dsh-jev-interceptor
DeepSeek Harness 中每次工具调用的毫秒级 System-1 判断：由 Jev 驱动的风险分类与基于证据门控的自动批准，设计上默认故障关闭。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-jev-interceptor@0.4.2
Jev Interceptor 以 dsh-jev-interceptor 发布，当前版本为 0.4.2。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
⚡ Millisecond judgement for every tool call and every recalled message — for about two millionths of a dollar each.
Your agent's most expensive habits: asking a poetry-writing LLM yes/no questions, and amputating your context by age. This plugin wires Jev — the non-generative "System One" model that broke everyone's feed — into the decision points of DeepSeek Harness where an LLM is overkill and rules are blind.
English | 中文
dsh-jev-interceptor screenshot
What it does, in one breath: before a tool call runs, Jev classifies its risk, irreversibility, task-fit, and injection-suspicion in one ~$0.00002 request — confident high-risk calls get denied, medium ones escalate to a human, and clearly-granted reversible ones stop wasting your clicks on approval dialogs. And when an @session snapshot gets injected, Jev scores every message's value for the citing task so the error traceback survives the byte budget instead of the oldest small talk. Every doubt, every timeout, every missing key degrades to stock dsh behavior. Nothing to configure away, nothing that can widen a permission.
dsh ships zero per-call risk classification — the pre-execute waterfall's default is a bare allow. Its only built-in precedent, experimental/auto-review, does the classification with a generative LLM: one full model request per tool call, temperature 0, hand-rolled JSON text protocol, self-described as slow, expensive, and experimental. That's a System-2 scribe doing a System-1 reflex's job:
| auto-review (generative LLM) | dsh-jev-interceptor (Jev) | |
|---|---|---|
| Decision shape | emits JSON token-by-token, then parses it and prays | typed choice/noul answers — type errors are structurally impossible |
| Cost per call | one full LLM request | ~$0.00002 (measured: 501 input tokens) |
| Latency | seconds | ~100ms provider-side (TypeSafe-reported p50); ~1s end-to-end from outside US-West |
| Uncertainty | buried in prose | per-question probability distributions + calibrated confidence |
| Failure path | parse fallback → deny | low confidence → next() — it never guesses |
Jev's maker TypeSafe reports up to 200× faster / 400× cheaper than LLMs on classification workflows — and this plugin is that number, landed in a real agent harness, with receipts in /jev-stats.
We believe this is the first System-1 decision plugin in the dsh ecosystem. The full map of where decision models fit in dsh — this plugin's two hooks plus eleven more verified hooks (semantic model routing, context-retention scoring, image-offload pre-planning, worker-report verification...) — is in docs/jev-usage-points.md.
When you @-mention a past session in dsh, the harness injects a bounded snapshot of it — and when that snapshot exceeds its byte budget, it drops messages oldest-first. Pure FIFO. Zero semantics. The bug report you pasted at the top of the session and the three-line question that started it all? Dropped first. The "thanks!" and "ok, continue"? Kept — they were newer.
dsh's own retention code is honest about it: drop the oldest, then truncate the longest, done. This plugin's jev-session-reference row takes that decision over (by subclassing the upstream resolver, so @-completion, budgets, spill, and cancellation stay inherited): one Jev fan-out scores each droppable message — noise / background / relevant / critical — and the drop order becomes least valuable first, with truncation cutting padding before substance. Checkpoints and the newest message stay protected exactly as upstream; the byte budget is honored exactly as upstream; and with sessionReferenceEnabled: false (the default) the row renders byte-for-byte like stock.
In shadow mode you get the receipts before trusting it: every injection logs the counterfactual — which messages FIFO dropped that scoring would have kept — then flip to enforce.
dsh plugin --profile <name> add dsh-jev-interceptor
# in your profile's cordis.patch.yml
- id: jev-interceptor
name: dsh-jev-interceptor
config:
enabled: true
mode: shadow # watch mode first: records every decision, enforces nothing
provider: typesafe # or 'openrouter' (works today, no waitlist) | 'custom'
No YAML needed. Once installed, control everything from the chat box — commands persist to the profile and take effect on the next tool call, no reload:
/jev-on # enable (starts in shadow mode — records, never acts)
/jev-stats # watch what it decides, with full probability distributions
/jev-mode enforce # promote once the numbers look right
/jev-off # back to stock behavior
Use your agent normally. In shadow mode every decision lands in telemetry with its full probability distribution; /jev-stats summarizes:
[guard] calls: 41 degraded: 0 cached: 9
actions: delegate=33 ask=6 deny=2
input tokens: 18234 est. cost: $0.000766
latency: p50 247ms p95 512ms max 611ms
Happy with the numbers? Flip mode: enforce. That's the whole rollout plan — shadow first, then trust, never guess.
allow. "No objection" is expressed as next(), so downstream listeners (external hooks, auto-review) keep their veto.never policy is enforced upstream of every listener, so this plugin structurally cannot relax it.allowed-once requires captured argument evidence: only a call the guard escalated (fresh pending entry, matching session and tool) can be auto-approved. Hook asks and sandbox escalations carry no arguments and always go to the human.state data field only; instructions are fixed strings; a suspected-injection answer escalates rather than suppresses. (Jev's maker acknowledges adversarial inputs can sway classifiers — so denial here is an accelerator, never the last line of defense.)jev-session-reference row replaces the upstream session-reference row; toggling only this row off in the Plugins UI would leave no session-reference active. Remove the takeover by disabling the whole dsh-jev-interceptor bundle layer (setBundleEnabled(false)), which restores the upstream row.<dsh-home>/plugins/dsh-jev-interceptor/telemetry.jsonl (honoring $DSH_HOME); /jev-stats aggregates it per hook.All of this is enforced by 77 tests, including adversarial-review regression cases (a concurrency leak that could hang the tool pipeline, cross-session callId collisions, evidence-free auto-approval).
Everything is a config field — timeouts, cooldown, concurrency, cache, per-hook thresholds, tool lists — see the Config schema in src/config.ts. Notable defaults:
read, read_image, grep, glob, todo_write) short-circuit with zero cost;auto-review (no double review, no double billing);preapproveToolAllowlist, nothing is ever auto-approved.Semantic session retention lives on its own row (disabled and byte-for-byte stock until you arm it):
- id: jev-session-reference
config:
sessionReferenceEnabled: true # false (default) = pure passthrough
mode: shadow # records would-be retention, renders stock FIFO
provider: openrouter
apiKeyEnv: OPENROUTER_API_KEY
OpenRouter works today with no waitlist (decisions models live on a dedicated endpoint there):
provider: openrouter
apiKeyEnv: OPENROUTER_API_KEY
The client speaks the plain state + questions wire shape shared by TypeSafe direct, OpenRouter, and the Apache-2.0 local alternative Laya — providers stay swappable, and a closed provider never becomes a lock-in.
npm install --legacy-peer-deps # devDeps pin a current dsh API generation
npm run typecheck # src + tests, against real @deepseek-ai types
npm test # vitest, 77 tests, no network
npm run build # tsc -> lib/
node scripts/smoke.mjs # one real decision against a live provider
The approval loop (v0.1) and semantic session retention (v0.2) are in. The verified next frontiers — where selection, not just safety, meets System-1 (full catalog):