Introduction

When running agents in DSH (DeepSeek Harness), tool calling approval easily falls into two extremes: confirming every call manually, or loosening permissions to reduce interruptions. The former affects efficiency, while the latter amplifies the risk of misoperation.

The following introduces dsh-tiered-approval. It is a tiered auto-approval plugin written for DeepSeek Harness (DSH), replacing the simple approaches of “full confirmation” or “full permission” with a three-layer adjudication of static rules, LLM review, and manual confirmation.

What is it

dsh-tiered-approval is a plugin for DSH written by Elaina-real, licensed under the MIT license. It solves the DSH tool calling approval problem: ensuring safe and recoverable calls reduce pop-ups, irreversible operations are blocked directly, and uncertain calls are handed over to manual confirmation.

It is not a standalone security system, but rather a security decision starting point within the DSH approval process. When using it, you still need to adjust rules based on your own threat model.

Core Mechanism

Static Rule Safety Net

The static rules layer is the first tier, characterized by high determinism and no model calls. The plugin includes a built-in dangerous command safety net and allows appending deny / allow regex rules.

For irreversible operations such as recursive deletion, formatting, force git pushing, writing to system directories, and killing processes, static rules will reject them directly upon match, without popping up a dialog or calling the model.

The goal of this layer is to block high-risk actions first, avoiding passing obviously dangerous calls to subsequent reviews.

LLM Reviewer

Calls that are not decided by static rules enter the second tier: the LLM Reviewer.

The reviewer judges the tool call, with results being allow, deny, or ask. The review frame will include the most recent user message, used to assist in judging whether the call aligns with user intent.

If the reviewer is unavailable or returns ask, the flow enters the manual fallback.

Manual Fallback and Convenience Mode

The manual fallback handles uncertain calls by popping up a native confirmation dialog for the user to decide.

The plugin also provides two configurable items:

  • autoApproveAligned: When the review result is allow and the user command is highly aligned with the call, it bypasses the pop-up and approves automatically.
  • alignDeny: For irreversible operations matched by static deny, if the user explicitly requests to do so, it can be downgraded to manual confirmation instead of being directly hard-rejected.

Review strength automatically follows the Access Selector, including read-only, workspace-write, and danger-full-access.

Installation and Enablement

The installation command is as follows:

dsh plugin --profile web add dsh-tiered-approval

After installation, you need to mount the plugin in cordis.patch.yml and then restart DSH. The minimal configuration is as follows:

# ~/.dsh/profiles/<profile>/cordis.patch.yml
- insert:
  - id: tiered-approval
    name: 'dsh-tiered-approval'

To verify the installation, run:

dsh --profile web --dump-config

Confirm that dsh-tiered-approval appears in the output.

Typical Usage

To test the static safety net, you can execute a command containing a dangerous recursive deletion. The example command is as follows:

Remove-Item ... -Recurse -Force

The expected result is that the call is rejected directly, and no manual confirmation dialog pops up.

To view review status during operation, use:

/auto-review status

You can see the decision count and recent decisions.

The upgrade and removal commands are as follows:

dsh plugin --profile web add dsh-tiered-approval@latest
dsh plugin --profile web remove dsh-tiered-approval

Configuration Key Points

Common configuration items include:

  • deny: Append hard reject rules.
  • allow: Append auto-allow rules.
  • answerer.allowModes: Elevation modes the approver is allowed to automatically approve.
  • answerer.allowJustifications: Regex patterns that allow auto-approval when a justification is matched.
  • answerer.denyJustifications: Regex patterns that automatically reject when a justification is matched.
  • autoApproveAligned: Convenience mode switch; bypass pop-ups and approve automatically when the review is allow and the user command is highly aligned.
  • alignDeny: For irreversible operations matched by static deny, downgrade to manual confirmation when the user explicitly requests it.

Review strength follows the Access Selector. If you switch to Full access, the preset will set the approval policy to never, at which point ask from the reviewer becomes a deterministic rejection. If you need to retain the manual fallback, do not switch to Full access.

Suitable Scenarios and Notes

Suitable for: DSH usage scenarios that want to reduce step-by-step confirmation but do not want to directly loosen all permissions. Especially suitable for scenarios requiring finer-grained approval judgments between read-only, workspace-write, and danger-full-access.

Pre-use cautions:

  • This is a product of pure vibe coding, has not undergone a security audit, is unrelated to DeepSeek officially, and comes with no guarantees.
  • Plugin code is in node_modules; HMR does not track changes; you must restart after modifying the code.
  • When review is enabled, the complete tool parameters and the most recent user message are sent to the review model; the review frame may contain sensitive text.
  • The plugin is a security decision starting point, not a trust boundary. Before installing, you should read lib/index.js, adjust rules according to your own threat model, and retain manual fallback for things that truly matter.
  • The Windows pwsh rule set has been tested; the POSIX bash rule set is theoretically compatible but untested.

Links

  • Project Directory: https://www.skillhub.cn/plugins/Elaina-real/dsh-tiered-approval
  • GitHub: https://github.com/Elaina-real/dsh-tiered-approval

The links above are the project release address and code repository address, and do not represent official recommendations or the official app store from DeepSeek.