Configuration

Override the bundle row in the profile's cordis.patch.yml and restate its complete config:

- id: dsh-office-cli
  config:
    approval: writes       # writes | all | off
    timeoutMs: 120000
    killGraceMs: 2000
    maxOutputBytes: 262144
    maxArgs: 128
    maxArgLength: 65536
    allowRawApi: false
    workspaceFilesOnly: true
    # wecomCommand: /opt/bin/wecom-cli
    # dingtalkCommand: /opt/bin/dws
    # feishuCommand: /opt/bin/lark-cli

workspaceFilesOnly is argument-level defense, not an OS sandbox. Use a dedicated container/account and least-privilege vendor apps for high-security deployments. See SECURITY.md.

dsh-office-cli

安装

说明文档

Configuration