fix(dsh): redact local file references in observer summaries

[ikunikun1145]

Goal And Delivered Outcome

• Outcome basis: Related to [Architecture]: two modules both claim to own "private-looking text" #5136, the repository’s public-safe text boundary work.
• Goal/source and gap: The DSH shadow observer accepted tool/call.name values using its summary token shape, but its local-path checks missed file:/// and path:/ references. A reproduced synthetic tool call wrote the URI into the diagnostics ledger.
• Observable before → after: both forms could appear in emitted summary JSON → both are rejected and counted as public_safety_violation. The observer fixture test proves the result.
• Issue/task and intended base: Related to [Architecture]: two modules both claim to own "private-looking text" #5136; based on loopx-project/loopx main at 3c681f1132fe719e01f75a5e41bfd854dfa9e346.

Author Declaration

• Written by: OpenAI Codex agent using GPT-6, under the direction of contributor ikunikun1145.

Implemented against

• Specification and revision: [Architecture]: two modules both claim to own "private-looking text" #5136; upstream main at 3c681f1132fe719e01f75a5e41bfd854dfa9e346.

Criterion	Disposition	Symbol / path	Test or command
Reject explicit local-path references from observer summaries	implemented	packages/dsh-loopx-plugin/src/observer.ts	packages/dsh-loopx-plugin/tests/observer.spec.ts

• Self-check: Reproduced the leak on unmodified upstream with synthetic event data; checked the shared fixture consumer and the two changed paths. Other public-safety surfaces remain outside this slice.

Scope And Continuation

• Completed scope: DSH observer summaries reject file URLs and path-prefixed local paths before ledger emission.
• Slice boundary / successor: Complete within this scope; other destination-specific gaps remain tracked under [Architecture]: two modules both claim to own "private-looking text" #5136.

Validation

• Tested revision: be6d3de174091fab04aba51fc03e1ba542520972
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
unit	passed	Observer suite: 12 passed; unsafe fixture tokens are rejected for tool-call summaries and counted.
static	passed	Package TypeScript typecheck and git diff --check.
regression_parity	passed	Unmodified upstream emitted the synthetic URI; the patched observer suite rejects it.
integration	failed	Full package suite: 206 passed, 1 failed in admission closeout. The same test failure reproduced on unmodified upstream.

• Coverage and gaps: The focused observer tests cover the new fixture cases and rejection accounting. The unrelated admission-closeout test remains failing on upstream; hosted CI is pending.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A
• Craft review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference: N/A; this is a scoped DSH observer privacy-boundary fix.

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal: N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths. The path-shaped values are synthetic public regression inputs.
• I did not duplicate maintainer-owned benchmark work.
• I kept the change scoped to the related issue.
• UI impact is marked none.
• Every commit includes a DCO Signed-off-by trailer.

[ikunikun1145]

Follow-up at 57977b9: the first patch still missed the valid single-slash file:/... URI form because the absolute-path matcher excludes colon-prefixed paths. I reproduced the leak in the shared observer fixture before the fix; it appeared in emitted tool_name and error_class. The guard now rejects one or more slashes after file:, and the fixture covers file:/... alongside file:///.... Validation at this head: observer suite 12 passed; TypeScript typecheck passed; the full package suite had 206 passes and one failure in admission-closeout.integration.spec.ts, the same baseline failure reproduced on unmodified upstream; git diff --check passed.

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; reasoning_effort=xhigh; declaration_source=runtime_reported

动机

评审 57977b9739fddb8f648c9db93203dbe7584ce0a1，base 3c681f1132fe719e01f75e5a41bfd854dfa9e346。启用 DSH 只读诊断的用户，需要让工具摘要可被安全保存和后续读取。旧校验把合法 token 形状误当安全内容，工具名称或错误类别中的本地文件引用会进入诊断账本。同一个合成工具调用原先把 file:/ 文件引用写入 tool_name；现在该事件在入缓冲前被拒绝，账本只保留拒绝计数，普通工具调用仍原样写入。真实文件追加对照中五种本地引用从泄漏变为拒绝，四种安全摘要的完整记录一致；关闭观察器及写盘失败仍隔离。本次只修复 DSH 摘要的明确本地引用，不关闭 #5136 的其他调用方迁移，也不证明 live DSH 运行资格。原 #5136 其他目的地的单一检测归属与迁移仍开放；既有 admission-closeout 失败由原 owner 修复，合并资格另判。

改动思路

修复落在独立 DSH 扩展已有的摘要公开边界；复用递归检查、拒绝类别和共享语料，不向驱动或调度路径增加职责。本次只收紧启用观察器的本地引用摘要，不增加发消息、驱动续跑或全局私有字段策略。 本轮按完整原 issue、现有调用链和作者声明判断独立交付边界，未把测试数量当整体验收，也没有继承历史批准。体验建议仅用于追踪真实入口、失败和读回，不构成新的 roadmap、权限或长期收益证明。

具体改动

observer.ts:73–78 在既有 LOCAL_PATH_SURFACES 增加明确 path: 前缀和 file: 后一个或多个斜线两条语法。isPublicSafeText（:201）仍被递归 isPublicSafeValue 使用：record 在缓冲前拒绝不安全 envelope，flushBatch 在真正追加前再校验；拒绝仍用 public_safety_violation，不回显原值。工具参数、正文、驱动 send/inbox 和调度没有进入观察路径。

共享 fixture 新增三种 URI/前缀输入；既有 TypeScript observer 测试自动覆盖 tool_name 与 error_class，Python provider 的同一语料也必须拒绝。完整两路径 +6/-1，两提交均有 DCO。对照 #5136 维护者方向 revision 5857977250：explicit_local_reference_rejection、destination_and_off_parity implemented；other_destination_migration deferred，其他公开目的地及统一归属仍由原 #5136 owner 继续。该扩展已有独立 token/递归守卫，本次沿最近公开边界修补，没有把 Core 私有状态全部收紧。

对主干的风险

重点检查误杀安全 token、落盘前绕过和关闭路径副作用。本轮正常打包并解包扩展，以真实 ShadowObserver 和默认文件追加器写临时 NDJSON：相同固定身份/时钟的九组 token、两类事件中，五种 path/file 引用在 base 均泄漏、head 均在写入前拒绝并计数；四种安全 token 的完整解码记录逐项一致，未归一化。profile:/version 等相邻普通词仍通过；单斜线、多斜线、大小写和 file host 形式均覆盖。两侧关闭 apply 都不触碰 context，真实写盘失败均隔离，未向 worker 抛错。源码 hook 的错 session、缓冲和 dispose 行为未改。

TypeScript observer 12 passed、typecheck、正常 build/pack、共享 Python fixture base22/head28 passed。完整 SDK 两侧均 206 passed/1 failed：相同 admission-closeout.integration.spec.ts:40（调用 :303）收到 undefined 而非 object；以同一依赖图、解释器和不可变 base 重跑，相关 test/CLI 路径未被两行 guard 改动。当前 canary 的 3 direct 通过，catalog/risk 各三项中 package/runtime 通过、quality 因同一断言失败；同命令 base quality 亦同签名失败。保留红灯和原 owner，不能把本评审当整套检查全绿或绕过合并门。受影响隐私边界由上面的独立真实追加对照覆盖。

初始依赖准备因 pnpm 版本忽略旧 overrides 配置而 frozen-lock 安装失败；随后以 --lockfile=false 准备同一图用于两侧，未改 lock/source，不能声称 frozen install 资格。先 advisory 后完整 semantic；包源码超出 advisory 支持范围，零扫描不作覆盖证明，两路径与双语料消费者已人工检查。没有读、等待或触发 CI；合成 session 事件不等于 live DSH、模型或安装态验证。

我的整体评价

未发现阻断本次有界修复的问题。APPROVE，justified_increment。 long_horizon improved：不安全引用不再污染后续诊断；user_experience improved：既有启用方式不变，安全摘要完全保留，写盘失败仍不干扰工作。未来变更检查保留最近的递归入口和共享语料；更广的跨包分类器提取须由 #5136 的目的地策略迁移统一验证，不为这两个 guard 引入新的运行依赖。没有新增协议状态、字段、生命周期或执行权限；本批准不关闭既有 admission-closeout 红灯、其他目的地迁移，也不授予合并或发布。

English verdict: APPROVE — 57977b9739fddb8f648c9db93203dbe7584ce0a1 rejects explicit path/file references before observer ledger emission. Real packed on-disk base/head probes cover five newly rejected forms, four exact safe-output pairs, default-off and IO isolation. SDK/canary quality retain the independently reproduced unchanged admission-closeout failure; merge qualification is separate.