Introduction

In DSH’s agent workflow, the approval card is responsible for controlling high-risk operations. When default permissions remain workspace-write + ask, the Agent prompts for approval every time it encounters a high-privilege request. For multiple similar requests within the same task, repeated confirmation increases operational overhead; however, directly opening global high permissions easily exceeds the scope required by the current task.

dsh-turn-approval adds a task-level authorization entry for the DSH Web approval card: After clicking “Allow this task”, subsequent explicitly matched danger-full-access upgrades within the current turn are automatically allowed; the authorization disappears after turn/end.

What is it

dsh-turn-approval is a DeepSeek Harness (DSH) community plugin, repository is arrow949/dsh-turn-approval, License is MIT.

It adds an “Allow this task” button to the DSH Web approval card, used to temporarily allow specific types of high-privilege upgrades within a single turn. It does not change DSH’s default permission model, nor does it switch the entire session to full access.

Core Features

By default, DSH permissions remain workspace-write + ask. When the Agent requests danger-full-access, the approval card provides three choices:

[Reject] [Allow once] [Allow this task]
  • Reject: Reject the current operation.
  • Allow once: Only allow the current operation.
  • Allow this task: Subsequent explicitly matched danger-full-access requests within the current turn are automatically allowed; authorization automatically expires after turn/end.

Key constraints of this plugin are as follows:

  • Authorization is only stored in memory and not written to disk.
  • Authorization is bound to session + turn; authorization for one session does not affect another.
  • Child agents use a separate session and do not inherit this authorization.
  • Only automatically allow explicitly matched danger-full-access upgrades; workspace-write and other approvals are still asked for one by one.
  • grant can only be established by the approval card button; the model has no entry point to enable task authorization on its own.
  • Automatic approval still retains a complete record of approval events.
  • Only supports DSH Web; the headless profile has no UI entry point, and the task authorization endpoint will not be registered.

Installation and Activation

When installing from GitHub, the command uses the <commit-sha> placeholder; verified sources do not provide a specific SHA, please confirm the commit you want to pin before replacing:

dsh plugin --profile web add github:arrow949/dsh-turn-approval#<commit-sha>

The package is pure ESM JavaScript of the submitted build artifact. No prepare script or pnpm allowBuilds permission is needed when installing from GitHub.

After installation, execute the following steps:

  1. Restart DSH Web.

  2. Hard refresh in the browser:

Ctrl+Shift+R
  1. Check if the approval card shows the third button “Allow this task”. If it appears, the plugin is loaded.

You can also check if the current profile has the plugin layer mounted:

dsh --profile web --dump-config

Typical Usage

  1. Use DSH normally, keeping permissions at workspace-write + ask.

  2. When the Agent requests danger-full-access, first read the approval reason and command.

  3. If multiple similar high-privilege operations are needed within the current task, click “Allow this task”.

  4. Subsequent similar danger-full-access requests within the current task will be automatically allowed according to rules.

  5. After the current task ends, the next message will ask again item by item.

If the endpoint returns a non-2xx status or the network request fails, the card will explicitly indicate the failure and remain retryable; it will not pretend the authorization is established, nor will it silently downgrade to “Allow once”.

Security Boundaries

Authorization expiration is fail-closed. The following situations will cause task authorization to expire:

  • DSH process restart.
  • Plugin uninstallation.
  • session or agent is released.

It will not switch the entire session to full access. Authorization for one session does not affect another; child agents use a separate session and do not inherit authorization.

From the trigger entry point, grant can only be established by the approval card button. Even if authorized within the current task, the plugin will only automatically allow explicitly matched danger-full-access upgrades; workspace-write and other approvals are still asked for one by one.

Automatic approval still retains a complete record of approval events, allowing you to see relevant approval events during subsequent troubleshooting.

Implementation and Compatibility

The plugin is integrated as part of the DSH bundle: package.json declares dsh.bundle.patch, and cordis.patch.yml adds the plugin to the profile. The client half renders the approval card via the official conversation.composer chain slot with higher priority.

It does not modify any DSH official bundle files. After uninstallation, the Node half and client half will be removed together, and the approval card returns to the two default buttons of DSH.

The current appearance reuses the internal CSS class names of the official ApprovalPanel. If DSH changes the component structure or CSS module class names in the future, a compatible update may be needed.

Uninstallation

Uninstallation command:

dsh plugin --profile web remove dsh-turn-approval

No modifications to DSH official files will be left behind after uninstallation.

Conclusion

The value of dsh-turn-approval lies in splitting a finer granularity between “Allow once” and “Global open”: the current turn. It is suitable for scenarios where repetitive approvals need to be reduced in DSH Web, but the permission scope does not need to be expanded.

GitHub repository:

https://github.com/arrow949/dsh-turn-approval