dsh-access-mode

In DeepSeek Harness (DSH), deciding which tools an AI agent may execute autonomously, which actions require human approval, and which file I/O is bounded by which sandbox used to mean three separate, easily misaligned settings. dsh-access-mode collapses them into a single atomic switch with three tiers: Default, No Edit, and Auto. One toggle aligns the tool-access gate, the approval policy, and the sandbox boundary at the same time, and the choice persists per agent session so restoring a conversation never silently reverts to an older state.

The plugin does not patch Harness core code, the agent loop, or tool implementations. It layers on top of the native Approval, Sandbox, Tool Execution, and Session services, injecting three access gates via session events and a tools/pre-execute hook. Default keeps the workspace-write boundary and only auto-clears read-only tools; No Edit raises the sandbox to full-access to avoid path-boundary errors while still routing edits through approval; Auto disables every gate and boundary for fully trusted work. A dropdown in the Web composer or the /access-mode command makes switching instant.

It is aimed at developers who want fine-grained control over what an AI agent may do autonomously while preserving the DSH architecture as-is. If you oscillate within an hour from letting the agent read code to letting it rewrite files behind a checkpoint, dsh-access-mode turns that shift into a single click rather than a config hunt or a service restart.