Risk-gated approval automation for DeepSeek Harness: flash pre-classifies whether a write/command is irreversible — safe operations are auto-approved, dangerous ones are escalated to human approval (fail-safe).
Install
# from npm (prebuilt)
dsh plugin --profile web add dsh-approval-gate
# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)
dsh plugin --profile web add github:moon09300731/dsh-approval-gate
Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time. Only install sources you trust, and pin a commit (github:owner/repo#sha).
README
简体中文 | English
dsh-approval-gate
Auto-approval gate for DeepSeek Harness — minimal human intervention: safe operations auto-approve, risky ones go to a human (fail-safe).
A Flash model pre-judges every sandbox escalation: routine operations auto-approve, hard-risk operations (deletion / credentials / remote / system / bulk) always require human confirmation; learned rules only ever cover operations you confirmed, with an in-app human review UI.
✨ Features
- ⚡ Flash risk pre-judgment: every sandbox escalation is judged by a Flash model (
SAFE/RISKY:<category>); recoverable operations auto-approve - 🛡️ Hard risks are always human: deletion, credentials, remote/production, system paths, and bulk irreversible operations go directly to human — no counting, no learning
- 🎯 Confirmation-based learning: after N-1 human confirmations of the same operation, it auto-approves; persisted rules carry an operation fingerprint, so only operations you confirmed are auto-approved
- 🧠 Semantic similarity verification: operations with different wording but the same intent are judged by Flash against your confirmed samples — no keyword dependency
- 🔧 Hot-reloadable config:
allowlist.jsonedits take effect immediately, no restart - ✅ Human review UI: a green notice appears above the composer on auto-approval; the "Approval" view (right of Trajectory) shows the current session's full auto-approval timeline
📸 Screenshots
| Auto-approval notice (in conversation) | Approval history view |
|---|---|
 |
 |
🚀 Quick Start
dsh plugin --profile web add dsh-approval-gate
- Add the permission preset: append the
auto-approvepreset to~/.dsh/profiles/web/cordis.patch.yml(see guide) - Restart
dsh web - Select the preset: choose "Auto Approval (Flash)" in the session's permission dropdown
📖 Docs
📄 License
MIT
Links
More in this category
superdesigndev/treg★ 428
Tool catalog for agents: search ~2,600 external endpoints (SEO and SERP, backlinks, social, people and company enrichment, ad libraries, scraping) by the task you want done, read each one's parameters and per-call price, then call it with the credential injected server-side. Ships the skill plus an MCP row that stays disabled until TREG_TOKEN is set.
Lum1104/dsh-browser★ 216
Chrome sidebar extension that lets DSH operate your browser directly, no vision capabilities required.
zhaoolee/notes★ 142
Export DSH conversations as Smartisan Notes-style PNGs, or create and update Markdown notes in a configured account-scoped workspace.
liustack/modsearch★ 115
Web search bridge for text-only agents: ask the web or X, get structured JSON evidence (search, fetch, citations).
taxueseek/argo★ 94
Search built for agents: multilingual coverage across web, academic, code, shopping, finance, news, and encyclopedias.
Vladimir-Human/ru-marketplace-mcp#dsh★ 64
Skills and optional MCP rows for ten Russian marketplaces: price comparison across Wildberries, Detsky Mir and Yandex Market, plus per-source search, product cards and reviews. The 13 skills load on install; both MCP rows stay disabled until RU_MARKETPLACE_MCP_DIR points at a local clone, which needs Python 3.12+ and uv.