Skip to content

dsh-telemetry-redactor v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@030611 030611 released this 14 Aug 07:23
· 3 commits to main since this release
v0.1.0
89a8196

First public release of DSH Telemetry Redactor.

Highlights

  • Mounts the official session-telemetry/record waterfall and recursively redacts supported secret patterns from the outbound copy.
  • Preserves the canonical session log and keeps other deployment rules composable through next().
  • Rejects cycles, accessors, excessive nesting, non-plain objects, and redacted-key collisions instead of exporting a partial or meaning-changing copy.
  • Supports a bounded configurable replacement string; detection rules remain fixed security behavior.

Install

dsh plugin --profile web add dsh-telemetry-redactor@0.1.0
dsh --profile web --dump-config

Verification

  • Node.js 24.19.0 and pnpm 11.19.0.
  • TypeScript typecheck, production build, and 17 tests passed.
  • Built smoke and 50,000-field performance smoke passed (167.2 ms on the release host).
  • Official-head and official-patch fixture checks passed for reviewed DSH commit 47f943859bef60e4160492346772ded9b24f765a.
  • Clean-environment packed install, public-registry install, and package-name import passed.
  • Published tarball contains 12 files; registry shasum is 7974ef9021fe6a95c9a8bad85bb98b327b227454.
  • GitHub CI: https://github.com/030611/dsh-telemetry-redactor/actions/runs/31776568953

Security boundaries

“Fail-closed” has one narrow meaning here: with the official SessionTelemetryCoordinator, a thrown rule causes that one export copy to be withheld while the agent loop continues. This is not a guarantee across every telemetry path or listener ordering. Direct backend emit() calls and a later outer prepended listener can bypass or reintroduce data. Pattern redaction cannot detect every opaque, encoded, novel, or deployment-specific secret, so exported telemetry remains sensitive. This plugin is not a process sandbox, authorization system, or complete data-loss-prevention service.

The frozen fixture checks reviewed source hashes and public runtime versions, file hashes, and required API surfaces. It does not prove that an npm package was built from the cited Git commit.

Implementation and release preparation used AI assistance; the published files, security claims, and release gates were reviewed before publication.

Assets 2
Loading