dsh-smart-approval

English | 中文

dsh-smart-approval is a fail-closed approval plugin for DeepSeek Harness. It separates access permission from automatic review: DSH continues to own Read Only, Workspace Write, and Full access, while this plugin adds an independent review selector beside Workspace Write.

New sessions use smart approval by default. Changing review mode does not change the sandbox, and changing access permission does not change review mode. Both changes apply to the next approval request without restarting DSH.

Two independent selectors

The Web composer should show two controls:

[ Workspace Write ▾ ] [ Smart approval ▾ ]

• Access: Read Only, Workspace Write, and Full access, owned by DSH.
• Automatic review: Manual approval, Smart approval, and Unattended, owned by this plugin.

Review mode	Safe request	High-risk or uncertain	Clearly malicious
Manual approval	Ask a human	Ask a human	Ask a human
Smart approval (recommended default)	Allow once	Ask a human	Reject
Unattended	Allow once	Reject	Reject

Automatic review only handles requests that already enter DSH's approval/request waterfall. It never expands the current access permission or switches a session to Full access.

Install

Requirements

• Node.js 24 or later.
• DeepSeek Harness >=0.1.0-rc.5 <0.2.0.
• pnpm on PATH; DSH forwards plugin-management operations to pnpm.

After installing the DSH CLI globally:

npm install --global @deepseek-ai/dsh@0.1.0-rc.6
dsh plugin --profile web add dsh-smart-approval@0.1.0-rc.4
dsh --profile web --dump-config
dsh web

For one-off execution:

npx @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add dsh-smart-approval@0.1.0-rc.4
npx @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config
npx @deepseek-ai/dsh@0.1.0-rc.6 web

npm dsh ... is not a valid npm command. Use dsh ... after a global install, npx @deepseek-ai/dsh ... for one-off execution, or pnpm dsh ... from a DeepSeek Harness source checkout.

DSH accepts an exact plugin version. After the stable release is published, the following form is supported:

dsh plugin --profile web add dsh-smart-approval@0.1.0

Install from a checkout or GitHub

From this repository:

dsh plugin --profile web add .

From a DeepSeek Harness source checkout:

pnpm dsh plugin --profile web add /absolute/path/to/dsh-smart-approval
pnpm dsh --profile web --dump-config
pnpm dsh --profile web

Pin a reviewed GitHub commit:

dsh plugin --profile web add github:TingRuDeng/dsh-smart-approval#<commit-sha>

Git dependencies run this package's prepare build. pnpm 10 and later block dependency build scripts by default. On first Git install, follow DSH's prompt to add the exact package name to that profile's pnpm-workspace.yaml allowBuilds, review the source, and retry. Registry packages already include built output and do not need that permission.

Verify or remove

dsh --profile web --dump-config

The result should contain the dsh-smart-approval bundle and smart-approval plugin row. The permission configuration should still contain only DSH's native Read Only, Workspace Write, and Full access choices. After Web starts, the automatic-review selector should appear separately beside access permission.

Remove the plugin with:

dsh plugin --profile web remove dsh-smart-approval

Use and switch modes

Use the independent automatic-review selector in Web, or run one of these in the current session:

/approval-mode manual
/approval-mode smart
/approval-mode unattended

/approval-mode without an argument returns the current mode. Access permission continues to use DSH's native /permission command; the two command families do not rewrite each other's state.

Sessions without an explicit selection use defaultMode, which defaults to smart. Explicit selections are stored as a Session-bound storage-domain sidecar; an unselected session continues to follow the configured default so the host decision and browser projection stay aligned after configuration changes. The plugin never appends a non-portable event to the Session log. During an upgrade from an earlier preview, legacy smart-approval/mode events are read only for one-way sidecar migration; older smart-approval and unattended permission presets migrate to smart and unattended. Migration does not modify permission events.

How it works

The plugin is an early answerer in DSH's approval/request waterfall:

1. It resolves the real tool/call event by callId. Only DSH bash and pwsh have an automatic-review contract; other tools are delegated or rejected according to the selected mode.
2. It uses only direct plain-text user messages from the current turn as authorization context. Earlier turns, assistant messages, tool output, and model-written approval reasons do not grant authority.
3. It sends only shell fields that affect execution: command, timeoutMs, workdir, run_in_background, and sandbox_permissions. Unknown fields, images, non-text content, or over-limit context fail closed without truncation.
4. Deterministic checks run before the model. Credential access, destructive commands, system changes, background work, dependency installation, publishing, remote writes, uploads, and sensitive workspace/workdir conditions are never classified as automatically safe.
5. The reviewer must return strict two-field JSON. allow means safe, human means high-risk or uncertain, and reject is reserved for clearly malicious behavior such as credential exfiltration, safety-control bypass, or an unauthorized remote write.
6. Only a valid allow becomes allowed-once. Timeouts, exceptions, malformed output, incomplete context, or a mode change during review fail closed under the active mode.

Configuration

The current session route performs review by default. To use an independent route, override the plugin row in the profile's cordis.patch.yml:

- id: smart-approval
  config:
    defaultMode: smart
    reviewerProvider: your-provider-route
    reviewerModel: your-model-id
    timeoutMs: 15000
    maxTokens: 128

reviewerProvider and reviewerModel must be configured together.

Field	Default	Purpose
defaultMode	smart	New-session mode: manual, smart, or unattended
reviewerProvider / reviewerModel	Current session route	Optional independent reviewer route; configure as a pair
timeoutMs	15000	Hard deadline for the complete review call
maxTokens	128	Maximum reviewer output
maxToolArgumentChars	12000	Tool-argument limit; overflow fails closed without truncation
maxUserMessages	4	Direct current-turn user-message limit
maxUserContextChars	8000	User-context limit; overflow fails closed without truncation

The bundle does not override the permission row, so it does not replace a profile's existing permission presets.

Model, data, and security boundaries

• Manual mode invokes no reviewer. Smart and unattended modes send the workspace root, minimized shell fields, and direct current-turn user text to the review provider.
• Reusing the current session model is convenient but is not an independent security review. Sensitive deployments should use a separate controlled provider route.
• Only requests that already enter DSH's approval channel can be reviewed. Network or remote actions that do not trigger approval are outside this plugin's control.
• Model classification is not a security proof. Unknown tools, arguments, background execution, and non-text or incomplete context fail closed: smart mode asks a human and unattended mode rejects.
• Every automatic approval is one-time. The plugin stores no directory allowlist or permanent grant.
• Logs contain tool name, outcome, and short reason code, not full prompts, arguments, credentials, or model reasoning.
• Smart fallback and manual mode require another Web, ACP, or custom human answerer. Without one, DSH remains fail-closed.
• DSH currently has one workspace-write root. A one-time Full access approval still has broad filesystem authority; this plugin does not turn it into a multi-root sandbox.

Repository map for maintainers and agents

Path	Responsibility
src/index.ts	Service injection, legacy migration, projection, command, and lifecycle
src/review-mode.ts	Legacy-event migration, command lifecycle fold, and browser projection
src/review-mode-storage.ts	Session-lifecycle-bound automatic-review mode sidecar
src/client/	Web selector and browser-plugin registration
src/approval-handler.ts	Three-mode routing, waterfall decisions, and post-review mode recheck
src/review-context.ts	Current-call and current-turn context extraction/minimization
src/review-policy.ts	Deterministic fail-closed prechecks
src/llm-reviewer.ts	Reviewer prompt, stream parser, strict verdict protocol, and timeout
cordis.patch.yml	Host-plugin mount only; it does not override permission presets
tests/	Host, policy, protocol, migration, projection, and browser contracts

Invariants: permission and review mode never rewrite each other; missing or ambiguous evidence never becomes an automatic allow; only direct user text from the same turn can grant authority; only strict allow returns allowed-once; manual mode inspects no request content and calls no model; and a mode change during review invalidates the original automatic allow.

Development

pnpm install
pnpm test
pnpm run typecheck
pnpm run build
pnpm pack --dry-run

The supported DSH range is >=0.1.0-rc.5 <0.2.0. Real-provider end-to-end review and human-fallback interaction still require deployment credentials and environment-specific acceptance testing.

License

MIT