dsh-dlp 0.8.1 → 0.9.0

package/README.md

@@ -12,24 +12,34 @@ built as an out-of-repo plugin.
    following symlinks first.
 2. **Redacts secrets out of tool results** before the model reads them and before the session log
    records them, withholding a result it cannot clean.
-3. **Redacts secrets out of exported telemetry**, closing a hole where `DSH_TELEMETRY_MODE=FULL`
+3. **Redacts secrets out of the messages a step enters with** — the context a listener splices
+   in (the workspace `AGENTS.md`/`CLAUDE.md` chain, a captured tmux pane, a hook's
+   `additionalContext`, a skill body a `/name` token loaded) and the input the loop claimed from
+   the inbox that the user did not type (a `dsh-webhook` delivery's third-party payload, a
+   settled subagent result, an agent relay). All of it reaches the model and the durable log
+   through `agent/pre-step` without ever being a tool result. A message whose `source.kind` is
+   `user` is exempt: a secret a person deliberately types into their own prompt is not a leak
+   this plugin intercepts. The `agent/inbox/spliced` delivery record keeps a delivery's original
+   text, which is deliberate — it derives no model message, and an operator investigating a
+   webhook incident needs to read what was actually delivered.
+4. **Redacts secrets out of exported telemetry**, closing a hole where `DSH_TELEMETRY_MODE=FULL`
    ships message text, tool arguments, results and workspace paths in the clear.
-4. **Strips invisible characters that carry hidden instructions** — the Tags block, bidi
+5. **Strips invisible characters that carry hidden instructions** — the Tags block, bidi
    overrides, runs of variation selectors — and strips terminal control sequences from the audit
    lane so a tool result cannot forge its own audit record.
-5. **Neutralises remote markdown images in assistant output** and detects a tool call another
+6. **Neutralises remote markdown images in assistant output** and detects a tool call another
    plugin rewrote after the session log recorded it.
-6. **Asks before the agent writes a file that changes future behaviour** — agent settings and
+7. **Asks before the agent writes a file that changes future behaviour** — agent settings and
    hooks, `CLAUDE.md`, `.claude/rules/**` and the other agent rules directories, prompt
    templates, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI workflows, shell startup files,
    `pnpm-workspace.yaml` — and before it writes a `*_BASE_URL` that would redirect a provider
    credential.
-7. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
+8. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
    `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
    prompts rather than controls: they live at `tools/pre-execute`, they can be neutralised, and
    they abstain wherever the approval seam prompts nobody — which includes every install under
    `DSH_PERMISSION_MODE=danger-full-access` and a stock headless install under any mode.
-8. **Writes an audit record for every decision.** A redaction or denial names the rule, its
+9. **Writes an audit record for every decision.** A redaction or denial names the rule, its
    version, the offsets and a keyed hash; the three kinds with no matched region to describe —
    an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
    the destination hostname instead. Never the secret, never the path or command that matched.
@@ -98,6 +108,8 @@ load.
     breadthTier: true
     resultRedaction: true
     telemetryRedaction: true
+    stepContextRedaction: true
+    claimedInputRedaction: true
     configWriteAsk: true
     approvalSuppressionAsk: true
 ```

package/cordis.patch.yml

@@ -19,6 +19,8 @@
         breadthTier: true
         resultRedaction: true
         telemetryRedaction: true
+        stepContextRedaction: true
+        claimedInputRedaction: true
         remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true
         configWriteAsk: true

package/lib/index.js

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Six registrations, in descending order of how much they can be trusted:
+ * Seven registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -19,6 +19,17 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  *    Prepended, so it redacts what the rest of the waterfall returned; a
  *    listener registering later with the same option still runs ahead of it.
+ * 3b. `agent/pre-step` — redaction of the messages one step enters with: the
+ *    context a listener splices in (the workspace instruction chain, the
+ *    session skill catalog, a captured terminal pane, a hook's
+ *    `additionalContext`) and the input the loop claimed from the inbox that
+ *    the user did not type (a `dsh-webhook` delivery, a subagent's settled
+ *    result, an agent relay). The loop appends what this waterfall returns as
+ *    the `user/message` surface events every request is derived from, so the
+ *    model-visible durable copy is the redacted one. A claimed message's
+ *    earlier `agent/inbox/spliced` delivery record keeps the original; it
+ *    derives no model message, and ADR §30 says why that is the wanted
+ *    asymmetry. `source.kind: 'user'` is exempt.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in
@@ -47,6 +58,7 @@ import { evaluateConfigWrite } from "./config-writes.js";
 import { evaluateApprovalSuppression } from "./approvals.js";
 import { approvalSeamNotice, askReach } from "./approval-reach.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
+import { redactStepContext } from "./steps.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
 export { Config } from "./policy.js";
@@ -364,6 +376,43 @@ export function apply(ctx, config) {
             return redacted.decision;
         }, { prepend: true });
     }
+    if (policy.stepContextRedaction || policy.claimedInputRedaction) {
+        // One listener for both toggles: they cover two classes of message
+        // entering the same waterfall, and scanning them in one pass is what finds
+        // a secret split across the boundary between them. `redactStepContext`
+        // reads both flags and leaves an out-of-scope message as the object it
+        // arrived as.
+        //
+        // Prepended for the reason the result and telemetry seams are: listeners
+        // run outermost-first, so registering ahead of the chain is what lets this
+        // one redact the messages the rest of the waterfall spliced in rather than
+        // have its own replacement discarded afterwards.
+        ctx.on('agent/pre-step', async (payload, next) => {
+            const redacted = await redactStepContext(await next(), payload.messages, policy, hasher);
+            const indicators = Object.keys(redacted.indicators).length > 0
+                ? { unicode: redacted.indicators }
+                : {};
+            if (redacted.spans.length > 0 || redacted.truncatedScan || Object.keys(indicators).length > 0) {
+                sink.write({
+                    v: RECORD_VERSION,
+                    time: new Date().toISOString(),
+                    kind: 'step-context-redaction',
+                    decisionId: newDecisionId(),
+                    sessionId: String(payload.agent.session.id),
+                    turn: payload.turn,
+                    step: payload.step,
+                    spans: redacted.spans,
+                    ...redacted.truncatedScan ? { truncatedScan: true } : {},
+                    ...indicators,
+                    // Only when the pass covered claimed input: an operator counting
+                    // deliveries must not have to read an empty list as "none arrived"
+                    // on every workspace-instruction record.
+                    ...redacted.claimedSources.length > 0 ? { claimedSources: redacted.claimedSources } : {},
+                });
+            }
+            return redacted.decision;
+        }, { prepend: true });
+    }
     if (policy.remoteImageNeutralization) {
         ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {
             sink.write({
@@ -397,6 +446,15 @@ export function apply(ctx, config) {
                 });
             }
             return redacted.record;
-        });
+            // Prepended for the reason the other seams are: a listener that returns
+            // without calling `next()` vetoes every listener behind it for that
+            // dispatch — `Events.dispatch()` hands the waterfall a fresh array, so
+            // the registration survives and runs again on the next dispatch — and
+            // this one is the only thing standing between an exported telemetry
+            // record and the wire. One vetoed dispatch is one record exported in the
+            // clear, which is why position matters here. Best-effort, as at the
+            // mutation snapshot: another plugin registering later with the same
+            // option lands ahead again.
+        }, { prepend: true });
     }
 }

package/lib/policy.js

@@ -30,6 +30,8 @@ export const Config = z.object({
     breadthTier: z.boolean().default(true),
     resultRedaction: z.boolean().default(true),
     telemetryRedaction: z.boolean().default(true),
+    stepContextRedaction: z.boolean().default(true),
+    claimedInputRedaction: z.boolean().default(true),
     remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
     configWriteAsk: z.boolean().default(true),
@@ -40,6 +42,8 @@ const ENABLEABLE = [
     'breadthTier',
     'resultRedaction',
     'telemetryRedaction',
+    'stepContextRedaction',
+    'claimedInputRedaction',
     'remoteImageNeutralization',
     'redactTelemetryWorkspacePaths',
     'configWriteAsk',
@@ -283,6 +287,8 @@ export function resolvePolicy(config, repo) {
         breadthTier: enabled('breadthTier'),
         resultRedaction: enabled('resultRedaction'),
         telemetryRedaction: enabled('telemetryRedaction'),
+        stepContextRedaction: enabled('stepContextRedaction'),
+        claimedInputRedaction: enabled('claimedInputRedaction'),
         remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
         configWriteAsk: enabled('configWriteAsk'),

package/lib/results.js

@@ -44,7 +44,7 @@ const RENDER_SEPARATOR = '\n';
  * @param policy - the effective policy.
  * @returns a memoized lookup, the invisible-character counts, and whether tier 2 saw less than the whole rendering.
  */
-async function prepareScan(strings, policy) {
+export async function prepareScan(strings, policy) {
     const rendered = strings.join(RENDER_SEPARATOR);
     const { detections, truncated } = await scanAll(rendered, policy.syncRules, policy.maxScanBytes);
     const memo = new Map();
@@ -87,7 +87,7 @@ function contentStrings(blocks) {
  * @param messages - the contexts attached to a decision or ferried on a result.
  * @returns every string those messages would put in front of the model or into the log.
  */
-function messageStrings(messages) {
+export function messageStrings(messages) {
     return messages.flatMap(message => [...contentStrings(message.content), ...nestedStrings(message.source)]);
 }
 /**

package/lib/steps.js

@@ -0,0 +1,117 @@
+/**
+ * Redaction of the messages one step enters with: the context a
+ * `agent/pre-step` listener splices in, and the input the loop claimed from
+ * the inbox that the user did not type.
+ *
+ * A tool result is not the only text that reaches the model. The agent loop
+ * dispatches `agent/pre-step` as a waterfall, appends every message the
+ * returned decision carries as a `user/message` surface event, and derives the
+ * next request from that surface. Two classes of text arrive that way.
+ *
+ * The first is what the waterfall itself adds, and nothing else scans it:
+ * `dsh-agent-instructions` splices the workspace `AGENTS.md`/`CLAUDE.md`
+ * chain, `dsh-tmux-context` splices captured pane text, the Claude Code and
+ * Codex hook bridges splice a hook command's `additionalContext`, and
+ * `dsh-tool-skill` splices a skill body a `/name` token asked for.
+ *
+ * The second is what the loop claimed from the inbox. Most of that is not the
+ * user typing either: `dsh-webhook` admits a verified third-party delivery's
+ * payload with `agent.followup()`, a subagent's settled result and an
+ * agent-to-agent relay arrive the same way, and so does anything
+ * `agent.inject()` seeded. {@link isUserTyped} is the exemption, and it is the
+ * only one: a secret a person deliberately types into their own prompt is not
+ * a leak this plugin intercepts.
+ *
+ * A claimed message differs from an added one in exactly one way, and it is
+ * narrower than it looks. Its delivery was already recorded as
+ * `agent/inbox/spliced` before this waterfall ran, and no seam can rewrite a
+ * committed event. That event is not a surface event — `SurfaceEventType` is
+ * `user/message | assistant/message | tool/result` — so it derives no model
+ * message and no request is built from it. The copy the model reads is the
+ * `user/message` the loop appends after this waterfall, which is the copy this
+ * pass rewrites. "Model-visible ⟺ logged" therefore still holds; what the
+ * delivery record keeps is the original text of an untrusted delivery, which
+ * is evidence rather than a disagreement. ADR §30 states that asymmetry, and
+ * `tests/e2e/step-context.e2e.ts` pins it.
+ *
+ * Best-effort, like every seam here that is not `ctx.tools.guard()`: this
+ * listener registers with `{ prepend: true }` so it sees what the rest of the
+ * waterfall settled on, and a listener registering later with the same option
+ * lands ahead of it again.
+ * @module dsh-dlp/steps
+ */
+import { messageStrings, prepareScan } from "./results.js";
+import { redactUserMessages } from "./redaction.js";
+/**
+ * Whether one message the loop claimed from the inbox is the user's own
+ * typing, and therefore exempt.
+ *
+ * `MessageSourceMap` is merge-extensible and every producer picks its own
+ * `kind`, so the exemption is a single allowed value rather than a list of
+ * denied ones: a source kind added by a package this plugin has never heard of
+ * is redacted rather than trusted. In the installed harness `kind: 'user'` is
+ * what the interactive entry points supply — `dsh-headless` for a CLI task,
+ * `dsh-acp` for an ACP prompt, `dsh-sdk-jsonrpc-server` for an SDK one, and
+ * `dsh-api-session-controller`'s `user-rpc` source for a browser prompt, which
+ * adds `rpcId` beside the same `kind`. `dsh-webhook`'s deliveries carry
+ * `kind: 'webhook'`, and the harness's own webhook invariant discriminates on
+ * exactly that value.
+ *
+ * Two producers borrow the value for text a person did not type: `dsh-subagent`
+ * and `dsh-subagent-in-process-driver` open a child agent with the parent's
+ * prompt under `kind: 'user'`. Those stay exempt here. Distinguishing them
+ * needs a fact the source does not carry, and inventing one would put a
+ * guessed value in a security decision.
+ * @param message - one message the loop claimed from the inbox.
+ * @returns whether the message came from a person typing into their own prompt.
+ */
+export function isUserTyped(message) {
+    return message.source.kind === 'user';
+}
+/**
+ * Redact the messages entering one step.
+ *
+ * @param decision - what the rest of the waterfall settled on.
+ * @param claimed - the messages the loop claimed from the inbox.
+ * @param policy - the effective policy after the tighten-only merge.
+ * @param hasher - mints each span's keyed hash.
+ * @returns the decision to return, plus what the pass found.
+ */
+export async function redactStepContext(decision, claimed, policy, hasher) {
+    const nothing = { spans: [], truncatedScan: false, indicators: {}, claimedSources: [] };
+    if (decision.kind !== 'enter')
+        return { decision, ...nothing };
+    // Object identity, which is what the loop and the shipped providers use: a
+    // provider splices its own message into the array it was handed, so a
+    // claimed message is the same object it arrived as.
+    const claimedSet = new Set(claimed);
+    const inScope = (message) => claimedSet.has(message)
+        ? policy.claimedInputRedaction && !isUserTyped(message)
+        : policy.stepContextRedaction;
+    const selected = decision.messages.filter(inScope);
+    if (selected.length === 0)
+        return { decision, ...nothing };
+    const claimedSources = [...new Set(selected.filter(message => claimedSet.has(message)).map(message => message.source.kind))];
+    const prepared = await prepareScan(messageStrings(selected), policy);
+    const redacted = redactUserMessages(selected, prepared.scan, hasher, '/messages');
+    const base = {
+        spans: redacted.spans,
+        truncatedScan: prepared.truncated,
+        indicators: prepared.indicators,
+        claimedSources,
+    };
+    if (!redacted.changed)
+        return { decision, ...base };
+    // Rebuilt position by position so every message keeps the place it had:
+    // ordering is what decides whether a workspace instruction reads before or
+    // after the user's request.
+    const replacements = [...redacted.messages];
+    const messages = decision.messages.map((message) => {
+        if (!inScope(message))
+            return message;
+        const replacement = replacements.shift();
+        /* v8 ignore next -- `redactUserMessages` returns one message per input, so this never runs short. */
+        return replacement ?? message;
+    });
+    return { decision: { ...decision, messages }, ...base };
+}

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Six registrations, in descending order of how much they can be trusted:
+ * Seven registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -19,6 +19,17 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  *    Prepended, so it redacts what the rest of the waterfall returned; a
  *    listener registering later with the same option still runs ahead of it.
+ * 3b. `agent/pre-step` — redaction of the messages one step enters with: the
+ *    context a listener splices in (the workspace instruction chain, the
+ *    session skill catalog, a captured terminal pane, a hook's
+ *    `additionalContext`) and the input the loop claimed from the inbox that
+ *    the user did not type (a `dsh-webhook` delivery, a subagent's settled
+ *    result, an agent relay). The loop appends what this waterfall returns as
+ *    the `user/message` surface events every request is derived from, so the
+ *    model-visible durable copy is the redacted one. A claimed message's
+ *    earlier `agent/inbox/spliced` delivery record keeps the original; it
+ *    derives no model message, and ADR §30 says why that is the wanted
+ *    asymmetry. `source.kind: 'user'` is exempt.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in

package/lib/types/policy.d.ts

@@ -33,6 +33,21 @@ export interface Config {
     resultRedaction: boolean;
     /** Whether `session-telemetry/record` redaction runs. */
     telemetryRedaction: boolean;
+    /**
+     * Whether the context an `agent/pre-step` listener splices into a step —
+     * the workspace instruction chain, captured terminal panes, a hook's
+     * `additionalContext`, a skill body a `/name` token asked for — is redacted
+     * before the loop logs it and builds the next request from it.
+     */
+    stepContextRedaction: boolean;
+    /**
+     * Whether the messages the loop claimed from the inbox are redacted before
+     * the step logs them and builds its request from them, for every message the
+     * user did not type: a `dsh-webhook` delivery's third-party payload, a
+     * subagent's settled result, an agent-to-agent relay, anything
+     * `agent.inject()` seeded. A message whose `source.kind` is `user` is exempt.
+     */
+    claimedInputRedaction: boolean;
     /** Whether remote markdown image destinations are neutralised in assistant output. */
     remoteImageNeutralization: boolean;
     /** Whether telemetry's `session.cwd` attribute is replaced with a keyed hash. */
@@ -52,7 +67,7 @@ export interface Config {
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk", "approvalSuppressionAsk"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "stepContextRedaction", "claimedInputRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk", "approvalSuppressionAsk"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -73,6 +88,8 @@ export interface ResolvedPolicy {
     readonly breadthTier: boolean;
     readonly resultRedaction: boolean;
     readonly telemetryRedaction: boolean;
+    readonly stepContextRedaction: boolean;
+    readonly claimedInputRedaction: boolean;
     readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
     readonly configWriteAsk: boolean;

package/lib/types/results.d.ts

@@ -13,9 +13,48 @@
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
  */
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
 import type { JsonSchemaNode, PostToolDecision, PreToolDecision, ToolExecution, ToolExecutionResult } from '@deepseek-ai/dsh-tools';
+import { type Detection } from './detectors.ts';
 import type { ResolvedPolicy } from './policy.ts';
 import { type RedactedSpan, type SpanHasher } from './redaction.ts';
+/** A scan function over already-scanned strings, plus how complete the scan was. */
+export interface PreparedScan {
+    readonly scan: (text: string) => readonly Detection[];
+    readonly truncated: boolean;
+    /** Runs of each invisible-character class in the whole rendering, by rule id. */
+    readonly indicators: Readonly<Record<string, number>>;
+}
+/**
+ * Scan a set of strings once and hand back a synchronous lookup, so the
+ * redaction walkers stay synchronous while detection stays async.
+ *
+ * The strings are scanned twice over: each on its own by tier 1, and all of
+ * them joined by both tiers. The joined pass is what finds a secret split
+ * across strings — a PEM block arriving as one `lines[i].text` per line, a
+ * token spanning two content blocks — which no per-string walk can see; its
+ * offsets are then mapped back onto the individual strings, because that is
+ * what the redaction walkers splice.
+ *
+ * Tier 2 runs once, over the joined text, and is budgeted by characters
+ * through `maxScanBytes`. One `lintSource` call per string would multiply a
+ * fixed per-call cost by however many pieces the tool happened to split its
+ * output into, and a budget counted in strings would make how much of a result
+ * is scanned depend on the same accident.
+ * @param strings - every string that will be redacted, in render order.
+ * @param policy - the effective policy.
+ * @returns a memoized lookup, the invisible-character counts, and whether tier 2 saw less than the whole rendering.
+ */
+export declare function prepareScan(strings: readonly string[], policy: ResolvedPolicy): Promise<PreparedScan>;
+/**
+ * Text one set of `additionalContexts` carries: the model-facing blocks, plus
+ * whatever text the source records beside them — a `snapshot` source repeats
+ * the block text in `sections[].text`, a `notice` source its opening in
+ * `summary`, and a plugin's own source kind may carry more.
+ * @param messages - the contexts attached to a decision or ferried on a result.
+ * @returns every string those messages would put in front of the model or into the log.
+ */
+export declare function messageStrings(messages: readonly UserMessage[]): string[];
 /** What a redaction pass produced, before an arm is chosen. */
 export interface ResultRedaction {
     readonly decision: PostToolDecision;

package/lib/types/sink.d.ts

@@ -38,7 +38,7 @@ export declare const RECORD_VERSION = 1;
  */
 export declare const AUDIT_MODE = 416;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'step-context-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -83,6 +83,14 @@ export interface AuditRecord {
      * operator needs to change to get the prompt back.
      */
     readonly askUnreachable?: AskUnreachable;
+    /**
+     * The distinct `source.kind` of the inbox-claimed messages a
+     * `step-context-redaction` pass covered, present only when it covered any.
+     * A kind names the producer that delivered the text — `webhook` for a
+     * `dsh-webhook` delivery — which is what separates a redacted third-party
+     * payload from a redacted workspace instruction file.
+     */
+    readonly claimedSources?: readonly string[];
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
     /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */

package/lib/types/steps.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Redaction of the messages one step enters with: the context a
+ * `agent/pre-step` listener splices in, and the input the loop claimed from
+ * the inbox that the user did not type.
+ *
+ * A tool result is not the only text that reaches the model. The agent loop
+ * dispatches `agent/pre-step` as a waterfall, appends every message the
+ * returned decision carries as a `user/message` surface event, and derives the
+ * next request from that surface. Two classes of text arrive that way.
+ *
+ * The first is what the waterfall itself adds, and nothing else scans it:
+ * `dsh-agent-instructions` splices the workspace `AGENTS.md`/`CLAUDE.md`
+ * chain, `dsh-tmux-context` splices captured pane text, the Claude Code and
+ * Codex hook bridges splice a hook command's `additionalContext`, and
+ * `dsh-tool-skill` splices a skill body a `/name` token asked for.
+ *
+ * The second is what the loop claimed from the inbox. Most of that is not the
+ * user typing either: `dsh-webhook` admits a verified third-party delivery's
+ * payload with `agent.followup()`, a subagent's settled result and an
+ * agent-to-agent relay arrive the same way, and so does anything
+ * `agent.inject()` seeded. {@link isUserTyped} is the exemption, and it is the
+ * only one: a secret a person deliberately types into their own prompt is not
+ * a leak this plugin intercepts.
+ *
+ * A claimed message differs from an added one in exactly one way, and it is
+ * narrower than it looks. Its delivery was already recorded as
+ * `agent/inbox/spliced` before this waterfall ran, and no seam can rewrite a
+ * committed event. That event is not a surface event — `SurfaceEventType` is
+ * `user/message | assistant/message | tool/result` — so it derives no model
+ * message and no request is built from it. The copy the model reads is the
+ * `user/message` the loop appends after this waterfall, which is the copy this
+ * pass rewrites. "Model-visible ⟺ logged" therefore still holds; what the
+ * delivery record keeps is the original text of an untrusted delivery, which
+ * is evidence rather than a disagreement. ADR §30 states that asymmetry, and
+ * `tests/e2e/step-context.e2e.ts` pins it.
+ *
+ * Best-effort, like every seam here that is not `ctx.tools.guard()`: this
+ * listener registers with `{ prepend: true }` so it sees what the rest of the
+ * waterfall settled on, and a listener registering later with the same option
+ * lands ahead of it again.
+ * @module dsh-dlp/steps
+ */
+import type { PreStepDecision } from '@deepseek-ai/dsh-agent';
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
+import type { ResolvedPolicy } from './policy.ts';
+import { type RedactedSpan, type SpanHasher } from './redaction.ts';
+/** What one pass over a step's entering messages produced. */
+export interface StepRedaction {
+    /** The decision to return: the same object when nothing was replaced. */
+    readonly decision: PreStepDecision;
+    /** The regions replaced, described by rule identity, offsets and keyed hash only. */
+    readonly spans: readonly RedactedSpan[];
+    /** Set when the scanned text exceeded `maxScanBytes` and tier 2 saw less than all of it. */
+    readonly truncatedScan: boolean;
+    /** Runs of each invisible-character class the scanned messages carried, by rule id. */
+    readonly indicators: Readonly<Record<string, number>>;
+    /**
+     * The distinct `source.kind` of every inbox-claimed message this pass
+     * scanned, in first-seen order. Empty when the pass only covered messages
+     * the waterfall added. An operator reading the sink needs this to tell a
+     * redacted workspace instruction from a redacted third-party delivery.
+     */
+    readonly claimedSources: readonly string[];
+}
+/**
+ * Whether one message the loop claimed from the inbox is the user's own
+ * typing, and therefore exempt.
+ *
+ * `MessageSourceMap` is merge-extensible and every producer picks its own
+ * `kind`, so the exemption is a single allowed value rather than a list of
+ * denied ones: a source kind added by a package this plugin has never heard of
+ * is redacted rather than trusted. In the installed harness `kind: 'user'` is
+ * what the interactive entry points supply — `dsh-headless` for a CLI task,
+ * `dsh-acp` for an ACP prompt, `dsh-sdk-jsonrpc-server` for an SDK one, and
+ * `dsh-api-session-controller`'s `user-rpc` source for a browser prompt, which
+ * adds `rpcId` beside the same `kind`. `dsh-webhook`'s deliveries carry
+ * `kind: 'webhook'`, and the harness's own webhook invariant discriminates on
+ * exactly that value.
+ *
+ * Two producers borrow the value for text a person did not type: `dsh-subagent`
+ * and `dsh-subagent-in-process-driver` open a child agent with the parent's
+ * prompt under `kind: 'user'`. Those stay exempt here. Distinguishing them
+ * needs a fact the source does not carry, and inventing one would put a
+ * guessed value in a security decision.
+ * @param message - one message the loop claimed from the inbox.
+ * @returns whether the message came from a person typing into their own prompt.
+ */
+export declare function isUserTyped(message: UserMessage): boolean;
+/**
+ * Redact the messages entering one step.
+ *
+ * @param decision - what the rest of the waterfall settled on.
+ * @param claimed - the messages the loop claimed from the inbox.
+ * @param policy - the effective policy after the tighten-only merge.
+ * @param hasher - mints each span's keyed hash.
+ * @returns the decision to return, plus what the pass found.
+ */
+export declare function redactStepContext(decision: PreStepDecision, claimed: readonly UserMessage[], policy: ResolvedPolicy, hasher: SpanHasher): Promise<StepRedaction>;
+//# sourceMappingURL=steps.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",
@@ -51,10 +51,11 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ~0.1.1-rc.0",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ~0.1.1-rc.0",
-    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6 || ~0.1.1-rc.0",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ~0.1.1-rc.0"
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "3.18.1",