Introduction

The DSH ecosystem emphasizes “everything is a plugin.” In some automated workflows, interactive approval is a practical bottleneck: when an agent needs to expand its sandbox, DSH might pop up allow / deny prompts for human review; if the workflow desires unattended operation, a clearly defined pre-approval path is needed.

dsh-approval-guardian is a DeepSeek Harness (DSH) bundle designed for this specific point: it claims only strict sandbox escalation approvals, hands these requests to a one-shot approval-reviewer agent, and applies its structured allow or deny.

It needs to be noted: The community directory is an independent site with no official affiliation to DeepSeek / Hypersphere; this article does not describe it as an official app store.

What is it

The positioning of dsh-approval-guardian is as a DSH profile bundle: it intercepts real sandbox escalation prompts and routes them to a dedicated approval reviewer.

The core problem it solves is: during automated execution, when an agent needs to expand the sandbox, it might originally require human confirmation; this plugin only handles strict sandbox escalations related to the current tool execution; other requests continue to be handed to the downstream answerer.

Verified information includes:

  • Repository: https://github.com/karuboniru/dsh-approval-guardian
  • Directory page: https://www.skillhub.cn/plugins/karuboniru/dsh-approval-guardian
  • License: MIT
  • Maintainer field: The verified information does not provide the author/maintainer fields in package.json, so this article does not describe karuboniru in the repository path as a confirmed maintainer.

Core Capabilities

Below is an introduction to the verified routing boundaries. A single tool execution will fall into one of three cases:

  1. The operation is executable within the current sandbox mode: The plugin does not intervene.
  2. The approval is not issued by the current tool execution, or it is not strict widening: The plugin calls the downstream answerer, preserving DSH’s original behavior.
  3. A strict sandbox escalation that is precisely related to the current tool execution: The plugin launches a new one-shot approval-reviewer agent and applies its structured allow or deny.

Result injection method:

  • After the reviewer completes, the result is queued via deferContext and injected after the matching tool/result.
  • The plugin is registered via dsh.bundle.patch in package.json, pointing to cordis.patch.yml.

Failure modes:

  • failureMode supports fail-closed and fallback-to-user.
  • fail-closed: Returns unavailable when the reviewer times out, is unavailable, or produces invalid output.
  • fallback-to-user: Hands the request back to the downstream answerer only when the reviewer fails.
  • An explicit deny is the final decision and does not fall back to the user in either mode.

Installation and Enablement

First, confirm the runtime environment:

  • Node.js: ^22.19.0 or >=24.0.0
  • pnpm
  • peer packages: @deepseek-ai/cordis ^4.0.1, and DSH packages ^0.1.0-rc.5
  • Verified against DSH CLI 0.1.0-rc.6

Install published package:

dsh plugin --profile <profile-name> add dsh-approval-guardian@0.1.1

This step registers the plugin to the specified profile. The plugin points to cordis.patch.yml via dsh.bundle.patch in package.json; restart the DSH surface after installation to load it.

If installing from a local checkout:

pnpm install
pnpm run build
dsh plugin --profile web add .

Git installation executes the prepare script. pnpm 10+ may require allowing this package to run build scripts in the pnpm-workspace.yaml of the target profile.

Upgrade:

dsh plugin --profile <profile-name> add dsh-approval-guardian@<new-version>

Disable: Set id: approval-guardian to disabled: true in the profile’s cordis.patch.yml, then restart:

- id: approval-guardian
  disabled: true

Remove:

dsh plugin --profile <profile-name> remove dsh-approval-guardian

If a profile-level override was added previously, also remove the corresponding approval-guardian block, then restart.

Typical Usage and Configuration

Can be used immediately after minimal installation. To customize deployment strategies, override the same id in the profile’s cordis.patch.yml. Verified configuration points include:

  • prompt: Can carry deployment-specific security policies; if it contains internal rules, do not put it in a public repository.
  • provider and model: Must be provided together or omitted together; providing only one is a configuration error, and the plugin will refuse to start.
  • failureMode: Choose fail-closed or fallback-to-user.
  • Model provider credentials are managed by DSH’s model routing; this plugin does not have plugin-specific environment variables.

Example configuration (only listing verified fields):

- id: approval-guardian
  config:
    prompt: |
      - Deny operations that touch protected paths unless the user explicitly names them.
    provider: <provider-id>
    model: <model-id>
    failureMode: fail-closed

Note: The prompt, provider, model, and failureMode in the example all belong to configuration items appearing in verified data; the placeholder values in the example need to be replaced according to the deployment environment.

Use Cases and Notes

Suitable for:

  • Avoiding human pop-ups for strict sandbox escalation approvals in automation.
  • Teams that want the reviewer to use structured allow/deny with a clear fallback on failure.
  • Scenarios where only pre-approval strategies are applied to genuine sandbox widening requests, without replacing general approval policies.

Notes:

  • Do not expect it to handle ordinary operations executable within the sandbox; these operations do not enter this process.
  • Approvals that are not strict or not related to the current tool execution will continue to the downstream answerer.
  • The plugin runs with the current dsh process permissions; check the source code, license, and dependency versions before installation.
  • prompt may contain internal security rules and should be avoided in public repositories.
  • The Permissions & data section in the verified README is truncated, and full data reading behavior is unconfirmed; please verify the source code and runtime logs yourself before use.
  • dsh-approval-guardian is not a general approval-policy replacement; it only claims genuine sandbox widening requests, and other requests are handed to the downstream answerer.

Conclusion

The value of dsh-approval-guardian is quite specific: routing strict sandbox escalation approvals that actually appear in DSH to a one-shot reviewer, while keeping the structured allow/deny and failure fallback boundaries clear. It is suitable for DSH profiles that require unattended, explainable approval paths, and also for teams that want to retain the original interactive answerer as a fallback.

Directory page:

https://www.skillhub.cn/plugins/karuboniru/dsh-approval-guardian

GitHub:

https://github.com/karuboniru/dsh-approval-guardian