dsh-http-tools

Configuration

All options are optional. Set them in your profile's cordis.patch.yml:

- id: http-tools
  name: dsh-http-tools
  config:
    maxBodyChars: 524288   # cap on response body characters returned to the model
    timeoutMs: 10000       # per-request timeout in milliseconds
    blockedHosts: []       # hostnames the plugin refuses to contact (e.g. ['169.254.169.254'])
    localOnly: false       # true = only loopback / private-network targets
    historyLimit: 50       # in-session request history retention
    auditHeader: true      # tag every request with an X-DSH-Request audit header

Security model

• By default every URL is allowed; the request is tagged with an X-DSH-Request audit header so the server can identify agent traffic.
• blockedHosts rejects exact hostnames and their subdomains before any network I/O (e.g. block cloud metadata endpoints like 169.254.169.254).
• localOnly: true restricts requests to loopback and private networks — a one-switch "local debugging mode".
• Response bodies are capped at maxBodyChars (default 512 KB) and timeouts at timeoutMs (default 10 s) so a runaway call can never flood the model context.
• Credentials (Bearer tokens, basic-auth pairs) are sent only as request headers. Generated curl commands redact authorization, cookie, proxy-authorization, and x-api-key values as ***, so secrets do not leak into session logs or request history.