dsh-dlp 0.7.0 → 0.8.1

package/README.md

@@ -48,16 +48,18 @@ Three limits worth knowing before you rely on it:
 
 - **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
   registered ahead of ours. `ctx.tools.guard()` is order-independent only because it has no allow
-  arm.
+  arm. Result redaction registers with `{ prepend: true }` so it gets the last word over
+  listeners already registered — but a listener registering after it with the same option lands
+  ahead of it again.
 - **The shell-command arm is advisory pattern-matching.** It tests the whole command line and
   each of its tokens, so a credential path left *spelled* in the command is caught whatever
   program would open it: `python3 -c "open('~/.ssh/id_rsa')"` is denied. Changing the spelling
   defeats it — one glob character, quote-splitting, `find -exec`, a substitution that assembles
   the path from pieces, a base64 round-trip, each verified. **Do not count this arm as a
   control.**
-- **Detection is pattern-based.** No entropy rule (measured, not assumed: at a false-positive-free
-  threshold the miss rate is 100% below 22 characters). Encoded forms pass. A homoglyph defeats
-  every rule in this package.
+- **Detection is pattern-based.** No entropy rule (measured, not assumed: the lowest
+  false-positive-free threshold cannot flag anything shorter than 64–66 characters). Encoded
+  forms pass. A homoglyph defeats every rule in this package.
 
 [The full list of limits →](https://charlotten7.github.io/dsh-dlp/)
 
@@ -72,8 +74,10 @@ dsh plugin --profile <name> add dsh-dlp
 dsh --profile <name> --dump-config      # the dsh-dlp row should appear
 ```
 
-Any harness from `0.1.0-rc.6` onwards in the `0.1.x` line works: the peer ranges accept it and CI
-runs the end-to-end suite against every published rc in that range.
+Any harness from `0.1.0-rc.6` onwards in the `0.1.x` line works, prereleases included. CI drives
+the end-to-end suite against every published rc the peer ranges admit — `0.1.0-rc.6`, `rc.7`,
+`rc.8`, `0.1.1-rc.1`, `0.1.1-rc.2`. The `0.1.2` prerelease line is watched by a non-blocking job
+line without running it end to end.
 
 Pin `@deepseek-ai/dsh-headless` explicitly — its npm `latest` tag still points at `0.0.1-rc.1`.
 The package ships a `cordis.patch.yml` bundle layer, so listing it in `dsh.profile.bundles` mounts

package/lib/cli.js

@@ -74,6 +74,7 @@ export function parseRecord(line) {
         return undefined;
     const tool = stringField(record, 'tool');
     const sessionId = stringField(record, 'sessionId');
+    const askUnreachable = stringField(record, 'askUnreachable');
     return {
         time,
         kind,
@@ -81,6 +82,7 @@ export function parseRecord(line) {
         ...sessionId === undefined ? {} : { sessionId },
         ruleIds: ruleIdsOf(record),
         unicode: unicodeOf(record),
+        ...askUnreachable === undefined ? {} : { askUnreachable },
     };
 }
 /** Text printed for `--help` and alongside a usage error. */
@@ -255,12 +257,17 @@ export function formatReport(records, unreadable, options) {
         lines.push(`  ${unreadable} line(s) were not readable as records`);
     if (selected.length === 0)
         return lines;
-    lines.push(...section('by decision', tally(selected, record => [record.kind])), ...section('by rule', tally(selected, record => record.ruleIds)), ...section('by tool', tally(selected, record => record.tool === undefined ? [] : [record.tool])), ...section('results carrying invisible characters', tally(selected, record => Object.keys(record.unicode))));
+    lines.push(...section('by decision', tally(selected, record => [record.kind])), ...section('by rule', tally(selected, record => record.ruleIds)), ...section('by tool', tally(selected, record => record.tool === undefined ? [] : [record.tool])), ...section('results carrying invisible characters', tally(selected, record => Object.keys(record.unicode))), 
+    // The state behind an abstention, which nothing else in the report shows.
+    // An abstention is the one outcome where a documented prompt did not
+    // happen and the call ran anyway, so the operator needs the state by name.
+    ...section('asks that reached nobody', tally(selected, record => record.askUnreachable === undefined ? [] : [record.askUnreachable])));
     const recent = [...selected].sort((left, right) => right.time - left.time).slice(0, RECENT_LIMIT);
     lines.push('', `most recent ${recent.length}`);
     for (const record of recent) {
         const rules = record.ruleIds.length === 0 ? '-' : record.ruleIds.join(', ');
-        lines.push(`  ${new Date(record.time).toISOString()}  ${record.kind}  ${record.tool ?? '-'}  ${rules}`);
+        const abstention = record.askUnreachable === undefined ? '' : `  no prompt: ${record.askUnreachable}`;
+        lines.push(`  ${new Date(record.time).toISOString()}  ${record.kind}  ${record.tool ?? '-'}  ${rules}${abstention}`);
     }
     return lines;
 }

package/lib/detectors.js

@@ -45,7 +45,23 @@ export const DENY_SEVERITY = 'high';
 export const SYNC_RULES = [
     { id: 'dsh-dlp/aws-access-key-id', version: 1, severity: 'critical', pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g },
     { id: 'dsh-dlp/aws-secret-access-key', version: 1, severity: 'critical', pattern: /\baws_secret_access_key\b\s*[=:]\s*["']?[A-Za-z0-9/+=]{40}["']?/gi },
-    { id: 'dsh-dlp/github-token', version: 1, severity: 'critical', pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,251}|github_pat_[A-Za-z0-9_]{22,251})\b/g },
+    // Three formats, and the stateless one is first because the opaque
+    // alternative would otherwise claim its `ghs_` prefix and stop at the app
+    // id. GitHub's 2026-04-24 changelog gives the shape as `ghs_APPID_JWT`,
+    // "~520 characters" carrying two dots, rolled out from 2026-04-27 to late
+    // June; the opaque 40-character format stays because existing tokens
+    // "continue to work until they expire". GitHub's own suggested
+    // `ghs_[A-Za-z0-9.\-_]{36,}` is deliberately not what this uses: on a floor
+    // rule a false positive is a denial, and that class matches an ordinary
+    // dotted file name — `ghs_report-2026-04-24.summary-eu-west-1.json` is 40
+    // characters past the prefix. Anchoring on the JWT the changelog describes
+    // costs nothing a real token has.
+    {
+        id: 'dsh-dlp/github-token',
+        version: 2,
+        severity: 'critical',
+        pattern: /\b(?:ghs_[A-Za-z0-9]{1,32}_eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])|gh[pousr]_[A-Za-z0-9]{36,251}\b|github_pat_[A-Za-z0-9_]{22,251}\b)/g,
+    },
     { id: 'dsh-dlp/slack-token', version: 1, severity: 'critical', pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
     { id: 'dsh-dlp/stripe-secret-key', version: 1, severity: 'critical', pattern: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/g },
     { id: 'dsh-dlp/anthropic-api-key', version: 1, severity: 'critical', pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g },
@@ -89,7 +105,19 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/cloudflare-api-token', version: 1, severity: 'critical', pattern: /\bcf(?:ut|at|k)_[A-Za-z0-9_-]{40,}/g },
     { id: 'dsh-dlp/notion-token', version: 1, severity: 'critical', pattern: /\bntn_[A-Za-z0-9]{40,}/g },
     { id: 'dsh-dlp/private-key-block', version: 1, severity: 'critical', pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g },
-    { id: 'dsh-dlp/json-web-token', version: 1, severity: 'high', pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    // Anchored on the base64url alphabet rather than on word characters. `\b`
+    // was wrong in both directions: `_` is a word character, so a JWT behind any
+    // `prefix_` was invisible, and a signature's trailing `-` was trimmed off the
+    // reported span. A letter or digit before `eyJ` still refuses, which is what
+    // keeps a match from starting in the middle of a longer token; `_` and `-`
+    // are base64url characters but are separators far more often, and the two
+    // literal dots this pattern requires are in no base64url run.
+    {
+        id: 'dsh-dlp/json-web-token',
+        version: 2,
+        severity: 'high',
+        pattern: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/g,
+    },
     { id: 'dsh-dlp/credential-url', version: 1, severity: 'high', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s/@]+@[^\s/]+/gi },
     // Webhook URLs are bearer credentials whose path segment is the secret. They
     // are in tier 1 rather than left to secretlint because the telemetry seam is

package/lib/index.js

@@ -17,6 +17,8 @@
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
+ *    Prepended, so it redacts what the rest of the waterfall returned; a
+ *    listener registering later with the same option still runs ahead of it.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in
@@ -328,6 +330,11 @@ export function apply(ctx, config) {
         });
     }
     if (policy.resultRedaction) {
+        // Prepended for the same reason as the snapshot listener above, and with
+        // the same limit: listeners run outermost-first, so registering ahead of
+        // the chain is what lets this one redact the decision the rest of the
+        // waterfall settled on rather than have its own replaced afterwards. A
+        // listener registered later with the same option still lands ahead of it.
         ctx.on('tools/post-execute', async (exec, result, next) => {
             // The live definition, so a schema the deployment's own tool declares is
             // read from the registry rather than assumed. `exec.agent` is the scope
@@ -355,7 +362,7 @@ export function apply(ctx, config) {
                 });
             }
             return redacted.decision;
-        });
+        }, { prepend: true });
     }
     if (policy.remoteImageNeutralization) {
         ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {

package/lib/redaction.js

@@ -166,10 +166,37 @@ function pointerSegment(segment) {
     return segment.replace(/~/g, '~0').replace(/\//g, '~1');
 }
 /**
- * Redact every string inside a JSON value, at any depth.
+ * Replace every detected region of every string inside one structure.
  *
  * Object *keys* are left alone: a key is structure, not payload, and renaming
- * one would break the owning tool's `output.schema` on re-validation.
+ * one would break the owning tool's `output.schema` on re-validation. The
+ * structure is otherwise rebuilt unchanged — only string leaves differ — which
+ * is what lets the callers re-type the result as what they handed in.
+ * @param node - the structure to walk.
+ * @param path - JSON pointer of this node.
+ * @param scan - synchronous detector applied to each string.
+ * @param hasher - mints each span's keyed hash.
+ * @param spans - collects every span replaced anywhere in the walk.
+ * @returns the same structure with each detected region replaced.
+ */
+function redactNode(node, path, scan, hasher, spans) {
+    if (typeof node === 'string') {
+        const redacted = redactText(node, scan(node), hasher, path);
+        if (redacted.spans.length === 0)
+            return node;
+        spans.push(...redacted.spans);
+        return redacted.text;
+    }
+    if (Array.isArray(node)) {
+        return node.map((item, index) => redactNode(item, `${path}/${index}`, scan, hasher, spans));
+    }
+    if (typeof node === 'object' && node !== null) {
+        return Object.fromEntries(Object.entries(node).map(([key, item]) => [key, redactNode(item, `${path}/${pointerSegment(key)}`, scan, hasher, spans)]));
+    }
+    return node;
+}
+/**
+ * Redact every string inside a JSON value, at any depth.
  * @param value - the structure to redact.
  * @param scan - synchronous detector applied to each string.
  * @param hasher - mints each span's keyed hash.
@@ -177,26 +204,10 @@ function pointerSegment(segment) {
  */
 export function redactJson(value, scan, hasher) {
     const spans = [];
-    let changed = false;
-    const walk = (node, path) => {
-        if (typeof node === 'string') {
-            const redacted = redactText(node, scan(node), hasher, path);
-            if (redacted.spans.length === 0)
-                return node;
-            changed = true;
-            spans.push(...redacted.spans);
-            return redacted.text;
-        }
-        if (Array.isArray(node)) {
-            return node.map((item, index) => walk(item, `${path}/${index}`));
-        }
-        if (typeof node === 'object' && node !== null) {
-            return Object.fromEntries(Object.entries(node).map(([key, item]) => [key, walk(item, `${path}/${pointerSegment(key)}`)]));
-        }
-        return node;
-    };
-    const result = walk(value, '');
-    return { value: result, spans, changed };
+    // `redactNode` replaces strings with strings and rebuilds everything else as
+    // it found it, so what comes back is the same JSON shape it was handed.
+    const result = redactNode(value, '', scan, hasher, spans);
+    return { value: result, spans, changed: spans.length > 0 };
 }
 /**
  * Redact the text blocks of one model-facing content array. Non-text blocks
@@ -205,15 +216,16 @@ export function redactJson(value, scan, hasher) {
  * @param blocks - the content blocks to redact.
  * @param scan - synchronous detector applied to each block's text.
  * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off, for blocks that are not the decision's own.
  * @returns the redacted blocks, the spans replaced, and whether anything changed.
  */
-export function redactContent(blocks, scan, hasher) {
+export function redactContent(blocks, scan, hasher, pathPrefix = '') {
     const spans = [];
     let changed = false;
     const content = blocks.map((block, index) => {
         if (block.type !== 'text')
             return block;
-        const redacted = redactText(block.text, scan(block.text), hasher, `/${index}/text`);
+        const redacted = redactText(block.text, scan(block.text), hasher, `${pathPrefix}/${index}/text`);
         if (redacted.spans.length === 0)
             return block;
         changed = true;
@@ -222,3 +234,50 @@ export function redactContent(blocks, scan, hasher) {
     });
     return { content, spans, changed };
 }
+/**
+ * Source fields that say what a message *is* rather than what it says. `kind`
+ * selects the source arm, `form` selects the fields that arm carries, and
+ * `plugin` names the producer; replacing one of those would change the
+ * message's identity rather than redact its text.
+ */
+const MESSAGE_SOURCE_STRUCTURE = new Set(['kind', 'form', 'plugin']);
+/**
+ * Redact the text of the `UserMessage`s a tool decision carries.
+ *
+ * A message's payload is its model-facing `content` blocks and whatever text
+ * its `source` records: a `snapshot` source repeats the block text in
+ * `sections[].text`, a `notice` source repeats its opening in `summary`, and
+ * `MessageSourceMap` is merge-extensible, so a plugin's own source kind may
+ * carry text of its own. All of it is appended to the session log with the
+ * message, so redacting the blocks alone would leave a copy behind. Both
+ * halves are walked with the same scan and the same hasher, and identical text
+ * yields an identical placeholder, so the copies stay in step.
+ *
+ * `id` and `role` are left alone: the inbox addresses a message by its id.
+ * A message with nothing to replace is returned as the object it arrived as.
+ * @param messages - the contexts to redact, in the order they are attached.
+ * @param scan - synchronous detector applied to each string.
+ * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off.
+ * @returns the redacted messages, the spans replaced, and whether anything changed.
+ */
+export function redactUserMessages(messages, scan, hasher, pathPrefix) {
+    const spans = [];
+    const redacted = messages.map((message, index) => {
+        const path = `${pathPrefix}/${index}`;
+        const before = spans.length;
+        const content = redactContent(message.content, scan, hasher, `${path}/content`);
+        spans.push(...content.spans);
+        // Rebuilt entry by entry so the discriminants pass through untouched;
+        // `redactNode` returns each remaining field as the shape it was given, so
+        // the result is the same source with redacted text.
+        const source = Object.fromEntries(Object.entries(message.source).map(([key, value]) => [
+            key,
+            MESSAGE_SOURCE_STRUCTURE.has(key)
+                ? value
+                : redactNode(value, `${path}/source/${pointerSegment(key)}`, scan, hasher, spans),
+        ]));
+        return spans.length === before ? message : { ...message, content: content.content, source };
+    });
+    return { messages: redacted, spans, changed: spans.length > 0 };
+}

package/lib/results.js

@@ -4,15 +4,18 @@
  *
  * Both are best-effort by construction. A `tools/pre-execute` listener
  * registered ahead of ours can return without calling `next()` and neutralize
- * the breadth tier; a `tools/post-execute` listener ahead of ours can replace a
- * result after we redacted it. Only `ctx.tools.guard()` is order-independent.
+ * the breadth tier. Result redaction registers with `{ prepend: true }`, so it
+ * redacts whatever the rest of the waterfall settled on rather than having its
+ * own decision replaced afterwards — but `prepend` unshifts, so a listener
+ * that registers later with the same option still lands ahead of it. Only
+ * `ctx.tools.guard()` is order-independent, and it cannot rewrite a result.
  * What these seams buy is breadth: they can await, so `@secretlint/core`'s
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
  */
 import { DENY_SEVERITY, countUnicodeIndicators, scanAll, scanSync, severityRank, } from "./detectors.js";
 import { isEgressCapable } from "./paths.js";
-import { nestedStrings, redactContent, redactJson } from "./redaction.js";
+import { nestedStrings, redactContent, redactJson, redactUserMessages, } from "./redaction.js";
 import { redactionBreaksSchema } from "./schema.js";
 /**
  * Separator the strings of one result are rendered with before the
@@ -76,6 +79,17 @@ async function prepareScan(strings, policy) {
 function contentStrings(blocks) {
     return blocks.flatMap(block => block.type === 'text' ? [block.text] : []);
 }
+/**
+ * Text one set of `additionalContexts` carries: the model-facing blocks, plus
+ * whatever text the source records beside them — a `snapshot` source repeats
+ * the block text in `sections[].text`, a `notice` source its opening in
+ * `summary`, and a plugin's own source kind may carry more.
+ * @param messages - the contexts attached to a decision or ferried on a result.
+ * @returns every string those messages would put in front of the model or into the log.
+ */
+function messageStrings(messages) {
+    return messages.flatMap(message => [...contentStrings(message.content), ...nestedStrings(message.source)]);
+}
 /**
  * Strings the harness keeps in the durable result when the decision does not
  * replace the canonical value.
@@ -121,8 +135,23 @@ function withheldFeedback(spans) {
  *   persisted surfaces are already clean — a failed result, which has no
  *   value, or a success whose secret exists only in the rendered content.
  * - `block` is the fallback when neither works: a failed result whose `meta`
- *   carries a secret, or a value that still scans dirty after redaction.
- *   Blocking replaces the whole result, which is the only way to drop `meta`.
+ *   carries a secret, a value that still scans dirty after redaction, or a
+ *   context the tool body deferred. Blocking replaces the whole result, which
+ *   is the only way to drop either.
+ *
+ * `additionalContexts` reach both the model and the log — the loop hands each
+ * one to the inbox, which appends an `agent/inbox/spliced` event carrying the
+ * whole message — and they arrive from two places that are not equally
+ * reachable:
+ *
+ * - the ones this decision carries, which the returned decision owns, so they
+ *   are redacted in place. Rewriting them is a rewrite of another listener's
+ *   data, which is the same thing the value arm already does to a downstream
+ *   `accept{content}`, and it costs a placeholder rather than a lost result;
+ * - the ones the tool body deferred, which the registry concatenates ahead of
+ *   the decision's own on *every* accept arm. No accept can rewrite or drop
+ *   them, so a dirty one is withheld. That is `meta`'s case exactly, and it is
+ *   the one place scanning contexts can cost a successful result.
  *
  * Replacing the value is re-validated by the registry against the tool's
  * `output.schema`, and a schema that pins the redacted string rejects it. That
@@ -142,21 +171,30 @@ function withheldFeedback(spans) {
  * @returns the decision to return, the spans replaced, and scan completeness.
  */
 export async function redactDecision(decision, result, policy, hasher, outputSchema) {
+    const attached = decision.additionalContexts ?? [];
     if (decision.kind === 'block') {
-        const prepared = await prepareScan(contentStrings(decision.feedback), policy);
+        // A block exposes only the blocking decision's own contexts, so the
+        // feedback and those are the whole surface this arm can put in front of
+        // the model.
+        const prepared = await prepareScan([...contentStrings(decision.feedback), ...messageStrings(attached)], policy);
         const redacted = redactContent(decision.feedback, prepared.scan, hasher);
+        const redactedContexts = redactUserMessages(attached, prepared.scan, hasher, '/additionalContexts');
         return {
-            decision: redacted.changed ? { ...decision, feedback: redacted.content } : decision,
-            spans: redacted.spans,
+            decision: redacted.changed || redactedContexts.changed
+                ? {
+                    ...decision,
+                    feedback: redacted.content,
+                    ...redactedContexts.changed ? { additionalContexts: redactedContexts.messages } : {},
+                }
+                : decision,
+            spans: [...redacted.spans, ...redactedContexts.spans],
             truncatedScan: prepared.truncated,
             indicators: prepared.indicators,
         };
     }
     const replacedValue = Object.hasOwn(decision, 'value') ? decision.value : undefined;
     const replacedContent = Object.hasOwn(decision, 'content') ? decision.content : undefined;
-    const contexts = decision.additionalContexts === undefined
-        ? {}
-        : { additionalContexts: decision.additionalContexts };
+    const deferred = result.additionalContexts ?? [];
     // The value the harness will persist: a downstream replacement when there is
     // one, otherwise the tool's own. A failed result has no value at all.
     const value = replacedValue ?? (result.isError ? undefined : result.value);
@@ -164,31 +202,39 @@ export async function redactDecision(decision, result, policy, hasher, outputSch
     const persisted = replacedValue === undefined
         ? persistedStrings(result)
         : [...nestedStrings(replacedValue), ...result.meta === undefined ? [] : nestedStrings(result.meta)];
-    const prepared = await prepareScan([...persisted, ...visible], policy);
+    const prepared = await prepareScan([...persisted, ...visible, ...messageStrings(attached), ...messageStrings(deferred)], policy);
     const dirty = (strings) => strings.some(text => prepared.scan(text).length > 0);
+    const redactedContexts = redactUserMessages(attached, prepared.scan, hasher, '/additionalContexts');
+    // A clean set is passed on as the array it arrived as, so a downstream
+    // listener's own messages are not rebuilt for nothing.
+    const contexts = decision.additionalContexts === undefined
+        ? {}
+        : { additionalContexts: redactedContexts.changed ? redactedContexts.messages : decision.additionalContexts };
+    /** Withhold the result, keeping the redacted contexts the decision brought. */
+    const withhold = (spans, truncated) => ({
+        decision: { kind: 'block', feedback: withheldFeedback(spans), ...contexts },
+        spans: [...spans, ...redactedContexts.spans],
+        truncatedScan: truncated,
+        indicators: prepared.indicators,
+    });
+    // Deferred contexts ride every accept arm untouched, so a dirty one settles
+    // the decision before any arm is considered.
+    const deferredSpans = redactUserMessages(deferred, prepared.scan, hasher, '/result/additionalContexts').spans;
+    if (deferredSpans.length > 0)
+        return withhold(deferredSpans, prepared.truncated);
     if (value !== undefined && dirty(nestedStrings(value))) {
         const redacted = redactJson(value, prepared.scan, hasher);
         if (redactionBreaksSchema(outputSchema, value, redacted.value)) {
-            return {
-                decision: { kind: 'block', feedback: withheldFeedback(redacted.spans) },
-                spans: redacted.spans,
-                truncatedScan: prepared.truncated,
-                indicators: prepared.indicators,
-            };
+            return withhold(redacted.spans, prepared.truncated);
         }
         const remaining = nestedStrings(redacted.value);
         const residual = await prepareScan(remaining, policy);
         if (remaining.some(text => residual.scan(text).length > 0)) {
-            return {
-                decision: { kind: 'block', feedback: withheldFeedback(redacted.spans) },
-                spans: redacted.spans,
-                truncatedScan: prepared.truncated || residual.truncated,
-                indicators: prepared.indicators,
-            };
+            return withhold(redacted.spans, prepared.truncated || residual.truncated);
         }
         return {
             decision: { kind: 'accept', value: redacted.value, ...contexts },
-            spans: redacted.spans,
+            spans: [...redacted.spans, ...redactedContexts.spans],
             truncatedScan: prepared.truncated,
             indicators: prepared.indicators,
         };
@@ -196,22 +242,21 @@ export async function redactDecision(decision, result, policy, hasher, outputSch
     // The value is clean, so the durable result is clean unless `meta` — which
     // no accept arm can rewrite — carries something of its own.
     if (result.meta !== undefined && dirty(nestedStrings(result.meta))) {
-        const spans = redactJson(result.meta, prepared.scan, hasher).spans;
-        return {
-            decision: { kind: 'block', feedback: withheldFeedback(spans) },
-            spans,
-            truncatedScan: prepared.truncated,
-            indicators: prepared.indicators,
-        };
+        return withhold(redactJson(result.meta, prepared.scan, hasher).spans, prepared.truncated);
     }
     const blocks = replacedContent ?? result.content;
     const redacted = redactContent(blocks, prepared.scan, hasher);
     if (!redacted.changed) {
-        return { decision, spans: [], truncatedScan: prepared.truncated, indicators: prepared.indicators };
+        return {
+            decision: redactedContexts.changed ? { ...decision, ...contexts } : decision,
+            spans: redactedContexts.spans,
+            truncatedScan: prepared.truncated,
+            indicators: prepared.indicators,
+        };
     }
     return {
         decision: { kind: 'accept', content: redacted.content, ...contexts },
-        spans: redacted.spans,
+        spans: [...redacted.spans, ...redactedContexts.spans],
         truncatedScan: prepared.truncated,
         indicators: prepared.indicators,
     };

package/lib/sink.js

@@ -14,7 +14,7 @@
  * `callId`, and a producer-minted `decisionId`.
  * @module dsh-dlp/sink
  */
-import { appendFileSync } from 'node:fs';
+import { appendFileSync, chmodSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { stripControlSequences } from "./detectors.js";
 /**
@@ -26,6 +26,15 @@ export function newDecisionId() {
 }
 /** Payload version carried inside every record this plugin writes. */
 export const RECORD_VERSION = 1;
+/**
+ * Mode the sink file is kept at.
+ *
+ * The records hold rule ids, keyed hashes, tool names and call identity — no
+ * matched value ever reaches them — but they are the evidence that a decision
+ * happened, so they are readable by the operator's group and never by the
+ * world. This is the mode the sibling packages keep their spools at.
+ */
+export const AUDIT_MODE = 0o640;
 /**
  * One record with every string cleaned of terminal control sequences.
  *
@@ -68,12 +77,20 @@ export class AuditSink {
      * evidence, not enforcement, and letting a full disk turn every tool call
      * into a denial trades a confidentiality control for an availability
      * outage. A guard that throws would also skip `tools/post-execute` and so
-     * disable redaction for that call.
+     * disable redaction for that call. A failure to hold
+     * {@link AUDIT_MODE} is reported on the same terms: the record is written
+     * either way, and an operator who cannot see the mode cannot know who else
+     * can read the file.
      * @param record - the decision to record.
      */
     write(record) {
         try {
-            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`);
+            appendFileSync(this.#path, `${JSON.stringify(cleaned(record))}\n`, { mode: AUDIT_MODE });
+            // `appendFileSync`'s `mode` applies only when the call creates the file,
+            // and even then the umask masks it, so the mode is forced afterwards.
+            // Forcing it on every append also takes back a loosening applied to an
+            // existing sink.
+            chmodSync(this.#path, AUDIT_MODE);
         }
         catch (error) {
             this.#onFailure(error);

package/lib/telemetry.js

@@ -26,7 +26,7 @@
  * @module dsh-dlp/telemetry
  */
 import { scanSync } from "./detectors.js";
-import { placeholderFor, redactJson, redactText } from "./redaction.js";
+import { placeholderFor, redactJson, redactText, } from "./redaction.js";
 /**
  * What to tell the operator when the redaction seam will never dispatch.
  *

package/lib/types/cli.d.ts

@@ -23,6 +23,12 @@ export interface ReportRecord {
     readonly ruleIds: readonly string[];
     /** Invisible-character runs by rule id. */
     readonly unicode: Readonly<Record<string, number>>;
+    /**
+     * Which state left the ask tier with nowhere to ask, on the one kind that
+     * records it. The abstention allowed a call the tier would have asked
+     * about, so this is the field an operator changes to get the prompt back.
+     */
+    readonly askUnreachable?: string;
 }
 /**
  * Parse one JSONL line into the fields this command reports on.

package/lib/types/index.d.ts

@@ -17,6 +17,8 @@
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
+ *    Prepended, so it redacts what the rest of the waterfall returned; a
+ *    listener registering later with the same option still runs ahead of it.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in

package/lib/types/redaction.d.ts

@@ -14,9 +14,22 @@
  *   installation key, useless to anyone without the key.
  * @module dsh-dlp/redaction
  */
-import type { ContentBlock } from '@deepseek-ai/dsh-llm';
-import type { JsonValue } from '@deepseek-ai/dsh-session';
+import type { ContentBlock, UserMessage } from '@deepseek-ai/dsh-llm';
 import { type Detection, type Severity } from './detectors.ts';
+/**
+ * A value that round-trips through JSON without loss.
+ *
+ * Declared here rather than imported. Upstream moved this alias out of
+ * `@deepseek-ai/dsh-session` and into `@deepseek-ai/dsh-util-values` in
+ * `0.1.2-alpha.2`; the new package does not exist in any release the peer
+ * ranges also admit, and a TypeScript import cannot name two homes, so either
+ * import breaks half the supported range. The alias is structural and carries
+ * no runtime, so a local copy is assignable in both directions wherever it
+ * meets upstream's — and nothing outside this package is handed one.
+ */
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
 /** One replaced region, described without disclosing what it held. */
 export interface RedactedSpan {
     /** Rule that justified the replacement; the strictest one when spans merged. */
@@ -83,9 +96,6 @@ export declare function redactText(text: string, detections: readonly Detection[
 export declare function nestedStrings(value: unknown): string[];
 /**
  * Redact every string inside a JSON value, at any depth.
- *
- * Object *keys* are left alone: a key is structure, not payload, and renaming
- * one would break the owning tool's `output.schema` on re-validation.
  * @param value - the structure to redact.
  * @param scan - synchronous detector applied to each string.
  * @param hasher - mints each span's keyed hash.
@@ -103,11 +113,37 @@ export declare function redactJson(value: JsonValue, scan: (text: string) => rea
  * @param blocks - the content blocks to redact.
  * @param scan - synchronous detector applied to each block's text.
  * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off, for blocks that are not the decision's own.
  * @returns the redacted blocks, the spans replaced, and whether anything changed.
  */
-export declare function redactContent(blocks: readonly ContentBlock[], scan: (text: string) => readonly Detection[], hasher: SpanHasher): {
+export declare function redactContent(blocks: readonly ContentBlock[], scan: (text: string) => readonly Detection[], hasher: SpanHasher, pathPrefix?: string): {
     content: ContentBlock[];
     spans: readonly RedactedSpan[];
     changed: boolean;
 };
+/**
+ * Redact the text of the `UserMessage`s a tool decision carries.
+ *
+ * A message's payload is its model-facing `content` blocks and whatever text
+ * its `source` records: a `snapshot` source repeats the block text in
+ * `sections[].text`, a `notice` source repeats its opening in `summary`, and
+ * `MessageSourceMap` is merge-extensible, so a plugin's own source kind may
+ * carry text of its own. All of it is appended to the session log with the
+ * message, so redacting the blocks alone would leave a copy behind. Both
+ * halves are walked with the same scan and the same hasher, and identical text
+ * yields an identical placeholder, so the copies stay in step.
+ *
+ * `id` and `role` are left alone: the inbox addresses a message by its id.
+ * A message with nothing to replace is returned as the object it arrived as.
+ * @param messages - the contexts to redact, in the order they are attached.
+ * @param scan - synchronous detector applied to each string.
+ * @param hasher - mints each span's keyed hash.
+ * @param pathPrefix - JSON pointer the recorded pointers hang off.
+ * @returns the redacted messages, the spans replaced, and whether anything changed.
+ */
+export declare function redactUserMessages(messages: readonly UserMessage[], scan: (text: string) => readonly Detection[], hasher: SpanHasher, pathPrefix: string): {
+    messages: UserMessage[];
+    spans: readonly RedactedSpan[];
+    changed: boolean;
+};
 //# sourceMappingURL=redaction.d.ts.map

package/lib/types/results.d.ts

@@ -4,8 +4,11 @@
  *
  * Both are best-effort by construction. A `tools/pre-execute` listener
  * registered ahead of ours can return without calling `next()` and neutralize
- * the breadth tier; a `tools/post-execute` listener ahead of ours can replace a
- * result after we redacted it. Only `ctx.tools.guard()` is order-independent.
+ * the breadth tier. Result redaction registers with `{ prepend: true }`, so it
+ * redacts whatever the rest of the waterfall settled on rather than having its
+ * own decision replaced afterwards — but `prepend` unshifts, so a listener
+ * that registers later with the same option still lands ahead of it. Only
+ * `ctx.tools.guard()` is order-independent, and it cannot rewrite a result.
  * What these seams buy is breadth: they can await, so `@secretlint/core`'s
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
@@ -40,8 +43,23 @@ export interface ResultRedaction {
  *   persisted surfaces are already clean — a failed result, which has no
  *   value, or a success whose secret exists only in the rendered content.
  * - `block` is the fallback when neither works: a failed result whose `meta`
- *   carries a secret, or a value that still scans dirty after redaction.
- *   Blocking replaces the whole result, which is the only way to drop `meta`.
+ *   carries a secret, a value that still scans dirty after redaction, or a
+ *   context the tool body deferred. Blocking replaces the whole result, which
+ *   is the only way to drop either.
+ *
+ * `additionalContexts` reach both the model and the log — the loop hands each
+ * one to the inbox, which appends an `agent/inbox/spliced` event carrying the
+ * whole message — and they arrive from two places that are not equally
+ * reachable:
+ *
+ * - the ones this decision carries, which the returned decision owns, so they
+ *   are redacted in place. Rewriting them is a rewrite of another listener's
+ *   data, which is the same thing the value arm already does to a downstream
+ *   `accept{content}`, and it costs a placeholder rather than a lost result;
+ * - the ones the tool body deferred, which the registry concatenates ahead of
+ *   the decision's own on *every* accept arm. No accept can rewrite or drop
+ *   them, so a dirty one is withheld. That is `meta`'s case exactly, and it is
+ *   the one place scanning contexts can cost a successful result.
  *
  * Replacing the value is re-validated by the registry against the tool's
  * `output.schema`, and a schema that pins the redacted string rejects it. That

package/lib/types/sink.d.ts

@@ -28,6 +28,15 @@ export type DecisionId = string & {
 export declare function newDecisionId(): DecisionId;
 /** Payload version carried inside every record this plugin writes. */
 export declare const RECORD_VERSION = 1;
+/**
+ * Mode the sink file is kept at.
+ *
+ * The records hold rule ids, keyed hashes, tool names and call identity — no
+ * matched value ever reaches them — but they are the evidence that a decision
+ * happened, so they are readable by the operator's group and never by the
+ * world. This is the mode the sibling packages keep their spools at.
+ */
+export declare const AUDIT_MODE = 416;
 /** What produced one audit record. */
 export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
@@ -103,7 +112,10 @@ export declare class AuditSink {
      * evidence, not enforcement, and letting a full disk turn every tool call
      * into a denial trades a confidentiality control for an availability
      * outage. A guard that throws would also skip `tools/post-execute` and so
-     * disable redaction for that call.
+     * disable redaction for that call. A failure to hold
+     * {@link AUDIT_MODE} is reported on the same terms: the record is written
+     * either way, and an operator who cannot see the mode cannot know who else
+     * can read the file.
      * @param record - the decision to record.
      */
     write(record: AuditRecord): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",
@@ -50,11 +50,11 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ~0.1.1-rc.0",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ~0.1.1-rc.0",
+    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6 || ~0.1.1-rc.0",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ~0.1.1-rc.0"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "3.18.1",
@@ -63,7 +63,7 @@
     "js-yaml": "^4.1.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/cordis": "4.0.2",
     "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
     "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
     "@deepseek-ai/dsh-llm-mock-server": "0.1.0-rc.6",