dsh-auto-approve adds an Auto permission preset to DeepSeek Harness. In that preset, routine sandbox escalations may be approved once by a classifier model; deterministic danger matches, uncertain model decisions, timeouts, malformed responses, and internal failures continue to the normal human approval dialog.
The bundle restates the permission preset table as four entries, in this order: read-only, workspace-write, auto, and danger-full-access — the auto preset is inserted between the stock presets, all of which are preserved. Outside the auto preset, the plugin delegates every approval request unchanged.
Positioning
auto is a lower-friction safety layer on top of workspace-write: it keeps the same sandbox boundary and sends routine escalations to the classifier, while danger-list matches, classifier uncertainty, and classification failures return to human approval.
Think of it as DeepSeek Harness's counterpart to Claude Code's auto mode and Codex's Auto-review mode: routine approvals are handled automatically, while dangerous or uncertain actions go back to a human.
Preset
Sandbox scope
When it prompts
Best for
read-only
Read-only workspace; project files cannot be changed
Writing, network access, or another out-of-bounds action needs escalation
Code review, exploration, and sensitive repositories
workspace-write
Workspace reads and writes are allowed; outside paths and restricted capabilities remain isolated
Network access, writes outside the workspace, or another sandbox escalation
Everyday development where a human reviews every escalation
auto
Same as workspace-write
Routine escalations are auto-approved; destructive-list matches, classifier uncertainty, or failures go to a human
Long-running tasks and dependency installs; fewer interruptions with a complete audit trail
danger-full-access
No workspace sandbox boundary; commands run with host permissions
No prompt (approval: never)
Isolated, disposable, fully trusted environments only
How it works
For each approval/request in the auto preset, the plugin:
Recovers the raw tool/call arguments from the in-memory session log.
Checks the justification and tool arguments against a deterministic danger list.
Sends the command, justification, target sandbox mode, and workspace path to the configured classifier model.
Returns allowed-once only for the exact response {"verdict":"approve"}. Every other result delegates to the next responder, normally the Web UI.
The built-in danger list covers destructive rm -rf targets, device writes and formatting, force-pushes, download-to-shell pipelines, destructive SQL, host shutdown, root-wide chmod 777, the shell fork bomb, and Terraform/Pulumi destruction. A model verdict can never override a danger-list match.
Install
DeepSeek Harness must run on a supported Node.js version. This package is pure ESM JavaScript and has no build or prepare script, so installing it from Git does not require pnpm build authorization.
From GitHub:
dsh plugin --profile web add github:Jiao-XXX/dsh-auto-approve
From a local checkout:
dsh plugin --profile web add ./dsh-auto-approve
Restart dsh web, open the Permissions selector, and choose Auto.
To remove the bundle:
dsh plugin --profile web remove dsh-auto-approve
Configuration
Field
Default
Meaning
presetName
auto
Permission preset in which the responder is active.
provider
null
null = use the default model provider configured under Settings → Models; any API is supported.
model
null
null = use the default model id configured under Settings → Models; any API is supported.
timeoutMs
8000
End-to-end classification deadline in milliseconds.
extraDangerPatterns
[]
Case-insensitive regular expressions appended to the built-in list.
dangerPatterns
null
null keeps the built-in list; an array replaces it completely.
provider and model are resolved independently for every classification, which supports three common setups:
Zero-config default: leave both as null to follow your default model. Auto works directly whether you use DeepSeek, a custom OpenAI-compatible endpoint, or any other API.
A cheaper classifier on the same API: set only model to a model id offered by your API and leave provider as null.
A completely different provider: set both provider and model explicitly.
To override the plugin row in a profile patch, restate every field because dsh patch config values are replaced rather than deep-merged:
Invalid regular expressions fail immediately while the plugin loads.
Audit
Every plugin decision writes one log line such as decision=auto-approve verdict=approve or decision=manual pattern=.... The authoritative audit ledger remains dsh's paired approval/asked and approval/decided session events.
On the target Session page, click Session log or enter /export. Inspect the downloaded ZIP with:
The two events for one approval share data.id. An automatic grant records outcome: "allowed-once".
Security considerations
This plugin reduces approval prompts; it does not prove that a command is safe. Commands and justifications are untrusted model input. The classifier prompt tells the model to treat them only as data, and strict output parsing fails closed, but prompt injection and classifier mistakes remain possible. The deterministic list is intentionally evaluated first, yet no finite regular-expression list covers every destructive spelling or indirect effect.
Use workspace-write when every escalation must receive human review. Add deployment-specific danger patterns for sensitive tools, and leave dangerPatterns: null unless you intend to replace the complete built-in protection. The classification request sends the command, justification, sandbox target, and workspace path to the resolved LLM provider; account for that in your data-handling policy.
Known limitations
The Web UI Permissions selector resolves icons from a built-in glyph table keyed by preset machine name, so host-configured presets (including auto) render without an icon. Fixing this needs an upstream DeepSeek Harness extension point; the plugin cannot patch it cleanly.
FAQ
Why is there no card for this plugin on the plugin-settings "configuration" page?
That page only renders namespaces on the host api-proxy whitelist (currently bash, agent-loop, and web-search-deepseek). The upstream docs state that plugins distributed outside the DeepSeek Harness repository cannot surface configuration cards there without host changes. This limitation applies to every third-party plugin, not just this one. Configure the plugin through the patch mechanism below instead.
Where is it on the plugin inventory page?
The inventory tab lists every Loader-tree plugin row; search for dsh-auto-approve or the entry id auto-approve. The snapshot is read once when Settings opens, so reopen Settings after installing. The page is a deliberately read-only view with no enable/disable controls.
How do I pause auto-approval temporarily?
Switch the session's permission preset back to Workspace Write. The plugin is completely inert outside the auto preset — no restart needed; this is the built-in switch.
How do I disable it entirely?
Append the following to your profile's user patch layer at $DSH_HOME/profiles/web/cordis.patch.yml (default ~/.dsh/profiles/web/) and restart dsh web, or uninstall with dsh plugin --profile web remove dsh-auto-approve:
- id: auto-approve
disabled: true
How do I change the classifier model or other settings?
The classifier follows the default model from Settings → Models, so changing that default (which has a UI) is usually enough. To pin a dedicated classifier model or change other fields, override the config in the same patch file (restate every field) and restart dsh web:
- id: auto-approve
config:
presetName: auto
provider: null
model: deepseek-chat # any model id from your API; provider null keeps the default model's provider
timeoutMs: 8000
extraDangerPatterns: []
dangerPatterns: null
Development
The test suite uses only Node's built-in test runner:
