dsh-auto-review

DeepSeek Harness asks for human confirmation on every sensitive tool call, and in long agent sessions the repeated approval pop-ups genuinely break your flow. dsh-auto-review adds an "Approve for me" tier to the permission menu: calls already cleared by DSH policy stay untouched, and the ones that would normally hit the approval bar are handed to a dedicated review model instead of a human. You keep the workspace-write sandbox; nothing is widened to Full Access.

The decision path has three lanes. Safely provable read-only observations such as pwd, ls, bounded find, and non-sensitive grep or glob fast-trace with no prompt at all. Genuinely sensitive reads or writes go to the review model, which must return a structured risk level, authorization basis, outcome, and rationale; if any field is missing, the call is denied. Catastrophic operations like rm -rf / are rejected locally before they ever reach the model. Timeouts, model unavailability, malformed output, or missing call context all fail closed rather than silently falling back to a human. Each approval is independent; the model cannot create task-level or permanent always-allow rules, and retries or privilege escalation trigger a fresh review.

It fits a specific workflow: you are running longer agent tasks inside DSH, you do not want approval pop-ups interrupting your focus, and you are not willing to widen the sandbox. The plugin keeps the workspace-write strategy intact and simply inserts a judge-for-me step at the exact point where you would normally click approve. Duplicate mounting does not add a second layer of protection; it only produces a second Loader ID.