Introduction

Before privileged operations such as file writes or command execution, DeepSeek Harness usually requires manual approval. In trusted environments or with a known safe subset of tools, these prompts can be disruptive. This plugin intercepts the approval/request event before UI or relay push prompts, automatically answers it based on policy, Hermes Pro semantic adjudication, or human review, and records all decisions. It is the mirror of dsh-reset-handoff: the former delegates restart to an external operations agent, while the latter delegates approval to local policy and Hermes.

Core Features

  1. Event interception: Intercepts approval/request events (optionally intercepts ask_user_question).
  2. Automatic adjudication: Automatically answers through the rules layer, Hermes Pro semantic adjudication, or human review.
  3. Audit logging: Records all decisions in JSON Lines format.
  4. Interactive rejection loop: When policy rejects, feeds the reason back to the requesting session and allows the agent to retry.

Installation and Enablement

Install it with the official plugin command:

dsh plugin --profile <profile> add github:nicecx/dsh-auto-approver

After installation, register it in the configuration file and set the parameters.

Configuration

Configure it in cordis.patch.yml:

- id: dsh-auto-approver
  name: 'dsh-auto-approver'
  config:
    mode: 'hermes'           # allow-all | allowlist | hermes | off
    allowlist: []            # 白名单工具，hermes 模式下直接通过
    denyAlways: []           # 黑名单工具，最高优先级，Hermes 无法覆盖
    denyReasons: {}          # 拒绝时的原因文本
    hermesModel: 'deepseek-v4-pro'   # 判决模型
    hermesTimeoutSecs: 90    # 超时时间，超时或失败则人工批准
    feedbackOnReject: true   # 是否将拒绝原因反馈给请求会话
    qnaMode: 'off'           # 'hermes' 表示用 Hermes 回答用户提问，'off' 表示人工
    userGranted: []          # 用户授权信号（软性背书），非硬性绕过
    logPath: ''              # 审计日志路径（默认 ~/.dsh/auto-approver.log）

Operating Modes

The plugin supports four modes:

  • allow-all: Automatically approves all operations (including danger-full-access). Only for fully trusted environments.
  • allowlist: Automatically approves only whitelisted tools; all other operations are left to manual approval.
  • hermes: Combines the rules layer (denyAlways/allowlist) with Hermes Pro semantic adjudication. If Hermes is unavailable or times out, it falls back to manual approval (fail-closed).
  • off: The plugin is inactive, and all operations are left to manual approval.

Security Notes

  • allow-all automatically grants all permissions, including dangerous commands. Ensure the environment is fully trusted before using it.
  • denyAlways has the highest priority and cannot be overridden by Hermes.
  • userGranted is a soft endorsement signal, not a bypass. denyAlways still takes priority over other rules.
  • hermes mode is fail-closed: if it is unavailable, it does not silently pass, but falls back to human approval.
  • Manual approval (via iMessage or Web UI) always overrides policy.

Audit Logs

Each decision is appended to the audit log file. The default path is ~/.dsh/auto-approver.log, in JSON Lines format:

{"ts":"...","sessionId":"...","toolName":"bash","reason":"...","callId":"...","decision":"allowed-once"}

Conclusion

By intercepting and adjudicating requests with policy, this plugin reduces the noise from manual approvals while audit logs preserve traceability. It is suitable for automation scenarios that require less human interaction while operating within controlled boundaries. Source code and details are available in the GitHub repository.