PerryLink/dsh-auto-review
40Last commit Aug 15, 2026
dsh-auto-review DSH plugin
dsh-auto-review 是一个 DSH 插件，当一个代理的操作跨越沙箱边界时，它会启动一个只读的审查子代理来决定允许或拒绝，并附带理由。它通过第二模型决策替代人类审批，同时保持完整的审计追踪和失败安全策略。
How to install the dsh-auto-review DSH plugin
dsh plugin --profile web add dsh-auto-reviewCopying does not run this command. Review the repository and version before installing the dsh-auto-review DSH plugin.
dsh-auto-review DSH plugin data source
dsh-auto-review DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-auto-review DSH plugin can do
- Second-model verdict: 使用一个独立的子代理（fork）对请求进行结构化决策（允许/拒绝+风险等级）。
- Fail closed: 审查器崩溃、超时或模式不匹配时默认拒绝，不会打开安全缺口。
- Config-driven routing: 通过 cordis.yml 配置每个工具的策略（ai/human/never）和风险规则（正则匹配）。
- Deny reasons reach the model: 拒绝理由会注入到被拒绝的工具结果中，让代理理解并调整行为。
- Full audit trail: 所有决策记录为 session 事件（autoReview/verdict, autoReview/rejection），可追溯。
- Rejection circuit breaker: 连续3次拒绝或最近10次中6次拒绝会触发断路器，避免无限循环。
Where the dsh-auto-review DSH plugin fits
- 自动化审批 bash 和 write 等工具的操作，减少人工干预。
- 防止代理执行高风险文件操作（如 rm -rf / 或 git push --force）。
- 在仅读模式下允许安全工具调用，同时拒绝危险操作。
- 为多代理工作流提供细粒度的安全策略，无需人工逐条审批。
Who the dsh-auto-review DSH plugin is for
- DSH 用户希望自动化审批流程以减少人工操作。
- 开发基于代理的自动化工作流，需要安全边界控制。
dsh-auto-review DSH plugin limitations
- 默认只审查 bash 和 write 工具，其他工具需要手动配置策略。
- 审查器依赖一个独立的模型（fork 后端），可能增加 token 消耗和延迟。
- 需要 DSH 0.1.0-rc.6 或更高版本。
- 审查器超时（默认60秒）或失败时会回退到 fallbackPolicy，可能导致审批延迟。
dsh-auto-review DSH plugin: from the repository README
Quoted from the PerryLink/dsh-auto-review README, the upstream source of the dsh-auto-review DSH plugin. Copyright remains with the original authors.
**Second-model AI approval for DeepSeek Harness** — the Codex `approvals_reviewer=auto_review` / Claude Code *auto mode* pattern, built as a pure Cordis plugin. When an agent's action crosses the sandbox boundary, a **read-only reviewer subagent** decides allow/deny — with a reason — so humans approve nothing while nothing unsafe slips through. [](LICENSE) [](https://www.npmjs.com/package/@deepseek-ai/dsh) [](https://www.npmjs.com/package/dsh-auto-review) [](https://www.npmjs.com/package/dsh-auto-review) [](.github/workflows/ci.yml) [](src) [](cordis.patch.yml) [](https://github.com/P
Read the full READMERepository license: Apache-2.0
dsh-auto-review DSH plugin questions
How do I install dsh-auto-review?
You can install it via npm: `dsh plugin --profile web add dsh-auto-review`. Alternatively, you can use a tarball (`pnpm pack` then `dsh plugin add ./dsh-auto-review-<version>.tgz`) or a git source (`dsh plugin add "github:PerryLink/dsh-auto-review#<commit>"`). After installation, restart DSH with `dsh --profile web`.
Does the plugin support all tools?
No, by default it only AI-reviews `bash` and `write`. Other tools like `edit` will delegate to the human chain unless you add `edit: ai` in the `toolsPolicy.overrides` configuration. You can customize the policy for each tool in your `cordis.yml`.
What happens if the reviewer model times out?
The plugin uses a fallback policy (default `rejected`) to fail closed. You can change it to `delegate` (continue to human) or `allow-once` (grant the request) via the `fallbackPolicy` config. The timeout duration is configurable with `reviewerTimeoutMs` (default 60 seconds).
How can I temporarily disable auto-review?
Use the `/auto-review off` command in the session. This writes a durable override that persists across session restarts. You can re-enable it with `/auto-review on` or check the status with `/auto-review status`.
What is the circuit breaker and how does it work?
The circuit breaker prevents endless denial loops. If the reviewer denies 3 consecutive requests or 6 out of the last 10 verdicts in a turn, the breaker trips. Subsequent requests can be delegated, rejected, or the turn aborted (configurable via `circuitBreaker.action`). This ensures the system doesn't get stuck in a cycle of denials.