The default sandbox in DeepSeek Harness (DSH) usually allows an Agent to run commands (such as bash or pwsh) to read/write files or access the network, increasing the risk of loss of control. When developing or debugging agents, a mechanism is needed to confirm intent before critical operations occur. The following plugin forces a pause and waits for explicit user approval or rejection before executing selected tools.

What It Is

This is a DeepSeek Harness plugin maintained by J0ss077 and categorized under workflows. It forces a pause and waits for explicit user approval or rejection when the Agent invokes tools in the configured list, preventing unauthorized command execution.

Core Features

  • Approval interception: intercepts selected tools and waits for user approval before execution.
  • Default monitoring: the default monitored list includes bash and pwsh.
  • Single-use approval: each invocation requires separate approval; approving once does not grant ongoing authorization.
  • Sub-agent forwarding: forwards sub-agent approval requests to the top-level session, where the main session user makes a single decision.

Installation and Enablement

Use the web profile to install the plugin (this profile includes the approval service by default):

dsh plugin --profile web add @j0ss077/dsh-always-require-tools-approval

After installation, restart the DSH GUI. If using a different profile, ensure that profile has the approval service configured.

Typical Usage

  1. Edit the configuration file ~/.dsh/settings.yaml and add or modify the tools list:
    always-require-tools-approval:
        tools: ["bash", "pwsh", "node"]
  1. When the Agent invokes bash, the flow pauses with the prompt:
    Approve this tool execution?
  2. Selecting Approve executes that specific invocation; selecting Reject rejects it and notifies the Agent.

Use Cases and Notes

  • Use cases: scenarios requiring strict control over Agent execution of shell commands or sensitive tools, such as debugging complex automation scripts.
  • Security model: uses a one-approval-per-execution mechanism; each approval corresponds to only one execution. If rejected or if no approval channel is available, the tool is denied (fail closed) and will not be auto-approved.
  • Unmonitored tools: tools not in the monitored list are unaffected and handled by the next plugin.
  • Prerequisites: ensure the DSH profile in use has the approval service configured (for example, the web profile), and Node.js >= 22.19.
  • Permissions note: the plugin runs with the permissions of the current DSH process; review the source code and license before installation.

Conclusion

With this plugin, command execution authority for the Agent can be brought under user control, establishing a clear approval checkpoint between security and flexibility. For more details, refer to the project repository and plugin directory.