From be6d3de174091fab04aba51fc03e1ba542520972 Mon Sep 17 00:00:00 2001
From: ikun <ikunikun1145@gmail.com>
Date: Wed, 14 Oct 2026 14:39:21 -0700
Subject: [PATCH 1/2] fix(dsh): redact local file references in observer
 summaries

Signed-off-by: ikun <ikunikun1145@gmail.com>
---
 packages/dsh-loopx-plugin/src/observer.ts                     | 2 ++
 .../reliability_diagnostics_public_safety_v0.json             | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/dsh-loopx-plugin/src/observer.ts b/packages/dsh-loopx-plugin/src/observer.ts
index 2f700e35ee..05eb42e4f3 100644
--- a/packages/dsh-loopx-plugin/src/observer.ts
+++ b/packages/dsh-loopx-plugin/src/observer.ts
@@ -73,6 +73,8 @@ const SUMMARY_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_./:-]{0,79}$/u
 const LOCAL_PATH_SURFACES = [
   /(?<![:/a-z0-9])\/(?:users|home|volumes|private|tmp|var|etc|opt|srv|mnt|root|workspace|workspaces)\/[^\s`'"<>]+/iu,
   /(?<![:/a-z0-9])[a-z]:[/\\](?:users|documents and settings)[/\\][^\s`'"<>]+/iu,
+  /(?<![\w:])path:[/\\][^\s`'"<>]+/iu,
+  /\bfile:\/\//iu,
 ] as const
 const SECRET_LIKE_SURFACES = [
   /\bbearer\s+[a-z0-9._~+/=-]{16,}/iu,
diff --git a/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json b/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json
index e70b9fc6a6..2066d27583 100644
--- a/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json
+++ b/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json
@@ -4,7 +4,9 @@
     "sk-abcdefghijklmnop0123",
     "ghp_abcdefghijklmnopqrstuvwx",
     "eyJabcdefghijk.abcdefghijk.abcdefghijk",
-    "C:/Users/alice/private.txt"
+    "C:/Users/alice/private.txt",
+    "path:/Users/alice/private.txt",
+    "file:///Users/alice/private.txt"
   ],
   "unsafe_identity_tokens": [
     "sk-abcdefghijklmnop0123",

From 57977b9739fddb8f648c9db93203dbe7584ce0a1 Mon Sep 17 00:00:00 2001
From: ikun <ikunikun1145@gmail.com>
Date: Wed, 14 Oct 2026 14:48:16 -0700
Subject: [PATCH 2/2] fix(dsh): reject single-slash file URLs

Signed-off-by: ikun <ikunikun1145@gmail.com>
---
 packages/dsh-loopx-plugin/src/observer.ts                      | 2 +-
 .../reliability_diagnostics_public_safety_v0.json              | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/dsh-loopx-plugin/src/observer.ts b/packages/dsh-loopx-plugin/src/observer.ts
index 05eb42e4f3..e1fb05ccf0 100644
--- a/packages/dsh-loopx-plugin/src/observer.ts
+++ b/packages/dsh-loopx-plugin/src/observer.ts
@@ -74,7 +74,7 @@ const LOCAL_PATH_SURFACES = [
   /(?<![:/a-z0-9])\/(?:users|home|volumes|private|tmp|var|etc|opt|srv|mnt|root|workspace|workspaces)\/[^\s`'"<>]+/iu,
   /(?<![:/a-z0-9])[a-z]:[/\\](?:users|documents and settings)[/\\][^\s`'"<>]+/iu,
   /(?<![\w:])path:[/\\][^\s`'"<>]+/iu,
-  /\bfile:\/\//iu,
+  /\bfile:\/+/iu,
 ] as const
 const SECRET_LIKE_SURFACES = [
   /\bbearer\s+[a-z0-9._~+/=-]{16,}/iu,
diff --git a/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json b/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json
index 2066d27583..e37be4f885 100644
--- a/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json
+++ b/tests/fixtures/control_plane/reliability_diagnostics_public_safety_v0.json
@@ -6,7 +6,8 @@
     "eyJabcdefghijk.abcdefghijk.abcdefghijk",
     "C:/Users/alice/private.txt",
     "path:/Users/alice/private.txt",
-    "file:///Users/alice/private.txt"
+    "file:///Users/alice/private.txt",
+    "file:/Users/alice/private.txt"
   ],
   "unsafe_identity_tokens": [
     "sk-abcdefghijklmnop0123",