ * `required`, `additionalProperties`, `items`, `enum`, `const` — and the
+ * caller guards against any disagreement by checking the *original* value
+ * first: a value this module rejects before redaction means the answer cannot
+ * be trusted, and the redaction proceeds as it did before.
+ * @module dsh-dlp/schema
+ */
+import type { JsonSchemaNode } from '@deepseek-ai/dsh-tools';
+/**
+ * Whether one value satisfies one schema node.
+ * @param node - a node of the tool's declared output schema.
+ * @param value - the candidate value.
+ * @returns `true` when the registry's own validation would accept it.
+ */
+export declare function satisfiesJsonSchema(node: JsonSchemaNode, value: unknown): boolean;
+/**
+ * Whether replacing a value with its redacted copy would fail the tool's
+ * output validation.
+ *
+ * A schema this module already rejects for the original value is one it does
+ * not model correctly, so the answer is `false` and the registry decides — the
+ * check can withhold a result, and it must never do so on its own confusion.
+ * @param schema - the tool's declared output schema, when one could be resolved.
+ * @param original - the value the tool produced.
+ * @param redacted - the value the redaction pass produced.
+ * @returns `true` only when the original validates and the redacted one does not.
+ */
+export declare function redactionBreaksSchema(schema: JsonSchemaNode | undefined, original: unknown, redacted: unknown): boolean;
+//# sourceMappingURL=schema.d.ts.map