dsh-approval-ai-review
通过 AI 审核为 DeepSeek Harness 自动批准：在任何人工应答者运行前，使用一次辅助模型调用判断每个待批准请求，自动批准安全请求，并将所有其他请求连同审核分析一并升级处理
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:kiiiiile/dsh-approval-ai-review#1f9559c163f455210d363af70e71ac2d48384d9bApproval Ai Review 以 dsh-approval-ai-review 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A DeepSeek Harness plugin (dsh-plugin).
dsh plugin --profile web add dsh-approval-ai-review
Or from GitHub: dsh plugin --profile web add github:kiiiiile/dsh-approval-ai-review.
Use this package to stop confirming every safe tool ask by hand. When enabled for a session, each pending approval ask is judged by one auxiliary model call before any human answerer runs: a safe operation is granted automatically, and every other outcome — escalation, review failure, deadline, malformed output — reaches the remaining answerers with the review's analysis (what the operation would do, what it risks) attached to the request. The plugin ships inert: without /auto-approve on (or enabled: true) it delegates every ask unchanged.
Compose this plugin after @deepseek-ai/dsh-user-approval in deployments whose permission mode still asks: the reviewer consumes the same approval/request waterfall the Web and ACP answerers listen on, registered with prepend so it settles before any prompt appears. It requires ctx.llm; the review call reuses the agent's routed conversation model unless an explicit route is configured.
- name: 'dsh-approval-ai-review'
config:
enabled: true
| Field | Default | Meaning |
|---|---|---|
enabled | false | Composition default for sessions without an approval/review/enabled override |
reviewProvider / reviewModel | follow the conversation model | Explicit review route; must be supplied together |
reasoningEffort | low | Reasoning effort for the review call (off/low/high/max) |
maxTokens | 2048 | Output-token cap for one review call |
reviewTimeoutMs | 30000 | End-to-end review deadline |
The exhaustive configuration surface is the Config schema in src/index.ts.
/auto-approve [on|off] appends the durable approval/review/enabled switch to the session log (the last event wins; without one the composition default applies), and bare /auto-approve reports the current state. The switch is log-only: the model never sees it.
The reviewer receives the tool name, the exact tool/call arguments from the session log when the ask carries a call id, and the asker's reason. A validated {"verdict":"approve"} resolves the ask allowed-once. Anything else — an escalate verdict, a transport error, a fired deadline, malformed output — delegates the ask to the remaining answerers with the review's analysis appended to the request reason, so the human prompt states what the operation would do and what it risks. Without a composed answerer the seam's own fail-closed unavailable applies.
The observable behavior is covered in Use this package; this section explains dispatch, the review call, and the log path.
| File | Role |
|---|---|
src/index.ts | Plugin registration, the prepend approval/request listener, the /auto-approve command |
src/reviewer.ts | Route resolution, reviewer prompts, verdict parsing, session-log reads |
src/types.ts | Config, verdict vocabulary, and the three log-only session events |
The prepend listener owns safe decisions and delegates everything else. On escalation it mutates the shared request's reason (the mutate-then-delegate pattern of the waterfall contract) so downstream answerers present the analysis; the committed approval/asked audit event already carries the asker's verbatim reason, so the log is unaffected.
The call is one hand-built ctx.llm.stream() request with the review system prompt and a JSON-framed input; the exact route, effort, prompts, and cap are appended as approval/review/request BEFORE dispatch, and the parsed verdict as approval/review/verdict, so the auxiliary request is reconstructable from the session log. A merge-extensible finish reason falls through unknown kinds to failure, and every failure path escalates — this plugin never rejects on its own authority.
Nothing new. The three review events and the toggle switch are log-only; the model sees the eventual tool outcome exactly as without the plugin, and the standing approval:policy sentence stays accurate because asks still happen — they are answered earlier.
Zero model-transcript tokens. Each enabled ask costs one auxiliary model call that never enters the conversation transcript.
Unchanged. The review call is a separate request with its own prefix; the conversation's stable request header and cached prefix are untouched.
approval/review/enabled is not seeded into delegated children the way approval/policy is; a child review default is deferred until delegation owns one.reviewTimeoutMs bounds it but does not shorten the caller's own tool-timeout budget.reasoningEffort values the routed model does not advertise fail the review (which escalates) rather than the boot; the compatible set is not known until a route exists.No ./invariant companion: the plugin owns no relationship whose observations can diverge — the review request/verdict pair is validated at the model-JSON boundary, and the ask/decided audit pair belongs to dsh-user-approval's invariant.