dsh-handoff-review
A DeepSeek Harness plugin that hands the
current session's changes to a linked, read-only review session — a
round-by-round handoff review in the spirit of OpenChamber.
The implementation session keeps working; an ordinary review session in the same
workspace reviews the change in an independent context. Its report can be sent
back to the implementer, later revisions can be sent back to the reviewer, and
every round is kept in a durable link record. The plugin only adds commands,
routes, projections, listeners and UI slots: nothing is written into the DSH
kernel, and removing the bundle removes everything it registered.
Handoff review panel
Link state, both sessions, actions and round history in the right-sidebar
panel (session and link ids masked).
Handoff review settings
Reviewer route and handoff limits under Settings → Handoff Review.
Features
- One command to start.
/handoff-review focus on retry logic (or the
composer dock button) creates or reuses a link, opens a review session and
delivers a handoff brief: goal, review focus, changed files, unified diff,
verification and open questions.
- Read-only reviewer. Three independent layers: a durable
sandbox/mode: read-only session event, removal/denial of write tools on the
reviewer's scoped tool runtime, and an approval: never policy.
- Round loop. Send the reviewer's report back to the implementation session;
after the fixes, send only the changes after the last handoff watermark as
round + 1.
maxRounds, per-round dedupe and a delivery rate limit keep the
loop bounded.
- Panel and history. Right-sidebar panel with link state, both sessions with
real navigation, expandable round history, handoff/report previews, a
changed-files diff drawer, and multi-link selection in the dock.
- Optional auto-continue. Start the review once and reports/revisions are
delivered automatically when each turn ends, until a stop condition (see
below).
- Configurable reviewer. Provider, model, thinking effort and agent preset,
picked from the installed catalog.
- Localized UI. English and Traditional Chinese, light/dark via theme
tokens.
Requirements
- DSH Desktop (
0.2.x) with ctx.storageDomain available (the stock desktop
profile satisfies this).
- Node.js >= 20 for development and tests.
Install
This is a profile bundle with a Host half and a Web Client half. The desktop
profile is managed by the app, so install it through the app:
- Open Settings → Plugins → Install bundle.
- Enter the absolute path of this directory (or a packed package).
- Restart DSH Desktop so the new Host/Client generation loads.
The bundle patch (cordis.patch.yml) contributes one composition row:
- insert:
- id: handoff-review
name: dsh-handoff-review
config:
maxRounds: 3
maxHandoffChars: 30000
diffPerFileChars: 6000
Use
- Work in an implementation session until it has
edit/write changes.
- Run
/handoff-review focus on retry logic, or click Handoff review in the
composer dock. The review session appears in the same workspace, titled
Review: <impl title> (round N).
- Open the review session and let the reviewer work.
- When the reviewer finishes, the link becomes
feedback_ready. In the
implementation session press Send feedback (or run
/handoff-review feedback from the review session).
- After the fixes, press Send revision (or
/handoff-review revision) — only
changes after the last handoff watermark are sent, round + 1. Past
maxRounds, the dock offers Send revision (force) and the command accepts
--force.
- Repeat, then press Close (or
/handoff-review close). Sessions are never
deleted; the review session keeps its history.
| Command | Purpose |
|---|
/handoff-review [focus] | create/reuse a link and deliver a handoff |
/handoff-review status | print the current link state |
/handoff-review feedback | send the reviewer's report to the implementer |
/handoff-review revision [--force] | send new changes as the next round |
/handoff-review close | close the link (history is kept) |
/handoff-review reopen | reopen a closed link |
/handoff-review --new [focus] | open another link for the same session |
/handoff-review -- <focus> | escape a focus that starts with a command word |
Automatic continuation
Enable Settings → Handoff Review → 行為 → 自動接續審查流程 once. From then on
starting a review is the only manual action: when the reviewer turn ends its
report is delivered to the implementation session, and when the implementation
turn ends the new changes are sent back to the reviewer. The loop stops at
maxRounds (no automatic --force), when there are no new changes, when a peer
session is offline, or when the link is closed. A stop injects a non-waking
[handoff-review] notice instead of looping, and automation re-arms on restart
or when a peer session is reopened.
Settings
Settings are persisted in the plugin's own storage domain
(handoff_review_settings) — no profile YAML edits.
| Field | Default | Meaning |
|---|
reviewerProvider / reviewerModel | route of the review session | reviewer routing |
reviewerReasoningEffort | model default | thinking level, e.g. high |
reviewerPreset | deployment default | agent preset for the review session |
maxRounds | 3 | revisions beyond this need --force |
autoContinue | false | run the review loop automatically |
The page also exposes maxHandoffChars (30000), diffPerFileChars (6000),
autoSummarize (off), readOnlyReviewer (on) and maxDeliveriesPerMinute (6).
A saved value applies to new reviews; an existing link keeps the reviewer route
captured when it was created.
Security
- The reviewer cannot modify files (sandbox mode, tool guard, approval policy).
- Reviewer reports are untrusted data: every cross-session message starts with
[handoff-review] … and marks itself as data, not instructions.
- Credential-looking diff lines (
*_KEY, *_TOKEN, password, secret,
api[_-]?key) are redacted and .env-like files are skipped. A diff can still
contain sensitive material — treat handoffs like patches.
/handoff-review/api/* are exact web-server routes and apply the host
browser-trust fence themselves; no approval escalation is performed.
Development
pnpm install # or npm install
npm run check # node --check on every module
npm test # node:test unit + integration suite (92 tests)
Tests cover the handoff builder, projections, link store, delivery loop breaker,
route fence, command grammar, reviewer lockdown, config admin and a fake-Cordis
round trip (create → feedback → revision → close → reopen).
Status and limitations
- A review session cannot create another link, so review-of-review chains are
intentionally blocked.
- No cross-machine sync/relay; no Review button inside the official diff card
(no public slot — the standalone diff drawer is used instead).
- The UI is localized (en / zh-TW); Host-side command receipts and route errors
are Traditional Chinese only.
See DEVELOPMENT.md for the full specification, assumptions
and as-built notes.
License
MIT