dsh-risk-guard

Usage

/risk-guard              operation bill for the current session
/risk-guard --turn       only the last turn
/risk-guard --all        summary + bills for every recorded session
/risk-guard --json       machine-readable output

The bill shows the time range, call count, turn count, high-risk count, fuse blocks, max/total scores, tag distribution, the risky calls table, and every fuse denial.

Configuration

Plugin config lives in the profile's cordis.patch.yml:

- insert:
    - id: risk-guard
      name: 'dsh-risk-guard'
      config:
        fuseEnabled: true
        maxFileSizeMb: 50
        workspaceRoot: 'C:/projects/my-app'
        homeDir: 'C:/Users/me'
        dshHome: 'C:/Users/me/.dsh'
        protectedBranches: ['main', 'master']
        protectedRemotes: []
        credentialFileNames: ['.env', 'credentials', 'id_rsa']

Field	Default	Meaning
fuseEnabled	true	master switch for fuse blocking
maxFileSizeMb	50	month JSONL rolls into a gzip archive above this size
workspaceRoot	unset	used to detect writes outside the workspace
homeDir	OS home	home used by path rules and ~ expansion
dshHome	~/.dsh or $DSH_HOME	audit store lives at /risk-guard
protectedBranches	['main','master']	force-push to these branches is blocked
protectedRemotes	[]	force-push to these remotes is blocked
credentialFileNames	common list	.env, credentials, id_rsa, …