dsh-agent-approval

DeepSeek Harness ships with only two permission presets: every privilege escalation pops up a manual confirmation, or you grant danger-full-access and lose all runtime guardrails. For agent sessions that trigger sandbox retries constantly, both extremes are painful. dsh-agent-approval introduces a third mode in the /permission menu: the sandbox baseline stays at workspace-write, but escalation requests are no longer routed to a human popup. Instead, an ephemeral approval sub-agent adjudicates them in the background and rejects anything risky.

That approval agent is spawned fresh each time, holds zero tools, and reads only the workspace path, the most recent user message, the tool name, the stated rationale, and the exact tool-parameter JSON. It returns a structured verdict of {decision, riskLevel, rationale}. The bar is strict: destructive, irreversible, out-of-scope (including modifying the OS or other applications data), or a rationale that does not match the actual command means an immediate reject. Approval requires the operation to be safe, reversible, objectively aligned with the task, and honestly stated. If the approval agent fails to start, times out, or returns malformed output, the request is denied. Fail-closed by design, never silently passed. The settings page lets you pick the provider and model used for review and configure a timeout anywhere from 30 s to 600 s, while a local audit log retains the last 200 decisions with full rationale, tool parameters, and a traceable session ID for debugging.

Built for developers who run long agent tasks in the DSH Web UI, hit escalation prompts frequently, and want guardrails without constant human-in-the-loop interruptions or a blanket permission grant. Toggle it on with /agent-approval on, revert with /agent-approval off and the previous sandbox mode and approval policy are restored automatically. Sessions that never enable the feature remain completely unaffected, keeping multi-session parallel workflows zero-intrusion.