PAKIKNOWLEDGE/dsh-auto-classifier ↗★ 0
dsh-auto-classifier
Autonomous (auto) mode permission classifier for DeepSeek Harness: a Claude-Code-auto-mode-like classifier over tools/pre-execute and approval/request, a selectable 'auto' permission preset, LLM semantic judge, git checkpointing, agent discipline guidance, and a web control page in Settings → Plugins.
AI Analysis
适合需要为 DSH 引入自主运行模式、精细化权限控制、自动审批决策以及 Git 状态回滚的安全管理与自动化任务。
Install
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:PAKIKNOWLEDGE/dsh-auto-classifierREADME
Read the full README ↗Configuration (auto-classifier row in cordis.patch.yml)
| Key | Default | Meaning |
|---|---|---|
presetName | auto | The permission preset under which the classifier is authoritative |
defaultDecision | allow | Decision when no rule matches and no judge (deny = fail closed) |
llmJudge | false | Enable the model semantic judge (one call per unmatched operation) |
judgeProvider / judgeBaseURL / judgeApiKey / judgeModel | empty | Explicit judge credentials (since v0.1.14), set in the web control page. When a non-empty API key + model + base URL are present, the judge calls that provider directly over HTTPS (OpenAI-compatible /chat/completions, or Anthropic /messages when the provider/base URL is Anthropic) with zero dependency on the harness llm registry or its config-file credentials. Empty judgeApiKey falls back to llmProvider/llmModel below. |
llmProvider / llmModel | deepseek-official / deepseek-v4-flash | Judge model via the harness llm service (fallback when no direct credentials are set) |
judgeStages | both | both = fast filter + thinking re-review on flag; fast / thinking = single stage |
denyMessage | Kafka doorkeeper copy | Fixed text appended to classifier denials (explains the sandbox_permissions channel does not apply); empty to disable |
hardDenyMessage | hard-boundary note | Extra sentence appended when a deny RULE (HARD) blocked the call — suggests running the step outside auto mode |
judgeMaxUserMessages / judgeUserMessageChars | 3 / 400 | How many recent user messages (truncated) the judge sees as intent evidence |
judgeToolHistory | 6 | How many recent tool calls (name + target, stripped) the judge sees for session context |
judgeFastMaxTokens / judgeThinkingTimeoutMs | 8 / 30000 | Stage-1 output cap and stage-2 abort timeout |
scanWriteContent / writeContentScanChars | false / 2000 | When on, judge write/edit payloads that carry a deny-pattern hit (content truncated to this many chars) |
bypassWindow | 5 | How many recent denials participate in suspectedBypass matching |
pwshStrict | true | Unmatched command-tool calls go to the judge / strict default (more conservative than path tools, mirroring Claude Code's default for PowerShell) |
denyPatterns / allowPatterns | built-in | Tool(pattern) regex arrays, override or extend |
denialLimitConsecutive / denialLimitTotal | 3 / 20 | Denial caps, hard-stop hint past them |
gitSnapshotOnAllow | true | Snapshot the git worktree before allowing an escalation |
gitSnapshotIntervalMs | 30000 | Per-session snapshot interval floor |