Preface

In DSH, agents often need to perform sandbox-escaping operations such as writes and commands. If every operation requires manual confirmation, the workflow slows down; if everything is automatically approved, it may encounter irreversible actions. The approach of dsh-approval-gate is: let the Flash model first determine whether an operation is reversible and whether it carries risk. Safe operations are automatically approved, while dangerous operations are routed to manual confirmation, keeping human intervention focused on cases that truly require judgment.

What This Is

dsh-approval-gate is a DeepSeek Harness plugin with the full name moon09300731/dsh-approval-gate, licensed under MIT.

It addresses the manual cost and security risks in DSH’s automated approval workflow: reducing repetitive confirmations for reversible, low-risk operations, while always routing hard-risk operations—such as deletions, credentials, remote/production, system paths, and batch irreversible actions—to manual review. The plugin also provides a manual review UI, hot-reloadable configuration, and file change diff and rollback capabilities in v0.5.0+.

Core Features

Flash Risk Prediction

Each time a sandbox escape occurs, the Flash model determines the operation’s risk. The result is classified as either SAFE or RISKY:<category>. Reversible operations are automatically approved without requiring manual confirmation every time.

Hard Risks Always Go to Manual Review

The following five categories of operations are directly routed to manual review without counting toward learning:

  1. Deletion
  2. Credentials
  3. Remote/production
  4. System paths
  5. Batch irreversible

These operations will never be automatically approved, regardless of whether they have been confirmed previously.

Confirmation-Based Learning with Semantic Similarity Validation

After confirming the same operation N-1 times, it can be automatically approved. The rules accumulated carry an operation fingerprint and only approve operations that you have confirmed.

If the wording of an operation changes but the intent remains the same, the plugin uses Flash to perform semantic comparison against your confirmed samples, no longer relying solely on keyword matching.

Manual Review UI

When an operation is automatically approved, a green notification appears above the input field.

The “Approval” view is located to the right of the trajectory and displays the complete approval timeline for the current session, making it easy to review which operations were auto-approved and which went to manual review.

Hot-Reloadable Configuration

Changes to allowlist.json take effect immediately without requiring a restart.

File Change Diff and Session-Level Snapshots (v0.5.0+)

Version v0.5.0+ provides file change diff capability: files involved in approval can be clicked to view a unified diff, and support one-click “rollback this change,” where the system sends an instruction for the AI to restore files based on the snapshot.

Snapshots are attributed to sessions by event, and cleanup supports two levels:

  1. “Clear current session only”: Only deletes snapshots from the current session, avoiding accidental deletion of unviewed diff records from other sessions.
  2. “Clear all”: Clears all session snapshots.

Installation and Activation

First, install the plugin:

dsh plugin --profile web add dsh-approval-gate

After installation, you need to manually configure the permission preset: add the auto-approve preset to ~/.dsh/profiles/web/cordis.patch.yml.

Once configured, restart dsh web, then select “Auto Approval (Flash)” in the session permission dropdown.

Typical Usage

  1. Routine low-risk operations
    When an operation is determined to be reversible or safe, the plugin automatically approves it, reducing repetitive approval clicks.

  2. Hard-risk operations
    Operations such as deletions, credentials, remote/production, system paths, and batch irreversible actions are directly routed to manual review and will not be automatically approved.

  3. Confirmation-based learning
    After confirming the same operation several times, the plugin can accumulate it into an auto-approval rule. The rule carries an operation fingerprint and only approves similar operations you have confirmed.

  4. Reviewing approval records
    Green notifications appear above the input field for auto-approvals; the “Approval” view displays the approval timeline for the current session.

  5. Viewing file changes and rolling back
    In v0.5.0+, files involved in approval can be viewed as a unified diff, and you can one-click “rollback this change” to have the AI restore files based on the snapshot.

Applicable Scenarios and Notes

This plugin is suitable for users who frequently perform sandbox-escaping operations such as writes and commands in DSH and want to reduce the cost of repetitive approvals.

Before use, please note:

  1. The plugin runs with the current dsh process permissions, and its actual scope depends on the permissions of that process. Review the source code and license before installation; this plugin is licensed under MIT.

  2. Hard-risk operations always go to manual review, do not participate in learning, and are never automatically approved.

  3. allowlist.json supports hot-reload, with changes taking effect immediately without requiring a restart.

  4. For snapshot cleanup in v0.5.0+, it is recommended to first use “Clear current session only” to avoid accidentally deleting diff records from other sessions that have not yet been viewed.

Links

  1. GitHub: https://github.com/moon09300731/dsh-approval-gate

  2. Community directory: No verifiable link is available, so it is not listed here.