Configuration

Field	Default	Purpose
`enabled`	`true`	Register the tool and policy hooks.
`injectionAction`	`sanitize`	`monitor`, `sanitize`, or `block` suspicious output. Dangerous and truncated output still fails closed.
`suspiciousThreshold`	`30`	Score that produces a suspicious verdict.
`dangerousThreshold`	`70`	Score that produces a dangerous verdict.
`maxScanChars`	`250000`	Maximum UTF-16 code units inspected per string.
`maxJsonDepth`	`256`	Maximum canonical tool-result nesting depth; exceeding it fails closed.
`maxJsonNodes`	`100000`	Maximum canonical JSON values inspected per tool result; exceeding it fails closed.
`inspectToolOutputs`	`true`	Inspect post-execution output automatically.
`trustedTools`	`promptwall_scan`	Exact tool names exempt from automatic reinspection.
`egressAction`	`ask`	`off`, `ask`, or `deny` for secret-like egress arguments.
`egressToolPatterns`	common network names	Case-insensitive patterns identifying egress-capable tools.
`rules`	`[]`	Additional deterministic injection rules.
`secretPatterns`	`[]`	Additional credential patterns.

The complete default composition is in cordis.patch.yml. Custom rules are JavaScript regular-expression sources and should be reviewed like code.

dsh-promptwall