# rolebox as a dsh profile bundle layer — configured example.
#
# This file mirrors the shipped bundle layer (dsh/cordis.patch.yml) but with a
# populated `config` block so you can see every Config option in action.
# Copy the `insert` list (or the id-targeted override) into your profile's
# cordis.patch.yml at ~/.dsh/profiles/<name>/cordis.patch.yml — the profile
# layer is applied AFTER every bundle layer, so the id-targeted form below
# overrides the bundle's default row.
#
# Contract reference: docs/dsh-plugin-contract.md §5.3 (entry shapes) and
# §5.4 (layer order). Config options are all optional; see README
# "Running as a dsh plugin" for the table.
#
# Option 1 — insert a fully-configured rolebox row (bundle-install equivalent):
- insert:
    - id: rolebox
      # Profile-relative path to the cordis host half. The row must be a
      # package root or a path-like specifier (never the `rolebox/dsh`
      # subpath) so dsh-client-modules scans it and derives the browser
      # module id `rolebox` from the package manifest.
      name: ./node_modules/rolebox/dist/entries/dsh.js
      config:
        # Override the rolebox directory (default: {dsh home}/rolebox).
        roleboxDir: /absolute/path/to/roles
        # Override the global skills directory (default: {dsh home}/skills).
        skillsDir: /absolute/path/to/skills
        # Promote this role id (directory name) to primary mode.
        defaultRole: emperor
        # Tool filter: exact tool names or namespace prefixes allow, a "!"
        # entry excludes, and "*" (or an absent/empty option) registers every
        # assembled tool. An exclusion beats an allow, so ["*", "!web"] keeps
        # everything except the colliding web namespace (contract §5.4.2).
        #
        # `web` is listed on purpose: if the host already registered
        # `web_search` / `web_fetch` in the same layer, rolebox registers its
        # own variants as `rb_web_search` / `rb_web_fetch` and logs it — the
        # automatic fallback needs no config. Excluding the namespace instead
        # (["*", "!web"], option 2b) leaves dsh's own web tools as the only
        # ones; entries match canonical names either way.
        enabledNamespaces:
          - hashline
          - web
          - graph
        # No web config keys exist: the role-switch UI surfaces as a
        # dsh.client slot plugin in the web profile, and the `/rolebox` route
        # is served by dsh's own host webserver — nothing to configure here.
      disabled: false

# NOTE (client scan resolution): dsh-client-modules only scans loader rows
# whose `name` is a package root or a path-like specifier, then derives the
# browser module id from the nearest owning package.json. Here that manifest
# is `node_modules/rolebox/package.json` (name "rolebox"), so the bundle
# envelope id is `rolebox` (scripts/build-dsh-web-client.ts). The shipped
# bundle layer uses `../dist/entries/dsh.js` because its patch file sits at
# `<pkg>/dsh/cordis.patch.yml`; a profile patch resolves against the profile
# directory instead.
#
# Option 2 — override just the bundle's default row (same id, no insert).
# Both `enabledNamespaces` shapes are shown; use ONE of them.
#
# 2a. Allow-list — exactly the listed namespaces register:
# - id: rolebox
#   config:
#     defaultRole: emperor
#     enabledNamespaces: ["graph", "loop"]
#
# 2b. Wildcard + exclusion — everything registers except the exclusions, so the
#     explicit form of the dsh global web_search / web_fetch mitigation
#     (contract §5.4.2) keeps interactive_terminal and every later tool without
#     listing them. The automatic rb_ fallback needs no config, and this
#     exclusion runs BEFORE it: rolebox's web tools are never probed, never
#     renamed, and dsh's own web tools serve alone:
# - id: rolebox
#   config:
#     defaultRole: emperor
#     enabledNamespaces: ["*", "!web"]
#
# NOTE (replace, not merge): an id-targeted override replaces the row's whole
# `config` object. The bundle's row ships no web config — the role-switch UI
# surfaces as a dsh.client slot plugin in the web profile and the `/rolebox`
# route is served by dsh's own webserver — so nothing hidden is lost by a
# config override; just re-declare the options you want to keep.