dsh-auto-approver

Configurable auto-approval for DeepSeek Harness. Intercepts approval/request (and optionally ask_user_question) and answers by policy — rule layer, an optional Hermes Pro semantic verdict, or the human. Every decision is audit-logged.

Why

DeepSeek Harness asks for approval before privileged operations (file writes, command execution, danger-full-access, …). In a trusted, autonomous setup — or for a known-safe subset of tools — those prompts are pure noise. This host plugin intercepts every approval request before the relay/UI push and settles it, with a full audit log and an interactive reject loop (the agent is told why it was rejected and can retry).

It is the mirror image of dsh-reset-handoff: that plugin delegates restarts to an external ops agent; this one delegates approvals to a local policy and/or Hermes.

How it works

agent requests permission
   → 'approval/request' event (host emits)
   → dsh-auto-approver (prepend, before relay/UI)
        │
        ├─ denyAlways hit        → 'rejected' (never prompts; Hermes cannot override)
        ├─ mode=allow-all        → 'allowed-once' (never prompts)
        ├─ mode=allowlist        → hit → 'allowed-once'; miss → next() (human asked)
        ├─ mode=hermes           → allowlist hit → 'allowed-once'
        │                          else → Hermes Pro semantic verdict
        │                                  (deepseek-v4-pro, 90s timeout, fail-closed → human)
        └─ mode=off              → next() (all to human, plugin inert)
   → every decision is appended to the audit log
   → 'rejected' also follows up the reason to the requesting session

Registering with { prepend: true, global: true } makes the plugin answer before dsh-relay pushes the prompt to iMessage/Web — an auto-settled request never disturbs the human.

QnA takeover (optional)

With qnaMode: 'hermes', ask_user_question is also answered by Hermes Pro instead of interrupting the human. Hermes sees the question and its options (or free-form) and returns a choice per the relay answer format; if Hermes is unavailable it falls back to the human.

Install

dsh plugin --profile <profile> add github:nicecx/dsh-auto-approver

Configuration

Override in your profile patch (cordis.patch.yml):

- id: dsh-auto-approver
  name: 'dsh-auto-approver'
  config:
    mode: 'hermes'           # allow-all | allowlist | hermes | off (default: allow-all)
    allowlist: []            # tools auto-approved (rule layer; hermes mode: direct pass)
    denyAlways: []           # tools always rejected (highest priority, Hermes cannot override)
    denyReasons: {}          # tool → reject reason text fed back to the agent
    hermesModel: 'deepseek-v4-pro'   # verdict model (Pro = highest capability)
    hermesTimeoutSecs: 90    # verdict timeout; on failure → human (fail-closed)
    feedbackOnReject: true   # followup the reject reason to the requesting session
    qnaMode: 'off'           # 'hermes' = ask_user_question answered by Hermes Pro; 'off' = human
    userGranted: []          # endorsement signal (NOT a bypass card) — see below
    logPath: ''              # audit log path (default ~/.dsh/auto-approver.log)

| mode | behavior | | --- | --- | | allow-all | auto-approve everything (incl. danger-full-access). Trusted environments only. | | allowlist | auto-approve only listed tools; everything else asks the human. | | hermes | rule layer (denyAlways / allowlist) + Hermes Pro semantic verdict for the rest. | | off | plugin inert; everything goes to the human. |

userGranted — endorsement signal, not a bypass card

userGranted is a soft endorsement passed into the Hermes verdict prompt ("the user explicitly authorized this tool — lean toward approval when the operation is reasonable and carries no data-destruction / credential-exfiltration risk"). It is not a hard allow:

• denyAlways still wins over everything.
• Hermes still rejects dangerous operations (data destruction, credential exfiltration, irreversible deletes).
• Keep it empty by default — adding broad tools (bash, write) conflicts with the least-privilege principle. Only list capabilities the user explicitly named.

Interactive reject loop

When the policy (or Hermes) rejects, the plugin follows the reason back into the requesting session, so the agent knows what was wrong and can retry with a corrected request (e.g. narrower permission, concrete path, specific command). Manual approval on iMessage/Web always wins.

Audit log

Every decision is appended (JSON lines) to ~/.dsh/auto-approver.log:

{"ts":"...","sessionId":"...","toolName":"bash","reason":"...","callId":"...","decision":"allowed-once"}

Hermes verdicts also carry the reason in note (e.g. hermes: ...).

Safety notes

• allow-all auto-grants everything, including full-access commands. Prefer allowlist/hermes in anything less than a fully trusted single-user box.
• hermes mode is fail-closed: if Hermes is unavailable or times out, the request goes to the human — never silently granted.
• The relay/Web double-track is untouched: when the policy says ask, the human still decides on iMessage or the Web UI; manual approvals always win.
• The audit log is the complete record of auto-decisions — keep it.

License

MIT