dsh-privacy-shield

Configuration

Full reference: docs/CONFIG.md. Summary:

Field	Default	Purpose
enabled	true	Master switch; false registers nothing.
mode	enforce	enforce rewrites the model-visible surface; observe counts only.
entities	26 types	Enabled entity types (see Entity types).
placeholderHash	hmac	Placeholder hash: hmac (HMAC-SHA256, local key file) / legacy (FNV-1a, enumerable).
minLevel	low	Entity sensitivity floor (high/medium/low) when entities is not set explicitly.
addressLevel	full	Chinese address granularity: full to door number / street to street only.
terms	[]	Inline term list (term, term @category, re:regex @category).
termsFile	null	Line-based word list file (relative → $DSH_HOME/shield/); hot-reloads on change.
disabledLabels	[]	Disabled term labels (mirrors terms label off).
rulesPack	null	Rules-pack file loaded at startup.
surfaces	all true	Per-surface toggles: system / developer / user / assistant / tool.
mediaPolicy	pass	Media blocks pass; text-like file contents are still masked; no image OCR.
audit.jsonl / audit.jsonlPath	true / default	JSONL audit sink (counts only).
audit.retentionDays	30	Audit retention; older lines are purged at startup.
audit.verifyOutbound	full	Plaintext re-check over outbound text: full/sample/off.
audit.maxVerifyChars	2000000	Skip the re-check above this size.
onUnmaskable	warn	block throws instead of sending a frozen request with plaintext.
registerProjections	true	Core masking switch (the derive patch); false = audit only.
registerCommand / registerTools	true	/shield command / shield_scan tool.
maxVaultEntries	5000	Vault cap (100–200000), oldest evicted first.

Removed in 0.2.0: sessionFilter — DSH's masking hooks are session-agnostic, so the shield can only operate globally; a configured sessionFilter degrades to a notice. Use /shield off for temporary exemption.