Introduction

In DeepSeek Harness (dsh), agents typically encounter approval issues before executing tools: if the granularity is too coarse, low-risk operations repeatedly disturb humans; if it is too loose, high-risk commands might execute directly. dsh-codex-approval is a dsh plugin imitating the OpenAI Codex CLI approval model, aiming to introduce a finer decision chain at dsh’s approval answer points: first checking explicit rules, then delegating to AI for risk assessment, and finally relying on humans as a safety net.

Below is an introduction to the plugin’s positioning, core capabilities, installation method, configuration options, and usage precautions.

What is it

dsh-codex-approval is an AI automatic approval plugin for DeepSeek Harness (dsh), maintained by 040822, with an MIT license.

Its core goal is to implement an automatic approval decision chain on the dsh approval/request answerer seam:

  1. Rule Layer: Handle predictable commands or reasons according to explicit rules.
  2. AI Judgment Layer: Perform risk assessment for requests not hit by rules.
  3. Human Fallback Layer: Return requests that still cannot be decided automatically to humans.

The version in package.json is 0.2.2, the engines requirement is node >=22.19, and it depends on @deepseek-ai/schemastery ^3.18.1.

Core Capabilities

Rule Layer

The plugin supports automatic approval at the rule layer. Matching objects can be:

  • ToolName(args preview): e.g., Bash(git status*).
  • reason:<text>: e.g., reason:*credential*.

Each rule can specify an action:

  • allow: Auto-approve.
  • ask: Hand over to humans.
  • deny: Directly reject.

Rule priority is:

deny > ask > allow

This means that as long as there is an explicit deny rule, the AI layer cannot override this rejection result.

AI Judgment Layer

When a rule is not matched, the plugin can invoke AI to make a judgment on the approval request. The AI layer outputs:

  • risk: low, medium, high.
  • authorization: allow, ask, deny.

The final result is mapped to allow, ask, or deny based on riskTolerance. The AI output is only mapped to one of these three results and does not directly execute arbitrary commands.

By default, AI uses:

  • provider: opencode-go
  • model: deepseek-v4-flash

Before entering the AI prompt, the command text is truncated, with a default maxPromptChars of 2000.

Human Fallback Layer

The default human fallback behavior is ask, which means popping up a GUI to ask.

If the AI call fails, times out, or the output is unrecognizable, the plugin can return the request to humans based on the failOpen configuration. The default failOpen is ask.

Approval Modes

The plugin provides three approval modes:

  • manual: Completely bypass automatic decision-making, returning approval to humans.
  • ai: Process in the order of rules, AI, and human fallback.
  • ai-auto: Rules and AI are processed automatically; ask does not pop up a window, but is handled according to mode3OnAsk.

In ai-auto mode, mode3OnAsk defaults to deny, meaning when AI cannot auto-approve, it will not pop up a window but will instead reject. If mode3OnAsk is set to allow, the plugin will allow high-risk operations when AI cannot decide, use with caution.

Audit Logs

Every decision is written to a JSONL audit log, with the default path:

~/.dsh/logs/approval.jsonl

The log records information such as the tool name, command preview, reason, decision source, mode, risk, AI reasoning, and duration.

Built-in npm publish rules

The plugin includes built-in rules:

Bash(npm publish*) → ask

This means that when an agent executes npm publish, it requires asking a human by default, and AI has no authority to auto-approve.

Command Text Language

The plugin’s command text language supports:

  • auto
  • zh
  • en

auto follows the language preference set in dsh.

Installation and Enablement

First, confirm that the Node environment meets node >=22.19. Then execute:

dsh plugin --profile web add dsh-codex-approval

After installation, restart dsh web for the changes to take effect.

The plugin is only registered in the target profile; the web profile is recommended. Profiles like qqbot / headless are unaffected.

Configuration Example

Plugin configuration can be placed in:

~/.dsh/profiles/web/cordis.patch.yml

Add a config with id: dsh-codex-approval in the file, for example:

- id: dsh-codex-approval
  config:
    mode: ai
    mode3OnAsk: deny
    locale: auto

    rules:
      - match: 'Bash(git status*)'
        action: allow
      - match: 'Bash(rm -rf /*)'
        action: deny
      - match: 'reason:*credential*'
        action: ask

    ai:
      provider: opencode-go
      model: deepseek-v4-flash
      riskTolerance: medium
      maxPromptChars: 2000
      timeoutMs: 15000
      maxTokens: 512
      failOpen: ask

    fallback: ask
    logFile: ~/.dsh/logs/approval.jsonl

Configurable options include:

  • mode: Approval mode.
  • mode3OnAsk: How ask is handled in ai-auto mode.
  • locale: Command text language.
  • rules: Explicit rules.
  • ai: AI provider, model, riskTolerance, maxPromptChars, timeoutMs, maxTokens, failOpen.
  • fallback: Fallback action when no rules match and AI is disabled.
  • logFile: Audit log path.

Typical Usage

Switching Approval Modes at Runtime

You can use slash commands to switch the approval mode of the current session:

/approval-mode

View current mode.

/approval-mode 3

Switch to ai-auto.

/approval-mode default

Clear session overrides and fall back to configured defaults.

Session overrides are saved to:

~/.dsh/settings.yaml

The save location is the dsh-codex-approval namespace. If the settings service is unavailable, it will fall back to in-memory saving and will be lost after restart.

Configuring Rules

Example rules:

rules:
  - match: 'Bash(git status*)'
    action: allow
  - match: 'Bash(rm -rf /*)'
    action: deny
  - match: 'reason:*credential*'
    action: ask

The meanings are as follows:

  1. Bash(git status*): Read-only status check, auto-approve.
  2. Bash(rm -rf /*): High-risk deletion command, direct reject.
  3. reason:*credential*: Involves credentials, keys, and other sensitive reasons, hand over to humans for questioning.

Default Behavior Without Configuration

If no configuration is made, the plugin uses built-in defaults:

  1. Read-only commands are auto-approved.
  2. Destructive commands are directly rejected.
  3. Sensitive word scenarios ask humans.

Development and Testing

When developing or testing the plugin, you can run:

node --test

Applicable Scenarios and Precautions

This plugin is suitable for the following scenarios:

  1. Using the dsh web profile and hoping to reduce the disturbance of low-risk approvals.
  2. Wanting to configure explicit allow/ask/deny rules based on commands or approval reasons.
  3. Wanting AI to participate in risk assessment while retaining humans as a safety net.
  4. Needing JSONL audit logs to trace every approval decision.

Usage precautions:

  1. The plugin participates in dsh’s approval decisions; you should check the source code, license, and dependencies before installing.
  2. The plugin runs with the current dsh process permissions and should not be enabled arbitrarily in untrusted environments.
  3. deny rules are always evaluated first; AI has no authority to override explicit rejections.
  4. In ai-auto mode, if mode3OnAsk is set to allow, the plugin will allow high-risk operations when AI cannot decide; use with caution.
  5. In danger-full-access mode, the sandbox does not reject any operations, so approval requests do not occur, and the plugin remains idle.
  6. The cost of a single AI approval is approximately 0.3 to 0.7 cents (official price estimate) and is only incurred when a rule is not matched and AI needs to be called.

Related Links

  • GitHub: https://github.com/040822/dsh-codex-approval
  • Plugin Directory Page: https://www.skillhub.cn/plugins/040822/dsh-codex-approval