dsh-auto-review

DSH Auto Mode — the native security-review plugin for DeepSeek Harness (DSH).

Pre-execution rule interception + delivery-time independent subagent deep review. Security first, trust second, quality third.

A native implementation of the Codex / Claude Code auto mode idea — built for long-running agents.

Why dsh-auto-review is a good choice for long-running agents

Long-running agents accumulate trust, context and write access over hours or days — and risk accumulates with them. dsh-auto-review adds a persistent, always-on security layer that never depends on the model remembering to be careful:

• Always on by default — Auto Mode is session-scoped, enabled by default, and survives restarts (folded from official command/run events, replayable). /security auto off is the only way to disable it, and it only affects the current session.
• Orthogonal to permissions — granting danger-full-access or any other permission preset never disables content review. The permission system answers "can the agent do this?"; Auto Mode answers "should it?". Both fail closed.
• Two independent layers — local rules intercept before execution (no LLM involved, cannot be argued with); a fresh read-only subagent reviews every delivery (no confirmation bias, no shared context).
• Fail-closed by default — interception defaults to deny; high-severity findings ask "fix / ignore" and default to fix; an interrupted or unparseable review is never reported as clean.
• Zero-friction UX — one-sentence risk summaries, a green "auto" badge on the composer (status only, not clickable), plain slash commands.

How it works

Layer 1 — pre-execution rule interception

write / edit / str_replace_editor / bash / read actions are checked against local rules (secrets, dangerous commands, sensitive paths). A match raises an approval question — allow once / deny, default deny (fail-closed). Only the root agent is intercepted.