@dsh-external/dsh-llm-approver

Usage

1. Open the web GUI and select the session you want to protect.

2. Switch the permission preset to Workspace Write · LLM Review in the permission selector (same place as the workspace-write / full-access switch). The default preset stays workspace-write until you switch.

3. Work as usual. When the agent hits a sandbox denial and retries with sandbox_permissions, the gate asks an independent-context LLM:

   • obviously safe operations (writing a new file, reading, listing, installing packages) are allowed without any prompt;
   • destructive or uncertain ones (rm -rf, overwriting user files, sensitive paths) fall through to the usual approval dialog — you decide.

Quick manual check:

请用 bash 工具创建文件 ~/llm-review-verify.txt，内容为 "review-ok"。
该路径在会话工作区之外，若被拒绝请按提示用 sandbox_permissions 重试。直接执行，不要询问我。

No dialog should appear and the file should exist afterwards. Then ask for rm -rf ~/llm-review-verify.txt — a dialog should appear instead.

Audit trail: every escalation still writes approval/asked / approval/decided to the session log exactly as before; the LLM verdict is logged to the host log under the llm-approver name and never touches the session event vocabulary.

Configuration

Override in the profile cordis.patch.yml (row id llm-approver):

Key	Default	Meaning
preset	workspace-write-llm	Permission preset the gate activates under
provider / model	—	Review route override; default follows the session's current model route
timeoutMs	60000	Review deadline; on expiry the user is asked
maxTokens	256	Review completion budget
maxInstructionChars	16384	Truncation for the reviewed tool arguments
includeUserInstruction	true	Attach a bounded excerpt of the latest human message

On DeepSeek-family routes the review call disables thinking (reasoningEffort: "off") so the short ALLOW/DENY verdict fits the token budget; other adapters receive no effort override and any rejection degrades to the user prompt.