dsh-auto-reviewer

English | 中文

A permission mode for DeepSeek Harness similar to Codex Auto Reviewer / "approve for me":

• Adds an auto-review option to the existing Permissions list.
• When the model requests a sandbox escalation, the plugin automatically judges whether the operation is dangerous or explicitly confirmed by the user.
• Safe operations are auto-approved (allowed-once); risky/ambiguous operations are forwarded to the user for confirmation; clearly malicious or destructive operations are rejected.
• For ambiguous cases, an optional LLM review decides; if the LLM is unavailable or unsure, it safely falls back to asking the user.

This is a community project and is not affiliated with or endorsed by DeepSeek.

Features

• New permission preset: extends the official permission-presets table through cordis.patch.yml. The UI permission dropdown gains an auto-review option, which writes workspace-write + ask and records the auto-review preset.

• Structured auto-decision notices: whenever the plugin auto-approves or auto-rejects, it injects a form: notice plugin message. The collapsed transcript row shows a one-line summary (e.g. approved(low) · bash · workspace-write · npm test); expanding it shows multi-line detail: outcome, risk level, authorization basis, tool, requested sandbox mode, the decision basis (matched rule name / fast path / LLM rationale) and the actual command (flattened to one line, capped at 160 chars):

  Automatic approval review approved (risk: low, authorization: user-confirmed)
  tool: bash
  mode: workspace-write
  basis: auto-approve: workspace-write escalation without a high-risk rule
  request: run the tests
  command: npm test
  

  On dsh ≥ 0.2 the client half of the plugin (client/client.js) renders this message as a transcript row — collapsed it shows "Auto-review approved / Auto-review denied" plus the one-line summary, expanded it shows the full detail. The 0.2 Chat no longer shows plain injected-context rows (only those carrying tool additions/removals), so the plugin registers a conversation node kind of its own; on earlier dsh the built-in "Context injection" row already shows the message, and the plugin detects that Chat generation and skips its registration to avoid a duplicate row.

• Auto permission icon: on load, the plugin automatically adds an auto-review icon (shield + sparkle) to the installed DSH permission selector, matching the built-in presets. It patches the selector bundle of the installed dsh (@deepseek-ai/dsh-client-ui-permission-presets on dsh ≥ 0.2, the conversation bundle before that). Re-applies automatically after upgrading or reinstalling dsh; a browser hard refresh picks it up.

• Approval waterfall prepend: uses ctx.on('approval/request', handler, true) to place the reviewer before the interactive UI answerer; returning allowed-once/rejected decides immediately, while calling next() falls through to the normal human confirmation prompt.

• Multi-level safety policy:

  • Fast approve: workspace-write escalation that is not high risk;
  • User-confirmed approve: recent user messages contain explicit signals such as "please run / I confirm / allow", and the operation is not a critical destructive one;
  • Ambiguous → human: the LLM returns ask, the LLM is unavailable, or it times out;
  • Direct reject: matches the blocklist, or is a critical destructive operation without user confirmation (rm -rf /, mkfs, curl | sh, etc.).

• Optional LLM review: by default, uses the current session's provider/model for a short JSON review of ambiguous requests; you can configure a dedicated llmProvider/llmModel.

Installation

Install from GitHub (recommended)

dsh plugin --profile web add github:AntaresCorn/dsh-auto-reviewer

Or clone and install manually (the repo ships a compiled lib/; for local-directory installs, install dev dependencies and link the host packages first):

git clone https://github.com/AntaresCorn/dsh-auto-reviewer.git
cd dsh-auto-reviewer
npm install
npm run link-host
cd ..
dsh plugin --profile web add /path/to/dsh-auto-reviewer

Note: dsh plugin add /path/to/dir installs through a link: to that directory, so you must run npm install and npm run link-host in the repo before installing.

Compatibility: peerDependencies cover dsh prereleases from 0.0.1-rc through 0.2.x. On dsh ≥ 0.2 every persisted message source must carry a producer-owned kind, so the notices use dsh-auto-reviewer (dsh's session-format migration rewrites older logs automatically).

This version also ships a client half (client/client.js) that renders the notice row. It is only loaded by a runtime with the client module system (dsh ≥ 0.1.5); older runtimes simply don't load it and are unaffected — their built-in "Context injection" row keeps showing the notice. Versions and changes: Releases.

Local build

npm install          # install dev deps such as typescript / @types/node
npm run link-host    # symlink node_modules/@deepseek-ai to the installed dsh host packages (avoids duplicate copies)
npm run build        # src/ → lib/ (the repo already ships the compiled output; regular users don't need to build)
npm test             # node:test unit tests: notice formatting, decision branches, notice-row bundle

After install/injection, fully restart DeepSeek Harness, open a new session, and select auto-review in the permission picker.

Reload the browser page once after the backend restart: the client bundle is rev-stamped, so an ordinary reload suffices — notices already recorded in earlier sessions then render as rows too.

⚠️ Lesson learned (tested 2026-08-16): do not hot-load the plugin with dev_install_package / dev_inject_plugin during a running conversation and continue using it. The hot-load path is inconsistent with the official bundle assembly and can corrupt loader/agent context (Cannot read properties of undefined (reading 'enabled')). Install through the official dsh plugin --profile web add <dir> and then systemctl --user restart dsh-web (or your equivalent restart method). The dev directory's node_modules is for local build/typecheck only; don't let it become the runtime dependency source for a profile link.

Usage

1. Open a new (or existing) session.
2. Select auto-review in the permission dialog/settings.
3. Let the model work normally. When it requests sandbox_permissions escalation after a sandbox denial, the plugin decides automatically:
   • Safe → auto-approved;
   • Risky → manual confirmation prompt;
   • Clearly malicious / unconfirmed destructive → rejected.

Configuration

The plugin's default configuration is provided in cordis.patch.yml. You can override it through the profile's cordis.patch.yml:

Security notes

• Any internal exception fails closed: it calls next() to ask the user and never auto-approves.
• Auto-approval is one-shot (allowed-once); it does not remember "always allow".
• This plugin does not bypass the never policy: if the session is switched to danger-full-access (approval: never), the approval service rejects before reaching this plugin.
• Read the source before installing; the plugin only makes permission decisions and only makes LLM review calls (no other network requests).

Repository structure

dsh-auto-reviewer/
├── client/client.js          # client half: renders the notice row in the transcript
├── cordis.patch.yml          # extends permission presets + mounts the plugin
├── package.json              # plugin package metadata (dsh.bundle.patch + dsh.client)
├── scripts/build.sh          # tsc build script (no DSH checkout required)
├── scripts/link-host-deps.sh # symlinks host @deepseek-ai deps (avoids duplicates)
├── src/index.ts              # auto-review implementation
├── test/                     # node:test unit tests (host decision branches + notice-row bundle)
├── README.md                 # Chinese README
└── README.en.md              # English README

License

BSD-3-Clause