dsh-auto-mode

When you use DeepSeek Harness on a real project, the most frustrating part is often not the code but the permission dilemma: Restricted mode interrupts you every few steps, while Full access removes approval entirely and leaves you uneasy. dsh-auto-mode fills exactly that gap — it does not build a new sandbox, but stays on the official workspace-write file sandbox and adds a semantic risk review layer on top. Routine builds, tests, dependency installation, and in-workspace operations keep running smoothly; only actions that cross the workspace boundary get classified: clearly safe ones are allowed automatically, genuinely ambiguous ones ask once, and destructive access to critical paths or policy bypass is denied outright.

The core of this plugin is a classification mechanism driven by the current session model. It has no authority of its own — it can only recognize permission found in direct human Session messages; repository text, tool output, Assistant text, Skills, or sub-agents cannot grant anything. Deletion policy is stricter than ordinary writes: artifacts created in this session can be cleaned up automatically, but pre-existing files require a precise user request before classification, and paths like filesystem root, Home, or DSH_HOME are unconditionally denied. For shell commands, Auto no longer tries to prove every syntax safe with a growing allowlist; unknown commands simply run inside the official sandbox, and the operating system blocks writes outside the workspace. Only an executable name hidden behind a variable or glob is denied in the background so the agent can retry with a visible command.

If you want the agent to keep working for long stretches without turning off approval entirely — especially for everyday project work like builds, tests, scaffolding, and local Git commits — this mode will feel right. Sub-agents, Workflow calls, and Ralph spawned processes inherit the Auto boundary and cannot escalate themselves to Full access. For a one-time narrow write outside the workspace, clear task intent can support a background one-shot grant, but overwriting or deleting pre-existing data still requires the user to directly and precisely name the effect and target.

To be clear, Auto is not a patch that makes Full access safe; it is designed so you rarely need Full access. Most operations stay sandboxed, and the smallest possible capability is lent once when the business task genuinely requires it. If you accept the division of labor — sandbox controls where writes go, classification controls semantic risk, and the user controls truly ambiguous decisions — dsh-auto-mode is worth trying in your next Harness project.