dsh-auto-review

Under the 'auto' approval policy in DeepSeek Harness, sandbox escalations beyond workspace-write should resolve without a human prompt, but the upstream core previously lacked the request channel and decision hooks to make that happen. dsh-auto-review closes that gap: once policy is set to auto, every escalation is decided on the spot, with a human consulted only when the reviewer is genuinely unsure.

Decisions run through two layers. First, a deterministic regex filter applies hardline (always-deny) and configurable deny/allow patterns over a normalized command—instant hits never trigger a model call. Second, the gray zone goes to a small reviewer model: fixed system prompt, temperature 0, a single-word verdict (ALLOW / DENY / UNSURE), and a user message that carries only the tool name, the justification, and the XML-wrapped command—never the conversation. In the default appeal mode, an LLM-voiced DENY gets one re-judgment with the session's genuine user prompts attached as intent evidence; appeals can only relax a denial, never tighten one. Every error path—timeout, parse failure, model error—fails closed, and an optional consecutive-denial circuit breaker short-circuits retry loops before any further LLM cost accrues.

Built for platform engineers running patched Harness who want agent-session sandbox grants to flow as a hands-off pipeline, and for teams clearing human-approval bottlenecks in CI batch workloads. The plugin is defense-in-depth, not a sandbox-widening mechanism: workspace-write remains the hard ceiling until a grant explicitly lands.