dsh-automode

The fastest way to lose trust in an autonomous agent is one careless command executed at the wrong moment. dsh-automode plugs into DeepSeek Harness as a pre-execution gate that intercepts every tool call before it runs, combining deterministic guardrails with a cost-aware LLM reviewer so dangerous actions never reach the shell. A regex deny layer hard-blocks exfiltration, secret access, and system-path writes with zero LLM cost; a prefix-glob allow layer approves routine commands instantly; and a full-trust allowPaths whitelist lets curated directories skip the classifier entirely, auto-granting sandbox escalations through an approval bridge. Only the remaining borderline actions reach a two-stage classifier—a one-token pre-screen followed by a structured review for flagged calls, with a five-minute verdict cache—keeping most tool calls to roughly one extra token of overhead. A circuit breaker pauses auto mode after three consecutive or twenty total denials and routes the decision to a human, who resumes it with a single confirmation. Every allow, deny, and bridge verdict is appended to a local JSONL audit trail. It is not an OS sandbox and does not change your user-account permissions; it is a safety layer specifically for the grey zone of autonomous agentic execution, built for developers who want to hand long-running tasks to their agent without hovering over every approval prompt.