dsh-auto-review

Configuration

All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need.

Key	Default	Meaning
enableByDefault	true	Sessions start with auto-review enabled; /auto-review on|off writes a durable override that beats this
toolsPolicy.default	human	Policy for unlisted tools (delegate to the human answerer)
toolsPolicy.overrides	{}	Per-tool policy: ai / human / never
riskRules	[]	{pattern, policy, field?} matched before the tool table; field selects reason (default), toolName, or arguments
reviewerProvider	fork	Subagent provider for the reviewer (in-process fork backend)
reviewerModel	(inherit)	Reviewer model id; unset inherits the session agent's route
reviewerTimeoutMs	60000	Verdict deadline; on expiry the fallback policy applies
reviewerTools	[read, glob, grep]	The reviewer child's tool allow-list (must be non-empty)
fallbackPolicy	rejected	Reviewer failure: rejected (fail closed) / delegate / allow-once
maxReviewsPerTurn	10	Real AI-verdict budget per open turn; beyond it, requests delegate
maxFailuresPerTurn	10	Reviewer-failure budget per open turn
reasonMaxChars	2000	Cap for reviewer reasons and the redacted argument preview
reviewerGuidance	(none)	Optional advisory guidance appended to the reviewer prompt
reviewerPolicyText	(none)	Markdown ruling policy injected into the reviewer prompt (Codex-style)
denyGuidance	(anti-circumvention text)	Guidance appended to every injected deny reason
contextBudget	{turns: 2, maxChars: 4000}	Compact transcript budget for the reviewer prompt (the open turn plus the one before it); turns: 0 disables the section — and a blind reviewer denies user-authorized actions, so the runtime warns when 0 meets an ai policy. The character budget is spent on the most recent lines
riskPolicy	{maxAutoAllow: high, onHighRisk: delegate}	allow verdicts above maxAutoAllow delegate or deny
circuitBreaker	{consecutiveDenies: 3, windowDenies: 6, windowSize: 10, action: delegate}	Rejection circuit breaker
overrideTtlMs	300000	How long a /auto-review approve override stays usable
verdictCacheTtlMs	60000	Reuse a recent verdict for an identical tool + arguments fingerprint; 0 disables the cache. Only applies with contextBudget.turns: 0 — a transcript-dependent verdict is not replayable from tool + arguments alone
verdictCacheMaxEntries	256	Maximum cached fingerprints before oldest-eviction
language	en	UI language of the /auto-review command output (en | zh)
allowUnmarkedAudit	false	Force session-log audit on hosts that drop the ignorable marker or fail-closed on unknown event types (host 0.1.2-rc.1+) (dangerous: unmarked events make sessions unresumable elsewhere); default is detect-and-degrade (adapted 2026-09-02, re-verified against 0.1.5-rc.2 on 2026-09-11): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged.

Example (annotated full form: fixtures/config/config-full.yaml):

- insert:
    - id: auto-review
      name: dsh-auto-review
      config:
        toolsPolicy:
          overrides: { bash: ai, write: ai }
        riskRules:
          - pattern: '(?i)(rm\s+(-[a-z]+\s+)*/|git\s+push\s+--force)'
            policy: never
          - pattern: 'write'
            policy: never
            field: toolName
        reviewerTimeoutMs: 30000
        fallbackPolicy: delegate
        riskPolicy: { maxAutoAllow: medium, onHighRisk: delegate }
        circuitBreaker: { consecutiveDenies: 3, windowDenies: 6, windowSize: 10, action: delegate }

Where the config actually comes from

~/.dsh/settings.yaml is NOT a config source for this plugin. An auto-review: block there has no effect and produces no warning: like every DSH function plugin, dsh-auto-review receives its Config from the row the loader mounts it with — the profile's cordis patch layer. (Some other DSH plugins additionally read the settings service, so the inconsistency is easy to trip over, and the symptom is indistinguishable from the reviewer simply denying.)

Put the configuration in your profile's cordis.patch.yml. An id-targeted override replaces the whole config row, so restate every key you need — dropping toolsPolicy silently returns bash/write to the schema default human and the reviewer stops running at all:

- id: auto-review
  config:
    toolsPolicy:
      overrides: { bash: ai, write: ai }
    contextBudget: { turns: 4, maxChars: 8000 }