dsh-approval-llm

Configuration

All fields are validated by the Loader schema; defaults apply when omitted.

Field	Default	Meaning
enabled	true	Master switch; when false every request is delegated unchanged.
modePreset	model-approval	The permission preset that activates the reviewer. When set, the plugin only answers asks from sessions whose effective preset equals this name; every other session delegates to the human channel. Set to '' to review every ask.
provider / model	unset	Explicit reviewer route. Must be set together; when unset the plugin reuses the conversation route from the last request/header in the session log, and fails to human when the log has none.
timeoutMs	60000	End-to-end reviewer deadline; on expiry the request is handed to a human (TIMEOUT, not counted in the breaker).
maxOutputTokens	256	Reviewer output cap.
systemPrompt	built-in policy	Custom security policy for the reviewer. The built-in policy is a short allow-by-default, deny-on-critical-harm rule set; see src/reviewer.ts.
allowlist	[]	Tool names auto-approved without a model call (SAFE_ALLOW).
denyList	[]	Tool names rejected outright without a model call. Wins over the allowlist.
humanOnlyList	[]	Tool names that must be decided by a human; never auto-reviewed.
maxConsecutiveDenials	3	Consecutive DENY threshold per session before the reviewer hands off to a human; 0 disables the breaker. ALLOW resets the counter.
maxArgsChars	4000	Cap on tool-argument JSON rendered to the reviewer.
includeArgs	true	Recover tool arguments from the session log for the review.
notifyUser	true	Append a user-visible decision message (✅ 模型审批通过/❌ 模型审批拒绝 with the risk and reason) to the session after every model ALLOW/DENY, so the main chain records why.

Example overlay (cordis.patch.yml of your profile):

- id: approval-llm
  config:
    provider: deepseek-official
    model: deepseek-v4-flash
    allowlist: [read, read_image, glob, grep]
    humanOnlyList: [delete, terminal_send]
    denyList: [job_kill]
    maxConsecutiveDenials: 3