dsh-auto-mode
中文文档：README.zh-CN.md
An auto mode for DeepSeek Harness (DSH), shown as an Auto mode entry in the permission picker next to read-only / workspace-write / danger-full-access. While auto mode is selected, tool calls that would normally require a user confirmation are decided automatically:
- explicit deny rules → rejected (operator vetoes always win)
- explicit allow rules → approved
- pre-approved tools → approved without a model call
- otherwise a review model inspects the conversation transcript and the requested call, then approves, blocks, or flags it for human confirmation
- when the review model produces no ruling (API error, abort, truncation): reject (
failClosed) or fall back to the ordinary approval chain (a prompt)
Compatibility
Tested against DSH 0.1.0-rc.6. The bundle patch restates the stock permission-preset table (read-only, workspace-write, danger-full-access); after a DSH upgrade, review that table in cordis.patch.yml and update it if the stock presets changed.
Install
dsh plugin --profile web add dsh-auto-mode@<version>
or, for a local checkout:
# add to C:\Users\<you>\.dsh\profiles\web\package.json
# "dependencies": { "dsh-auto-mode": "file:E:/Project/Interests/dsh-auto-mode" }
# "dsh.profile.bundles": [..., "dsh-auto-mode"]
pnpm install --dir C:\Users\<you>\.dsh\profiles\web
Restart the web app. The permission picker (bottom-left of the chat box) now shows Auto mode; /auto switches the current session directly.
The picker entry is declared by the plugin's bundle patch (cordis.patch.yml). DSH's stock permission glyph table has no icon for custom preset ids, and the UI intentionally falls back to text-only labels — this plugin does not patch the DSH client bundle.
Configuration
All options have defaults; a bare {} config is valid.
| Path | Type | Default | Meaning |
|---|
classifier.provider / classifier.model | string | '' | Route for classifier calls; empty follows the session's current model. |
classifier.maxTranscriptMessages | number | 40 | Trailing transcript messages fed to the classifier. |
classifier.maxTokens | number | 512 | Classifier output budget. |
classifier.temperature | number | 0 | Classifier sampling temperature. |
classifier.askFallback | boolean | true | Classifier decision "ask" (uncertain risky call) falls back to the human approval chain; false treats it as a rejection. |
rules.allow | string[] | [] | Always-allow rules (see rule syntax below). |
rules.deny | string[] | [] | Always-reject rules; evaluated before everything else. |
rules.environment | string[] | [] | Free-form environment facts injected into the classifier prompt. |
allowlist | string[] | read, glob, grep, todo_write, web_search, job_list, list_agents | Tools approved without a classifier call. |
failClosed | boolean | false | true: classifier failure rejects; false: falls back to the normal approval chain. |
The auto-mode preset's label, description, and sandbox mode live in cordis.patch.yml, because the permission-preset table must be available when @deepseek-ai/dsh-permission-presets constructs its settings schema.
Rule syntax
tool match a tool by name (case-insensitive), e.g. `read`
tool:pattern match a tool whose request reason contains the pattern, e.g. `read:/etc/`, `pwsh:rm -rf`
* any tool
*:pattern any tool whose reason contains the pattern
A pattern containing * or ? is a wildcard match against the whole reason (read:/etc/*); any other pattern is a case-insensitive substring match.
How it works
- Mode state — auto mode is the session's selected
permission/preset value 'auto-mode'. The preset itself bundles workspace-write sandbox and the core-valid approval policy ask. The plugin detects that preset and takes over the approval answerer; it never writes an out-of-union approval/policy value and never patches DSH core services.
- Decision chain — the plugin registers an
approval/request answerer with prepend, so in auto mode requests are claimed before the web UI answerer. The review model returns one of three decisions:
allow — approved without prompting;reject — the reviewer judged the call harmful or contrary to the user's interests. The model is told explicitly that the reviewer, not a person, blocked the call (the tool layer reports both outcomes as "the user rejected…");ask — consequential but plausibly intended (installs, writes outside the workspace, sends data): the plugin shows a confirmation dialog with three choices — allow, reject, or reject and type what should happen instead. The typed text is injected directly into the session (visible at the next model step, bypassing inbox scheduling). Without a questions provider the ordinary approval chain is used instead.
In any other permission preset the answerer delegates immediately.
- Review call — built from the session's derived messages plus the requested action, streamed through
ctx.llm with temperature: 0; the reply is parsed robustly (JSON object or token scan). The review prompt carries the operator's standing approvals, standing rejections, and environment notes in separate sections.
- Model awareness — the plugin shadows the core
approval:policy system-prompt context per agent so an auto-mode session is reported as auto, not ask, and tool-result wording ("the user rejected…") is clarified as a reviewer ruling rather than a human veto.
- Settings page — because
cordis.patch.yml declares the auto-mode preset at construction time with the valid ask approval value, the new-session default picker can advertise it without any runtime promotion or service patching.
Security & privacy
Auto mode is a convenience mode, not a security boundary:
- the review model reads the recent conversation transcript and the requested action, and sends them to the configured LLM route (by default the session model);
- the default preset runs with
workspace-write sandbox, so workspace-external writes still require sandbox escalation/approval paths;
- malicious content in the workspace (files, tool results) can attempt prompt injection against the review model — deterministic deny rules and the pre-approved tool list are evaluated before the model and should carry the rules you actually depend on;
- set
failClosed: true if you want review-model failures to reject instead of prompting.
Development
npm install
npm run typecheck # tsc --noEmit
npm run build # tsc -p tsconfig.build.json → lib/
npm test # smoke tests for pure logic
License
MIT
