dsh-baize-rules

Configuration (Config)

On startup the plugin validates Config with @deepseek-ai/schemastery; an invalid value makes the plugin fail to load.

Config	Default	Description
scope	— (schema-required)	Default scope, used when /baize-rules doesn't specify one. Any of global/session/project — project included, resolved against the session's working directory
maxBytes	— (schema-required)	Byte cap visible to the model; trimmed with specificity-wins when exceeded
globalRulesPath	$DSH_HOME/rules/global.json	Override the global rules file path
injectAtEveryStep	false	Force re-render on every step (debugging); default only patches on change
refreshAfterSteps	20	Republish the snapshot once the last copy is this many steps old, even when nothing changed, so a long conversation never keeps the rules only at its top. 0 disables the periodic refresh
injectTags	false	When true, render tags into the model context (- [flow,release] body). Off by default: tags are a human-facing classifier, and injecting them spends budget and adds noise
apiOriginCheck	false	When true, the panel API accepts same-machine, same-origin requests only; off by default so a reverse-proxied web UI keeps working

scope and maxBytes are required by the schema, not optional with an implicit fallback. Omitting either fails the plugin load with an explicit error naming the missing field — silently defaulting an undefined scope used to hide a broken configuration.

apiOriginCheck (default false). When switched on, the panel API answers only requests that come from this machine and, when the browser states an Origin, from the host's own origin (or a local file:// page, which sends a null origin); anything else is refused with 403. It is off by default because the web UI is routinely reached through a reverse proxy, where the request arrives from the proxy's address instead of loopback and the panel would break. Turn it on when the port is reachable by others and no proxy layer authenticates the callers — the check exists because the global rule file reaches every conversation's prompt, so "anything that can reach the port" must not be enough. With the check off, authentication belongs to the transport (dsh's own token) and the proxy.

Mount metadata (cordis.patch.yml)

The published npm package ships dsh.bundle.patch, wired up automatically by dsh when you install dsh-baize-rules@: cordis.patch.yml inserts a single plugin line with default scope: session and maxBytes: 8192. To adjust the default scope / budget, change it there.

To mount by hand instead of relying on the bundle patch, insert the same row yourself — note the whole mounted-rows list is inserted into the tree, and config mirrors the Config schema: