dsh-approval-ai-review

English | 中文

A DeepSeek Harness plugin (dsh-plugin).

Install

dsh plugin --profile web add dsh-approval-ai-review

Or from GitHub: dsh plugin --profile web add github:kiiiiile/dsh-approval-ai-review.

Summary

Use this package to stop confirming every safe tool ask by hand. When enabled for a session, each pending approval ask is judged by one auxiliary model call before any human answerer runs: a safe operation is granted automatically, and every other outcome — escalation, review failure, deadline, malformed output — reaches the remaining answerers with the review's analysis (what the operation would do, what it risks) attached to the request. The plugin ships inert: without /auto-approve on (or enabled: true) it delegates every ask unchanged.

Table of Contents

• Use this package
• Understand the implementation
• Model Experience
• Known Limitations and Deferred Work
• Dev Note

Use this package

Compose this plugin after @deepseek-ai/dsh-user-approval in deployments whose permission mode still asks: the reviewer consumes the same approval/request waterfall the Web and ACP answerers listen on, registered with prepend so it settles before any prompt appears. It requires ctx.llm; the review call reuses the agent's routed conversation model unless an explicit route is configured.

- name: 'dsh-approval-ai-review'
  config:
    enabled: true

The exhaustive configuration surface is the Config schema in src/index.ts.

Toggling per session

/auto-approve [on|off] appends the durable approval/review/enabled switch to the session log (the last event wins; without one the composition default applies), and bare /auto-approve reports the current state. The switch is log-only: the model never sees it.

Deciding one ask

The reviewer receives the tool name, the exact tool/call arguments from the session log when the ask carries a call id, and the asker's reason. A validated {"verdict":"approve"} resolves the ask allowed-once. Anything else — an escalate verdict, a transport error, a fired deadline, malformed output — delegates the ask to the remaining answerers with the review's analysis appended to the request reason, so the human prompt states what the operation would do and what it risks. Without a composed answerer the seam's own fail-closed unavailable applies.

Understand the implementation

Model Experience

Review decision

What the model sees

Nothing new. The three review events and the toggle switch are log-only; the model sees the eventual tool outcome exactly as without the plugin, and the standing approval:policy sentence stays accurate because asks still happen — they are answered earlier.

Token effect

Zero model-transcript tokens. Each enabled ask costs one auxiliary model call that never enters the conversation transcript.

KV Cache effect

Unchanged. The review call is a separate request with its own prefix; the conversation's stable request header and cached prefix are untouched.

Known Limitations and Deferred Work

• The reviewer never denies — a dangerous ask escalates to a human rather than being rejected automatically; a machine-denial verdict is deferred until a deployment owns that authority.
• Child sessions do not inherit the switch — approval/review/enabled is not seeded into delegated children the way approval/policy is; a child review default is deferred until delegation owns one.
• The review consumes wall-clock time inside the ask — a slow model extends the pending ask; reviewTimeoutMs bounds it but does not shorten the caller's own tool-timeout budget.
• Effort validation is per-route — reasoningEffort values the routed model does not advertise fail the review (which escalates) rather than the boot; the compatible set is not known until a route exists.

Dev Note