yolo-mode

You hand the agent a two-hour batch job, walk away, and every approval prompt and sandbox boundary turns progress into waiting. Worse, dsh's file sandbox only governs file effects; fork bombs, systemctl poweroff, and raw-device dd writes sail through workspace-write untouched. What you need is not a stricter sandbox but a switch: tightened while you are present, fully open while you are away, and automatically reverted on expiry.

yolo-mode arms that switch with one human-only command. It writes the canonical danger-full-access permission events through dsh official setters, so the model-visible runtime context and the Web UI update instantly. The session carries a configurable time-box (minutes, hours, or days); when it expires the pre-arm snapshot is restored. A built-in tripwire, honestly labeled as anti-accident rather than anti-adversary, blocks a deliberately tiny set of catastrophic operations; denials are final with no retry or rephrasing. Accumulated denials hitting the strike limit auto-disarm the session and fire a notification. Desktop, webhook, and email channels relay armed, disarmed, guard-denial, and idle events to your workstation or phone.

Built for dsh users who run long unattended jobs: bulk refactors, multi-file generation, pipeline scripts. It does not replace the sandbox; it fills the two gaps of stalled approvals and uncovered destructive commands, while every tool call and guard decision lands in the session log for after-the-fact review. Note that the plugin's presence is required for sessions that used the switch to remain readable; this is a dsh persistence-layer API gap, not a design flaw the plugin can opt out of.