dsh-approval-guardian

Every time a DSH agent requests a wider sandbox, the Web/ACP surface pauses and waits for a human to click allow or deny. In CI pipelines, batch jobs, or any headless automation, that popup is a hard stop. dsh-approval-guardian narrows its intervention to exactly one trigger: a strict sandbox escalation emitted inside the current tool execution. Everything else — ordinary in-sandbox work, non-widening approvals, downstream failures — calls next() and flows straight through to DSH's original behavior, completely untouched.

When a qualifying escalation arrives, the plugin spawns a fresh one-shot reviewer agent with zero tools. It receives a bounded slice of session context, the exact tool arguments, and the escalation reason, then returns a structured allow or deny decision. The reviewer output is explicitly framed as untrusted data so it can never inject instructions back into the parent agent. The default failure mode is fail-closed: a timeout or schema-invalid response yields unavailable rather than silently opening the sandbox. An alternative fallback-to-user mode hands the request back to the interactive Web/ACP answerer. The plugin reads no files, writes no files, and makes no network calls beyond the single model-provider inference routed through DSH's existing model configuration.

It is built for users and teams who want a lightweight, explainable approval layer in front of sandbox escalation while keeping DSH's full approval stack intact. If your workflow runs agents unattended and you need a deterministic, auditable allow/deny gate with a safe fallback when the reviewer cannot run, this is the minimal piece to add. A single-line profile override disables it, and removing the plugin restores the interactive popup immediately.