dsh-dlp 0.3.0 → 0.4.1

package/SECURITY.md

@@ -4,11 +4,12 @@
 
 | Version | Supported |
 |---|---|
-| 0.1.x | yes |
-| < 0.1 | no |
+| 0.3.x | yes |
+| < 0.3 | no |
 
-Only the latest published `0.1.x` receives fixes. There is no long-term-support branch while
-the package is pre-1.0.
+Only the latest published `0.3.x` receives fixes. There is no long-term-support branch while
+the package is pre-1.0: each minor supersedes the one before it, and a fix ships as the next
+`0.3.x` patch or, if the minor has already moved on, as the next minor.
 
 ## Reporting a vulnerability
 
@@ -44,4 +45,11 @@ These do count, and we want to hear about them:
 - a secret surviving into the session log through a `tools/post-execute` arm;
 - a repo-local `policyFile` loosening any part of the floor, executing code, or stalling the
   agent;
-- any way to make the guard abstain that does not require executing code.
+- any way to make the guard abstain that does not require executing code;
+- a terminal control sequence, or any other forgeable bytes, reaching the audit sink or a
+  denial the user reads.
+
+The `ask` tier for behaviour-changing config paths is **not** part of the floor and is
+documented as neutralizable: it lives at `tools/pre-execute`, so a listener registered ahead of
+it disables it. A missed path there is a gap worth reporting; the fact that another plugin can
+switch the tier off is a stated design limit, not a vulnerability.

package/cordis.patch.yml

@@ -21,3 +21,4 @@
         telemetryRedaction: true
         remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true
+        configWriteAsk: true

package/lib/cli.js

@@ -24,18 +24,22 @@ function stringField(record, key) {
     const value = record[key];
     return typeof value === 'string' ? value : undefined;
 }
-/** Rule ids named by a record's spans, in file order and without repeats. */
+/**
+ * Rule ids a record names, in file order and without repeats: one per span,
+ * plus the top-level `ruleId` a decision with no matched region carries.
+ */
 function ruleIdsOf(record) {
+    const named = stringField(record, 'ruleId');
     const spans = record['spans'];
     if (!Array.isArray(spans))
-        return [];
+        return named === undefined ? [] : [named];
     const ids = spans.flatMap((span) => {
         if (typeof span !== 'object' || span === null)
             return [];
         const ruleId = span['ruleId'];
         return typeof ruleId === 'string' ? [ruleId] : [];
     });
-    return [...new Set(ids)];
+    return [...new Set(named === undefined ? ids : [named, ...ids])];
 }
 /** Invisible-character counts a record carries, keeping only numeric entries. */
 function unicodeOf(record) {

package/lib/config-writes.js

@@ -0,0 +1,215 @@
+/**
+ * The `ask` tier: files whose contents decide how the agent, the editor or CI
+ * behaves next time, and the one config *key* whose value redirects a
+ * credential.
+ *
+ * This tier is deliberately **not** on the guard floor, and that is the whole
+ * design. `ctx.tools.guard()` has no `ask` arm and cannot be overridden, so a
+ * rule that lands there must be one a developer never legitimately trips. A
+ * developer asks the agent to edit `CLAUDE.md`, add a `.github/workflows`
+ * job or extend `.vscode/settings.json` constantly. Putting those on an
+ * unoverridable floor produces a plugin that gets uninstalled, which removes
+ * the floor as well.
+ *
+ * The cost is stated rather than hidden: `tools/pre-execute` is neutralizable.
+ * A listener registered ahead of this one can return without calling `next()`
+ * and this tier never runs. Only the guard floor is order-independent.
+ * @module dsh-dlp/config-writes
+ */
+import { isReadOnlyTool, normalizeCandidatePath, pathArguments } from "./paths.js";
+import { nestedStrings } from "./redaction.js";
+/**
+ * Paths whose contents change future behaviour, and the config key whose value
+ * redirects credentials.
+ *
+ * Every path here was used in the wild. The Miasma worm wrote `SessionStart`
+ * hooks into `.claude/settings.json` and `.gemini/settings.json`, an
+ * always-apply `.cursor/rules/setup.mdc`, a `folderOpen` task into
+ * `.vscode/tasks.json`, and a hijacked `npm test` into `Azure/durabletask`;
+ * GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples
+ * over it, 39 of them inside 38 seconds. See also CVE-2025-53773,
+ * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
+ * CVE-2025-59041.
+ *
+ * The rules match by name, never by what is on disk, so a file the call is
+ * about to *create* is matched exactly like one it would change:
+ * CVE-2026-25725 worked precisely because the path did not exist yet and was
+ * therefore writable without any prompt.
+ */
+export const CONFIG_WRITE_RULES = [
+    {
+        id: 'dsh-dlp/config-agent-settings',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(claude|gemini|codex|cursor|windsurf|continue)\/settings[^/]*\.json$/i,
+        effect: 'agent settings, which can register hooks that run on every future session',
+    },
+    {
+        id: 'dsh-dlp/config-agent-hooks',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(claude|gemini|codex|windsurf|continue)\/hooks(\/|$)/i,
+        effect: 'an agent hook, which runs on a session event without the model asking for it',
+    },
+    {
+        id: 'dsh-dlp/config-agent-instructions',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)(CLAUDE|AGENTS|GEMINI|\.cursorrules|\.windsurfrules)(\.md)?$/i,
+        effect: 'standing instructions every future session in this repository reads',
+    },
+    {
+        id: 'dsh-dlp/config-agent-rules',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(cursor|windsurf|continue)\/rules(\/|$)/i,
+        effect: 'an always-apply rules file every future session in this repository reads',
+    },
+    {
+        id: 'dsh-dlp/config-mcp-manifest',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.mcp\.json$/i,
+        effect: 'the MCP manifest, which decides which servers the agent starts and with what environment',
+    },
+    {
+        id: 'dsh-dlp/config-editor-tasks',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.vscode\/(settings|tasks|launch)\.json$/i,
+        effect: 'editor configuration, which can run a task the moment the folder is opened',
+    },
+    {
+        id: 'dsh-dlp/config-git',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.git\/(config$|hooks(\/|$))/i,
+        effect: 'git configuration or a git hook, which runs on the next commit, checkout or push',
+    },
+    {
+        id: 'dsh-dlp/config-git-hooks-managed',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.husky(\/|$)/i,
+        effect: 'a managed git hook, which runs on the next commit or push',
+    },
+    {
+        id: 'dsh-dlp/config-ci-workflow',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.(github\/workflows|gitlab-ci\.yml|circleci)(\/|$)/i,
+        effect: 'a CI workflow, which runs on the shared runner with the repository\'s secrets',
+    },
+    {
+        id: 'dsh-dlp/config-shell-rc',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)(\.bashrc|\.bash_profile|\.bash_login|\.bash_logout|\.profile|\.zshrc|\.zprofile|\.zshenv|\.zlogin|\.kshrc|config\.fish)$/i,
+        effect: 'a shell startup file, which runs on every future shell this agent opens',
+    },
+    {
+        id: 'dsh-dlp/config-harness-bundle',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)cordis[^/]*\.ya?ml$/i,
+        effect: 'a harness bundle manifest, which decides which plugins load',
+    },
+    // CVE-2026-21852: a repo-local settings file setting `ANTHROPIC_BASE_URL`
+    // sends the user's own API key to whatever host it names. This is neither a
+    // path nor a secret — it is a key whose *value* redirects a credential — so
+    // it is matched against what would be written rather than against where.
+    {
+        id: 'dsh-dlp/config-api-base-url',
+        version: 1,
+        match: 'content',
+        pattern: /\b[A-Z][A-Z0-9_]*(?:_BASE_URL|_API_BASE)\b["']?\s*[=:]\s*["']?\s*https?:\/\//,
+        effect: 'a provider base URL, which sends the credential for that provider to whatever host it names',
+    },
+];
+/**
+ * Argument keys whose values are the bytes a call would write.
+ *
+ * Deliberately separate from the floor's path-typed keys: the floor must never
+ * run its path table over file content, and this tier must run its one content
+ * rule over nothing else.
+ */
+export const CONTENT_ARGUMENT_KEYS = new Set([
+    'content', 'contents', 'text', 'file_text', 'fileText',
+    'new_string', 'newString', 'new_str', 'replacement', 'body',
+]);
+/**
+ * The strings one call would write.
+ * @param args - the pending call's parsed arguments.
+ * @returns every string under a content-typed key, at any depth.
+ */
+export function contentArguments(args) {
+    const found = [];
+    const walk = (node) => {
+        if (Array.isArray(node)) {
+            for (const item of node)
+                walk(item);
+            return;
+        }
+        if (typeof node !== 'object' || node === null)
+            return;
+        for (const [key, value] of Object.entries(node)) {
+            if (CONTENT_ARGUMENT_KEYS.has(key))
+                found.push(...nestedStrings(value));
+            else
+                walk(value);
+        }
+    };
+    walk(args);
+    return found;
+}
+/**
+ * Prompt text for one behaviour-changing write.
+ *
+ * The path is not quoted, for the same reason the floor never quotes one: this
+ * string is model-visible and a path carries tenant and customer names. What
+ * the user needs in order to answer is which tool, which rule, and what the
+ * file does.
+ */
+function configWriteReason(toolName, rule) {
+    return `dsh-dlp is asking before ${JSON.stringify(toolName)} writes ${rule.effect} (rule ${rule.id}). `
+        + 'This kind of file changes what happens on a later session, commit or CI run rather than now, so it is worth '
+        + 'one look. Approve it if you asked for this change; decline it if you did not.';
+}
+/**
+ * Decide whether one call should be confirmed by a human.
+ *
+ * Only calls that can change something are examined: a tool
+ * {@link isReadOnlyTool} classifies as query-only cannot write a hook. Shell
+ * command lines are deliberately **not** tokenised here, unlike in the floor:
+ * a command line cannot be told apart from a read of the same path, and
+ * prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+ * that gets a tier switched off. A shell redirection into one of these files
+ * is therefore not covered, which README.md says beside the feature.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link CONFIG_WRITE_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export function evaluateConfigWrite(exec, rules = CONFIG_WRITE_RULES) {
+    if (isReadOnlyTool(exec.name))
+        return undefined;
+    const targets = pathArguments(exec.arguments).filter(argument => !argument.shell);
+    for (const rule of rules) {
+        if (rule.match !== 'path')
+            continue;
+        for (const target of targets) {
+            if (rule.pattern.test(normalizeCandidatePath(target.text))) {
+                return { rule, reason: configWriteReason(exec.name, rule) };
+            }
+        }
+    }
+    const written = contentArguments(exec.arguments);
+    for (const rule of rules) {
+        if (rule.match !== 'content')
+            continue;
+        for (const text of written) {
+            if (rule.pattern.test(text))
+                return { rule, reason: configWriteReason(exec.name, rule) };
+        }
+    }
+    return undefined;
+}

package/lib/detectors.js

@@ -36,6 +36,11 @@ export const DENY_SEVERITY = 'high';
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
+ *
+ * Prefix-anchored is the whole membership criterion, and the reason this table
+ * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
+ * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
+ * here is exported in the clear when telemetry is on.
  */
 export const SYNC_RULES = [
     { id: 'dsh-dlp/aws-access-key-id', version: 1, severity: 'critical', pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g },
@@ -44,9 +49,23 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/slack-token', version: 1, severity: 'critical', pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
     { id: 'dsh-dlp/stripe-secret-key', version: 1, severity: 'critical', pattern: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/g },
     { id: 'dsh-dlp/anthropic-api-key', version: 1, severity: 'critical', pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g },
+    // Ahead of the OpenAI rule, whose `sk-` prefix also covers this shape: two
+    // detections over the same span merge into one placeholder attributed to
+    // whichever rule the table reached first, and the specific rule is the
+    // useful attribution.
+    { id: 'dsh-dlp/openrouter-api-key', version: 1, severity: 'critical', pattern: /\bsk-or-v1-[0-9a-f]{64}\b/g },
     { id: 'dsh-dlp/openai-api-key', version: 1, severity: 'critical', pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g },
     { id: 'dsh-dlp/google-api-key', version: 1, severity: 'critical', pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
     { id: 'dsh-dlp/npm-token', version: 1, severity: 'critical', pattern: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    { id: 'dsh-dlp/gitlab-token', version: 1, severity: 'critical', pattern: /\bglpat-[A-Za-z0-9_-]{20,}/g },
+    { id: 'dsh-dlp/huggingface-token', version: 1, severity: 'critical', pattern: /\bhf_[A-Za-z0-9]{34,}/g },
+    { id: 'dsh-dlp/groq-api-key', version: 1, severity: 'critical', pattern: /\bgsk_[A-Za-z0-9]{40,}/g },
+    { id: 'dsh-dlp/xai-api-key', version: 1, severity: 'critical', pattern: /\bxai-[A-Za-z0-9]{32,}/g },
+    { id: 'dsh-dlp/google-oauth-client-secret', version: 1, severity: 'critical', pattern: /\bGOCSPX-[A-Za-z0-9_-]{24,}/g },
+    { id: 'dsh-dlp/databricks-token', version: 1, severity: 'critical', pattern: /\bdapi[0-9a-f]{32}(?:-\d+)?\b/g },
+    { id: 'dsh-dlp/sendgrid-api-key', version: 1, severity: 'critical', pattern: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+    { id: 'dsh-dlp/supabase-service-key', version: 1, severity: 'critical', pattern: /\bsbp_[0-9a-f]{40}\b/g },
+    { id: 'dsh-dlp/notion-token', version: 1, severity: 'critical', pattern: /\bntn_[A-Za-z0-9]{40,}/g },
     { id: 'dsh-dlp/private-key-block', version: 1, severity: 'critical', pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g },
     { id: 'dsh-dlp/json-web-token', version: 1, severity: 'high', pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
     { id: 'dsh-dlp/credential-url', version: 1, severity: 'high', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s/@]+@[^\s/]+/gi },
@@ -58,13 +77,94 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/teams-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/[A-Za-z0-9.-]*webhook\.office\.com\/webhookb2\/[A-Za-z0-9@/_-]{10,}/g },
     { id: 'dsh-dlp/secret-assignment', version: 1, severity: 'medium', pattern: /\b(?:api[_-]?key|secret[_-]?key|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token)\b\s*[=:]\s*["']?[A-Za-z0-9/+=_-]{16,}["']?/gi },
 ];
-/** Build one class's run pattern from its ranges, so the two cannot drift apart. */
-function unicodeRule(id, action, ranges) {
-    return { id, version: 1, severity: 'medium', action, ranges, pattern: new RegExp(`[${ranges}]+`, 'gu') };
+/**
+ * Build one class's run pattern from its ranges, so the two cannot drift apart.
+ * @param id - the rule's identity.
+ * @param action - what the scan does with a match.
+ * @param ranges - the class's ranges as a character-class body.
+ * @param quantifier - applied to the class; the default matches a whole run.
+ * @param wholeRun - whether a match must be a complete run rather than part of a longer one.
+ * @returns the rule.
+ */
+function unicodeRule(id, action, ranges, quantifier = '+', wholeRun = false) {
+    const source = wholeRun
+        ? `(?<![${ranges}])[${ranges}]${quantifier}(?![${ranges}])`
+        : `[${ranges}]${quantifier}`;
+    return { id, version: 1, severity: 'medium', action, ranges, pattern: new RegExp(source, 'gu') };
 }
+/** Variation-selector code points, shared by the isolated rule and the run rule. */
+const VARIATION_SELECTORS = String.raw `\u{FE00}-\u{FE0F}\u{E0100}-\u{E01EF}`;
+/**
+ * Consecutive variation selectors at which the run stops being glyph selection
+ * and starts being a payload.
+ *
+ * One selector picks a glyph: VS15/VS16 after a base character, one selector
+ * after one ideograph in an Ideographic Variation Sequence. Two in a row have
+ * no standard meaning — an emoji ZWJ sequence separates its selectors with a
+ * joiner, so a run stays at one — and four leaves no plausible reading but
+ * "these are bytes". GlassWorm encoded executable JavaScript one byte per
+ * selector across five waves, so a real payload is hundreds of selectors long
+ * and 4 is a conservative floor rather than a tight one.
+ */
+const VARIATION_SELECTOR_RUN = 4;
+/**
+ * One terminal control sequence: the full CSI form, not only the SGR colour
+ * subset, plus the string-introducer families and the 8-bit C1 equivalents.
+ *
+ * Each alternative in order: an OSC/DCS/SOS/PM/APC introducer and its body up
+ * to a string terminator that may never arrive; a complete CSI — parameter
+ * bytes, intermediate bytes, one final byte; any other escape sequence; and a
+ * lone escape or C1 control that introduces nothing.
+ *
+ * Terminating at end of input matters: an unterminated OSC swallows everything
+ * a terminal prints after it, which is the whole trick, so the tail is part of
+ * the match rather than a miss.
+ */
+const CONTROL_SEQUENCE = [
+    String.raw `(?:\u001B[\]P^_X]|[\u0090\u0098\u009D\u009E\u009F])[\s\S]*?(?:\u0007|\u001B\\|\u009C|$)`,
+    String.raw `(?:\u001B\[|\u009B)[\u0030-\u003F]*[\u0020-\u002F]*[\u0040-\u007E]`,
+    String.raw `\u001B[\u0020-\u002F]*[\u0030-\u007E]`,
+    String.raw `[\u001B\u0080-\u009F]`,
+].join('|');
+/**
+ * Text substituted for a stripped control sequence. Visible on purpose: the
+ * lanes that strip are the ones an operator reads as evidence, and silently
+ * deleting the bytes would hide that a forgery was attempted.
+ */
+export const CONTROL_SEQUENCE_PLACEHOLDER = '[REDACTED:dsh-dlp:control-sequence]';
+/**
+ * Remove every terminal control sequence from one string.
+ *
+ * This is the `strip` half of {@link CONTROL_SEQUENCE_RULE}, applied on the
+ * lanes that must never carry forgeable bytes: an audit record and the strings
+ * an operator or an approval prompt reads back. Ordinary tool-result text takes
+ * the `report` half instead, because `git diff`, `rg` and `pytest` legitimately
+ * colourise their output.
+ * @param text - the string to clean.
+ * @returns the string with each control sequence replaced by a visible marker.
+ */
+export function stripControlSequences(text) {
+    return text.replace(new RegExp(CONTROL_SEQUENCE, 'gu'), CONTROL_SEQUENCE_PLACEHOLDER);
+}
+/**
+ * Terminal control sequences in ordinary text.
+ *
+ * `report` rather than `strip`, deliberately: a tool result carrying SGR colour
+ * codes is the normal output of half the commands an agent runs, and replacing
+ * them would corrupt every one of those results. What the class buys on that
+ * lane is the count in the audit record.
+ */
+const CONTROL_SEQUENCE_RULE = {
+    id: 'dsh-dlp/control-sequence',
+    version: 1,
+    severity: 'medium',
+    action: 'report',
+    pattern: new RegExp(CONTROL_SEQUENCE, 'gu'),
+};
 /**
  * Character classes that hide text from the reader while the model still reads
- * it, verified against the Unicode character database.
+ * it, verified against the Unicode character database, plus the terminal
+ * control sequences that show the reader something other than what is there.
  *
  * Every class is `medium`. These are injection *indicators*, not credentials:
  * the guard floor denies at `high` and above, so an argument carrying one is
@@ -88,14 +188,22 @@ export const UNICODE_RULES = [
     unicodeRule('dsh-dlp/unicode-zero-width', 'report', String.raw `\u{200B}-\u{200D}\u{2060}\u{FEFF}`),
     // Bidi marks, unlike the overrides above, appear in real right-to-left text.
     unicodeRule('dsh-dlp/unicode-bidi-mark', 'report', String.raw `\u{061C}\u{200E}\u{200F}`),
-    unicodeRule('dsh-dlp/unicode-variation-selector', 'report', String.raw `\u{FE00}-\u{FE0F}\u{E0100}-\u{E01EF}`),
+    // An isolated selector is glyph selection and is left alone; a run of them
+    // is a byte string wearing the same code points.
+    unicodeRule('dsh-dlp/unicode-variation-selector', 'report', VARIATION_SELECTORS, `{1,${VARIATION_SELECTOR_RUN - 1}}`, true),
+    unicodeRule('dsh-dlp/unicode-variation-selector-run', 'strip', VARIATION_SELECTORS, `{${VARIATION_SELECTOR_RUN},}`),
+    CONTROL_SEQUENCE_RULE,
 ];
+/** Classes whose matches are a run of one character class. */
+const CHARACTER_RULES = UNICODE_RULES.filter(rule => rule.ranges !== undefined);
+/** Classes whose matches have an ASCII body and are scanned over the whole input. */
+const SEQUENCE_RULES = UNICODE_RULES.filter(rule => rule.ranges === undefined);
 /**
- * One run of any indicator class. The scan is a single pass over the input
- * with this pattern; the per-class patterns then run over the matched runs
- * only, which are a handful of characters each.
+ * One run of any character-class indicator. The scan is a single pass over the
+ * input with this pattern; the per-class patterns then run over the matched
+ * runs only, which are a handful of characters each.
  */
-const UNICODE_RUN = new RegExp(`[${UNICODE_RULES.map(rule => rule.ranges).join('')}]+`, 'gu');
+const UNICODE_RUN = new RegExp(`[${[...new Set(CHARACTER_RULES.map(rule => rule.ranges))].join('')}]+`, 'gu');
 /**
  * Find every invisible or direction-changing character in one string.
  *
@@ -107,20 +215,25 @@ const UNICODE_RUN = new RegExp(`[${UNICODE_RULES.map(rule => rule.ranges).join('
  */
 export function scanUnicode(text) {
     const findings = [];
+    const found = (rule, start, length) => {
+        findings.push({
+            ruleId: rule.id,
+            ruleVersion: rule.version,
+            severity: rule.severity,
+            start,
+            end: start + length,
+            exact: true,
+            action: rule.action,
+        });
+    };
+    for (const rule of SEQUENCE_RULES) {
+        for (const match of text.matchAll(rule.pattern))
+            found(rule, match.index, match[0].length);
+    }
     for (const run of text.matchAll(UNICODE_RUN)) {
-        for (const rule of UNICODE_RULES) {
-            for (const match of run[0].matchAll(rule.pattern)) {
-                const start = run.index + match.index;
-                findings.push({
-                    ruleId: rule.id,
-                    ruleVersion: rule.version,
-                    severity: rule.severity,
-                    start,
-                    end: start + match[0].length,
-                    exact: true,
-                    action: rule.action,
-                });
-            }
+        for (const rule of CHARACTER_RULES) {
+            for (const match of run[0].matchAll(rule.pattern))
+                found(rule, run.index + match.index, match[0].length);
         }
     }
     findings.sort(byPosition);

package/lib/index.js

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Four registrations, in descending order of how much they can be trusted:
+ * Six registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -9,6 +9,10 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
+ * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
+ *    config paths. Deliberately here rather than on the floor: its rules have a
+ *    real false-positive rate and the floor cannot ask. Neutralizable, and it
+ *    abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
@@ -36,6 +40,7 @@ import { SpanHasher } from "./redaction.js";
 import { safeEvaluateGuard } from "./guard.js";
 import { neutralizeImageStream } from "./images.js";
 import { ExecutionSnapshots, mutationReason } from "./mutation.js";
+import { evaluateConfigWrite } from "./config-writes.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
@@ -230,6 +235,59 @@ export function apply(ctx, config) {
         });
         return verdict.reason;
     }), 'dsh-dlp guard floor');
+    /**
+     * Report once that the `ask` tier has nowhere to ask.
+     *
+     * The registry resolves an `ask` through `ctx.get('approval')` and keeps the
+     * historical degrade to *deny* when no service is composed. This tier exists
+     * because its rules are too false-positive-prone for a deny, so under a
+     * deployment with no approval channel it abstains instead of becoming the
+     * silent hard deny it was designed not to be. Evaluated at decision time
+     * rather than at mount, because by then the harness is running and an absent
+     * service is conclusive rather than a load order.
+     */
+    let approvalSeamReported = false;
+    const discloseApprovalSeam = () => {
+        if (approvalSeamReported)
+            return;
+        approvalSeamReported = true;
+        notice(ctx, 'dsh-dlp: configWriteAsk is enabled, but no approval service is mounted, so an ask would degrade'
+            + ' to a denial. This tier abstains instead: a write to a behaviour-changing config path is allowed through'
+            + ' with no prompt. The guard floor is unaffected.');
+    };
+    if (policy.configWriteAsk) {
+        // Registered ahead of the breadth tier, so a call that is both a config
+        // write and carries a secret is denied rather than merely asked about:
+        // this listener sees whatever the rest of the waterfall settled on and
+        // only ever narrows `allow` into `ask`.
+        ctx.on('tools/pre-execute', async (exec, next) => {
+            const decision = await next();
+            if (decision.kind !== 'allow')
+                return decision;
+            const finding = evaluateConfigWrite(exec);
+            if (finding === undefined)
+                return decision;
+            // A call the floor will deny anyway is left to the floor. Any non-allow
+            // decision from this waterfall skips guards entirely, so asking here
+            // would replace an unconditional denial with a prompt a user can grant,
+            // and would file the decision as an ask rather than as a guard denial.
+            if (safeEvaluateGuard(exec, policy, hasher) !== undefined)
+                return decision;
+            if (ctx.get('approval') === undefined) {
+                discloseApprovalSeam();
+                return decision;
+            }
+            sink.write({
+                v: RECORD_VERSION,
+                time: new Date().toISOString(),
+                kind: 'pre-execute-ask',
+                decisionId: newDecisionId(),
+                ...identity(exec),
+                ruleId: finding.rule.id,
+            });
+            return { kind: 'ask', reason: finding.reason };
+        });
+    }
     if (policy.breadthTier) {
         ctx.on('tools/pre-execute', async (exec, next) => {
             const decision = await next();

package/lib/paths.js

@@ -48,9 +48,61 @@ export const CREDENTIAL_PATH_RULES = [
     { id: 'dsh-dlp/path-pgpass', version: 1, pattern: /(^|\/)\.pgpass$/i },
     { id: 'dsh-dlp/path-mysql-config', version: 1, pattern: /(^|\/)\.my\.cnf$/i },
     { id: 'dsh-dlp/path-service-account', version: 1, pattern: /(^|\/)[^/]*service[._-]?account[^/]*\.json$/i },
+    // Coding-agent credential stores. IronWorm's 44 packages and SANDWORM_MODE
+    // name these verbatim; an `auth.json` under an agent's own directory is a
+    // token file whatever else the directory holds.
+    { id: 'dsh-dlp/path-agent-auth', version: 1, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/auth\.json$/i },
+    // An MCP manifest carries each server's `env`, which is where its API keys
+    // are written.
+    { id: 'dsh-dlp/path-agent-mcp-config', version: 1, pattern: /(^|\/)\.(cursor|windsurf|continue|codex|claude|gemini)\/mcp\.json$/i },
+    // Cursor keeps session tokens in a SQLite state database rather than a
+    // credential file.
+    { id: 'dsh-dlp/path-editor-state-db', version: 1, pattern: /(^|\/)state\.vscdb(-journal|-wal|-shm)?$/i },
+    { id: 'dsh-dlp/path-macos-keychain', version: 1, pattern: /(^|\/)Library\/Keychains(\/|$)/i },
+    // A Terraform variables file is where provider credentials are written by
+    // convention, and state holds every provider's secrets in plaintext.
+    { id: 'dsh-dlp/path-terraform-vars', version: 1, pattern: /\.tfvars(\.json)?$/i },
+    { id: 'dsh-dlp/path-terraform-state', version: 1, pattern: /(^|\/)terraform\.tfstate(\.backup)?$/i },
     { id: 'dsh-dlp/path-keystore', version: 2, pattern: /\.(pem|p12|pfx|jks|keystore|key|asc|gpg)$/i },
     { id: 'dsh-dlp/path-credential-name', version: 1, pattern: new RegExp(String.raw `(^|\/)(?!.*\.(?:${CODE_EXTENSIONS})$)[^/]*(credentials?|secrets?|tokens?)([._-][^/]*)?$`, 'i') },
 ];
+/**
+ * Escape one literal path so it can anchor a regular expression.
+ * @param literal - the path to quote.
+ * @returns the same text with every metacharacter escaped.
+ */
+export function escapePathPattern(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+}
+/**
+ * Credential-path rules anchored at the user's home directory, resolved at
+ * mount because the directory is not known until then.
+ *
+ * A coding agent's *home* configuration decides how every future session in
+ * every repository behaves: the Miasma worm's `SessionStart` hooks went into
+ * exactly these files. Writing one is never ordinary repository work, so it is
+ * on the floor. Reading one is — a user asking the agent why its own
+ * configuration behaves a certain way is a normal request — so the rule is
+ * `writes-only` rather than `every-call`, unlike the `auth.json` and `mcp.json`
+ * stores in {@link CREDENTIAL_PATH_RULES}, which hold nothing but credentials.
+ *
+ * The *repository-local* copies of these same file names are a different
+ * question with a different answer: they are edited legitimately and often, so
+ * they sit in the neutralizable `ask` tier rather than on the floor.
+ * @param home - the user's home directory.
+ * @returns rules appended after the built-in table.
+ */
+export function homeCredentialPathRules(home) {
+    // `~` survives normalization as a root-anchored marker, so a home-relative
+    // spelling reaches the same rule as the absolute one.
+    const anchor = `(?:${escapePathPattern(home)}|/~)`;
+    return [{
+            id: 'dsh-dlp/path-agent-home-settings',
+            version: 1,
+            enforcement: 'writes-only',
+            pattern: new RegExp(`^${anchor}/\\.(claude|gemini|codex|cursor|windsurf|continue)/settings[^/]*\\.json$`, 'i'),
+        }];
+}
 /**
  * Normalize one candidate path for matching: Windows separators become
  * forward slashes, surrounding quotes come off, `~` expands to a