dsh-auto-approval

dsh ships four permission modes, and the approval prompt is a binary switch: either you confirm every single step or you confirm none. In a full-access session doing bulk refactors or batch scripting, dozens of identical low-risk confirmations stack up and break your flow, yet flipping approval off entirely feels like surrendering a guardrail. dsh-auto-approval sits in that gap. Before any operation that would normally trigger a prompt, an LLM judge reviews it: clearly safe operations pass silently, anything doubtful still lands in your queue, and every failure mode—judge error, timeout, unparseable reply, step-cap hit—falls back to the human prompt. Fail-closed by design, it never second-guesses a deny into an allow.

The judge is not a single-shot completion. It runs as a bounded sub-agent that reads the session transcript (framed strictly as untrusted evidence) to assess whether you actually authorized the action, and can invoke three read-only tools—read_file, list_dir, stat_path—to verify local state on the fly. The verdict is a four-field structured output (risk level, authorization sufficiency, outcome, rationale) evaluated against a declarative policy table. The host additionally enshrines a mechanical override: any self-contradictory combination such as critical-risk + allow is flipped to deny, single-direction tightening only. The sandbox boundary is untouched; the plugin intercepts only the step that would have asked you.

Built for developers who run dsh in full-access mode and want to shed the low-value confirmation fatigue without giving up the prompts that actually matter. It is deliberately conservative: in lower permission modes the operations that trigger approval are mostly privilege escalation and will still route to you. Its value is filtering out the repetitive, low-risk confirmations you would click through on autopilot, so your attention lands where it is genuinely needed.