dsh-process-guard

Configuration

Defaults are the safe ones; the shipped cordis.patch.yml deliberately sets no config: block. Override keys by copying the row into your own profile cordis.patch.yml (see examples/override.cordis.patch.yml):

- id: process-guard
  name: dsh-process-guard
  config:
    mode: ask                 # 'deny' (default) routes through ctx.tools.guard()
    additionalTools: [remote_shell]
    additionalProtectedImages: [custombrowser]
    safeFilterAllows: false   # default: require a PID or owned process handle
    announce: true            # add the system-prompt section
    enabled: true

Key	Default	Meaning
enabled	true	Set false to disable inspection entirely.
tools	common shell tool names	Replacement list of tools whose command argument is inspected.
additionalTools	[]	Tool names added to the default list.
protectedImages	cross-platform browsers + harness/terminal hosts	Replacement list of images that must never be killed by name.
additionalProtectedImages	[]	Image names added to the built-in protected list.
mode	deny	deny blocks the call; ask sends it to the approval prompt instead.
safeFilterAllows	false	Opt into the positive CommandLine -like/-match '*--headless*' or --user-data-dir exception. Negated or -or filters remain blocked.
announce	true	Contribute the system-prompt section.

Use additionalTools and additionalProtectedImages for normal extension; tools and protectedImages intentionally replace their defaults. Unknown keys, mistyped booleans, invalid array entries, and empty safety lists are reported and fall back to safe values, so a typo cannot quietly weaken the guard.

mode: deny is enforced through ctx.tools.guard(), which is monotonic — no other guard can force-allow a call this one denied. mode: ask registers a tools/pre-execute listener instead and lets you decide, with the reason shown.