dsh-auto-review: An AI Safety Review Plugin for DeepSeek Harness
perrylink/dsh-auto-review
A DSH plugin: a read-only reviewer subagent auto-approves sandbox-boundary requests, fail-closed and fully auditable.
Provides a read-only reviewer subagent for DeepSeek Harness approval requests, returning allow/deny verdicts with reasons, fail-closed by default, and fully auditable.
dsh plugin --profile web add github:perrylink/dsh-auto-review- Category
- Skills & Agents
- Platform
- DSH-Plugin
- Author
- perrylink
- Distribution
- Plugin
dsh-auto-review Key Features
dsh-auto-review Repository
dsh-auto-review Repo Summary
dsh-auto-review is an AI safety review plugin (DSH plugin) for DeepSeek Harness, maintained by PerryLink under the Apache-2.0 license, built with TypeScript. It addresses the approval challenge when an agent's action crosses the sandbox boundary: pattern-based auto-approvers decide before dispatch with no evidence, while this plugin introduces a read-only reviewer subagent that, upon an approval request, reads the actual workspace, the already-streamed tool-call arguments (sensitive values redacted), the request reason, and your risk rules, then returns a structured allow/deny verdict with a reason. The plugin fails closed by default, and every decision is reconstructable from the session log: approval/asked → autoReview/verdict (or autoReview/rejection) → approval/decided.
What core features does the dsh-auto-review DSH plugin support?
The plugin acts as an answerer on the approval/request waterfall; requests it does not own are delegated via next(), never short-circuiting the human approval flow. The reviewer subagent is a one-shot fork with a read-only tool allow-list (read/glob/grep) and a structured verdict schema { decision, reason, riskLevel }. It supports per-tool policies (ai/human/never) and regex risk rules, all configurable from cordis.yml. Deny reasons are injected into the denied tool result (callId-linked), enabling the agent to adapt rather than retry blindly. Additionally, the plugin includes a rejection circuit breaker (3 consecutive denials or 6 within the last 1 minute) and prevents recursive reviews.
How to install and configure dsh-auto-review?
Use the following installation command:
dsh plugin --profile web add github:PerryLink/dsh-auto-review
After installation, configure per-tool approval policies (ai/human/never) and risk rules in cordis.yml. The plugin recognizes reviewer requests by identity and delegates them; maxDepth and the tool allow-list keep the reviewer non-delegating.
How does dsh-auto-review ensure safety and auditability?
The plugin fails closed by default: if the reviewer crashes, times out, or returns a schema mismatch, the fallbackPolicy applies (default rejected), never opening the gate. All verdicts and rejections (autoReview/verdict, autoReview/rejection) log reviewer identity, verdict, reason, risk level, and duration, with an invariant companion enforcing that model-visible equals logged. Deny reasons are fed back to the calling model, and failure texts carry [auto-review], [auto-review-fallback], and [auto-review-never] markers for auditable traces.
Which DeepSeek Harness versions and platforms does dsh-auto-review support?
The plugin depends on official packages such as @deepseek-ai/dsh-agent, dsh-brand, dsh-commands, dsh-invariants, dsh-llm, dsh-session, dsh-subagent, dsh-tools, and dsh-user-approval, running as a pure Cordis plugin. It is compatible with DeepSeek Harness 0.1.0-rc.6 and above. Last updated in 2026-08, it currently has 4 stars, 0 forks, and 0 open issues, indicating active maintenance.