The plugin performs no network requests and has no telemetry. For each session cwd it accesses only the two same-directory filenames configured by memoryFile and instructionFile. Their defaults are .dsh-memory.md and AGENTS.md.

The final path component must not be a symbolic link. Files must be regular UTF-8 files. maxBytes bounds each complete read, replacement, and proposal rationale. Writes use the filesystem provider's create-if-absent or replace-if-version operation, so a concurrent change rejects a stale update instead of being overwritten.

AGENTS.md is workspace-authored instruction content. .dsh-memory.md is labeled as project context without instruction authority. Repository text is escaped so it cannot close the plugin-owned reminder wrapper.

Classification of feedback is model-based and can miss or misclassify a candidate. An inferred candidate is never written directly: the propose operation displays a bounded contextual diff and concise reason, while retaining the complete replacement internally, and writes only when the user selects Apply. This confirmation protects mutation, but cannot guarantee that a model will obey every recorded instruction.

Every mutation passes the calling session to DSH's sandbox-policy service, so workspace-write is resolved against that session's cwd rather than the server startup directory. A read-only session remains unable to write. If a proposal is declined, denied, or fails, the curation prompt explicitly forbids falling back to generic write, edit, or shell tools for the inferred update.

Do not include secrets, private workspace content, or session logs in a public issue. Until a dedicated private reporting address is published, open a minimal GitHub issue asking the maintainer to establish a private contact channel.