xmwpoi/dsh-approval-center

dsh-approval-center is a Windows-only approval console plugin built specifically for the DeepSeek Harness (DSH) agent, currently shipped as the v0.3.1-rc.1 pre-release and pinned to host DSH 0.1.7-rc.2. It hooks the approval/request cordis waterfall with { prepend: true }, surfaces high-risk tool calls as actionable toast notifications carrying dshapproval:approve/<id> URIs, and adds parallel approval handling, withdraw/cleanup on uninstall, a SQLite audit database, and opt-in subagent start/end notifications. Distribution is GitHub Releases only (a built .tgz plus SHA256SUMS.txt); users add it with dsh plugin --profile web add <url-or-path> or paste the same URL into the Web sidebar, and the bundle auto-applies its cordis patch — adding another insert by hand mounts the listener twice.

A typical round trip looks like this: the DSH tool fires an approval request, the plugin (registered before dsh-api-remotes) claims it, and scripts/approval-toast.ps1 pushes a Windows reminder toast that stays on screen until the user taps Approve or Reject. The button URI is resolved by an HKCU-registered dshapproval: handler — a VBS main processor on wscript.exe with a PowerShell fallback — which writes the decision to a state file that the polling script then relays back to the harness, mapping to exit codes 0 (allowed-once), 1 (rejected), 2 (timeout), and 3/4 (unavailable). Auditing and result receipts are kept separate from the pending-approval group so cleanup never wipes receipts, and all warnings go to host stderr rather than the Web GUI.

Runtime requirements are Windows 11 with a working notification center, Node.js ≥ 24 (so node:sqlite needs no flag), pnpm on PATH for the DSH CLI, plus PowerShell 5.1 and a working VBScript/wscript as the notification and URI processors; on non-Windows hosts apply() throws and the entry is marked inactive while the rest of the plugin tree keeps running. Defaults are fail-closed (timeoutAction: reject), so faults and timeouts never auto-approve unless the user explicitly sets approve. Known limits include no WinRT Dismissed detection for unpackaged apps (the toast only clears on timeout, capped by ExpirationTime), a narrow window where a killed host can leave a zombie notification, silent drops if tools patterns use invented prefixes like fs* instead of the real write/edit names from dsh-tool-fs, and dependency on pnpm-workspace.yaml rather than .npmrc to keep @deepseek-ai/dsh out of node_modules. Verified scope is 98/98 unit tests plus 21/21 host integration on remote Windows CI; full real subagent sessions, 20-way batches, and production rollback have not yet been validated. License is MIT, with packages delivered exclusively through GitHub Releases and never published to npm.