dsh-plain-approvals
DSH 插件：以通俗语言呈现带有风险等级和文件路径的审批卡片，并以通俗语言改写问题
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:MMMichelsa/dsh-plain-approvals#23dafcf12aaf06173a080aee42457604406ed170Plain Approvals 以 dsh-plain-approvals 发布，当前版本为 1.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
中文 | English
A DeepSeek Harness (DSH) profile plugin that rewrites the two most technical moments of the UI into plain language:
Everything is fail-open: if rewriting fails for any reason, the original text is shown and the operation is never blocked or altered.
Status: tested against DSH
0.2.1-rc.3. This plugin hooks internal seams (Cordis waterfalls and the browser panel'sdisplayReasonfield). Those are not public API and may change in future DSH releases. When they do, the plugin degrades to showing the original text.
The profile matters. The desktop client loads the
desktopprofile. Installing intoweb(or any other name) leaves the desktop build unable to see the plugin — the most common "installed but nothing happens" case.
install.bat in this folder.node install.mjs in this folder.The script finds Node itself (PATH, the usual install dirs, and DSH's bundled runtime), finds the DSH CLI itself, and installs into desktop by default; it then prints the next step (restart DSH).
No environment variables to configure first, spaces and non-ASCII directories in the path are fine, and package.json / pnpm-lock.yaml are backed up before anything changes.
Pick another profile with install.bat --profile <name> or node install.mjs --profile <name>.
dsh plugin --profile desktop add github:MMMichelsa/dsh-plain-approvals
Pinned version (recommended once the tag exists):
dsh plugin --profile desktop add github:MMMichelsa/dsh-plain-approvals#v1.1.1
Not on the desktop build (CLI/TUI)? Replace
desktopwith your own profile name. Installation needs network access: pnpm fetches the repository from GitHub.If
gitis not installed (pnpm reports a git error), install from the tarball instead:dsh plugin --profile desktop add https://codeload.github.com/MMMichelsa/dsh-plain-approvals/tar.gz/refs/heads/main
Confirm dsh-plain-approvals ends up in the profile's dsh.profile.bundles.
Uninstall with dsh plugin --profile desktop remove dsh-plain-approvals and remove it from dsh.profile.bundles.
Local development (link a checkout):
dsh plugin --profile desktop add link:<absolute path to this repo>
Before: Allow this operation with danger-full-access permissions: update the profile config
After: ⚠️ 会写入文件，请确认。助手要把「write」这一次调用放宽到 danger-full-access 权限
（沙箱几乎完全关闭：可以读写这台电脑上的任意文件、运行任意系统命令、访问网络），
并会写入：C:\Users\you\.dsh\profiles\desktop\cordis.patch.yml。
授权只对这一次有效，批准后无法撤回；拿不准就拒绝，助手会停下来解释，不会绕开。
理由：update the profile config
Delete / overwrite operations get a louder 🔴 card with the exact paths they will remove or overwrite.
Commands that wrap another script are unwrapped too: bash -c "rm -rf x", sh -c …, python -c …,
cmd /c …, pwsh -Command …, and even powershell -EncodedCommand <base64> is decoded and read.
Up to three levels deep; when the budget runs out the card says so instead of pretending it saw
everything — and a deeply nested command can never hang the host.
English cards carry the same information, e.g. 🔴 DESTRUCTIVE OPERATION — please confirm. The agent wants to widen this one "pwsh" call to danger-full-access (…), and it will delete or overwrite: ….
Before: Which sandbox mode should the retry use? (option labels: workspace-write / danger-full-access)
After: 这次重试应该用哪种权限？ (option labels unchanged; descriptions gain the Chinese explanation)
| UI | Before | After |
|---|---|---|
| Read-type approval (rare) | Allow this operation with read-only permissions: … | 🟢 读取操作：这次只是读取 <path>，不会改动任何文件。… |
| Write-type approval | Allow this operation with danger-full-access permissions: … | ⚠️ 会写入文件，请确认。…并会写入：<path list>。… |
| Delete / overwrite approval | same | 🔴 高危操作，请确认！…它会删除或覆盖：<path list>。… |
| Command approval without an obvious delete/overwrite | technical wording | ⚙️ 需要你批准：…没有发现明显的删除或覆盖指令，但命令仍可能有副作用… |
| Other approvals | the asker's own wording | 【需要你批准】… |
| Model question cards | model wording (possibly English or jargon) | rewritten into plain Chinese; option labels stay byte-identical, descriptions gain a label explanation |
| Class | Basis | Presentation |
|---|---|---|
| Read | tool name is read, read_image, glob, grep, web_fetch, … | 🟢 read-only note, never a high-risk warning |
| Write | write / edit / apply_patch / str_replace_editor; or a command whose first word is Set-Content, Add-Content, Out-File, Copy-Item, Move-Item, New-Item, tee, …; or a > file output redirect | ⚠️ 会写入文件 plus the paths |
| Delete | delete_file / remove_file, …; or a command whose first word is rm, del, rd, ri, rmdir, Remove-Item, Clear-Content, …; or git clean / git reset --hard / git checkout --; or shutil.rmtree / os.remove inside a script | 🔴 高危操作 plus the paths |
| Other | shell commands without any of the above; unknown tools | neutral ⚙️ note |
Approval requests do not carry tool arguments (by design in DSH), so the plugin caches each call's arguments from tools/pre-execute (keyed by callId, cleared on tools/result, at most 256 entries). File paths for write / edit come from file_path exactly; for pwsh / bash they are extracted heuristically from the command and the card says so. When neither source yields a path, the plugin falls back to paths found in the approval note, and otherwise says the path is unknown instead of guessing.
reason, the approval outcome, or your decision;id, label, multi_select, intent, detail (plan body);approval/request and user-questions/request are Cordis waterfalls that the host forwards to the browser panel. The plugin registers with ctx.on(event, listener, { prepend: true, global: true }), gets the same request object first, and:
displayReason ({ en, zh }, presentation only);question / header / option.description.deepFreezed by dsh-tools, so question objects are read-only. The plugin clones them, rewrites the clones, and replaces request.questions; approval request objects are writable, so displayReason is replaced in place.All user-visible copy lives in locale/zh.json and locale/en.json; the code only fills placeholders. A missing key falls back to English, and a key missing from both locales drops the sentence rather than printing {placeholder}. Change the wording by editing those JSON files — no model call, no code change. The two locale files must have identical keys, which the test suite enforces. Copy is neutral (“the agent” / 「助手」) and carries no author-specific persona.
The plugin appends one line per event to ~/.dsh/dsh-plain-approvals.log: activation (with build marker), approval classification (kind, sandbox mode, number of paths), question rewrite outcome and failure reason. It never logs command text, approval justifications, or question text. Delete the file at any time; it is recreated.
npm test # runs node test/index.test.mjs
node --test cannot spawn child processes inside DSH's sandbox, so the suite is a plain script using node:test directly.
Release steps are in RELEASING.md.
0.2.1-rc.3 (desktop profile, web UI).approval/request, user-questions/request, tools/pre-execute, tools/result, and the client approval panel's displayReason. Not official API.Get-ChildItem C:\rd\x is not mistaken for rd), while long forms (Remove-Item, shutil.rmtree) match anywhere in the command. Deletes hidden in encoded or nested scripts can still be missed.read tools do not normally trigger approvals, so the green note is rarely seen in practice.MIT — see LICENSE.