dsh-mask

Configuration

All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need. cordis.patch.yml documents each key inline.

Key	Default	Meaning
enabled	true	Master switch; false unregisters the listener, the /mask command, and the mask_test tool
mode	regex	Detection mode; only regex is implemented (regex+ner for name/address recognition is reserved and fails loud)
entities	[phone, email, id-card, bank-card, key]	Which PII types to mask; ip is also regex-capable (opt-in), person/address require NER
scope	[messages]	Masking surface(s); messages masks agent/pre-step messages, tools masks tool-result text on tools/post-execute. Accepts a string or an array, e.g. [messages, tools]
registerCommand	true	Register the /mask command
registerTools	true	Register the mask_test tool when the tools service is present
persistRestoreTable	true	Persist the restore table to the controlled dsh_mask storage domain (false = memory only)
maxRestoreEntriesPerSession	500	Per-session restore entry cap (oldest evicted first)
maxSessions	1000	In-memory session cap (least-recently-used evicted, mapping reloaded on demand)
maskClientEnabled	false	Feature flag for the browser half "reveal" bubble (defensive; off by default until the live slot catalog verifies the target slot). The key is schema-declared and validated, but no runtime code reads it yet, so it changes nothing until the browser half ships

Example override in your profile patch:

- insert:
    - id: mask
      name: dsh-mask
      config:
        entities: [phone, email, id-card, bank-card, key, ip]
        persistRestoreTable: false
        registerCommand: true