Preface

In DSH Auto sessions, tool calls often require approval. Existing approaches usually rely on the workspace-write sandbox and privilege escalation approval to maintain execution boundaries; dsh-autogate adds two permission tiers—auto-ask (semi-automatic) and auto (fully automatic)—on top of this, with the goal of reducing manual approval rather than relaxing the sandbox.

Below is an introduction to the plugin’s positioning, decision mechanism, installation method, configuration options, and security boundaries to be aware of.

What is this

wangxing-git/dsh-autogate is an automatic approval plugin for DeepSeek Harness maintained by wangxing-git.

Its one-sentence positioning is: adding “semi-automatic (auto-ask) + fully automatic (auto)” two tiers of permissions on top of the workspace-write sandbox, adopting a layered decision-making mechanism of “deterministic rules + LLM security approval + (in semi-automatic mode) proactive human approval from the rejected party”. It preserves the workspace sandbox boundaries and does not relax them to full-access.

Core Mechanism

L0 Deterministic Rules

The L0 layer performs zero-cost allow/deny judgments, independent of LLMs.

Verified capabilities cover the following scenarios:

  • Read-only operations
  • Session state
  • Editing and deletion within the workspace
  • build/test
  • run_code container

The role of this layer is: for calls that can be directly judged by rules, let the rules judge first to avoid entering LLM approval every time.

L1 LLM Security Approval

The L1 layer targets operations that are not intercepted by the sandbox but are semantically dangerous, performing allow/deny adjudication via the LLM.

This layer does not change the sandbox boundaries of ordinary calls: ordinary calls remain workspace-write, and L0/L1 decisions do not relax the sandbox.

L2 Human Approval or Final Adjudication

The L2 layer corresponds to the human safety net.

The difference between the two modes lies mainly in L2:

  • auto-ask: Semi-automatic mode, retaining the manual popup.
  • auto: Fully automatic mode, where the LLM decision is final.

Security Policy

fail-closed

The plugin adopts a fail-closed strategy: classification errors, timeouts, no route, or format errors are all rejected.

This means that when the LLM classifier is unavailable, it will not pass through by default, but will tend to reject to reduce false positives.

Input Sanitization and Tag Isolation

Classifier inputs undergo sanitization and are isolated using <untrusted> / <user-authority> tags, along with built-in injection defense.

This is a soft defense at the prompt injection level; it can raise the threshold for injection but cannot completely eliminate injection risks.

Non-Auto Session Behavior

Non-Auto sessions are passed through as-is, without changing official behavior.

Approval Trail

The approval trail UI injects into the shell.overlay slot.

Verified trail capabilities include:

  • Displaying the last 50 records
  • Isolated by session
  • Polling the trail RPC every 2 seconds

Setting showTrail: false hides the approval trail floating window in the bottom right corner and stops polling the trail RPC; server-side trails will still be recorded.

Trails are process-level and stored only in memory; they are cleared when dsh restarts and are never persisted.

Installation

Before installing, please confirm: the plugin runs with the permissions of the current dsh process, and you should check the source code and license before installing. The materials do not explicitly state the license field, so you need to confirm it yourself in the repository.

  1. Install from GitHub:
dsh plugin --profile web add github:wangxing-git/dsh-autogate
  1. If dsh is not in PATH, you can use:
npx @deepseek-ai/dsh plugin --profile web add github:wangxing-git/dsh-autogate
  1. Restart dsh.

Configuration

Configuration is written to the autogate section of $DSH_HOME/settings.yaml by the DSH settings service and supports hot reload. If the settings service is not mounted, it falls back to the entry config in cordis.patch.yml.

Basic example:

autogate:
  preflight: false
  presetName: auto-ask
  fullAutoPresetName: auto

Explanation of each configuration item:

  • preflight: Default false. When set to false, skip pre-sandbox ordinary deterministic rules + LLM classification; hard denies and approval request pre-screening still take effect. When set to true, intercept before restoring the full sandbox.
  • presetName: Preset key for semi-automatic mode, default auto-ask.
  • fullAutoPresetName: Preset key for fully automatic mode, default auto.
  • showTrail: When set to false, hides the approval trail floating window in the bottom right corner and stops polling the trail RPC; server-side trails will still be recorded.

You can also read/write official settings API (the describe / mutate of ctx.connection.api.settings) via DSH settings cards; the approval trail panel is fetched via the trail endpoint of the /autogate RPC.

Use Cases and Considerations

Suitable for scenarios in DSH Auto sessions where you want to reduce manual approval while retaining the workspace-write sandbox boundaries.

You need to pay attention to the following limitations:

  1. This plugin is the “decision layer for reducing manual approval,” not a security boundary. The true execution boundary remains the DSH workspace-write sandbox and its privilege escalation approval.
  2. The L1 LLM classifier is heuristic and may make mistakes. fail-closed can reduce false positives but cannot eliminate misjudgments.
  3. Prompt injection defense is a soft defense; it can raise the injection threshold but cannot completely eliminate it.
  4. Static path checks have a TOCTOU window: symbolic links may be re-pointed after the check passes but before the write.
  5. In fully automatic auto mode, the LLM decision is final and there are no manual popups; it is only recommended for trusted environments.
  6. The L2 escalation path is a one-time relaxation: after the LLM approves the elevation, that call runs with the requested wider sandbox (usually full-access).
  7. Approval trails are only saved in the current process’s memory; they are cleared when dsh restarts and are never persisted.
  8. package.json shows version 0.2.0, engines node >=22.19.0, platform web.

Links

  • GitHub: https://github.com/wangxing-git/dsh-autogate
  • Community Directory Page: https://www.skillhub.cn/plugins/wangxing-git/dsh-autogate