dsh-permission-rules

Configuration

All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need. On a 0.1.7-alpha host every field is declared .volatile(), so it is ALSO editable in place from the Plugins settings page: the edit is committed into the running references without remounting the plugin, the runtime reads the new value on its next use, and a change to network.proxyPort, proxyBind, injectEnv or noProxy rebinds the local proxy immediately. The numeric bounds live in the schema, and the config editor resolves the merged config against that schema before persisting, so an out-of-range value is refused at write time. On a host whose Schemastery predates volatile() these fields stay cordis.yml-only.

Key	Default	Meaning
rulesFile	.dsh/rules.yaml	Rule file location; relative = resolved against the calling session's cwd, absolute = global and validated at mount
fallbackPath	(none)	Rule file used when per-cwd discovery finds nothing; validated at mount
badFilePolicy	fail	Bad rule file: fail errors the pending tool call loudly; ignore-with-warning warns and continues empty
maxRules	256	Hard cap on rule count across the effective source chain
maxCachedWorkspaces	512	Hard cap on cached per-workspace rule loads (LRU eviction)
patternMode	glob	params/paths/when.env pattern flavor: glob or regex (tool names are always globs)
watch	true	Chokidar watch + reload on change
watchStabilityThresholdMs	200	Reload debounce window (ms)
language	en	/rules output language: en, zh, es, pt, hi
caseInsensitivePaths	(win32)	paths patterns and workspace-root comparison ignore ASCII case; true on Windows
audit	all	Audit granularity: all logs every hit AND passthrough; hits skips passthrough events
searchUp	false	Walk parent directories from the session cwd and merge every found rule file, nearest first
maxGlobStars	2	Hard cap on unbounded */** quantifiers per glob pattern
enforce	true	false = dry-run mode: deny/ask hits are audit-logged with a dryRun marker and every call passes through
allowUnmarkedAudit	false	Pre-marker hosts drop the ignorable marker; the plugin disables session-log audit with a warning. Set true to opt back in
network.enabled	true	Master switch for the proxy, env injection, and web-tool mode defaults
network.mode	auto	Policy mode: auto follows the sandbox preset, or deny-all / whitelist / allow-all
network.autoFallback	allow-all	Mode used when auto has no sandbox-policy service
network.unlisted	ask	Whitelist-mode handling of targets no rule matched: ask or deny
network.proxyBind	127.0.0.1	Local proxy bind address (loopback only)
network.proxyPort	0	Local proxy port; 0 picks a free ephemeral port
network.proxyMaxRecent	100	Cap on recent-block records kept for the settings page
network.loopback	allow	Loopback targets: allow (Codex parity) or policy
network.injectEnv	true	Whether proxy environment variables are injected for subprocesses
network.noProxy	clear	Subprocess NO_PROXY handling: clear enforces the policy or preserve
network.upstreamProxy	off	Upstream proxy for connections this plugin ALLOWS: off dials directly, inherit reuses the launch environment's proxy names, or an explicit http(s):// proxy URL
network.allowHostAction	true	Settings-page per-block "allow this host" action: false hides the Allow button and makes the permissionRules/allowHost RPC refuse (the rule editor is not affected)
builtin.enabled	true	Built-in high-risk baseline: false disables the shipped deny/ask ruleset entirely
builtin.path	(shipped)	Replacement baseline file (absolute, or relative to process.cwd()); validated at mount