dsh-approve-for-me

Web configuration

Open Settings -> Plugins -> Plugin configuration -> Approve for me. Add only command prefixes you are willing to review automatically, for example:

Shell:      git status
Shell:      git diff
PowerShell: Get-Location
PowerShell: Get-Content

Select the Approve for me Access preset for the target agent or session.

[!IMPORTANT] commandPrefixes is empty by default. Installing the plugin alone does not automatically approve any command; define positive rules first.

The Web card is an optional editor. The Host approval core also works in a headless Profile and can be configured through YAML only.

On rc.6, the client registers a settings.plugin.item card under the real plugin id approve-for-me. It appears only over loopback and uses the plugin's loopback-only RPC. The Host delegates persistence, schema validation, conflict handling, redaction, and hot reload to the official Settings service. The card makes no approval decisions and does not depend on or impersonate llm-pi-ai.

Verify

Trigger a read-only command that would normally request sandbox escalation and matches a configured prefix. Confirm that:

1. A matching request approved by the reviewer receives one-time approval.
2. An unmatched or high-risk request still shows native human approval.
3. Switching to another Access preset disables the plugin for that session.

The plugin does not participate when no sandbox escalation occurs.

Check the effective package version in the Profile:

dsh plugin --profile web list dsh-approve-for-me --depth 0

The list output is the version actually installed in this Profile. Its package manifest and lockfile live under $DSH_HOME\profiles\web; on this machine the directory is C:\Users\zariba\.dsh\profiles\web.

YAML configuration

The Web settings page and $DSH_HOME\settings.yaml edit the same approve-for-me settings. Web is optional; a headless environment can use YAML only.

Recommended: rules + current session model

Omit reviewer.provider and reviewer.model. Each review inherits the session provider/model attached to that approval request:

approve-for-me:
  version: 1
  mode: rules-and-llm
  rules:
    commandPrefixes:
      - tool: shell
        prefix: git status
      - tool: shell
        prefix: git diff
      - tool: pwsh
        prefix: Get-Content
    reviewerInstructions: >-
      Only allow read-only repository inspection.
  reviewer:
    timeoutMs: 30000

If the requesting session has no complete provider/model route, the reviewer cannot allow the request and it falls through to human approval.

Pin a reviewer route

Set both fields under reviewer:

reviewer:
  provider: your-provider-id
  model: your-model-id
  timeoutMs: 30000

provider and model must be set together or omitted together. The plugin stores identifiers only; Harness continues to own model credentials.

Use rules only

approve-for-me:
  version: 1
  mode: rules-only
  rules:
    commandPrefixes:
      - tool: shell
        prefix: git status
      - tool: pwsh
        prefix: Get-Location
    reviewerInstructions: ''

rules-only does not call a model. Correlation checks, conservative parsing, and fixed high-risk checks still apply.

Field limits

Field	Default	Constraint
mode	rules-and-llm	rules-only or rules-and-llm
rules.commandPrefixes	[]	At most 200 entries; tool must be shell or pwsh
One prefix	None	Non-empty literal command segment, up to 1,000 characters
rules.reviewerInstructions	''	Up to 8,000 characters
reviewer.timeoutMs	30000	1,000 to 120,000 milliseconds
reviewer.provider/model	Current session	Set both or omit both

Optional content-bound defaults:

approve-for-me:
  limits:
    trustedTranscriptChars: 12000
    untrustedToolDataChars: 8000
    reviewerOutputChars: 2000

A review already in progress uses the settings snapshot captured at its start. Hot reload affects later requests only.