Introduction

In the plugin-based usage of DSH, a specific challenge is handling approvals. When a session’s approval policy is set to 'auto', should sandbox escalation beyond workspace-write still require a manual prompt?

dsh-auto-review provides an approval answerer. It uses a deterministic filter to handle commands that are explicitly allowed or denied, followed by a clean-context LLM safety review for requests in the gray zone, enabling these approval judgments to be completed without a manual prompt.

What is this

accpowered/dsh-auto-review is an LLM auto-review approval answerer plugin for DeepSeek Harness, licensed under the MIT license.

It targets sessions where the approval policy is 'auto', addressing the automatic approval problem for sandbox escalations beyond workspace-write. The plugin integrates as an answerer to approval/request, providing automatic judgments when conditions are met and delegating to the original chain when they are not.

Core Capabilities

Deterministic Filtering

The plugin executes a deterministic filter first:

  • hardline rules are always-deny.
  • Apply deny and allow regex rules to the normalized command.
  • Immediately deny if hardline or deny is hit.
  • Immediately allow if allow is hit.
  • Only proceed to LLM review if neither deny nor allow is hit.

Deterministic denials are final results and cannot be overturned by an appeal.

Clean-context LLM Safety Review

Requests in the gray zone enter a clean-context LLM safety review.

The content sent to the reviewer only carries:

  • tool name
  • justification
  • XML-wrapped command

No full session context is carried.

Appeal Mode

The default appeal mode allows using real user prompts to re-evaluate an LLM-given DENY.

This mechanism can only loosen denials, not tighten allowances. It is used to reduce false positives, not to expand sandbox permissions.

Registration and Delegation

The answerer is registered on approval/request with { prepend: true}, so it runs before subsequent human/machine answerers.

It delegates to next() when any of the following occurs:

  • The current effective policy is not 'auto'
  • The request has no action

Consecutive Denial Protection

The plugin supports a consecutive-denial circuit breaker, configured via denialBreakerThreshold.

User-level Overrides

The plugin provides user-level live overrides for the auto-review settings namespace, allowing adjustment of some overridable configurations at the user level.

Installation and Enablement

First, confirm that the harness core has been patched. This plugin cannot run on the stock upstream deepseek-harness; on a vanilla upstream without a patch, the plugin will remain inert and delegate to normal human answerers.

Install from GitHub:

dsh plugin --profile web add github:accpowered/dsh-auto-review

Install from a local checkout:

dsh plugin --profile web add ./dsh-auto-review

During installation, pnpm may ask for allowBuilds. This is build permission for installation; it is recommended to only allow trusted sources and prioritize fixed commits.

After installation, restart dsh web or the corresponding profile.

Configuration

The plugin uses the reviewer’s provider and model. To switch to a different reviewer, you need to override the corresponding row in cordis.patch.yml and fill in the required provider and model.

By design, hardline, maxTokens, and timeoutMs can only be set via the composition layer. User-level overridable configurations take effect through the auto-review settings namespace.

Uninstallation

dsh plugin --profile web remove dsh-auto-review

Use Cases and Considerations

Suitable for developers or administrators who run DSH profiles, wish to reduce manual approval interruptions, and are willing to maintain a patched harness core.

Considerations before use:

  • The plugin depends on a patched harness core; it will not make automatic decisions if unpatched.
  • The plugin loads and executes within the dsh process, so it runs with the permissions held by the current dsh process.
  • It is recommended to check the source code, dependencies, and license before installation.
  • Deterministic denials are final; operator policy cannot be appealed.
  • An appeal can only loosen a denial, not tighten an allowance.
  • The reviewer is a defense-in-depth measure, not a sandbox-widening mechanism.

Links

  • Plugin Directory: https://www.skillhub.cn/plugins/accpowered/dsh-auto-review
  • GitHub: https://github.com/accpowered/dsh-auto-review