Introduction

In DeepSeek Harness (DSH), there is often a missing tier between Workspace Write and Full access (danger-full-access): the former still asks repeatedly for operations outside the trusted zone, while the latter hands the approval strategy to never. If you wish to automatically pass calls that are “clearly harmless” and targets within “configured trusted zones,” while letting other requests continue to be confirmed by humans, you can use the DSH plugin dsh-auto-approval-plugin maintained by StyxNether.

What is this

dsh-auto-approval-plugin is a DSH permission approval plugin. It adds an auto-approval preset tier to DSH, positioned between Workspace Write and Full access.

Verified plugin information is as follows:

  • Name: StyxNether/dsh-auto-approval-plugin
  • License: MIT
  • package.json version: 2.1.0
  • Core capability: Automatically approve harmless commands and operations, especially requests where the target is within a configured trusted zone; trusted zones can be outside the current workspace
  • For requests that do not meet the auto-approval conditions, do not reject them and continue to hand them over to the human approver in the deployment

It does not switch DSH directly to full permissions, but adds a layer of automatic determination on the approval/request path.

Core Capabilities

This plugin works around DSH’s approval path, with main capabilities including:

  1. Register a prepend listener on DSH’s approval/request path, so it runs before the Web approval prompt.
  2. Read real tool arguments based on tool/call events recorded in the session log, such as command text, file_path, workdir, without reading the justification string written by the model itself.
  3. Use realpath to resolve the deepest existing ancestor path for trusted zone path inclusion checks, avoiding symlink or junction bypasses.
  4. Return allowed-once for auto-approved requests, and write approval/asked and approval/decided: allowed-once to the session log.
  5. Call next() for non-auto-approved requests to hand them back to the human approver. The plugin itself does not reject any request.
  6. Provide a default tier in General settings → Permission, as well as the immediate session switch command /permission auto-approval.
  7. Provide a Settings → Auto Approval page, including the master switch, scope, trusted area editing, harmless/dangerous pattern tables, decision length limit, log switch, and recent decision records.
  8. Support mode: gated, mode: global, and mode: off.
  9. Support configuration items: trustedAreas, harmlessPatterns, dangerousPatterns, maxCommandChars, logDecisions, trustedHosts.
  10. When reading old configurations, it migrates the legacy enabled or requireTrustedPreset to mode.

Installation

Both of the following commands can install the plugin. The first installs from the npm registry, and the second installs from GitHub and suggests using <commit> for a fixed version.

dsh plugin --profile <profile> add dsh-auto-approval-plugin

dsh plugin --profile <profile> add github:StyxNether/dsh-auto-approval-plugin#<commit>

Here, <profile> and <commit> are both placeholders and need to be replaced with your own actual values during installation.

After installation, the plugin’s bundle patch will rewrite the complete permission preset table. When upgrading DSH, you need to keep it in sync with the table from @deepseek-ai/dsh-base; if the target row is missing, the patch will warn and skip.

Enabling

There are two ways to enable it:

  1. Immediate session switch:
/permission auto-approval
  1. Set default values for future sessions: Go to General settings → Permission and set the default tier to auto-approval.

You can also configure via the Settings → Auto Approval page. This page contains:

  • master switch: The master switch
  • scope: Scope, optional Only when the session tier is Auto Approval or Globally, regardless of the session tier
  • trusted areas: Trusted zones
  • harmless/dangerous pattern tables: Harmless/dangerous pattern tables
  • decision length limit: Decision length limit
  • log switch: Log switch
  • recent decisions: Recent decisions

Changes to Web settings are written to the auto-approval section of settings.yaml and take effect immediately.

If mode is off, the Auto Approval tier will behave like Workspace Write: the tier remains visible, but it will not automatically approve any requests.

Typical Configuration

The mode defaults to gated after installation, with the following meanings:

  • off: Disable auto-approval
  • global: Auto-approve matching requests under any session tier
  • gated: Auto-approve matching requests only when the current session tier is auto-approval

trustedAreas is empty by default. This means that trusted zone auto-approval will not take effect before paths are added.

Basic combined configuration can be written in the profile’s composition file:

~/.dsh/profiles/<profile>/cordis.patch.yml

Example structure:

- id: auto-approval
  config:
    # Defaults to gated after installation
    mode: gated

    # List of absolute paths for trusted zones; empty by default means trusted zone auto-approval is not enabled
    trustedAreas: []

Other verified configuration items include:

harmlessPatterns
dangerousPatterns
maxCommandChars
logDecisions
trustedHosts

Where:

  • harmlessPatterns: Used to match harmless commands or operations
  • dangerousPatterns: Hand over to human confirmation after matching; the plugin does not reject
  • maxCommandChars: Decision length limit
  • logDecisions: Decision log switch
  • trustedHosts: Controls non-loopback hosts allowed to access the configuration HTTP API; loopback is always allowed, cross-site requests are rejected

How Auto-Approval Works

The following flow corresponds to the processing order of the plugin on the approval/request path:

  1. DSH initiates the request needing approval.
  2. The plugin’s prepend listener runs before the Web approval prompt.
  3. The plugin finds the tool/call event recorded in the session log via callId.
  4. The plugin reads real tool arguments instead of the model’s justification.
  5. The decision module determines if the request is allow or defer.
  6. If it is allow, return allowed-once; the request will not enter the human confirmation UI.
  7. If it is defer, call next() to let the human approver in the deployment decide.

Note that auto-approval is not a permanent authorization. The DSH sandbox still constrains all non-elevation calls; a single auto-approved call simply allows that specific call to run in a wider mode as requested, while the session’s standing tier remains unchanged.

Applicable Scenarios and Notes

This plugin is suitable for scenarios where you have accepted the DSH human approval cost but wish to reduce repetitive confirmations for a few verifiable requests. It is not a security boundary, but a scope control: it only automatically approves a narrower, verifiable category of requests and automatically completes the approval step for the human.

Notes before use:

  1. Do not use it on machines or sessions where you are unwilling to trust a human operator to execute commands.
  2. The plugin does not reject requests; non-auto-approved requests will continue to go through human confirmation.
  3. trustedAreas is empty by default, so trusted zone auto-approval will not take effect before trusted zones are added.
  4. trustedHosts affects non-loopback access to the configuration HTTP API; confirm the source host before modifying.
  5. As a DSH plugin, it runs with DSH and may cause a specific call to execute in a wider mode; it is recommended to check the source code and MIT license before installing.
  6. When upgrading DSH, check if the bundle patch is synchronized with the permission preset table from @deepseek-ai/dsh-base.

Links

  • Directory page: https://www.skillhub.cn/plugins/StyxNether/dsh-auto-approval-plugin
  • GitHub: https://github.com/StyxNether/dsh-auto-approval-plugin