dsh-dlp 0.5.0 → 0.6.0

package/README.md

@@ -27,8 +27,11 @@ built as an out-of-repo plugin.
 7. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
    `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
    prompts rather than controls: they live at `tools/pre-execute` and can be neutralised.
-8. **Writes an audit record for every decision** — rule id, rule version, offsets, keyed hash.
-   Never the secret, never the path or command that matched. `dsh-dlp report` reads it back.
+8. **Writes an audit record for every decision.** A redaction or denial names the rule, its
+   version, the offsets and a keyed hash; the three kinds with no matched region to describe —
+   an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
+   the destination hostname instead. Never the secret, never the path or command that matched.
+   `dsh-dlp report` reads it back.
 
 ## What this is not
 
@@ -44,9 +47,12 @@ Three limits worth knowing before you rely on it:
 - **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
   registered ahead of ours. `ctx.tools.guard()` is order-independent only because it has no allow
   arm.
-- **The shell-command arm is advisory pattern-matching.** It catches an unobfuscated
-  `cat ~/.ssh/id_rsa` and nothing that tries — one glob character, a `$(printf …)` reassembly or
-  `python3 -c` all defeat it, each verified. **Do not count this arm as a control.**
+- **The shell-command arm is advisory pattern-matching.** It tests the whole command line and
+  each of its tokens, so a credential path left *spelled* in the command is caught whatever
+  program would open it: `python3 -c "open('~/.ssh/id_rsa')"` is denied. Changing the spelling
+  defeats it — one glob character, quote-splitting, `find -exec`, a substitution that assembles
+  the path from pieces, a base64 round-trip, each verified. **Do not count this arm as a
+  control.**
 - **Detection is pattern-based.** No entropy rule (measured, not assumed: at a false-positive-free
   threshold the miss rate is 100% below 22 characters). Encoded forms pass. A homoglyph defeats
   every rule in this package.
@@ -108,11 +114,14 @@ switch a pass on. Any downgrade makes the whole file invalid.
 ```sh
 dsh-dlp report                       # everything in the audit sink
 dsh-dlp report --since 24h
-dsh-dlp report --kind guard-deny
+dsh-dlp report --session <id>
+dsh-dlp report --would-have          # everything except the denials
 ```
 
-Every record carries a rule id, rule version, span offsets and a keyed hash — never the matched
-value.
+A redaction or denial record carries a rule id, rule version, span offsets and a keyed hash —
+never the matched value. An ask carries its rule id, a rewritten call the names of the fields
+that changed, and a neutralised remote image the destination hostname in the clear; none of
+those has a matched region to hash.
 
 [Audit record format →](https://charlotten7.github.io/dsh-dlp/audit.html)
 

package/SECURITY.md

@@ -4,12 +4,12 @@
 
 | Version | Supported |
 |---|---|
-| 0.3.x | yes |
-| < 0.3 | no |
+| 0.5.x | yes |
+| < 0.5 | no |
 
-Only the latest published `0.3.x` receives fixes. There is no long-term-support branch while
+Only the latest published `0.5.x` receives fixes. There is no long-term-support branch while
 the package is pre-1.0: each minor supersedes the one before it, and a fix ships as the next
-`0.3.x` patch or, if the minor has already moved on, as the next minor.
+`0.5.x` patch or, if the minor has already moved on, as the next minor.
 
 ## Reporting a vulnerability
 
@@ -32,8 +32,10 @@ This plugin is **not a containment boundary**. It runs in-process at the agent's
 anything the agent can execute can read the same files the guard denies. The following are
 documented limits, not vulnerabilities — they are described in README.md:
 
-- shell-command obfuscation defeating the `bash` path arm (globbing, quoting, substitution, a
-  different binary);
+- shell-command obfuscation defeating the `bash` path arm — anything that stops the path being
+  spelled in the command line: globbing, quote-splitting, `find -exec`, assembling the path
+  from pieces, a base64 round-trip. A command that spells the path is caught whatever program
+  it runs, so that is a gap worth reporting;
 - encoded or split secrets passing both detection tiers;
 - a secret with no recognisable structure going undetected;
 - a secret reaching the provider because it was already in the conversation.

package/lib/approvals.js

@@ -30,7 +30,13 @@ import { isReadOnlyTool } from "./paths.js";
  * for the prompt.
  */
 const SUPPRESSING_TRUE = /^(?:true|yes|on|1)$/;
-/** Values of an approval-mode argument that name the absence of a prompt. */
+/**
+ * Values of an approval-mode argument that name the absence of a prompt.
+ *
+ * One spelling per mode, because the value is normalized the same way the key
+ * is: `full-auto` — which is what Codex writes — `full_auto` and `fullauto`
+ * are one entry rather than three.
+ */
 const SUPPRESSING_MODE = /^(?:auto|autoapprove|autoedit|never|none|bypass|fullauto|yolo)$/;
 /**
  * Arguments that turn off the human confirmation for the call carrying them.
@@ -51,7 +57,7 @@ export const APPROVAL_SUPPRESSION_RULES = [
     // CVE-2026-56075.
     {
         id: 'dsh-dlp/approval-mode-auto',
-        version: 1,
+        version: 2,
         condition: { key: /^approval(?:mode|policy|setting)$/, value: SUPPRESSING_MODE },
         effect: 'an approval mode that approves on the model\'s behalf instead of asking',
     },
@@ -66,25 +72,33 @@ export const APPROVAL_SUPPRESSION_RULES = [
     },
 ];
 /**
- * The spelling one argument key is matched under: lowercase, with the
+ * The spelling one key or value is matched under: lowercase, with the
  * separators that distinguish `non_interactive`, `nonInteractive` and
- * `non-interactive` removed.
- * @param key - the key as the tool declared it.
+ * `non-interactive` — and `full-auto` from `full_auto` — removed.
+ *
+ * Values take the same normalization as keys, and that is the whole reason
+ * `approval_mode: full-auto`, which is the spelling Codex writes, reaches the
+ * table: enumerating the separator variants one at a time only ever covers the
+ * spellings someone already thought of. Every value the rules name is a single
+ * word with no legitimate hyphenated or dotted form, so folding the separators
+ * away cannot pull an ordinary value in — `on-demand` and `ask-every-time`
+ * stay outside the table.
+ * @param text - a key as the tool declared it, or a scalar value it carried.
  * @returns the normalized spelling.
  */
-export function normalizeArgumentKey(key) {
-    return key.toLowerCase().replace(/[_.-]/g, '');
+export function normalizeArgumentToken(text) {
+    return text.toLowerCase().replace(/[_.-]/g, '');
 }
 /**
  * One argument value as a string, for the values a flag can take.
  * @param node - the value under one argument key.
- * @returns the lowercased rendering, or `undefined` for an object or a list.
+ * @returns the normalized rendering, or `undefined` for an object or a list.
  */
 function scalarValue(node) {
     if (typeof node === 'boolean' || typeof node === 'number')
         return String(node);
     if (typeof node === 'string')
-        return node.trim().toLowerCase();
+        return normalizeArgumentToken(node.trim());
     return undefined;
 }
 /** Whether one object carries a key and value the condition describes. */
@@ -121,7 +135,7 @@ export function matchApprovalSuppression(args, rules = APPROVAL_SUPPRESSION_RULE
         for (const [key, value] of Object.entries(node)) {
             const scalar = scalarValue(value);
             if (scalar !== undefined)
-                entries.set(normalizeArgumentKey(key), scalar);
+                entries.set(normalizeArgumentToken(key), scalar);
         }
         found = rules.find(rule => satisfies(entries, rule.condition)
             && (rule.alongside === undefined || satisfies(entries, rule.alongside)));

package/lib/cli.js

@@ -94,9 +94,9 @@ export const USAGE = [
     '  --since <when>   only decisions at or after an ISO timestamp, or a span back',
     '                   from now written as 30m, 24h or 7d',
     '  --session <id>   only decisions from one session',
-    '  --would-have     only the decisions that let the call through: the redactions',
-    '                   and invisible-character findings, which is what a policy that',
-    '                   denied instead of rewriting would have blocked',
+    '  --would-have     leave out the decisions that stopped a call, keeping the',
+    '                   redactions, the invisible-character findings, the asks and',
+    '                   the neutralised images',
     '  -h, --help       print this text',
 ].join('\n');
 /** Milliseconds in one `--since` suffix; {@link parseSince} accepts no other. */
@@ -250,7 +250,7 @@ export function formatReport(records, unreadable, options) {
     if (options.session !== undefined)
         lines.push(`  session ${options.session}`);
     if (options.wouldHave)
-        lines.push('  only decisions that let the call through');
+        lines.push('  decisions that stopped a call left out');
     if (unreadable > 0)
         lines.push(`  ${unreadable} line(s) were not readable as records`);
     if (selected.length === 0)

package/lib/config-writes.js

@@ -51,9 +51,11 @@ export const CONFIG_WRITE_RULES = [
     },
     {
         id: 'dsh-dlp/config-agent-hooks',
-        version: 1,
+        version: 2,
         match: 'path',
-        pattern: /(^|\/)\.(claude|gemini|codex|windsurf|continue)\/hooks(\/|$)/i,
+        // `.cursor` is in the sibling settings rule above and was missing here,
+        // which left one of the six agent directories' hooks unguarded.
+        pattern: /(^|\/)\.(claude|gemini|codex|cursor|windsurf|continue)\/hooks(\/|$)/i,
         effect: 'an agent hook, which runs on a session event without the model asking for it',
     },
     // Copilot reads these without any agent asking it to: VS Code documents

package/lib/paths.js

@@ -40,7 +40,9 @@ export const CREDENTIAL_PATH_RULES = [
     { id: 'dsh-dlp/path-pypirc', version: 1, pattern: /(^|\/)\.pypirc$/i },
     { id: 'dsh-dlp/path-git-credentials', version: 1, pattern: /(^|\/)\.git-credentials$/i },
     { id: 'dsh-dlp/path-gh-config', version: 1, pattern: /(^|\/)\.config\/gh(\/|$)/i },
-    { id: 'dsh-dlp/path-kubeconfig', version: 2, pattern: /(^|\/)(\.kube\/[^/]*|kubeconfig[^/]*)$/i },
+    // `.kube` matches at any depth, like `.aws` and `.azure`: the cached OIDC and
+    // exec-plugin tokens sit under `~/.kube/cache/`, not beside the config file.
+    { id: 'dsh-dlp/path-kubeconfig', version: 3, pattern: /(^|\/)(\.kube(\/|$)|kubeconfig[^/]*$)/i },
     { id: 'dsh-dlp/path-kubernetes-conf', version: 1, pattern: /(^|\/)kubernetes\/[^/]*\.conf$/i },
     { id: 'dsh-dlp/path-docker-config', version: 2, pattern: /(^|\/)(\.docker\/config\.json|\.dockercfg)$/i },
     { id: 'dsh-dlp/path-gcloud-credentials', version: 1, pattern: /(^|\/)\.config\/gcloud\/[^/]*credential[^/]*$/i },
@@ -53,8 +55,10 @@ export const CREDENTIAL_PATH_RULES = [
     // token file whatever else the directory holds.
     { id: 'dsh-dlp/path-agent-auth', version: 1, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/auth\.json$/i },
     // An MCP manifest carries each server's `env`, which is where its API keys
-    // are written.
-    { id: 'dsh-dlp/path-agent-mcp-config', version: 1, pattern: /(^|\/)\.(cursor|windsurf|continue|codex|claude|gemini)\/mcp\.json$/i },
+    // are written. The directory alternation is the one above: an agent that
+    // keeps an `auth.json` keeps its manifest beside it, and Cursor's own
+    // directory is spelled without the dot under `~/.config`.
+    { id: 'dsh-dlp/path-agent-mcp-config', version: 2, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/mcp\.json$/i },
     // Cursor keeps session tokens in a SQLite state database rather than a
     // credential file.
     { id: 'dsh-dlp/path-editor-state-db', version: 1, pattern: /(^|\/)state\.vscdb(-journal|-wal|-shm)?$/i },

package/lib/types/approvals.d.ts

@@ -26,7 +26,7 @@ import type { ToolExecution } from '@deepseek-ai/dsh-tools';
 export interface ArgumentCondition {
     /** Matched against the key lowercased with `_`, `-` and `.` removed. */
     readonly key: RegExp;
-    /** Matched against the value's scalar rendering, lowercased. */
+    /** Matched against the value under the same normalization as the key. */
     readonly value: RegExp;
 }
 /** One argument, or pair of arguments, that suppresses a confirmation. */
@@ -54,13 +54,21 @@ export interface ApprovalSuppressionRule {
  */
 export declare const APPROVAL_SUPPRESSION_RULES: readonly ApprovalSuppressionRule[];
 /**
- * The spelling one argument key is matched under: lowercase, with the
+ * The spelling one key or value is matched under: lowercase, with the
  * separators that distinguish `non_interactive`, `nonInteractive` and
- * `non-interactive` removed.
- * @param key - the key as the tool declared it.
+ * `non-interactive` — and `full-auto` from `full_auto` — removed.
+ *
+ * Values take the same normalization as keys, and that is the whole reason
+ * `approval_mode: full-auto`, which is the spelling Codex writes, reaches the
+ * table: enumerating the separator variants one at a time only ever covers the
+ * spellings someone already thought of. Every value the rules name is a single
+ * word with no legitimate hyphenated or dotted form, so folding the separators
+ * away cannot pull an ordinary value in — `on-demand` and `ask-every-time`
+ * stay outside the table.
+ * @param text - a key as the tool declared it, or a scalar value it carried.
  * @returns the normalized spelling.
  */
-export declare function normalizeArgumentKey(key: string): string;
+export declare function normalizeArgumentToken(text: string): string;
 /**
  * The first rule any object inside the arguments satisfies.
  *

package/lib/types/cli.d.ts

@@ -36,7 +36,7 @@ export interface ReportOptions {
     /** Epoch milliseconds; records before it are left out. */
     readonly since?: number;
     readonly session?: string;
-    /** Keep only the decisions that let the call through. */
+    /** Leave out the decisions that stopped a call; see {@link DENYING_KINDS}. */
     readonly wouldHave: boolean;
 }
 /** The outcome of reading the command line. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",