dsh-failure-lens is a read-only, presentational browser plugin. If you find a security issue — especially anything that contradicts the guarantees below — please report it privately rather than opening a public issue.

Report to: open a private security advisory in the GitHub repository, or contact the maintainer directly. Please include the affected version and a minimal reproduction.

The plugin is designed within the following hard boundaries. Any behavior outside them is a bug and should be reported:

• No telemetry, no network, no disk writes. The plugin adds no requests of its own and writes nothing to storage.
• No model calls. Classification is a pure deterministic function; the plugin never invokes an LLM, never edits the system prompt, and never adds tokens to a request.
• No approval, no re-execution. The plugin never auto-approves, never escalates sandbox permissions, and never runs the command again.
• No raw-output duplication. The tool card keeps the original output; the plugin renders only a summary row.
• No DOM patching or private-internals imports. Composition is exclusively through the documented Harness client APIs.

Only the latest release is supported for security fixes. Pin to the current version and upgrade when a fix is published.

The plugin observes the locally-delivered session events in the browser tab where it is installed. It does not transmit, store, or persist any of that data.