DNAlec/dsh-auto-approve

dsh-auto-approve

English | 中文

A DeepSeek Harness plugin that auto-approves or rejects tool calls with keywords and a judge model that returns a category plus a risk level. Every category has three cells (low / medium / high), all yours to configure. Uncertainty goes to the original Web approval dialog.

Install

dsh plugin --profile web add github:DNAlec/dsh-auto-approve

Or from npm, after a tagged release:

dsh plugin --profile web add @dnalec/dsh-auto-approve

To pin a reproducible version, append #vX.Y.Z (the tag must match package.json, which the publish workflow checks).

Restart dsh web. The first start adds the Auto-approve permission preset to the current profile's cordis.patch.yml; if that write fails, the log line names the file and the reason.

Setup

Settings → Auto-approve. Each control on the page carries one line of hint; the rules live here:

1. Auto-approve mode — in-workspace writes skip approval (workspace-write, recommended), or send them through the judge (read-only). Clicking a mode writes it; restart dsh web, then re-select Auto-approve or start a new session.
2. Keywords — three buckets: reject / human / allow. They match the tool name, command, path, and working directory, plus the values of custom-tool (MCP and friends) arguments with unrecognized names; they never see written contents, code bodies, or numeric/boolean switches ({content:"rm -rf /"}, {recursive:true} are judged by the model only). Reject/human words also match the tool name; allow words match neither the tool name nor the session directory, so bash/write is never allowed as a class.
3. Criteria table — a row is an English id + a description (state when to pick this id) + three cells (low/medium/high → action). The judge sees only the id and the description; the plugin runs the action in the (row, level) cell. other cannot be deleted, but its description and cells are editable. The id is what the approval history shows.
4. Risk levels — all three descriptions go into the prompt. When the level is unreadable (default high) also decides which cell of that row runs, so it decides the outcome: a high fallback rejects such calls, medium asks a human, low allows them.
5. Judge model — model, reasoning effort, judge timeout, the judge request limit, the output budget (tokens), and whether a call that is over the limit / hit the collection guard goes to a human or is rejected (arguments not captured are always rejected; not configurable — see “How it works”). The same card holds the judge prompt: {{criteria}} inserts the criteria table and {{levels}} the level descriptions; a missing placeholder appends that block. It is editable, and restoring writes the shipped template of the language you pick and switches the language to it. The output budget (judge.maxTokens, default 8192, range 256-32768) caps how much the judge may write on its first attempt (reasoning tokens share that cap with the answer). A small cap breaks judgments: the model thinks by default, and locally it spent 3.7k-8.3k characters (≈2-5k tokens) on reasoning per call, so the old 1024 cap was always eaten by reasoning → empty answer → the plugin retried with a bigger budget, i.e. every judgment paid a wasted model call (double latency, tighter against the 20s timeout); the 2026-09-14 “every judgment goes to a human” outage was this chain at its extreme (the retry then was only 2048 and got eaten too). maxTokens is a cap, not a reservation — a model that does not think stops when done, so a generous value costs no extra time and only removes that doomed first call. It applies to routes that may reason (no effort configured but the route reports reasoning still counts); routes without reasoning stay at 256. The scene is visible in Test judgment and in the audit log.
6. Model-initiated human review (off by default) — when on, auto-rejections carry their reason and the model may escalate one operation to a human. The tool name is editable (restart to rename) and the notice language is Chinese or English. Enabling it turns the approval dialog into a channel the model can wake you through — including while it is being driven by untrusted content.
7. Set the session permission to Auto-approve.