yhfgyyf/dsh-audit-mode2

dsh-audit-mode

DSH 第五种模式:支持可配置的 Codex、Claude Code 或 DSH 审计,用户批准的修复回合,渐进式提权及安全暂停。

AI 分析

核心用途是引入独立的审计与安全审查机制。适合在执行高风险代码或系统操作时,需要 AI 审计员进行双重把关的用户。

包名
dsh-audit-mode
版本
0.6.0
许可证
MIT
最近更新
2026年9月2日

安装

$npx -p @deepseek-ai/dsh dsh plugin --profile web add github:yhfgyyf/dsh-audit-mode

Reviewer configuration

Configure the audit-bundle row in the profile's cordis.patch.yml. No configuration preserves the existing Codex defaults:

- id: audit-bundle
  config:
    reviewer: codex
    binary: codex
    args: [app-server, --stdio]
    models:
      summarizer: { model: gpt-5.6-luna, effort: medium }
      auditor: { model: gpt-5.6-sol, effort: max }

summarizer and auditor are stable, responsibility-based keys; their model names remain fully configurable. Legacy luna / sol keys are still accepted and are migrated to the new names at runtime.

Claude Code uses print mode with JSON-schema output, plan permission mode, safe mode, and an empty tool set. Set Claude-supported model names explicitly:

- id: audit-bundle
  config:
    reviewer: claude-code
    claudeBinary: claude
    claudeArgs: []
    models:
      summarizer: { model: haiku, effort: medium }
      auditor: { model: opus, effort: max }

The DSH backend routes directly through a registered provider. A per-role provider overrides dshProvider when summary and audit use different routes:

- id: audit-bundle
  config:
    reviewer: dsh
    dshProvider: deepseek-official
    dshMaxTokens: 4096
    models:
      summarizer: { model: deepseek-v4-flash, effort: off }
      auditor: { model: deepseek-v4-flash, effort: high }

Changing reviewer does not translate model names. Audit fails loudly if the selected backend does not support a configured model; it never silently substitutes an audit model.