dsh-automode
CC-style auto-approval for DeepSeek Harness. Deterministic deny/allow rules handle the obvious cases; a model-agnostic two-stage classifier decides everything else — with circuit breaker, fail-closed semantics, persistent JSONL logging, and native permission preset integration.
Install
dsh plugin add dsh-automode
How it works
Tool call arrives
│
├─ [pre-execute gate] (all tools; deny reason reaches the model verbatim)
│ ① Read-only tools → allow (unless deny matched)
│ ② Deny rules (regex) → hard reject
│ ③ Allow rules (prefix glob) → approve
│ ④ allowInsideWorkingDirectory → in-tree file ops approve
│ ⑤ Escalation intent → classifier pre-screen
│ ⑥ Everything else → pass through
│
└─ [approval waterfall]
① Soft deny rules (prose) → reject
② Soft allow rules (prose) → approve
③ Read-only allowlist → approve
④ Verdict cache hit → reuse
⑤ Classifier (two-stage: one-token filter → structured review)
⑥ Failure → failClosed
Rules
Two-layer rule system:
Hard boundary (deterministic, never goes to classifier):
deny — regex patterns that hard-reject (exfiltration, secrets, sensitive targets)allow — prefix-glob patterns that zero-LLM approve (routine commands, curated paths)
Classifier guidance (prose, fed to the LLM):
rules.deny — soft-deny descriptions (force push, curl|bash, production deploys)rules.allow — soft-allow exceptions (local dev, dependency install, standard git)rules.environment — context facts (trusted repos, infrastructure)
All rule arrays support $defaults: ["$defaults", "my custom rule"] keeps the built-in rules while adding yours.
Configuration
# In cordis.patch.yml
- id: auto-mode
name: dsh-automode
config:
deny: [...] # Regex hard-reject patterns
allow: [...] # Prefix-glob allow patterns
readOnlyTools: [read, glob, grep, list, search]
allowPaths: ['~/Documents/'] # Curated full-trust directories
allowInsideWorkingDirectory: true
failClosed: true
preExecuteGate: true
timeoutMs: 45000
breakerConsecutive: 3
breakerTotal: 20
classifier:
provider: '' # Empty = follow session model
model: ''
maxTokens: 2048
askFallback: false # true = three-state (allow/ask/reject)
rules:
deny: ['$defaults']
allow: ['$defaults']
environment: ['$defaults']
Commands
/auto — Switch to auto mode/auto-status — Show diagnostics
Logging
All decisions are logged to ~/.dsh/auto-mode/decisions.jsonl (JSONL format, append-only).
Architecture
src/
index.ts Main entry: preset management, approval answerer, commands
config.ts Config schema + $defaults mechanism + built-in rule lists
bands.ts Deterministic band engine (deny regex + allow glob)
pre-execute.ts Pre-execute gate (first defense for all tools)
classifier.ts Two-stage classifier (one-token filter + structured review)
rules.ts Prose rule matching for the classifier
prompt.ts Classifier prompt construction
cache.ts Verdict cache (shared across enforcement points)
breaker.ts Circuit breaker (3 consecutive / 20 total)
License
MIT
