dsh-auto-approver

Configuration

Override in your profile patch (cordis.patch.yml):

- id: dsh-auto-approver
  name: 'dsh-auto-approver'
  config:
    mode: 'hermes'           # allow-all | allowlist | hermes | off (default: allow-all)
    allowlist: []            # tools auto-approved (rule layer; hermes mode: direct pass)
    denyAlways: []           # tools always rejected (highest priority, Hermes cannot override)
    denyReasons: {}          # tool → reject reason text fed back to the agent
    hermesModel: 'deepseek-v4-pro'   # verdict model (Pro = highest capability)
    hermesTimeoutSecs: 90    # verdict timeout; on failure → human (fail-closed)
    feedbackOnReject: true   # followup the reject reason to the requesting session
    qnaMode: 'off'           # 'hermes' = ask_user_question answered by Hermes Pro; 'off' = human
    userGranted: []          # endorsement signal (NOT a bypass card) — see below
    logPath: ''              # audit log path (default ~/.dsh/auto-approver.log)

mode	behavior
allow-all	auto-approve everything (incl. danger-full-access). Trusted environments only.
allowlist	auto-approve only listed tools; everything else asks the human.
hermes	rule layer (denyAlways / allowlist) + Hermes Pro semantic verdict for the rest.
off	plugin inert; everything goes to the human.

userGranted — endorsement signal, not a bypass card

userGranted is a soft endorsement passed into the Hermes verdict prompt ("the user explicitly authorized this tool — lean toward approval when the operation is reasonable and carries no data-destruction / credential-exfiltration risk"). It is not a hard allow:

• denyAlways still wins over everything.
• Hermes still rejects dangerous operations (data destruction, credential exfiltration, irreversible deletes).
• Keep it empty by default — adding broad tools (bash, write) conflicts with the least-privilege principle. Only list capabilities the user explicitly named.