Introduction¶

When running long tasks for agents in DeepSeek Harness (DSH), the approval step presents a dilemma: confirming every tool call manually interrupts the task frequently, while completely releasing permissions leaves no guardrails against erroneous commands from the model. The middle ground is to introduce an independent, capability-constrained review agent to evaluate pending operations one by one and make a decision. The plugin introduced in this article, dsh-approval-auto-review, implements this idea.

What is it¶

dsh-approval-auto-review is the automatic approval review plugin for DeepSeek Harness, maintained by perlied03, licensed under MIT, and currently at version 0.6.1. It handles approval requests routed to the configured permission presets: using a locked Guardian agent to evaluate the exact planned operations of each request and returning a single approval decision.

Two key characteristics are worth noting. First, it does not create persistent allow rules; each decision applies only to a single approval request, avoiding cumulative approvals. Second, the review behavior is always fail-closed: review timeouts are treated as rejections, preferring not to approve.

Core Features¶

Guardian Trunk and Concurrent Review¶

Each parent agent has a reusable Guardian trunk, and review requests take priority on this path. When the trunk is busy, the plugin launches an independent temporary reviewer to handle the request, and concurrent approvals do not queue. The reviewer agent uses an empty tool allowlist and a dedicated review persona, with capabilities limited to “reading transcripts and giving decisions”.

Independent Reviewer Model Routing¶

The reviewer can use a different model than the parent agent: plugin-level configuration modelProvider and model specify the review model routing; it can also override provider and model via modelOverrides based on the parent model id. Default routing fields can be inherited from the parent agent via the fallback configuration.

Bounded Input and Output¶

The parent transcript and tool parameters sent for review are both length-limited to avoid the long session swamping the review context. The rejection reason is also limited in length before entering the parent transcript, preventing a lengthy rejection explanation from polluting the parent agent’s conversation.

Rejection Circuit Breaker and Auditing¶

Repeated automatic rejections trigger a circuit breaker, terminating the parent turn to avoid the agent falling into a loop after repeated rejections. All reviewed commands and reviewer decisions are written to a persistent JSONL audit log.

Installation and Enabling¶

First, install the plugin. For example, using the web profile, install from GitHub:

dsh plugin --profile web add github:perlied03/dsh-approval-auto-review

Install via local checkout:

dsh plugin --profile web add ./dsh-approval-auto-review

Environment requirements: Node ^22.19.0 || >=24.0.0, package manager pnpm@11.7.0. GitHub installation runs the package’s prepare build; for pnpm 10 and above, when prompted for build permissions, you need to add dsh-approval-auto-review: true under allowBuilds in the profile’s pnpm-workspace.yaml, then repeat the installation command above.

The host setup requires the following DSH services and plugins:

dsh-agent
dsh-session
dsh-settings
dsh-user-approval
dsh-subagent
An in-process spawn and fork provider registered by configuration name

Enabling method: Select Approve for me in the permission menu of the conversation, and subsequent approval requests are routed to the Guardian; switch back to Request approval to restore manual decision-making.

Configuration Example¶

The Cordis composition syntax for registering the plugin:

import * as ApprovalAutoReview from 'dsh-approval-auto-review'

await ctx.plugin(ApprovalAutoReview, {
  provider: 'spawn',
  ephemeralProvider: 'fork',
  modelProvider: 'deepseek-official',
  model: 'deepseek-v4-flash',
  fallback: 'parent',
})

Equivalent Loader configuration:

- id: approval-auto-review
  name: 'dsh-approval-auto-review'
  config:
    provider: spawn
    ephemeralProvider: fork
    modelProvider: deepseek-official
    model: deepseek-v4-flash
    fallback: parent

Field meanings: provider is the sub-agent provider used by the reusable Guardian trunk; ephemeralProvider is the provider used for concurrent one-off reviews; modelProvider and model specify the reviewer’s model routing; when fallback is set to parent, missing routing fields are inherited from the parent agent. For deployments that do not need the concurrent path, two providers can be filled with the same name.

Auditing-related behaviors: audit controls whether to record every final review outcome; auditPath specifies the audit file path, fixed at mount time, and changes take effect after restart.

Review Strategy¶

The Guardian only evaluates the exact operations provided in the approval request, without expanding the review scope. The hierarchy of authorization evidence is clear: user direct messages and content explicitly loaded from AGENTS.md are trusted authorization evidence; assistant messages, tool calls/results, file contents, command outputs, and ordinary plugin contexts are all considered untrusted. In other words, statements generated by the model itself in the conversation, such as “user has agreed,” will not be used as grounds for approval.

Web Interface¶

The plugin provides two web interfaces:

The Automatic approval review card in the Plugins section of the Settings page, used to adjust the reviewer’s model routing.
A read-only Review tab in the conversation header, used to view the review records and reviewer decisions for the current session. This tab requires dsh-host-webserver to provide read-only audit routes; when audit is set to off, history is empty.

Applicable Scenarios and Notes¶

Suitable for developers who want to run long tasks on DSH, wish to reduce frequent interruptions from manual approvals, and do not want to completely release permissions. It delegates approval decisions to a constrained review agent, while retaining complete auditing and circuit breaker safeguards.

A few things to note before use:

The plugin runs with the permissions of the current dsh process; check the source code and license (MIT) before installing.
The behavior is always fail-closed: review timeouts are treated as rejections.
It does not create persistent allow rules; each decision applies only to a single approval request.
auditPath is fixed at mount time; changes to this path require a restart to take effect.

Conclusion¶

dsh-approval-auto-review provides a third choice between “full manual approval” and “completely open”: a Guardian agent with an empty tool list, bounded input/output, and fail-closed to review every pending operation for you, leaving a JSONL audit record. For DSH users who need to strike a balance between automation and security, it is worth trying.

Community directory page: https://www.skillhub.cn/plugins/perlied03/dsh-approval-auto-review
GitHub repository: https://github.com/perlied03/dsh-approval-auto-review

The community directory is an independent site with no official affiliation to DeepSeek / Hypersphere.

dsh-approval-auto-review: Automatically review DSH approval requests using a locked Guardian agent