Preface¶

DeepSeek Harness (dsh) grants agent tool execution permissions to the current process. Looser permissions speed up development, but overly permissive access risks real filesystem damage from a single misjudgment. The community repeatedly grapples with this dilemma: some ask for a “review on my behalf” approval mode similar to Codex / Claude Code, finding Full Access too worrying (Discussion #421); others have accidentally deleted most of their home directories while testing plugins under Full Access (Discussion #461).

On one end is manually approving every command, on the other is blindly trusting the model not to mistype paths. dsh-clawrouter from BlockRunAI takes a third path: it does not interrupt routine reads, writes, and builds; for tool calls that hit risk rules, it first routes them to a more powerful model for review, then lets the tool executor enforce approval, denial, or defer the decision back to you.

This article is collated after cross-checking against the community plugin directory, the GitHub repository README / CHANGELOG, package.json, and the original license text. The core philosophy of the official DeepSeek Harness repository is “everything is a plugin”; deepseek-harness-plugin.com is an independent community directory with no official affiliation to DeepSeek / HyperMind, do not treat it as an official app store.

What is this¶

dsh-clawrouter is a DeepSeek Harness plugin maintained by BlockRunAI, licensed under MIT, primarily written in TypeScript. Its npm package name is also dsh-clawrouter, and the current repository package.json version is 0.10.1. The community directory categorizes it under “Interface Enhancement”, with 9 GitHub stars (as currently shown on the directory and repository pages).

It does two related things:
1. Review Gate (blockrun-review): When an agent proposes a risky tool call, it first sends the request to a more powerful model to classify it as safe / dangerous / uncertain. The actual tool executor enforces the ruling, rather than relying on prompt word discouragement.
2. BlockRun Model Routing (blockrun-llm): Registers a provider named blockrun. Authentication uses wallet signatures, not API Keys; requests are settled per-call with USDC on Base Chain via x402. The repository README states this routing exposes 67 models (the count is updated from the live catalog via npm run sync:models, and the CHANGELOG also records a correction from “written 70, actual 67”).

It does not modify your main loop model by default. dsh-base still uses the deepseek-official provider; this routing is only used when you explicitly specify it, or when the review gate needs to call a review model. The repository’s own description is: DeepSeek continues to run the main loop, and the plugin supplements capabilities it does not cover – more powerful review models, and multi-vendor models including vision support.

Core Features¶

1. Review Gate: Tighten, Never Loosen¶

The gate is disabled by default (enabled: false). When enabled, calls that hit risk rules are first sent to the review model (default: anthropic/claude-opus-5):

Passing the review does not equal immediate execution. The README makes this clear: it only tightens policies, never relaxes them – the same applies when escalating to human review: if a stricter permission rule would have rejected the call anyway, you will receive that rejection rather than an approval popup. It stands in front of the permission system, rather than replacing it.

When the review model is unreachable, the default setting is onReviewerFailure: ask (defer to you), which can also be changed to deny for unattended tasks. The repository emphasizes two points: never silently allow requests on failure; nor will it freeze an entire session due to a single network blip.

Which calls go through the gate. The rules are intentionally narrow. Reads, edits, and builds are not audited by default. The built-in rules target recursive deletion, raw disk writes, fork bombs, curl … | sh, forced pushes and hard reset, chmod 777, sudo, and operations touching ~/.ssh, ~/.aws, /etc/passwd; they also cover commands that delete data without using rm, such as git clean -fdx, find … -delete, git checkout -- ., terraform destroy, and npm publish.

Mentioning a dangerous command does not equal executing it: grep -rn "rm -rf" docs/ will not be blocked. Writing dangerous commands into a Makefile, cleanup script, or README also does not count as execution. File body parameters (content, new_string, diff, etc.) are treated as data by default; actually executing that file is a separate tool call, which will still be screened by the gate. CHANGELOG 0.10.0 added a quieter class of risk: files written now but run later, such as .git/hooks/pre-commit, CI workflows, shell startup files, npm postinstall scripts.

You can add custom rules. For example, to block deployments to production:

    extraRules:
      - name: no-prod-deploy
        pattern: "deploy\\s+--env[= ]prod"

How much does running the gate continuously cost. The numbers below come from test corpus in the repository’s own README, not third-party evaluations: 0/59 routine operations triggered the gate (including cases where dangerous commands were only mentioned); 39 dangerous commands were correctly flagged with no false negatives; 10/10 files written for future execution (git hooks / CI / postinstall, etc.) were caught; the review model only sees the single marked call (approximately 356 tokens) by default, not the entire session. When a match occurs, the README measured approximately $0.0057 and ~3 seconds of latency with claude-opus-5 and reviewerMaxTokens=512. Before 0.10.0, review requests inherited Opus’s advertised 128,000 output limit, leading to single calls costing up to $0.28–0.33; CHANGELOG 0.10.1 fixed this issue and added the reviewerMaxTokens parameter.

These numbers are tested but only valid for the current rules and test corpus. Commands not flagged by the matcher will never be seen by the review model – the repository itself lists “recall rate” as an upper bound for all declared cases.

2. /gate: First Confirm the Gate is Armed¶

The gate may be disabled even when “everything seems normal”: it defaults to enabled: false; profile patches will replace an entire line of config rather than merging keys; /review is registered regardless of the gate’s state. So the fact that /review works only means the plugin loaded, not that tool calls are being screened.

/gate         # Show whether the gate is armed and the current configuration
/gate drill   # Send a dangerous command through the matcher and live review model, without passing it to any tools

The sample command used by /gate drill is rm -rf / --no-preserve-root. It reports results in two parts: rule mismatches are a policy issue, and failure to connect to the review model is a wallet or model issue. At runtime both will resolve to “defer to you”, which looks identical to “gate working normally”. The drill incurs one review call charge.

3. /review and /spend¶

/review <paste diff, plan, or agent conclusion>
/spend

/review uses the same powerful model to audit content you specify. The README references Discussion #475: an agent read critical evidence but arrived at an incorrect conclusion first.

/spend lists the routing’s costs since the current process started: total amount, broken down by model, plus token costs and fixed fees. The billing model to remember is: priced per request – input size plus the max_tokens specified in the request, regardless of how much the model actually outputs. Small requests have a minimum fee of approximately **\(0.002** (\)0.001 minimum payment + $0.001 processing fee). The README also notes: the plugin itself does not write session cost events or ~/.blockrun/cost_log.jsonl; wallet balance is the source of truth. Reading 402 pricing quotes itself incurs no charge.

4. One Wallet, 67 Models¶

The blockrun-llm provider registers the blockrun routing. There is no per-vendor API key application process: local wallet signature serves as authentication, and USDC is settled via x402 on Base Chain. This is especially useful for review models, since the default review model is Anthropic’s Opus, which is not available on DeepSeek’s official routing.

Installing this routing will not change your default chat model to BlockRun. Specify it explicitly when needed. The repository also provides auxiliaryModel, which only affects maintenance calls marked by Harness itself (compaction, session titles), and chat requests will not be rerouted. The README gives an example of moving compaction summaries to a cheaper model:

- id: blockrun-llm
  config:
    auxiliaryModel: deepseek/deepseek-chat

For a ~100k token compaction, the README used real-time 402 pricing to calculate: Claude Opus 5 costs approximately $0.90, while DeepSeek V4 Flash costs approximately $0.026. This is the repository’s own measurement, used to explain why maintenance calls deserve a dedicated model.

The smart routing blockrun/auto is not yet available. The reason is written in the README: virtual models must report a context window, which Harness uses to decide when to compress content; reporting a window that is too large or too small will cause issues. Until this is fixed, please specify model IDs directly.

5. Vision: Whitelist, Don’t Blindly Trust Gateway Tags¶

DeepSeek’s official routing does not include vision models. Starting from version 0.10.0, this routing can serialize image sequences in messages into OpenAI content parts. The configuration option is visionModels, which defaults to the four models the repository tested to support image input; the README example is:

- id: blockrun-llm
  config:
    visionModels: [google/gemini-3.5-flash]

There are 35 entries in the gateway catalog with the vision tag. The repository sent the same inline PNG to 10 of these models: Google’s three Gemini models and moonshot/kimi-k3 responded correctly; several OpenAI models returned HTTP 400 after being charged; xai/grok-4.5 returned HTTP 503 after being charged; Anthropic’s Sonnet / Opus returned HTTP 200, passing through the upstream 400 as assistant text. So the plugin requires both signals to be true: the gateway has tagged the model with vision, and the model is present in the visionModels whitelist.

The “Known Limitations” section at the end of the same README still states “images will be explicitly rejected… vision capabilities are planned”. This conflicts with the 0.10.0 CHANGELOG and the dedicated vision section in the same document. This article follows the CHANGELOG and the dedicated vision section; if you encounter older documentation, interpret it using the two updated sources.

Installation and Activation¶

The installation command given on the community directory page is:

dsh plugin add github:BlockRunAI/dsh-clawrouter

For reproducible installations, pin the commit hash per the directory’s instructions:

dsh plugin add github:BlockRunAI/dsh-clawrouter#<commit>

The repository README’s quick start guide recommends installing via the npm package name with a profile (sample profile is web):

dsh plugin --profile web add dsh-clawrouter
export BASE_CHAIN_WALLET_KEY=0x...   # You can also store this in the credentials service

Both commands will install the plugin to your current configuration. The directory command is the original text from the community directory; the README command includes the --profile flag. Choose based on the profile you actually use.

Six ✕ missing peer warnings printed during installation: the repository states this is expected behavior. These packages are provided by Harness at runtime, and the first-party bundle uses the same peer dependencies; if you convert them to direct dependencies, a duplicate copy of cordis will appear in your profile. The repository tested on a clean environment: the profile can be assembled, and dsh --profile web --dump-config will list lines for blockrun-llm and blockrun-review.

The wallet is not an API Key:
- If you have used other BlockRun tools before: the SDK’s common path is ~/.blockrun/.session, and ClawRouter’s common path is ~/.openclaw/blockrun/wallet.key. Export whichever file exists, for example export BASE_CHAIN_WALLET_KEY=$(cat ~/.blockrun/.session).
- If you do not have a wallet yet: npx -y @blockrun/clawrouter will generate one and print its address. Note down the address, stop the process, transfer USDC on Base Chain to that address, then export the private key.

The plugin will not read these two files on its own – it only reads the credential reference you declare in your configuration (default environment variable name BASE_CHAIN_WALLET_KEY). Do not paste private keys into cordis.patch.yml.

The README’s order-of-magnitude estimate: $5 USDC on Base Chain is enough for approximately 2500 gate reviews at the $0.002 minimum fee, but only enough for approximately 5 Opus calls with a 100k token context. Fund based on how you actually use this routing, not the minimum estimate.

The gate is disabled by default. To enable it, edit the corresponding profile’s cordis.patch.yml file. The patch will replace an entire line of config, so include all required keys when overriding:

- id: blockrun-review
  config:
    enabled: true
    reviewerProvider: blockrun
    reviewerModel: anthropic/claude-opus-5

The Node engine declared in package.json is ^22.19 || >=24. The CHANGELOG also notes: when installing dsh in a minimal Node image, node-pty may require python3, make, and g++ on the host machine, otherwise it will fail during compilation; this is an issue with Harness dependencies, and the error message may not explicitly name this plugin.

Typical Usage¶

The steps below come directly from the repository documentation and can be followed exactly.

1. After installation, first check the gate status, do not assume commands are already being blocked.

/gate

If it shows as disabled, add enabled: true to your profile per the previous section. Then run:

/gate drill

Confirm that both the risk matcher and review model are working. This step will incur one review call charge, but will not execute the deletion command.

2. Continue using DeepSeek for the main loop, and use a stronger model for reviews.

Do not reroute cached routine chat conversations to this routing. The README contrasts: a cached agent turn with direct DeepSeek access costs approximately $0.000056; via BlockRun with ~22k input tokens, it costs approximately $0.007. Using a separate, more powerful review model is a core design premise of the gate. If you mistype the reviewerModel, marked commands will be escalated or rejected, with an error message like “BlockRun does not serve model … Did you mean …?”, which will look like the gate is operating cautiously, so always use /gate to confirm your configuration.

3. Have the strong model review a diff or conclusion when needed.

/review Please point out any destructive side effects in this change

This is a separate entry point from the automated gate: one blocks tool calls, the other audits text you paste in manually.

4. Check costs using your wallet balance as the source of truth.

/spend

/spend cannot see requests that were paid for but subsequently failed. Large max_tokens values will be billed at the quoted rate even if the model returns a short response.

Applicable Scenarios and Notes¶

It is well-suited for these cases:
- You want fewer manual approvals for Full Access without fully exposing your system
- You need Claude / GPT / Gemini / Grok and other models not available on DeepSeek’s official routing, especially for review purposes
- You need to give agents access to vision capabilities, and prefer a whitelist over relying solely on gateway tags
- You are willing to pay per-use with Base Chain USDC instead of applying for additional vendor API keys

Review these boundaries before use:
- The plugin runs with the permissions of the current dsh process, and may execute code during installation. Both the directory page and this article recommend checking the source repository and license before installing; pin the commit hash for reproducible installations.
- This is not an operating system sandbox, and cannot cover all tool forms. The gate only handles matched calls; the review model will not see calls missed by the matcher.
- Free NVIDIA models are explicitly marked as “smoke testing, not production”. They may use prompts for service improvement, so do not run private code through them, especially not as a review model.
- The review model only sees the