Configuration

Via $DSH_HOME/settings.yaml (default ~/.dsh/settings.yaml), hot-reloaded:

auto-approval:
  enabled: true
  denyPatterns:
    - 'rm\s+(-[a-z]*[fr][a-z]*\s+)*/\s*$'
    - 'curl\s+[^|]*\|\s*(ba)?sh'
  askPatterns:   # kept for config compatibility; hits now deny (fully autonomous)
    - 'sudo\s'
    - 'git\s+push\s+--force'
  autoApproveTools: [read, grep, find]
  # Enable L1 (omit to disable — L0 unmatched calls are then allowed)
  # classifierFastProvider: deepseek
  # classifierFastModel: deepseek-chat
  # classifierDeepProvider: deepseek   # defaults to fast
  # classifierDeepModel: deepseek-reasoner

Key	Default	Description
`enabled`	`true`	master switch
`denyPatterns`	see `src/config.ts`	regexes, matched ⇒ deny (hard rule)
`askPatterns`	see `src/config.ts`	regexes, matched ⇒ deny (formerly ask; kept for config compatibility)
`autoApproveTools`	read-only tools + file-write tools (`write`/`edit`/`str_replace_editor`)	tool-name whitelist, bypasses all checks. File writes have independent review (code review + sandbox boundary); the main audit target is bash / run_code
`bashCommandPrefixes`	empty	bash prefix whitelist (`ls`/`cat` both go through the bash tool, which the tool-name whitelist can't exempt — this is the only L1 bypass for read-only shell commands)
`selfKillGuard`	`true`	self-kill guard, see above
`auditSessionEvents`	`false`	whether to write session events. Keep off: since 08-12 final, sessions fail-closed on undeclared event types — enabling this makes sessions unopenable after restart
`classifierFastProvider` / `classifierFastModel`	unset	L1 fast model route (must be paired; setting enables L1)
`classifierDeepProvider` / `classifierDeepModel`	unset	L1 deep model route (paired; defaults to fast)
`classifierTimeoutMs`	`20000`	per-call L1 timeout, fail-closed ⇒ deny
`classifierGuidance`	unset	custom judgment guidance (advisory, not hard rules)

dsh-auto-approval

AI 分析

インストール

ドキュメント

Configuration