dsh-guardian-approval

Under DSH's Auto Approve preset, every out-of-sandbox write or command execution either sails through unchallenged or drops back to a human approval UI—one click at a time, which is untenable for batch jobs or unattended CI. dsh-guardian-approval inserts an independent review channel between those extremes: each approval request is routed to a dedicated reviewer model, fully decoupled from the agent's main model, which renders a verdict against the full Codex Guardian policy matrix (five risk levels × four authorization levels). File and tool content is always treated as untrusted evidence; only an explicit user instruction constitutes authorization, so an instruction embedded in a file can never launder a dangerous operation into a legitimate one. For egress-shaped actions the plugin pre-reads a 2KB excerpt of the target file and hands it to the reviewer so it sees exactly what would leave the machine. Built-in safety rails include a three-state circuit breaker (3 consecutive denials, 3 consecutive channel errors, or 10 denials in a 50-review window trips the breaker), a fail-closed guarantee (a dead endpoint never results in an allow—requests fall back to the human UI), a sidecar audit log appended to ~/.dsh/auto-approval-audit.jsonl recording every verdict with risk, authorization, and rationale, and dual API-style support (OpenAI Responses with strict json_schema, or the classic /chat/completions) for compatibility with relay and proxy providers. It is aimed at teams running DSH agents in Auto Approve mode—multi-agent pipelines, unattended CI, shared workbenches—where policy-driven, programmatic approval is needed instead of blanket trust or constant human supervision. Configure a reviewer endpoint you trust, pick the Auto Approve preset, and you are live.