dsh-audit-log

Usage

Query the audit trail from any plugin:

const records = await ctx.auditLog.query({
  events: ['message/send'],
  mutationsOnly: true,   // only dispatches that changed something
  fromSeq: 100,
  limit: 50,
})

// Each mutation carries exact attribution (when attribute_by_window is on):
//   { listenerIndex, package, fiber, confidence: 'window' }
const culprit = records[0].mutations[0].attribution?.package

// Raw per-listener windows:
const windows = ctx.auditLog.queryWindows({ event: 'message/send' })

Record shape

{
  "v": 1, "ts": "2026-08-19T08:00:00.000Z", "seq": 42,
  "mode": "waterfall", "event": "message/send",
  "listeners": [{ "order": 0, "package": "my-plugin", "fiber": 3 }],
  "before": [ { "type": "object", "keys": ["content"] } ],
  "after":  [ { "type": "object", "keys": ["content"] } ],
  "mutations": [{
    "argIndex": 0, "path": "arg[0].content",
    "kind": "replace", "beforeLength": 56, "afterLength": 36,
    "attribution": { "listenerIndex": 1, "package": "spam-filter", "fiber": 7, "confidence": "window" }
  }]
}

Configuration

Via the profile patch layer (cordis.patch.yml), or $DSH_HOME/settings.yaml namespace audit-log:

Field	Default	Meaning
enabled	true	Global switch
capacity	10000	Ring-buffer size (oldest dropped first)
mutations_only	false	Only keep dispatches that mutated something
attribute_by_window	true	Per-listener attribution (wrap listeners)
package_allowlist	[]	Regex sources; empty audits all packages
package_blocklist	[]	Regex sources; excludes after allowlist
events	[]	Exact event names to audit; empty audits all
event_allowlist	[]	Regex sources for event names

- id: audit-log
  config:
    events: ["message/send", "before/*"]
    package_blocklist: ["my-noisy-plugin"]