Introduction

In DeepSeek Harness (DSH), tool calls such as bash, pwsh, write, and edit enter DSH’s approval/request waterfall. DSH itself continues to possess three access permissions: Read Only, Workspace Write, and Full access. dsh-smart-approval adds an independent auto-approval selector next to these, separating “whether access is allowed” from “whether a specific request should be automatically approved.”

dsh-smart-approval is a DSH plugin maintained by TingRuDeng, positioned as a “Fail-closed LLM-assisted approval reviewer for DeepSeek Harness”. The license is MIT.

Core Capabilities

The capabilities related to approval boundaries are introduced below.

  • In the Web interface, an independent auto-approval selector appears next to the access permission selector.
  • Supports three review modes: Manual approval, Smart approval (recommended default), and Unattended.
  • New sessions default to smart.
  • Auto-approval only handles requests that have already entered DSH’s approval/request waterfall; it does not expand current access permissions nor switch the session to Full access.
  • Switching review mode or access permissions takes effect on the next approval request; no need to restart DSH.
  • Uses closed adapters for bash, pwsh, write, edit; unknown tools fail closed.
  • The model classification only returns riskLevel, authorization, intent, and reasonCode; it cannot directly authorize.
  • Successful classification only generates allowed-once; similar requests in the next turn will still be re-evaluated.

What is Checked During Approval

  1. The plugin handles requests in DSH’s approval/request waterfall and uses closed adapters for bash, pwsh, write, edit. Unknown tools fail closed.

  2. Context uses the current turn and bounded recent direct-user text, removing descriptions and reasons written by the model.

  3. File changes use the DSH filesystem service to obtain read-only evidence, blocking final symlinks, canonical path aliases, malformed metadata, sensitive paths, and protected system locations.

  4. Deterministic checks cover credential material, destructive commands, system changes, background work, dependency installation, publishing, remote writes, uploads, and sensitive workspace/workdir conditions.

  5. The model outputs strict four-field classification: riskLevel, authorization, intent, and reasonCode. It cannot directly authorize, and successful classification only yields a one-time allowed-once.

Installation and Verification

First, confirm the environment:

  • Node.js 24 or later
  • DeepSeek Harness >=0.1.2-alpha.1 <0.2.0
  • pnpm on PATH

DSH accepts exact plugin versions. As of 2026-09-03, the README candidate installation uses:

dsh plugin --profile web add dsh-smart-approval@0.1.0-rc.11

After installation, dump the current profile configuration:

dsh --profile web --dump-config

The result should include the dsh-smart-approval bundle and the smart-approval plugin row. The access permission configuration should still only contain DSH’s native Read Only, Workspace Write, and Full access; after starting Web, the auto-approval selector should be displayed independently next to the access permissions.

Other Installation Methods

For one-time execution:

npx @deepseek-ai/dsh plugin --profile web add dsh-smart-approval@0.1.0-rc.11
npx @deepseek-ai/dsh --profile web --dump-config

Installing from a plugin checkout:

dsh plugin --profile web add .

Executing from a DeepSeek Harness source checkout:

pnpm dsh plugin --profile web add .
pnpm dsh --profile web --dump-config

Pin a reviewed GitHub commit:

dsh plugin --profile web add github:TingRuDeng/dsh-smart-approval#<commit-sha>

Note that npm dsh ... is not a valid npm command. Use dsh ... if already globally installed; use npx @deepseek-ai/dsh ... for one-time execution; use pnpm dsh ... from a DeepSeek Harness source checkout.

Build Permissions for Git Installation

Git dependencies will run the prepare build of this package. pnpm 10 and later block dependency build scripts by default. On the first Git install, add the exact package name to the allowBuilds in that profile’s pnpm-workspace.yaml as prompted by DSH, review the source, and retry. Registry packages already contain built output, so this permission is not needed.

Typical Usage

You can use the independent auto-approval selector in Web; you can also run commands in the current session:

/approval-mode manual
/approval-mode smart
/approval-mode unattended

View the current mode without arguments:

/approval-mode

View the auto-decision log:

/approval-log
/approval-log 30

/approval-log lists the latest 10 by default; specifying 30 lists the latest 30. Each line displays time, tool, outcome, reason code, and review mode; it does not include arguments or model output. Setting decisionLogSize: 0 disables the audit log.

Configuration

The current session route executes review by default. To use an independent route, override the plugin row in the profile’s cordis.patch.yml. Sessions not explicitly selected use defaultMode, which defaults to smart.

Use Cases and Notes

  • Suitable for developers who need to retain Manual approval, default Smart approval, or Unattended in DSH Web.
  • Both this project and DSH are in developer preview; in reproducible environments, exact versions should be pinned.
  • The plugin runs with the current DSH process permissions; you should check the source code, license, and version before installing.
  • Auto-approval does not expand DSH access permissions nor switch the session to Full access.
  • Unknown tools fail closed; deterministic checks and filesystem evidence block high-risk file paths and dangerous operations.
  • Audit logs only retain time, tool, outcome, reason code, and review mode; they do not retain arguments or model output.

Links

  • GitHub repository: https://github.com/TingRuDeng/dsh-smart-approval
  • Directory page clue (from plugin clue, not directly listed in README/package): https://www.skillhub.cn/plugins/TingRuDeng/dsh-smart-approval

The community directory is an independent site with no official affiliation to DeepSeek / SynthFlow.