Introduction

When running agents with DeepSeek Harness (DSH), local code changes can be rolled back using worktrees and file checkpoints. However, the agent’s writes to the external world have no corresponding “undo”: once an issue comment, an email, a deployment, or a payment is sent, it cannot be retracted.

The Cordis paper behind DSH offers two approaches for this boundary: holding output until commit, or defining compensation logic for each domain. dsh-action-outbox implements the former—it does not actually call the target tool during the staging period, submits in a single batch after manual review and approval, and does not pretend that unrelated external systems share an atomic transaction. Below is an introduction to the positioning, usage, and configuration of this plugin.

What is this

dsh-action-outbox is a DSH plugin, current version 0.3.0, MIT license, maintained by JimchengChina. One-sentence positioning: DeepSeek Harness tool-side-effect persistent batch review inbox—staging exact calls, checking or editing full canonical JSON, and submitting immutable batches in a single transaction after approval.

The package itself is a DSH bundle, activated via cordis.patch.yml. The browser-side only contributes two slots: the official sidebar.footer.action and shell.overlay, without intruding into other UI.

Core Features

  • Batch Review Inbox in the DSH Web Sidebar: Displays full parameters, per-action byte counts, tool source, tool fingerprints, and action hashes, with support for copying and downloading.
  • Zero Target Dispatch during Staging/Editing: Only updates bounded local state; it does not call the target tools.
  • Review re-parses real-time policy, tool identity, schema, and parameters, returning a SHA-256 digest plus a one-time approval nonce; the commit accepts only this combination.
  • action_outbox_replace allows editing staged tools/parameters/summaries, and any edit invalidates the old digest, nonce, review, and approval.
  • Fail-closed handling for long reviews: A truncated approval card cannot authorize submission on its own; the user must explicitly confirm the full Inbox view.
  • Persisted pending batches: State file permissions are 0600; upon restart, drafts become needs_reapproval, requiring re-verification against the current policy/tool/schema and issuance of a new nonce.
  • Crash-safe commit recovery: Loss of the committing process transitions to recovery_required; actions without a persistent success receipt are marked as ambiguous, and are never retried automatically.
  • Built-in “Copy safe demo prompt” guided path; separation of active/history, expired batches do not enter the pending badge, but evidence is retained for viewing or discarding.
  • TOCTOU protection and change revocation: stage, unstage, and replace clear all previous reviews, confirmations, and nonces; restarts never auto-commit and never reuse nonces.
  • Configurable tool scope and parameters: Control storable and outbox-enforced tools via include/exclude/enforce wildcards, along with options like requireApproval, rejectDuplicateActions, persistPending, stateFile, maxPendingMs, maxActions, maxArgumentBytes, resultPreviewChars, and approvalPreviewChars.

Installation and Activation

Runtime environment: engines require Node ^22.19.0 || >=24.0.0; peer dependencies are @deepseek-ai/dsh-tools >=0.1.0-rc.6 <0.2.0, @deepseek-ai/schemastery ^3.18.1, and react ^18.2.0.

It is recommended to install the pre-built tarball without build-time permissions:

curl -LO https://github.com/JimchengChina/dsh-action-outbox/releases/download/v0.3.0/dsh-action-outbox-0.3.0.tgz
npx @deepseek-ai/dsh plugin --profile web add ./dsh-action-outbox-0.3.0.tgz

You can also install a Git source with a specific tag. Git installation executes the package’s prepare build; for pnpm 10 and above, you need to add the dsh-action-outbox package key to the profile’s pnpm-workspace.yaml allowBuilds as per DSH error prompts and retry. Fixed tags can avoid branch updates silently changing installed code:

dsh plugin --profile web add github:JimchengChina/dsh-action-outbox#v0.3.0

Local checkout can also be added directly:

dsh plugin --profile web add ./dsh-action-outbox

For the first run, it is recommended to use the built-in demo path: open Outbox, click “Copy safe demo prompt”, and paste it into a new DSH chat. The demo will stage a single no-clobber file write under /private/tmp, stop after Review, and does not initiate network requests.

Typical Usage

The agent-side workflow is fixed to seven steps:

1、action_outbox_begin({ label })
2、action_outbox_stage({ tool, arguments, summary? })，一或多次
3、可选：action_outbox_unstage({ action_id }) 或
   action_outbox_replace({ action_id, tool?, arguments?, summary? })
4、action_outbox_review()
5、在 Batch Review Inbox 检查完整批次；如批准卡片被截断，在 Inbox 中确认完整视图
6、Inbox 编辑后点击 Run fresh review；批次 reviewed 后按钮替换为
   Next: copy exact commit prompt，复制并粘贴到聊天提交
7、action_outbox_commit({ expected_digest, approval_nonce }) 或 action_outbox_discard()

There are two points prone to error. First, reviews in the Inbox do not enter chat history; do not just tell the agent “use the latest review”—the model’s latest review might be the result of an earlier action_outbox_review tool in the chat history. Either paste the exact commit prompt given by the Inbox, or let the agent call action_outbox_review and submit immediately using the credentials returned by that call. Second, before commit starts, discard ensures that no staged target actions have run; every change produces a different authorization state, even if the caller still holds the old digest or nonce.

Configuration

Plugin behavior is controlled by configuration items in the profile; below is an example covering the main options:

- id: action-outbox
  name: dsh-action-outbox
  config:
    include: ['github_*', 'slack_*', 'deploy_*']
    exclude: ['github_get_*', 'github_list_*']
    enforce: ['github_create_*', 'github_update_*', 'slack_send', 'deploy_*']
    requireApproval: true
    rejectDuplicateActions: true
    persistPending: true
    stateFile: ''
    maxPendingMs: 1800000
    maxActions: 20
    maxArgumentBytes: 65536
    resultPreviewChars: 2000
    approvalPreviewChars: 4000

Meaning of each field:

  • include: Wildcard patterns for tools allowed to be staged.
  • exclude: Exceptions that apply to both staging and enforcement.
  • enforce: Tool patterns that reject direct calls and force the outbox route; defaults to empty for compatibility.
  • requireApproval: Requires a single approval for the exact reviewed digest/nonce; without an approval service, commit will fail closed.
  • rejectDuplicateActions: Rejects duplicate “target name + arguments” combinations; replace is also checked.
  • persistPending: Persists bounded drafts and recovery receipts; enabled by default.
  • stateFile: Optional absolute or relative path override; if empty, defaults to $DSH_HOME/action-outbox/state.json, or ~/.dsh/action-outbox/state.json when DSH_HOME is unset.
  • maxPendingMs: Pending batches expire if they exceed this millisecond count; 0 means expiration is disabled.
  • maxActions / maxArgumentBytes: Constrain the size of persisted state.
  • resultPreviewChars: Constrain the length of the result receipt shown to the model.
  • approvalPreviewChars: Upper limit for the compact approval card; if exceeded, commit requires confirmation from the full Inbox. For headless/TUI deployments without an Inbox, this must be raised high enough to display the full review, otherwise it will correctly fail closed.

* is the only wildcard; all other regex characters are treated literally.

Applicable Scenarios and Notes

Suitable scenarios: agents need to write to external systems (comments, emails, deployments, payments, etc.) and want someone to review the full batch before execution; or want to accumulate multiple calls into one batch, approve once, and dispatch them sequentially through the DSH tool pipeline.

Note three points before use:

  1. enforce defaults to empty; when requireApproval is enabled without an approval service, commit will fail closed. This is expected behavior, not a bug.
  2. The restart protocol is one-way: reviewed becomes needs_reapproval after restart; committing crashes become recovery_required; pending calls are marked as ambiguous; restarts never auto-commit, never reuse nonces, and never retry automatically.
  3. The plugin runs with the current DSH process permissions; ensure you check the source code and license (MIT) before installing.

Conclusion

Let’s review the value of this plugin: it transforms “external writes” from “fire and forget” into a batch process that is reviewable, revocable (before commit), and recoverable—zero dispatch during staging, digest plus one-time nonce authorization, 0600 state file persistence, and recovery_required after crashes without blind retries. If your agent touches external systems, it is worth adding this workflow path.

Plugin directory page: https://www.skillhub.cn/plugins/JimchengChina/dsh-action-outbox （独立社区目录，与 DeepSeek / 幻方无官方从属关系）；源码与 README：https://github.com/JimchengChina/dsh-action-outbox 。