dsh-automode
DeepSeek Harness 的 CC 风格自动模式：确定性的拒绝/允许规则 + 执行前门控 + 与模型无关的两阶段分类器。采用 TypeScript 重写，合并 dsh-auto-mode v0.4.1 与 Nuo-cl/dsh-auto-mode 原生集成。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:log-li/dsh-automode#ab4961b4379a75e605188fac132bab90859e5ad5Automode 以 dsh-automode 发布，当前版本为 0.5.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
CC-style auto-approval for DeepSeek Harness. Deterministic deny/allow rules handle the obvious cases; a model-agnostic two-stage classifier decides everything else — with circuit breaker, fail-closed semantics, persistent JSONL logging, and native permission preset integration.
dsh plugin add dsh-automode
Tool call arrives
│
├─ [pre-execute gate] (all tools; deny reason reaches the model verbatim)
│ ① Read-only tools → allow (unless deny matched)
│ ② Deny rules (regex) → hard reject
│ ③ Allow rules (prefix glob) → approve
│ ④ allowInsideWorkingDirectory → in-tree file ops approve
│ ⑤ Escalation intent → classifier pre-screen
│ ⑥ Everything else → pass through
│
└─ [approval waterfall]
① Soft deny rules (prose) → reject
② Soft allow rules (prose) → approve
③ Read-only allowlist → approve
④ Verdict cache hit → reuse
⑤ Classifier (two-stage: one-token filter → structured review)
⑥ Failure → failClosed
Two-layer rule system:
Hard boundary (deterministic, never goes to classifier):
deny — regex patterns that hard-reject (exfiltration, secrets, sensitive targets)allow — prefix-glob patterns that zero-LLM approve (routine commands, curated paths)Classifier guidance (prose, fed to the LLM):
rules.deny — soft-deny descriptions (force push, curl|bash, production deploys)rules.allow — soft-allow exceptions (local dev, dependency install, standard git)rules.environment — context facts (trusted repos, infrastructure)All rule arrays support $defaults: ["$defaults", "my custom rule"] keeps the built-in rules while adding yours.
# In cordis.patch.yml
- id: auto-mode
name: dsh-automode
config:
deny: [...] # Regex hard-reject patterns
allow: [...] # Prefix-glob allow patterns
readOnlyTools: [read, glob, grep, list, search]
allowPaths: ['~/Documents/'] # Curated full-trust directories
allowInsideWorkingDirectory: true
failClosed: true
preExecuteGate: true
timeoutMs: 45000
breakerConsecutive: 3
breakerTotal: 20
classifier:
provider: '' # Empty = follow session model
model: ''
maxTokens: 2048
askFallback: false # true = three-state (allow/ask/reject)
rules:
deny: ['$defaults']
allow: ['$defaults']
environment: ['$defaults']
/auto — Switch to auto mode/auto-status — Show diagnosticsAll decisions are logged to ~/.dsh/auto-mode/decisions.jsonl (JSONL format, append-only).
src/
index.ts Main entry: preset management, approval answerer, commands
config.ts Config schema + $defaults mechanism + built-in rule lists
bands.ts Deterministic band engine (deny regex + allow glob)
pre-execute.ts Pre-execute gate (first defense for all tools)
classifier.ts Two-stage classifier (one-token filter + structured review)
rules.ts Prose rule matching for the classifier
prompt.ts Classifier prompt construction
cache.ts Verdict cache (shared across enforcement points)
breaker.ts Circuit breaker (3 consecutive / 20 total)