dsh-dlp 0.9.0 → 0.10.0

package/README.md

@@ -18,32 +18,36 @@ built as an out-of-repo plugin.
    the inbox that the user did not type (a `dsh-webhook` delivery's third-party payload, a
    settled subagent result, an agent relay). All of it reaches the model and the durable log
    through `agent/pre-step` without ever being a tool result. A message whose `source.kind` is
-   `user` is exempt: a secret a person deliberately types into their own prompt is not a leak
-   this plugin intercepts. The `agent/inbox/spliced` delivery record keeps a delivery's original
-   text, which is deliberate — it derives no model message, and an operator investigating a
-   webhook incident needs to read what was actually delivered.
+   `user` is exempt below `aggressiveness: high`; at `high` the user's own typed prompt is
+   redacted too, because this plugin cannot know which provider the request is bound for. The
+   `agent/inbox/spliced` delivery record keeps a delivery's original text, which is deliberate —
+   it derives no model message, and an operator investigating a webhook incident needs to read
+   what was actually delivered.
 4. **Redacts secrets out of exported telemetry**, closing a hole where `DSH_TELEMETRY_MODE=FULL`
    ships message text, tool arguments, results and workspace paths in the clear.
-5. **Strips invisible characters that carry hidden instructions** — the Tags block, bidi
+5. **Detects payment card numbers** — issuer range, a length that issuer assigns, and a Luhn
+   check digit — so cardholder data does not reach a third-party model in a tool result, a
+   spliced file, exported telemetry, or (at `aggressiveness: high`) a prompt someone typed.
+6. **Strips invisible characters that carry hidden instructions** — the Tags block, bidi
    overrides, runs of variation selectors — and strips terminal control sequences from the audit
    lane so a tool result cannot forge its own audit record.
-6. **Neutralises remote markdown images in assistant output** and detects a tool call another
+7. **Neutralises remote markdown images in assistant output** and detects a tool call another
    plugin rewrote after the session log recorded it.
-7. **Asks before the agent writes a file that changes future behaviour** — agent settings and
+8. **Asks before the agent writes a file that changes future behaviour** — agent settings and
    hooks, `CLAUDE.md`, `.claude/rules/**` and the other agent rules directories, prompt
    templates, `.vscode/tasks.json`, `.mcp.json`, git hooks, CI workflows, shell startup files,
    `pnpm-workspace.yaml` — and before it writes a `*_BASE_URL` that would redirect a provider
    credential.
-8. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
+9. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
    `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
    prompts rather than controls: they live at `tools/pre-execute`, they can be neutralised, and
    they abstain wherever the approval seam prompts nobody — which includes every install under
    `DSH_PERMISSION_MODE=danger-full-access` and a stock headless install under any mode.
-9. **Writes an audit record for every decision.** A redaction or denial names the rule, its
-   version, the offsets and a keyed hash; the three kinds with no matched region to describe —
-   an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
-   the destination hostname instead. Never the secret, never the path or command that matched.
-   `dsh-dlp report` reads it back.
+10. **Writes an audit record for every decision.** A redaction or denial names the rule, its
+    version, the offsets and a keyed hash; the three kinds with no matched region to describe —
+    an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
+    the destination hostname instead. Never the secret, never the path or command that matched.
+    `dsh-dlp report` reads it back.
 
 ## What this is not
 
@@ -69,7 +73,9 @@ Three limits worth knowing before you rely on it:
   control.**
 - **Detection is pattern-based.** No entropy rule (measured, not assumed: the lowest
   false-positive-free threshold cannot flag anything shorter than 64–66 characters). Encoded
-  forms pass. A homoglyph defeats every rule in this package.
+  forms pass. A homoglyph defeats every rule in this package. The card rule is Luhn-validated
+  and range-checked and found nothing across 272,635 lines of real source and docs, but
+  a *uniformly random* 16-digit number trips it 2.7% of the time and Maestro is not covered.
 
 [The full list of limits →](https://charlotten7.github.io/dsh-dlp/)
 
@@ -105,6 +111,7 @@ load.
     auditLog: /var/log/dsh-dlp.audit.jsonl
     redactionKeyFile: /var/lib/dsh/dsh-dlp.redaction-key
     policyFile: ./.dsh-dlp.yml        # optional, lowest trust
+    aggressiveness: medium            # low | medium | high
     breadthTier: true
     resultRedaction: true
     telemetryRedaction: true
@@ -118,10 +125,24 @@ load.
 version control — it is what makes a placeholder's hash keyed rather than a bare digest anyone
 holding a candidate secret could confirm.
 
+**`aggressiveness` is one word for how far redaction reaches.** `low` guarantees nothing and lets
+each toggle stand alone; `medium` — the default — guarantees every pass is on and that no toggle
+can take one away; `high` adds the user's own typed prompt to what is redacted. It composes with
+the toggles rather than overriding them: at `medium` and `high` a toggle set to `false`
+contradicts the level and **fails the mount** with the fix in the message, rather than one setting
+quietly beating the other.
+
+> **Upgrading from 0.9.0.** The default `medium` matches the shipped toggle defaults exactly, so
+> an install that never wrote a toggle is unchanged. An install that set any redaction toggle to
+> `false` now refuses to mount; add `aggressiveness: low` to the same row and it means what it
+> meant before. `high` is opt-in.
+
 **The guard floor has no configuration.** Credential-path denial and secret-argument denial are
 security invariants, not deployment-varying tunables. A repo-local `policyFile` is the lowest
 trust rank and may only *tighten*: add deny patterns, add egress tool names, raise a severity,
-switch a pass on. Any downgrade makes the whole file invalid.
+switch a pass on. It cannot reach `aggressiveness` — raising the level would let a hostile
+workspace put placeholders into the user's own prompt. Any downgrade makes the whole file
+invalid.
 
 [Configuration reference →](https://charlotten7.github.io/dsh-dlp/configuration.html) ·
 [What gets denied →](https://charlotten7.github.io/dsh-dlp/denials.html) ·

package/cordis.patch.yml

@@ -15,6 +15,12 @@
       config:
         auditLog: !!js dshHomePath('dsh-dlp.audit.jsonl')
         redactionKeyFile: !!js dshHomePath('dsh-dlp.redaction-key')
+        # `medium` guarantees every pass below is on and that none of them can
+        # be switched off; `high` adds the user's own typed prompt to what is
+        # redacted; `low` guarantees nothing and is what a deployment needing
+        # a pass off must set. A `false` below contradicting the level is a
+        # load-time error rather than a setting that quietly loses.
+        aggressiveness: medium
         maxScanBytes: 1048576
         breadthTier: true
         resultRedaction: true

package/lib/detectors.js

@@ -1,8 +1,9 @@
 /**
  * Two detection tiers and the vocabulary they share.
  *
- * Tier 1 is a synchronous table of prefix-anchored token formats, owned here
- * because two of the three seams this plugin uses are synchronous:
+ * Tier 1 is a synchronous table of token formats — prefix-anchored but for the
+ * check-digit-validated card rule — owned here because two of the three seams
+ * this plugin uses are synchronous:
  * `ToolGuard` returns `string | undefined` and the `session-telemetry/record`
  * waterfall returns a record, neither of which can await. Tier 2 wraps
  * `@secretlint/core`, which runs in-process with no subprocess but resolves a
@@ -31,16 +32,136 @@ export function severityRank(severity) {
 }
 /** Severity at or above which the guard floor denies rather than only redacting. */
 export const DENY_SEVERITY = 'high';
+/**
+ * Whether a digit string satisfies the Luhn check digit (ISO/IEC 7812-1).
+ * @param digits - the number with every separator already removed.
+ * @returns whether the trailing check digit is consistent with the rest.
+ */
+function luhnValid(digits) {
+    let sum = 0;
+    let double = false;
+    for (let index = digits.length - 1; index >= 0; index -= 1) {
+        let value = digits.charCodeAt(index) - 48;
+        if (double) {
+            value *= 2;
+            if (value > 9)
+                value -= 9;
+        }
+        sum += value;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+/**
+ * Issuer identification ranges, each with the lengths that issuer assigns.
+ *
+ * The length is half of each rule. Luhn alone accepts one digit run in ten,
+ * and these ranges at these lengths accept 26.8% of the sixteen-digit space
+ * (measured over 200,000 numbers with the check digit forced valid), so it is
+ * the pair that separates a card number from an order id beginning with a 4.
+ *
+ * Maestro is deliberately absent. Its ranges run from `50` and `56`-`58`
+ * through a bare leading `6` at any length from 12 to 19, which is most of the
+ * six-prefixed numeric space at most of the lengths an identifier uses;
+ * including it would cost more ordinary text than it catches.
+ * `docs/redaction.md` records that gap rather than implying coverage.
+ */
+const CARD_RANGES = [
+    { prefix: /^4/, lengths: [13, 16, 19] },
+    { prefix: /^5[1-5]/, lengths: [16] },
+    // Mastercard's 2-series, 222100 through 272099.
+    { prefix: /^2(?:22[1-9]|2[3-9]\d|[3-6]\d\d|7[01]\d|720)/, lengths: [16] },
+    { prefix: /^3[47]/, lengths: [15] },
+    // Discover: 6011, 622126-622925, 644-649, 65.
+    { prefix: /^6(?:011|5\d\d|4[4-9]\d|22(?:12[6-9]|1[3-9]\d|[2-8]\d\d|9[01]\d|92[0-5]))/, lengths: [16, 19] },
+    { prefix: /^35(?:2[89]|[3-8]\d)/, lengths: [16, 17, 18, 19] },
+    // Diners Club: 300-305, 3095, 36, 38, 39.
+    { prefix: /^3(?:0(?:[0-5]|95)|[689])/, lengths: [14, 16, 19] },
+    { prefix: /^62/, lengths: [16, 17, 18, 19] },
+];
+/** Whether a bare digit string is a number some issuer would have handed out. */
+function isIssuedCardNumber(digits) {
+    const issued = CARD_RANGES.some(range => range.lengths.includes(digits.length) && range.prefix.test(digits));
+    return issued && luhnValid(digits);
+}
+/**
+ * Shortest printed digit group.
+ *
+ * This is the constant that keeps an amount written with space thousands
+ * separators from reading as a card number. Measured over 200,000 random
+ * sixteen-digit amounts written `4 920 007 989 245 430`: admitting groups
+ * shorter than three flags 3.75% of them, requiring three flags 0.19%.
+ */
+const MIN_CARD_GROUP = 3;
+/** Longest printed digit group: American Express is printed 4-6-5. */
+const MAX_CARD_GROUP = 6;
+/** Most groups one match may span — a 19-digit number takes five, leaving room for one neighbour. */
+const MAX_CARD_GROUPS = 6;
+/** One printed group of a grouped card number. */
+const CARD_GROUP = String.raw `\d{${MIN_CARD_GROUP},${MAX_CARD_GROUP}}`;
+/**
+ * A digit run that could be a card number: either unbroken, or printed in
+ * groups separated by single spaces or hyphens.
+ *
+ * The two lookarounds drop the commonest long digit run in machine output that
+ * is not an identifier at all — the fractional part of a decimal. A JavaScript
+ * `Math.random()` prints sixteen digits after the point, and 1.63% of them get
+ * past both the issuer ranges and the check digit; measured over 200,000
+ * printouts, the lookbehind takes that to zero.
+ */
+const CARD_CANDIDATE = new RegExp(String.raw `(?<!\d\.)\b(?:\d{13,19}|${CARD_GROUP}(?:[ -]${CARD_GROUP}){1,${MAX_CARD_GROUPS - 1}})\b(?!\.\d)`, 'g');
+/**
+ * Narrow one candidate digit run to the card number inside it.
+ *
+ * The pattern is greedy across printed groups, so a run holding a card number
+ * beside an expiry date, an amount or a year arrives here as one match. Every
+ * group-aligned window of the run is tested, longest first, and each window's
+ * edges sit on a separator or on the ends of the match — where the pattern
+ * already established a word boundary — so narrowing never reports part of a
+ * longer unbroken number. An unbroken run has exactly one window, itself,
+ * which is what keeps a 20-digit identifier from being reported as the
+ * 16-digit card number hiding in its first sixteen digits.
+ * @param match - the matched candidate.
+ * @returns offsets of the card number within the match, or `undefined` when there is none.
+ */
+export function refinePaymentCardNumber(match) {
+    const groups = [];
+    let cursor = 0;
+    for (const digits of match.split(/[ -]/)) {
+        groups.push({ start: cursor, end: cursor + digits.length, digits });
+        cursor += digits.length + 1;
+    }
+    const windows = [];
+    for (const [index, first] of groups.entries()) {
+        let digits = '';
+        for (const group of groups.slice(index)) {
+            digits += group.digits;
+            windows.push({ start: first.start, end: group.end, digits });
+        }
+    }
+    // Longest first, so a number is reported whole rather than as a prefix of
+    // itself that happens to validate at a shorter issuer length.
+    windows.sort((left, right) => (right.end - right.start) - (left.end - left.start));
+    for (const window of windows) {
+        if (isIssuedCardNumber(window.digits))
+            return { start: window.start, end: window.end };
+    }
+    return undefined;
+}
 /**
  * Tier 1's rule table. Deliberately narrow: only formats whose prefix or
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
  *
- * Prefix-anchored is the whole membership criterion, and the reason this table
- * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
- * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
- * here is exported in the clear when telemetry is on.
+ * A structurally unambiguous match is the membership criterion, and the reason
+ * this table keeps growing rather than deferring to tier 2: the
+ * `session-telemetry/record` waterfall is synchronous and cannot reach tier 2
+ * at all, so a format missing here is exported in the clear when telemetry is
+ * on. For every rule but one that means a prefix. The exception is
+ * `dsh-dlp/payment-card-number`, which has no prefix to anchor on and earns
+ * its place through an issuer range, a length that issuer assigns and a check
+ * digit instead.
  */
 export const SYNC_RULES = [
     { id: 'dsh-dlp/aws-access-key-id', version: 1, severity: 'critical', pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g },
@@ -126,6 +247,23 @@ export const SYNC_RULES = [
     { id: 'dsh-dlp/discord-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/(?:\w+\.)?discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]{10,}/g },
     { id: 'dsh-dlp/teams-webhook-url', version: 1, severity: 'critical', pattern: /\bhttps:\/\/[A-Za-z0-9.-]*webhook\.office\.com\/webhookb2\/[A-Za-z0-9@/_-]{10,}/g },
     { id: 'dsh-dlp/secret-assignment', version: 1, severity: 'medium', pattern: /\b(?:api[_-]?key|secret[_-]?key|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token)\b\s*[=:]\s*["']?[A-Za-z0-9/+=_-]{16,}["']?/gi },
+    // Cardholder data, which is the one class here that is not a credential the
+    // agent could have fetched: it is typed, pasted or read out of a customer
+    // record, and it is regulated wherever it goes. `medium` is deliberate and
+    // is the only rule in this table below `high` other than the assignment
+    // heuristic above it. The guard floor denies at `high`, and a denial from
+    // this rule would be unoverridable, while its false positives are ordinary
+    // long numbers rather than malformed credentials. A deployment that wants
+    // the denial raises the severity from its repo-local policy, which the
+    // tighten-only tier already allows.
+    {
+        id: 'dsh-dlp/payment-card-number',
+        version: 1,
+        severity: 'medium',
+        pattern: CARD_CANDIDATE,
+        refine: refinePaymentCardNumber,
+        exact: true,
+    },
 ];
 /**
  * Build one class's run pattern from its ranges, so the two cannot drift apart.
@@ -318,13 +456,18 @@ export function scanSync(text, rules = SYNC_RULES) {
     for (const rule of rules) {
         for (const match of text.matchAll(rule.pattern)) {
             // `matchAll` on a global pattern always reports an index.
-            const start = match.index;
+            const region = rule.refine === undefined
+                ? { start: 0, end: match[0].length }
+                : rule.refine(match[0]);
+            if (region === undefined)
+                continue;
             detections.push({
                 ruleId: rule.id,
                 ruleVersion: rule.version,
                 severity: rule.severity,
-                start,
-                end: start + match[0].length,
+                start: match.index + region.start,
+                end: match.index + region.end,
+                ...rule.exact === true ? { exact: true } : {},
             });
         }
     }

package/lib/policy.js

@@ -11,7 +11,10 @@
  * Rank 3 is a file inside the workspace, so a hostile repository ships one and
  * a prompt-injected agent can write one. It may add deny patterns, add egress
  * tools, raise a severity, and switch a redaction pass on. Every other key,
- * and every downgrade, is a load-time error rather than a silent ignore.
+ * and every downgrade, is a load-time error rather than a silent ignore. It
+ * cannot reach {@link Config.aggressiveness}: the level's own lever is
+ * redacting what the user typed, and a workspace that could force that could
+ * garble the user's own words on their way to the model.
  * @module dsh-dlp/policy
  */
 import { readFileSync } from 'node:fs';
@@ -23,6 +26,7 @@ import { SYNC_RULES, severityRank, stripControlSequences } from "./detectors.js"
 import { resolveDshHome } from "./home.js";
 import { CREDENTIAL_PATH_RULES, escapePathPattern, homeCredentialPathRules } from "./paths.js";
 export const Config = z.object({
+    aggressiveness: z.union([z.const('low'), z.const('medium'), z.const('high')]).default('medium'),
     auditLog: z.string().required(),
     redactionKeyFile: z.string().required(),
     policyFile: z.string(),
@@ -49,6 +53,39 @@ const ENABLEABLE = [
     'configWriteAsk',
     'approvalSuppressionAsk',
 ];
+/**
+ * Passes each level requires, whatever the toggles say.
+ *
+ * `low` requires none, which is what makes it the level a deployment moves to
+ * when it needs a pass off — and what makes every configuration that was legal
+ * before this field existed still legal. `medium` and `high` require all of
+ * them, so the one-word setting and the nine booleans can never describe
+ * different plugins.
+ */
+const LEVEL_REQUIRES = {
+    low: [],
+    medium: ENABLEABLE,
+    high: ENABLEABLE,
+};
+/**
+ * Reject a configuration whose level and whose toggles describe different
+ * behaviour.
+ *
+ * Loud at load rather than silently resolved either way: two
+ * deployment-controlled settings disagreeing is self-contained
+ * misconfiguration, and whichever of them lost would be a pass an operator
+ * believes is running and is not, or one they believe is off and is not.
+ * @param config - the deployment-controlled configuration.
+ * @throws PolicyError naming every toggle that contradicts the level.
+ */
+function assertLevelAgrees(config) {
+    const contradicted = LEVEL_REQUIRES[config.aggressiveness].filter(toggle => !config[toggle]);
+    if (contradicted.length === 0)
+        return;
+    throw new PolicyError(`aggressiveness: ${config.aggressiveness} requires every pass this package ships, but`
+        + ` ${contradicted.join(', ')} ${contradicted.length === 1 ? 'is' : 'are'} set to false.`
+        + ' Set aggressiveness: low to choose passes individually, or drop the false setting.');
+}
 /** Keys a repo-local policy file may carry; anything else fails the load. */
 const POLICY_KEYS = ['v', 'addCredentialPaths', 'addEgressTools', 'raiseSeverity', 'enable'];
 /** Payload version this package writes and accepts for repo-local policy files. */
@@ -270,6 +307,7 @@ function selfProtectionRules(config, dshHome) {
  * @returns the effective policy every seam reads.
  */
 export function resolvePolicy(config, repo) {
+    assertLevelAgrees(config);
     const enabled = (toggle) => config[toggle] || (repo?.enable.includes(toggle) ?? false);
     return {
         credentialPathRules: [
@@ -284,6 +322,8 @@ export function resolvePolicy(config, repo) {
             return raised === undefined ? rule : { ...rule, severity: raised };
         }),
         maxScanBytes: config.maxScanBytes,
+        aggressiveness: config.aggressiveness,
+        userTypedInputRedaction: config.aggressiveness === 'high',
         breadthTier: enabled('breadthTier'),
         resultRedaction: enabled('resultRedaction'),
         telemetryRedaction: enabled('telemetryRedaction'),

package/lib/steps.js

@@ -19,8 +19,12 @@
  * payload with `agent.followup()`, a subagent's settled result and an
  * agent-to-agent relay arrive the same way, and so does anything
  * `agent.inject()` seeded. {@link isUserTyped} is the exemption, and it is the
- * only one: a secret a person deliberately types into their own prompt is not
- * a leak this plugin intercepts.
+ * only one, but it is not unconditional: it applies at `aggressiveness: low`
+ * and `medium`, and stops applying at `high`. This plugin cannot know where
+ * the request is going, and a card number a person typed on purpose is still
+ * cardholder data at whatever provider the deployment happens to be pointed
+ * at, so the deployment says which reading it wants rather than this module
+ * assuming one.
  *
  * A claimed message differs from an added one in exactly one way, and it is
  * narrower than it looks. Its delivery was already recorded as
@@ -44,7 +48,7 @@ import { messageStrings, prepareScan } from "./results.js";
 import { redactUserMessages } from "./redaction.js";
 /**
  * Whether one message the loop claimed from the inbox is the user's own
- * typing, and therefore exempt.
+ * typing, which exempts it below `aggressiveness: high`.
  *
  * `MessageSourceMap` is merge-extensible and every producer picks its own
  * `kind`, so the exemption is a single allowed value rather than a list of
@@ -62,6 +66,9 @@ import { redactUserMessages } from "./redaction.js";
  * prompt under `kind: 'user'`. Those stay exempt here. Distinguishing them
  * needs a fact the source does not carry, and inventing one would put a
  * guessed value in a security decision.
+ *
+ * At `aggressiveness: high` the caller stops consulting this, so the two
+ * borrowed cases stop being exempt with everything else.
  * @param message - one message the loop claimed from the inbox.
  * @returns whether the message came from a person typing into their own prompt.
  */
@@ -86,7 +93,7 @@ export async function redactStepContext(decision, claimed, policy, hasher) {
     // claimed message is the same object it arrived as.
     const claimedSet = new Set(claimed);
     const inScope = (message) => claimedSet.has(message)
-        ? policy.claimedInputRedaction && !isUserTyped(message)
+        ? policy.claimedInputRedaction && (policy.userTypedInputRedaction || !isUserTyped(message))
         : policy.stepContextRedaction;
     const selected = decision.messages.filter(inScope);
     if (selected.length === 0)

package/lib/types/detectors.d.ts

@@ -1,8 +1,9 @@
 /**
  * Two detection tiers and the vocabulary they share.
  *
- * Tier 1 is a synchronous table of prefix-anchored token formats, owned here
- * because two of the three seams this plugin uses are synchronous:
+ * Tier 1 is a synchronous table of token formats — prefix-anchored but for the
+ * check-digit-validated card rule — owned here because two of the three seams
+ * this plugin uses are synchronous:
  * `ToolGuard` returns `string | undefined` and the `session-telemetry/record`
  * waterfall returns a record, neither of which can await. Tier 2 wraps
  * `@secretlint/core`, which runs in-process with no subprocess but resolves a
@@ -39,8 +40,10 @@ export interface Detection {
     readonly end: number;
     /**
      * Set when the offsets cover exactly what must be replaced, so redaction
-     * must not widen them to the surrounding delimiters. Only the Unicode
-     * indicators set it: their matches are the characters themselves, while a
+     * must not widen them to the surrounding delimiters. Two kinds of rule set
+     * it: the Unicode indicators, whose matches are the characters themselves,
+     * and the payment-card rule, whose match is validated digit by digit and so
+     * covers precisely the number. Everything else leaves it unset, because a
      * secret's reported span is advisory and verified to under-cover (ADR §4).
      */
     readonly exact?: true;
@@ -58,17 +61,55 @@ export interface SyncRule {
     readonly severity: Severity;
     /** Global-flagged; matched through `matchAll`, which never mutates this instance's `lastIndex`. */
     readonly pattern: RegExp;
+    /**
+     * Narrows one raw match to the region that is really a detection, or rejects
+     * it outright by returning `undefined`. Offsets are relative to the match.
+     *
+     * Present for the one format a regular expression cannot decide on its own:
+     * a payment card number is a digit run that must also carry a known issuer
+     * prefix at a length that issuer assigns and satisfy a check digit, and the
+     * run it sits in may carry a neighbouring number the pattern swept up.
+     * Absent everywhere else, where the prefix makes the match unambiguous.
+     */
+    readonly refine?: (match: string) => {
+        readonly start: number;
+        readonly end: number;
+    } | undefined;
+    /** Whether the reported offsets cover exactly the text to replace; see {@link Detection.exact}. */
+    readonly exact?: true;
 }
+/**
+ * Narrow one candidate digit run to the card number inside it.
+ *
+ * The pattern is greedy across printed groups, so a run holding a card number
+ * beside an expiry date, an amount or a year arrives here as one match. Every
+ * group-aligned window of the run is tested, longest first, and each window's
+ * edges sit on a separator or on the ends of the match — where the pattern
+ * already established a word boundary — so narrowing never reports part of a
+ * longer unbroken number. An unbroken run has exactly one window, itself,
+ * which is what keeps a 20-digit identifier from being reported as the
+ * 16-digit card number hiding in its first sixteen digits.
+ * @param match - the matched candidate.
+ * @returns offsets of the card number within the match, or `undefined` when there is none.
+ */
+export declare function refinePaymentCardNumber(match: string): {
+    start: number;
+    end: number;
+} | undefined;
 /**
  * Tier 1's rule table. Deliberately narrow: only formats whose prefix or
  * delimiters make a match structurally unambiguous, plus PEM blocks and
  * credential-bearing URLs. Anything requiring entropy heuristics is left to
  * tier 2, where a false positive costs a redaction rather than a denial.
  *
- * Prefix-anchored is the whole membership criterion, and the reason this table
- * keeps growing rather than deferring to tier 2: the `session-telemetry/record`
- * waterfall is synchronous and cannot reach tier 2 at all, so a format missing
- * here is exported in the clear when telemetry is on.
+ * A structurally unambiguous match is the membership criterion, and the reason
+ * this table keeps growing rather than deferring to tier 2: the
+ * `session-telemetry/record` waterfall is synchronous and cannot reach tier 2
+ * at all, so a format missing here is exported in the clear when telemetry is
+ * on. For every rule but one that means a prefix. The exception is
+ * `dsh-dlp/payment-card-number`, which has no prefix to anchor on and earns
+ * its place through an issuer range, a length that issuer assigns and a check
+ * digit instead.
  */
 export declare const SYNC_RULES: readonly SyncRule[];
 /**

package/lib/types/policy.d.ts

@@ -11,14 +11,41 @@
  * Rank 3 is a file inside the workspace, so a hostile repository ships one and
  * a prompt-injected agent can write one. It may add deny patterns, add egress
  * tools, raise a severity, and switch a redaction pass on. Every other key,
- * and every downgrade, is a load-time error rather than a silent ignore.
+ * and every downgrade, is a load-time error rather than a silent ignore. It
+ * cannot reach {@link Config.aggressiveness}: the level's own lever is
+ * redacting what the user typed, and a workspace that could force that could
+ * garble the user's own words on their way to the model.
  * @module dsh-dlp/policy
  */
 import z from '@deepseek-ai/schemastery';
 import { type Severity, type SyncRule } from './detectors.ts';
 import { type CredentialPathRule } from './paths.ts';
+/**
+ * How far redaction reaches, as one word.
+ *
+ * The level is not a tenth switch beside the nine below it. It states what the
+ * deployment guarantees, the toggles state which passes carry it out, and the
+ * two may not disagree: at `medium` and `high` a toggle set to `false`
+ * contradicts the guarantee and is a load-time error rather than a setting
+ * that quietly loses.
+ *
+ * - `low` guarantees nothing. Every pass is exactly its own toggle, which is
+ *   still `true` unless the deployment says otherwise. This is the level to
+ *   pick when a pass has to be switched off.
+ * - `medium` guarantees that every pass this package ships is on and that no
+ *   toggle can take one away. The user's own typing stays exempt.
+ * - `high` is `medium` plus the one thing no toggle can express: the exemption
+ *   in `isUserTyped` stops applying, so a secret in the user's own prompt is
+ *   redacted before the request is built from it.
+ */
+export type Aggressiveness = 'low' | 'medium' | 'high';
 /** Deployment configuration, validated from `cordis.yml`. */
 export interface Config {
+    /**
+     * How far redaction reaches. See {@link Aggressiveness}; `high` is the only
+     * value that puts the user's own typed prompt in scope.
+     */
+    aggressiveness: Aggressiveness;
     /** Absolute path of this plugin's own JSONL audit sink. Never the session log. */
     auditLog: string;
     /** Absolute path of the installation's redaction key; created with 32 random bytes if absent. */
@@ -85,6 +112,16 @@ export interface ResolvedPolicy {
     readonly extraEgressTools: ReadonlySet<string>;
     readonly syncRules: readonly SyncRule[];
     readonly maxScanBytes: number;
+    readonly aggressiveness: Aggressiveness;
+    /**
+     * Whether a message the user typed themselves is scanned like any other.
+     *
+     * Set by the level alone, at `high` only, and by nothing else: there is no
+     * toggle for it and a repo-local policy cannot reach it. `isUserTyped` still
+     * decides which messages this applies to; this decides whether that answer
+     * exempts them.
+     */
+    readonly userTypedInputRedaction: boolean;
     readonly breadthTier: boolean;
     readonly resultRedaction: boolean;
     readonly telemetryRedaction: boolean;

package/lib/types/steps.d.ts

@@ -19,8 +19,12 @@
  * payload with `agent.followup()`, a subagent's settled result and an
  * agent-to-agent relay arrive the same way, and so does anything
  * `agent.inject()` seeded. {@link isUserTyped} is the exemption, and it is the
- * only one: a secret a person deliberately types into their own prompt is not
- * a leak this plugin intercepts.
+ * only one, but it is not unconditional: it applies at `aggressiveness: low`
+ * and `medium`, and stops applying at `high`. This plugin cannot know where
+ * the request is going, and a card number a person typed on purpose is still
+ * cardholder data at whatever provider the deployment happens to be pointed
+ * at, so the deployment says which reading it wants rather than this module
+ * assuming one.
  *
  * A claimed message differs from an added one in exactly one way, and it is
  * narrower than it looks. Its delivery was already recorded as
@@ -64,7 +68,7 @@ export interface StepRedaction {
 }
 /**
  * Whether one message the loop claimed from the inbox is the user's own
- * typing, and therefore exempt.
+ * typing, which exempts it below `aggressiveness: high`.
  *
  * `MessageSourceMap` is merge-extensible and every producer picks its own
  * `kind`, so the exemption is a single allowed value rather than a list of
@@ -82,6 +86,9 @@ export interface StepRedaction {
  * prompt under `kind: 'user'`. Those stay exempt here. Distinguishing them
  * needs a fact the source does not carry, and inventing one would put a
  * guessed value in a security decision.
+ *
+ * At `aggressiveness: high` the caller stops consulting this, so the two
+ * borrowed cases stop being exempt with everything else.
  * @param message - one message the loop claimed from the inbox.
  * @returns whether the message came from a person typing into their own prompt.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",