Preface

The pluggable usage model of DSH (DeepSeek Harness) allows security controls to be integrated into the web or cc-tui profile. dsh-auto-review is the native security review plugin for DSH: it performs local rule interception before execution and performs a read-only sub-agent review upon delivery.

It separates the handling of “whether the permission allows the action” from “whether the content should be allowed,” avoiding the direct skipping of content review simply because full access is granted.

What is this

dsh-auto-review is a DSH security review plugin released by maintainer AtropinolTT, licensed under MIT and categorized as admin-security.

Its core positioning is:

  • Intercept high-risk tool invocations before action execution
  • Perform independent review upon change delivery
  • Provide a session-level Auto Mode that is enabled by default
  • Remain orthogonal to the DSH permission system

The plugin is declared as an ESM package: type: module, with the entry point at lib/index.js, and declares dsh.client.inject for the web platform.

Core Capabilities

Pre-execution Local Rule Interception

dsh-auto-review performs local rule checks before the following actions are executed:

write
edit
str_replace_editor
bash
read

When a rule is hit, the plugin triggers a review confirmation; the default result is a rejection, i.e., fail-closed.

The meaning of default rejection is: before the review conclusion is clear, the plugin will not allow these actions by default.

Delivery-time Independent Read-only Review

Upon delivery of a change, the plugin performs an independent review of the change by a brand new read-only sub-agent.

This sub-agent only uses the following capabilities:

read
grep
glob

Review results are categorized as follows:

  • Clean: reports clean
  • High-severity issues: asks for fix / ignore, defaulting to fix
  • Review interrupted or unparseable: does not report clean

The key constraint here is: once the review process is interrupted, or the result is unparseable, the plugin will not mark that review as clean.

Auto Mode and Permission Boundaries

Auto Mode is a session-level switch that is enabled by default and persists across restarts.

/security auto off only affects the current session.

The permission system answers “can the agent perform this action”; Auto Mode answers “should this action be performed”.

Even if permissions such as full access or danger-full-access are granted, content review will not be disabled.

Web Status Presentation

In the web profile, a green auto status badge is displayed to the left of the input box to indicate the current state of Auto Mode.

This badge is for display purposes only and is not clickable.

Installation and Enablement

DSH (DeepSeek Harness) is required before installation. The plugin is a single ESM package requiring Node 18+.

The installation commands are as follows:

git clone https://github.com/AtropinolTT/dsh-auto-review.git
dsh plugin --profile web add /path/to/dsh-auto-review
dsh plugin --profile cc-tui add /path/to/dsh-auto-review

Here, /path/to/dsh-auto-review is a placeholder that needs to be replaced with the actual locally cloned directory.

To enable the green auto badge on the left side of the Web input box, you also need to add "dsh-auto-review" to:

~/.dsh/profiles/web/package.json

The specific field is:

dsh.profile.bundles

Restart after modification:

dsh web

Typical Usage

Manual Trigger Review

/review

/review is used to manually trigger a review, executed in the background.

View Plugin Status

/security

/security is used to view the plugin status, including:

  • Auto Mode
  • rules
  • review layer
  • high-severity threshold

Toggle Current Session Auto Mode

/security auto on
/security auto off

These two commands only affect the current session.

Configuration Fields

Plugin configuration is deeply merged from the config field of cordis.patch.yml.

The listed configuration fields include:

rules.enabled
rules.custom
review.mode
review.provider
review.highSeverity

Use Cases and Notes

Suitable for the following usage patterns:

  • Using the web or cc-tui profile in DSH
  • Need to separate content review from permission presets
  • Want default-reject local rules before action execution
  • Want independent read-only review upon change delivery
  • Want to avoid being falsely reported as clean when review fails

Notes before installation:

  • The plugin runs with the permissions of the current dsh process
  • Source code, dependencies, and the MIT license should be checked before installation
  • /security auto off only disables the current session and does not change the default enabled policy
  • High-severity issues default to requiring fix
  • When the review is interrupted or unparseable, it will not be reported as clean

Conclusion

The main function of dsh-auto-review is to turn security review into a default layer in DSH sessions: local rules with default rejection before execution, read-only sub-agent review after delivery, high-severity issues defaulting to requiring fixes, and review failures will not be falsely reported as clean.

GitHub repository:

https://github.com/AtropinolTT/dsh-auto-review

Directory page address (from plugin hints, not directly confirmed in current captured materials):

https://www.skillhub.cn/plugins/AtropinolTT/dsh-auto-review