dsh-tiered-approval

DSH's native permission model offers only two extremes: either every tool call that crosses a boundary triggers a confirmation popup, or you grant full access and lose all guardrails. In a read-only session that frequently needs to escalate for routine operations, clicking approve over and over is tedious and breaks your flow; yet full access makes you nervous about irreversible commands like recursive deletes or force-pushes.

dsh-tiered-approval inserts a three-layer checkpoint between those extremes. First, a zero-cost static ruleset blocks dangerous commands outright—recursive deletion, disk formatting, force-push, writes to system paths, process kills—rejecting them without a popup or model call, while supporting custom deny/allow regexes. Second, an LLM reviewer handles calls the rules do not cover, deciding allow, deny, or ask, with the review frame including the most recent user message for intent alignment. Third, a human fallback surfaces a native confirmation dialog whenever the reviewer says ask or is unavailable. An optional autoApproveAligned mode skips the popup entirely when the reviewer says allow and the user's instructions clearly match the call. Review strictness automatically tracks the active Access level (read-only / workspace-write / danger-full-access), and under Full access the reviewer becomes the last line of defense.

It is well suited for users working in read-only sessions who frequently escalate for legitimate operations and want to stop clicking approve every time, while still keeping a hard block on irreversible actions. If you already live in workspace-write or Full access and rarely trigger escalation requests, the plugin stays largely silent and the benefit is limited.