dsh-auto-mode
DSH 插件：自动模式会在批准、阻止或请求确认之前，通过 LLM 审查需要权限的工具调用。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-auto-mode@0.1.1Auto Mode 以 dsh-auto-mode 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
中文文档：README.zh-CN.md
An auto mode for DeepSeek Harness (DSH), shown as an Auto mode entry in the permission picker next to read-only / workspace-write / danger-full-access. While auto mode is selected, tool calls that would normally require a user confirmation are decided automatically:
failClosed) or fall back to the ordinary approval chain (a prompt)Tested against DSH 0.1.0-rc.6. The bundle patch restates the stock permission-preset table (read-only, workspace-write, danger-full-access); after a DSH upgrade, review that table in cordis.patch.yml and update it if the stock presets changed.
dsh plugin --profile web add dsh-auto-mode@<version>
or, for a local checkout:
# add to C:\Users\<you>\.dsh\profiles\web\package.json
# "dependencies": { "dsh-auto-mode": "file:E:/Project/Interests/dsh-auto-mode" }
# "dsh.profile.bundles": [..., "dsh-auto-mode"]
pnpm install --dir C:\Users\<you>\.dsh\profiles\web
Restart the web app. The permission picker (bottom-left of the chat box) now shows Auto mode; /auto switches the current session directly.
The picker entry is declared by the plugin's bundle patch (cordis.patch.yml). DSH's stock permission glyph table has no icon for custom preset ids, and the UI intentionally falls back to text-only labels — this plugin does not patch the DSH client bundle.
All options have defaults; a bare {} config is valid.
| Path | Type | Default | Meaning |
|---|---|---|---|
classifier.provider / classifier.model | string | '' | Route for classifier calls; empty follows the session's current model. |
classifier.maxTranscriptMessages | number | 40 | Trailing transcript messages fed to the classifier. |
classifier.maxTokens | number | 512 | Classifier output budget. |
classifier.temperature | number | 0 | Classifier sampling temperature. |
classifier.askFallback | boolean | true | Classifier decision "ask" (uncertain risky call) falls back to the human approval chain; false treats it as a rejection. |
rules.allow | string[] | [] | Always-allow rules (see rule syntax below). |
rules.deny | string[] | [] | Always-reject rules; evaluated before everything else. |
rules.environment | string[] | [] | Free-form environment facts injected into the classifier prompt. |
allowlist | string[] | read, glob, grep, todo_write, web_search, job_list, list_agents | Tools approved without a classifier call. |
failClosed | boolean | false | true: classifier failure rejects; false: falls back to the normal approval chain. |
The auto-mode preset's label, description, and sandbox mode live in cordis.patch.yml, because the permission-preset table must be available when @deepseek-ai/dsh-permission-presets constructs its settings schema.
tool match a tool by name (case-insensitive), e.g. `read`
tool:pattern match a tool whose request reason contains the pattern, e.g. `read:/etc/`, `pwsh:rm -rf`
* any tool
*:pattern any tool whose reason contains the pattern
A pattern containing * or ? is a wildcard match against the whole reason (read:/etc/*); any other pattern is a case-insensitive substring match.
permission/preset value 'auto-mode'. The preset itself bundles workspace-write sandbox and the core-valid approval policy ask. The plugin detects that preset and takes over the approval answerer; it never writes an out-of-union approval/policy value and never patches DSH core services.approval/request answerer with prepend, so in auto mode requests are claimed before the web UI answerer. The review model returns one of three decisions:
allow — approved without prompting;reject — the reviewer judged the call harmful or contrary to the user's interests. The model is told explicitly that the reviewer, not a person, blocked the call (the tool layer reports both outcomes as "the user rejected…");ask — consequential but plausibly intended (installs, writes outside the workspace, sends data): the plugin shows a confirmation dialog with three choices — allow, reject, or reject and type what should happen instead. The typed text is injected directly into the session (visible at the next model step, bypassing inbox scheduling). Without a questions provider the ordinary approval chain is used instead.
In any other permission preset the answerer delegates immediately.ctx.llm with temperature: 0; the reply is parsed robustly (JSON object or token scan). The review prompt carries the operator's standing approvals, standing rejections, and environment notes in separate sections.approval:policy system-prompt context per agent so an auto-mode session is reported as auto, not ask, and tool-result wording ("the user rejected…") is clarified as a reviewer ruling rather than a human veto.cordis.patch.yml declares the auto-mode preset at construction time with the valid ask approval value, the new-session default picker can advertise it without any runtime promotion or service patching.Auto mode is a convenience mode, not a security boundary:
workspace-write sandbox, so workspace-external writes still require sandbox escalation/approval paths;failClosed: true if you want review-model failures to reject instead of prompting.npm install
npm run typecheck # tsc --noEmit
npm run build # tsc -p tsconfig.build.json → lib/
npm test # smoke tests for pure logic
MIT