dsh-full-with-approval

In everyday DeepSeek Harness workflows, developers often face a false binary: danger-full-access unlocks CUDA, GPU, devices, and the network but treats every file write as unconditionally allowed, while workspace-write fences file operations but also locks down all compute access at the same time. dsh-full-with-approval fills the gap between these two extremes.

It registers itself as a fourth permission preset through the existing preset table without modifying any core package. Once active, the session enjoys full unconfined compute access-GPU, network, devices, any binary-while every write or edit targeting files outside the session workspace, protected paths inside the workspace (such as .git or .env files), and shell commands showing static evidence of out-of-workspace file modification all trigger a one-shot approval prompt before execution. Rejection or timeout means the call fails closed with no side effects. All reads, workspace-relative writes to ordinary files, and temp-area operations pass through without interruption.

It is built for developers who need GPU inference, device debugging, or network access in the same session yet want a confirm-before-write habit for sensitive paths. The plugin adds a human-in-the-loop checkpoint at the tool-dispatch layer without replacing the kernel-level sandbox fence. Treat it as an ask-first prompt layer rather than a security boundary, and use it alongside- rather than instead of-workspace-write when maximum safety is the priority.