dsh-dlp 0.6.0 → 0.8.0

package/README.md

@@ -26,7 +26,9 @@ built as an out-of-repo plugin.
    credential.
 7. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
    `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
-   prompts rather than controls: they live at `tools/pre-execute` and can be neutralised.
+   prompts rather than controls: they live at `tools/pre-execute`, they can be neutralised, and
+   they abstain wherever the approval seam prompts nobody — which includes every install under
+   `DSH_PERMISSION_MODE=danger-full-access` and a stock headless install under any mode.
 8. **Writes an audit record for every decision.** A redaction or denial names the rule, its
    version, the offsets and a keyed hash; the three kinds with no matched region to describe —
    an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
@@ -46,16 +48,18 @@ Three limits worth knowing before you rely on it:
 
 - **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
   registered ahead of ours. `ctx.tools.guard()` is order-independent only because it has no allow
-  arm.
+  arm. Result redaction registers with `{ prepend: true }` so it gets the last word over
+  listeners already registered — but a listener registering after it with the same option lands
+  ahead of it again.
 - **The shell-command arm is advisory pattern-matching.** It tests the whole command line and
   each of its tokens, so a credential path left *spelled* in the command is caught whatever
   program would open it: `python3 -c "open('~/.ssh/id_rsa')"` is denied. Changing the spelling
   defeats it — one glob character, quote-splitting, `find -exec`, a substitution that assembles
   the path from pieces, a base64 round-trip, each verified. **Do not count this arm as a
   control.**
-- **Detection is pattern-based.** No entropy rule (measured, not assumed: at a false-positive-free
-  threshold the miss rate is 100% below 22 characters). Encoded forms pass. A homoglyph defeats
-  every rule in this package.
+- **Detection is pattern-based.** No entropy rule (measured, not assumed: the lowest
+  false-positive-free threshold cannot flag anything shorter than 64–66 characters). Encoded
+  forms pass. A homoglyph defeats every rule in this package.
 
 [The full list of limits →](https://charlotten7.github.io/dsh-dlp/)
 
@@ -70,8 +74,10 @@ dsh plugin --profile <name> add dsh-dlp
 dsh --profile <name> --dump-config      # the dsh-dlp row should appear
 ```
 
-Any harness from `0.1.0-rc.6` onwards in the `0.1.x` line works: the peer ranges accept it and CI
-runs the end-to-end suite against every published rc in that range.
+Any harness from `0.1.0-rc.6` onwards in the `0.1.x` line works, prereleases included. CI drives
+the end-to-end suite against every published rc the peer ranges admit — `0.1.0-rc.6`, `rc.7`,
+`rc.8`, `0.1.1-rc.1`, `0.1.1-rc.2` — and typechecks and builds against the `0.1.2` prerelease
+line without running it end to end.
 
 Pin `@deepseek-ai/dsh-headless` explicitly — its npm `latest` tag still points at `0.0.1-rc.1`.
 The package ships a `cordis.patch.yml` bundle layer, so listing it in `dsh.profile.bundles` mounts

package/lib/approval-reach.js

@@ -0,0 +1,144 @@
+/**
+ * Whether an `ask` this plugin returns can still reach a human.
+ *
+ * The `ask` tier is documented as a prompt and never a block: its rules have a
+ * real false-positive rate, so a developer who is asked about `CLAUDE.md` or
+ * `.github/workflows/**` says yes and carries on. The tool registry resolves an
+ * `ask` through `ctx.get('approval')`, and three states of that seam turn the
+ * prompt into a denial nobody ever saw:
+ *
+ * 1. **No service composed.** `ToolRegistry.serviceAsk` keeps the historical
+ *    degrade to `deny` when `ctx.get('approval')` is `undefined`.
+ * 2. **The policy in force is `'never'`.** `ApprovalService.decide` resolves
+ *    `'rejected'` before any dispatch — its own JSDoc calls this "never prompt
+ *    anyone". The shipped `dsh-base` bundle selects it for every install under
+ *    `DSH_PERMISSION_MODE=danger-full-access`, which is the unattended posture.
+ * 3. **Nothing composed on `approval/request`.** The waterfall falls through to
+ *    the fail-closed `'unavailable'`, which the registry maps to `deny`. The
+ *    shipped `dsh-headless` bundle composes no answerer, so this is the state
+ *    of a stock headless install under every other permission mode.
+ *
+ * In all three the call is stopped with no human involved, which is exactly
+ * what this tier was designed not to do. Each is decided here so the caller can
+ * abstain instead — the same thing it already did for (1) alone.
+ *
+ * **Every check reports "reachable" when it cannot tell.** Abstaining removes a
+ * prompt, so an unreadable service, a missing session, or a `ctx.get` that
+ * returned something other than the service read here all keep the ask. Only a
+ * positive reading of one of the three states above abstains.
+ * @module dsh-dlp/approval-reach
+ */
+/** The event `ApprovalService.decide` dispatches its answerer waterfall on. */
+const APPROVAL_REQUEST = 'approval/request';
+/**
+ * Whether every ask for this session resolves without prompting anyone.
+ *
+ * `'never'` is the only policy whose outcome is knowable without asking, and
+ * the service decides it before dispatch, so no composed answerer can change
+ * it. Anything else — including a value this build does not recognise — leaves
+ * the answerers to decide and is therefore not a positive reading.
+ * @param approval - whatever `ctx.get('approval')` returned.
+ * @param session - the calling agent's session, or `undefined` when the call has no agent.
+ * @returns `true` only when the policy in force was read and is `'never'`.
+ */
+function policyIsNever(approval, session) {
+    // Without a session there is no override to fold, and the configured default
+    // alone cannot tell a session that never switched from one that switched to
+    // 'ask' — so an agent-less call keeps its prompt.
+    if (session === undefined)
+        return false;
+    const service = approval;
+    let policy;
+    try {
+        policy = service.overrideOf === undefined ? undefined : service.overrideOf(session) ?? service.config?.policy;
+    }
+    catch {
+        // Only a service without the members ApprovalSurface describes reaches
+        // here. It answers nothing about whether a human can be asked, and
+        // this runs inside a live tool call: a diagnostic read must not fail it.
+        return false;
+    }
+    return policy === 'never';
+}
+/**
+ * How many listeners are composed on the answerer waterfall.
+ *
+ * The count is read across the whole context tree, before the scope filter
+ * `ApprovalService.decide` applies. That over-counts — an agent-scoped answerer
+ * belonging to a different agent is included — and over-counting is the safe
+ * direction here, because only a count of zero abstains and zero listeners
+ * cannot be filtered into some.
+ *
+ * `EventsService._hooks` is a declared public field of the exported class, so a
+ * Cordis that stops carrying it fails `typecheck` and `build` in this package
+ * rather than being misread at a user's install; `@deepseek-ai/cordis` is
+ * pinned to one exact version (ADR §19) for the same reason.
+ * @param ctx - the plugin's context; every context in one tree shares the bus.
+ * @returns the number of composed answerers.
+ */
+function composedAnswerers(ctx) {
+    return ctx.events._hooks[APPROVAL_REQUEST]?.length ?? 0;
+}
+/**
+ * Decide whether an ask would reach a human, at the moment of the decision.
+ *
+ * Evaluated per call rather than at mount: a session switches policy mid-run
+ * through `approval/policy`, the override is per session, and an answerer can
+ * be composed or disposed while the harness runs. A mount-time answer would be
+ * a cached guess at all three.
+ * @param ctx - the plugin's context, for the service and the event bus.
+ * @param session - the calling agent's session, or `undefined` when the call has no agent.
+ * @returns whether to ask, or which state stopped the ask from reaching anyone.
+ */
+export function askReach(ctx, session) {
+    const approval = ctx.get('approval');
+    if (approval === undefined)
+        return { kind: 'unreachable', cause: 'no-service' };
+    // Policy first, matching the service's own order: it decides 'never' before
+    // dispatching, so that is the state an operator sees reported.
+    if (policyIsNever(approval, session))
+        return { kind: 'unreachable', cause: 'policy-never' };
+    if (composedAnswerers(ctx) === 0)
+        return { kind: 'unreachable', cause: 'no-answerer' };
+    return { kind: 'reachable' };
+}
+/** What abstaining does, said once and identically for all three states. */
+const CONSEQUENCE = 'This tier abstains rather than becoming the silent hard deny it was designed not to be: a'
+    + ' write to a behaviour-changing config path, and a call that switches its own confirmation off, are allowed'
+    + ' through with no prompt, and each one is recorded in the audit sink as "pre-execute-ask-abstained". The'
+    + ' guard floor is unaffected. Set configWriteAsk: false and approvalSuppressionAsk: false to turn this tier'
+    + ' off entirely.';
+/**
+ * What to tell the operator when the ask tier has nowhere to ask.
+ *
+ * Each line names the state, what to change to get the prompt back, and the
+ * consequence. Reported on `process.stderr` as well as `ctx.logger` for the
+ * reason ADR §7 records: the logger's default exporter is an in-memory ring
+ * buffer and no shipped bundle mounts a console exporter.
+ * @param cause - the state {@link askReach} read.
+ * @returns the whole line to report.
+ */
+export function approvalSeamNotice(cause) {
+    const prefix = 'dsh-dlp: the ask tier (configWriteAsk, approvalSuppressionAsk) is enabled, but';
+    switch (cause) {
+        case 'no-service':
+            return `${prefix} no approval service is mounted, so the tool registry would resolve an ask as a denial`
+                + ' with nothing shown to anyone. Composing an approval service and an answerer puts the prompt back.'
+                + ` ${CONSEQUENCE}`;
+        case 'policy-never':
+            return `${prefix} the approval policy in force is "never", which resolves every ask as rejected without`
+                + ' prompting anyone. DSH_PERMISSION_MODE=danger-full-access selects that policy in the shipped dsh-base'
+                + ' bundle; run under another permission mode, or set the approval row\'s policy to "ask", for these'
+                + ` calls to be asked about. ${CONSEQUENCE}`;
+        case 'no-answerer':
+            return `${prefix} nothing is composed on the approval/request waterfall, which fails every ask closed as`
+                + ' unavailable and denies the call with nothing shown to anyone. The shipped dsh-headless bundle'
+                + ' composes no answerer; a surface that answers approvals, such as the Host API proxy or the ACP'
+                + ` bridge, puts the prompt back. ${CONSEQUENCE}`;
+        /* v8 ignore next 4 -- unreachable while `AskUnreachable` stays closed; the arm exists so adding a variant fails the build. */
+        default: {
+            const unhandled = cause;
+            throw new TypeError(`dsh-dlp: unhandled ask-tier state ${JSON.stringify(unhandled)}`);
+        }
+    }
+}

package/lib/cli.js

@@ -74,6 +74,7 @@ export function parseRecord(line) {
         return undefined;
     const tool = stringField(record, 'tool');
     const sessionId = stringField(record, 'sessionId');
+    const askUnreachable = stringField(record, 'askUnreachable');
     return {
         time,
         kind,
@@ -81,6 +82,7 @@ export function parseRecord(line) {
         ...sessionId === undefined ? {} : { sessionId },
         ruleIds: ruleIdsOf(record),
         unicode: unicodeOf(record),
+        ...askUnreachable === undefined ? {} : { askUnreachable },
     };
 }
 /** Text printed for `--help` and alongside a usage error. */
@@ -255,12 +257,17 @@ export function formatReport(records, unreadable, options) {
         lines.push(`  ${unreadable} line(s) were not readable as records`);
     if (selected.length === 0)
         return lines;
-    lines.push(...section('by decision', tally(selected, record => [record.kind])), ...section('by rule', tally(selected, record => record.ruleIds)), ...section('by tool', tally(selected, record => record.tool === undefined ? [] : [record.tool])), ...section('results carrying invisible characters', tally(selected, record => Object.keys(record.unicode))));
+    lines.push(...section('by decision', tally(selected, record => [record.kind])), ...section('by rule', tally(selected, record => record.ruleIds)), ...section('by tool', tally(selected, record => record.tool === undefined ? [] : [record.tool])), ...section('results carrying invisible characters', tally(selected, record => Object.keys(record.unicode))), 
+    // The state behind an abstention, which nothing else in the report shows.
+    // An abstention is the one outcome where a documented prompt did not
+    // happen and the call ran anyway, so the operator needs the state by name.
+    ...section('asks that reached nobody', tally(selected, record => record.askUnreachable === undefined ? [] : [record.askUnreachable])));
     const recent = [...selected].sort((left, right) => right.time - left.time).slice(0, RECENT_LIMIT);
     lines.push('', `most recent ${recent.length}`);
     for (const record of recent) {
         const rules = record.ruleIds.length === 0 ? '-' : record.ruleIds.join(', ');
-        lines.push(`  ${new Date(record.time).toISOString()}  ${record.kind}  ${record.tool ?? '-'}  ${rules}`);
+        const abstention = record.askUnreachable === undefined ? '' : `  no prompt: ${record.askUnreachable}`;
+        lines.push(`  ${new Date(record.time).toISOString()}  ${record.kind}  ${record.tool ?? '-'}  ${rules}${abstention}`);
     }
     return lines;
 }

package/lib/detectors.js

@@ -45,7 +45,23 @@ export const DENY_SEVERITY = 'high';
 export const SYNC_RULES = [
     { id: 'dsh-dlp/aws-access-key-id', version: 1, severity: 'critical', pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g },
     { id: 'dsh-dlp/aws-secret-access-key', version: 1, severity: 'critical', pattern: /\baws_secret_access_key\b\s*[=:]\s*["']?[A-Za-z0-9/+=]{40}["']?/gi },
-    { id: 'dsh-dlp/github-token', version: 1, severity: 'critical', pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,251}|github_pat_[A-Za-z0-9_]{22,251})\b/g },
+    // Three formats, and the stateless one is first because the opaque
+    // alternative would otherwise claim its `ghs_` prefix and stop at the app
+    // id. GitHub's 2026-04-24 changelog gives the shape as `ghs_APPID_JWT`,
+    // "~520 characters" carrying two dots, rolled out from 2026-04-27 to late
+    // June; the opaque 40-character format stays because existing tokens
+    // "continue to work until they expire". GitHub's own suggested
+    // `ghs_[A-Za-z0-9.\-_]{36,}` is deliberately not what this uses: on a floor
+    // rule a false positive is a denial, and that class matches an ordinary
+    // dotted file name — `ghs_report-2026-04-24.summary-eu-west-1.json` is 40
+    // characters past the prefix. Anchoring on the JWT the changelog describes
+    // costs nothing a real token has.
+    {
+        id: 'dsh-dlp/github-token',
+        version: 2,
+        severity: 'critical',
+        pattern: /\b(?:ghs_[A-Za-z0-9]{1,32}_eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])|gh[pousr]_[A-Za-z0-9]{36,251}\b|github_pat_[A-Za-z0-9_]{22,251}\b)/g,
+    },
     { id: 'dsh-dlp/slack-token', version: 1, severity: 'critical', pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
     { id: 'dsh-dlp/stripe-secret-key', version: 1, severity: 'critical', pattern: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/g },
     { id: 'dsh-dlp/anthropic-api-key', version: 1, severity: 'critical', pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g },
@@ -89,7 +105,19 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/cloudflare-api-token', version: 1, severity: 'critical', pattern: /\bcf(?:ut|at|k)_[A-Za-z0-9_-]{40,}/g },
     { id: 'dsh-dlp/notion-token', version: 1, severity: 'critical', pattern: /\bntn_[A-Za-z0-9]{40,}/g },
     { id: 'dsh-dlp/private-key-block', version: 1, severity: 'critical', pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g },
-    { id: 'dsh-dlp/json-web-token', version: 1, severity: 'high', pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    // Anchored on the base64url alphabet rather than on word characters. `\b`
+    // was wrong in both directions: `_` is a word character, so a JWT behind any
+    // `prefix_` was invisible, and a signature's trailing `-` was trimmed off the
+    // reported span. A letter or digit before `eyJ` still refuses, which is what
+    // keeps a match from starting in the middle of a longer token; `_` and `-`
+    // are base64url characters but are separators far more often, and the two
+    // literal dots this pattern requires are in no base64url run.
+    {
+        id: 'dsh-dlp/json-web-token',
+        version: 2,
+        severity: 'high',
+        pattern: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/g,
+    },
     { id: 'dsh-dlp/credential-url', version: 1, severity: 'high', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s/@]+@[^\s/]+/gi },
     // Webhook URLs are bearer credentials whose path segment is the secret. They
     // are in tier 1 rather than left to secretlint because the telemetry seam is

package/lib/index.js

@@ -13,10 +13,12 @@
  *    config paths and for calls carrying an argument that switches their own
  *    confirmation off. Deliberately here rather than on the floor: its rules
  *    have a real false-positive rate and the floor cannot ask. Neutralizable,
- *    and it abstains entirely when no approval service is mounted.
+ *    and it abstains entirely wherever the approval seam cannot prompt anyone.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
+ *    Prepended, so it redacts what the rest of the waterfall returned; a
+ *    listener registering later with the same option still runs ahead of it.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in
@@ -43,6 +45,7 @@ import { neutralizeImageStream } from "./images.js";
 import { ExecutionSnapshots, mutationReason } from "./mutation.js";
 import { evaluateConfigWrite } from "./config-writes.js";
 import { evaluateApprovalSuppression } from "./approvals.js";
+import { approvalSeamNotice, askReach } from "./approval-reach.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
@@ -238,25 +241,20 @@ export function apply(ctx, config) {
         return verdict.reason;
     }), 'dsh-dlp guard floor');
     /**
-     * Report once that the `ask` tier has nowhere to ask.
+     * Report once per state that the `ask` tier has nowhere to ask.
      *
-     * The registry resolves an `ask` through `ctx.get('approval')` and keeps the
-     * historical degrade to *deny* when no service is composed. This tier exists
-     * because its rules are too false-positive-prone for a deny, so under a
-     * deployment with no approval channel it abstains instead of becoming the
-     * silent hard deny it was designed not to be. Evaluated at decision time
-     * rather than at mount, because by then the harness is running and an absent
-     * service is conclusive rather than a load order.
+     * Latched per state rather than once overall: the three states have
+     * different fixes, a session can move between them mid-run by switching its
+     * approval policy, and a single latch would leave the first one reported
+     * standing for a different one afterwards. `approval-reach.ts` records why
+     * each is a state in which an ask reaches nobody.
      */
-    let approvalSeamReported = false;
-    const discloseApprovalSeam = () => {
-        if (approvalSeamReported)
+    const approvalSeamReported = new Set();
+    const discloseApprovalSeam = (cause) => {
+        if (approvalSeamReported.has(cause))
             return;
-        approvalSeamReported = true;
-        notice(ctx, 'dsh-dlp: the ask tier (configWriteAsk, approvalSuppressionAsk) is enabled, but no approval service'
-            + ' is mounted, so an ask would degrade to a denial. This tier abstains instead: a write to a'
-            + ' behaviour-changing config path, and a call that switches its own confirmation off, are allowed through'
-            + ' with no prompt. The guard floor is unaffected.');
+        approvalSeamReported.add(cause);
+        notice(ctx, approvalSeamNotice(cause));
     };
     if (policy.configWriteAsk || policy.approvalSuppressionAsk) {
         // Registered ahead of the breadth tier, so a call that is both a config
@@ -280,8 +278,25 @@ export function apply(ctx, config) {
             // and would file the decision as an ask rather than as a guard denial.
             if (safeEvaluateGuard(exec, policy, hasher) !== undefined)
                 return decision;
-            if (ctx.get('approval') === undefined) {
-                discloseApprovalSeam();
+            // Asked at decision time, never at mount: the session's policy is a fold
+            // over its own log and can change mid-run, and an answerer can be
+            // composed or disposed while the harness runs.
+            const reach = askReach(ctx, exec.agent?.session);
+            if (reach.kind === 'unreachable') {
+                discloseApprovalSeam(reach.cause);
+                // An abstention allowed a call this tier would have asked about, so it
+                // is recorded rather than left silent. Its own kind, not a flag on
+                // `pre-execute-ask`: `dsh-dlp report` counts by kind, and an ask that
+                // reached nobody must not be counted as a prompt that happened.
+                sink.write({
+                    v: RECORD_VERSION,
+                    time: new Date().toISOString(),
+                    kind: 'pre-execute-ask-abstained',
+                    decisionId: newDecisionId(),
+                    ...identity(exec),
+                    ruleId: finding.rule.id,
+                    askUnreachable: reach.cause,
+                });
                 return decision;
             }
             sink.write({
@@ -315,6 +330,11 @@ export function apply(ctx, config) {
         });
     }
     if (policy.resultRedaction) {
+        // Prepended for the same reason as the snapshot listener above, and with
+        // the same limit: listeners run outermost-first, so registering ahead of
+        // the chain is what lets this one redact the decision the rest of the
+        // waterfall settled on rather than have its own replaced afterwards. A
+        // listener registered later with the same option still lands ahead of it.
         ctx.on('tools/post-execute', async (exec, result, next) => {
             // The live definition, so a schema the deployment's own tool declares is
             // read from the registry rather than assumed. `exec.agent` is the scope
@@ -342,7 +362,7 @@ export function apply(ctx, config) {
                 });
             }
             return redacted.decision;
-        });
+        }, { prepend: true });
     }
     if (policy.remoteImageNeutralization) {
         ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {

package/lib/redaction.js

@@ -166,10 +166,37 @@ function pointerSegment(segment) {
     return segment.replace(/~/g, '~0').replace(/\//g, '~1');
 }
 /**
- * Redact every string inside a JSON value, at any depth.
+ * Replace every detected region of every string inside one structure.
  *
  * Object *keys* are left alone: a key is structure, not payload, and renaming
- * one would break the owning tool's `output.schema` on re-validation.
+ * one would break the owning tool's `output.schema` on re-validation. The
+ * structure is otherwise rebuilt unchanged — only string leaves differ — which
+ * is what lets the callers re-type the result as what they handed in.
+ * @param node - the structure to walk.
+ * @param path - JSON pointer of this node.
+ * @param scan - synchronous detector applied to each string.
+ * @param hasher - mints each span's keyed hash.
+ * @param spans - collects every span replaced anywhere in the walk.
+ * @returns the same structure with each detected region replaced.
+ */
+function redactNode(node, path, scan, hasher, spans) {
+    if (typeof node === 'string') {
+        const redacted = redactText(node, scan(node), hasher, path);
+        if (redacted.spans.length === 0)
+            return node;
+        spans.push(...redacted.spans);
+        return redacted.text;
+    }
+    if (Array.isArray(node)) {
+        return node.map((item, index) => redactNode(item, `${path}/${index}`, scan, hasher, spans));
+    }
+    if (typeof node === 'object' && node !== null) {
+        return Object.fromEntries(Object.entries(node).map(([key, item]) => [key, redactNode(item, `${path}/${pointerSegment(key)}`, scan, hasher, spans)]));
+    }
+    return node;
+}
+/**
+ * Redact every string inside a JSON value, at any depth.
  * @param value - the structure to redact.
  * @param scan - synchronous detector applied to each string.
  * @param hasher - mints each span's keyed hash.
@@ -177,26 +204,10 @@ function pointerSegment(segment) {
  */
 export function redactJson(value, scan, hasher) {
     const spans = [];
-    let changed = false;
-    const walk = (node, path) => {
-        if (typeof node === 'string') {
-            const redacted = redactText(node, scan(node), hasher, path);
-            if (redacted.spans.length === 0)
-                return node;
-            changed = true;
-            spans.push(...redacted.spans);
-            return redacted.text;
-        }
-        if (Array.isArray(node)) {
-            return node.map((item, index) => walk(item, `${path}/${index}`));
-        }
-        if (typeof node === 'object' && node !== null) {
-            return Object.fromEntries(Object.entries(node).map(([key, item]) => [key, walk(item, `${path}/${pointerSegment(key)}`)]));
-        }
-        return node;
-    };
-    const result = walk(value, '');
-    return { value: result, spans, changed };
+    // `redactNode` replaces strings with strings and rebuilds everything else as
+    // it found it, so what comes back is the same JSON shape it was handed.
+    const result = redactNode(value, '', scan, hasher, spans);
+    return { value: result, spans, changed: spans.length > 0 };
 }
 /**
  * Redact the text blocks of one model-facing content array. Non-text blocks
@@ -205,15 +216,16 @@ export function redactJson(value, scan, hasher) {
  * @param blocks - the content blocks to redact.
  * @param scan - synchronous detector applied to each block's text.
  * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off, for blocks that are not the decision's own.
  * @returns the redacted blocks, the spans replaced, and whether anything changed.
  */
-export function redactContent(blocks, scan, hasher) {
+export function redactContent(blocks, scan, hasher, pathPrefix = '') {
     const spans = [];
     let changed = false;
     const content = blocks.map((block, index) => {
         if (block.type !== 'text')
             return block;
-        const redacted = redactText(block.text, scan(block.text), hasher, `/${index}/text`);
+        const redacted = redactText(block.text, scan(block.text), hasher, `${pathPrefix}/${index}/text`);
         if (redacted.spans.length === 0)
             return block;
         changed = true;
@@ -222,3 +234,50 @@ export function redactContent(blocks, scan, hasher) {
     });
     return { content, spans, changed };
 }
+/**
+ * Source fields that say what a message *is* rather than what it says. `kind`
+ * selects the source arm, `form` selects the fields that arm carries, and
+ * `plugin` names the producer; replacing one of those would change the
+ * message's identity rather than redact its text.
+ */
+const MESSAGE_SOURCE_STRUCTURE = new Set(['kind', 'form', 'plugin']);
+/**
+ * Redact the text of the `UserMessage`s a tool decision carries.
+ *
+ * A message's payload is its model-facing `content` blocks and whatever text
+ * its `source` records: a `snapshot` source repeats the block text in
+ * `sections[].text`, a `notice` source repeats its opening in `summary`, and
+ * `MessageSourceMap` is merge-extensible, so a plugin's own source kind may
+ * carry text of its own. All of it is appended to the session log with the
+ * message, so redacting the blocks alone would leave a copy behind. Both
+ * halves are walked with the same scan and the same hasher, and identical text
+ * yields an identical placeholder, so the copies stay in step.
+ *
+ * `id` and `role` are left alone: the inbox addresses a message by its id.
+ * A message with nothing to replace is returned as the object it arrived as.
+ * @param messages - the contexts to redact, in the order they are attached.
+ * @param scan - synchronous detector applied to each string.
+ * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off.
+ * @returns the redacted messages, the spans replaced, and whether anything changed.
+ */
+export function redactUserMessages(messages, scan, hasher, pathPrefix) {
+    const spans = [];
+    const redacted = messages.map((message, index) => {
+        const path = `${pathPrefix}/${index}`;
+        const before = spans.length;
+        const content = redactContent(message.content, scan, hasher, `${path}/content`);
+        spans.push(...content.spans);
+        // Rebuilt entry by entry so the discriminants pass through untouched;
+        // `redactNode` returns each remaining field as the shape it was given, so
+        // the result is the same source with redacted text.
+        const source = Object.fromEntries(Object.entries(message.source).map(([key, value]) => [
+            key,
+            MESSAGE_SOURCE_STRUCTURE.has(key)
+                ? value
+                : redactNode(value, `${path}/source/${pointerSegment(key)}`, scan, hasher, spans),
+        ]));
+        return spans.length === before ? message : { ...message, content: content.content, source };
+    });
+    return { messages: redacted, spans, changed: spans.length > 0 };
+}

package/lib/results.js

@@ -4,15 +4,18 @@
  *
  * Both are best-effort by construction. A `tools/pre-execute` listener
  * registered ahead of ours can return without calling `next()` and neutralize
- * the breadth tier; a `tools/post-execute` listener ahead of ours can replace a
- * result after we redacted it. Only `ctx.tools.guard()` is order-independent.
+ * the breadth tier. Result redaction registers with `{ prepend: true }`, so it
+ * redacts whatever the rest of the waterfall settled on rather than having its
+ * own decision replaced afterwards — but `prepend` unshifts, so a listener
+ * that registers later with the same option still lands ahead of it. Only
+ * `ctx.tools.guard()` is order-independent, and it cannot rewrite a result.
  * What these seams buy is breadth: they can await, so `@secretlint/core`'s
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
  */
 import { DENY_SEVERITY, countUnicodeIndicators, scanAll, scanSync, severityRank, } from "./detectors.js";
 import { isEgressCapable } from "./paths.js";
-import { nestedStrings, redactContent, redactJson } from "./redaction.js";
+import { nestedStrings, redactContent, redactJson, redactUserMessages, } from "./redaction.js";
 import { redactionBreaksSchema } from "./schema.js";
 /**
  * Separator the strings of one result are rendered with before the
@@ -76,6 +79,17 @@ async function prepareScan(strings, policy) {
 function contentStrings(blocks) {
     return blocks.flatMap(block => block.type === 'text' ? [block.text] : []);
 }
+/**
+ * Text one set of `additionalContexts` carries: the model-facing blocks, plus
+ * whatever text the source records beside them — a `snapshot` source repeats
+ * the block text in `sections[].text`, a `notice` source its opening in
+ * `summary`, and a plugin's own source kind may carry more.
+ * @param messages - the contexts attached to a decision or ferried on a result.
+ * @returns every string those messages would put in front of the model or into the log.
+ */
+function messageStrings(messages) {
+    return messages.flatMap(message => [...contentStrings(message.content), ...nestedStrings(message.source)]);
+}
 /**
  * Strings the harness keeps in the durable result when the decision does not
  * replace the canonical value.
@@ -121,8 +135,23 @@ function withheldFeedback(spans) {
  *   persisted surfaces are already clean — a failed result, which has no
  *   value, or a success whose secret exists only in the rendered content.
  * - `block` is the fallback when neither works: a failed result whose `meta`
- *   carries a secret, or a value that still scans dirty after redaction.
- *   Blocking replaces the whole result, which is the only way to drop `meta`.
+ *   carries a secret, a value that still scans dirty after redaction, or a
+ *   context the tool body deferred. Blocking replaces the whole result, which
+ *   is the only way to drop either.
+ *
+ * `additionalContexts` reach both the model and the log — the loop hands each
+ * one to the inbox, which appends an `agent/inbox/spliced` event carrying the
+ * whole message — and they arrive from two places that are not equally
+ * reachable:
+ *
+ * - the ones this decision carries, which the returned decision owns, so they
+ *   are redacted in place. Rewriting them is a rewrite of another listener's
+ *   data, which is the same thing the value arm already does to a downstream
+ *   `accept{content}`, and it costs a placeholder rather than a lost result;
+ * - the ones the tool body deferred, which the registry concatenates ahead of
+ *   the decision's own on *every* accept arm. No accept can rewrite or drop
+ *   them, so a dirty one is withheld. That is `meta`'s case exactly, and it is
+ *   the one place scanning contexts can cost a successful result.
  *
  * Replacing the value is re-validated by the registry against the tool's
  * `output.schema`, and a schema that pins the redacted string rejects it. That
@@ -142,21 +171,30 @@ function withheldFeedback(spans) {
  * @returns the decision to return, the spans replaced, and scan completeness.
  */
 export async function redactDecision(decision, result, policy, hasher, outputSchema) {
+    const attached = decision.additionalContexts ?? [];
     if (decision.kind === 'block') {
-        const prepared = await prepareScan(contentStrings(decision.feedback), policy);
+        // A block exposes only the blocking decision's own contexts, so the
+        // feedback and those are the whole surface this arm can put in front of
+        // the model.
+        const prepared = await prepareScan([...contentStrings(decision.feedback), ...messageStrings(attached)], policy);
         const redacted = redactContent(decision.feedback, prepared.scan, hasher);
+        const redactedContexts = redactUserMessages(attached, prepared.scan, hasher, '/additionalContexts');
         return {
-            decision: redacted.changed ? { ...decision, feedback: redacted.content } : decision,
-            spans: redacted.spans,
+            decision: redacted.changed || redactedContexts.changed
+                ? {
+                    ...decision,
+                    feedback: redacted.content,
+                    ...redactedContexts.changed ? { additionalContexts: redactedContexts.messages } : {},
+                }
+                : decision,
+            spans: [...redacted.spans, ...redactedContexts.spans],
             truncatedScan: prepared.truncated,
             indicators: prepared.indicators,
         };
     }
     const replacedValue = Object.hasOwn(decision, 'value') ? decision.value : undefined;
     const replacedContent = Object.hasOwn(decision, 'content') ? decision.content : undefined;
-    const contexts = decision.additionalContexts === undefined
-        ? {}
-        : { additionalContexts: decision.additionalContexts };
+    const deferred = result.additionalContexts ?? [];
     // The value the harness will persist: a downstream replacement when there is
     // one, otherwise the tool's own. A failed result has no value at all.
     const value = replacedValue ?? (result.isError ? undefined : result.value);
@@ -164,31 +202,39 @@ export async function redactDecision(decision, result, policy, hasher, outputSch
     const persisted = replacedValue === undefined
         ? persistedStrings(result)
         : [...nestedStrings(replacedValue), ...result.meta === undefined ? [] : nestedStrings(result.meta)];
-    const prepared = await prepareScan([...persisted, ...visible], policy);
+    const prepared = await prepareScan([...persisted, ...visible, ...messageStrings(attached), ...messageStrings(deferred)], policy);
     const dirty = (strings) => strings.some(text => prepared.scan(text).length > 0);
+    const redactedContexts = redactUserMessages(attached, prepared.scan, hasher, '/additionalContexts');
+    // A clean set is passed on as the array it arrived as, so a downstream
+    // listener's own messages are not rebuilt for nothing.
+    const contexts = decision.additionalContexts === undefined
+        ? {}
+        : { additionalContexts: redactedContexts.changed ? redactedContexts.messages : decision.additionalContexts };
+    /** Withhold the result, keeping the redacted contexts the decision brought. */
+    const withhold = (spans, truncated) => ({
+        decision: { kind: 'block', feedback: withheldFeedback(spans), ...contexts },
+        spans: [...spans, ...redactedContexts.spans],
+        truncatedScan: truncated,
+        indicators: prepared.indicators,
+    });
+    // Deferred contexts ride every accept arm untouched, so a dirty one settles
+    // the decision before any arm is considered.
+    const deferredSpans = redactUserMessages(deferred, prepared.scan, hasher, '/result/additionalContexts').spans;
+    if (deferredSpans.length > 0)
+        return withhold(deferredSpans, prepared.truncated);
     if (value !== undefined && dirty(nestedStrings(value))) {
         const redacted = redactJson(value, prepared.scan, hasher);
         if (redactionBreaksSchema(outputSchema, value, redacted.value)) {
-            return {
-                decision: { kind: 'block', feedback: withheldFeedback(redacted.spans) },
-                spans: redacted.spans,
-                truncatedScan: prepared.truncated,
-                indicators: prepared.indicators,
-            };
+            return withhold(redacted.spans, prepared.truncated);
         }
         const remaining = nestedStrings(redacted.value);
         const residual = await prepareScan(remaining, policy);
         if (remaining.some(text => residual.scan(text).length > 0)) {
-            return {
-                decision: { kind: 'block', feedback: withheldFeedback(redacted.spans) },
-                spans: redacted.spans,
-                truncatedScan: prepared.truncated || residual.truncated,
-                indicators: prepared.indicators,
-            };
+            return withhold(redacted.spans, prepared.truncated || residual.truncated);
         }
         return {
             decision: { kind: 'accept', value: redacted.value, ...contexts },
-            spans: redacted.spans,
+            spans: [...redacted.spans, ...redactedContexts.spans],
             truncatedScan: prepared.truncated,
             indicators: prepared.indicators,
         };
@@ -196,22 +242,21 @@ export async function redactDecision(decision, result, policy, hasher, outputSch
     // The value is clean, so the durable result is clean unless `meta` — which
     // no accept arm can rewrite — carries something of its own.
     if (result.meta !== undefined && dirty(nestedStrings(result.meta))) {
-        const spans = redactJson(result.meta, prepared.scan, hasher).spans;
-        return {
-            decision: { kind: 'block', feedback: withheldFeedback(spans) },
-            spans,
-            truncatedScan: prepared.truncated,
-            indicators: prepared.indicators,
-        };
+        return withhold(redactJson(result.meta, prepared.scan, hasher).spans, prepared.truncated);
     }
     const blocks = replacedContent ?? result.content;
     const redacted = redactContent(blocks, prepared.scan, hasher);
     if (!redacted.changed) {
-        return { decision, spans: [], truncatedScan: prepared.truncated, indicators: prepared.indicators };
+        return {
+            decision: redactedContexts.changed ? { ...decision, ...contexts } : decision,
+            spans: redactedContexts.spans,
+            truncatedScan: prepared.truncated,
+            indicators: prepared.indicators,
+        };
     }
     return {
         decision: { kind: 'accept', content: redacted.content, ...contexts },
-        spans: redacted.spans,
+        spans: [...redacted.spans, ...redactedContexts.spans],
         truncatedScan: prepared.truncated,
         indicators: prepared.indicators,
     };

package/lib/sink.js

@@ -14,7 +14,7 @@
  * `callId`, and a producer-minted `decisionId`.
  * @module dsh-dlp/sink
  */
-import { appendFileSync } from 'node:fs';
+import { appendFileSync, chmodSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { stripControlSequences } from "./detectors.js";
 /**
@@ -26,6 +26,15 @@ export function newDecisionId() {
 }
 /** Payload version carried inside every record this plugin writes. */
 export const RECORD_VERSION = 1;
+/**
+ * Mode the sink file is kept at.
+ *
+ * The records hold rule ids, keyed hashes, tool names and call identity — no
+ * matched value ever reaches them — but they are the evidence that a decision
+ * happened, so they are readable by the operator's group and never by the
+ * world. This is the mode the sibling packages keep their spools at.
+ */
+export const AUDIT_MODE = 0o640;
 /**
  * One record with every string cleaned of terminal control sequences.
  *
@@ -68,12 +77,20 @@ export class AuditSink {
      * evidence, not enforcement, and letting a full disk turn every tool call
      * into a denial trades a confidentiality control for an availability
      * outage. A guard that throws would also skip `tools/post-execute` and so
-     * disable redaction for that call.
+     * disable redaction for that call. A failure to hold
+     * {@link AUDIT_MODE} is reported on the same terms: the record is written
+     * either way, and an operator who cannot see the mode cannot know who else
+     * can read the file.
      * @param record - the decision to record.
      */
     write(record) {
         try {
-            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`);
+            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`, { mode: AUDIT_MODE });
+            // `appendFileSync`'s `mode` applies only when the call creates the file,
+            // and even then the umask masks it, so the mode is forced afterwards.
+            // Forcing it on every append also takes back a loosening applied to an
+            // existing sink.
+            chmodSync(this.#path, AUDIT_MODE);
         }
         catch (error) {
             this.#onFailure(error);

package/lib/telemetry.js

@@ -26,7 +26,7 @@
  * @module dsh-dlp/telemetry
  */
 import { scanSync } from "./detectors.js";
-import { placeholderFor, redactJson, redactText } from "./redaction.js";
+import { placeholderFor, redactJson, redactText, } from "./redaction.js";
 /**
  * What to tell the operator when the redaction seam will never dispatch.
  *

package/lib/types/approval-reach.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Whether an `ask` this plugin returns can still reach a human.
+ *
+ * The `ask` tier is documented as a prompt and never a block: its rules have a
+ * real false-positive rate, so a developer who is asked about `CLAUDE.md` or
+ * `.github/workflows/**` says yes and carries on. The tool registry resolves an
+ * `ask` through `ctx.get('approval')`, and three states of that seam turn the
+ * prompt into a denial nobody ever saw:
+ *
+ * 1. **No service composed.** `ToolRegistry.serviceAsk` keeps the historical
+ *    degrade to `deny` when `ctx.get('approval')` is `undefined`.
+ * 2. **The policy in force is `'never'`.** `ApprovalService.decide` resolves
+ *    `'rejected'` before any dispatch — its own JSDoc calls this "never prompt
+ *    anyone". The shipped `dsh-base` bundle selects it for every install under
+ *    `DSH_PERMISSION_MODE=danger-full-access`, which is the unattended posture.
+ * 3. **Nothing composed on `approval/request`.** The waterfall falls through to
+ *    the fail-closed `'unavailable'`, which the registry maps to `deny`. The
+ *    shipped `dsh-headless` bundle composes no answerer, so this is the state
+ *    of a stock headless install under every other permission mode.
+ *
+ * In all three the call is stopped with no human involved, which is exactly
+ * what this tier was designed not to do. Each is decided here so the caller can
+ * abstain instead — the same thing it already did for (1) alone.
+ *
+ * **Every check reports "reachable" when it cannot tell.** Abstaining removes a
+ * prompt, so an unreadable service, a missing session, or a `ctx.get` that
+ * returned something other than the service read here all keep the ask. Only a
+ * positive reading of one of the three states above abstains.
+ * @module dsh-dlp/approval-reach
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Session } from '@deepseek-ai/dsh-session';
+/** Which of the three states stopped an ask from reaching a human. */
+export type AskUnreachable = 
+/** Nothing is composed on `ctx.approval`. */
+'no-service'
+/** The policy in force for this session is `'never'`. */
+ | 'policy-never'
+/** Nothing is composed on the `approval/request` waterfall. */
+ | 'no-answerer';
+/** Whether an ask can reach a human, and when it cannot, which state stopped it. */
+export type AskReach = {
+    readonly kind: 'reachable';
+} | {
+    readonly kind: 'unreachable';
+    readonly cause: AskUnreachable;
+};
+/**
+ * Decide whether an ask would reach a human, at the moment of the decision.
+ *
+ * Evaluated per call rather than at mount: a session switches policy mid-run
+ * through `approval/policy`, the override is per session, and an answerer can
+ * be composed or disposed while the harness runs. A mount-time answer would be
+ * a cached guess at all three.
+ * @param ctx - the plugin's context, for the service and the event bus.
+ * @param session - the calling agent's session, or `undefined` when the call has no agent.
+ * @returns whether to ask, or which state stopped the ask from reaching anyone.
+ */
+export declare function askReach(ctx: Context, session: Session | undefined): AskReach;
+/**
+ * What to tell the operator when the ask tier has nowhere to ask.
+ *
+ * Each line names the state, what to change to get the prompt back, and the
+ * consequence. Reported on `process.stderr` as well as `ctx.logger` for the
+ * reason ADR §7 records: the logger's default exporter is an in-memory ring
+ * buffer and no shipped bundle mounts a console exporter.
+ * @param cause - the state {@link askReach} read.
+ * @returns the whole line to report.
+ */
+export declare function approvalSeamNotice(cause: AskUnreachable): string;
+//# sourceMappingURL=approval-reach.d.ts.map

package/lib/types/cli.d.ts

@@ -23,6 +23,12 @@ export interface ReportRecord {
     readonly ruleIds: readonly string[];
     /** Invisible-character runs by rule id. */
     readonly unicode: Readonly<Record<string, number>>;
+    /**
+     * Which state left the ask tier with nowhere to ask, on the one kind that
+     * records it. The abstention allowed a call the tier would have asked
+     * about, so this is the field an operator changes to get the prompt back.
+     */
+    readonly askUnreachable?: string;
 }
 /**
  * Parse one JSONL line into the fields this command reports on.

package/lib/types/index.d.ts

@@ -13,10 +13,12 @@
  *    config paths and for calls carrying an argument that switches their own
  *    confirmation off. Deliberately here rather than on the floor: its rules
  *    have a real false-positive rate and the floor cannot ask. Neutralizable,
- *    and it abstains entirely when no approval service is mounted.
+ *    and it abstains entirely wherever the approval seam cannot prompt anyone.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
+ *    Prepended, so it redacts what the rest of the waterfall returned; a
+ *    listener registering later with the same option still runs ahead of it.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in

package/lib/types/redaction.d.ts

@@ -14,9 +14,22 @@
  *   installation key, useless to anyone without the key.
  * @module dsh-dlp/redaction
  */
-import type { ContentBlock } from '@deepseek-ai/dsh-llm';
-import type { JsonValue } from '@deepseek-ai/dsh-session';
+import type { ContentBlock, UserMessage } from '@deepseek-ai/dsh-llm';
 import { type Detection, type Severity } from './detectors.ts';
+/**
+ * A value that round-trips through JSON without loss.
+ *
+ * Declared here rather than imported. Upstream moved this alias out of
+ * `@deepseek-ai/dsh-session` and into `@deepseek-ai/dsh-util-values` in
+ * `0.1.2-alpha.2`; the new package does not exist in any release the peer
+ * ranges also admit, and a TypeScript import cannot name two homes, so either
+ * import breaks half the supported range. The alias is structural and carries
+ * no runtime, so a local copy is assignable in both directions wherever it
+ * meets upstream's — and nothing outside this package is handed one.
+ */
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
 /** One replaced region, described without disclosing what it held. */
 export interface RedactedSpan {
     /** Rule that justified the replacement; the strictest one when spans merged. */
@@ -83,9 +96,6 @@ export declare function redactText(text: string, detections: readonly Detection[
 export declare function nestedStrings(value: unknown): string[];
 /**
  * Redact every string inside a JSON value, at any depth.
- *
- * Object *keys* are left alone: a key is structure, not payload, and renaming
- * one would break the owning tool's `output.schema` on re-validation.
  * @param value - the structure to redact.
  * @param scan - synchronous detector applied to each string.
  * @param hasher - mints each span's keyed hash.
@@ -103,11 +113,37 @@ export declare function redactJson(value: JsonValue, scan: (text: string) => rea
  * @param blocks - the content blocks to redact.
  * @param scan - synchronous detector applied to each block's text.
  * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off, for blocks that are not the decision's own.
  * @returns the redacted blocks, the spans replaced, and whether anything changed.
  */
-export declare function redactContent(blocks: readonly ContentBlock[], scan: (text: string) => readonly Detection[], hasher: SpanHasher): {
+export declare function redactContent(blocks: readonly ContentBlock[], scan: (text: string) => readonly Detection[], hasher: SpanHasher, pathPrefix?: string): {
     content: ContentBlock[];
     spans: readonly RedactedSpan[];
     changed: boolean;
 };
+/**
+ * Redact the text of the `UserMessage`s a tool decision carries.
+ *
+ * A message's payload is its model-facing `content` blocks and whatever text
+ * its `source` records: a `snapshot` source repeats the block text in
+ * `sections[].text`, a `notice` source repeats its opening in `summary`, and
+ * `MessageSourceMap` is merge-extensible, so a plugin's own source kind may
+ * carry text of its own. All of it is appended to the session log with the
+ * message, so redacting the blocks alone would leave a copy behind. Both
+ * halves are walked with the same scan and the same hasher, and identical text
+ * yields an identical placeholder, so the copies stay in step.
+ *
+ * `id` and `role` are left alone: the inbox addresses a message by its id.
+ * A message with nothing to replace is returned as the object it arrived as.
+ * @param messages - the contexts to redact, in the order they are attached.
+ * @param scan - synchronous detector applied to each string.
+ * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off.
+ * @returns the redacted messages, the spans replaced, and whether anything changed.
+ */
+export declare function redactUserMessages(messages: readonly UserMessage[], scan: (text: string) => readonly Detection[], hasher: SpanHasher, pathPrefix: string): {
+    messages: UserMessage[];
+    spans: readonly RedactedSpan[];
+    changed: boolean;
+};
 //# sourceMappingURL=redaction.d.ts.map

package/lib/types/results.d.ts

@@ -4,8 +4,11 @@
  *
  * Both are best-effort by construction. A `tools/pre-execute` listener
  * registered ahead of ours can return without calling `next()` and neutralize
- * the breadth tier; a `tools/post-execute` listener ahead of ours can replace a
- * result after we redacted it. Only `ctx.tools.guard()` is order-independent.
+ * the breadth tier. Result redaction registers with `{ prepend: true }`, so it
+ * redacts whatever the rest of the waterfall settled on rather than having its
+ * own decision replaced afterwards — but `prepend` unshifts, so a listener
+ * that registers later with the same option still lands ahead of it. Only
+ * `ctx.tools.guard()` is order-independent, and it cannot rewrite a result.
  * What these seams buy is breadth: they can await, so `@secretlint/core`'s
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
@@ -40,8 +43,23 @@ export interface ResultRedaction {
  *   persisted surfaces are already clean — a failed result, which has no
  *   value, or a success whose secret exists only in the rendered content.
  * - `block` is the fallback when neither works: a failed result whose `meta`
- *   carries a secret, or a value that still scans dirty after redaction.
- *   Blocking replaces the whole result, which is the only way to drop `meta`.
+ *   carries a secret, a value that still scans dirty after redaction, or a
+ *   context the tool body deferred. Blocking replaces the whole result, which
+ *   is the only way to drop either.
+ *
+ * `additionalContexts` reach both the model and the log — the loop hands each
+ * one to the inbox, which appends an `agent/inbox/spliced` event carrying the
+ * whole message — and they arrive from two places that are not equally
+ * reachable:
+ *
+ * - the ones this decision carries, which the returned decision owns, so they
+ *   are redacted in place. Rewriting them is a rewrite of another listener's
+ *   data, which is the same thing the value arm already does to a downstream
+ *   `accept{content}`, and it costs a placeholder rather than a lost result;
+ * - the ones the tool body deferred, which the registry concatenates ahead of
+ *   the decision's own on *every* accept arm. No accept can rewrite or drop
+ *   them, so a dirty one is withheld. That is `meta`'s case exactly, and it is
+ *   the one place scanning contexts can cost a successful result.
  *
  * Replacing the value is re-validated by the registry against the tool's
  * `output.schema`, and a schema that pins the redacted string rejects it. That

package/lib/types/sink.d.ts

@@ -14,6 +14,7 @@
  * `callId`, and a producer-minted `decisionId`.
  * @module dsh-dlp/sink
  */
+import type { AskUnreachable } from './approval-reach.ts';
 import type { RedactedSpan } from './redaction.ts';
 declare const decisionIdBrand: unique symbol;
 /** Producer-minted id correlating one decision across records. */
@@ -27,8 +28,17 @@ export type DecisionId = string & {
 export declare function newDecisionId(): DecisionId;
 /** Payload version carried inside every record this plugin writes. */
 export declare const RECORD_VERSION = 1;
+/**
+ * Mode the sink file is kept at.
+ *
+ * The records hold rule ids, keyed hashes, tool names and call identity — no
+ * matched value ever reaches them — but they are the evidence that a decision
+ * happened, so they are readable by the operator's group and never by the
+ * world. This is the mode the sibling packages keep their spools at.
+ */
+export declare const AUDIT_MODE = 416;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -66,6 +76,13 @@ export interface AuditRecord {
      * behaviour-changing file, not that any part of it matched a secret.
      */
     readonly ruleId?: string;
+    /**
+     * Which state left the ask tier with nowhere to ask, for a
+     * `pre-execute-ask-abstained`. An abstention allowed a call the tier would
+     * otherwise have asked about, so the state that caused it is the field an
+     * operator needs to change to get the prompt back.
+     */
+    readonly askUnreachable?: AskUnreachable;
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
     /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */
@@ -95,7 +112,10 @@ export declare class AuditSink {
      * evidence, not enforcement, and letting a full disk turn every tool call
      * into a denial trades a confidentiality control for an availability
      * outage. A guard that throws would also skip `tools/post-execute` and so
-     * disable redaction for that call.
+     * disable redaction for that call. A failure to hold
+     * {@link AUDIT_MODE} is reported on the same terms: the record is written
+     * either way, and an operator who cannot see the mode cannot know who else
+     * can read the file.
      * @param record - the decision to record.
      */
     write(record: AuditRecord): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",
@@ -50,11 +50,11 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.6 <0.2.0-0 || >=0.1.1-0 <0.2.0-0 || >=0.1.2-0 <0.2.0-0",
+    "@deepseek-ai/dsh-session": ">=0.1.0-rc.6 <0.2.0-0 || >=0.1.1-0 <0.2.0-0 || >=0.1.2-0 <0.2.0-0",
+    "@deepseek-ai/dsh-session-telemetry": ">=0.1.0-rc.6 <0.2.0-0 || >=0.1.1-0 <0.2.0-0 || >=0.1.2-0 <0.2.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6 <0.2.0-0 || >=0.1.1-0 <0.2.0-0 || >=0.1.2-0 <0.2.0-0"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "3.18.1",
@@ -63,7 +63,7 @@
     "js-yaml": "^4.1.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/cordis": "4.0.2",
     "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
     "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
     "@deepseek-ai/dsh-llm-mock-server": "0.1.0-rc.6",