dsh-dlp 0.3.0 → 0.4.0

package/README.md

@@ -3,7 +3,7 @@
 Data-loss prevention for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness),
 built as an out-of-repo plugin.
 
-It does six things:
+It does seven things:
 
 1. **Denies credential-file access and secrets bound for the network** — unconditionally, from
    `ctx.tools.guard()`. It tests the path-typed arguments of a call against a table of
@@ -19,7 +19,12 @@ It does six things:
    plugin rewrote after the session log recorded it. Both are partial mitigations for defects
    in the harness rather than in your configuration —
    [see below](#mitigations-for-defects-in-the-harness-itself), including what they do not close.
-6. **Writes an audit record for every decision** to its own sink — rule id, rule version,
+6. **Asks before the agent writes a file that changes future behaviour** — agent settings and
+   hooks, `CLAUDE.md`, `.cursor/rules/**`, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI
+   workflows, shell startup files — and before it writes a `*_BASE_URL` that would redirect a
+   provider credential. This tier prompts rather than denying, and is neutralizable;
+   [see below](#behaviour-changing-config-paths).
+7. **Writes an audit record for every decision** to its own sink — rule id, rule version,
    offsets, and a keyed hash. Never the secret, and never the path or command that matched.
    `dsh-dlp report` reads that sink back.
 
@@ -248,7 +253,7 @@ checkout, build first and add the tarball:
 ```sh
 git clone https://github.com/CharlotteN7/dsh-dlp && cd dsh-dlp
 pnpm install && pnpm run build && pnpm pack
-dsh plugin --profile <name> add ./dsh-dlp-0.1.0.tgz
+dsh plugin --profile <name> add ./dsh-dlp-0.3.0.tgz
 ```
 
 ## Configure
@@ -266,6 +271,7 @@ dsh plugin --profile <name> add ./dsh-dlp-0.1.0.tgz
     telemetryRedaction: true
     remoteImageNeutralization: true
     redactTelemetryWorkspacePaths: true
+    configWriteAsk: true
 ```
 
 `redactionKeyFile` is created on first mount with 32 random bytes at mode `0600`. Keep it out
@@ -295,7 +301,7 @@ addCredentialPaths:
 addEgressTools: [acme_publish]
 raiseSeverity:
   dsh-dlp/secret-assignment: high
-enable: [telemetryRedaction]
+enable: [telemetryRedaction, configWriteAsk]
 ```
 
 Any other key, and any downgrade, makes the **whole file invalid**: it is reported on
@@ -328,6 +334,22 @@ directories (but not `.env.example`), anything under `.ssh/`,
 documentation extensions are excluded from that last rule, so `src/auth/token.ts` stays
 readable.
 
+**Coding-agent and infrastructure credential stores**, which IronWorm's 44 packages and
+SANDWORM_MODE name verbatim: an `auth.json` under `.codex/`, `Cursor/`, `.composer/`,
+`.windsurf/`, `.continue/`, `.aider/`, `.claude/` or `.gemini/`; an `mcp.json` under any of the
+same directories, because an MCP manifest carries each server's `env` and that is where its API
+keys are written; Cursor's `state.vscdb` session database; anything under `Library/Keychains/`;
+`*.tfvars` and `terraform.tfstate`, which hold provider credentials in plaintext.
+
+**A home-level agent settings file is denied for writing only.** `~/.claude/settings.json`,
+`~/.gemini/settings.json` and the equivalents for Codex, Cursor, Windsurf and Continue decide
+how every future session in every repository behaves — this is where the Miasma worm put its
+`SessionStart` hooks — so writing one is on the floor. Reading one is ordinary work, since a
+user asking why their agent behaves a certain way is a normal request, so the rule is lifted for
+a tool that provably cannot change anything. The **repository-local** copies of those same file
+names are a different question with a different answer: see
+[behaviour-changing config paths](#behaviour-changing-config-paths) below.
+
 Also denied for every tool: this plugin's own `redactionKeyFile` and `auditLog`.
 
 **`$DSH_HOME` is split by direction.** Every *write* under the harness home is denied, for
@@ -382,6 +404,69 @@ need, or use a path that is not a credential store.
 
 ---
 
+## Behaviour-changing config paths
+
+Everything above governs **reads**. The dominant technique of 2026 is the opposite: the agent
+*writes* a file that changes what happens next time. The Miasma worm put `SessionStart` hooks in
+`.claude/settings.json` and `.gemini/settings.json`, an always-apply `.cursor/rules/setup.mdc`,
+a `folderOpen` task in `.vscode/tasks.json` and a hijacked `npm test` into `Azure/durabletask`;
+GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples over it, 39 of them
+inside 38 seconds. See also CVE-2025-53773, CVE-2026-25725, CVE-2026-33068, CVE-2026-48124,
+CVE-2026-26268 and CVE-2025-59041.
+
+A write to one of these **asks the user first**:
+
+| Rule | Paths |
+|---|---|
+| `config-agent-settings` | `.claude/settings*.json`, and the same under `.gemini/`, `.codex/`, `.cursor/`, `.windsurf/`, `.continue/` |
+| `config-agent-hooks` | `.claude/hooks/**` and the same under the other agent directories |
+| `config-agent-instructions` | `CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `.cursorrules`, `.windsurfrules` |
+| `config-agent-rules` | `.cursor/rules/**`, `.windsurf/rules/**`, `.continue/rules/**` |
+| `config-mcp-manifest` | `.mcp.json` |
+| `config-editor-tasks` | `.vscode/settings.json`, `.vscode/tasks.json`, `.vscode/launch.json` |
+| `config-git` | `.git/config`, `.git/hooks/**` |
+| `config-git-hooks-managed` | `.husky/**` |
+| `config-ci-workflow` | `.github/workflows/**`, `.gitlab-ci.yml`, `.circleci/**` |
+| `config-shell-rc` | `.bashrc`, `.bash_profile`, `.profile`, `.zshrc`, `.zprofile`, `.zshenv`, `.kshrc`, `config.fish`, … |
+| `config-harness-bundle` | `cordis*.yml` |
+| `config-api-base-url` | not a path — content setting a `*_BASE_URL` or `*_API_BASE` to an `http(s)` URL |
+
+The last row is CVE-2026-21852: a repo-local settings file that sets `ANTHROPIC_BASE_URL` sends
+the user's own API key to whatever host it names. That is neither a path nor a secret — it is a
+config key whose *value* redirects a credential — so it is matched against the bytes the call
+would write rather than against where they would go.
+
+**Rules match by name, so creating a file is covered as well as changing one.** CVE-2026-25725
+worked precisely because the path did not exist yet and was therefore writable with nothing to
+prompt about.
+
+**This tier is `ask`, and it is therefore neutralizable — unlike the floor.** That is deliberate
+and it is the important sentence in this section. A developer asks the agent to edit `CLAUDE.md`
+or add a workflow constantly; the guard floor is deny-only and non-overridable by design, so a
+rule with that false-positive rate must not go there. It lives at `tools/pre-execute`, which
+means a listener registered ahead of ours can return without calling `next()` and switch the
+whole tier off. Treat it as a prompt, not as a control.
+
+**A call the floor already denies is left to the floor**, and no prompt appears for it. Any
+non-allow decision at `tools/pre-execute` skips guards entirely, so asking about a call the
+guard would deny would replace an unconditional denial with a prompt a user can grant. That is
+also why `~/.claude/settings.json` and a repository's own `.claude/settings.json` behave
+differently: the first is on the floor, the second is a prompt.
+
+Two more limits worth stating:
+
+- **A shell redirection is not covered.** Only path-typed arguments are tested, and unlike the
+  floor the command line is not tokenised: a shell command cannot be told apart from a *read* of
+  the same file, and prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+  that gets a tier switched off.
+- **With no approval service mounted, the tier abstains rather than denying.** The registry
+  resolves an `ask` through `ctx.get('approval')` and degrades to a *denial* when nothing is
+  composed — which would turn this tier into the silent hard deny it was designed not to be. It
+  reports once on `process.stderr` and `ctx.logger` and lets the call through. `configWriteAsk:
+  false` turns it off entirely.
+
+---
+
 ## What gets redacted
 
 A redacted region becomes:
@@ -430,10 +515,16 @@ the redacted copy.
 Two tiers:
 
 - **Tier 1**, synchronous and owned by this package: prefix-anchored token formats (AWS,
-  GitHub, Slack, Stripe, OpenAI, Anthropic, Google, npm), PEM private-key blocks, JWTs,
-  credential-bearing URLs, Slack/Discord/Teams webhook URLs, and high-signal secret
-  assignments. This is the tier the guard and the telemetry listener use, because both of
-  those seams are synchronous, and it is never capped.
+  GitHub, GitLab, Slack, Stripe, OpenAI, OpenRouter, Anthropic, Google API keys and
+  `GOCSPX-` OAuth client secrets, npm, HuggingFace, Groq, xAI, Databricks, SendGrid,
+  Supabase, Notion), PEM private-key blocks, JWTs, credential-bearing URLs,
+  Slack/Discord/Teams webhook URLs, and high-signal secret assignments. This is the tier the
+  guard and the telemetry listener use, because both of those seams are synchronous, and it is
+  never capped.
+
+  Prefix-anchored is the whole criterion for being in this tier, and the reason the table keeps
+  growing rather than deferring to tier 2 is the line below: **the telemetry seam cannot reach
+  tier 2**, so a format missing from tier 1 is exported in the clear when telemetry is on.
 - **Tier 2**, [`@secretlint/core`](https://github.com/secretlint/secretlint) with the
   recommended preset — 28 maintained rules, in-process, no subprocess. Used at
   `tools/pre-execute` and `tools/post-execute`, the two seams that can await. **The telemetry
@@ -456,7 +547,9 @@ session titles — and never on the tool-result path.
 | Bidi overrides and isolates | `U+202A–U+202E`, `U+2066–U+2069` | replaced |
 | Zero-width | `U+200B–U+200D`, `U+2060`, `U+FEFF` | counted only |
 | Bidi marks | `U+061C`, `U+200E–U+200F` | counted only |
-| Variation selectors | `U+FE00–U+FE0F`, `U+E0100–U+E01EF` | counted only |
+| Variation selectors, 1–3 in a row | `U+FE00–U+FE0F`, `U+E0100–U+E01EF` | counted only |
+| Variation selectors, 4 or more in a row | the same class | replaced |
+| Terminal control sequences | CSI, OSC, DCS, SOS, PM, APC, other `ESC` forms, C1 `U+0080–U+009F` | counted in tool results, **replaced in the audit sink** |
 
 The first two have no legitimate use in tool output — the Tags block is a full invisible ASCII
 alphabet, which is what makes it the standard carrier for a hidden instruction. The last three
@@ -469,6 +562,30 @@ character is never turned into a denial. A replaced run becomes an ordinary plac
 unlike a secret, is replaced exactly: an invisible character is not widened to its surrounding
 delimiters, so the visible word it hid inside survives.
 
+**Variation selectors are split by run length.** One selector picks a glyph — VS15/VS16 after a
+base character, one selector after one ideograph in an Ideographic Variation Sequence — so an
+isolated occurrence stays counted-only. A run of four or more is not glyph selection: it is a
+byte string wearing the same code points, which is how GlassWorm hid executable JavaScript
+across five waves, 35,800 installs, 300+ repositories and the first MCP package compromises. An
+emoji ZWJ sequence separates its selectors with a joiner, so no legitimate sequence produces a
+run at all; four is a conservative floor, and a real payload is hundreds of selectors long.
+
+**Terminal control sequences are split by lane rather than by class.** A tool result carrying
+SGR colour codes is the normal output of `git diff`, `rg` and `pytest`, so on that lane the
+class is counted and left alone. On the lane that ends in an audit record it is **replaced**
+with `[REDACTED:dsh-dlp:control-sequence]`, because a record is evidence and evidence must not
+be able to rewrite itself: `JSON.stringify` escapes the byte in the file, but `dsh-dlp report`,
+`jq -r` and every log viewer parse it back into a live escape, so a tool registered under a name
+containing `ESC [ 1 A ESC [ 2 K` could overwrite the audit line describing it. The whole CSI
+form is matched, not the SGR subset, along with OSC, DCS, SOS, PM, APC, the other escape forms
+and the 8-bit C1 controls; an unterminated OSC is matched to the end of the string, because that
+is how much of the display it would swallow. A repo-local `policyFile` whose rule `id` carries
+one is rejected outright, since a rule id is quoted in the denial the user reads.
+
+Not covered: a bare `\r`, `\b` or `\f` can still overprint a line on a terminal. Those have
+ordinary uses in tool output and are escaped by `JSON.stringify` in the sink; the escape-driven
+forms above are the ones with no benign use in a record.
+
 **A homoglyph defeats all of this**, and every other rule in this plugin. A Cyrillic `а` in
 `аdmin` is a normal, visible, legitimately-encoded character; detecting it means UTS #39
 confusable tables, which is a data set and a different cost class. This plugin does not attempt
@@ -530,8 +647,10 @@ its own identity.
 }
 ```
 
-`kind` is one of `guard-deny`, `pre-execute-deny`, `execution-mutation`, `result-redaction`,
-`telemetry-redaction`, `assistant-image-neutralized`. An `execution-mutation` record carries
+`kind` is one of `guard-deny`, `pre-execute-deny`, `pre-execute-ask`, `execution-mutation`,
+`result-redaction`, `telemetry-redaction`, `assistant-image-neutralized`. A `pre-execute-ask`
+record carries a top-level `ruleId` instead of `spans`: the finding is that a path names a
+behaviour-changing file, not that any region of it matched. An `execution-mutation` record carries
 `mutatedFields` and, when a tool substitution happened, the `originalTool` the log recorded. An
 `assistant-image-neutralized` record carries `host` — the hostname of the blocked destination
 and nothing else from the URL.

package/SECURITY.md

@@ -4,11 +4,12 @@
 
 | Version | Supported |
 |---|---|
-| 0.1.x | yes |
-| < 0.1 | no |
+| 0.3.x | yes |
+| < 0.3 | no |
 
-Only the latest published `0.1.x` receives fixes. There is no long-term-support branch while
-the package is pre-1.0.
+Only the latest published `0.3.x` receives fixes. There is no long-term-support branch while
+the package is pre-1.0: each minor supersedes the one before it, and a fix ships as the next
+`0.3.x` patch or, if the minor has already moved on, as the next minor.
 
 ## Reporting a vulnerability
 
@@ -44,4 +45,11 @@ These do count, and we want to hear about them:
 - a secret surviving into the session log through a `tools/post-execute` arm;
 - a repo-local `policyFile` loosening any part of the floor, executing code, or stalling the
   agent;
-- any way to make the guard abstain that does not require executing code.
+- any way to make the guard abstain that does not require executing code;
+- a terminal control sequence, or any other forgeable bytes, reaching the audit sink or a
+  denial the user reads.
+
+The `ask` tier for behaviour-changing config paths is **not** part of the floor and is
+documented as neutralizable: it lives at `tools/pre-execute`, so a listener registered ahead of
+it disables it. A missed path there is a gap worth reporting; the fact that another plugin can
+switch the tier off is a stated design limit, not a vulnerability.

package/cordis.patch.yml

@@ -21,3 +21,4 @@
         telemetryRedaction: true
         remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true
+        configWriteAsk: true

package/lib/cli.js

@@ -24,18 +24,22 @@ function stringField(record, key) {
     const value = record[key];
     return typeof value === 'string' ? value : undefined;
 }
-/** Rule ids named by a record's spans, in file order and without repeats. */
+/**
+ * Rule ids a record names, in file order and without repeats: one per span,
+ * plus the top-level `ruleId` a decision with no matched region carries.
+ */
 function ruleIdsOf(record) {
+    const named = stringField(record, 'ruleId');
     const spans = record['spans'];
     if (!Array.isArray(spans))
-        return [];
+        return named === undefined ? [] : [named];
     const ids = spans.flatMap((span) => {
         if (typeof span !== 'object' || span === null)
             return [];
         const ruleId = span['ruleId'];
         return typeof ruleId === 'string' ? [ruleId] : [];
     });
-    return [...new Set(ids)];
+    return [...new Set(named === undefined ? ids : [named, ...ids])];
 }
 /** Invisible-character counts a record carries, keeping only numeric entries. */
 function unicodeOf(record) {

package/lib/config-writes.js

@@ -0,0 +1,215 @@
+/**
+ * The `ask` tier: files whose contents decide how the agent, the editor or CI
+ * behaves next time, and the one config *key* whose value redirects a
+ * credential.
+ *
+ * This tier is deliberately **not** on the guard floor, and that is the whole
+ * design. `ctx.tools.guard()` has no `ask` arm and cannot be overridden, so a
+ * rule that lands there must be one a developer never legitimately trips. A
+ * developer asks the agent to edit `CLAUDE.md`, add a `.github/workflows`
+ * job or extend `.vscode/settings.json` constantly. Putting those on an
+ * unoverridable floor produces a plugin that gets uninstalled, which removes
+ * the floor as well.
+ *
+ * The cost is stated rather than hidden: `tools/pre-execute` is neutralizable.
+ * A listener registered ahead of this one can return without calling `next()`
+ * and this tier never runs. Only the guard floor is order-independent.
+ * @module dsh-dlp/config-writes
+ */
+import { isReadOnlyTool, normalizeCandidatePath, pathArguments } from "./paths.js";
+import { nestedStrings } from "./redaction.js";
+/**
+ * Paths whose contents change future behaviour, and the config key whose value
+ * redirects credentials.
+ *
+ * Every path here was used in the wild. The Miasma worm wrote `SessionStart`
+ * hooks into `.claude/settings.json` and `.gemini/settings.json`, an
+ * always-apply `.cursor/rules/setup.mdc`, a `folderOpen` task into
+ * `.vscode/tasks.json`, and a hijacked `npm test` into `Azure/durabletask`;
+ * GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples
+ * over it, 39 of them inside 38 seconds. See also CVE-2025-53773,
+ * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
+ * CVE-2025-59041.
+ *
+ * The rules match by name, never by what is on disk, so a file the call is
+ * about to *create* is matched exactly like one it would change:
+ * CVE-2026-25725 worked precisely because the path did not exist yet and was
+ * therefore writable without any prompt.
+ */
+export const CONFIG_WRITE_RULES = [
+    {
+        id: 'dsh-dlp/config-agent-settings',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(claude|gemini|codex|cursor|windsurf|continue)\/settings[^/]*\.json$/i,
+        effect: 'agent settings, which can register hooks that run on every future session',
+    },
+    {
+        id: 'dsh-dlp/config-agent-hooks',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(claude|gemini|codex|windsurf|continue)\/hooks(\/|$)/i,
+        effect: 'an agent hook, which runs on a session event without the model asking for it',
+    },
+    {
+        id: 'dsh-dlp/config-agent-instructions',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)(CLAUDE|AGENTS|GEMINI|\.cursorrules|\.windsurfrules)(\.md)?$/i,
+        effect: 'standing instructions every future session in this repository reads',
+    },
+    {
+        id: 'dsh-dlp/config-agent-rules',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(cursor|windsurf|continue)\/rules(\/|$)/i,
+        effect: 'an always-apply rules file every future session in this repository reads',
+    },
+    {
+        id: 'dsh-dlp/config-mcp-manifest',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.mcp\.json$/i,
+        effect: 'the MCP manifest, which decides which servers the agent starts and with what environment',
+    },
+    {
+        id: 'dsh-dlp/config-editor-tasks',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.vscode\/(settings|tasks|launch)\.json$/i,
+        effect: 'editor configuration, which can run a task the moment the folder is opened',
+    },
+    {
+        id: 'dsh-dlp/config-git',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.git\/(config$|hooks(\/|$))/i,
+        effect: 'git configuration or a git hook, which runs on the next commit, checkout or push',
+    },
+    {
+        id: 'dsh-dlp/config-git-hooks-managed',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.husky(\/|$)/i,
+        effect: 'a managed git hook, which runs on the next commit or push',
+    },
+    {
+        id: 'dsh-dlp/config-ci-workflow',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(github\/workflows|gitlab-ci\.yml|circleci)(\/|$)/i,
+        effect: 'a CI workflow, which runs on the shared runner with the repository\'s secrets',
+    },
+    {
+        id: 'dsh-dlp/config-shell-rc',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)(\.bashrc|\.bash_profile|\.bash_login|\.bash_logout|\.profile|\.zshrc|\.zprofile|\.zshenv|\.zlogin|\.kshrc|config\.fish)$/i,
+        effect: 'a shell startup file, which runs on every future shell this agent opens',
+    },
+    {
+        id: 'dsh-dlp/config-harness-bundle',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)cordis[^/]*\.ya?ml$/i,
+        effect: 'a harness bundle manifest, which decides which plugins load',
+    },
+    // CVE-2026-21852: a repo-local settings file setting `ANTHROPIC_BASE_URL`
+    // sends the user's own API key to whatever host it names. This is neither a
+    // path nor a secret — it is a key whose *value* redirects a credential — so
+    // it is matched against what would be written rather than against where.
+    {
+        id: 'dsh-dlp/config-api-base-url',
+        version: 1,
+        match: 'content',
+        pattern: /\b[A-Z][A-Z0-9_]*(?:_BASE_URL|_API_BASE)\b["']?\s*[=:]\s*["']?\s*https?:\/\//,
+        effect: 'a provider base URL, which sends the credential for that provider to whatever host it names',
+    },
+];
+/**
+ * Argument keys whose values are the bytes a call would write.
+ *
+ * Deliberately separate from the floor's path-typed keys: the floor must never
+ * run its path table over file content, and this tier must run its one content
+ * rule over nothing else.
+ */
+export const CONTENT_ARGUMENT_KEYS = new Set([
+    'content', 'contents', 'text', 'file_text', 'fileText',
+    'new_string', 'newString', 'new_str', 'replacement', 'body',
+]);
+/**
+ * The strings one call would write.
+ * @param args - the pending call's parsed arguments.
+ * @returns every string under a content-typed key, at any depth.
+ */
+export function contentArguments(args) {
+    const found = [];
+    const walk = (node) => {
+        if (Array.isArray(node)) {
+            for (const item of node)
+                walk(item);
+            return;
+        }
+        if (typeof node !== 'object' || node === null)
+            return;
+        for (const [key, value] of Object.entries(node)) {
+            if (CONTENT_ARGUMENT_KEYS.has(key))
+                found.push(...nestedStrings(value));
+            else
+                walk(value);
+        }
+    };
+    walk(args);
+    return found;
+}
+/**
+ * Prompt text for one behaviour-changing write.
+ *
+ * The path is not quoted, for the same reason the floor never quotes one: this
+ * string is model-visible and a path carries tenant and customer names. What
+ * the user needs in order to answer is which tool, which rule, and what the
+ * file does.
+ */
+function configWriteReason(toolName, rule) {
+    return `dsh-dlp is asking before ${JSON.stringify(toolName)} writes ${rule.effect} (rule ${rule.id}). `
+        + 'This kind of file changes what happens on a later session, commit or CI run rather than now, so it is worth '
+        + 'one look. Approve it if you asked for this change; decline it if you did not.';
+}
+/**
+ * Decide whether one call should be confirmed by a human.
+ *
+ * Only calls that can change something are examined: a tool
+ * {@link isReadOnlyTool} classifies as query-only cannot write a hook. Shell
+ * command lines are deliberately **not** tokenised here, unlike in the floor:
+ * a command line cannot be told apart from a read of the same path, and
+ * prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+ * that gets a tier switched off. A shell redirection into one of these files
+ * is therefore not covered, which README.md says beside the feature.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link CONFIG_WRITE_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export function evaluateConfigWrite(exec, rules = CONFIG_WRITE_RULES) {
+    if (isReadOnlyTool(exec.name))
+        return undefined;
+    const targets = pathArguments(exec.arguments).filter(argument => !argument.shell);
+    for (const rule of rules) {
+        if (rule.match !== 'path')
+            continue;
+        for (const target of targets) {
+            if (rule.pattern.test(normalizeCandidatePath(target.text))) {
+                return { rule, reason: configWriteReason(exec.name, rule) };
+            }
+        }
+    }
+    const written = contentArguments(exec.arguments);
+    for (const rule of rules) {
+        if (rule.match !== 'content')
+            continue;
+        for (const text of written) {
+            if (rule.pattern.test(text))
+                return { rule, reason: configWriteReason(exec.name, rule) };
+        }
+    }
+    return undefined;
+}

package/lib/detectors.js

@@ -36,6 +36,11 @@ export const DENY_SEVERITY = 'high';
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
+ *
+ * Prefix-anchored is the whole membership criterion, and the reason this table
+ * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
+ * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
+ * here is exported in the clear when telemetry is on.
  */
 export const SYNC_RULES = [
     { id: 'dsh-dlp/aws-access-key-id', version: 1, severity: 'critical', pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g },
@@ -44,9 +49,23 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/slack-token', version: 1, severity: 'critical', pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
     { id: 'dsh-dlp/stripe-secret-key', version: 1, severity: 'critical', pattern: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/g },
     { id: 'dsh-dlp/anthropic-api-key', version: 1, severity: 'critical', pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g },
+    // Ahead of the OpenAI rule, whose `sk-` prefix also covers this shape: two
+    // detections over the same span merge into one placeholder attributed to
+    // whichever rule the table reached first, and the specific rule is the
+    // useful attribution.
+    { id: 'dsh-dlp/openrouter-api-key', version: 1, severity: 'critical', pattern: /\bsk-or-v1-[0-9a-f]{64}\b/g },
     { id: 'dsh-dlp/openai-api-key', version: 1, severity: 'critical', pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g },
     { id: 'dsh-dlp/google-api-key', version: 1, severity: 'critical', pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
     { id: 'dsh-dlp/npm-token', version: 1, severity: 'critical', pattern: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    { id: 'dsh-dlp/gitlab-token', version: 1, severity: 'critical', pattern: /\bglpat-[A-Za-z0-9_-]{20,}/g },
+    { id: 'dsh-dlp/huggingface-token', version: 1, severity: 'critical', pattern: /\bhf_[A-Za-z0-9]{34,}/g },
+    { id: 'dsh-dlp/groq-api-key', version: 1, severity: 'critical', pattern: /\bgsk_[A-Za-z0-9]{40,}/g },
+    { id: 'dsh-dlp/xai-api-key', version: 1, severity: 'critical', pattern: /\bxai-[A-Za-z0-9]{32,}/g },
+    { id: 'dsh-dlp/google-oauth-client-secret', version: 1, severity: 'critical', pattern: /\bGOCSPX-[A-Za-z0-9_-]{24,}/g },
+    { id: 'dsh-dlp/databricks-token', version: 1, severity: 'critical', pattern: /\bdapi[0-9a-f]{32}(?:-\d+)?\b/g },
+    { id: 'dsh-dlp/sendgrid-api-key', version: 1, severity: 'critical', pattern: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+    { id: 'dsh-dlp/supabase-service-key', version: 1, severity: 'critical', pattern: /\bsbp_[0-9a-f]{40}\b/g },
+    { id: 'dsh-dlp/notion-token', version: 1, severity: 'critical', pattern: /\bntn_[A-Za-z0-9]{40,}/g },
     { id: 'dsh-dlp/private-key-block', version: 1, severity: 'critical', pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g },
     { id: 'dsh-dlp/json-web-token', version: 1, severity: 'high', pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
     { id: 'dsh-dlp/credential-url', version: 1, severity: 'high', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s/@]+@[^\s/]+/gi },
@@ -58,13 +77,95 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/teams-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/[A-Za-z0-9.-]*webhook\.office\.com\/webhookb2\/[A-Za-z0-9@/_-]{10,}/g },
     { id: 'dsh-dlp/secret-assignment', version: 1, severity: 'medium', pattern: /\b(?:api[_-]?key|secret[_-]?key|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token)\b\s*[=:]\s*["']?[A-Za-z0-9/+=_-]{16,}["']?/gi },
 ];
-/** Build one class's run pattern from its ranges, so the two cannot drift apart. */
-function unicodeRule(id, action, ranges) {
-    return { id, version: 1, severity: 'medium', action, ranges, pattern: new RegExp(`[${ranges}]+`, 'gu') };
+/**
+ * Build one class's run pattern from its ranges, so the two cannot drift apart.
+ * @param id - the rule's identity.
+ * @param action - what the scan does with a match.
+ * @param ranges - the class's ranges as a character-class body.
+ * @param quantifier - applied to the class; the default matches a whole run.
+ * @param wholeRun - whether a match must be a complete run rather than part of a longer one.
+ * @returns the rule.
+ */
+function unicodeRule(id, action, ranges, quantifier = '+', wholeRun = false) {
+    const source = wholeRun
+        ? `(?<![${ranges}])[${ranges}]${quantifier}(?![${ranges}])`
+        : `[${ranges}]${quantifier}`;
+    return { id, version: 1, severity: 'medium', action, ranges, pattern: new RegExp(source, 'gu') };
 }
+/** Variation-selector code points, shared by the isolated rule and the run rule. */
+const VARIATION_SELECTORS = String.raw `\u{FE00}-\u{FE0F}\u{E0100}-\u{E01EF}`;
+/**
+ * Consecutive variation selectors at which the run stops being glyph selection
+ * and starts being a payload.
+ *
+ * One selector picks a glyph: VS15/VS16 after a base character, one selector
+ * after one ideograph in an Ideographic Variation Sequence. Two in a row have
+ * no standard meaning — an emoji ZWJ sequence separates its selectors with a
+ * joiner, so a run stays at one — and four leaves no plausible reading but
+ * "these are bytes". GlassWorm encoded executable JavaScript one byte per
+ * selector across five waves, 35,800 installs and 300+ repositories, so a real
+ * payload is hundreds of selectors long and 4 is a conservative floor rather
+ * than a tight one.
+ */
+const VARIATION_SELECTOR_RUN = 4;
+/**
+ * One terminal control sequence: the full CSI form, not only the SGR colour
+ * subset, plus the string-introducer families and the 8-bit C1 equivalents.
+ *
+ * Each alternative in order: an OSC/DCS/SOS/PM/APC introducer and its body up
+ * to a string terminator that may never arrive; a complete CSI — parameter
+ * bytes, intermediate bytes, one final byte; any other escape sequence; and a
+ * lone escape or C1 control that introduces nothing.
+ *
+ * Terminating at end of input matters: an unterminated OSC swallows everything
+ * a terminal prints after it, which is the whole trick, so the tail is part of
+ * the match rather than a miss.
+ */
+const CONTROL_SEQUENCE = [
+    String.raw `(?:\u001B[\]P^_X]|[\u0090\u0098\u009D\u009E\u009F])[\s\S]*?(?:\u0007|\u001B\\|\u009C|$)`,
+    String.raw `(?:\u001B\[|\u009B)[\u0030-\u003F]*[\u0020-\u002F]*[\u0040-\u007E]`,
+    String.raw `\u001B[\u0020-\u002F]*[\u0030-\u007E]`,
+    String.raw `[\u001B\u0080-\u009F]`,
+].join('|');
+/**
+ * Text substituted for a stripped control sequence. Visible on purpose: the
+ * lanes that strip are the ones an operator reads as evidence, and silently
+ * deleting the bytes would hide that a forgery was attempted.
+ */
+export const CONTROL_SEQUENCE_PLACEHOLDER = '[REDACTED:dsh-dlp:control-sequence]';
+/**
+ * Remove every terminal control sequence from one string.
+ *
+ * This is the `strip` half of {@link CONTROL_SEQUENCE_RULE}, applied on the
+ * lanes that must never carry forgeable bytes: an audit record and the strings
+ * an operator or an approval prompt reads back. Ordinary tool-result text takes
+ * the `report` half instead, because `git diff`, `rg` and `pytest` legitimately
+ * colourise their output.
+ * @param text - the string to clean.
+ * @returns the string with each control sequence replaced by a visible marker.
+ */
+export function stripControlSequences(text) {
+    return text.replace(new RegExp(CONTROL_SEQUENCE, 'gu'), CONTROL_SEQUENCE_PLACEHOLDER);
+}
+/**
+ * Terminal control sequences in ordinary text.
+ *
+ * `report` rather than `strip`, deliberately: a tool result carrying SGR colour
+ * codes is the normal output of half the commands an agent runs, and replacing
+ * them would corrupt every one of those results. What the class buys on that
+ * lane is the count in the audit record.
+ */
+const CONTROL_SEQUENCE_RULE = {
+    id: 'dsh-dlp/control-sequence',
+    version: 1,
+    severity: 'medium',
+    action: 'report',
+    pattern: new RegExp(CONTROL_SEQUENCE, 'gu'),
+};
 /**
  * Character classes that hide text from the reader while the model still reads
- * it, verified against the Unicode character database.
+ * it, verified against the Unicode character database, plus the terminal
+ * control sequences that show the reader something other than what is there.
  *
  * Every class is `medium`. These are injection *indicators*, not credentials:
  * the guard floor denies at `high` and above, so an argument carrying one is
@@ -88,14 +189,22 @@ export const UNICODE_RULES = [
     unicodeRule('dsh-dlp/unicode-zero-width', 'report', String.raw `\u{200B}-\u{200D}\u{2060}\u{FEFF}`),
     // Bidi marks, unlike the overrides above, appear in real right-to-left text.
     unicodeRule('dsh-dlp/unicode-bidi-mark', 'report', String.raw `\u{061C}\u{200E}\u{200F}`),
-    unicodeRule('dsh-dlp/unicode-variation-selector', 'report', String.raw `\u{FE00}-\u{FE0F}\u{E0100}-\u{E01EF}`),
+    // An isolated selector is glyph selection and is left alone; a run of them
+    // is a byte string wearing the same code points.
+    unicodeRule('dsh-dlp/unicode-variation-selector', 'report', VARIATION_SELECTORS, `{1,${VARIATION_SELECTOR_RUN - 1}}`, true),
+    unicodeRule('dsh-dlp/unicode-variation-selector-run', 'strip', VARIATION_SELECTORS, `{${VARIATION_SELECTOR_RUN},}`),
+    CONTROL_SEQUENCE_RULE,
 ];
+/** Classes whose matches are a run of one character class. */
+const CHARACTER_RULES = UNICODE_RULES.filter(rule => rule.ranges !== undefined);
+/** Classes whose matches have an ASCII body and are scanned over the whole input. */
+const SEQUENCE_RULES = UNICODE_RULES.filter(rule => rule.ranges === undefined);
 /**
- * One run of any indicator class. The scan is a single pass over the input
- * with this pattern; the per-class patterns then run over the matched runs
- * only, which are a handful of characters each.
+ * One run of any character-class indicator. The scan is a single pass over the
+ * input with this pattern; the per-class patterns then run over the matched
+ * runs only, which are a handful of characters each.
  */
-const UNICODE_RUN = new RegExp(`[${UNICODE_RULES.map(rule => rule.ranges).join('')}]+`, 'gu');
+const UNICODE_RUN = new RegExp(`[${[...new Set(CHARACTER_RULES.map(rule => rule.ranges))].join('')}]+`, 'gu');
 /**
  * Find every invisible or direction-changing character in one string.
  *
@@ -107,20 +216,25 @@ const UNICODE_RUN = new RegExp(`[${UNICODE_RULES.map(rule => rule.ranges).join('
  */
 export function scanUnicode(text) {
     const findings = [];
+    const found = (rule, start, length) => {
+        findings.push({
+            ruleId: rule.id,
+            ruleVersion: rule.version,
+            severity: rule.severity,
+            start,
+            end: start + length,
+            exact: true,
+            action: rule.action,
+        });
+    };
+    for (const rule of SEQUENCE_RULES) {
+        for (const match of text.matchAll(rule.pattern))
+            found(rule, match.index, match[0].length);
+    }
     for (const run of text.matchAll(UNICODE_RUN)) {
-        for (const rule of UNICODE_RULES) {
-            for (const match of run[0].matchAll(rule.pattern)) {
-                const start = run.index + match.index;
-                findings.push({
-                    ruleId: rule.id,
-                    ruleVersion: rule.version,
-                    severity: rule.severity,
-                    start,
-                    end: start + match[0].length,
-                    exact: true,
-                    action: rule.action,
-                });
-            }
+        for (const rule of CHARACTER_RULES) {
+            for (const match of run[0].matchAll(rule.pattern))
+                found(rule, run.index + match.index, match[0].length);
         }
     }
     findings.sort(byPosition);

package/lib/index.js

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Four registrations, in descending order of how much they can be trusted:
+ * Six registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -9,6 +9,10 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
+ * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
+ *    config paths. Deliberately here rather than on the floor: its rules have a
+ *    real false-positive rate and the floor cannot ask. Neutralizable, and it
+ *    abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
@@ -36,6 +40,7 @@ import { SpanHasher } from "./redaction.js";
 import { safeEvaluateGuard } from "./guard.js";
 import { neutralizeImageStream } from "./images.js";
 import { ExecutionSnapshots, mutationReason } from "./mutation.js";
+import { evaluateConfigWrite } from "./config-writes.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
@@ -230,6 +235,59 @@ export function apply(ctx, config) {
         });
         return verdict.reason;
     }), 'dsh-dlp guard floor');
+    /**
+     * Report once that the `ask` tier has nowhere to ask.
+     *
+     * The registry resolves an `ask` through `ctx.get('approval')` and keeps the
+     * historical degrade to *deny* when no service is composed. This tier exists
+     * because its rules are too false-positive-prone for a deny, so under a
+     * deployment with no approval channel it abstains instead of becoming the
+     * silent hard deny it was designed not to be. Evaluated at decision time
+     * rather than at mount, because by then the harness is running and an absent
+     * service is conclusive rather than a load order.
+     */
+    let approvalSeamReported = false;
+    const discloseApprovalSeam = () => {
+        if (approvalSeamReported)
+            return;
+        approvalSeamReported = true;
+        notice(ctx, 'dsh-dlp: configWriteAsk is enabled, but no approval service is mounted, so an ask would degrade'
+            + ' to a denial. This tier abstains instead: a write to a behaviour-changing config path is allowed through'
+            + ' with no prompt. The guard floor is unaffected.');
+    };
+    if (policy.configWriteAsk) {
+        // Registered ahead of the breadth tier, so a call that is both a config
+        // write and carries a secret is denied rather than merely asked about:
+        // this listener sees whatever the rest of the waterfall settled on and
+        // only ever narrows `allow` into `ask`.
+        ctx.on('tools/pre-execute', async (exec, next) => {
+            const decision = await next();
+            if (decision.kind !== 'allow')
+                return decision;
+            const finding = evaluateConfigWrite(exec);
+            if (finding === undefined)
+                return decision;
+            // A call the floor will deny anyway is left to the floor. Any non-allow
+            // decision from this waterfall skips guards entirely, so asking here
+            // would replace an unconditional denial with a prompt a user can grant,
+            // and would file the decision as an ask rather than as a guard denial.
+            if (safeEvaluateGuard(exec, policy, hasher) !== undefined)
+                return decision;
+            if (ctx.get('approval') === undefined) {
+                discloseApprovalSeam();
+                return decision;
+            }
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'pre-execute-ask',
+                decisionId: newDecisionId(),
+                ...identity(exec),
+                ruleId: finding.rule.id,
+            });
+            return { kind: 'ask', reason: finding.reason };
+        });
+    }
     if (policy.breadthTier) {
         ctx.on('tools/pre-execute', async (exec, next) => {
             const decision = await next();

package/lib/paths.js

@@ -48,9 +48,61 @@ export const CREDENTIAL_PATH_RULES = [
     { id: 'dsh-dlp/path-pgpass', version: 1, pattern: /(^|\/)\.pgpass$/i },
     { id: 'dsh-dlp/path-mysql-config', version: 1, pattern: /(^|\/)\.my\.cnf$/i },
     { id: 'dsh-dlp/path-service-account', version: 1, pattern: /(^|\/)[^/]*service[._-]?account[^/]*\.json$/i },
+    // Coding-agent credential stores. IronWorm's 44 packages and SANDWORM_MODE
+    // name these verbatim; an `auth.json` under an agent's own directory is a
+    // token file whatever else the directory holds.
+    { id: 'dsh-dlp/path-agent-auth', version: 1, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/auth\.json$/i },
+    // An MCP manifest carries each server's `env`, which is where its API keys
+    // are written.
+    { id: 'dsh-dlp/path-agent-mcp-config', version: 1, pattern: /(^|\/)\.(cursor|windsurf|continue|codex|claude|gemini)\/mcp\.json$/i },
+    // Cursor keeps session tokens in a SQLite state database rather than a
+    // credential file.
+    { id: 'dsh-dlp/path-editor-state-db', version: 1, pattern: /(^|\/)state\.vscdb(-journal|-wal|-shm)?$/i },
+    { id: 'dsh-dlp/path-macos-keychain', version: 1, pattern: /(^|\/)Library\/Keychains(\/|$)/i },
+    // A Terraform variables file is where provider credentials are written by
+    // convention, and state holds every provider's secrets in plaintext.
+    { id: 'dsh-dlp/path-terraform-vars', version: 1, pattern: /\.tfvars(\.json)?$/i },
+    { id: 'dsh-dlp/path-terraform-state', version: 1, pattern: /(^|\/)terraform\.tfstate(\.backup)?$/i },
     { id: 'dsh-dlp/path-keystore', version: 2, pattern: /\.(pem|p12|pfx|jks|keystore|key|asc|gpg)$/i },
     { id: 'dsh-dlp/path-credential-name', version: 1, pattern: new RegExp(String.raw `(^|\/)(?!.*\.(?:${CODE_EXTENSIONS})$)[^/]*(credentials?|secrets?|tokens?)([._-][^/]*)?$`, 'i') },
 ];
+/**
+ * Escape one literal path so it can anchor a regular expression.
+ * @param literal - the path to quote.
+ * @returns the same text with every metacharacter escaped.
+ */
+export function escapePathPattern(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+}
+/**
+ * Credential-path rules anchored at the user's home directory, resolved at
+ * mount because the directory is not known until then.
+ *
+ * A coding agent's *home* configuration decides how every future session in
+ * every repository behaves: the Miasma worm's `SessionStart` hooks went into
+ * exactly these files. Writing one is never ordinary repository work, so it is
+ * on the floor. Reading one is — a user asking the agent why its own
+ * configuration behaves a certain way is a normal request — so the rule is
+ * `writes-only` rather than `every-call`, unlike the `auth.json` and `mcp.json`
+ * stores in {@link CREDENTIAL_PATH_RULES}, which hold nothing but credentials.
+ *
+ * The *repository-local* copies of these same file names are a different
+ * question with a different answer: they are edited legitimately and often, so
+ * they sit in the neutralizable `ask` tier rather than on the floor.
+ * @param home - the user's home directory.
+ * @returns rules appended after the built-in table.
+ */
+export function homeCredentialPathRules(home) {
+    // `~` survives normalization as a root-anchored marker, so a home-relative
+    // spelling reaches the same rule as the absolute one.
+    const anchor = `(?:${escapePathPattern(home)}|/~)`;
+    return [{
+            id: 'dsh-dlp/path-agent-home-settings',
+            version: 1,
+            enforcement: 'writes-only',
+            pattern: new RegExp(`^${anchor}/\\.(claude|gemini|codex|cursor|windsurf|continue)/settings[^/]*\\.json$`, 'i'),
+        }];
+}
 /**
  * Normalize one candidate path for matching: Windows separators become
  * forward slashes, surrounding quotes come off, `~` expands to a

package/lib/policy.js

@@ -15,12 +15,13 @@
  * @module dsh-dlp/policy
  */
 import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { resolve } from 'node:path';
 import { JSON_SCHEMA, load } from 'js-yaml';
 import z from '@deepseek-ai/schemastery';
-import { SYNC_RULES, severityRank } from "./detectors.js";
+import { SYNC_RULES, severityRank, stripControlSequences } from "./detectors.js";
 import { resolveDshHome } from "./home.js";
-import { CREDENTIAL_PATH_RULES } from "./paths.js";
+import { CREDENTIAL_PATH_RULES, escapePathPattern, homeCredentialPathRules } from "./paths.js";
 export const Config = z.object({
     auditLog: z.string().required(),
     redactionKeyFile: z.string().required(),
@@ -31,6 +32,7 @@ export const Config = z.object({
     telemetryRedaction: z.boolean().default(true),
     remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
+    configWriteAsk: z.boolean().default(true),
 });
 /** Config toggles a repo-local policy may switch on, and never off. */
 const ENABLEABLE = [
@@ -39,6 +41,7 @@ const ENABLEABLE = [
     'telemetryRedaction',
     'remoteImageNeutralization',
     'redactTelemetryWorkspacePaths',
+    'configWriteAsk',
 ];
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
@@ -119,6 +122,12 @@ function parseCredentialPathEntry(node, index) {
     if (typeof id !== 'string' || id.length === 0) {
         throw new PolicyError(`addCredentialPaths[${index}].id must be a non-empty string`);
     }
+    // A rule id is quoted verbatim in a model-facing denial and in every audit
+    // record the rule produces, and this file is attacker-controlled.
+    if (stripControlSequences(id) !== id) {
+        throw new PolicyError(`addCredentialPaths[${index}].id carries a terminal control sequence; a rule id is quoted in a denial`
+            + ' the user reads and in the audit record, so it may not rewrite what is on screen');
+    }
     if (typeof pattern !== 'string' || pattern.length === 0) {
         throw new PolicyError(`addCredentialPaths[${index}].pattern must be a non-empty string`);
     }
@@ -218,10 +227,6 @@ export function loadRepoPolicy(path) {
         return { kind: 'invalid', problem: String(error) };
     }
 }
-/** Escape one literal path so it can anchor a regular expression. */
-function escapePattern(literal) {
-    return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
-}
 /**
  * Deny rules protecting this plugin's own state and the harness home.
  *
@@ -244,10 +249,10 @@ function escapePattern(literal) {
  * @returns rules appended after the built-in table.
  */
 function selfProtectionRules(config, dshHome) {
-    const home = escapePattern(resolve(dshHome));
+    const home = escapePathPattern(resolve(dshHome));
     return [
-        { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.redactionKeyFile))}$`, 'i') },
-        { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.auditLog))}$`, 'i') },
+        { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePathPattern(resolve(config.redactionKeyFile))}$`, 'i') },
+        { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePathPattern(resolve(config.auditLog))}$`, 'i') },
         { id: 'dsh-dlp/path-dsh-sessions', version: 1, pattern: new RegExp(`^${home}/sessions(/|$)`, 'i') },
         { id: 'dsh-dlp/path-dsh-home', version: 2, enforcement: 'writes-only', pattern: new RegExp(`^${home}(/|$)`, 'i') },
     ];
@@ -263,6 +268,7 @@ export function resolvePolicy(config, repo) {
     return {
         credentialPathRules: [
             ...CREDENTIAL_PATH_RULES,
+            ...homeCredentialPathRules(resolve(homedir())),
             ...selfProtectionRules(config, resolveDshHome()),
             ...repo?.addCredentialPaths ?? [],
         ],
@@ -277,5 +283,6 @@ export function resolvePolicy(config, repo) {
         telemetryRedaction: enabled('telemetryRedaction'),
         remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
+        configWriteAsk: enabled('configWriteAsk'),
     };
 }

package/lib/sink.js

@@ -16,6 +16,7 @@
  */
 import { appendFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
+import { stripControlSequences } from "./detectors.js";
 /**
  * Mint a decision id.
  * @returns an id unique to one guard verdict or redaction pass.
@@ -25,6 +26,29 @@ export function newDecisionId() {
 }
 /** Payload version carried inside every record this plugin writes. */
 export const RECORD_VERSION = 1;
+/**
+ * One record with every string cleaned of terminal control sequences.
+ *
+ * A record carries strings this plugin did not author — a tool's registered
+ * name, a call id, a rule id from the repo-local policy tier — and a reader
+ * gets them back unescaped: `JSON.stringify` writes `\u001b` to the file, but
+ * `dsh-dlp report`, `jq -r` and any log viewer parse that back into a live
+ * escape. A tool named with a CSI sequence could then overwrite the line
+ * describing it, which is the forged-audit-record half of CVE-2026-35651.
+ * Cleaning here means every consumer of the file gets the cleaned form.
+ * @param value - any part of a record.
+ * @returns the same structure with control sequences replaced.
+ */
+function cleaned(value) {
+    if (typeof value === 'string')
+        return stripControlSequences(value);
+    if (Array.isArray(value))
+        return value.map(cleaned);
+    if (typeof value === 'object' && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [stripControlSequences(key), cleaned(item)]));
+    }
+    return value;
+}
 /** Append-only JSONL sink for this plugin's decisions. */
 export class AuditSink {
     #path;
@@ -49,7 +73,7 @@ export class AuditSink {
      */
     write(record) {
         try {
-            appendFileSync(this.#path, `${JSON.stringify(record)}\n`);
+            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`);
         }
         catch (error) {
             this.#onFailure(error);

package/lib/types/config-writes.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The `ask` tier: files whose contents decide how the agent, the editor or CI
+ * behaves next time, and the one config *key* whose value redirects a
+ * credential.
+ *
+ * This tier is deliberately **not** on the guard floor, and that is the whole
+ * design. `ctx.tools.guard()` has no `ask` arm and cannot be overridden, so a
+ * rule that lands there must be one a developer never legitimately trips. A
+ * developer asks the agent to edit `CLAUDE.md`, add a `.github/workflows`
+ * job or extend `.vscode/settings.json` constantly. Putting those on an
+ * unoverridable floor produces a plugin that gets uninstalled, which removes
+ * the floor as well.
+ *
+ * The cost is stated rather than hidden: `tools/pre-execute` is neutralizable.
+ * A listener registered ahead of this one can return without calling `next()`
+ * and this tier never runs. Only the guard floor is order-independent.
+ * @module dsh-dlp/config-writes
+ */
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+/** What a behaviour-config rule is matched against. */
+export type ConfigMatch = 
+/** A path-typed argument: the file the call would create or change. */
+'path'
+/** A content-typed argument: the bytes the call would write. */
+ | 'content';
+/** One file, or one written value, that changes what happens next time. */
+export interface ConfigWriteRule {
+    readonly id: string;
+    readonly version: number;
+    readonly match: ConfigMatch;
+    readonly pattern: RegExp;
+    /** What the file or value does, quoted in the prompt the user answers. */
+    readonly effect: string;
+}
+/**
+ * Paths whose contents change future behaviour, and the config key whose value
+ * redirects credentials.
+ *
+ * Every path here was used in the wild. The Miasma worm wrote `SessionStart`
+ * hooks into `.claude/settings.json` and `.gemini/settings.json`, an
+ * always-apply `.cursor/rules/setup.mdc`, a `folderOpen` task into
+ * `.vscode/tasks.json`, and a hijacked `npm test` into `Azure/durabletask`;
+ * GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples
+ * over it, 39 of them inside 38 seconds. See also CVE-2025-53773,
+ * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
+ * CVE-2025-59041.
+ *
+ * The rules match by name, never by what is on disk, so a file the call is
+ * about to *create* is matched exactly like one it would change:
+ * CVE-2026-25725 worked precisely because the path did not exist yet and was
+ * therefore writable without any prompt.
+ */
+export declare const CONFIG_WRITE_RULES: readonly ConfigWriteRule[];
+/**
+ * Argument keys whose values are the bytes a call would write.
+ *
+ * Deliberately separate from the floor's path-typed keys: the floor must never
+ * run its path table over file content, and this tier must run its one content
+ * rule over nothing else.
+ */
+export declare const CONTENT_ARGUMENT_KEYS: ReadonlySet<string>;
+/**
+ * The strings one call would write.
+ * @param args - the pending call's parsed arguments.
+ * @returns every string under a content-typed key, at any depth.
+ */
+export declare function contentArguments(args: unknown): string[];
+/** A call this tier wants a human to confirm. */
+export interface ConfigWriteFinding {
+    readonly rule: ConfigWriteRule;
+    /** Model- and user-facing text; names the rule and what the file does, never the path. */
+    readonly reason: string;
+}
+/**
+ * Decide whether one call should be confirmed by a human.
+ *
+ * Only calls that can change something are examined: a tool
+ * {@link isReadOnlyTool} classifies as query-only cannot write a hook. Shell
+ * command lines are deliberately **not** tokenised here, unlike in the floor:
+ * a command line cannot be told apart from a read of the same path, and
+ * prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+ * that gets a tier switched off. A shell redirection into one of these files
+ * is therefore not covered, which README.md says beside the feature.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link CONFIG_WRITE_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export declare function evaluateConfigWrite(exec: Pick<ToolExecution, 'name' | 'arguments'>, rules?: readonly ConfigWriteRule[]): ConfigWriteFinding | undefined;
+//# sourceMappingURL=config-writes.d.ts.map

package/lib/types/detectors.d.ts

@@ -64,6 +64,11 @@ export interface SyncRule {
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
+ *
+ * Prefix-anchored is the whole membership criterion, and the reason this table
+ * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
+ * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
+ * here is exported in the clear when telemetry is on.
  */
 export declare const SYNC_RULES: readonly SyncRule[];
 /**
@@ -72,8 +77,14 @@ export declare const SYNC_RULES: readonly SyncRule[];
  *
  * `strip` classes have no legitimate use in tool output, so they are replaced
  * like any other detection. `report` classes do: `U+200D` joins an emoji
- * sequence and a variation selector chooses a glyph, so replacing them would
- * corrupt ordinary text. They are counted and never rewritten.
+ * sequence, a variation selector chooses a glyph, and a CSI sequence colours
+ * the output of `git diff`, so replacing them would corrupt ordinary text.
+ * They are counted and never rewritten.
+ *
+ * The split is per class and per lane both: {@link stripControlSequences}
+ * applies the `strip` treatment to a `report` class on the audit and
+ * approval-facing lanes, where colour buys nothing and a forged record costs
+ * everything.
  */
 export type UnicodeAction = 'strip' | 'report';
 /** One class of invisible or direction-changing characters. */
@@ -84,12 +95,37 @@ export interface UnicodeRule {
     readonly action: UnicodeAction;
     /** Global, unicode-flagged, matching one run of this class. */
     readonly pattern: RegExp;
-    /** The class's ranges as a character-class body, for the combined run pattern. */
-    readonly ranges: string;
+    /**
+     * The class's ranges as a character-class body, for the combined run pattern.
+     *
+     * Absent for a class whose matches are not a run of one character class —
+     * a terminal control sequence has an ASCII body — which is scanned over the
+     * whole input instead of within a combined run.
+     */
+    readonly ranges?: string;
 }
+/**
+ * Text substituted for a stripped control sequence. Visible on purpose: the
+ * lanes that strip are the ones an operator reads as evidence, and silently
+ * deleting the bytes would hide that a forgery was attempted.
+ */
+export declare const CONTROL_SEQUENCE_PLACEHOLDER = "[REDACTED:dsh-dlp:control-sequence]";
+/**
+ * Remove every terminal control sequence from one string.
+ *
+ * This is the `strip` half of {@link CONTROL_SEQUENCE_RULE}, applied on the
+ * lanes that must never carry forgeable bytes: an audit record and the strings
+ * an operator or an approval prompt reads back. Ordinary tool-result text takes
+ * the `report` half instead, because `git diff`, `rg` and `pytest` legitimately
+ * colourise their output.
+ * @param text - the string to clean.
+ * @returns the string with each control sequence replaced by a visible marker.
+ */
+export declare function stripControlSequences(text: string): string;
 /**
  * Character classes that hide text from the reader while the model still reads
- * it, verified against the Unicode character database.
+ * it, verified against the Unicode character database, plus the terminal
+ * control sequences that show the reader something other than what is there.
  *
  * Every class is `medium`. These are injection *indicators*, not credentials:
  * the guard floor denies at `high` and above, so an argument carrying one is

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Four registrations, in descending order of how much they can be trusted:
+ * Six registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -9,6 +9,10 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
+ * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
+ *    config paths. Deliberately here rather than on the floor: its rules have a
+ *    real false-positive rate and the floor cannot ask. Neutralizable, and it
+ *    abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.

package/lib/types/paths.d.ts

@@ -40,6 +40,31 @@ export interface CredentialPathRule {
  * authenticates with is agent-readable. That is the gap this table closes.
  */
 export declare const CREDENTIAL_PATH_RULES: readonly CredentialPathRule[];
+/**
+ * Escape one literal path so it can anchor a regular expression.
+ * @param literal - the path to quote.
+ * @returns the same text with every metacharacter escaped.
+ */
+export declare function escapePathPattern(literal: string): string;
+/**
+ * Credential-path rules anchored at the user's home directory, resolved at
+ * mount because the directory is not known until then.
+ *
+ * A coding agent's *home* configuration decides how every future session in
+ * every repository behaves: the Miasma worm's `SessionStart` hooks went into
+ * exactly these files. Writing one is never ordinary repository work, so it is
+ * on the floor. Reading one is — a user asking the agent why its own
+ * configuration behaves a certain way is a normal request — so the rule is
+ * `writes-only` rather than `every-call`, unlike the `auth.json` and `mcp.json`
+ * stores in {@link CREDENTIAL_PATH_RULES}, which hold nothing but credentials.
+ *
+ * The *repository-local* copies of these same file names are a different
+ * question with a different answer: they are edited legitimately and often, so
+ * they sit in the neutralizable `ask` tier rather than on the floor.
+ * @param home - the user's home directory.
+ * @returns rules appended after the built-in table.
+ */
+export declare function homeCredentialPathRules(home: string): readonly CredentialPathRule[];
 /**
  * Normalize one candidate path for matching: Windows separators become
  * forward slashes, surrounding quotes come off, `~` expands to a

package/lib/types/policy.d.ts

@@ -37,10 +37,16 @@ export interface Config {
     remoteImageNeutralization: boolean;
     /** Whether telemetry's `session.cwd` attribute is replaced with a keyed hash. */
     redactTelemetryWorkspacePaths: boolean;
+    /**
+     * Whether a write to a behaviour-changing config path asks the user first.
+     * Needs an approval service; without one the tier abstains rather than
+     * letting an `ask` degrade into a denial.
+     */
+    configWriteAsk: boolean;
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -63,6 +69,7 @@ export interface ResolvedPolicy {
     readonly telemetryRedaction: boolean;
     readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
+    readonly configWriteAsk: boolean;
 }
 /** Thrown when a policy file is malformed or attempts to loosen the policy. */
 export declare class PolicyError extends Error {

package/lib/types/sink.d.ts

@@ -28,7 +28,7 @@ export declare function newDecisionId(): DecisionId;
 /** Payload version carried inside every record this plugin writes. */
 export declare const RECORD_VERSION = 1;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -60,6 +60,12 @@ export interface AuditRecord {
      * instruction is exactly the content this file must not repeat.
      */
     readonly unicode?: Readonly<Record<string, number>>;
+    /**
+     * The single rule behind a decision that has no matched region to describe,
+     * which is every `pre-execute-ask`: the finding is that a path names a
+     * behaviour-changing file, not that any part of it matched a secret.
+     */
+    readonly ruleId?: string;
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
     /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",