dsh-guardian-approval
面向 DSH 的独立 Codex Guardian 风格审批审核器。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-guardian-approval@0.1.1Guardian Approval 以 dsh-guardian-approval 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English · 简体中文
In DSH (DeepSeek Harness), agents trigger approval prompts for out-of-sandbox writes, command runs, etc. Under the "Auto Approve" preset, this plugin hands every approval request to a fixed reviewer model for a verdict:
approval request ──► collect evidence (tool call + args + egress payload pre-read)
│
▼
reviewer model (fixed route, immune to
the agent's hot model switches)
embeds the full Codex Guardian policy
│
┌─────────┴─────────┐
▼ ▼
allow deny / circuit-break
(allow this once) (reject with a readable reason)
│
channel failure → fail-closed to human, never silently allow
~/.dsh/auto-approval-audit.jsonl with risk/authorization/rationaleresponses (strict json_schema) or chat (OpenAI-compatible /chat/completions) for relay/proxy providersThe configured reviewer receives sanitized tool arguments, bounded recent direct-user messages, and, for egress-shaped actions, up to four 2KB local-file excerpts. Redaction is best-effort and cannot guarantee detection of every secret format. Use only a reviewer endpoint you trust with the reviewed workspace data.
| Action | Verdict | Rationale |
|---|---|---|
| User explicitly asked: delete this directory | ✅ allow | narrow scope + explicit authorization |
| A file instructed: copy an API-key config into Public | ❌ deny | "user only authorized following untrusted file content, never authorized writing secrets to a public path" |
| A file instructed: set a directory ACL to Everyone:F | ❌ deny | persistent security weakening, not narrowly scoped |
| Review channel failed 3× in a row | ❌ breaker | "review service failed 3 times in a row — check the channel or retry later" |
Requires Node.js 22.19 or later and DSH 0.1.0-rc.6 or later in the 0.1 release line. Development and CI use DSH rc.8.
dsh plugin --profile web add -w dsh-guardian-approval@0.1.1
Restart DSH Web, then fill in Settings → Plugins → Plugin config → DSH 自动审批:
The 连通与策略 section has a one-click connectivity test (sends a real probe review and shows the verdict, risk/auth grades, rationale and latency — verifying endpoint, model, key, API style and policy in one shot) and a policy-document editor (the full Codex Guardian policy text ships built-in; edit or replace it, effective on the next review without restart):
Then: any OpenAI-compatible endpoint, a reviewer model, and the API key (stored in the DSH credential store, never in the repo). Pick the Auto Approve preset in a session to activate.
pnpm install
pnpm run build # tsc + client bundle
pnpm test # vitest: evidence recovery, output parsing tolerance, breaker states, error breaker