dsh-dlp 0.4.1 → 0.6.0

package/README.md

@@ -20,11 +20,18 @@ built as an out-of-repo plugin.
 5. **Neutralises remote markdown images in assistant output** and detects a tool call another
    plugin rewrote after the session log recorded it.
 6. **Asks before the agent writes a file that changes future behaviour** — agent settings and
-   hooks, `CLAUDE.md`, `.cursor/rules/**`, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI
-   workflows, shell startup files — and before it writes a `*_BASE_URL` that would redirect a
-   provider credential.
-7. **Writes an audit record for every decision** — rule id, rule version, offsets, keyed hash.
-   Never the secret, never the path or command that matched. `dsh-dlp report` reads it back.
+   hooks, `CLAUDE.md`, `.claude/rules/**` and the other agent rules directories, prompt
+   templates, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI workflows, shell startup files,
+   `pnpm-workspace.yaml` — and before it writes a `*_BASE_URL` that would redirect a provider
+   credential.
+7. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
+   `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
+   prompts rather than controls: they live at `tools/pre-execute` and can be neutralised.
+8. **Writes an audit record for every decision.** A redaction or denial names the rule, its
+   version, the offsets and a keyed hash; the three kinds with no matched region to describe —
+   an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
+   the destination hostname instead. Never the secret, never the path or command that matched.
+   `dsh-dlp report` reads it back.
 
 ## What this is not
 
@@ -40,9 +47,12 @@ Three limits worth knowing before you rely on it:
 - **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
   registered ahead of ours. `ctx.tools.guard()` is order-independent only because it has no allow
   arm.
-- **The shell-command arm is advisory pattern-matching.** It catches an unobfuscated
-  `cat ~/.ssh/id_rsa` and nothing that tries — one glob character, a `$(printf …)` reassembly or
-  `python3 -c` all defeat it, each verified. **Do not count this arm as a control.**
+- **The shell-command arm is advisory pattern-matching.** It tests the whole command line and
+  each of its tokens, so a credential path left *spelled* in the command is caught whatever
+  program would open it: `python3 -c "open('~/.ssh/id_rsa')"` is denied. Changing the spelling
+  defeats it — one glob character, quote-splitting, `find -exec`, a substitution that assembles
+  the path from pieces, a base64 round-trip, each verified. **Do not count this arm as a
+  control.**
 - **Detection is pattern-based.** No entropy rule (measured, not assumed: at a false-positive-free
   threshold the miss rate is 100% below 22 characters). Encoded forms pass. A homoglyph defeats
   every rule in this package.
@@ -83,6 +93,7 @@ load.
     resultRedaction: true
     telemetryRedaction: true
     configWriteAsk: true
+    approvalSuppressionAsk: true
 ```
 
 `redactionKeyFile` is created on first mount with 32 random bytes at mode `0600`. Keep it out of
@@ -103,11 +114,14 @@ switch a pass on. Any downgrade makes the whole file invalid.
 ```sh
 dsh-dlp report                       # everything in the audit sink
 dsh-dlp report --since 24h
-dsh-dlp report --kind guard-deny
+dsh-dlp report --session <id>
+dsh-dlp report --would-have          # everything except the denials
 ```
 
-Every record carries a rule id, rule version, span offsets and a keyed hash — never the matched
-value.
+A redaction or denial record carries a rule id, rule version, span offsets and a keyed hash —
+never the matched value. An ask carries its rule id, a rewritten call the names of the fields
+that changed, and a neutralised remote image the destination hostname in the clear; none of
+those has a matched region to hash.
 
 [Audit record format →](https://charlotten7.github.io/dsh-dlp/audit.html)
 

package/SECURITY.md

@@ -4,12 +4,12 @@
 
 | Version | Supported |
 |---|---|
-| 0.3.x | yes |
-| < 0.3 | no |
+| 0.5.x | yes |
+| < 0.5 | no |
 
-Only the latest published `0.3.x` receives fixes. There is no long-term-support branch while
+Only the latest published `0.5.x` receives fixes. There is no long-term-support branch while
 the package is pre-1.0: each minor supersedes the one before it, and a fix ships as the next
-`0.3.x` patch or, if the minor has already moved on, as the next minor.
+`0.5.x` patch or, if the minor has already moved on, as the next minor.
 
 ## Reporting a vulnerability
 
@@ -32,8 +32,10 @@ This plugin is **not a containment boundary**. It runs in-process at the agent's
 anything the agent can execute can read the same files the guard denies. The following are
 documented limits, not vulnerabilities — they are described in README.md:
 
-- shell-command obfuscation defeating the `bash` path arm (globbing, quoting, substitution, a
-  different binary);
+- shell-command obfuscation defeating the `bash` path arm — anything that stops the path being
+  spelled in the command line: globbing, quote-splitting, `find -exec`, assembling the path
+  from pieces, a base64 round-trip. A command that spells the path is caught whatever program
+  it runs, so that is a gap worth reporting;
 - encoded or split secrets passing both detection tiers;
 - a secret with no recognisable structure going undetected;
 - a secret reaching the provider because it was already in the conversation.

package/cordis.patch.yml

@@ -22,3 +22,4 @@
         remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true
         configWriteAsk: true
+        approvalSuppressionAsk: true

package/lib/approvals.js

@@ -0,0 +1,177 @@
+/**
+ * The `ask` tier's second rule class: a tool argument whose effect is to switch
+ * off the confirmation for the call carrying it.
+ *
+ * Three 2026 advisories are the same technique. CVE-2026-18733 is
+ * `non_interactive: true`; CVE-2026-53808 is `apply: true` while
+ * `approvalPolicy` is still `pending`; CVE-2026-56075 is
+ * `approval_mode: auto`. In each one the model composes an argument that
+ * removes the human from that call, and nothing about the file paths or the
+ * secrets involved says so.
+ *
+ * This is not the mutation check in `mutation.ts` and not the neutralizable
+ * seam of the guard floor. Those are about *this plugin's* decision being
+ * deleted by something else in the process. This is the model asking a tool to
+ * skip the tool's *own* prompt, which every one of those seams would let
+ * through as an ordinary, unmodified, secret-free call.
+ *
+ * It is an `ask` and deliberately not a denial, for the reason the write side
+ * is: `non_interactive` also means "no TTY" on plenty of ordinary programs, the
+ * tool registry is open, and an unoverridable denial on an argument name is a
+ * false denial nobody can work around. ADR.md records the whole weighing.
+ * @module dsh-dlp/approvals
+ */
+import { isReadOnlyTool } from "./paths.js";
+/**
+ * Values that mean the confirmation does not happen.
+ *
+ * Only the affirmative spellings: `false`, `0` and `no` leave the prompt in
+ * place, and a rule that fired on them would prompt on the argument that asks
+ * for the prompt.
+ */
+const SUPPRESSING_TRUE = /^(?:true|yes|on|1)$/;
+/**
+ * Values of an approval-mode argument that name the absence of a prompt.
+ *
+ * One spelling per mode, because the value is normalized the same way the key
+ * is: `full-auto` — which is what Codex writes — `full_auto` and `fullauto`
+ * are one entry rather than three.
+ */
+const SUPPRESSING_MODE = /^(?:auto|autoapprove|autoedit|never|none|bypass|fullauto|yolo)$/;
+/**
+ * Arguments that turn off the human confirmation for the call carrying them.
+ *
+ * Matched by argument name and value, at any depth of the arguments object,
+ * never against the filesystem and never against the tool's name: the registry
+ * is open, so a table keyed on tool names would abstain on every MCP tool this
+ * build has never heard of — which is where these arguments live.
+ */
+export const APPROVAL_SUPPRESSION_RULES = [
+    // CVE-2026-18733.
+    {
+        id: 'dsh-dlp/approval-non-interactive',
+        version: 1,
+        condition: { key: /^noninteractive$/, value: SUPPRESSING_TRUE },
+        effect: 'a non-interactive flag, which runs the call without the confirmation it would otherwise ask for',
+    },
+    // CVE-2026-56075.
+    {
+        id: 'dsh-dlp/approval-mode-auto',
+        version: 2,
+        condition: { key: /^approval(?:mode|policy|setting)$/, value: SUPPRESSING_MODE },
+        effect: 'an approval mode that approves on the model\'s behalf instead of asking',
+    },
+    // CVE-2026-53808: applying while the approval for that change is still
+    // pending is what skips the decision, so neither half is a finding alone.
+    {
+        id: 'dsh-dlp/approval-apply-pending',
+        version: 1,
+        condition: { key: /^apply$/, value: SUPPRESSING_TRUE },
+        alongside: { key: /^approvalpolicy$/, value: /^pending$/ },
+        effect: 'an instruction to apply a change whose approval is still pending, which commits it before the answer',
+    },
+];
+/**
+ * The spelling one key or value is matched under: lowercase, with the
+ * separators that distinguish `non_interactive`, `nonInteractive` and
+ * `non-interactive` — and `full-auto` from `full_auto` — removed.
+ *
+ * Values take the same normalization as keys, and that is the whole reason
+ * `approval_mode: full-auto`, which is the spelling Codex writes, reaches the
+ * table: enumerating the separator variants one at a time only ever covers the
+ * spellings someone already thought of. Every value the rules name is a single
+ * word with no legitimate hyphenated or dotted form, so folding the separators
+ * away cannot pull an ordinary value in — `on-demand` and `ask-every-time`
+ * stay outside the table.
+ * @param text - a key as the tool declared it, or a scalar value it carried.
+ * @returns the normalized spelling.
+ */
+export function normalizeArgumentToken(text) {
+    return text.toLowerCase().replace(/[_.-]/g, '');
+}
+/**
+ * One argument value as a string, for the values a flag can take.
+ * @param node - the value under one argument key.
+ * @returns the normalized rendering, or `undefined` for an object or a list.
+ */
+function scalarValue(node) {
+    if (typeof node === 'boolean' || typeof node === 'number')
+        return String(node);
+    if (typeof node === 'string')
+        return normalizeArgumentToken(node.trim());
+    return undefined;
+}
+/** Whether one object carries a key and value the condition describes. */
+function satisfies(entries, condition) {
+    for (const [key, value] of entries) {
+        if (condition.key.test(key) && condition.value.test(value))
+            return true;
+    }
+    return false;
+}
+/**
+ * The first rule any object inside the arguments satisfies.
+ *
+ * Both halves of a two-part rule must sit on the *same* object: an `apply` in
+ * one element of a batch and an `approvalPolicy` in another are two different
+ * requests, and pairing them across objects would report a call nobody made.
+ * @param args - the pending call's parsed arguments.
+ * @param rules - the rule table; defaults to {@link APPROVAL_SUPPRESSION_RULES}.
+ * @returns the first matching rule, or `undefined`.
+ */
+export function matchApprovalSuppression(args, rules = APPROVAL_SUPPRESSION_RULES) {
+    let found;
+    const walk = (node) => {
+        if (found !== undefined)
+            return;
+        if (Array.isArray(node)) {
+            for (const item of node)
+                walk(item);
+            return;
+        }
+        if (typeof node !== 'object' || node === null)
+            return;
+        const entries = new Map();
+        for (const [key, value] of Object.entries(node)) {
+            const scalar = scalarValue(value);
+            if (scalar !== undefined)
+                entries.set(normalizeArgumentToken(key), scalar);
+        }
+        found = rules.find(rule => satisfies(entries, rule.condition)
+            && (rule.alongside === undefined || satisfies(entries, rule.alongside)));
+        if (found !== undefined)
+            return;
+        for (const value of Object.values(node))
+            walk(value);
+    };
+    walk(args);
+    return found;
+}
+/**
+ * Prompt text for one approval-suppressing argument.
+ *
+ * The argument's own value is not quoted, for the reason the write side does
+ * not quote a path: this string is model-visible, and what the user needs in
+ * order to answer is which tool, which rule, and what the argument does.
+ */
+function approvalSuppressionReason(toolName, rule) {
+    return `dsh-dlp is asking before ${JSON.stringify(toolName)} runs with ${rule.effect} (rule ${rule.id}). `
+        + 'The call carries an argument that turns off the confirmation for this call, so the prompt you would '
+        + 'normally see is this one. Approve it if you asked for an unattended run; decline it if you did not.';
+}
+/**
+ * Decide whether one call suppresses its own confirmation.
+ *
+ * A tool {@link isReadOnlyTool} classifies as query-only is left alone: it has
+ * nothing to confirm, so an argument switching a confirmation off changes
+ * nothing there.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link APPROVAL_SUPPRESSION_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export function evaluateApprovalSuppression(exec, rules = APPROVAL_SUPPRESSION_RULES) {
+    if (isReadOnlyTool(exec.name))
+        return undefined;
+    const rule = matchApprovalSuppression(exec.arguments, rules);
+    return rule === undefined ? undefined : { rule, reason: approvalSuppressionReason(exec.name, rule) };
+}

package/lib/cli.js

@@ -94,9 +94,9 @@ export const USAGE = [
     '  --since <when>   only decisions at or after an ISO timestamp, or a span back',
     '                   from now written as 30m, 24h or 7d',
     '  --session <id>   only decisions from one session',
-    '  --would-have     only the decisions that let the call through: the redactions',
-    '                   and invisible-character findings, which is what a policy that',
-    '                   denied instead of rewriting would have blocked',
+    '  --would-have     leave out the decisions that stopped a call, keeping the',
+    '                   redactions, the invisible-character findings, the asks and',
+    '                   the neutralised images',
     '  -h, --help       print this text',
 ].join('\n');
 /** Milliseconds in one `--since` suffix; {@link parseSince} accepts no other. */
@@ -250,7 +250,7 @@ export function formatReport(records, unreadable, options) {
     if (options.session !== undefined)
         lines.push(`  session ${options.session}`);
     if (options.wouldHave)
-        lines.push('  only decisions that let the call through');
+        lines.push('  decisions that stopped a call left out');
     if (unreadable > 0)
         lines.push(`  ${unreadable} line(s) were not readable as records`);
     if (selected.length === 0)

package/lib/config-writes.js

@@ -31,6 +31,11 @@ import { nestedStrings } from "./redaction.js";
  * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
  * CVE-2025-59041.
  *
+ * The file is the whole payload, which is why this tier watches the write
+ * rather than a later execution: the keyv/cacheable compromise of 2026-08-04
+ * placed a `SessionStart` hook in `.claude/settings.json` and was reported to
+ * need no `npm install` to take effect.
+ *
  * The rules match by name, never by what is on disk, so a file the call is
  * about to *create* is matched exactly like one it would change:
  * CVE-2026-25725 worked precisely because the path did not exist yet and was
@@ -46,25 +51,55 @@ export const CONFIG_WRITE_RULES = [
     },
     {
         id: 'dsh-dlp/config-agent-hooks',
-        version: 1,
+        version: 2,
         match: 'path',
-        pattern: /(^|\/)\.(claude|gemini|codex|windsurf|continue)\/hooks(\/|$)/i,
+        // `.cursor` is in the sibling settings rule above and was missing here,
+        // which left one of the six agent directories' hooks unguarded.
+        pattern: /(^|\/)\.(claude|gemini|codex|cursor|windsurf|continue)\/hooks(\/|$)/i,
         effect: 'an agent hook, which runs on a session event without the model asking for it',
     },
+    // Copilot reads these without any agent asking it to: VS Code documents
+    // `.github/copilot-instructions.md` and every `.github/instructions/**.md`
+    // as workspace instruction files it applies on its own. They are separate
+    // from `config-ci-workflow`, which governs what CI *runs* rather than what a
+    // model is told.
     {
-        id: 'dsh-dlp/config-agent-instructions',
+        id: 'dsh-dlp/config-copilot-instructions',
         version: 1,
         match: 'path',
-        pattern: /(^|\/)(CLAUDE|AGENTS|GEMINI|\.cursorrules|\.windsurfrules)(\.md)?$/i,
+        pattern: /(^|\/)\.github\/(copilot-instructions\.md$|instructions\/)/i,
+        effect: 'standing instructions the editor feeds to every future session',
+    },
+    {
+        id: 'dsh-dlp/config-agent-instructions',
+        version: 2,
+        // `CLAUDE.local.md` is the personal, git-ignored companion to `CLAUDE.md`
+        // and is read the same way, so covering one and not the other left the
+        // quieter of the two files unguarded.
+        pattern: /(^|\/)(CLAUDE(\.local)?|AGENTS|GEMINI|\.cursorrules|\.windsurfrules)(\.md)?$/i,
+        match: 'path',
         effect: 'standing instructions every future session in this repository reads',
     },
+    // `.claude/rules` belongs beside the other three: VS Code lists it as a
+    // workspace instruction location it detects and applies on its own
+    // ("Workspace (Claude format) `.claude/rules` folder"), so it is loaded by an
+    // editor a developer never configured for Claude.
     {
         id: 'dsh-dlp/config-agent-rules',
-        version: 1,
+        version: 2,
         match: 'path',
-        pattern: /(^|\/)\.(cursor|windsurf|continue)\/rules(\/|$)/i,
+        pattern: /(^|\/)\.(claude|cursor|windsurf|continue)\/rules(\/|$)/i,
         effect: 'an always-apply rules file every future session in this repository reads',
     },
+    // CVE-2026-46580. A prompt template is loaded into a later session the same
+    // way a rules file is, and the extension is what marks it for loading.
+    {
+        id: 'dsh-dlp/config-prompt-template',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)\.prompts\/.*\.prompttemplate$/i,
+        effect: 'a prompt template a later session loads without the model asking for it',
+    },
     {
         id: 'dsh-dlp/config-mcp-manifest',
         version: 1,
@@ -114,6 +149,23 @@ export const CONFIG_WRITE_RULES = [
         pattern: /(^|\/)cordis[^/]*\.ya?ml$/i,
         effect: 'a harness bundle manifest, which decides which plugins load',
     },
+    // pnpm reads `registry`, `registries` and `namedRegistries` from
+    // `pnpm-workspace.yaml`, so the file decides which host the next install
+    // downloads packages from. pnpm's own documentation treats it as
+    // attacker-controlled for exactly that reason: since v11.5.3 it refuses to
+    // expand `${...}` in those settings, "Because `pnpm-workspace.yaml` is
+    // committed to the repository, expanding env variables in registry URLs could
+    // be exploited by a malicious repository to leak secrets from the environment
+    // to an attacker-controlled registry." A literal hostile URL is still obeyed.
+    // The `.npmrc` half of the same technique needs no rule here: it is on the
+    // guard floor as `dsh-dlp/path-npmrc`, where every call is denied.
+    {
+        id: 'dsh-dlp/config-pnpm-workspace',
+        version: 1,
+        match: 'path',
+        pattern: /(^|\/)pnpm-workspace\.ya?ml$/i,
+        effect: 'the pnpm workspace settings, which decide the registry the next install downloads packages from',
+    },
     // CVE-2026-21852: a repo-local settings file setting `ANTHROPIC_BASE_URL`
     // sends the user's own API key to whatever host it names. This is neither a
     // path nor a secret — it is a key whose *value* redirects a credential — so

package/lib/detectors.js

@@ -64,7 +64,29 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/google-oauth-client-secret', version: 1, severity: 'critical', pattern: /\bGOCSPX-[A-Za-z0-9_-]{24,}/g },
     { id: 'dsh-dlp/databricks-token', version: 1, severity: 'critical', pattern: /\bdapi[0-9a-f]{32}(?:-\d+)?\b/g },
     { id: 'dsh-dlp/sendgrid-api-key', version: 1, severity: 'critical', pattern: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+    // Supabase's `sbp_` format is superseded but not retired: the platform's own
+    // deprecation notice for the keys it replaces says they "will be deprecated
+    // by the end of 2026", so a credential in this format is still live and a
+    // rule matching it still fires on something. Removing it would also make
+    // every audit record already carrying this rule id uninterpretable.
     { id: 'dsh-dlp/supabase-service-key', version: 1, severity: 'critical', pattern: /\bsbp_[0-9a-f]{40}\b/g },
+    // The current format. Supabase documents the prefixes (`sb_publishable_...`,
+    // `sb_secret_...`) but not the suffix, so the rule anchors on the documented
+    // prefix and requires enough base64url characters to exclude prose: the keys
+    // shown in the announcement discussion carry a 22-character body, a `_`, and
+    // a checksum. `sb_publishable_` is deliberately absent — it is the
+    // browser-facing replacement for `anon` and is meant to be published, the
+    // same reason this table matches Stripe's `sk_live_` and not `pk_live_`.
+    { id: 'dsh-dlp/supabase-secret-key', version: 1, severity: 'critical', pattern: /\bsb_secret_[A-Za-z0-9_-]{16,}/g },
+    // Cloudflare's scannable format, from the provider's own table: "Each
+    // credential type has a distinct prefix followed by 40 characters and a
+    // checksum" — `cfk_` for a Global API Key, `cfut_` for a User API Token,
+    // `cfat_` for an Account API Token. The checksum's length and character set
+    // are not published, so the rule requires the documented 40 and lets the
+    // match run to the end of the token. The legacy formats are a bare
+    // 40-character alphanumeric string and a 37-45 character hex string, neither
+    // of which is prefix-anchored and both of which are therefore tier 2's.
+    { id: 'dsh-dlp/cloudflare-api-token', version: 1, severity: 'critical', pattern: /\bcf(?:ut|at|k)_[A-Za-z0-9_-]{40,}/g },
     { id: 'dsh-dlp/notion-token', version: 1, severity: 'critical', pattern: /\bntn_[A-Za-z0-9]{40,}/g },
     { id: 'dsh-dlp/private-key-block', version: 1, severity: 'critical', pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g },
     { id: 'dsh-dlp/json-web-token', version: 1, severity: 'high', pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },

package/lib/index.js

@@ -9,10 +9,11 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
- * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
- *    config paths. Deliberately here rather than on the floor: its rules have a
- *    real false-positive rate and the floor cannot ask. Neutralizable, and it
- *    abstains entirely when no approval service is mounted.
+ * 2b. `tools/pre-execute` — the `ask` tier, for writes to behaviour-changing
+ *    config paths and for calls carrying an argument that switches their own
+ *    confirmation off. Deliberately here rather than on the floor: its rules
+ *    have a real false-positive rate and the floor cannot ask. Neutralizable,
+ *    and it abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
@@ -41,6 +42,7 @@ import { safeEvaluateGuard } from "./guard.js";
 import { neutralizeImageStream } from "./images.js";
 import { ExecutionSnapshots, mutationReason } from "./mutation.js";
 import { evaluateConfigWrite } from "./config-writes.js";
+import { evaluateApprovalSuppression } from "./approvals.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
@@ -251,11 +253,12 @@ export function apply(ctx, config) {
         if (approvalSeamReported)
             return;
         approvalSeamReported = true;
-        notice(ctx, 'dsh-dlp: configWriteAsk is enabled, but no approval service is mounted, so an ask would degrade'
-            + ' to a denial. This tier abstains instead: a write to a behaviour-changing config path is allowed through'
+        notice(ctx, 'dsh-dlp: the ask tier (configWriteAsk, approvalSuppressionAsk) is enabled, but no approval service'
+            + ' is mounted, so an ask would degrade to a denial. This tier abstains instead: a write to a'
+            + ' behaviour-changing config path, and a call that switches its own confirmation off, are allowed through'
             + ' with no prompt. The guard floor is unaffected.');
     };
-    if (policy.configWriteAsk) {
+    if (policy.configWriteAsk || policy.approvalSuppressionAsk) {
         // Registered ahead of the breadth tier, so a call that is both a config
         // write and carries a secret is denied rather than merely asked about:
         // this listener sees whatever the rest of the waterfall settled on and
@@ -264,7 +267,11 @@ export function apply(ctx, config) {
             const decision = await next();
             if (decision.kind !== 'allow')
                 return decision;
-            const finding = evaluateConfigWrite(exec);
+            // The argument that switches a confirmation off is reported ahead of the
+            // file it would write: it describes the call itself rather than what the
+            // call touches, and it is the one the user has least reason to expect.
+            const finding = (policy.approvalSuppressionAsk ? evaluateApprovalSuppression(exec) : undefined)
+                ?? (policy.configWriteAsk ? evaluateConfigWrite(exec) : undefined);
             if (finding === undefined)
                 return decision;
             // A call the floor will deny anyway is left to the floor. Any non-allow

package/lib/paths.js

@@ -40,7 +40,9 @@ export const CREDENTIAL_PATH_RULES = [
     { id: 'dsh-dlp/path-pypirc', version: 1, pattern: /(^|\/)\.pypirc$/i },
     { id: 'dsh-dlp/path-git-credentials', version: 1, pattern: /(^|\/)\.git-credentials$/i },
     { id: 'dsh-dlp/path-gh-config', version: 1, pattern: /(^|\/)\.config\/gh(\/|$)/i },
-    { id: 'dsh-dlp/path-kubeconfig', version: 2, pattern: /(^|\/)(\.kube\/[^/]*|kubeconfig[^/]*)$/i },
+    // `.kube` matches at any depth, like `.aws` and `.azure`: the cached OIDC and
+    // exec-plugin tokens sit under `~/.kube/cache/`, not beside the config file.
+    { id: 'dsh-dlp/path-kubeconfig', version: 3, pattern: /(^|\/)(\.kube(\/|$)|kubeconfig[^/]*$)/i },
     { id: 'dsh-dlp/path-kubernetes-conf', version: 1, pattern: /(^|\/)kubernetes\/[^/]*\.conf$/i },
     { id: 'dsh-dlp/path-docker-config', version: 2, pattern: /(^|\/)(\.docker\/config\.json|\.dockercfg)$/i },
     { id: 'dsh-dlp/path-gcloud-credentials', version: 1, pattern: /(^|\/)\.config\/gcloud\/[^/]*credential[^/]*$/i },
@@ -53,8 +55,10 @@ export const CREDENTIAL_PATH_RULES = [
     // token file whatever else the directory holds.
     { id: 'dsh-dlp/path-agent-auth', version: 1, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/auth\.json$/i },
     // An MCP manifest carries each server's `env`, which is where its API keys
-    // are written.
-    { id: 'dsh-dlp/path-agent-mcp-config', version: 1, pattern: /(^|\/)\.(cursor|windsurf|continue|codex|claude|gemini)\/mcp\.json$/i },
+    // are written. The directory alternation is the one above: an agent that
+    // keeps an `auth.json` keeps its manifest beside it, and Cursor's own
+    // directory is spelled without the dot under `~/.config`.
+    { id: 'dsh-dlp/path-agent-mcp-config', version: 2, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/mcp\.json$/i },
     // Cursor keeps session tokens in a SQLite state database rather than a
     // credential file.
     { id: 'dsh-dlp/path-editor-state-db', version: 1, pattern: /(^|\/)state\.vscdb(-journal|-wal|-shm)?$/i },

package/lib/policy.js

@@ -33,6 +33,7 @@ export const Config = z.object({
     remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
     configWriteAsk: z.boolean().default(true),
+    approvalSuppressionAsk: z.boolean().default(true),
 });
 /** Config toggles a repo-local policy may switch on, and never off. */
 const ENABLEABLE = [
@@ -42,6 +43,7 @@ const ENABLEABLE = [
     'remoteImageNeutralization',
     'redactTelemetryWorkspacePaths',
     'configWriteAsk',
+    'approvalSuppressionAsk',
 ];
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
@@ -284,5 +286,6 @@ export function resolvePolicy(config, repo) {
         remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
         configWriteAsk: enabled('configWriteAsk'),
+        approvalSuppressionAsk: enabled('approvalSuppressionAsk'),
     };
 }

package/lib/types/approvals.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The `ask` tier's second rule class: a tool argument whose effect is to switch
+ * off the confirmation for the call carrying it.
+ *
+ * Three 2026 advisories are the same technique. CVE-2026-18733 is
+ * `non_interactive: true`; CVE-2026-53808 is `apply: true` while
+ * `approvalPolicy` is still `pending`; CVE-2026-56075 is
+ * `approval_mode: auto`. In each one the model composes an argument that
+ * removes the human from that call, and nothing about the file paths or the
+ * secrets involved says so.
+ *
+ * This is not the mutation check in `mutation.ts` and not the neutralizable
+ * seam of the guard floor. Those are about *this plugin's* decision being
+ * deleted by something else in the process. This is the model asking a tool to
+ * skip the tool's *own* prompt, which every one of those seams would let
+ * through as an ordinary, unmodified, secret-free call.
+ *
+ * It is an `ask` and deliberately not a denial, for the reason the write side
+ * is: `non_interactive` also means "no TTY" on plenty of ordinary programs, the
+ * tool registry is open, and an unoverridable denial on an argument name is a
+ * false denial nobody can work around. ADR.md records the whole weighing.
+ * @module dsh-dlp/approvals
+ */
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+/** One argument key and the value that makes it a finding. */
+export interface ArgumentCondition {
+    /** Matched against the key lowercased with `_`, `-` and `.` removed. */
+    readonly key: RegExp;
+    /** Matched against the value under the same normalization as the key. */
+    readonly value: RegExp;
+}
+/** One argument, or pair of arguments, that suppresses a confirmation. */
+export interface ApprovalSuppressionRule {
+    readonly id: string;
+    readonly version: number;
+    readonly condition: ArgumentCondition;
+    /**
+     * A second pair that must be present on the same object for the rule to
+     * fire. `apply: true` on its own is how half the infrastructure tools in
+     * existence are driven; it is the pending approval beside it that makes the
+     * call skip a decision someone else had not made yet.
+     */
+    readonly alongside?: ArgumentCondition;
+    /** What the argument does, quoted in the prompt the user answers. */
+    readonly effect: string;
+}
+/**
+ * Arguments that turn off the human confirmation for the call carrying them.
+ *
+ * Matched by argument name and value, at any depth of the arguments object,
+ * never against the filesystem and never against the tool's name: the registry
+ * is open, so a table keyed on tool names would abstain on every MCP tool this
+ * build has never heard of — which is where these arguments live.
+ */
+export declare const APPROVAL_SUPPRESSION_RULES: readonly ApprovalSuppressionRule[];
+/**
+ * The spelling one key or value is matched under: lowercase, with the
+ * separators that distinguish `non_interactive`, `nonInteractive` and
+ * `non-interactive` — and `full-auto` from `full_auto` — removed.
+ *
+ * Values take the same normalization as keys, and that is the whole reason
+ * `approval_mode: full-auto`, which is the spelling Codex writes, reaches the
+ * table: enumerating the separator variants one at a time only ever covers the
+ * spellings someone already thought of. Every value the rules name is a single
+ * word with no legitimate hyphenated or dotted form, so folding the separators
+ * away cannot pull an ordinary value in — `on-demand` and `ask-every-time`
+ * stay outside the table.
+ * @param text - a key as the tool declared it, or a scalar value it carried.
+ * @returns the normalized spelling.
+ */
+export declare function normalizeArgumentToken(text: string): string;
+/**
+ * The first rule any object inside the arguments satisfies.
+ *
+ * Both halves of a two-part rule must sit on the *same* object: an `apply` in
+ * one element of a batch and an `approvalPolicy` in another are two different
+ * requests, and pairing them across objects would report a call nobody made.
+ * @param args - the pending call's parsed arguments.
+ * @param rules - the rule table; defaults to {@link APPROVAL_SUPPRESSION_RULES}.
+ * @returns the first matching rule, or `undefined`.
+ */
+export declare function matchApprovalSuppression(args: unknown, rules?: readonly ApprovalSuppressionRule[]): ApprovalSuppressionRule | undefined;
+/** A call this tier wants a human to confirm, because the call asked not to be. */
+export interface ApprovalSuppressionFinding {
+    readonly rule: ApprovalSuppressionRule;
+    /** Model- and user-facing text; names the tool, the rule and what the argument does. */
+    readonly reason: string;
+}
+/**
+ * Decide whether one call suppresses its own confirmation.
+ *
+ * A tool {@link isReadOnlyTool} classifies as query-only is left alone: it has
+ * nothing to confirm, so an argument switching a confirmation off changes
+ * nothing there.
+ * @param exec - the pending call.
+ * @param rules - the rule table; defaults to {@link APPROVAL_SUPPRESSION_RULES}.
+ * @returns the finding, or `undefined` to leave the call alone.
+ */
+export declare function evaluateApprovalSuppression(exec: Pick<ToolExecution, 'name' | 'arguments'>, rules?: readonly ApprovalSuppressionRule[]): ApprovalSuppressionFinding | undefined;
+//# sourceMappingURL=approvals.d.ts.map

package/lib/types/cli.d.ts

@@ -36,7 +36,7 @@ export interface ReportOptions {
     /** Epoch milliseconds; records before it are left out. */
     readonly since?: number;
     readonly session?: string;
-    /** Keep only the decisions that let the call through. */
+    /** Leave out the decisions that stopped a call; see {@link DENYING_KINDS}. */
     readonly wouldHave: boolean;
 }
 /** The outcome of reading the command line. */

package/lib/types/config-writes.d.ts

@@ -45,6 +45,11 @@ export interface ConfigWriteRule {
  * CVE-2026-25725, CVE-2026-33068, CVE-2026-48124, CVE-2026-26268 and
  * CVE-2025-59041.
  *
+ * The file is the whole payload, which is why this tier watches the write
+ * rather than a later execution: the keyv/cacheable compromise of 2026-08-04
+ * placed a `SessionStart` hook in `.claude/settings.json` and was reported to
+ * need no `npm install` to take effect.
+ *
  * The rules match by name, never by what is on disk, so a file the call is
  * about to *create* is matched exactly like one it would change:
  * CVE-2026-25725 worked precisely because the path did not exist yet and was

package/lib/types/index.d.ts

@@ -9,10 +9,11 @@
  *    has no allow arm.
  * 2. `tools/pre-execute` — the async breadth tier, which can await
  *    `@secretlint/core`. Neutralizable by any listener registered ahead of it.
- * 2b. `tools/pre-execute` — the `ask` tier for writes to behaviour-changing
- *    config paths. Deliberately here rather than on the floor: its rules have a
- *    real false-positive rate and the floor cannot ask. Neutralizable, and it
- *    abstains entirely when no approval service is mounted.
+ * 2b. `tools/pre-execute` — the `ask` tier, for writes to behaviour-changing
+ *    config paths and for calls carrying an argument that switches their own
+ *    confirmation off. Deliberately here rather than on the floor: its rules
+ *    have a real false-positive rate and the floor cannot ask. Neutralizable,
+ *    and it abstains entirely when no approval service is mounted.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.

package/lib/types/policy.d.ts

@@ -43,10 +43,16 @@ export interface Config {
      * letting an `ask` degrade into a denial.
      */
     configWriteAsk: boolean;
+    /**
+     * Whether a call carrying an argument that switches its own confirmation off
+     * asks the user first. Shares the `ask` tier, and its approval service, with
+     * {@link Config.configWriteAsk}.
+     */
+    approvalSuppressionAsk: boolean;
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk", "approvalSuppressionAsk"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -70,6 +76,7 @@ export interface ResolvedPolicy {
     readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
     readonly configWriteAsk: boolean;
+    readonly approvalSuppressionAsk: boolean;
 }
 /** Thrown when a policy file is malformed or attempts to loosen the policy. */
 export declare class PolicyError extends Error {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",