Preface¶

When running agents in DeepSeek Harness (DSH), Shell and PowerShell sandbox escalation will by default trigger native human approval. Read-only inspection commands (e.g., git status, git diff) require confirmation each time, which disrupts development rhythm; switching directly to Full access, on the other hand, removes the entire sandbox boundary.

dsh-approve-for-me offers a third path between these two approaches: using literal command prefix rules to define the scope of auto-approval, with an optional LLM review that falls back to Harness native human approval when uncertain. This article introduces its positioning, installation method, and key configuration points.

What Is This¶

dsh-approve-for-me is a DeepSeek Harness plugin released by maintainer timeance. Its npm package name is also dsh-approve-for-me, current version 0.2.2, licensed under MIT. It is categorized as admin-security in the SkillHub Plugin Directory.

The plugin handles Shell and PowerShell sandbox escalation requests by executing a fixed high-risk check, user-configured literal command prefix rules, and, in rules-and-llm mode, an optional LLM reviewer. Upon approval, it grants a one-time allowed-once permission for the current request only, without permanently opening up permissions.

This version is compatible with DeepSeek Harness 0.1.1-rc.1, including the rc1 third-party keyed settings card mechanism and shared client settings schema service. The README explicitly states that this is an unofficial plugin that has not undergone independent security audits.

Core Features¶

Comparison of Three Access Modes¶

Rules define the maximum candidate scope for auto-approval. The reviewer can only narrow this scope; it cannot bypass rules or fixed high-risk checks.

Decision Order¶

1. The current Access preset must be approve-for-me.
2. The request must be a supported Shell or PowerShell escalation that can be strictly associated with the current tool invocation.
3. The command must pass the fixed high-risk check.
4. Each command segment must match the corresponding tool’s literal prefix.
5. In rules-only mode, after a rule match, it returns allowed-once once; in rules-and-llm mode, it also requires the reviewer to return a structurally correct, explicit allow.

Fixed high-risk checks cover common risk patterns such as parse failures, file or permission modifications, system and package manager changes, Git/GitHub write operations, package manager lifecycle scripts, executable files with paths, dynamic command execution, credential access, and external writes. A high-risk result stops the auto-approval process and returns the request to Harness; it does not directly reject the command.

Two Operating Modes¶

• rules-and-llm (default): After rule matching, a tool-less LLM reviewer performs a secondary judgment.
• rules-only: Relies solely on rules and fixed checks, without calling the model.

Web Configuration Card¶

After installing the web profile, you can manage command prefixes via Settings -> Plugins -> Plugin configuration -> Approve for me. The card is only displayed in loopback connections and reads/writes configuration through the plugin’s own loopback-only RPC. Persistence, schema validation, and hot-reloading are handled by the Harness Settings service. The card does not make approval decisions and does not depend on llm-pi-ai.

Installation and Enabling¶

First, install the DSH CLI, then add the plugin to the target profile. Plugins and settings are isolated per profile; web, headless, and tui profiles require separate installations.

npm install -g @deepseek-ai/dsh
dsh plugin --profile web add dsh-approve-for-me@latest
dsh web --host 127.0.0.1 --port 3080

Enabling involves three steps:

1. Open Settings -> Plugins -> Plugin configuration -> Approve for me.
2. Add only the command prefixes you wish to auto-review.
3. Select the Approve for me Access preset for the target agent or session.

commandPrefixes defaults to empty; installing the plugin alone does not auto-approve any commands. @latest is an npm dist-tag, not a fixed version number; use @<version> for reproducible installations.

When only the host approval core is needed without the web settings card:

dsh plugin --profile headless add dsh-approve-for-me@latest

After installation, you can confirm the actual version in the profile with the following command:

dsh plugin --profile web list dsh-approve-for-me --depth 0
dsh --profile web --dump-config

The configuration dump should include the approve-for-me permission preset and the host plugin entry.

Typical Usage¶

Configuring Command Prefixes via Web Interface¶

Add literal prefixes with clear scope. Rule matching applies to parsed token prefixes, not exact full command equality; parameters can still follow, so specify subcommands and paths as precisely as possible. Each segment in a compound command must match separately.

Shell:      git status
Shell:      git diff
PowerShell: Get-Location
PowerShell: Get-Content -LiteralPath README.md

Even if a prefix appears to match, known package manager lifecycle actions, executable files with paths, direct scripts, wrappers, PowerShell aliases that write, parsing ambiguities, and fixed high-risk patterns will still be escalated to human approval.

YAML Configuration¶

The web page and $DSH_HOME\settings.yaml modify the same approve-for-me settings. It is recommended to omit reviewer.provider and reviewer.model so that each review inherits the session provider/model that initiated the approval request:

approve-for-me:
  version: 1
  mode: rules-and-llm
  rules:
    commandPrefixes:
      - tool: shell
        prefix: git status
      - tool: shell
        prefix: git diff
      - tool: pwsh
        prefix: Get-Content -LiteralPath README.md
    reviewerInstructions: >-
      Only allow read-only repository inspection.
  reviewer:
    timeoutMs: 30000
  limits:
    trustedTranscriptChars: 12000
    untrustedToolDataChars: 8000
    reviewerOutputChars: 2000

If the request session lacks a complete provider/model route, the reviewer will not automatically allow the request, and it will be escalated to human approval. Set mode: rules-only when model review is not needed.

When a fixed reviewer route is required, fill in both the provider and model identifiers; model credentials are still managed by Harness, and the plugin only stores identifiers.

Verifying Effectiveness¶

1. Matching read-only escalations should receive one-time approval.
2. Non-matching or high-risk requests will still display native human approval.
3. After switching to another Access preset, the plugin no longer participates in the current session’s approval.

Use Cases and Considerations¶

It is suitable for developers who frequently execute predictable read-only commands in DSH, wish to reduce repetitive approval clicks, and are unwilling to switch to Full access. The headless profile can be configured independently via YAML without relying on the web card.

Before use, please note:

• The plugin runs with the current dsh process privileges; check the source code and MIT license before installation.
• The built-in checks are conservative classifiers and cannot prove that non-matched commands are necessarily safe; the positive allowlist should be as narrow as possible.
• There are no built-in positive rules, only fixed high-risk checks; which specific commands to allow must be configured by the user.
• Compatibility baseline: DeepSeek Harness 0.1.1-rc.1, Node.js ^22.19.0 || >=24.0.0.

Conclusion¶

dsh-approve-for-me processes escalation requests using a three-layer mechanism of rules, optional LLM review, and native human fallback while preserving sandbox boundaries. It is suitable for DSH users who need fine-grained control over the scope of auto-approval.

• Plugin directory: https://www.skillhub.cn/plugins/timeance/dsh-approve-for-me
• Source code and documentation: https://github.com/timeance/dsh-approve-for-me