dsh-dlp 0.3.0 → 0.4.1

package/lib/policy.js

@@ -15,12 +15,13 @@
  * @module dsh-dlp/policy
  */
 import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { resolve } from 'node:path';
 import { JSON_SCHEMA, load } from 'js-yaml';
 import z from '@deepseek-ai/schemastery';
-import { SYNC_RULES, severityRank } from "./detectors.js";
+import { SYNC_RULES, severityRank, stripControlSequences } from "./detectors.js";
 import { resolveDshHome } from "./home.js";
-import { CREDENTIAL_PATH_RULES } from "./paths.js";
+import { CREDENTIAL_PATH_RULES, escapePathPattern, homeCredentialPathRules } from "./paths.js";
 export const Config = z.object({
     auditLog: z.string().required(),
     redactionKeyFile: z.string().required(),
@@ -31,6 +32,7 @@ export const Config = z.object({
     telemetryRedaction: z.boolean().default(true),
     remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
+    configWriteAsk: z.boolean().default(true),
 });
 /** Config toggles a repo-local policy may switch on, and never off. */
 const ENABLEABLE = [
@@ -39,6 +41,7 @@ const ENABLEABLE = [
     'telemetryRedaction',
     'remoteImageNeutralization',
     'redactTelemetryWorkspacePaths',
+    'configWriteAsk',
 ];
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
@@ -119,6 +122,12 @@ function parseCredentialPathEntry(node, index) {
     if (typeof id !== 'string' || id.length === 0) {
         throw new PolicyError(`addCredentialPaths[${index}].id must be a non-empty string`);
     }
+    // A rule id is quoted verbatim in a model-facing denial and in every audit
+    // record the rule produces, and this file is attacker-controlled.
+    if (stripControlSequences(id) !== id) {
+        throw new PolicyError(`addCredentialPaths[${index}].id carries a terminal control sequence; a rule id is quoted in a denial`
+            + ' the user reads and in the audit record, so it may not rewrite what is on screen');
+    }
     if (typeof pattern !== 'string' || pattern.length === 0) {
         throw new PolicyError(`addCredentialPaths[${index}].pattern must be a non-empty string`);
     }
@@ -218,10 +227,6 @@ export function loadRepoPolicy(path) {
         return { kind: 'invalid', problem: String(error) };
     }
 }
-/** Escape one literal path so it can anchor a regular expression. */
-function escapePattern(literal) {
-    return literal.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
-}
 /**
  * Deny rules protecting this plugin's own state and the harness home.
  *
@@ -244,10 +249,10 @@ function escapePattern(literal) {
  * @returns rules appended after the built-in table.
  */
 function selfProtectionRules(config, dshHome) {
-    const home = escapePattern(resolve(dshHome));
+    const home = escapePathPattern(resolve(dshHome));
     return [
-        { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.redactionKeyFile))}$`, 'i') },
-        { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePattern(resolve(config.auditLog))}$`, 'i') },
+        { id: 'dsh-dlp/path-own-redaction-key', version: 1, pattern: new RegExp(`^${escapePathPattern(resolve(config.redactionKeyFile))}$`, 'i') },
+        { id: 'dsh-dlp/path-own-audit-log', version: 1, pattern: new RegExp(`^${escapePathPattern(resolve(config.auditLog))}$`, 'i') },
         { id: 'dsh-dlp/path-dsh-sessions', version: 1, pattern: new RegExp(`^${home}/sessions(/|$)`, 'i') },
         { id: 'dsh-dlp/path-dsh-home', version: 2, enforcement: 'writes-only', pattern: new RegExp(`^${home}(/|$)`, 'i') },
     ];
@@ -263,6 +268,7 @@ export function resolvePolicy(config, repo) {
     return {
         credentialPathRules: [
             ...CREDENTIAL_PATH_RULES,
+            ...homeCredentialPathRules(resolve(homedir())),
             ...selfProtectionRules(config, resolveDshHome()),
             ...repo?.addCredentialPaths ?? [],
         ],
@@ -277,5 +283,6 @@ export function resolvePolicy(config, repo) {
         telemetryRedaction: enabled('telemetryRedaction'),
         remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
+        configWriteAsk: enabled('configWriteAsk'),
     };
 }

package/lib/sink.js

@@ -16,6 +16,7 @@
  */
 import { appendFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
+import { stripControlSequences } from "./detectors.js";
 /**
  * Mint a decision id.
  * @returns an id unique to one guard verdict or redaction pass.
@@ -25,6 +26,29 @@ export function newDecisionId() {
 }
 /** Payload version carried inside every record this plugin writes. */
 export const RECORD_VERSION = 1;
+/**
+ * One record with every string cleaned of terminal control sequences.
+ *
+ * A record carries strings this plugin did not author — a tool's registered
+ * name, a call id, a rule id from the repo-local policy tier — and a reader
+ * gets them back unescaped: `JSON.stringify` writes `\u001b` to the file, but
+ * `dsh-dlp report`, `jq -r` and any log viewer parse that back into a live
+ * escape. A tool named with a CSI sequence could then overwrite the line
+ * describing it, which is the forged-audit-record half of CVE-2026-35651.
+ * Cleaning here means every consumer of the file gets the cleaned form.
+ * @param value - any part of a record.
+ * @returns the same structure with control sequences replaced.
+ */
+function cleaned(value) {
+    if (typeof value === 'string')
+        return stripControlSequences(value);
+    if (Array.isArray(value))
+        return value.map(cleaned);
+    if (typeof value === 'object' && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [stripControlSequences(key), cleaned(item)]));
+    }
+    return value;
+}
 /** Append-only JSONL sink for this plugin's decisions. */
 export class AuditSink {
     #path;
@@ -49,7 +73,7 @@ export class AuditSink {
      */
     write(record) {
         try {
-            appendFileSync(this.#path, `${JSON.stringify(record)}\n`);
+            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`);
         }
         catch (error) {
             this.#onFailure(error);

package/lib/types/config-writes.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The `ask` tier: files whose contents decide how the agent, the editor or CI
+ * behaves next time, and the one config *key* whose value redirects a
+ * credential.
+ *
+ * This tier is deliberately **not** on the guard floor, and that is the whole
+ * design. `ctx.tools.guard()` has no `ask` arm and cannot be overridden, so a
+ * rule that lands there must be one a developer never legitimately trips. A
+ * developer asks the agent to edit `CLAUDE.md`, add a `.github/workflows`
+ * job or extend `.vscode/settings.json` constantly. Putting those on an
+ * unoverridable floor produces a plugin that gets uninstalled, which removes
+ * the floor as well.
+ *
+ * The cost is stated rather than hidden: `tools/pre-execute` is neutralizable.
+ * A listener registered ahead of this one can return without calling `next()`
+ * and this tier never runs. Only the guard floor is order-independent.
+ * @module dsh-dlp/config-writes
+ */
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+/** What a behaviour-config rule is matched against. */
+export type ConfigMatch = 
+/** A path-typed argument: the file the call would create or change. */
+'path'
+/** A content-typed argument: the bytes the call would write. */
+ | 'content';
+/** One file, or one written value, that changes what happens next time. */
+export interface ConfigWriteRule {
+    readonly id: string;
+    readonly version: number;
+    readonly match: ConfigMatch;
+    readonly pattern: RegExp;
+    /** What the file or value does, quoted in the prompt the user answers. */
+    readonly effect: string;
+}
+/**
+ * Paths whose contents change future behaviour, and the config key whose value
+ * redirects credentials.
+ *
+ * Every path here was used in the wild. The Miasma worm wrote `SessionStart`
+ * hooks into `.claude/settings.json` and `.gemini/settings.json`, an
+ * always-apply `.cursor/rules/setup.mdc`, a `folderOpen` task into
+ * `.vscode/tasks.json`, and a hijacked `npm test` into `Azure/durabletask`;
+ * GitHub disabled 73 repositories across Azure, microsoft and Azure-Samples
+ * over it, 39 of them inside 38 seconds. See also CVE-2025-53773,
+ * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
+ * CVE-2025-59041.
+ *
+ * The rules match by name, never by what is on disk, so a file the call is
+ * about to *create* is matched exactly like one it would change:
+ * CVE-2026-25725 worked precisely because the path did not exist yet and was
+ * therefore writable without any prompt.
+ */
+export declare const CONFIG_WRITE_RULES: readonly ConfigWriteRule[];
+/**
+ * Argument keys whose values are the bytes a call would write.
+ *
+ * Deliberately separate from the floor's path-typed keys: the floor must never
+ * run its path table over file content, and this tier must run its one content
+ * rule over nothing else.
+ */
+export declare const CONTENT_ARGUMENT_KEYS: ReadonlySet<string>;
+/**
+ * The strings one call would write.
+ * @param args - the pending call's parsed arguments.
+ * @returns every string under a content-typed key, at any depth.
+ */
+export declare function contentArguments(args: unknown): string[];
+/** A call this tier wants a human to confirm. */
+export interface ConfigWriteFinding {
+    readonly rule: ConfigWriteRule;
+    /** Model- and user-facing text; names the rule and what the file does, never the path. */
+    readonly reason: string;
+}
+/**
+ * Decide whether one call should be confirmed by a human.
+ *
+ * Only calls that can change something are examined: a tool
+ * {@link isReadOnlyTool} classifies as query-only cannot write a hook. Shell
+ * command lines are deliberately **not** tokenised here, unlike in the floor:
+ * a command line cannot be told apart from a read of the same path, and
+ * prompting on `cat .github/workflows/ci.yml` is exactly the false positive
+ * that gets a tier switched off. A shell redirection into one of these files
+ * is therefore not covered, which README.md says beside the feature.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link CONFIG_WRITE_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export declare function evaluateConfigWrite(exec: Pick<ToolExecution, 'name' | 'arguments'>, rules?: readonly ConfigWriteRule[]): ConfigWriteFinding | undefined;
+//# sourceMappingURL=config-writes.d.ts.map

package/lib/types/detectors.d.ts

@@ -64,6 +64,11 @@ export interface SyncRule {
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
+ *
+ * Prefix-anchored is the whole membership criterion, and the reason this table
+ * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
+ * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
+ * here is exported in the clear when telemetry is on.
  */
 export declare const SYNC_RULES: readonly SyncRule[];
 /**
@@ -72,8 +77,14 @@ export declare const SYNC_RULES: readonly SyncRule[];
  *
  * `strip` classes have no legitimate use in tool output, so they are replaced
  * like any other detection. `report` classes do: `U+200D` joins an emoji
- * sequence and a variation selector chooses a glyph, so replacing them would
- * corrupt ordinary text. They are counted and never rewritten.
+ * sequence, a variation selector chooses a glyph, and a CSI sequence colours
+ * the output of `git diff`, so replacing them would corrupt ordinary text.
+ * They are counted and never rewritten.
+ *
+ * The split is per class and per lane both: {@link stripControlSequences}
+ * applies the `strip` treatment to a `report` class on the audit and
+ * approval-facing lanes, where colour buys nothing and a forged record costs
+ * everything.
  */
 export type UnicodeAction = 'strip' | 'report';
 /** One class of invisible or direction-changing characters. */
@@ -84,12 +95,37 @@ export interface UnicodeRule {
     readonly action: UnicodeAction;
     /** Global, unicode-flagged, matching one run of this class. */
     readonly pattern: RegExp;
-    /** The class's ranges as a character-class body, for the combined run pattern. */
-    readonly ranges: string;
+    /**
+     * The class's ranges as a character-class body, for the combined run pattern.
+     *
+     * Absent for a class whose matches are not a run of one character class —
+     * a terminal control sequence has an ASCII body — which is scanned over the
+     * whole input instead of within a combined run.
+     */
+    readonly ranges?: string;
 }
+/**
+ * Text substituted for a stripped control sequence. Visible on purpose: the
+ * lanes that strip are the ones an operator reads as evidence, and silently
+ * deleting the bytes would hide that a forgery was attempted.
+ */
+export declare const CONTROL_SEQUENCE_PLACEHOLDER = "[REDACTED:dsh-dlp:control-sequence]";
+/**
+ * Remove every terminal control sequence from one string.
+ *
+ * This is the `strip` half of {@link CONTROL_SEQUENCE_RULE}, applied on the
+ * lanes that must never carry forgeable bytes: an audit record and the strings
+ * an operator or an approval prompt reads back. Ordinary tool-result text takes
+ * the `report` half instead, because `git diff`, `rg` and `pytest` legitimately
+ * colourise their output.
+ * @param text - the string to clean.
+ * @returns the string with each control sequence replaced by a visible marker.
+ */
+export declare function stripControlSequences(text: string): string;
 /**
  * Character classes that hide text from the reader while the model still reads
- * it, verified against the Unicode character database.
+ * it, verified against the Unicode character database, plus the terminal
+ * control sequences that show the reader something other than what is there.
  *
  * Every class is `medium`. These are injection *indicators*, not credentials:
  * the guard floor denies at `high` and above, so an argument carrying one is

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Four registrations, in descending order of how much they can be trusted:
+ * Six registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -9,6 +9,10 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
+ * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
+ *    config paths. Deliberately here rather than on the floor: its rules have a
+ *    real false-positive rate and the floor cannot ask. Neutralizable, and it
+ *    abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.

package/lib/types/paths.d.ts

@@ -40,6 +40,31 @@ export interface CredentialPathRule {
  * authenticates with is agent-readable. That is the gap this table closes.
  */
 export declare const CREDENTIAL_PATH_RULES: readonly CredentialPathRule[];
+/**
+ * Escape one literal path so it can anchor a regular expression.
+ * @param literal - the path to quote.
+ * @returns the same text with every metacharacter escaped.
+ */
+export declare function escapePathPattern(literal: string): string;
+/**
+ * Credential-path rules anchored at the user's home directory, resolved at
+ * mount because the directory is not known until then.
+ *
+ * A coding agent's *home* configuration decides how every future session in
+ * every repository behaves: the Miasma worm's `SessionStart` hooks went into
+ * exactly these files. Writing one is never ordinary repository work, so it is
+ * on the floor. Reading one is — a user asking the agent why its own
+ * configuration behaves a certain way is a normal request — so the rule is
+ * `writes-only` rather than `every-call`, unlike the `auth.json` and `mcp.json`
+ * stores in {@link CREDENTIAL_PATH_RULES}, which hold nothing but credentials.
+ *
+ * The *repository-local* copies of these same file names are a different
+ * question with a different answer: they are edited legitimately and often, so
+ * they sit in the neutralizable `ask` tier rather than on the floor.
+ * @param home - the user's home directory.
+ * @returns rules appended after the built-in table.
+ */
+export declare function homeCredentialPathRules(home: string): readonly CredentialPathRule[];
 /**
  * Normalize one candidate path for matching: Windows separators become
  * forward slashes, surrounding quotes come off, `~` expands to a

package/lib/types/policy.d.ts

@@ -37,10 +37,16 @@ export interface Config {
     remoteImageNeutralization: boolean;
     /** Whether telemetry's `session.cwd` attribute is replaced with a keyed hash. */
     redactTelemetryWorkspacePaths: boolean;
+    /**
+     * Whether a write to a behaviour-changing config path asks the user first.
+     * Needs an approval service; without one the tier abstains rather than
+     * letting an `ask` degrade into a denial.
+     */
+    configWriteAsk: boolean;
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -63,6 +69,7 @@ export interface ResolvedPolicy {
     readonly telemetryRedaction: boolean;
     readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
+    readonly configWriteAsk: boolean;
 }
 /** Thrown when a policy file is malformed or attempts to loosen the policy. */
 export declare class PolicyError extends Error {

package/lib/types/sink.d.ts

@@ -28,7 +28,7 @@ export declare function newDecisionId(): DecisionId;
 /** Payload version carried inside every record this plugin writes. */
 export declare const RECORD_VERSION = 1;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -60,6 +60,12 @@ export interface AuditRecord {
      * instruction is exactly the content this file must not repeat.
      */
     readonly unicode?: Readonly<Record<string, number>>;
+    /**
+     * The single rule behind a decision that has no matched region to describe,
+     * which is every `pre-execute-ask`: the finding is that a path names a
+     * behaviour-changing file, not that any part of it matched a secret.
+     */
+    readonly ruleId?: string;
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
     /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",
@@ -51,10 +51,10 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session-telemetry": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6"
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "3.18.1",