dsh-auto-approval: An Auto-Approval Permission Tier for DeepSeek Harness
styxnether/dsh-auto-approval
Adds an auto-approval middle permission tier to DeepSeek Harness, auto-approving harmless commands and trusted-area targets while deferring the rest to human.
Adds an auto-approval preset to DeepSeek Harness, auto-approving harmless commands and trusted-area operations to reduce manual approval overhead.
dsh plugin --profile web add github:styxnether/dsh-auto-approval- Category
- Workflow & Automation
- Platform
- DSH-Plugin
- Author
- styxnether
- Distribution
- Plugin
dsh-auto-approval Key Features
dsh-auto-approval Repository
dsh-auto-approval Repo Summary
dsh-auto-approval is a middle permission tier plugin for DeepSeek Harness (DSH), maintained by StyxNether under the MIT license. It fills the gap between Workspace Write and Full access (danger-full-access) by adding an auto-approval preset to the permission settings, backed by an automated approval answerer that approves harmless commands and operations targeting configured trusted areas (including paths outside the workspace), while deferring everything else to the user. The plugin aims to reduce manual approval overhead but explicitly states it is scope control, not a security boundary—the DSH sandbox still confines all non-escalated calls, and an auto-approved call runs with the wider mode for exactly that one call.
What permission presets and approval policies does the dsh-auto-approval DSH plugin provide?
The plugin adds an auto-approval preset with sandbox mode workspace-write and approval policy ask, but auto-approves two categories: harmless commands (per rule table) and operations whose targets lie inside configured trusted areas (including outside the workspace). All other requests still ask the user. After installation, the preset appears in two permission surfaces: General settings → Permission (sets as default for future sessions) and the /permission picker (switches current session immediately, e.g., /permission auto-approval).
How does dsh-auto-approval implement auto-approval without compromising security?
DSH routes every operation needing approval through the approval/request waterfall. This plugin registers a listener with prepend, running before the web approval prompt. It looks up the recorded tool/call event by callId in the session log and reads the real tool arguments (command text, file_path, workdir)—never trusting the model-written justification string. The pure decision core (lib/decide.js) classifies requests as allow or defer. Path containment is evaluated on real identity: the deepest existing ancestor of every candidate path is resolved through realpath (the same mechanism the DSH filesystem sandbox uses), so symlinks and junctions cannot smuggle an auto-approval to a target outside a trusted area. allow returns allowed-once—the request never reaches the human UI, but the audit pair approval/asked + approval/decided: allowed-once is still written to the session log. defer calls next(), letting the deployment's human answerer decide as usual. The plugin never denies anything.
How to install dsh-auto-approval?
You can install from the npm registry or GitHub, pinning a commit for reproducibility:
dsh plugin --profile web add github:styxnether/dsh-auto-approval
Or from npm:
dsh plugin --profile <profile> add dsh-auto-approval-plugin
Note: the bundle patch restates the complete permission preset table (DSH patches replace a row's whole config), so keep it in sync with @deepseek-ai/dsh-base's table when upgrading DSH—the patch warns and is skipped if the target row is missing.
How to configure trusted areas and rule tables for dsh-auto-approval?
Configuration is two-layered, both live (no restart needed):
- Web settings page (easiest): Settings → Auto Approval (a dedicated page in the settings sidebar, like the Vision Toolkit page). Edit trusted areas (one absolute path per line), the harmless/dangerous pattern tables, and the switches there. Changes are written to the
auto-approvalsection ofsettings.yamland apply immediately. The page also shows the last few auto-approval decisions. - Composition config (the default base): set the relevant environment variables or options in the configuration file, as per the README example.
Which DeepSeek Harness versions and platforms does dsh-auto-approval support?
The plugin is built on DSH's approval seam (approval/request waterfall) and depends on @deepseek-ai/dsh-settings, @deepseek-ai/dsh-app-boot, and @deepseek-ai/dsh-permission-presets. It works with any DSH session using the approval mechanism, including web UI and CLI. Due to the patch mechanism, keep the permission preset table in sync when upgrading DSH. The plugin was last updated in 2026-08, with 2 stars, 1 fork, and 0 open issues, indicating an early but stable state.