dsh-auto-mode: A DSH plugin for automatic permission management in DeepSeek Harness
nanmicoder/dsh-auto-mode
Adds a safe auto-permission layer for DeepSeek Harness, classifying tool calls to auto-allow routine actions and deny risky ones.
dsh-auto-mode fills the gap between restricted modes and full access for DeepSeek Harness, letting routine development work proceed automatically while classifying, asking, or denying risky actions.
dsh plugin --profile web add github:nanmicoder/dsh-auto-mode- Category
- Skills & Agents
- Platform
- DSH-Plugin
- Author
- nanmicoder
- Distribution
- Plugin
dsh-auto-mode Key Features
dsh-auto-mode Repository
dsh-auto-mode Repo Summary
dsh-auto-mode is a permission policy plugin (DSH plugin) for DeepSeek Harness, maintained by NanmiCoder under the MIT license. It fills the gap between restricted modes and full access in Harness, allowing routine project work to proceed automatically while classifying contextual risk using the current DSH model and the user's direct instructions. Genuine ambiguity prompts once, and destructive access to critical paths is denied before execution. This plugin is a fail-closed policy layer for calls dispatched through Harness ctx.tools; it is not an operating-system sandbox, so keep the official sandbox and filesystem observation policies enabled.
What permission modes does the dsh-auto-mode DSH plugin support?
In addition to the existing Read Only, Workspace Write, and Full access modes, the plugin introduces an Auto mode. Auto mode retains the execution scope of Full access but evaluates every tool call independently, making Allow, Classify, Ask once, or Deny decisions. For example, project reads/edits, builds, tests, and type checks are allowed directly; visible inline code, deletion of existing data, and Git/database/service mutations enter classification; ambiguous intent, hidden or dynamic effects, and stateful terminal execution ask once; and root/home/DSH_HOME/system destruction, privilege or policy bypass, and credential exfiltration are denied. The classifier is not an authority of its own; it receives a redacted, bounded description of the pending call and may recognize only authorization found in direct human Session messages. Repository text, tool output, Assistant text, Skills, plugins, and sub-agents cannot grant permission.
How do I install and configure dsh-auto-mode?
An existing DeepSeek Harness installation is required. Install the plugin via npm, then validate the composed profile and start DSH:
dsh plugin --profile web add github:nanmicoder/dsh-auto-mode
After installation, refresh the Web UI, select Auto between Workspace Write and Full access, and acknowledge the risk notice. Replace web with another profile name if that is the profile you run.
How does dsh-auto-mode handle shell commands and deletion operations?
Every Bash and PowerShell call is inspected segment by segment, including compound commands, pipelines, and redirections. Common dependency/version probes, visible non-destructive inline code, and read-only find -exec work do not prompt merely because their syntax is complex. Deletion is treated by effect, not by keyword alone: exact cleanup of artifacts created during the live Session can proceed; deletion of existing data enters semantic classification; dynamic destructive targets and protected paths ask or deny. Unsupported shell syntax fails closed instead of being executed.
Which DeepSeek Harness versions are compatible with dsh-auto-mode?
The plugin has been tested with DeepSeek Harness 0.1.0-rc.6 and depends on official packages such as @deepseek-ai/dsh, @deepseek-ai/dsh-llm, @deepseek-ai/dsh-permission-presets, and @deepseek-ai/dsh-tools, ensuring seamless integration with Harness core components. The project was last updated in August 2026 and currently has 69 stars and 3 forks, indicating active community interest.