dsh-autotier

English | 简体中文 | Español | Português | हिन्दी

Automatic model-tier routing for DeepSeek Harness: one user instruction enters, one tier decision comes out — no manual model switching.

Complex intent (architecture, planning, debugging, multi-step engineering) is planned on the strong tier and then implemented on the cheap tier. Simple intent (questions, retrieval, batch chores, daily work) is designed and implemented on the cheap tier directly. While the cheap tier executes, high-risk tool calls are denied by a deterministic guard, and repeated failures escalate to the strong tier with a TTL fallback.

• Official repository: https://github.com/PerryLink/dsh-autotier
• npm: dsh-autotier (bare, unscoped)

Compatibility

Harness	Status
@deepseek-ai/dsh 0.1.2-rc.1	no longer supported; that line predates the SettingsForms contract this plugin now targets
@deepseek-ai/dsh 0.1.5-rc.2	no longer supported; the settings.register / settings/updated contract it exposes was removed upstream
@deepseek-ai/dsh 0.1.6-alpha.2	no longer supported; same removal, first line to ship SettingsForms
@deepseek-ai/dsh 0.1.7-alpha.2	required; verified against the matching checkout (typecheck) and the published packages (typecheck:ci, 214 tests)
@deepseek-ai/cordis ^4.0.3, @deepseek-ai/cosmokit ^1.8.4, @deepseek-ai/schemastery ^3.18.3	peer baseline

Peer ranges name all published lines explicitly (>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0), because a semver range whose only prerelease comparator sits on an earlier version tuple does not admit a later alpha. They are refreshed per published wave. The declared range is deliberately wider than the verified one: it documents what the manifest accepts, not what has been tested.

This release is a breaking adaptation. The 0.1.6-generation harness removed the settings provider seam this plugin was built on: the @deepseek-ai/dsh-settings-file package is gone, ctx.settings is now SettingsForms (a schema→form projector, with no register), and settings/updated no longer exists. There is no shared surface that lets one plugin observe another plugin's settings document, so no version of this plugin can support both contracts at once. Configuration now flows through the host's volatile-config mechanism, and the per-session routing mode — the setting that actually changes behaviour at runtime — is unchanged.

The plugin is host-plane only. It needs no agent preset of its own: the host row applies to every session. A one-line prompt section in your preset is optional and only makes the router's decisions visible to the model (see Install & uninstall).

What you get

• Intent gate — every turn is classified from deterministic signals (message text, tool names, image presence, conversation length). The zero-token rule layer decides when it is confident; only a low-confidence turn calls the cheap judge model, and never on a cooldown.
• Tier landing on the official seam — the decision is applied on the agent/request waterfall by returning a replacement provider/model/effort triple. Sampling scalars the session already chose (temperature, maxTokens, stop) are preserved.
• Plan-mode handoff — a complex instruction enters plan mode on the strong tier; leaving plan mode drops back to the cheap tier for implementation.
• High-risk guard — while the cheap tier executes, destructive commands (rm -rf, sudo, mkfs, git push --force, credential-file writes, …) are denied with a corrective message telling the model to escalate instead.
• Failure escalation — repeated failures (optionally same-signature) raise the tier for a TTL; a model/route failure walks the configured fallback chain.
• Manual escape hatches — /tier auto|strong|cheap|off and the tier_status / tier_route tools. Setting routingMode: delegated (or /tier off) stops routing for a session that must keep its own model.
• ctx.autotier service — a small read surface (status) plus the autotier/route veto waterfall and autotier/tier-changed event, so other plugins can observe or override a decision.

Quick start

dsh plugin --profile web add dsh-autotier
npm i -g dsh1024
dsh1024 plugin --profile web add dsh-autotier

Then start (or restart) the harness. The row is appended to your profile's cordis.patch.yml; routing starts on the next turn with no further setup.

Install & uninstall

npm channel

dsh plugin --profile web add dsh-autotier
npm i -g dsh1024
dsh1024 plugin --profile web add dsh-autotier

git channel

dsh plugin --profile web add "github:PerryLink/dsh-autotier#main"
git clone https://github.com/PerryLink/dsh-autotier.git
cd dsh-autotier && pnpm install && pnpm run build
dsh plugin --profile web add .

Optional preset prompt section. The router works without it. To let the model know which tier it is running on, add one row to your agent preset (docs/preset-row.md has the exact block):

- insert:
    - id: autotier-prompt
      name: '@deepseek-ai/dsh-system-prompt'
      # sections: [...]  — see docs/preset-row.md

Uninstall

dsh plugin --profile web remove dsh-autotier

The row, its command, its tools and its listeners are all removed with the plugin. Configuration a user saved through the Plugins page lives in the active profile patch and belongs to that profile, not to this plugin; removing the row leaves it there untouched.

Configuration

Every key is validated at load time; an invalid value fails loudly instead of silently disabling routing. cordis.patch.yml in this repository documents the same keys inline.

Key	Default	Meaning
tiers.strong.provider	deepseek-official	Provider for the planning/review tier.
tiers.strong.model	deepseek-v4-pro	Catalog id of the strong model.
tiers.strong.effort	high	Adapter vocabulary off | low | high | max.
tiers.strong.followSession	false	false = this tier's effort overrides the session's.
tiers.strong.fallback	[]	Ordered provider/model landings when the tier is unavailable.
tiers.cheap.provider	deepseek-official	Provider for the implementation tier.
tiers.cheap.model	deepseek-flash	Catalog id of the cheap model.
tiers.cheap.effort	low	Adapter vocabulary off | low | high | max.
tiers.cheap.followSession	true	true = inherit the session's effort so an explicit choice wins.
tiers.cheap.fallback	[]	Ordered provider/model landings when the tier is unavailable.
tiers.vision.provider	deepseek-official	Provider for image-carrying turns.
tiers.vision.model	deepseek-flash	The catalog's image-capable model.
intent.ruleThreshold	0.7	Confidence at or above which the rule layer decides alone.
intent.attemptBand.enabled	false	Start the middle band on the cheap tier and escalate on a signal.
intent.attemptBand.tauLow	0.45	Lower bound of the attempt-first band.
intent.hysteresis.toStrong	0.8	Score that switches a cheap turn to strong.
intent.hysteresis.toCheap	0.6	Score below which a strong turn returns to cheap.
intent.rules	[]	Declarative rule table (when.patterns / when.tools / when.cwd, tier, priority).
intent.judge.enabled	true	Allow the low-confidence judge.
intent.judge.model	''	Judge model id; empty = first catalog model containing flash.
intent.judge.temperature	0	Judge sampling temperature.
intent.judge.maxTokens	16	Judge output cap (it answers with one word).
intent.judge.cooldownMs	30000	Minimum gap between two judge calls.
intent.judge.timeoutMs	2000	Judge call timeout.
intent.judge.unavailableSkip	2	Consecutive judge failures after which the turn skips it.
intent.scenarios	all true	Per-scenario switches: coding, review, planning, retrieval, batch, daily, longText, multimodal.
intent.costMode	balanced	Ambiguity arbitration: cost-first | quality-first | balanced.
guard.enabled	true	Enable the deterministic high-risk guard.
guard.tiers	[cheap]	Tiers the guard protects.
guard.whitelist	[]	Commands, tools or path prefixes that never trip the guard.
guard.protectedPaths	['.dsh','AGENTS.md','package.json','.github/workflows']	Self-modification surfaces that force strong-tier review.
guard.interopDefend	auto	Relationship with dsh-defend: auto audits coexistence, none stays silent.
escalation.threshold	2	Failures within the window that raise the tier.
escalation.windowMs	60000	Failure-counting window.
escalation.ttlMs	180000	How long an escalation stays in effect.
escalation.fallbackTtlMs	300000	TTL used after a fallback landing was taken.
escalation.signature	true	Count same-signature recurrences instead of every failure.
routingMode	auto	auto | strong | cheap | delegated | off.

All keys can also be edited live from the plugin's card on the Plugins page; the Host validates the new value against the schema and commits it with loader/volatile-update, and this plugin then re-judges the whole configuration through the same cross-field judge the mount path uses. A value that violates a cross-field requirement (two tiers landing on the same route, a hysteresis pair that cannot stop flapping, a rule with neither a pattern nor a tool) leaves the last good policy routing instead of swapping in something unroutable.

routingMode is the one key that is not live: it is the composition default, and the runtime switch is the session-scoped override written by /tier, the composer pill and the card's selector. Making it live as well would give the same behaviour two owners.

Tools & surfaces

Surface	Kind	Purpose
/tier	command	auto | strong | cheap | off | status; session-scoped override.
tier_status	tool	Current tier, mode, escalation TTL and guard state.
tier_route	tool	Route one intent string without sending a request (dry run).
ctx.autotier	service	status() read surface for other plugins.
autotier/route	serial event	Third parties may veto a proposed tier.
autotier/tier-changed	emit event	Observability when the effective tier changes.

Permissions & data

• Files — the plugin reads no file and writes none. Configuration is the host's: a value saved on the Plugins page is persisted by the Host into the active profile patch, and this plugin only reads the live snapshot it is handed.
• Network — the only outbound traffic is the judge call, which goes through the normal ctx.llm path and the configured provider.
• Session log — the plugin appends no custom session events. The routing trail is the plugin logger plus the live autotier/tier-changed bus event; the only append it makes is the plan/mode fallback when the plan-mode service is absent. Custom event types are fail-closed on 0.1.2-alpha.1 and later, so no durable plugin-owned record is written.
• Secrets — no credential is read, logged or stored by this plugin.

Security boundaries

• The guard is a defence in depth, not a sandbox. It denies the patterns it knows on the cheap tier and never weakens dsh-defend, the approval service, or the sandbox policy. Keep those enabled.
• The guard protects only the tiers listed in guard.tiers (cheap by default). A strong-tier turn is not blocked by design: the strong model is the reviewer.
• If the guard itself throws, the call is escalated to the strong tier rather than allowed — a broken guard must not become an open door.
• /tier off disables routing entirely; the harness then behaves exactly as it did before the plugin was installed.

Known limitations

• The rule layer is deterministic and therefore finite: a novel phrasing of a complex request may start on the cheap tier and escalate only after a failure or a guard denial. The judge call covers the low-confidence middle.
• Escalation is per-agent and in-memory; a harness restart starts from auto.
• Tier switching resets the provider prompt cache for the changed request, so very chatty sessions may see a small cache-miss cost on the switch turn. The hysteresis thresholds exist to keep that rare.
• The plugin routes conversation requests. Compaction and title generation are separate host seams; align their own model settings with the cheap tier if you want the same cost profile (docs/supporting-lanes.md).
• followSession: true on the cheap tier means an explicit session model choice wins; in that case the cheap tier cannot force its own model.
• The Settings card and composer tier pill shipped in 0.2.0. The card (routing mode, live tier landings, model catalog) lives in the Plugins settings section and the pill cycles the session mode from the composer.
• A model picked in the GUI is not detected automatically. The router does not watch the agent-default-model document, so switching models there does not by itself stop routing — use routingMode: delegated or /tier off.
• Fingerprint posteriors are in-memory. They reset on restart and re-learn from the judge's cold-start fallback; persisting them through the settings document is planned for v0.2.
• The attempt-first middle band ships disabled. intent.attemptBand.enabled stays false until the calibration corpus and its metric gate land (v0.2).

Development

pnpm install
pnpm run typecheck      # against the local harness checkout type faces
pnpm run typecheck:ci   # against the published 0.1.7-alpha.2 faces (what CI runs)
pnpm test
pnpm run build
pnpm run verify:self-contained
pnpm run verify:artifacts
pnpm pack

pnpm run build emits lib/types (tsc declarations) and lib/index.js (tsdown bundle). Tests use the published host packages directly — real Context, real session/tools/commands services — plus one real Loader composition over a temporary cordis.yml. The settings service is the one stand-in: the host's real SettingsForms binds to configEditor, profileContext and the Loader's fiber graph, none of which this plugin consumes, while the plugin's whole contract with it is configure({ auto }) plus the Loader's loader/volatile-update event.

Topics

dsh, dsh-plugin, deepseek-harness, deepseek, cordis, router, model-tier, cost, auto.

Contributors

PerryLink. Issues and pull requests are welcome at https://github.com/PerryLink/dsh-autotier/issues.

Applicable DSH version: verified against dsh-v0.1.7-alpha.2 (the host release this build targets); requires >=0.1.7-alpha.1 <0.2.0.

PerryLink DSH Plugin Family

This project is one of the 45 DeepSeek Harness plugins maintained by PerryLink. If this one helps you, the others likely will too:

Plugin	One-liner
dsh-auto-review	Second-model auto-review on the approval chain, fail-closed by default
dsh-autotier	Automatic strong/cheap model-tier routing with deterministic risk guards and a /tier command
dsh-background-agents	Durable background child agents with a Web UI sidebar, messaging and interrupt
dsh-budget	Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel.
dsh-catalog	DSH Desktop Market standard catalog source for the PerryLink family
dsh-cert-mcp	Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence
dsh-checkpoint-rewind	Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore
dsh-claude-move	Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH
dsh-click	Cross-platform native desktop control for DeepSeek Harness — Windows first.
dsh-composer-history	Terminal-style input history for the web composer: arrows, Ctrl+R search
dsh-data-quality	Dataset quality checks and citation cross-checks (the optional numeric bridge consumed here)
dsh-defend	Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness.
dsh-doublecheck	Engineering-discipline guard: requirements grill, test gates, adversary review
dsh-draw	Unified static-image generation routing for DeepSeek Harness.
dsh-fast	Read-only performance diagnostics for DeepSeek Harness.
dsh-fund-research	Deterministic research reports for Chinese public mutual funds
dsh-github	GitHub PR/issues integration for DSH, every write gated by approval
dsh-industry-research	Industry research orchestration that seals its deliverables through this plugin's ctx.researchReport.assemble
dsh-laya	Laya typed decisions (noul/choice/score) as a first-class Cordis service and model-visible tools
dsh-library	Local document knowledge base for DeepSeek Harness.
dsh-local-ai	Local-model (Ollama) integration for DeepSeek Harness.
dsh-lsp-actions	LSP diagnostics, formatting, completion, code actions and rename over language servers
dsh-mask	PII masking middleware: anonymize at the model boundary, restore at the display layer
dsh-mcp-panel	Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors
dsh-memento	Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool
dsh-observe	OpenTelemetry and Langfuse observability exporter for DeepSeek Harness.
dsh-output-styles	Claude Code outputStyles-equivalent runtime style switching
dsh-permission-rules	Claude Code-style declarative allow/deny/ask permission rules with audit
dsh-plugin-certification	Community certification registry with repro-checkable grades and badges
dsh-plugin-doctor	Zero-dependency static + sandbox smoke detector for DSH plugins
dsh-plugin-guide	Plugin-development knowledge base as an on-demand agent skill
dsh-plugin-kit	Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins
dsh-plugin-upgrade	One-package, one-corridor-index plugin upgrade skill: routes a repository to the matching closed corridor card
dsh-plugin-upgrade-015	Merged 0.1.3-alpha.1 → 0.1.5-rc.1 upgrade corridor card plus a zero-dependency seam scanner
dsh-reach	Multi-channel approval/question bridge: WeChat/Telegram/Feishu, session console
dsh-research-report	Verifiable research-report engine: content-addressed evidence ledger and sealed versions
dsh-score	Multi-dimensional quality scoring for DeepSeek Harness plugins.
dsh-session-pin	Pin sessions in the Web sidebar with durable ordering
dsh-session-sync	Cross-device session sync for DeepSeek Harness — a dedicated git mirror of your session store.
dsh-skill-pack-security	Security-audit skill pack: secret scan, dependency and supply-chain review
dsh-talk	Voice-first session loop for DeepSeek Harness: talk to it, hear it answer.
dsh-team-rooms	Cross-session team rooms: shared message bus, task board and timeline
dsh-test-drive	Isolated install-and-smoke test drives for DeepSeek Harness plugins.
dsh-ticktick	TickTick/Dida365 task bridge: session-header panel + 11 tools
dsh-translate	Vendor parameter translation and deterministic JSON repair for DeepSeek Harness.

License

Apache-2.0. See LICENSE and THIRD_PARTY_NOTICES.md.