Foreword

Running agents in DeepSeek Harness (DSH) often presents a dilemma: either manually approve every command, disrupting workflow, or enable Full Access, completely handing execution control to the model. Community discussions have raised questions about review modes similar to Codex or Claude Code, with some users reporting accidental deletion of their entire home directory when testing plugins in Full Access mode.

dsh-clawrouter addresses this gap: it continues using DeepSeek for the main loop but routes dangerous tool calls to a stronger model for review before execution, enforced by a real executor rather than relying on prompt discouragement. Below, we introduce its positioning, capabilities, and how to enable it.

What This Is

dsh-clawrouter is a DSH plugin maintained by BlockRunAI, with the npm package name dsh-clawrouter, current version 0.10.1, MIT license. It is categorized under admin-security in the SkillHub community directory.

The plugin does two things:

  1. Review Gate: When an agent prepares to execute a destructive operation, the review model reads the tool call and returns safe / dangerous / uncertain, which the executor enforces.
  2. BlockRun Model Routing: Registers a blockrun provider, using a wallet with the x402 protocol for per-call USDC payment, eliminating the need to register separate accounts or configure API keys for each provider, providing access to 67 models (including vision models) in the BlockRun directory.

Core Features

Review Gate

When an agent prepares to execute a destructive operation, the default review model anthropic/claude-opus-5 reads the call and returns a verdict:

Verdict Result
safe Continues through the original permission chain, no relaxation
dangerous Rejects execution and returns a reason for the agent to adjust
uncertain Escalates to you, displaying the normal approval prompt

The gate only tightens, never relaxes. Reviewed calls still go through sandboxing, permissions, and approval; if the review model is unavailable, it defaults to asking you (onReviewerFailure: ask), never silently allowing.

The trigger scope is intentionally narrow. Reading, editing, and building do not trigger it. Built-in rules cover recursive deletion, bare disk writes, fork bombs, curl … | sh, force push and hard reset, chmod 777, sudo, and touching ~/.ssh, ~/.aws, /etc/passwd; also including git clean -fdx, find … -delete, terraform destroy, npm publish, etc. Merely mentioning dangerous commands (e.g., grep -rn "rm -rf" docs/) or writing command text in files does not trigger it.

Custom rules can be added as needed:

    extraRules:
      - name: no-prod-deploy
        pattern: "deploy\\s+--env[= ]prod"

BlockRun Model Routing & Vision

The plugin registers a blockrun provider route, authenticated via wallet signature, with per-call USDC payment through x402.

DeepSeek itself does not offer vision models. In the blockrun-llm configuration, you can specify visionModels to allow the agent to read image inputs. The plugin requires the model to be in both the gateway’s vision tag and the visionModels list to declare image support—avoiding misjudgment based on tags alone.

Built-in Commands

  • /spend: View spending for this route since the process started, broken down by model, tokens, and fixed fees.
  • /review <content>: Use the same strong model to review a specified diff, proposal, or agent conclusion.
  • /gate: Check if the gate is enabled and its current configuration.
  • /gate drill: Send rm -rf / --no-preserve-root to the risk matcher and real review model (not to any tool), reporting results in stages.

Note: enabled defaults to false, and /review being available does not mean tool calls are being reviewed. After installing the plugin, run /gate to confirm the gate status.

Installation & Enabling

Installation

The installation command from the SkillHub directory page and GitHub README is:

dsh plugin --profile web add dsh-clawrouter

During installation, you might see six ✕ missing peer messages; the README explains these packages are provided by the harness at runtime, which is normal.

Wallet Configuration

The review model and BlockRun route require an EVM wallet private key, injected via environment variables or credentials service:

export BASE_CHAIN_WALLET_KEY=0x...

Existing BlockRun tool users can export from ~/.blockrun/.session or ~/.openclaw/blockrun/wallet.key. If you don’t have a wallet, run npx -y @blockrun/clawrouter to generate an address, transfer USDC to the Base chain, and export the private key. The plugin does not auto-read the above files; it only reads your configured reference (default walletKeyEnv: BASE_CHAIN_WALLET_KEY).

Enabling the Review Gate

Enable in the profile’s cordis.patch.yml:

- id: blockrun-review
  config:
    enabled: true
    reviewerModel: anthropic/claude-opus-5

Main configuration items for blockrun-review:

Configuration Default Meaning
enabled false Whether to automatically intercept tool calls
reviewerModel anthropic/claude-opus-5 Review model, should be stronger than the agent’s model
reviewerMaxTokens 512 Output limit per review (billed per request quote)
onReviewerFailure ask When review is unavailable: ask escalates to you, deny directly rejects
extraRules [] Additional risk rules

Mounting the BlockRun route does not change the default model; dsh-base still uses deepseek-official, only using this route when explicitly specified.

Typical Usage

Quick Gate Verification

After installation and wallet configuration, confirm the plugin loads correctly:

/gate

If enabled: true, you can run a drill:

/gate drill

The drill consumes one review call fee.

Manual Content Review

Make a second judgment on a diff or proposal:

/review <paste diff, proposal, or agent conclusion>

Enabling Vision Capability

- id: blockrun-llm
  config:
    visionModels: [google/gemini-3.5-flash]

Verified models can be added to the list manually.

Reducing Compaction Overhead

When the harness compresses long sessions, you can specify a cheaper auxiliary model without affecting conversation requests:

- id: blockrun-llm
  config:
    auxiliaryModel: deepseek/deepseek-chat

Applicable Scenarios & Notes

Who it’s for: Developers who need to run agents semi-automatically in DSH without relying entirely on Full Access; users who need to invoke models not covered by DeepSeek (Claude, GPT, Gemini, etc.) for review or vision tasks.

Cost: Reviews only trigger when hitting risk rules. README tests: 59 daily operations with zero triggers; when triggered, claude-opus-5 at a 512 token output limit costs about $0.0057 with a latency of around 3 seconds. The gateway has a minimum quote of $0.002; large context calls can significantly increase costs. It’s recommended to keep the main loop connected directly to DeepSeek, using this plugin for things DeepSeek cannot do.

Security Reminder: The plugin runs with the current dsh process permissions. Before installation, read the GitHub repository source code to confirm the MIT license and behavior meet expectations. The community directory SkillHub is an independent site, with no official affiliation to DeepSeek /幻方.

Known Limitations (from README): The review model only sees the flagged tool call, not the entire repository; smart routing blockrun/auto is not yet integrated; the plugin does not write session spending logs, costs are based on wallet balance; versions before 0.10.0 may have higher review request costs due to inherited large max_tokens, upgrading is recommended.

Conclusion

dsh-clawrouter adds a layer of model review in front of DSH’s permission system: daily read/write/build operations remain unaffected, dangerous commands are judged by a stronger model before execution, and failure escalates to humans instead of silently allowing. It also connects to BlockRun’s 67 models via a single wallet, completing review and vision capabilities.