dsh-audit-trail

Configuration

All fields optional. Defaults shown.

interface AuditConfig {
  storage: {
    /** null => /audit-trail/audit.sqlite
     *  dshHome = $DSH_HOME || ~/.dsh; AUDITRAIL_DB overrides for the CLI */
    path: string | null;
  };
  redact: {
    /** Mask known secret patterns before storing (default true). */
    maskSecrets: boolean;
    /** Tool-argument digest cap in chars.            */ truncateArgs: number;   // 512
    /** Summary cap in chars.                         */ truncateSummary: number; // 240
    /** Detail JSON cap in chars.                     */ truncateDetail: number;  // 4096
    /** Max file paths captured per record.           */ maxFiles: number;        // 16
    /** Max outbound destinations captured per record.*/ maxNetwork: number;      // 16
    /** Extra secret regex patterns (regex source).   */ extraSecretPatterns: string[];
  };
  rules: {
    /** Built-in rule ids to disable, e.g. ["net:plaintext-http"]. */
    disabledIds: string[];
    /** Operator rules added to (not replacing) the default table. */
    custom: Array;
  };
  capture: {
    chunks: boolean;        // false — record assistant_chunk per token?
    turnEvents: boolean;    // true
    stepEvents: boolean;    // true
    toolDispatch: boolean;  // true — record live tool_dispatch rows
    toolRegistered: boolean;// true — record tools/change deltas
  };
}

Example (cordis.patch.yml override):

- insert:
  - id: audit-trail
    name: 'dsh-audit-trail'
    config:
      storage:
        path: '/srv/audit/audit.sqlite'
      redact:
        truncateArgs: 256
        extraSecretPatterns:
          - '\\bCUSTOM_SECRET_[A-Z0-9]{20,}\\b'
      rules:
        disabledIds:
          - 'net:plaintext-http'
        custom:
          - id: 'my:purge'
            severity: 'critical'
            pattern: '\\bpurgelogs\\b'
            scope: 'args'
      capture:
        chunks: false

---