Jiao-XXX/dsh-auto-approve
41Last commit Aug 15, 2026
dsh-auto-approve DSH plugin
dsh-auto-approve inserts an 'Auto' permission tier between workspace-write and danger-full-access in DSH's permission presets. It uses a classifier model to decide whether a sandbox upgrade request is routine and safe, granting it automatically, or requires human approval for risky operations. The plugin is designed to reduce interruptions during long tasks while maintaining a safety net via deterministic danger lists and fallback to human approval.
How to install the dsh-auto-approve DSH plugin
dsh plugin --profile web add github:Jiao-XXX/dsh-auto-approveCopying does not run this command. Review the repository and version before installing the dsh-auto-approve DSH plugin.
dsh-auto-approve DSH plugin data source
dsh-auto-approve DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-auto-approve DSH plugin can do
- Automatically approves routine sandbox escalation requests (e.g., installing dependencies, downloading read-only resources) using a configurable classifier model.
- Falls back to human approval when the operation matches a built-in danger pattern (destructive commands, force-push to protected branches, etc.) or when the classifier is uncertain.
- Supports custom classifier model, provider, timeout, and additional danger patterns via profile configuration.
- Provides a /auto-report command in-session to view auto-approved, danger-list handoff, and classifier-to-human statistics.
- Works with DSH Web, TUI, and Desktop frontends, with full support on Web.
Where the dsh-auto-approve DSH plugin fits
- Long-running development sessions where frequent workspace-write prompts would be disruptive; the Auto mode reduces interruptions while maintaining security.
- Automated CI/CD pipelines using DSH where routine dependency installations and git operations can be approved automatically.
- Teams that want a balance between security and developer productivity, allowing the model to handle safe operations while humans review dangerous ones.
- Scenarios where a cheaper, faster model can be used for classification while the main model is a large reasoning model, reducing latency and cost.
Who the dsh-auto-approve DSH plugin is for
- Developers using DeepSeek Harness who want to reduce approval interruptions during long tasks.
- Teams deploying DSH in shared environments where they need an automated approval layer for routine operations.
dsh-auto-approve DSH plugin limitations
- The plugin is compatible only with DeepSeek Harness (rc.6 or later) and requires a running DSH instance with plugin support.
- The icon compatibility layer for the 'Auto' preset in the Web UI depends on the DOM structure and accessibility labels of rc.6; future DSH updates may break the icon display (though approval logic remains unaffected).
- The classifier model must be accessible via the DSH API configuration; if the default model is a large reasoning model, it may cause timeouts (falling back to human approval). Users must configure a faster model or increase timeoutMs.
- The plugin cannot distinguish between automatic and human approval in the session log's 'allowed-once' events; the /auto-report command provides a separate in-memory view.
dsh-auto-approve DSH plugin: from the repository README
Quoted from the Jiao-XXX/dsh-auto-approve README, the upstream source of the dsh-auto-approve DSH plugin. Copyright remains with the original authors.
中文 | [English](README_EN.md) `dsh-auto-approve` 为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 增加 `Auto` 权限档。在该档位下，分类模型可以对例行的沙箱升级做一次性批准；命中确定性危险规则、模型拿不准、超时、响应格式错误或插件内部异常时，审批仍会交给正常的人工弹窗。 该 bundle 会把权限预设表重述为四个档位，顺序为 `read-only`、`workspace-write`、`auto`、`danger-full-access`——即在 dsh 原生三档中间插入 `auto` 档，原有档位全部保留。不在 `auto` 档时，插件会原样放行所有审批请求给后续应答者。 ## 定位 `auto` 是 `workspace-write` 之上的低打扰安全层：保留同一沙箱边界，把例行升级交给分类器；命中危险清单、分类器拿不准或分类失败时，才回到人工审批。 直观地说，它类似 [Claude Code 的 **auto mode**](https://code.claude.com/docs/en/permission-modes) 与 [Codex 的 **Auto-review mode**](https://developers.openai.com/codex/agent-approvals-security)：把例行审批交给安全评审，危险或拿不准时再交还人工。 | 权限档 | 沙箱范围 | 什么时候弹窗 | 适合场景 | | --- | --- | --- | --- | | `read-only` | 只读工作区，不能修改项目文件 | 需要写入、联网或执行其他越界操作时 | 代码审阅、探索和敏感仓库 | | `workspace-write` | 可读写工作区；工作区外和受限能力仍被隔离 | 需要联网、写工作区外或进行其他沙箱升级时 | 常规开发；每次升级都由人确认 | | **`auto`** | **与 `workspace-write` 相同** | **例行升级自动批；命中删库级危险清单、分类器拿不准或失败时才问人** | **长任务和依赖安装；减少打断且全程保留审计台账** | | `danger-full-access` | 不受工作区沙箱限制，按宿主权限运行 | 不弹窗（`approval: never`） | 仅限隔离、可丢弃且充分信任的环境 | ## 工作原理 收到 `auto` 档的 `approval/request` 后，插件会： 1. 从内存中的会话日志找回对应 `tool/call` 的原始参数，并读取最新一条真人用户消息：只接受 `user/message` 中
Read the full READMERepository license: MIT
dsh-auto-approve DSH plugin questions
How do I install dsh-auto-approve?
Run `dsh plugin --profile web add github:Jiao-XXX/dsh-auto-approve` in your DSH environment. After installation, restart `dsh web` and select 'Auto' from the Permissions dropdown. You can also install from a local checkout using `dsh plugin --profile web add ./dsh-auto-approve`.
Why can't I see the plugin card in the Plugin Settings page?
The Plugin Settings page only shows host-side api-proxy official namespaces (like bash, agent-loop, web-search-deepseek). Third-party plugins distributed outside the official repository cannot appear there without modifying host code. This is a current limitation of DeepSeek Harness for all third-party plugins, not a defect of this plugin. Use the profile patch method to configure it.
How do I temporarily disable auto-approval in a session?
Switch the permission mode back to 'Workspace Write' (or any non-Auto preset) using the Permissions dropdown. The plugin automatically becomes transparent for presets other than 'auto', so no restart or removal is needed. This acts as a built-in toggle.
How do I configure the classifier model used for approval?
By default, the classifier follows your default model from Settings → Models. To use a different model, add a patch to your profile (e.g., `$DSH_HOME/profiles/web/cordis.patch.yml`) with `provider` and `model` fields under the plugin's config. You must restate all config fields because DSH does a full replace, not deep merge. See the README configuration section for an example.
Why does a normal git push still trigger the approval dialog?
The default classifier prompt only allows auto-approval for pushes to the user's own fork or working branches. Pushes to protected branches like main, master, release, production, or prod are considered dangerous and will be escalated to human. Additionally, force-pushes (with --force, -f, --mirror, etc.) are caught by the deterministic danger list before classification. If you need to allow pushes to those branches, you can customize the classifierPrompt, but be aware of the security implications.