# dsh bundle patch: inserts this plugin's loader entry into a profile layer.
# Bundle patches add rows via `insert` blocks; top-level rows would be treated
# as id-targeted overrides of EXISTING entries ("entry not found" otherwise).
#
# The plugin is strictly READ-ONLY: it inspects configuration, session files,
# plugin sources, paths, network bindings and environment variables, and
# never writes, deletes or executes anything. (The only write path is the
# opt-in `logFile` audit log below — an append-only JSONL file you configure.)

- insert:
    - id: secure-audit
      name: 'dsh-secure-audit'

# All plugin config keys are optional; defaults are applied by the plugin.
#   config:
#     scanTimeoutMs: 100        # cooperative scan budget (ms); on expiry the decision follows onTimeout
#     onTimeout: allow          # policy on budget expiry: allow (fail-open) / review / block (fail-closed)
#     scanMaxLength: 200000     # hard cap on scanned text length
#     cacheSize: 512            # LRU entries for identical scan inputs
#     blockThreshold: 0.8
#     reviewThreshold: 0.5
#     allowlist: []             # rule ids always downgraded to "allow" (appeal channel)
#     maskChar: "*"
#     logEnabled: true          # set false to silence the structured JSONL event log
#     logFile: ""               # empty = structured JSON lines go to ctx.logger
#     supplyChainLive: false    # opt-in: security_audit queries registry.npmjs.org advisories
#                               # (sends installed plugin names+versions; offline inventory is default)
#     supplyChainTimeoutMs: 3000
#     classifier:               # optional model layer (see README)
#       adapter: ollama
#       endpoint: http://localhost:11434/api/generate
#       model: llama3-guard
#       timeoutMs: 1500