dsh-dlp 0.2.0 → 0.4.0

package/lib/index.js

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Four registrations, in descending order of how much they can be trusted:
+ * Six registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -9,11 +9,24 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
+ * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
+ *    config paths. Deliberately here rather than on the floor: its rules have a
+ *    real false-positive rate and the floor cannot ask. Neutralizable, and it
+ *    abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
+ * 5. `llm/stream` — neutralising remote markdown image destinations in
+ *    assistant output, before the text becomes a session event.
+ *
+ * Three of those registrations mitigate defects in the harness rather than in
+ * a deployment's own configuration: the missing Content-Security-Policy behind
+ * (5), the mutable execution object behind the guard's mutation check, and the
+ * silently inert telemetry seam behind the notice reported at mount. Each one
+ * is partial, none closes its channel, and README.md says so beside the
+ * feature.
  *
  * This plugin is not a containment boundary. It runs in-process at the agent's
  * own uid; anything the agent can execute can read the same files the guard
@@ -25,8 +38,11 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { loadRepoPolicy, resolvePolicy } from "./policy.js";
 import { SpanHasher } from "./redaction.js";
 import { safeEvaluateGuard } from "./guard.js";
+import { neutralizeImageStream } from "./images.js";
+import { ExecutionSnapshots, mutationReason } from "./mutation.js";
+import { evaluateConfigWrite } from "./config-writes.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
-import { redactRecord } from "./telemetry.js";
+import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
 export { Config } from "./policy.js";
 /** Display metadata; labels the plugin in Cordis diagnostics. */
@@ -84,6 +100,16 @@ function report(ctx, message) {
     ctx.logger.error(message);
     process.stderr.write(`${message}\n`);
 }
+/**
+ * Report something the operator should know that is not a fault, on the same
+ * two channels and for the same reason as {@link report}.
+ * @param ctx - the plugin's context, used for its logger.
+ * @param message - the whole line to report.
+ */
+function notice(ctx, message) {
+    ctx.logger.warn(message);
+    process.stderr.write(`${message}\n`);
+}
 /**
  * Load the repo-local policy tier, if the deployment named one.
  *
@@ -138,7 +164,30 @@ export function apply(ctx, config) {
             ...position === undefined ? {} : { turn: position.turn, step: position.step },
         };
     };
+    const snapshots = new ExecutionSnapshots(hasher);
+    /**
+     * Report the telemetry seam's state once.
+     *
+     * At mount only a backend that is already there answers the question: the
+     * backend can load after this plugin, and calling that absence "inert" would
+     * be a false alarm. `conclusive` marks the later call, made once the harness
+     * is running sessions, where an absent backend really means no dispatcher.
+     */
+    let telemetrySeamReported = false;
+    const discloseTelemetrySeam = (conclusive) => {
+        if (telemetrySeamReported)
+            return;
+        const backend = ctx.get('sessionTelemetry');
+        if (backend === undefined && !conclusive)
+            return;
+        telemetrySeamReported = true;
+        const line = telemetrySeamNotice(backend?.sharing);
+        if (line !== undefined)
+            notice(ctx, line);
+    };
     ctx.on('session/event', (_session, event) => {
+        if (policy.telemetryRedaction)
+            discloseTelemetrySeam(true);
         if (event.type === 'tool/call') {
             correlator.note(event.data.callId, { turn: event.data.turn, step: event.data.step });
             return;
@@ -147,9 +196,32 @@ export function apply(ctx, config) {
             correlator.forget(event.data.message.source.callId);
         }
     });
+    // Snapshot each call before the rest of the waterfall can rewrite it. The
+    // prepend is best-effort by construction: a listener registered later with
+    // the same option runs ahead of this one.
+    ctx.on('tools/pre-execute', (exec, next) => {
+        snapshots.record(exec);
+        return next();
+    }, { prepend: true });
     // The floor. Registered on a plain context so it applies globally: to every
     // agent, every `run_code` inner sub-call, and every subagent child.
     ctx.effect(() => ctx.tools.guard((exec) => {
+        // Integrity first: a call whose name or arguments changed after `tool/call`
+        // was appended is denied whatever the policy tables say about it, because
+        // the log no longer describes what would run.
+        const mutation = snapshots.detect(exec);
+        if (mutation !== undefined) {
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'execution-mutation',
+                decisionId: newDecisionId(),
+                ...identity(exec),
+                mutatedFields: mutation.fields,
+                ...mutation.fields.includes('name') ? { originalTool: mutation.originalTool } : {},
+            });
+            return mutationReason(exec, mutation);
+        }
         const verdict = safeEvaluateGuard(exec, policy, hasher);
         if (verdict === undefined)
             return undefined;
@@ -163,6 +235,59 @@ export function apply(ctx, config) {
         });
         return verdict.reason;
     }), 'dsh-dlp guard floor');
+    /**
+     * Report once that the `ask` tier has nowhere to ask.
+     *
+     * The registry resolves an `ask` through `ctx.get('approval')` and keeps the
+     * historical degrade to *deny* when no service is composed. This tier exists
+     * because its rules are too false-positive-prone for a deny, so under a
+     * deployment with no approval channel it abstains instead of becoming the
+     * silent hard deny it was designed not to be. Evaluated at decision time
+     * rather than at mount, because by then the harness is running and an absent
+     * service is conclusive rather than a load order.
+     */
+    let approvalSeamReported = false;
+    const discloseApprovalSeam = () => {
+        if (approvalSeamReported)
+            return;
+        approvalSeamReported = true;
+        notice(ctx, 'dsh-dlp: configWriteAsk is enabled, but no approval service is mounted, so an ask would degrade'
+            + ' to a denial. This tier abstains instead: a write to a behaviour-changing config path is allowed through'
+            + ' with no prompt. The guard floor is unaffected.');
+    };
+    if (policy.configWriteAsk) {
+        // Registered ahead of the breadth tier, so a call that is both a config
+        // write and carries a secret is denied rather than merely asked about:
+        // this listener sees whatever the rest of the waterfall settled on and
+        // only ever narrows `allow` into `ask`.
+        ctx.on('tools/pre-execute', async (exec, next) => {
+            const decision = await next();
+            if (decision.kind !== 'allow')
+                return decision;
+            const finding = evaluateConfigWrite(exec);
+            if (finding === undefined)
+                return decision;
+            // A call the floor will deny anyway is left to the floor. Any non-allow
+            // decision from this waterfall skips guards entirely, so asking here
+            // would replace an unconditional denial with a prompt a user can grant,
+            // and would file the decision as an ask rather than as a guard denial.
+            if (safeEvaluateGuard(exec, policy, hasher) !== undefined)
+                return decision;
+            if (ctx.get('approval') === undefined) {
+                discloseApprovalSeam();
+                return decision;
+            }
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'pre-execute-ask',
+                decisionId: newDecisionId(),
+                ...identity(exec),
+                ruleId: finding.rule.id,
+            });
+            return { kind: 'ask', reason: finding.reason };
+        });
+    }
     if (policy.breadthTier) {
         ctx.on('tools/pre-execute', async (exec, next) => {
             const decision = await next();
@@ -212,7 +337,20 @@ export function apply(ctx, config) {
             return redacted.decision;
         });
     }
+    if (policy.remoteImageNeutralization) {
+        ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'assistant-image-neutralized',
+                decisionId: newDecisionId(),
+                ...options.sessionId === undefined ? {} : { sessionId: String(options.sessionId) },
+                host,
+            });
+        }));
+    }
     if (policy.telemetryRedaction) {
+        discloseTelemetrySeam(false);
         ctx.on('session-telemetry/record', (_record, next) => {
             // Throwing here withholds this one record; the coordinator contains it
             // and the agent loop never sees the failure. That is the fail-closed

package/lib/mutation.js

@@ -0,0 +1,102 @@
+/**
+ * Detecting a tool call that was rewritten after it was logged.
+ *
+ * The registry deep-freezes `exec.arguments` but does not freeze the execution
+ * object until results are notified, so a `tools/pre-execute` listener can
+ * reassign `exec.arguments` or `exec.name` — and reassigning `exec.name`
+ * changes which tool body runs. The agent loop appended `tool/call` from the
+ * model's own response block before the waterfall ran, so nothing in the
+ * session log records the change: the durable record then describes a
+ * different call than the one about to execute.
+ *
+ * This module snapshots the call as early in the waterfall as it can and
+ * compares in the guard, which runs after the whole waterfall and cannot be
+ * out-ordered. It is detection, not prevention: preventing the rewrite would
+ * mean freezing an object this plugin does not own, and the snapshot itself is
+ * best-effort — a later `{ prepend: true }` registration runs ahead of ours and
+ * would be snapshotted after its own rewrite.
+ * @module dsh-dlp/mutation
+ */
+/**
+ * Render a JSON value with object keys in a fixed order, so two equal argument
+ * sets hash equally whatever order a listener rebuilt them in.
+ * @param value - the argument value; JSON-serializable by the registry's own snapshot step.
+ * @returns a canonical string for hashing.
+ */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (typeof value === 'object' && value !== null) {
+        return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+    }
+    // `undefined` has no JSON rendering; it reaches here only for an execution
+    // whose arguments never materialized, which the registry fails before the
+    // waterfall. A fixed token keeps the digest total either way.
+    return JSON.stringify(value) ?? 'undefined';
+}
+/**
+ * Remembers what each pending call looked like before the rest of the
+ * `tools/pre-execute` waterfall ran.
+ *
+ * Keyed by the execution object's identity in a `WeakMap`, the way the
+ * registry keys its own per-execution state, so the entry is found again in
+ * the guard and released with the execution.
+ */
+export class ExecutionSnapshots {
+    #snapshots = new WeakMap();
+    #hasher;
+    /**
+     * @param hasher - mints the keyed digest of the arguments; the values themselves are never stored.
+     */
+    constructor(hasher) {
+        this.#hasher = hasher;
+    }
+    /**
+     * Snapshot one pending call.
+     * @param exec - the execution as the earliest listener sees it.
+     */
+    record(exec) {
+        this.#snapshots.set(exec, { name: exec.name, digest: this.#hasher.hash(canonicalJson(exec.arguments)) });
+    }
+    /**
+     * Compare one call against its snapshot.
+     *
+     * A call with no snapshot is not a finding: the listener may never have run
+     * for it, and reporting absence as mutation would deny calls this plugin
+     * simply did not observe.
+     * @param exec - the execution as the guard stage sees it.
+     * @returns what changed, or `undefined` when nothing did.
+     */
+    detect(exec) {
+        const snapshot = this.#snapshots.get(exec);
+        if (snapshot === undefined)
+            return undefined;
+        const fields = [];
+        if (exec.name !== snapshot.name)
+            fields.push('name');
+        if (this.#hasher.hash(canonicalJson(exec.arguments)) !== snapshot.digest)
+            fields.push('arguments');
+        return fields.length === 0 ? undefined : { fields, originalTool: snapshot.name };
+    }
+}
+/**
+ * Denial text for a rewritten call.
+ *
+ * Both tool names are named: a tool name is already in the session log and in
+ * every other denial this plugin writes, and naming them is the whole point —
+ * the operator needs to know which call the log describes and which one was
+ * about to run. No argument value appears.
+ * @param exec - the call as the guard sees it, after the rewrite.
+ * @param mutation - the fields that changed and the recorded tool name.
+ * @returns the model-facing reason.
+ */
+export function mutationReason(exec, mutation) {
+    const changed = mutation.fields.join(' and ');
+    const renamed = mutation.fields.includes('name')
+        ? ` The session log records a call to ${JSON.stringify(mutation.originalTool)}.`
+        : '';
+    return `dsh-dlp denied ${JSON.stringify(exec.name)}: another mounted plugin rewrote this call's ${changed} `
+        + `after the session log recorded it, so the log and the presented call describe something other than what `
+        + `would have run.${renamed} The call is denied because a tool call that cannot be reconstructed from the log `
+        + 'is not auditable. This is a defect in a mounted plugin, not in the call; report it to the deployment operator.';
+}

package/lib/paths.js

@@ -48,9 +48,61 @@ export const CREDENTIAL_PATH_RULES = [
     { id: 'dsh-dlp/path-pgpass', version: 1, pattern: /(^|\/)\.pgpass$/i },
     { id: 'dsh-dlp/path-mysql-config', version: 1, pattern: /(^|\/)\.my\.cnf$/i },
     { id: 'dsh-dlp/path-service-account', version: 1, pattern: /(^|\/)[^/]*service[._-]?account[^/]*\.json$/i },
+    // Coding-agent credential stores. IronWorm's 44 packages and SANDWORM_MODE
+    // name these verbatim; an `auth.json` under an agent's own directory is a
+    // token file whatever else the directory holds.
+    { id: 'dsh-dlp/path-agent-auth', version: 1, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/auth\.json$/i },
+    // An MCP manifest carries each server's `env`, which is where its API keys
+    // are written.
+    { id: 'dsh-dlp/path-agent-mcp-config', version: 1, pattern: /(^|\/)\.(cursor|windsurf|continue|codex|claude|gemini)\/mcp\.json$/i },
+    // Cursor keeps session tokens in a SQLite state database rather than a
+    // credential file.
+    { id: 'dsh-dlp/path-editor-state-db', version: 1, pattern: /(^|\/)state\.vscdb(-journal|-wal|-shm)?$/i },
+    { id: 'dsh-dlp/path-macos-keychain', version: 1, pattern: /(^|\/)Library\/Keychains(\/|$)/i },
+    // A Terraform variables file is where provider credentials are written by
+    // convention, and state holds every provider's secrets in plaintext.
+    { id: 'dsh-dlp/path-terraform-vars', version: 1, pattern: /\.tfvars(\.json)?$/i },
+    { id: 'dsh-dlp/path-terraform-state', version: 1, pattern: /(^|\/)terraform\.tfstate(\.backup)?$/i },
     { id: 'dsh-dlp/path-keystore', version: 2, pattern: /\.(pem|p12|pfx|jks|keystore|key|asc|gpg)$/i },
     { id: 'dsh-dlp/path-credential-name', version: 1, pattern: new RegExp(String.raw `(^|\/)(?!.*\.(?:${CODE_EXTENSIONS})$)[^/]*(credentials?|secrets?|tokens?)([._-][^/]*)?$`, 'i') },
 ];
+/**
+ * Escape one literal path so it can anchor a regular expression.
+ * @param literal - the path to quote.
+ * @returns the same text with every metacharacter escaped.
+ */
+export function escapePathPattern(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+}
+/**
+ * Credential-path rules anchored at the user's home directory, resolved at
+ * mount because the directory is not known until then.
+ *
+ * A coding agent's *home* configuration decides how every future session in
+ * every repository behaves: the Miasma worm's `SessionStart` hooks went into
+ * exactly these files. Writing one is never ordinary repository work, so it is
+ * on the floor. Reading one is — a user asking the agent why its own
+ * configuration behaves a certain way is a normal request — so the rule is
+ * `writes-only` rather than `every-call`, unlike the `auth.json` and `mcp.json`
+ * stores in {@link CREDENTIAL_PATH_RULES}, which hold nothing but credentials.
+ *
+ * The *repository-local* copies of these same file names are a different
+ * question with a different answer: they are edited legitimately and often, so
+ * they sit in the neutralizable `ask` tier rather than on the floor.
+ * @param home - the user's home directory.
+ * @returns rules appended after the built-in table.
+ */
+export function homeCredentialPathRules(home) {
+    // `~` survives normalization as a root-anchored marker, so a home-relative
+    // spelling reaches the same rule as the absolute one.
+    const anchor = `(?:${escapePathPattern(home)}|/~)`;
+    return [{
+            id: 'dsh-dlp/path-agent-home-settings',
+            version: 1,
+            enforcement: 'writes-only',
+            pattern: new RegExp(`^${anchor}/\\.(claude|gemini|codex|cursor|windsurf|continue)/settings[^/]*\\.json$`, 'i'),
+        }];
+}
 /**
  * Normalize one candidate path for matching: Windows separators become
  * forward slashes, surrounding quotes come off, `~` expands to a

package/lib/policy.js

@@ -15,12 +15,13 @@
  * @module dsh-dlp/policy
  */
 import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { resolve } from 'node:path';
 import { JSON_SCHEMA, load } from 'js-yaml';
 import z from '@deepseek-ai/schemastery';
-import { SYNC_RULES, severityRank } from "./detectors.js";
+import { SYNC_RULES, severityRank, stripControlSequences } from "./detectors.js";
 import { resolveDshHome } from "./home.js";
-import { CREDENTIAL_PATH_RULES } from "./paths.js";
+import { CREDENTIAL_PATH_RULES, escapePathPattern, homeCredentialPathRules } from "./paths.js";
 export const Config = z.object({
     auditLog: z.string().required(),
     redactionKeyFile: z.string().required(),
@@ -29,10 +30,19 @@ export const Config = z.object({
     breadthTier: z.boolean().default(true),
     resultRedaction: z.boolean().default(true),
     telemetryRedaction: z.boolean().default(true),
+    remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
+    configWriteAsk: z.boolean().default(true),
 });
 /** Config toggles a repo-local policy may switch on, and never off. */
-const ENABLEABLE = ['breadthTier', 'resultRedaction', 'telemetryRedaction', 'redactTelemetryWorkspacePaths'];
+const ENABLEABLE = [
+    'breadthTier',
+    'resultRedaction',
+    'telemetryRedaction',
+    'remoteImageNeutralization',
+    'redactTelemetryWorkspacePaths',
+    'configWriteAsk',
+];
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -112,6 +122,12 @@ function parseCredentialPathEntry(node, index) {
     if (typeof id !== 'string' || id.length === 0) {
         throw new PolicyError(`addCredentialPaths[${index}].id must be a non-empty string`);
     }
+    // A rule id is quoted verbatim in a model-facing denial and in every audit
+    // record the rule produces, and this file is attacker-controlled.
+    if (stripControlSequences(id) !== id) {
+        throw new PolicyError(`addCredentialPaths[${index}].id carries a terminal control sequence; a rule id is quoted in a denial`
+            + ' the user reads and in the audit record, so it may not rewrite what is on screen');
+    }
     if (typeof pattern !== 'string' || pattern.length === 0) {
         throw new PolicyError(`addCredentialPaths[${index}].pattern must be a non-empty string`);
     }
@@ -211,10 +227,6 @@ export function loadRepoPolicy(path) {
         return { kind: 'invalid', problem: String(error) };
     }
 }
-/** Escape one literal path so it can anchor a regular expression. */
-function escapePattern(literal) {
-    return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
-}
 /**
  * Deny rules protecting this plugin's own state and the harness home.
  *
@@ -237,10 +249,10 @@ function escapePattern(literal) {
  * @returns rules appended after the built-in table.
  */
 function selfProtectionRules(config, dshHome) {
-    const home = escapePattern(resolve(dshHome));
+    const home = escapePathPattern(resolve(dshHome));
     return [
-        { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.redactionKeyFile))}$`, 'i') },
-        { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.auditLog))}$`, 'i') },
+        { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePathPattern(resolve(config.redactionKeyFile))}$`, 'i') },
+        { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePathPattern(resolve(config.auditLog))}$`, 'i') },
         { id: 'dsh-dlp/path-dsh-sessions', version: 1, pattern: new RegExp(`^${home}/sessions(/|$)`, 'i') },
         { id: 'dsh-dlp/path-dsh-home', version: 2, enforcement: 'writes-only', pattern: new RegExp(`^${home}(/|$)`, 'i') },
     ];
@@ -256,6 +268,7 @@ export function resolvePolicy(config, repo) {
     return {
         credentialPathRules: [
             ...CREDENTIAL_PATH_RULES,
+            ...homeCredentialPathRules(resolve(homedir())),
             ...selfProtectionRules(config, resolveDshHome()),
             ...repo?.addCredentialPaths ?? [],
         ],
@@ -268,6 +281,8 @@ export function resolvePolicy(config, repo) {
         breadthTier: enabled('breadthTier'),
         resultRedaction: enabled('resultRedaction'),
         telemetryRedaction: enabled('telemetryRedaction'),
+        remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
+        configWriteAsk: enabled('configWriteAsk'),
     };
 }

package/lib/sink.js

@@ -16,6 +16,7 @@
  */
 import { appendFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
+import { stripControlSequences } from "./detectors.js";
 /**
  * Mint a decision id.
  * @returns an id unique to one guard verdict or redaction pass.
@@ -25,6 +26,29 @@ export function newDecisionId() {
 }
 /** Payload version carried inside every record this plugin writes. */
 export const RECORD_VERSION = 1;
+/**
+ * One record with every string cleaned of terminal control sequences.
+ *
+ * A record carries strings this plugin did not author — a tool's registered
+ * name, a call id, a rule id from the repo-local policy tier — and a reader
+ * gets them back unescaped: `JSON.stringify` writes `\u001b` to the file, but
+ * `dsh-dlp report`, `jq -r` and any log viewer parse that back into a live
+ * escape. A tool named with a CSI sequence could then overwrite the line
+ * describing it, which is the forged-audit-record half of CVE-2026-35651.
+ * Cleaning here means every consumer of the file gets the cleaned form.
+ * @param value - any part of a record.
+ * @returns the same structure with control sequences replaced.
+ */
+function cleaned(value) {
+    if (typeof value === 'string')
+        return stripControlSequences(value);
+    if (Array.isArray(value))
+        return value.map(cleaned);
+    if (typeof value === 'object' && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [stripControlSequences(key), cleaned(item)]));
+    }
+    return value;
+}
 /** Append-only JSONL sink for this plugin's decisions. */
 export class AuditSink {
     #path;
@@ -49,7 +73,7 @@ export class AuditSink {
      */
     write(record) {
         try {
-            appendFileSync(this.#path, `${JSON.stringify(record)}\n`);
+            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`);
         }
         catch (error) {
             this.#onFailure(error);

package/lib/telemetry.js

@@ -27,6 +27,35 @@
  */
 import { scanSync } from "./detectors.js";
 import { placeholderFor, redactJson, redactText } from "./redaction.js";
+/**
+ * What to tell the operator when the redaction seam will never dispatch.
+ *
+ * A `session-telemetry/record` listener mounts successfully and never runs
+ * unless a backend built a coordinator, and the shipped default builds none:
+ * the mode is `DISABLED`, so nothing is exported and nothing is dispatched.
+ * That is the safe posture, not a leak — but an operator who mounts a redactor
+ * under it sees every signal of success and has verified nothing. The
+ * backend's own `sharing` disclosure is the resolved answer, so this never
+ * guesses at `DSH_TELEMETRY_MODE`, which is only the base patch's default
+ * expression for a `mode` a deployment can also set directly.
+ * @param sharing - the mounted backend's disclosure, or `undefined` when no backend is mounted.
+ * @returns the line to report, or `undefined` when the seam does dispatch.
+ */
+export function telemetrySeamNotice(sharing) {
+    const consequence = 'nothing dispatches the session-telemetry/record waterfall and this plugin\'s telemetry'
+        + ' redaction never runs. Nothing is exported in this state, so this is not a leak — it means the redaction'
+        + ' rules are unverified, and they begin running the moment telemetry is turned on. Informational only: the'
+        + ' plugin\'s other seams are unaffected.';
+    switch (sharing) {
+        case 'disabled':
+            return 'dsh-dlp: telemetryRedaction is enabled, but the mounted session-telemetry backend reports sharing'
+                + ` "disabled", so ${consequence}`;
+        case undefined:
+            return `dsh-dlp: telemetryRedaction is enabled, but no session-telemetry backend is mounted, so ${consequence}`;
+        default:
+            return undefined;
+    }
+}
 /** Attribute keys whose values are filesystem paths rather than payload text. */
 const PATH_ATTRIBUTES = ['session.cwd'];
 /** Rule identity recorded when a workspace path is replaced. */

package/lib/types/config-writes.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The `ask` tier: files whose contents decide how the agent, the editor or CI
+ * behaves next time, and the one config *key* whose value redirects a
+ * credential.
+ *
+ * This tier is deliberately **not** on the guard floor, and that is the whole
+ * design. `ctx.tools.guard()` has no `ask` arm and cannot be overridden, so a
+ * rule that lands there must be one a developer never legitimately trips. A
+ * developer asks the agent to edit `CLAUDE.md`, add a `.github/workflows`
+ * job or extend `.vscode/settings.json` constantly. Putting those on an
+ * unoverridable floor produces a plugin that gets uninstalled, which removes
+ * the floor as well.
+ *
+ * The cost is stated rather than hidden: `tools/pre-execute` is neutralizable.
+ * A listener registered ahead of this one can return without calling `next()`
+ * and this tier never runs. Only the guard floor is order-independent.
+ * @module dsh-dlp/config-writes
+ */
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+/** What a behaviour-config rule is matched against. */
+export type ConfigMatch = 
+/** A path-typed argument: the file the call would create or change. */
+'path'
+/** A content-typed argument: the bytes the call would write. */
+ | 'content';
+/** One file, or one written value, that changes what happens next time. */
+export interface ConfigWriteRule {
+    readonly id: string;
+    readonly version: number;
+    readonly match: ConfigMatch;
+    readonly pattern: RegExp;
+    /** What the file or value does, quoted in the prompt the user answers. */
+    readonly effect: string;
+}
+/**
+ * Paths whose contents change future behaviour, and the config key whose value
+ * redirects credentials.
+ *
+ * Every path here was used in the wild. The Miasma worm wrote `SessionStart`
+ * hooks into `.claude/settings.json` and `.gemini/settings.json`, an
+ * always-apply `.cursor/rules/setup.mdc`, a `folderOpen` task into
+ * `.vscode/tasks.json`, and a hijacked `npm test` into `Azure/durabletask`;
+ * GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples
+ * over it, 39 of them inside 38 seconds. See also CVE-2025-53773,
+ * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
+ * CVE-2025-59041.
+ *
+ * The rules match by name, never by what is on disk, so a file the call is
+ * about to *create* is matched exactly like one it would change:
+ * CVE-2026-25725 worked precisely because the path did not exist yet and was
+ * therefore writable without any prompt.
+ */
+export declare const CONFIG_WRITE_RULES: readonly ConfigWriteRule[];
+/**
+ * Argument keys whose values are the bytes a call would write.
+ *
+ * Deliberately separate from the floor's path-typed keys: the floor must never
+ * run its path table over file content, and this tier must run its one content
+ * rule over nothing else.
+ */
+export declare const CONTENT_ARGUMENT_KEYS: ReadonlySet<string>;
+/**
+ * The strings one call would write.
+ * @param args - the pending call's parsed arguments.
+ * @returns every string under a content-typed key, at any depth.
+ */
+export declare function contentArguments(args: unknown): string[];
+/** A call this tier wants a human to confirm. */
+export interface ConfigWriteFinding {
+    readonly rule: ConfigWriteRule;
+    /** Model- and user-facing text; names the rule and what the file does, never the path. */
+    readonly reason: string;
+}
+/**
+ * Decide whether one call should be confirmed by a human.
+ *
+ * Only calls that can change something are examined: a tool
+ * {@link isReadOnlyTool} classifies as query-only cannot write a hook. Shell
+ * command lines are deliberately **not** tokenised here, unlike in the floor:
+ * a command line cannot be told apart from a read of the same path, and
+ * prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+ * that gets a tier switched off. A shell redirection into one of these files
+ * is therefore not covered, which README.md says beside the feature.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link CONFIG_WRITE_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export declare function evaluateConfigWrite(exec: Pick<ToolExecution, 'name' | 'arguments'>, rules?: readonly ConfigWriteRule[]): ConfigWriteFinding | undefined;
+//# sourceMappingURL=config-writes.d.ts.map