Introduction

When running long tasks with DSH (DeepSeek Harness), the permission mechanism presents a dilemma: the default approval chain pops up confirmation dialogs for every tool call requiring confirmation, necessitating repeated manual intervention for long tasks; switching to danger-full-access is too permissive, questioning no calls.

dsh-auto-mode offers a middle ground: it introduces a new “Auto mode” preset in the permission selector, delegating tool calls that usually require manual confirmation to a review model. It automatically approves what it can, blocks suspicious ones, and prompts for confirmation when unsure. Below is an introduction to the usage and implementation of this plugin.

What is it

dsh-auto-mode is a DSH plugin by Nuo-cl, licensed under the MIT license, with the current version being 0.1.1. In the words of the README, it routes permission-gated tool calls through an LLM review before approving, blocking, or asking for confirmation.

It does not patch the DSH core service: the Auto mode preset is declared via a bundle patch in cordis.patch.yml, appearing alongside the built-in read-only, workspace-write, and danger-full-access presets in the permission selector.

How the decision chain works

After selecting Auto mode, the plugin registers an approval/request responder in prepend mode, taking over approval before the web UI responder. When a tool call arrives, it is processed in the following order:

  1. deny rules are evaluated first; a hit means rejection. The operator’s veto always takes priority.
  2. If allow rules are hit, it is directly approved.
  3. Pre-approved tools in the allowlist bypass the model and are directly approved. The default list is read, glob, grep, todo_write, web_search, job_list, list_agents.
  4. Remaining calls are handed to the review model, which gives one of three rulings based on conversation history and request content:
    • allow: direct approval;
    • reject: the reviewer judges the call as harmful or contrary to user interests, and rejects it;
    • ask: the call has significant impact but may align with intent (installing dependencies, writing outside the workspace, sending data, etc.), prompting a confirmation dialog with three choices—Allow, Reject, or Reject and specify how to handle. The input text is directly injected into the session and visible in the next model call.

When the review model fails to produce a ruling (API error, abort, truncation), the behavior is configurable: if failClosed is set to true, it rejects; otherwise, it falls back to the normal approval chain. Additionally, the ask confirmation dialog requires questions provider support; without it, it falls back to the normal approval chain.

The plugin also masks the core approval:policy system prompt context by agent, causing the auto mode session to be reported to the model as “auto” rather than “ask”. It also clarifies the phrasing “User rejected” in tool results as a reviewer ruling rather than a manual veto.

Rule Syntax

tool            Matches tools by name (case insensitive), e.g., read
tool:pattern    Matches tools where the request reason contains a specified pattern, e.g., read:/etc/, pwsh:rm -rf
*               Any tool
*:pattern       Any tool where reason contains a specified pattern

There are two types of matching:

  • Patterns containing * or ? are wildcard matching of the entire reason, e.g., read:/etc/*;
  • Other patterns are case-insensitive substring matching, e.g., read:/etc/.

Installation & Enabling

Standard installation command:

dsh plugin --profile web add dsh-auto-mode@<version>

If installing from locally checked out code, first add the following to the dependencies in C:\Users\<you>\.dsh\profiles\web\package.json:

"dsh-auto-mode": "file:E:/Project/Interests/dsh-auto-mode"

and add "dsh-auto-mode" to dsh.profile.bundles, then execute:

pnpm install --dir C:\Users\<you>\.dsh\profiles\web

After installation, restart the web application. The Auto mode will appear in the permission selector (bottom left of the chat box). Typing /auto allows you to directly switch the current session to Auto mode.

Configuration Options

All options have default values; an empty {} configuration is valid:

  • classifier.provider / classifier.model: Review model routing, default ''; if empty, it follows the session’s current model;
  • classifier.maxTranscriptMessages: Number of conversation records sent for review, default 40;
  • classifier.maxTokens: Review output budget, default 512;
  • classifier.temperature: Review sampling temperature, default 0;
  • classifier.askFallback: Fallback to the manual approval chain when the review model returns ask, default true; if set to false, it is treated as a rejection;
  • rules.allow / rules.deny / rules.environment: allow rules, deny rules, and environment descriptions for injecting the review prompt, default [];
  • allowlist: Tools approved directly without review model, default read, glob, grep, todo_write, web_search, job_list, list_agents;
  • failClosed: Whether to reject when the review fails, default false, meaning it falls back to the normal approval chain.

The label, description, and sandbox mode of the Auto mode preset are also written in cordis.patch.yml, because the permission preset table needs to be available when building the schema for @deepseek-ai/dsh-permission-presets.

Compatibility

The plugin is tested against DSH 0.1.0-rc.6. The bundle patch restates the built-in permission preset table (read-only, workspace-write, danger-full-access), so after upgrading DSH, you need to check this table in cordis.patch.yml and update it according to changes in the built-in presets.

Additionally, the DSH built-in permission icon table does not have icons for custom preset IDs; the UI intentionally falls back to plain text labels, and this plugin does not patch the DSH client bundle.

Applicable Scenarios & Precautions

Auto mode is suitable for scenarios where you want to reduce manual confirmation in long tasks but do not trust fully open permissions. However, before using it, there are a few things to be clear about:

  • It is a convenience mode, not a security boundary. The review model reads recent conversation records and request actions and sends them to the configured LLM route (default is the session’s current model). Consider this for privacy-sensitive tasks.
  • Beware of prompt injection. Malicious content (files, tool results) in the workspace may attempt prompt injection against the review model. Deterministic deny rules and the pre-approved tool list are evaluated before the model; rules that are truly relied upon should be written here, rather than expecting the model to act as a gatekeeper.
  • The sandbox is still effective. The default preset uses the workspace-write sandbox; writing outside the workspace still requires sandbox privilege escalation or the approval path.
  • You must actively choose the behavior on review failure. If you want the review model to reject directly when it fails rather than falling back to a popup dialog, set failClosed: true.
  • The plugin runs with the permissions of the current dsh process. Before installing, check the plugin’s source code and license (MIT), and confirm there are no issues before loading it into your own profile.

Summary

The value of dsh-auto-mode lies in adding a tunable middle state for DSH permission levels: deny rules and the allowlist provide a safety net, the review model handles the gray areas, and the ask popup retains the final human decision-making power. The rule syntax and configuration options have default values; an empty configuration works out of the box, and you can tighten it as needed.

Plugin directory page: https://www.skillhub.cn/plugins/Nuo-cl/dsh-auto-mode

Source code repository: https://github.com/Nuo-cl/dsh-auto-mode