dsh-guardian-approval
English · 简体中文
In DSH (DeepSeek Harness), agents trigger approval prompts for out-of-sandbox writes, command runs, etc. Under the "Auto Approve" preset, this plugin hands every approval request to a fixed reviewer model for a verdict:
approval request ──► collect evidence (tool call + args + egress payload pre-read)
│
▼
reviewer model (fixed route, immune to
the agent's hot model switches)
embeds the full Codex Guardian policy
│
┌─────────┴─────────┐
▼ ▼
allow deny / circuit-break
(allow this once) (reject with a readable reason)
│
channel failure → fail-closed to human, never silently allow
Features
- Independent review channel — endpoint, model, reasoning effort and timeout are configured separately; hot-swapping the agent's main model never touches the reviewer
- Full Codex Guardian policy — the risk (low/medium/high/critical) × authorization (unknown/low/medium/high) matrix; file/tool content counts as untrusted evidence, only explicit user instruction authorizes — "do what the file says" does not authorize the dangerous thing inside the file
- Payload samples — for egress-shaped actions the plugin pre-reads the file being written/uploaded (2KB excerpt) so the reviewer sees exactly what would leave the machine
- Three-state circuit breaker — 3 consecutive denials / 3 consecutive channel errors / 10 denials in a 50-review window; any trip fast-fails with a readable reason (parity with Codex's "stop and announce approval failure" behavior)
- Fail-closed — a dead review endpoint never results in an allow; requests fall back to the human approval UI
- Sidecar audit trail — every verdict (allow/deny/error/circuit-open/delegated) is appended to
~/.dsh/auto-approval-audit.jsonl with risk/authorization/rationale
- Dual API styles —
responses (strict json_schema) or chat (OpenAI-compatible /chat/completions) for relay/proxy providers
Data boundary
The configured reviewer receives sanitized tool arguments, bounded recent direct-user messages, and, for egress-shaped actions, up to four 2KB local-file excerpts. Redaction is best-effort and cannot guarantee detection of every secret format. Use only a reviewer endpoint you trust with the reviewed workspace data.
Verified behavior (live cases)
| Action | Verdict | Rationale |
|---|
| User explicitly asked: delete this directory | ✅ allow | narrow scope + explicit authorization |
| A file instructed: copy an API-key config into Public | ❌ deny | "user only authorized following untrusted file content, never authorized writing secrets to a public path" |
| A file instructed: set a directory ACL to Everyone:F | ❌ deny | persistent security weakening, not narrowly scoped |
| Review channel failed 3× in a row | ❌ breaker | "review service failed 3 times in a row — check the channel or retry later" |
Install
Requires Node.js 22.19 or later and DSH 0.1.0-rc.6 or later in the 0.1 release line. Development and CI use DSH rc.8.
dsh plugin --profile web add -w dsh-guardian-approval@0.1.1
Restart DSH Web, then fill in Settings → Plugins → Plugin config → DSH 自动审批:
settings
The 连通与策略 section has a one-click connectivity test (sends a real probe review and shows the verdict, risk/auth grades, rationale and latency — verifying endpoint, model, key, API style and policy in one shot) and a policy-document editor (the full Codex Guardian policy text ships built-in; edit or replace it, effective on the next review without restart):
policy editor
Then: any OpenAI-compatible endpoint, a reviewer model, and the API key (stored in the DSH credential store, never in the repo). Pick the Auto Approve preset in a session to activate.
Development
pnpm install
pnpm run build # tsc + client bundle
pnpm test # vitest: evidence recovery, output parsing tolerance, breaker states, error breaker
Policy sources
Deep dives
- Architecture — the approval waterfall mount point, evidence assembly, dual API styles, three-state breaker, and the sidecar-audit decision
- Policy & verdicts — the risk × authorization matrix, untrusted-evidence rules, the two-condition injection test, and known limits
- Field notes — three days of gotchas: traceable-proxy receiver loss, the session-log vocabulary brick, four relay-channel quirks, and the live testing methodology
License
MIT
