dsh-canary

When a model reads a malicious instruction, the stealthiest exfiltration path is echoing a context value straight into a tool argument or an outbound URL. dsh-canary guards exactly that narrow seam: it plants a one-shot canary string (DSHCANARY_ prefix plus 32 lowercase hex characters) in a tool description the model can see, then walks every argument, object key, and URL component (including two passes of percent-decoding) at your own wrapExecute call site. If the canary shows up, the tool is denied before it runs, the error carries the code CANARY_TRIP, and one canary-free JSONL incident line is appended to a 0600 log. There is no model, no scoring, no entropy heuristic, no threshold to tune; a truncated, re-cased, or split-across-fields canary deliberately does not trip it, because a single false denial is the failure mode that gets a tripwire switched off. In short, it is a single-value, precision tripwire for echo-exfiltration only — it does not promise to catch file edits, step-skipping, or exfiltration of your real data. It suits admins and security engineers running DeepSeek Harness who want a low-cognition-cost, auditable signal that answers one question — "did the canary get read out?" — without maintaining a word list, pulling in a red-team corpus, or feeding CI any credentials. A fresh 128-bit canary is minted on every apply and retires with the plugin's lifetime.