@ramen-ai/dsh-ramen-guard

Configuration

Add the plugin to the selected profile's cordis.patch.yml, normally under ${DSH_HOME:-$HOME/.dsh}/profiles/ /cordis.patch.yml:

- insert:
    - id: dsh-ramen-guard
      name: '@ramen-ai/dsh-ramen-guard'
      config:
        apiKey: !!js process.env.RAMEN_API_KEY
        bundleIds: ['ramen__shield_core_it']
        mode: enforce

At least one non-empty bundleIds or policyIds array is required. Both may be provided. Invalid or incomplete configuration fails plugin activation rather than starting an unprotected boundary.

Enforcement mode

mode: enforce is the default and the production safety boundary. It denies a tool call when:

• ramen-ai returns a blocked verdict;
• the evaluation request fails, times out, or is cancelled;
• the response is malformed; or
• the cryptographic receipt is missing or cannot be verified locally.

Infrastructure and receipt failures deterministically return:

ramen ai execution boundary unavailable

There is no fail-open configuration.

Audit mode

Use mode: audit only when deliberately observing policy outcomes without making ramen-ai an enforcement gate:

- insert:
    - id: dsh-ramen-guard-audit
      name: '@ramen-ai/dsh-ramen-guard'
      config:
        apiKey: !!js process.env.RAMEN_API_KEY
        policyIds: ['
']
        mode: audit

Audit mode logs allowed, denied, unavailable, and unverified outcomes, then delegates to the remaining Cordis tool policy chain. Other Harness guards may still deny the call.

BYOK account compatibility

The current plugin config exposes the ramen-ai apiKey but does not expose a provider key. Accounts whose ramen-ai tier requires a BYOK provider key may receive 402 Payment Required; enforcement mode treats that response as a denial. Use a managed-inference Enterprise account for this release. Do not put provider credentials into tool arguments or source-controlled configuration.

---

Configuration

Field	Required	Default	Description
apiKey	yes	—	ramen-ai API key. Resolve from RAMEN_API_KEY with !!js.
bundleIds	one of	[]	Bundle slugs evaluated for every tool call.
policyIds	one of	[]	Explicit policy UUIDs; may be combined with bundles.
mode	no	enforce	enforce or explicit non-blocking audit.
baseUrl	no	SDK default	ramen-ai API base URL override.

The intent sent to the SDK is:

{
  "tool": "shell",
  "arguments": { "command": "rm -rf /" }
}

The SDK also receives context.tool_name for policy/audit context.

---