dsh-dlp 0.8.2 → 0.10.0

package/README.md

@@ -12,28 +12,42 @@ built as an out-of-repo plugin.
    following symlinks first.
 2. **Redacts secrets out of tool results** before the model reads them and before the session log
    records them, withholding a result it cannot clean.
-3. **Redacts secrets out of exported telemetry**, closing a hole where `DSH_TELEMETRY_MODE=FULL`
+3. **Redacts secrets out of the messages a step enters with** — the context a listener splices
+   in (the workspace `AGENTS.md`/`CLAUDE.md` chain, a captured tmux pane, a hook's
+   `additionalContext`, a skill body a `/name` token loaded) and the input the loop claimed from
+   the inbox that the user did not type (a `dsh-webhook` delivery's third-party payload, a
+   settled subagent result, an agent relay). All of it reaches the model and the durable log
+   through `agent/pre-step` without ever being a tool result. A message whose `source.kind` is
+   `user` is exempt below `aggressiveness: high`; at `high` the user's own typed prompt is
+   redacted too, because this plugin cannot know which provider the request is bound for. The
+   `agent/inbox/spliced` delivery record keeps a delivery's original text, which is deliberate —
+   it derives no model message, and an operator investigating a webhook incident needs to read
+   what was actually delivered.
+4. **Redacts secrets out of exported telemetry**, closing a hole where `DSH_TELEMETRY_MODE=FULL`
    ships message text, tool arguments, results and workspace paths in the clear.
-4. **Strips invisible characters that carry hidden instructions** — the Tags block, bidi
+5. **Detects payment card numbers** — issuer range, a length that issuer assigns, and a Luhn
+   check digit — so cardholder data does not reach a third-party model in a tool result, a
+   spliced file, exported telemetry, or (at `aggressiveness: high`) a prompt someone typed.
+6. **Strips invisible characters that carry hidden instructions** — the Tags block, bidi
    overrides, runs of variation selectors — and strips terminal control sequences from the audit
    lane so a tool result cannot forge its own audit record.
-5. **Neutralises remote markdown images in assistant output** and detects a tool call another
+7. **Neutralises remote markdown images in assistant output** and detects a tool call another
    plugin rewrote after the session log recorded it.
-6. **Asks before the agent writes a file that changes future behaviour** — agent settings and
+8. **Asks before the agent writes a file that changes future behaviour** — agent settings and
    hooks, `CLAUDE.md`, `.claude/rules/**` and the other agent rules directories, prompt
    templates, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI workflows, shell startup files,
    `pnpm-workspace.yaml` — and before it writes a `*_BASE_URL` that would redirect a provider
    credential.
-7. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
+9. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
    `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
    prompts rather than controls: they live at `tools/pre-execute`, they can be neutralised, and
    they abstain wherever the approval seam prompts nobody — which includes every install under
    `DSH_PERMISSION_MODE=danger-full-access` and a stock headless install under any mode.
-8. **Writes an audit record for every decision.** A redaction or denial names the rule, its
-   version, the offsets and a keyed hash; the three kinds with no matched region to describe —
-   an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
-   the destination hostname instead. Never the secret, never the path or command that matched.
-   `dsh-dlp report` reads it back.
+10. **Writes an audit record for every decision.** A redaction or denial names the rule, its
+    version, the offsets and a keyed hash; the three kinds with no matched region to describe —
+    an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
+    the destination hostname instead. Never the secret, never the path or command that matched.
+    `dsh-dlp report` reads it back.
 
 ## What this is not
 
@@ -59,7 +73,9 @@ Three limits worth knowing before you rely on it:
   control.**
 - **Detection is pattern-based.** No entropy rule (measured, not assumed: the lowest
   false-positive-free threshold cannot flag anything shorter than 64–66 characters). Encoded
-  forms pass. A homoglyph defeats every rule in this package.
+  forms pass. A homoglyph defeats every rule in this package. The card rule is Luhn-validated
+  and range-checked and found nothing across 272,635 lines of real source and docs, but
+  a *uniformly random* 16-digit number trips it 2.7% of the time and Maestro is not covered.
 
 [The full list of limits →](https://charlotten7.github.io/dsh-dlp/)
 
@@ -95,9 +111,12 @@ load.
     auditLog: /var/log/dsh-dlp.audit.jsonl
     redactionKeyFile: /var/lib/dsh/dsh-dlp.redaction-key
     policyFile: ./.dsh-dlp.yml        # optional, lowest trust
+    aggressiveness: medium            # low | medium | high
     breadthTier: true
     resultRedaction: true
     telemetryRedaction: true
+    stepContextRedaction: true
+    claimedInputRedaction: true
     configWriteAsk: true
     approvalSuppressionAsk: true
 ```
@@ -106,10 +125,24 @@ load.
 version control — it is what makes a placeholder's hash keyed rather than a bare digest anyone
 holding a candidate secret could confirm.
 
+**`aggressiveness` is one word for how far redaction reaches.** `low` guarantees nothing and lets
+each toggle stand alone; `medium` — the default — guarantees every pass is on and that no toggle
+can take one away; `high` adds the user's own typed prompt to what is redacted. It composes with
+the toggles rather than overriding them: at `medium` and `high` a toggle set to `false`
+contradicts the level and **fails the mount** with the fix in the message, rather than one setting
+quietly beating the other.
+
+> **Upgrading from 0.9.0.** The default `medium` matches the shipped toggle defaults exactly, so
+> an install that never wrote a toggle is unchanged. An install that set any redaction toggle to
+> `false` now refuses to mount; add `aggressiveness: low` to the same row and it means what it
+> meant before. `high` is opt-in.
+
 **The guard floor has no configuration.** Credential-path denial and secret-argument denial are
 security invariants, not deployment-varying tunables. A repo-local `policyFile` is the lowest
 trust rank and may only *tighten*: add deny patterns, add egress tool names, raise a severity,
-switch a pass on. Any downgrade makes the whole file invalid.
+switch a pass on. It cannot reach `aggressiveness` — raising the level would let a hostile
+workspace put placeholders into the user's own prompt. Any downgrade makes the whole file
+invalid.
 
 [Configuration reference →](https://charlotten7.github.io/dsh-dlp/configuration.html) ·
 [What gets denied →](https://charlotten7.github.io/dsh-dlp/denials.html) ·

package/cordis.patch.yml

@@ -15,10 +15,18 @@
       config:
         auditLog: !!js dshHomePath('dsh-dlp.audit.jsonl')
         redactionKeyFile: !!js dshHomePath('dsh-dlp.redaction-key')
+        # `medium` guarantees every pass below is on and that none of them can
+        # be switched off; `high` adds the user's own typed prompt to what is
+        # redacted; `low` guarantees nothing and is what a deployment needing
+        # a pass off must set. A `false` below contradicting the level is a
+        # load-time error rather than a setting that quietly loses.
+        aggressiveness: medium
         maxScanBytes: 1048576
         breadthTier: true
         resultRedaction: true
         telemetryRedaction: true
+        stepContextRedaction: true
+        claimedInputRedaction: true
         remoteImageNeutralization: true
         redactTelemetryWorkspacePaths: true
         configWriteAsk: true

package/lib/detectors.js

@@ -1,8 +1,9 @@
 /**
  * Two detection tiers and the vocabulary they share.
  *
- * Tier 1 is a synchronous table of prefix-anchored token formats, owned here
- * because two of the three seams this plugin uses are synchronous:
+ * Tier 1 is a synchronous table of token formats — prefix-anchored but for the
+ * check-digit-validated card rule — owned here because two of the three seams
+ * this plugin uses are synchronous:
  * `ToolGuard` returns `string | undefined` and the `session-telemetry/record`
  * waterfall returns a record, neither of which can await. Tier 2 wraps
  * `@secretlint/core`, which runs in-process with no subprocess but resolves a
@@ -31,16 +32,136 @@ export function severityRank(severity) {
 }
 /** Severity at or above which the guard floor denies rather than only redacting. */
 export const DENY_SEVERITY = 'high';
+/**
+ * Whether a digit string satisfies the Luhn check digit (ISO/IEC 7812-1).
+ * @param digits - the number with every separator already removed.
+ * @returns whether the trailing check digit is consistent with the rest.
+ */
+function luhnValid(digits) {
+    let sum = 0;
+    let double = false;
+    for (let index = digits.length - 1; index >= 0; index -= 1) {
+        let value = digits.charCodeAt(index) - 48;
+        if (double) {
+            value *= 2;
+            if (value > 9)
+                value -= 9;
+        }
+        sum += value;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+/**
+ * Issuer identification ranges, each with the lengths that issuer assigns.
+ *
+ * The length is half of each rule. Luhn alone accepts one digit run in ten,
+ * and these ranges at these lengths accept 26.8% of the sixteen-digit space
+ * (measured over 200,000 numbers with the check digit forced valid), so it is
+ * the pair that separates a card number from an order id beginning with a 4.
+ *
+ * Maestro is deliberately absent. Its ranges run from `50` and `56`-`58`
+ * through a bare leading `6` at any length from 12 to 19, which is most of the
+ * six-prefixed numeric space at most of the lengths an identifier uses;
+ * including it would cost more ordinary text than it catches.
+ * `docs/redaction.md` records that gap rather than implying coverage.
+ */
+const CARD_RANGES = [
+    { prefix: /^4/, lengths: [13, 16, 19] },
+    { prefix: /^5[1-5]/, lengths: [16] },
+    // Mastercard's 2-series, 222100 through 272099.
+    { prefix: /^2(?:22[1-9]|2[3-9]\d|[3-6]\d\d|7[01]\d|720)/, lengths: [16] },
+    { prefix: /^3[47]/, lengths: [15] },
+    // Discover: 6011, 622126-622925, 644-649, 65.
+    { prefix: /^6(?:011|5\d\d|4[4-9]\d|22(?:12[6-9]|1[3-9]\d|[2-8]\d\d|9[01]\d|92[0-5]))/, lengths: [16, 19] },
+    { prefix: /^35(?:2[89]|[3-8]\d)/, lengths: [16, 17, 18, 19] },
+    // Diners Club: 300-305, 3095, 36, 38, 39.
+    { prefix: /^3(?:0(?:[0-5]|95)|[689])/, lengths: [14, 16, 19] },
+    { prefix: /^62/, lengths: [16, 17, 18, 19] },
+];
+/** Whether a bare digit string is a number some issuer would have handed out. */
+function isIssuedCardNumber(digits) {
+    const issued = CARD_RANGES.some(range => range.lengths.includes(digits.length) && range.prefix.test(digits));
+    return issued && luhnValid(digits);
+}
+/**
+ * Shortest printed digit group.
+ *
+ * This is the constant that keeps an amount written with space thousands
+ * separators from reading as a card number. Measured over 200,000 random
+ * sixteen-digit amounts written `4 920 007 989 245 430`: admitting groups
+ * shorter than three flags 3.75% of them, requiring three flags 0.19%.
+ */
+const MIN_CARD_GROUP = 3;
+/** Longest printed digit group: American Express is printed 4-6-5. */
+const MAX_CARD_GROUP = 6;
+/** Most groups one match may span — a 19-digit number takes five, leaving room for one neighbour. */
+const MAX_CARD_GROUPS = 6;
+/** One printed group of a grouped card number. */
+const CARD_GROUP = String.raw `\d{${MIN_CARD_GROUP},${MAX_CARD_GROUP}}`;
+/**
+ * A digit run that could be a card number: either unbroken, or printed in
+ * groups separated by single spaces or hyphens.
+ *
+ * The two lookarounds drop the commonest long digit run in machine output that
+ * is not an identifier at all — the fractional part of a decimal. A JavaScript
+ * `Math.random()` prints sixteen digits after the point, and 1.63% of them get
+ * past both the issuer ranges and the check digit; measured over 200,000
+ * printouts, the lookbehind takes that to zero.
+ */
+const CARD_CANDIDATE = new RegExp(String.raw `(?<!\d\.)\b(?:\d{13,19}|${CARD_GROUP}(?:[ -]${CARD_GROUP}){1,${MAX_CARD_GROUPS - 1}})\b(?!\.\d)`, 'g');
+/**
+ * Narrow one candidate digit run to the card number inside it.
+ *
+ * The pattern is greedy across printed groups, so a run holding a card number
+ * beside an expiry date, an amount or a year arrives here as one match. Every
+ * group-aligned window of the run is tested, longest first, and each window's
+ * edges sit on a separator or on the ends of the match — where the pattern
+ * already established a word boundary — so narrowing never reports part of a
+ * longer unbroken number. An unbroken run has exactly one window, itself,
+ * which is what keeps a 20-digit identifier from being reported as the
+ * 16-digit card number hiding in its first sixteen digits.
+ * @param match - the matched candidate.
+ * @returns offsets of the card number within the match, or `undefined` when there is none.
+ */
+export function refinePaymentCardNumber(match) {
+    const groups = [];
+    let cursor = 0;
+    for (const digits of match.split(/[ -]/)) {
+        groups.push({ start: cursor, end: cursor + digits.length, digits });
+        cursor += digits.length + 1;
+    }
+    const windows = [];
+    for (const [index, first] of groups.entries()) {
+        let digits = '';
+        for (const group of groups.slice(index)) {
+            digits += group.digits;
+            windows.push({ start: first.start, end: group.end, digits });
+        }
+    }
+    // Longest first, so a number is reported whole rather than as a prefix of
+    // itself that happens to validate at a shorter issuer length.
+    windows.sort((left, right) => (right.end - right.start) - (left.end - left.start));
+    for (const window of windows) {
+        if (isIssuedCardNumber(window.digits))
+            return { start: window.start, end: window.end };
+    }
+    return undefined;
+}
 /**
  * Tier 1's rule table. Deliberately narrow: only formats whose prefix or
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
  *
- * Prefix-anchored is the whole membership criterion, and the reason this table
- * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
- * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
- * here is exported in the clear when telemetry is on.
+ * A structurally unambiguous match is the membership criterion, and the reason
+ * this table keeps growing rather than deferring to tier 2: the
+ * `session-telemetry/record` waterfall is synchronous and cannot reach tier 2
+ * at all, so a format missing here is exported in the clear when telemetry is
+ * on. For every rule but one that means a prefix. The exception is
+ * `dsh-dlp/payment-card-number`, which has no prefix to anchor on and earns
+ * its place through an issuer range, a length that issuer assigns and a check
+ * digit instead.
  */
 export const SYNC_RULES = [
     { id: 'dsh-dlp/aws-access-key-id', version: 1, severity: 'critical', pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g },
@@ -126,6 +247,23 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/discord-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/(?:\w+\.)?discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]{10,}/g },
     { id: 'dsh-dlp/teams-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/[A-Za-z0-9.-]*webhook\.office\.com\/webhookb2\/[A-Za-z0-9@/_-]{10,}/g },
     { id: 'dsh-dlp/secret-assignment', version: 1, severity: 'medium', pattern: /\b(?:api[_-]?key|secret[_-]?key|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token)\b\s*[=:]\s*["']?[A-Za-z0-9/+=_-]{16,}["']?/gi },
+    // Cardholder data, which is the one class here that is not a credential the
+    // agent could have fetched: it is typed, pasted or read out of a customer
+    // record, and it is regulated wherever it goes. `medium` is deliberate and
+    // is the only rule in this table below `high` other than the assignment
+    // heuristic above it. The guard floor denies at `high`, and a denial from
+    // this rule would be unoverridable, while its false positives are ordinary
+    // long numbers rather than malformed credentials. A deployment that wants
+    // the denial raises the severity from its repo-local policy, which the
+    // tighten-only tier already allows.
+    {
+        id: 'dsh-dlp/payment-card-number',
+        version: 1,
+        severity: 'medium',
+        pattern: CARD_CANDIDATE,
+        refine: refinePaymentCardNumber,
+        exact: true,
+    },
 ];
 /**
  * Build one class's run pattern from its ranges, so the two cannot drift apart.
@@ -318,13 +456,18 @@ export function scanSync(text, rules = SYNC_RULES) {
     for (const rule of rules) {
         for (const match of text.matchAll(rule.pattern)) {
             // `matchAll` on a global pattern always reports an index.
-            const start = match.index;
+            const region = rule.refine === undefined
+                ? { start: 0, end: match[0].length }
+                : rule.refine(match[0]);
+            if (region === undefined)
+                continue;
             detections.push({
                 ruleId: rule.id,
                 ruleVersion: rule.version,
                 severity: rule.severity,
-                start,
-                end: start + match[0].length,
+                start: match.index + region.start,
+                end: match.index + region.end,
+                ...rule.exact === true ? { exact: true } : {},
             });
         }
     }

package/lib/index.js

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Six registrations, in descending order of how much they can be trusted:
+ * Seven registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -19,6 +19,17 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  *    Prepended, so it redacts what the rest of the waterfall returned; a
  *    listener registering later with the same option still runs ahead of it.
+ * 3b. `agent/pre-step` — redaction of the messages one step enters with: the
+ *    context a listener splices in (the workspace instruction chain, the
+ *    session skill catalog, a captured terminal pane, a hook's
+ *    `additionalContext`) and the input the loop claimed from the inbox that
+ *    the user did not type (a `dsh-webhook` delivery, a subagent's settled
+ *    result, an agent relay). The loop appends what this waterfall returns as
+ *    the `user/message` surface events every request is derived from, so the
+ *    model-visible durable copy is the redacted one. A claimed message's
+ *    earlier `agent/inbox/spliced` delivery record keeps the original; it
+ *    derives no model message, and ADR §30 says why that is the wanted
+ *    asymmetry. `source.kind: 'user'` is exempt.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in
@@ -47,6 +58,7 @@ import { evaluateConfigWrite } from "./config-writes.js";
 import { evaluateApprovalSuppression } from "./approvals.js";
 import { approvalSeamNotice, askReach } from "./approval-reach.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
+import { redactStepContext } from "./steps.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
 export { Config } from "./policy.js";
@@ -364,6 +376,43 @@ export function apply(ctx, config) {
             return redacted.decision;
         }, { prepend: true });
     }
+    if (policy.stepContextRedaction || policy.claimedInputRedaction) {
+        // One listener for both toggles: they cover two classes of message
+        // entering the same waterfall, and scanning them in one pass is what finds
+        // a secret split across the boundary between them. `redactStepContext`
+        // reads both flags and leaves an out-of-scope message as the object it
+        // arrived as.
+        //
+        // Prepended for the reason the result and telemetry seams are: listeners
+        // run outermost-first, so registering ahead of the chain is what lets this
+        // one redact the messages the rest of the waterfall spliced in rather than
+        // have its own replacement discarded afterwards.
+        ctx.on('agent/pre-step', async (payload, next) => {
+            const redacted = await redactStepContext(await next(), payload.messages, policy, hasher);
+            const indicators = Object.keys(redacted.indicators).length > 0
+                ? { unicode: redacted.indicators }
+                : {};
+            if (redacted.spans.length > 0 || redacted.truncatedScan || Object.keys(indicators).length > 0) {
+                sink.write({
+                    v: RECORD_VERSION,
+                    time: new Date().toISOString(),
+                    kind: 'step-context-redaction',
+                    decisionId: newDecisionId(),
+                    sessionId: String(payload.agent.session.id),
+                    turn: payload.turn,
+                    step: payload.step,
+                    spans: redacted.spans,
+                    ...redacted.truncatedScan ? { truncatedScan: true } : {},
+                    ...indicators,
+                    // Only when the pass covered claimed input: an operator counting
+                    // deliveries must not have to read an empty list as "none arrived"
+                    // on every workspace-instruction record.
+                    ...redacted.claimedSources.length > 0 ? { claimedSources: redacted.claimedSources } : {},
+                });
+            }
+            return redacted.decision;
+        }, { prepend: true });
+    }
     if (policy.remoteImageNeutralization) {
         ctx.on('llm/stream', (options, next) => neutralizeImageStream(next(), (host) => {
             sink.write({
@@ -397,11 +446,15 @@ export function apply(ctx, config) {
                 });
             }
             return redacted.record;
-            // Prepended for the reason the other two seams are: a listener that
-            // returns without calling `next()` deletes every listener behind it, and
+            // Prepended for the reason the other seams are: a listener that returns
+            // without calling `next()` vetoes every listener behind it for that
+            // dispatch — `Events.dispatch()` hands the waterfall a fresh array, so
+            // the registration survives and runs again on the next dispatch — and
             // this one is the only thing standing between an exported telemetry
-            // record and the wire. Best-effort, as at the mutation snapshot: another
-            // plugin registering later with the same option lands ahead again.
+            // record and the wire. One vetoed dispatch is one record exported in the
+            // clear, which is why position matters here. Best-effort, as at the
+            // mutation snapshot: another plugin registering later with the same
+            // option lands ahead again.
         }, { prepend: true });
     }
 }

package/lib/policy.js

@@ -11,7 +11,10 @@
  * Rank 3 is a file inside the workspace, so a hostile repository ships one and
  * a prompt-injected agent can write one. It may add deny patterns, add egress
  * tools, raise a severity, and switch a redaction pass on. Every other key,
- * and every downgrade, is a load-time error rather than a silent ignore.
+ * and every downgrade, is a load-time error rather than a silent ignore. It
+ * cannot reach {@link Config.aggressiveness}: the level's own lever is
+ * redacting what the user typed, and a workspace that could force that could
+ * garble the user's own words on their way to the model.
  * @module dsh-dlp/policy
  */
 import { readFileSync } from 'node:fs';
@@ -23,6 +26,7 @@ import { SYNC_RULES, severityRank, stripControlSequences } from "./detectors.js"
 import { resolveDshHome } from "./home.js";
 import { CREDENTIAL_PATH_RULES, escapePathPattern, homeCredentialPathRules } from "./paths.js";
 export const Config = z.object({
+    aggressiveness: z.union([z.const('low'), z.const('medium'), z.const('high')]).default('medium'),
     auditLog: z.string().required(),
     redactionKeyFile: z.string().required(),
     policyFile: z.string(),
@@ -30,6 +34,8 @@ export const Config = z.object({
     breadthTier: z.boolean().default(true),
     resultRedaction: z.boolean().default(true),
     telemetryRedaction: z.boolean().default(true),
+    stepContextRedaction: z.boolean().default(true),
+    claimedInputRedaction: z.boolean().default(true),
     remoteImageNeutralization: z.boolean().default(true),
     redactTelemetryWorkspacePaths: z.boolean().default(true),
     configWriteAsk: z.boolean().default(true),
@@ -40,11 +46,46 @@ const ENABLEABLE = [
     'breadthTier',
     'resultRedaction',
     'telemetryRedaction',
+    'stepContextRedaction',
+    'claimedInputRedaction',
     'remoteImageNeutralization',
     'redactTelemetryWorkspacePaths',
     'configWriteAsk',
     'approvalSuppressionAsk',
 ];
+/**
+ * Passes each level requires, whatever the toggles say.
+ *
+ * `low` requires none, which is what makes it the level a deployment moves to
+ * when it needs a pass off — and what makes every configuration that was legal
+ * before this field existed still legal. `medium` and `high` require all of
+ * them, so the one-word setting and the nine booleans can never describe
+ * different plugins.
+ */
+const LEVEL_REQUIRES = {
+    low: [],
+    medium: ENABLEABLE,
+    high: ENABLEABLE,
+};
+/**
+ * Reject a configuration whose level and whose toggles describe different
+ * behaviour.
+ *
+ * Loud at load rather than silently resolved either way: two
+ * deployment-controlled settings disagreeing is self-contained
+ * misconfiguration, and whichever of them lost would be a pass an operator
+ * believes is running and is not, or one they believe is off and is not.
+ * @param config - the deployment-controlled configuration.
+ * @throws PolicyError naming every toggle that contradicts the level.
+ */
+function assertLevelAgrees(config) {
+    const contradicted = LEVEL_REQUIRES[config.aggressiveness].filter(toggle => !config[toggle]);
+    if (contradicted.length === 0)
+        return;
+    throw new PolicyError(`aggressiveness: ${config.aggressiveness} requires every pass this package ships, but`
+        + ` ${contradicted.join(', ')} ${contradicted.length === 1 ? 'is' : 'are'} set to false.`
+        + ' Set aggressiveness: low to choose passes individually, or drop the false setting.');
+}
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -266,6 +307,7 @@ function selfProtectionRules(config, dshHome) {
  * @returns the effective policy every seam reads.
  */
 export function resolvePolicy(config, repo) {
+    assertLevelAgrees(config);
     const enabled = (toggle) => config[toggle] || (repo?.enable.includes(toggle) ?? false);
     return {
         credentialPathRules: [
@@ -280,9 +322,13 @@ export function resolvePolicy(config, repo) {
             return raised === undefined ? rule : { ...rule, severity: raised };
         }),
         maxScanBytes: config.maxScanBytes,
+        aggressiveness: config.aggressiveness,
+        userTypedInputRedaction: config.aggressiveness === 'high',
         breadthTier: enabled('breadthTier'),
         resultRedaction: enabled('resultRedaction'),
         telemetryRedaction: enabled('telemetryRedaction'),
+        stepContextRedaction: enabled('stepContextRedaction'),
+        claimedInputRedaction: enabled('claimedInputRedaction'),
         remoteImageNeutralization: enabled('remoteImageNeutralization'),
         redactTelemetryWorkspacePaths: enabled('redactTelemetryWorkspacePaths'),
         configWriteAsk: enabled('configWriteAsk'),

package/lib/results.js

@@ -44,7 +44,7 @@ const RENDER_SEPARATOR = '\n';
  * @param policy - the effective policy.
  * @returns a memoized lookup, the invisible-character counts, and whether tier 2 saw less than the whole rendering.
  */
-async function prepareScan(strings, policy) {
+export async function prepareScan(strings, policy) {
     const rendered = strings.join(RENDER_SEPARATOR);
     const { detections, truncated } = await scanAll(rendered, policy.syncRules, policy.maxScanBytes);
     const memo = new Map();
@@ -87,7 +87,7 @@ function contentStrings(blocks) {
  * @param messages - the contexts attached to a decision or ferried on a result.
  * @returns every string those messages would put in front of the model or into the log.
  */
-function messageStrings(messages) {
+export function messageStrings(messages) {
     return messages.flatMap(message => [...contentStrings(message.content), ...nestedStrings(message.source)]);
 }
 /**

package/lib/steps.js

@@ -0,0 +1,124 @@
+/**
+ * Redaction of the messages one step enters with: the context a
+ * `agent/pre-step` listener splices in, and the input the loop claimed from
+ * the inbox that the user did not type.
+ *
+ * A tool result is not the only text that reaches the model. The agent loop
+ * dispatches `agent/pre-step` as a waterfall, appends every message the
+ * returned decision carries as a `user/message` surface event, and derives the
+ * next request from that surface. Two classes of text arrive that way.
+ *
+ * The first is what the waterfall itself adds, and nothing else scans it:
+ * `dsh-agent-instructions` splices the workspace `AGENTS.md`/`CLAUDE.md`
+ * chain, `dsh-tmux-context` splices captured pane text, the Claude Code and
+ * Codex hook bridges splice a hook command's `additionalContext`, and
+ * `dsh-tool-skill` splices a skill body a `/name` token asked for.
+ *
+ * The second is what the loop claimed from the inbox. Most of that is not the
+ * user typing either: `dsh-webhook` admits a verified third-party delivery's
+ * payload with `agent.followup()`, a subagent's settled result and an
+ * agent-to-agent relay arrive the same way, and so does anything
+ * `agent.inject()` seeded. {@link isUserTyped} is the exemption, and it is the
+ * only one, but it is not unconditional: it applies at `aggressiveness: low`
+ * and `medium`, and stops applying at `high`. This plugin cannot know where
+ * the request is going, and a card number a person typed on purpose is still
+ * cardholder data at whatever provider the deployment happens to be pointed
+ * at, so the deployment says which reading it wants rather than this module
+ * assuming one.
+ *
+ * A claimed message differs from an added one in exactly one way, and it is
+ * narrower than it looks. Its delivery was already recorded as
+ * `agent/inbox/spliced` before this waterfall ran, and no seam can rewrite a
+ * committed event. That event is not a surface event — `SurfaceEventType` is
+ * `user/message | assistant/message | tool/result` — so it derives no model
+ * message and no request is built from it. The copy the model reads is the
+ * `user/message` the loop appends after this waterfall, which is the copy this
+ * pass rewrites. "Model-visible ⟺ logged" therefore still holds; what the
+ * delivery record keeps is the original text of an untrusted delivery, which
+ * is evidence rather than a disagreement. ADR §30 states that asymmetry, and
+ * `tests/e2e/step-context.e2e.ts` pins it.
+ *
+ * Best-effort, like every seam here that is not `ctx.tools.guard()`: this
+ * listener registers with `{ prepend: true }` so it sees what the rest of the
+ * waterfall settled on, and a listener registering later with the same option
+ * lands ahead of it again.
+ * @module dsh-dlp/steps
+ */
+import { messageStrings, prepareScan } from "./results.js";
+import { redactUserMessages } from "./redaction.js";
+/**
+ * Whether one message the loop claimed from the inbox is the user's own
+ * typing, which exempts it below `aggressiveness: high`.
+ *
+ * `MessageSourceMap` is merge-extensible and every producer picks its own
+ * `kind`, so the exemption is a single allowed value rather than a list of
+ * denied ones: a source kind added by a package this plugin has never heard of
+ * is redacted rather than trusted. In the installed harness `kind: 'user'` is
+ * what the interactive entry points supply — `dsh-headless` for a CLI task,
+ * `dsh-acp` for an ACP prompt, `dsh-sdk-jsonrpc-server` for an SDK one, and
+ * `dsh-api-session-controller`'s `user-rpc` source for a browser prompt, which
+ * adds `rpcId` beside the same `kind`. `dsh-webhook`'s deliveries carry
+ * `kind: 'webhook'`, and the harness's own webhook invariant discriminates on
+ * exactly that value.
+ *
+ * Two producers borrow the value for text a person did not type: `dsh-subagent`
+ * and `dsh-subagent-in-process-driver` open a child agent with the parent's
+ * prompt under `kind: 'user'`. Those stay exempt here. Distinguishing them
+ * needs a fact the source does not carry, and inventing one would put a
+ * guessed value in a security decision.
+ *
+ * At `aggressiveness: high` the caller stops consulting this, so the two
+ * borrowed cases stop being exempt with everything else.
+ * @param message - one message the loop claimed from the inbox.
+ * @returns whether the message came from a person typing into their own prompt.
+ */
+export function isUserTyped(message) {
+    return message.source.kind === 'user';
+}
+/**
+ * Redact the messages entering one step.
+ *
+ * @param decision - what the rest of the waterfall settled on.
+ * @param claimed - the messages the loop claimed from the inbox.
+ * @param policy - the effective policy after the tighten-only merge.
+ * @param hasher - mints each span's keyed hash.
+ * @returns the decision to return, plus what the pass found.
+ */
+export async function redactStepContext(decision, claimed, policy, hasher) {
+    const nothing = { spans: [], truncatedScan: false, indicators: {}, claimedSources: [] };
+    if (decision.kind !== 'enter')
+        return { decision, ...nothing };
+    // Object identity, which is what the loop and the shipped providers use: a
+    // provider splices its own message into the array it was handed, so a
+    // claimed message is the same object it arrived as.
+    const claimedSet = new Set(claimed);
+    const inScope = (message) => claimedSet.has(message)
+        ? policy.claimedInputRedaction && (policy.userTypedInputRedaction || !isUserTyped(message))
+        : policy.stepContextRedaction;
+    const selected = decision.messages.filter(inScope);
+    if (selected.length === 0)
+        return { decision, ...nothing };
+    const claimedSources = [...new Set(selected.filter(message => claimedSet.has(message)).map(message => message.source.kind))];
+    const prepared = await prepareScan(messageStrings(selected), policy);
+    const redacted = redactUserMessages(selected, prepared.scan, hasher, '/messages');
+    const base = {
+        spans: redacted.spans,
+        truncatedScan: prepared.truncated,
+        indicators: prepared.indicators,
+        claimedSources,
+    };
+    if (!redacted.changed)
+        return { decision, ...base };
+    // Rebuilt position by position so every message keeps the place it had:
+    // ordering is what decides whether a workspace instruction reads before or
+    // after the user's request.
+    const replacements = [...redacted.messages];
+    const messages = decision.messages.map((message) => {
+        if (!inScope(message))
+            return message;
+        const replacement = replacements.shift();
+        /* v8 ignore next -- `redactUserMessages` returns one message per input, so this never runs short. */
+        return replacement ?? message;
+    });
+    return { decision: { ...decision, messages }, ...base };
+}

package/lib/types/detectors.d.ts

@@ -1,8 +1,9 @@
 /**
  * Two detection tiers and the vocabulary they share.
  *
- * Tier 1 is a synchronous table of prefix-anchored token formats, owned here
- * because two of the three seams this plugin uses are synchronous:
+ * Tier 1 is a synchronous table of token formats — prefix-anchored but for the
+ * check-digit-validated card rule — owned here because two of the three seams
+ * this plugin uses are synchronous:
  * `ToolGuard` returns `string | undefined` and the `session-telemetry/record`
  * waterfall returns a record, neither of which can await. Tier 2 wraps
  * `@secretlint/core`, which runs in-process with no subprocess but resolves a
@@ -39,8 +40,10 @@ export interface Detection {
     readonly end: number;
     /**
      * Set when the offsets cover exactly what must be replaced, so redaction
-     * must not widen them to the surrounding delimiters. Only the Unicode
-     * indicators set it: their matches are the characters themselves, while a
+     * must not widen them to the surrounding delimiters. Two kinds of rule set
+     * it: the Unicode indicators, whose matches are the characters themselves,
+     * and the payment-card rule, whose match is validated digit by digit and so
+     * covers precisely the number. Everything else leaves it unset, because a
      * secret's reported span is advisory and verified to under-cover (ADR §4).
      */
     readonly exact?: true;
@@ -58,17 +61,55 @@ export interface SyncRule {
     readonly severity: Severity;
     /** Global-flagged; matched through `matchAll`, which never mutates this instance's `lastIndex`. */
     readonly pattern: RegExp;
+    /**
+     * Narrows one raw match to the region that is really a detection, or rejects
+     * it outright by returning `undefined`. Offsets are relative to the match.
+     *
+     * Present for the one format a regular expression cannot decide on its own:
+     * a payment card number is a digit run that must also carry a known issuer
+     * prefix at a length that issuer assigns and satisfy a check digit, and the
+     * run it sits in may carry a neighbouring number the pattern swept up.
+     * Absent everywhere else, where the prefix makes the match unambiguous.
+     */
+    readonly refine?: (match: string) => {
+        readonly start: number;
+        readonly end: number;
+    } | undefined;
+    /** Whether the reported offsets cover exactly the text to replace; see {@link Detection.exact}. */
+    readonly exact?: true;
 }
+/**
+ * Narrow one candidate digit run to the card number inside it.
+ *
+ * The pattern is greedy across printed groups, so a run holding a card number
+ * beside an expiry date, an amount or a year arrives here as one match. Every
+ * group-aligned window of the run is tested, longest first, and each window's
+ * edges sit on a separator or on the ends of the match — where the pattern
+ * already established a word boundary — so narrowing never reports part of a
+ * longer unbroken number. An unbroken run has exactly one window, itself,
+ * which is what keeps a 20-digit identifier from being reported as the
+ * 16-digit card number hiding in its first sixteen digits.
+ * @param match - the matched candidate.
+ * @returns offsets of the card number within the match, or `undefined` when there is none.
+ */
+export declare function refinePaymentCardNumber(match: string): {
+    start: number;
+    end: number;
+} | undefined;
 /**
  * Tier 1's rule table. Deliberately narrow: only formats whose prefix or
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
  *
- * Prefix-anchored is the whole membership criterion, and the reason this table
- * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
- * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
- * here is exported in the clear when telemetry is on.
+ * A structurally unambiguous match is the membership criterion, and the reason
+ * this table keeps growing rather than deferring to tier 2: the
+ * `session-telemetry/record` waterfall is synchronous and cannot reach tier 2
+ * at all, so a format missing here is exported in the clear when telemetry is
+ * on. For every rule but one that means a prefix. The exception is
+ * `dsh-dlp/payment-card-number`, which has no prefix to anchor on and earns
+ * its place through an issuer range, a length that issuer assigns and a check
+ * digit instead.
  */
 export declare const SYNC_RULES: readonly SyncRule[];
 /**

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `dsh-dlp` — data-loss prevention for DeepSeek Harness.
  *
- * Six registrations, in descending order of how much they can be trusted:
+ * Seven registrations, in descending order of how much they can be trusted:
  *
  * 1. `ctx.tools.guard()` — an unconditional, non-configurable deny floor for
  *    credential paths named in a path-typed argument and for secrets heading
@@ -19,6 +19,17 @@
  *    a result that cannot be cleaned is withheld rather than accepted.
  *    Prepended, so it redacts what the rest of the waterfall returned; a
  *    listener registering later with the same option still runs ahead of it.
+ * 3b. `agent/pre-step` — redaction of the messages one step enters with: the
+ *    context a listener splices in (the workspace instruction chain, the
+ *    session skill catalog, a captured terminal pane, a hook's
+ *    `additionalContext`) and the input the loop claimed from the inbox that
+ *    the user did not type (a `dsh-webhook` delivery, a subagent's settled
+ *    result, an agent relay). The loop appends what this waterfall returns as
+ *    the `user/message` surface events every request is derived from, so the
+ *    model-visible durable copy is the redacted one. A claimed message's
+ *    earlier `agent/inbox/spliced` delivery record keeps the original; it
+ *    derives no model message, and ADR §30 says why that is the wanted
+ *    asymmetry. `source.kind: 'user'` is exempt.
  * 4. `session-telemetry/record` — fail-closed redaction of exported telemetry,
  *    reaching tier 1 only because the waterfall is synchronous.
  * 5. `llm/stream` — neutralising remote markdown image destinations in

package/lib/types/policy.d.ts

@@ -11,14 +11,41 @@
  * Rank 3 is a file inside the workspace, so a hostile repository ships one and
  * a prompt-injected agent can write one. It may add deny patterns, add egress
  * tools, raise a severity, and switch a redaction pass on. Every other key,
- * and every downgrade, is a load-time error rather than a silent ignore.
+ * and every downgrade, is a load-time error rather than a silent ignore. It
+ * cannot reach {@link Config.aggressiveness}: the level's own lever is
+ * redacting what the user typed, and a workspace that could force that could
+ * garble the user's own words on their way to the model.
  * @module dsh-dlp/policy
  */
 import z from '@deepseek-ai/schemastery';
 import { type Severity, type SyncRule } from './detectors.ts';
 import { type CredentialPathRule } from './paths.ts';
+/**
+ * How far redaction reaches, as one word.
+ *
+ * The level is not a tenth switch beside the nine below it. It states what the
+ * deployment guarantees, the toggles state which passes carry it out, and the
+ * two may not disagree: at `medium` and `high` a toggle set to `false`
+ * contradicts the guarantee and is a load-time error rather than a setting
+ * that quietly loses.
+ *
+ * - `low` guarantees nothing. Every pass is exactly its own toggle, which is
+ *   still `true` unless the deployment says otherwise. This is the level to
+ *   pick when a pass has to be switched off.
+ * - `medium` guarantees that every pass this package ships is on and that no
+ *   toggle can take one away. The user's own typing stays exempt.
+ * - `high` is `medium` plus the one thing no toggle can express: the exemption
+ *   in `isUserTyped` stops applying, so a secret in the user's own prompt is
+ *   redacted before the request is built from it.
+ */
+export type Aggressiveness = 'low' | 'medium' | 'high';
 /** Deployment configuration, validated from `cordis.yml`. */
 export interface Config {
+    /**
+     * How far redaction reaches. See {@link Aggressiveness}; `high` is the only
+     * value that puts the user's own typed prompt in scope.
+     */
+    aggressiveness: Aggressiveness;
     /** Absolute path of this plugin's own JSONL audit sink. Never the session log. */
     auditLog: string;
     /** Absolute path of the installation's redaction key; created with 32 random bytes if absent. */
@@ -33,6 +60,21 @@ export interface Config {
     resultRedaction: boolean;
     /** Whether `session-telemetry/record` redaction runs. */
     telemetryRedaction: boolean;
+    /**
+     * Whether the context an `agent/pre-step` listener splices into a step —
+     * the workspace instruction chain, captured terminal panes, a hook's
+     * `additionalContext`, a skill body a `/name` token asked for — is redacted
+     * before the loop logs it and builds the next request from it.
+     */
+    stepContextRedaction: boolean;
+    /**
+     * Whether the messages the loop claimed from the inbox are redacted before
+     * the step logs them and builds its request from them, for every message the
+     * user did not type: a `dsh-webhook` delivery's third-party payload, a
+     * subagent's settled result, an agent-to-agent relay, anything
+     * `agent.inject()` seeded. A message whose `source.kind` is `user` is exempt.
+     */
+    claimedInputRedaction: boolean;
     /** Whether remote markdown image destinations are neutralised in assistant output. */
     remoteImageNeutralization: boolean;
     /** Whether telemetry's `session.cwd` attribute is replaced with a keyed hash. */
@@ -52,7 +94,7 @@ export interface Config {
 }
 export declare const Config: z<Config>;
 /** Config toggles a repo-local policy may switch on, and never off. */
-declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk", "approvalSuppressionAsk"];
+declare const ENABLEABLE: readonly ["breadthTier", "resultRedaction", "telemetryRedaction", "stepContextRedaction", "claimedInputRedaction", "remoteImageNeutralization", "redactTelemetryWorkspacePaths", "configWriteAsk", "approvalSuppressionAsk"];
 /** One toggle name a repo-local policy may name in `enable`. */
 export type EnableableToggle = typeof ENABLEABLE[number];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -70,9 +112,21 @@ export interface ResolvedPolicy {
     readonly extraEgressTools: ReadonlySet<string>;
     readonly syncRules: readonly SyncRule[];
     readonly maxScanBytes: number;
+    readonly aggressiveness: Aggressiveness;
+    /**
+     * Whether a message the user typed themselves is scanned like any other.
+     *
+     * Set by the level alone, at `high` only, and by nothing else: there is no
+     * toggle for it and a repo-local policy cannot reach it. `isUserTyped` still
+     * decides which messages this applies to; this decides whether that answer
+     * exempts them.
+     */
+    readonly userTypedInputRedaction: boolean;
     readonly breadthTier: boolean;
     readonly resultRedaction: boolean;
     readonly telemetryRedaction: boolean;
+    readonly stepContextRedaction: boolean;
+    readonly claimedInputRedaction: boolean;
     readonly remoteImageNeutralization: boolean;
     readonly redactTelemetryWorkspacePaths: boolean;
     readonly configWriteAsk: boolean;

package/lib/types/results.d.ts

@@ -13,9 +13,48 @@
  * whole rule set applies here and not in the guard.
  * @module dsh-dlp/results
  */
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
 import type { JsonSchemaNode, PostToolDecision, PreToolDecision, ToolExecution, ToolExecutionResult } from '@deepseek-ai/dsh-tools';
+import { type Detection } from './detectors.ts';
 import type { ResolvedPolicy } from './policy.ts';
 import { type RedactedSpan, type SpanHasher } from './redaction.ts';
+/** A scan function over already-scanned strings, plus how complete the scan was. */
+export interface PreparedScan {
+    readonly scan: (text: string) => readonly Detection[];
+    readonly truncated: boolean;
+    /** Runs of each invisible-character class in the whole rendering, by rule id. */
+    readonly indicators: Readonly<Record<string, number>>;
+}
+/**
+ * Scan a set of strings once and hand back a synchronous lookup, so the
+ * redaction walkers stay synchronous while detection stays async.
+ *
+ * The strings are scanned twice over: each on its own by tier 1, and all of
+ * them joined by both tiers. The joined pass is what finds a secret split
+ * across strings — a PEM block arriving as one `lines[i].text` per line, a
+ * token spanning two content blocks — which no per-string walk can see; its
+ * offsets are then mapped back onto the individual strings, because that is
+ * what the redaction walkers splice.
+ *
+ * Tier 2 runs once, over the joined text, and is budgeted by characters
+ * through `maxScanBytes`. One `lintSource` call per string would multiply a
+ * fixed per-call cost by however many pieces the tool happened to split its
+ * output into, and a budget counted in strings would make how much of a result
+ * is scanned depend on the same accident.
+ * @param strings - every string that will be redacted, in render order.
+ * @param policy - the effective policy.
+ * @returns a memoized lookup, the invisible-character counts, and whether tier 2 saw less than the whole rendering.
+ */
+export declare function prepareScan(strings: readonly string[], policy: ResolvedPolicy): Promise<PreparedScan>;
+/**
+ * Text one set of `additionalContexts` carries: the model-facing blocks, plus
+ * whatever text the source records beside them — a `snapshot` source repeats
+ * the block text in `sections[].text`, a `notice` source its opening in
+ * `summary`, and a plugin's own source kind may carry more.
+ * @param messages - the contexts attached to a decision or ferried on a result.
+ * @returns every string those messages would put in front of the model or into the log.
+ */
+export declare function messageStrings(messages: readonly UserMessage[]): string[];
 /** What a redaction pass produced, before an arm is chosen. */
 export interface ResultRedaction {
     readonly decision: PostToolDecision;

package/lib/types/sink.d.ts

@@ -38,7 +38,7 @@ export declare const RECORD_VERSION = 1;
  */
 export declare const AUDIT_MODE = 416;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'step-context-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -83,6 +83,14 @@ export interface AuditRecord {
      * operator needs to change to get the prompt back.
      */
     readonly askUnreachable?: AskUnreachable;
+    /**
+     * The distinct `source.kind` of the inbox-claimed messages a
+     * `step-context-redaction` pass covered, present only when it covered any.
+     * A kind names the producer that delivered the text — `webhook` for a
+     * `dsh-webhook` delivery — which is what separates a redacted third-party
+     * payload from a redacted workspace instruction file.
+     */
+    readonly claimedSources?: readonly string[];
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
     /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */

package/lib/types/steps.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Redaction of the messages one step enters with: the context a
+ * `agent/pre-step` listener splices in, and the input the loop claimed from
+ * the inbox that the user did not type.
+ *
+ * A tool result is not the only text that reaches the model. The agent loop
+ * dispatches `agent/pre-step` as a waterfall, appends every message the
+ * returned decision carries as a `user/message` surface event, and derives the
+ * next request from that surface. Two classes of text arrive that way.
+ *
+ * The first is what the waterfall itself adds, and nothing else scans it:
+ * `dsh-agent-instructions` splices the workspace `AGENTS.md`/`CLAUDE.md`
+ * chain, `dsh-tmux-context` splices captured pane text, the Claude Code and
+ * Codex hook bridges splice a hook command's `additionalContext`, and
+ * `dsh-tool-skill` splices a skill body a `/name` token asked for.
+ *
+ * The second is what the loop claimed from the inbox. Most of that is not the
+ * user typing either: `dsh-webhook` admits a verified third-party delivery's
+ * payload with `agent.followup()`, a subagent's settled result and an
+ * agent-to-agent relay arrive the same way, and so does anything
+ * `agent.inject()` seeded. {@link isUserTyped} is the exemption, and it is the
+ * only one, but it is not unconditional: it applies at `aggressiveness: low`
+ * and `medium`, and stops applying at `high`. This plugin cannot know where
+ * the request is going, and a card number a person typed on purpose is still
+ * cardholder data at whatever provider the deployment happens to be pointed
+ * at, so the deployment says which reading it wants rather than this module
+ * assuming one.
+ *
+ * A claimed message differs from an added one in exactly one way, and it is
+ * narrower than it looks. Its delivery was already recorded as
+ * `agent/inbox/spliced` before this waterfall ran, and no seam can rewrite a
+ * committed event. That event is not a surface event — `SurfaceEventType` is
+ * `user/message | assistant/message | tool/result` — so it derives no model
+ * message and no request is built from it. The copy the model reads is the
+ * `user/message` the loop appends after this waterfall, which is the copy this
+ * pass rewrites. "Model-visible ⟺ logged" therefore still holds; what the
+ * delivery record keeps is the original text of an untrusted delivery, which
+ * is evidence rather than a disagreement. ADR §30 states that asymmetry, and
+ * `tests/e2e/step-context.e2e.ts` pins it.
+ *
+ * Best-effort, like every seam here that is not `ctx.tools.guard()`: this
+ * listener registers with `{ prepend: true }` so it sees what the rest of the
+ * waterfall settled on, and a listener registering later with the same option
+ * lands ahead of it again.
+ * @module dsh-dlp/steps
+ */
+import type { PreStepDecision } from '@deepseek-ai/dsh-agent';
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
+import type { ResolvedPolicy } from './policy.ts';
+import { type RedactedSpan, type SpanHasher } from './redaction.ts';
+/** What one pass over a step's entering messages produced. */
+export interface StepRedaction {
+    /** The decision to return: the same object when nothing was replaced. */
+    readonly decision: PreStepDecision;
+    /** The regions replaced, described by rule identity, offsets and keyed hash only. */
+    readonly spans: readonly RedactedSpan[];
+    /** Set when the scanned text exceeded `maxScanBytes` and tier 2 saw less than all of it. */
+    readonly truncatedScan: boolean;
+    /** Runs of each invisible-character class the scanned messages carried, by rule id. */
+    readonly indicators: Readonly<Record<string, number>>;
+    /**
+     * The distinct `source.kind` of every inbox-claimed message this pass
+     * scanned, in first-seen order. Empty when the pass only covered messages
+     * the waterfall added. An operator reading the sink needs this to tell a
+     * redacted workspace instruction from a redacted third-party delivery.
+     */
+    readonly claimedSources: readonly string[];
+}
+/**
+ * Whether one message the loop claimed from the inbox is the user's own
+ * typing, which exempts it below `aggressiveness: high`.
+ *
+ * `MessageSourceMap` is merge-extensible and every producer picks its own
+ * `kind`, so the exemption is a single allowed value rather than a list of
+ * denied ones: a source kind added by a package this plugin has never heard of
+ * is redacted rather than trusted. In the installed harness `kind: 'user'` is
+ * what the interactive entry points supply — `dsh-headless` for a CLI task,
+ * `dsh-acp` for an ACP prompt, `dsh-sdk-jsonrpc-server` for an SDK one, and
+ * `dsh-api-session-controller`'s `user-rpc` source for a browser prompt, which
+ * adds `rpcId` beside the same `kind`. `dsh-webhook`'s deliveries carry
+ * `kind: 'webhook'`, and the harness's own webhook invariant discriminates on
+ * exactly that value.
+ *
+ * Two producers borrow the value for text a person did not type: `dsh-subagent`
+ * and `dsh-subagent-in-process-driver` open a child agent with the parent's
+ * prompt under `kind: 'user'`. Those stay exempt here. Distinguishing them
+ * needs a fact the source does not carry, and inventing one would put a
+ * guessed value in a security decision.
+ *
+ * At `aggressiveness: high` the caller stops consulting this, so the two
+ * borrowed cases stop being exempt with everything else.
+ * @param message - one message the loop claimed from the inbox.
+ * @returns whether the message came from a person typing into their own prompt.
+ */
+export declare function isUserTyped(message: UserMessage): boolean;
+/**
+ * Redact the messages entering one step.
+ *
+ * @param decision - what the rest of the waterfall settled on.
+ * @param claimed - the messages the loop claimed from the inbox.
+ * @param policy - the effective policy after the tighten-only merge.
+ * @param hasher - mints each span's keyed hash.
+ * @returns the decision to return, plus what the pass found.
+ */
+export declare function redactStepContext(decision: PreStepDecision, claimed: readonly UserMessage[], policy: ResolvedPolicy, hasher: SpanHasher): Promise<StepRedaction>;
+//# sourceMappingURL=steps.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",
@@ -51,10 +51,11 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ~0.1.1-rc.0",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ~0.1.1-rc.0",
-    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6 || ~0.1.1-rc.0",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ~0.1.1-rc.0"
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-session-telemetry": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ~0.1.1-rc.0 || ~0.1.2-alpha.0"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "3.18.1",