dsh-codex-auto-approval
DeepSeek Harness 的 Codex Guardian 审批策略与恢复
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:MagicSpirit007/CodexAutoApprovalDSH#9f58afa84a91ae86bf97856873cdd3bb2255af4dCodex Auto Approval 以 dsh-codex-auto-approval 发布，当前版本为 0.1.2。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →For long-running tasks, manual approvals are exhausting, while granting full access is nerve-racking. So I ported the Guardian reviewer behind “Approve for me”, my favorite auto-approval feature in Codex CLI, into a standalone DeepSeek Harness (DSH) plugin, including risk assessment, user authorization, structured decisions, read-only investigation, retries, and denial limits.
You can now safely run long tasks that take hours.
New top-level sessions start in CodexAutoApproval. The reviewer uses the session's current model by default. When it denies an action, the main agent receives the reason and guidance to continue with a safer alternative.
| Component | Supported version |
|---|---|
| DSH Desktop / CLI | 0.2.0-rc.2 |
| Plugin | 0.1.2 |
| Node.js | ^22.19.0 or >=24.0.0 |
The official @deepseek-ai/dsh-experimental-auto-review plugin can remain enabled alongside this plugin.
flowchart TD
action["Main agent proposes an operation"] --> review["Guardian review: current or configured model"]
review -. "When needed" .-> investigate["Read-only investigation: files, metadata, directories"]
investigate -. "Additional facts" .-> review
review -->|Allow| gates["Continue through host gates"]
gates -->|Host allows| execute["Execute this operation"]
review -->|Policy denial| deny["Block operation; return reason and guidance"]
deny -->|Propose a safer alternative| action
review -->|Technical failure| recovery["Automatic recovery, then feedback to main agent"]
recovery -->|Continue independent work| action
recovery -. "ask-user only" .-> fallback["DSH native human approval"]
fallback -->|allowed-once| gates
fallback -->|never / denied / unavailable / cancelled| stop["Do not execute"]
classDef reviewer fill:#dbeafe,stroke:#2563eb,color:#172554
classDef allowed fill:#dcfce7,stroke:#16a34a,color:#14532d
classDef denied fill:#ffedd5,stroke:#ea580c,color:#7c2d12
classDef manual fill:#f3e8ff,stroke:#9333ea,color:#581c87
classDef blocked fill:#fee2e2,stroke:#dc2626,color:#7f1d1d
class review,investigate reviewer
class gates,execute allowed
class deny denied
class fallback manual
class stop blocked
.tgz file.dsh-codex-auto-approval.Existing auto sessions continue using the official reviewer after an upgrade; select CodexAutoApproval to switch reviewers. Fresh root sessions default to CodexAutoApproval.
Desktop runtime compatibility is checked with an isolated profile and a deterministic model adapter; this does not exercise a live model or the graphical interface.
Replace my-profile with your profile and use the full path to the downloaded package:
dsh plugin --profile my-profile add /absolute/path/dsh-codex-auto-approval-0.1.2.tgz
dsh --profile my-profile --dump-config
dsh --profile my-profile
For example, in Windows PowerShell:
dsh plugin --profile my-profile add 'C:\Downloads\dsh-codex-auto-approval-0.1.2.tgz'
The bundle automatically adds the plugin layer. Desktop's dedicated profile is managed by Electron; do not launch the desktop profile with the CLI.
Use the Desktop plugin manager, or remove it from a CLI profile:
dsh plugin --profile my-profile remove dsh-codex-auto-approval
Disabling the plugin aborts pending reviews and removes its registrations. Sessions still using CodexAutoApproval return to the known preset selected before that mode, or to the host's configured default when no previous preset is known.
never. They still receive automatic reviews; a technical failure cannot prompt for human approval.run_code program, and its inner SDK calls. Approvals are not cached. Other host gates can still deny a call or require human approval.CODEX_AUTO_REVIEW_FAILED, with recovery guidance, without creating a human approval request. The agent can resolve the error or continue independent authorized work; unchanged retries and approval bypasses are disallowed. PTC inner failures also reach the main agent even when caught. Set technicalFailureMode: ask-user explicitly to restore native human fallback; only allowed-once then admits the action. Invalid session/action identity is always blocked.The default reviewer route is the main agent's current provider / model. You can select a separate route already registered in DSH. Requests use the host's adapters and credentials and may incur additional model charges.
The reviewer has three private investigation capabilities through ctx.fs: read a bounded file window, inspect file metadata, and list directory entries. It cannot invoke host tools, run shell commands, start processes, write files, or request network access. Reviewed context and any file content it reads are sent to the configured model provider.
CodexAutoApproval uses the host's full-access permission preset, subject to other host gates. Model review does not provide OS isolation or a deterministic safety guarantee. Cancellation propagation also depends on the configured model adapter.
Override the plugin row in the profile's cordis.patch.yml, or use DSH's configuration editor. A patch replaces the row's entire config, rather than merging individual fields:
- id: codex-auto-approval
config:
autoEnableNewSessions: true
# Set both fields to use a separate registered reviewer route.
# reviewerProvider: your-registered-provider
# reviewerModel: your-registered-model
reviewTimeoutMs: 90000
maxConcurrentReviews: 4
technicalFailureMode: return-to-agent
| Setting | Default | Purpose |
|---|---|---|
autoEnableNewSessions | true | Enable CodexAutoApproval for fresh root sessions |
reviewerProvider, reviewerModel | Unset | Separate reviewer route; supply both nonempty values |
reviewTimeoutMs | 90000 | Total review deadline, including queueing, investigation, and retries; human response time is separate |
technicalFailureMode | return-to-agent | Return technical failures to the agent; ask-user enables manual fallback |
maxAttempts | 3 | Maximum attempts for recoverable review failures |
maxReviewRounds | 8 | Maximum model round trips per attempt |
maxInputBytes | 131072 | Byte budget for review requests and responses |
maxReadBytes | 32768 | Maximum bytes in one investigation read |
maxDirectoryEntries | 256 | Maximum entries returned from one investigation listing |
maxConcurrentReviews | 4 | Concurrent reviews across this plugin instance |
maxConsecutiveDenials | 3 | Consecutive policy denials that stop a turn |
denialWindowSize | 50 | Recent-review window within a turn |
maxRecentDenials | 10 | Denial threshold in that window; cannot exceed its size |
Numeric settings must be positive integers. reviewTimeoutMs must also fit the Node timer range. Invalid configuration fails during loading.
The ESM entry exports name, apply, inject, and Config, with no default export. Required services are permissionPresets, approval, sessions, tools, llm, fs, and agents. The observation event codex-auto-approval/decision contains call identity, outcome, assessment, elapsed time, and numeric diagnostics (phase, byte limit/usage, remaining bytes, attempts, and budget recoveries); it excludes tool arguments and the private review conversation. Tool results and human decisions use DSH's existing persistent logs.
Codex source is pinned to d42056091aded7feb1d88ac7e83972108b2aa478. DSH API reference is pinned to 639ed015397290b3745d163aafe02ffee4aa3f84; implementation and verification use the actual npm runtime 0.2.0-rc.2. The installed Desktop's exact source commit has not been confirmed.
Apache-2.0. The adapted DSH code retains its MIT notice. Upstream attribution and changes are recorded in NOTICE. This is an independent port of the upstream functionality.