hook-dsh-normalize-invisible

Family position (the @-sentence Hook @ DSH @ Normalize @ Invisible): a hook child of the plugin-dsh-factory service and the hook-dsh-core machinery; the fifth of the six stream normalizer siblings:

A non-manifest factory consumer: it injects ["pluginFactory"] and uses only State (cell unwrap + shared Ledger/Enabled mappings + its own fields) and Append; the config is composed by the factory's standalone Schema helper with shared: false - the minimal block, no fs/observed dead fields. It touches no files, so fs/write-intent and fs/observed never see it; it wraps the downstream result and always calls next(), so it composes with other llm/stream listeners regardless of registration order.

Zero-width and format characters carry no visible width - which makes them the perfect smugglers. A zero-width joiner inside a file path, a right-to-left mark inside a command, the U+202E visual-spoofing override in what looks like plain text: none of them show up in the transcript, all of them change what a parser, shell or diff sees. This flavor deletes the whole family before it reaches the transcript.

The transform - the core's Invisible class, applied per text segment through the core's generic class-to-string Replace:

All are removed (default replacement: "" - REMOVAL) per text segment:

No context rules, chunk-boundary-safe - single-character replacement, no lookahead, per-chunk application can never disagree with whole-text application. The replacement is applied with a function replacer, so a custom replacement containing $ patterns is inserted literally. Replaced characters are counted per stream for the ledger line.

Volatile cells commit without remounting the plugin; the factory's State builder unwraps them defensively. Example cordis.patch.yml row:

One stream, one deletion. The model emits text carrying invisible smugglers; the live UI and the transcript receive clean text - and the two lines below look identical in print, because the removed characters are invisible. The incoming line carries, in order: a soft hyphen (U+00AD), a zero-width space (U+200B), a zero-width joiner (U+200D), a left-to-right mark (U+200E), a right-to-left mark (U+200F), a word joiner (U+2060) and a BOM character (U+FEFF):

Before → after - identical in print, different to a parser

In the incoming line the smugglers sit inside the word password and around the colon; a diff would see a password that does not match the author's text, a parser would tokenize differently, a shell could splice a command. After the pass all of them are simply gone - the output line is what the reader should see. When a stream finishes normally with replacements made, the ledger gets the count line shown below. The replacement is hot-editable (the default "" removes; a non-empty value such as "?" would mark each smuggler's position for debugging), and the same pass runs over reasoning deltas when normalizeReasoning is on and over tool-call arguments when the example patch enables normalizeToolArguments - with the edit name exempt and raw-marker calls passing through unnormalized.

Two lines, both written through the factory's Append (the hook-dsh-normalize-invisible: prefix is the logger's <State.Module>:; the durable file line is [<ISO>] <message>). The empty default replacement renders as the empty replacement=:

The activation line is written by apply(); the count line only follows a normal stream completion and only when N > 0 (a thrown-away stream writes no ledger line).

License: MIT.