Introduction¶

When performing long tasks in DeepSeek Harness (DSH), permission presets often require a trade-off between two extremes: workspace-write demands manual confirmation for every sandbox upgrade, which is frequently disruptive; while danger-full-access fully opens permissions, suitable for isolated environments but too risky for daily development use.

Below, we introduce the community plugin dsh-auto-approve. It inserts an auto level between DSH’s native three permission tiers. The sandbox boundaries remain the same as workspace-write, but routine upgrades are approved in bulk by a classification model. When hitting deterministic danger rules, when the classifier is uncertain, or if classification fails, it still falls back to the standard manual approval popup.

What Is This¶

dsh-auto-approve is published by maintainer Jiao-XXX, categorized as admin-security, currently at version 0.5.1 under the MIT license, with approximately 9 stars on GitHub.

The plugin redefines the permission preset table into four levels via a Cordis bundle, ordered as read-only, workspace-write, auto, danger-full-access—inserting auto between the original levels while preserving all others. When not in the auto level, the plugin passes all approval requests unchanged to the next responder (Web UI, TUI, or Desktop).

In positioning, auto is similar to Claude Code’s auto mode and Codex’s Auto-review mode: routine approvals are delegated to a security reviewer, while dangerous or uncertain cases are returned to the human user.

Core Features¶

Approval Waterfall¶

When receiving an approval/request for the auto level, the plugin processes it in the following order:

1. Retrieves the original parameters of the corresponding tool/call from the session log and reads the latest human user message (text from source.kind === "user", ignoring plugin messages). If the message is within 2000 characters, it is included in full as evidence; if it exceeds the limit, it is passed directly to human review without truncation or guessing.
2. Checks the justification and tool parameters against a deterministic danger list. Obfuscation circuit-breakers pass destructive commands with command substitution or process substitution directly to human review.
3. Sends the command, justification, target sandbox mode, workspace path, and latestUserMessage to the configured classification model. Explicit authorization in the human message can help judge specific operations, but command examples and references themselves do not constitute execution authorization.
4. Only returns allowed-once if the model strictly returns {"verdict":"approve"}; all other cases are passed to the next responder.

The built-in danger list covers destructive rm -rf, device writes and formatting, force pushes, downloads directly piped to shell, destructive SQL, host shutdowns, recursive chmod 777 on root paths, shell fork bombs, Terraform/Pulumi destroy, and obfuscated combinations of rm, dd, mkfs, chmod, or chown with $(), backticks, or <(). LLMs cannot override already-hit danger rules.

Ordinary git push to a user’s own fork or working branch is considered a routine candidate; pushes to shared/production branches like main, master, release, production, prod should be sent to human review. Force-push notations like --force / -f / --mirror, leading +refspec, and git -C ... push --force will hit the danger list before classification, regardless of the target branch.

Frontend Compatibility¶

The plugin host-side only relies on DSH’s approval/request waterfall and permissionPresets service, independent of the frontend implementation.

Configuration Options¶

From version 0.5.0, the default prompt adopts a “default approve, only ask if listed concerns are hit” stance. To revert to the older strict stance, you can paste the strict-level prompt from the README into classifierPrompt.

The classification model only needs to make a binary approve / ask judgment. If the default model is a large reasoning model, latency and cost may be high, potentially hitting the timeoutMs—you can run /auto-report in the session to check the proportion of verdict=timeout and consider specifying a faster model or increasing the timeout:

- id: auto-approve
  config:
    model: <your API's fast model id>
    timeoutMs: 20000

Installation and Enabling¶

DSH requires a supported Node.js version (>=22.19.0). This package has no runtime dependencies; when installing from Git, you don’t need to authorize pnpm to execute builds.

Install from GitHub:

dsh plugin --profile web add github:Jiao-XXX/dsh-auto-approve

Install from local checkout:

dsh plugin --profile web add ./dsh-auto-approve

Restart dsh web and select Auto from the Permissions dropdown.

To uninstall:

dsh plugin --profile web remove dsh-auto-approve

Typical Usage¶

In daily development, after switching the permission level to Auto, routine sandbox upgrades such as installing dependencies, downloading read-only resources, and running build tests will be automatically approved by the classifier, eliminating the need for manual confirmation each time. Scenarios involving database-level operations, pushes to production branches, and force pushes will still trigger manual approval.

To troubleshoot classifier performance, you can run /auto-report in the session to view grouped statistics of automatic approvals and cases sent to human review.

Use Cases and Considerations¶

Suitable for DSH users who need to let the agent run autonomously for extended periods without fully opening the sandbox: long tasks like dependency installation, multi-step refactoring, and batch file operations reduce approval interruptions while preserving workspace-write sandbox boundaries.

Before installation, it’s recommended to review the source code and MIT license on the GitHub repository yourself. The plugin runs with the current DSH process permissions; while the auto level is more conservative than danger-full-access, it still delegates some approval decisions to the classification model. For sensitive repositories or non-disposable environments, read-only or workspace-write should be prioritized.

The community directory SkillHub is an independent site with no official affiliation with DeepSeek or High-Flyer.

Conclusion¶

dsh-auto-approve fills the gap between workspace-write and danger-full-access in DSH’s permission system: sandbox remains unchanged, routine upgrades are auto-approved, and dangerous or uncertain operations still have human oversight. If you’re frequently interrupted by sandbox upgrade popups, you can install it using the steps above and switch to Auto in Permissions.

• Directory page: https://www.skillhub.cn/plugins/Jiao-XXX/dsh-auto-approve
• GitHub: https://github.com/Jiao-XXX/dsh-auto-approve