dsh-auto-approval-plugin: An Auto-Approval Permission Tier for DeepSeek Harness

dsh-auto-approval-plugin is a middle permission tier plugin (DSH plugin) for DeepSeek Harness, maintained by StyxNether under the MIT license. It addresses the granularity gap between Workspace Write and Full access: the default workspace-write mode still prompts for harmless commands and operations within trusted areas, while danger-full-access is too risky. This plugin adds an auto-approval preset that automatically approves harmless commands and targets inside configured trusted areas (including outside the workspace), deferring everything else to the user, balancing safety and efficiency.

What core features does the dsh-auto-approval-plugin DSH plugin support?

The plugin adds an auto-approval preset to permission settings and backs it with an automated approval answerer. It registers a listener with prepend on the approval/request waterfall, running before the human approval prompt. The decision core lib/decide.js reads the real tool/call arguments (command text, file_path, workdir) from the session log, never trusting the model-written justification. Path containment is evaluated on real identity: the deepest existing ancestor of each candidate path is resolved via realpath (same mechanism as the DSH filesystem sandbox), preventing symlinks or junctions from smuggling an auto-approval outside trusted areas. An allow returns allowed-once — the request never reaches the human UI, but the audit pair approval/asked + approval/decided: allowed-once is still written to the session log. The plugin never denies anything; defer calls next() for the deployment's human answerer.

How to install dsh-auto-approval-plugin?

Install with the following command (or from GitHub, pinning a commit for reproducibility):

dsh plugin --profile web add github:styxnether/dsh-auto-approval-plugin

After installation, the new preset appears in both permission surfaces: General settings → Permission (sets auto-approval as default for future sessions) and the /permission picker (switches the current session immediately, e.g., /permission auto-approval).

How to configure dsh-auto-approval-plugin?

Configuration is two-layered, both live (no restart needed):

1. Web settings page (easiest): Settings → Auto Approval (a dedicated page in the settings sidebar, like the Vision Toolkit page). Edit trusted areas (one absolute path per line), the harmless/dangerous pattern tables, and switches there. Changes are written to the auto-approval section of settings.yaml and apply immediately. The page also shows the last few auto-approval decisions.
2. Composition config (the default base): set relevant options in the composition config (e.g., default areas and patterns for auto-approval).

What are the permission boundaries and caveats of dsh-auto-approval-plugin?

The plugin is scope control, not a security boundary. It automates the human approval step for a narrow, verifiable class of requests. The DSH sandbox still confines every non-escalated call; an auto-approved call runs with the wider mode for exactly that one call (the same one-shot grant a human click would produce). Do not use it on machines or sessions you would not trust a human operator to run commands on. Additionally, the bundle patch restates the complete permission preset table (DSH patches replace a row's whole config), so keep it in sync with @deepseek-ai/dsh-base's table when upgrading DSH — the patch warns and is skipped if the target row is missing.

What is the compatibility and maintenance status of dsh-auto-approval-plugin?

Developed by StyxNether, written in JavaScript, and licensed under MIT. The repository was created on 2026-08-14 and last updated the same day, currently with 2 stars, 1 fork, and 0 open issues. It depends on @deepseek-ai/dsh-settings, @deepseek-ai/dsh-app-boot, and @deepseek-ai/dsh-permission-presets, and includes the official dsh.bundle composition manifest, ensuring integration with DeepSeek Harness.

See more DSH plugins at dsh-plugin.org