dsh-approval-first

Under a DSH sandbox, when the standing mode would deny a file write, the model must first issue a call that is guaranteed to fail, then retry with sandbox_permissions and a justification before the approval prompt ever appears to the user. dsh-approval-first collapses that into a single step: the approval card shows on the very first call, the review object is the diff itself rather than model-written prose, and a rejection is a normal outcome—file left unchanged, no red error.

The plugin achieves this by shadowing the edit and write tools with frozen copies that inject an approval step only where the standing policy would deny the operation. Writes inside the workspace remain silent, identical to the shipped tools. Switching the standing mode mid-session arms or disarms the shadows on the next call without a restart. A built-in drift tripwire compares the frozen copies against live tool definitions at boot and refuses to activate on mismatch, so a harness update can never leave the plugin silently serving stale logic.

It suits DSH users working in read-only or workspace-write mode who want every out-of-policy write to pass through a human review card. One caveat: this is an interim shim. Once DSH ships native one-turn escalation, the bundle becomes obsolete and can be removed cleanly—no files, no settings, no services to tidy up.