dsh-approval-popup

Native Windows popup dialogs for DeepSeek Harness (DSH) approval requests — approve or reject sandbox escalations, file writes, and shell commands from a desktop dialog instead of the Web GUI. Optionally pops a "task finished" notice when an agent turn completes.

Windows 原生弹窗插件：DSH 需要批准（沙箱提权、写文件、执行命令等）时，直接弹出桌面对话框点「是 / 否」，不用再切回 Web 界面操作；任务完成时还会弹出提醒。

✨ Features

• Native yes/no dialog — 是(Y) / 否(N) buttons, always-on-top, centered.
• Global Enter-to-approve hotkey — press Enter anywhere on the desktop to approve (toggleable).
• Timeout with configurable action — no choice within N seconds → auto-approve (default), auto-reject, or fall back to the Web GUI (allow / reject / next).
• Turn-finished popup — a non-decision notice when an agent turn completes, auto-closes, debounced so bursts of turns never stack windows.
• Prepend answerer — runs before the Web UI answerer; a concrete choice short-circuits the waterfall.
• Audit log — every request/outcome is appended to ~/.dsh/approval-popup.log.
• Zero dependencies — plain ESM + two PowerShell helpers; no npm install, no build step.

📋 Requirements

🚀 Installation

Option A — one-command installer (recommended)

# clone anywhere, then:
powershell -ExecutionPolicy Bypass -File .\install.ps1

What it does:

1. Copies index.mjs + the three .ps1 helpers into %USERPROFILE%\.dsh\plugins\approval-popup\.
2. Appends an insert entry to %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml (idempotent — re-running never duplicates).
3. Prints the next steps.

Then restart dsh (exit and relaunch dsh web / the desktop app) and the dialog is live.

Option B — manual

# 1. copy the plugin folder into the DSH plugins directory
Copy-Item -Recurse . "$env:USERPROFILE\.dsh\plugins\approval-popup"

# 2. edit %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml and add:
# - insert:
#     - id: approval-popup
#       name: 'file:///C:/Users/<you>/.dsh/plugins/approval-popup/index.mjs'

# 3. restart dsh web

⚙️ Configuration

All options are environment variables read once at plugin start (set them before launching dsh, e.g. in System settings or your launch script):

Example (stricter policy — deny by default):

$env:DSH_APPROVAL_TIMEOUT_MS = 20000
$env:DSH_APPROVAL_TIMEOUT_ACTION = "reject"

🗑 Uninstall

Remove-Item -Recurse -Force "$env:USERPROFILE\.dsh\plugins\approval-popup"
# then remove the approval-popup entry from %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml
# and restart dsh

🔍 Troubleshooting

• No dialog appears, but requests auto-approve — the plugin is applying but the PowerShell helper can't show UI (e.g. running as a service/headless session). Check ~/.dsh/approval-popup.log; consider DSH_APPROVAL_TIMEOUT_ACTION=reject or DSH_APPROVAL_POPUP=0.
• Dialog text is garbled — the .ps1 files must stay UTF-8 with BOM (PowerShell 5.1 reads ANSI otherwise). Do not re-save them as plain UTF-8.
• Want the dialog in another language — the UI strings live in index.mjs (title/body) and approval-dialog.ps1 / turn-done.ps1 (button labels). Edit and re-run install.ps1.
• Need a plain toast instead of the dialog — approval-toast.ps1 is a standalone helper using WScript.Shell.Popup; call it from any script: powershell -File .\approval-toast.ps1 -Title "hi" -Text "hello".

🔒 Security notes

• The plugin is a trusted local helper: the dialog approves by default after the timeout so long-running agents aren't blocked while you're away. If you prefer fail-closed, set DSH_APPROVAL_TIMEOUT_ACTION=reject.
• The Enter hotkey is global (registered via RegisterHotKey) — any focused app's Enter key approves while the dialog is open. Disable with DSH_APPROVAL_ENTER=0 if that's surprising.
• Only install the plugin from sources you trust: it can decide every approval request DSH makes.

🧩 Files

📄 License

MIT

dsh-approval-popup（中文说明）

✨ 功能

• 原生是/否弹窗：置顶、居中，「是(Y) / 否(N)」两个按钮。
• 全局回车快捷键：弹窗打开期间，在桌面任意位置按 Enter 即批准（可关闭）。
• 超时自动处理：N 秒无操作后自动「同意」（默认）/「拒绝」/「退回 Web 界面」（allow / reject / next）。
• 任务完成提醒：一轮任务完成时弹出非决策提醒窗，自动关闭；带防抖，多轮同时结束时不会叠窗。
• 优先应答：注册为 prepend answerer，先于 Web 界面处理批准请求。
• 审计日志：每次请求与结果追加写入 ~/.dsh/approval-popup.log。
• 零依赖：纯 ESM + 两个 PowerShell 脚本，无需 npm 安装与构建。

📋 环境要求

🚀 安装

方式 A：一键安装（推荐）

# 克隆本仓库后，在仓库目录执行：
powershell -ExecutionPolicy Bypass -File .\install.ps1

脚本会：

1. 把 index.mjs 和三个 .ps1 辅助脚本复制到 %USERPROFILE%\.dsh\plugins\approval-popup\。
2. 在 %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml 中追加 insert 条目（幂等，重复执行不会产生重复条目）。
3. 输出后续步骤提示。

然后重启 dsh（退出并重新启动 dsh web / 桌面应用）即可生效。

方式 B：手动安装

# 1. 复制插件目录到 DSH 插件目录
Copy-Item -Recurse . "$env:USERPROFILE\.dsh\plugins\approval-popup"

# 2. 编辑 %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml，添加：
# - insert:
#     - id: approval-popup
#       name: 'file:///C:/Users/<你>/.dsh/plugins/approval-popup/index.mjs'

# 3. 重启 dsh web

⚙️ 配置项

均为环境变量，插件启动时读取一次（在启动 dsh 前设置）：

示例（更严格策略，默认拒绝）：

$env:DSH_APPROVAL_TIMEOUT_MS = 20000
$env:DSH_APPROVAL_TIMEOUT_ACTION = "reject"

🗑 卸载

Remove-Item -Recurse -Force "$env:USERPROFILE\.dsh\plugins\approval-popup"
# 再从 %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml 中删除 approval-popup 条目
# 最后重启 dsh

🔍 常见问题

• 不弹窗但请求被自动批准 — 插件已生效，但 PowerShell 无法弹出 UI（如以服务/无桌面会话运行）。查看 ~/.dsh/approval-popup.log；可改用 DSH_APPROVAL_TIMEOUT_ACTION=reject 或 DSH_APPROVAL_POPUP=0。
• 弹窗文字乱码 — .ps1 文件必须保持 UTF-8 带 BOM（PowerShell 5.1 默认按 ANSI 读取），不要另存为无 BOM 的 UTF-8。
• 想换语言 — UI 文案在 index.mjs（标题/正文）和 approval-dialog.ps1 / turn-done.ps1（按钮文字）中，改完重新执行 install.ps1。
• 只需要普通 toast — approval-toast.ps1 是独立的 WScript.Shell.Popup 助手：powershell -File .\approval-toast.ps1 -Title "hi" -Text "hello"。

🔒 安全说明

• 这是受信任的本地助手：超时默认自动同意，避免你离开时长时间任务被卡住。希望默认拒绝请设置 DSH_APPROVAL_TIMEOUT_ACTION=reject。
• Enter 是全局热键（RegisterHotKey），弹窗打开期间任何应用的 Enter 都会批准。介意的话设置 DSH_APPROVAL_ENTER=0。
• 只从可信来源安装：它能决定 DSH 的每一个批准请求。

🧩 文件

📄 许可证

MIT