# Example bundle patch for dsh-blast-radius.
#
# Install into a profile with:
#   dsh plugin --profile web add dsh-blast-radius
#
# Report-only by default: findings are recorded and logged, and no write is
# ever refused. Turn `enforce` on once the analysis has proved itself on your
# codebase — see README for why that order matters.

plugins:
- id: blast-radius
  config:
    # Defaults to the workspace root dsh booted in.
    projectRoot: ''

    # Ask before a risky write instead of only reporting it.
    enforce: false
    # Which risk level triggers the prompt: medium | high
    enforceAtRisk: high

    # Per-query budget for the analyzer. Exceeding it degrades to "unanalyzed"
    # and the write proceeds — analysis never blocks the agent.
    timeoutMs: 3000

    # Production call sites above which an edit is high risk even with tests.
    highProductionRefs: 12

    # Extra regexes for paths that are test code (built-ins already cover
    # *.test.*, *.spec.*, test/, tests/, __tests__/).
    testPatterns: []
    #  - '(^|/)e2e/'

    # Cap on files scanned when the project has no tsconfig.json. Reaching it
    # is reported, because findings are then partial.
    maxProjectFiles: 2000

    # Log one line per analyzed edit; useful while tuning thresholds.
    verbose: false