🤖 dsh-auto-review
Second-model AI approval for DeepSeek Harness — a read-only reviewer subagent decides allow/deny on the approval chain, fail-closed by default.
When an action crosses the sandbox boundary, a second model reads the evidence and returns a verdict with a reason — so humans approve nothing while nothing unsafe slips through.
Official repository. This is the only official repository of dsh-auto-review, maintained by PerryLink. Same-name repositories under other accounts are not affiliated.
English · 简体中文 · Español · Português · हिन्दी
⭐ 如果它帮到了你
这个插件是 DSH 插件家族的一员（40+ 个，全部 Apache-2.0）。如果你在用，给个 star —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。
English: part of a 40+ plugin family for DeepSeek Harness. If it is useful, a star helps the next person find it — nothing is gated behind it.
Compatibility
| Surface | Status |
|---|---|
| Harness | DeepSeek Harness dsh-v0.2.1-alpha.1 (verified 2026-09-25). Dual-line npm support: dev pins and runtime deps 0.1.7-rc.2, peers >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.1.7-0 <0.2.0 — the plugin code feature-detects the published host lines and each line runs the full gate chain; the runtime dependency pins follow the host line so a profile install never shadows the host's own tree. pnpm-workspace.yaml pins the whole @deepseek-ai/dsh-* graph to that line, because autoInstallPeers otherwise fills the frozen dsh-agent-spine-demo subgraph's ^0.1.1-rc.2 peers with previews that lack the exports the 0.1.7 packages import. On the alpha.2 line the eval fixtures pin deepseek-flash (the removed deepseek-v4-flash id is gone from eval/). |
| Node | ^22.19.0 || >=24.0.0 |
| Platforms | All (host answerer; optional Web review panel via the session-projection capability) |
| Model | Any (the reviewer inherits the session agent's route; reviewerModel overrides) |
What you get
dsh-auto-review puts a second model on the approval/request answerer chain:
- Official seam — an answerer that claims only the requests it owns (
aipolicy) and delegates everything else vianext(); the human approval flow is never short-circuited. - Read-only reviewer subagent — a one-shot fork with a
read/glob/greptool allow-list returns a structured verdict{ decision, reason, riskLevel }. Reviewer asks are recognized by identity and delegated;maxDepth+ the allow-list keep the reviewer non-delegating. - Fail closed — reviewer crash, timeout, or schema mismatch resolves through
fallbackPolicy(defaultrejected); a deny verdict feeds its reason back to the calling model. - Config-driven routing — per-tool policies (
ai/human/never) plus regex risk rules, all changeable from cordis.yml. - Deny reasons reach the model — the reviewer's reason is injected into the denied tool result (callId-linked); fallback and
never-policy rejections inject auditable markers too ([auto-review]/[auto-review-fallback]/[auto-review-never]). - Full audit trail — log-only
autoReview/verdict+autoReview/rejectionsession events (envelopeignorable: true) plus an optional invariant companion enforcing marker ⟺ event. - Safety knobs — a rejection circuit breaker (3 consecutive denials, or 6 of the last 10 verdicts, per turn), a risk-level policy, a one-shot
/auto-review approveoverride, and anever-policy hard disable that explains itself to the model. - Optional reviewer context — a bounded compact transcript (
contextBudget) plus a Codex-style Markdown ruling policy (reviewerPolicyText).
Every decision reconstructs from the session log: approval/asked → autoReview/verdict (or autoReview/rejection) → approval/decided.
Why a second model instead of rules?
Pattern-based auto-approvers decide before dispatch, with no evidence. dsh-auto-review gives the decision to a reviewer subagent that reads the actual workspace (through its read-only tool face), the already-streamed tool-call arguments (sensitive values redacted), the request reason, and your risk rules — then returns a structured verdict. A deny verdict feeds its reason back to the calling model, so the agent learns why instead of retrying blindly.
Quick start
# 1. install the bundle into your profile
dsh plugin --profile web add "github:PerryLink/dsh-auto-review#main"
# or from npm (published releases)
dsh plugin --profile web add dsh-auto-review
# 2. restart and verify the row
dsh --profile web --dump-config | grep -A4 'id: auto-review'
Out of the box the shipped patch AI-reviews bash and write; every other tool (including edit — in-place modification) delegates to the human chain. Add edit: ai explicitly if you accept in-place edits without a human in the loop.
Install & uninstall
- git channel (latest
main):dsh plugin --profile web add "github:PerryLink/dsh-auto-review#main"— the isolatedpreparebuild needs the singleallowBuilds: { esbuild: true }key thedshCLI prints fordsh-auto-review. - npm channel (published releases):
dsh plugin --profile web add dsh-auto-review. - 1024 store channel:
npm i -g dsh1024once, thendsh1024 plugin --profile web add dsh-auto-review(counts toward the deepseek1024.com install ranking). - tarball channel:
pnpm packin this repo, thendsh plugin --profile web add ./dsh-auto-review-<version>.tgz. - uninstall:
dsh plugin --profile web remove dsh-auto-review(or remove the row from the profile patch). - native build scripts: when
dsh plugin addstops atERR_PNPM_IGNORED_BUILDSforkoffi/node-pty(pulled in by the eval harness), runpnpm approve-buildsto approve those build scripts.
Configuration
All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need.
| Key | Default | Meaning |
|---|---|---|
enableByDefault |
true |
Sessions start with auto-review enabled; /auto-review on|off writes a durable override that beats this |
toolsPolicy.default |
human |
Policy for unlisted tools (delegate to the human answerer) |
toolsPolicy.overrides |
{} |
Per-tool policy: ai / human / never |
riskRules |
[] |
{pattern, policy, field?} matched before the tool table; field selects reason (default), toolName, or arguments |
reviewerProvider |
fork |
Subagent provider for the reviewer (in-process fork backend) |
reviewerModel |
(inherit) | Reviewer model id; unset inherits the session agent's route |
reviewerTimeoutMs |
60000 |
Verdict deadline; on expiry the fallback policy applies |
reviewerTools |
[read, glob, grep] |
The reviewer child's tool allow-list (must be non-empty) |
fallbackPolicy |
rejected |
Reviewer failure: rejected (fail closed) / delegate / allow-once |
maxReviewsPerTurn |
10 |
Real AI-verdict budget per open turn; beyond it, requests delegate |
maxFailuresPerTurn |
10 |
Reviewer-failure budget per open turn |
reasonMaxChars |
2000 |
Cap for reviewer reasons and the redacted argument preview |
reviewerGuidance |
(none) | Optional advisory guidance appended to the reviewer prompt |
reviewerPolicyText |
(none) | Markdown ruling policy injected into the reviewer prompt (Codex-style) |
denyGuidance |
(anti-circumvention text) | Guidance appended to every injected deny reason |
contextBudget |
{turns: 2, maxChars: 4000} |
Compact transcript budget for the reviewer prompt (the open turn plus the one before it); turns: 0 disables the section — and a blind reviewer denies user-authorized actions, so the runtime warns when 0 meets an ai policy. The character budget is spent on the most recent lines |
riskPolicy |
{maxAutoAllow: high, onHighRisk: delegate} |
allow verdicts above maxAutoAllow delegate or deny |
circuitBreaker |
{consecutiveDenies: 3, windowDenies: 6, windowSize: 10, action: delegate} |
Rejection circuit breaker |
overrideTtlMs |
300000 |
How long a /auto-review approve override stays usable |
verdictCacheTtlMs |