Apache-2.0 DeepSeek Harness plugin that puts a second model on the `approval/request` answerer chain: a read-only reviewer subagent returns structured `{ decision, reason, riskLevel }` verdicts, fail-closed by default, with deny reasons fed back to the model and a full session-log audit trail.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-08-25
License
Apache-2.0
01What can it help you accomplish?
Gate DeepSeek Harness tool approvals with a second-model reviewer
Structured allow/deny verdicts `{ decision, reason, riskLevel }` injected back into the denied tool result, fail-closed by default
Teams running DeepSeek Harness who want human-grade safety on sandbox-breaking actions without a human clicking approve
Reconstruct and audit every approval decision from the session log
A replayable decision chain `approval/asked → autoReview/verdict → approval/decided` plus log-only `autoReview/*` events
Security and compliance reviewers who need an immutable record of why each action was allowed or denied
Give the agent self-correcting denials
The reviewer's reason is fed back into the denied tool result (callId-linked) so the model adapts instead of retrying blindly
Agent operators who want fewer blind retries and clearer, policy-driven rejections
02How to install into DeepSeek Harness
Prerequisites
- DeepSeek Harness `0.1.1-rc.2` (dependencies pinned to `0.1.1-rc.2`; peers `>=0.1.0-rc.8 <0.2.0`)
- Node `^22.19.0 || >=24.0.0`
Installation steps
- 01
Install from npm: `dsh plugin --profile web add dsh-auto-review`
$ dsh plugin --profile web add dsh-auto-review
- 02
Alternatively install the latest `main` from git: `dsh plugin --profile web add "github:PerryLink/dsh-auto-review#main"`
$ dsh plugin --profile web add "github:PerryLink/dsh-auto-review#main"
- 03
Restart DeepSeek Harness to load the plugin
Verify the integration
- Confirm the auto-review row is present: `dsh --profile web --dump-config | grep -A4 'id: auto-review'`
Rollback
- Uninstall with `dsh plugin --profile web remove dsh-auto-review`, or remove the row from the profile patch.
03DSH integration and capability boundaries
Adds a read-only reviewer subagent to DeepSeek Harness's `approval/request` answerer chain that returns structured allow/deny verdicts, fail-closed by default.
Second-model approval answerer
An `approval/request` for a tool whose policy is `ai`→allow (allowed-once) or deny (rejected) with a reason; the human flow is never short-circuited
Claims only `ai`-policy requests and delegates everything else via `next()`Read-only reviewer subagent
The streamed tool-call arguments (sensitive values redacted), the request reason, and your risk rules→A structured verdict `{ decision, reason, riskLevel }`
Runs as a one-shot fork with a `read`/`glob`/`grep` tool allow-list; cannot write, edit, run bash, fetch the network, or delegateDeny-reason injection
A deny, fallback, or `never` verdict→The reviewer's verdict reason injected into the denied tool result, callId-linked
Forces models to see auditable `[auto-review]` / `[auto-review-fallback]` / `[auto-review-never]` markersFull audit trail
Every approval decision→Log-only `autoReview/verdict` + `autoReview/rejection` session events the session log can reconstruct
Optionally emits an invariant companion enforcing marker ⟺ eventSession command & Web review panel
`/auto-review on|off|status|approve [n]`→Durable per-session override, per-turn budgets, cumulative statistics, recent verdicts, one-shot approve
`on`/`off` writes a durable `autoReview/state` override (the fold survives restart and resume)
04Who is it for? When not to use it?
Good for
- Teams running DeepSeek Harness who want human-grade safety on sandbox-breaking actions without a human clicking approve
- Security and compliance reviewers who need an immutable record of why each action was allowed or denied
- Agent operators who want fewer blind retries and clearer, policy-driven rejections
Not for
- The reviewer is strictly read-only — its `toolFilter` allow-list (`read`/`glob`/`grep`) cannot write, edit, run bash, fetch the network, or delegate. Treat its verdicts as advisory policy, not a security kernel; prefer `human`/`never` rules for irreversible operations.
- Sensitive arguments are redacted by key name (`token`, `password`, `api_key`, `Authorization`, credentials, private keys …) before reaching the reviewer prompt. Do not AI-review tools whose argument values you cannot afford to show a model.
05Compatibility, maintenance and safety notes
- The reviewer is strictly read-only — its `toolFilter` allow-list (`read`/`glob`/`grep`) cannot write, edit, run bash, fetch the network, or delegate. Treat its verdicts as advisory policy, not a security kernel; prefer `human`/`never` rules for irreversible operations.
- Nothing is stored on disk; the report ring buffer is in-memory and bounded, and the plugin makes no network requests of its own.
- Sensitive arguments are redacted by key name (`token`, `password`, `api_key`, `Authorization`, credentials, private keys …) before reaching the reviewer prompt. Do not AI-review tools whose argument values you cannot afford to show a model.
- The plugin requires the `session:append`, `approval:answer`, `subagent:spawn`, `command:register`, and `tools:observe` permissions.
Apache-2.0 · actively maintained (latest release v0.6.0, 2026-08-23)
06Frequently asked questions
How do I install DSH Auto Review into DeepSeek Harness?
Add it to your web profile with `dsh plugin --profile web add dsh-auto-review` (or `dsh plugin --profile web add "github:PerryLink/dsh-auto-review#main"` for the latest `main`). Restart DeepSeek Harness, then confirm the row loaded with `dsh --profile web --dump-config | grep -A4 'id: auto-review'`.
Does the reviewer actually run bash or edit files?
No. The reviewer is a read-only one-shot fork with a `read`/`glob`/`grep` tool allow-list — it cannot write, edit, run bash, fetch the network, or delegate. Its verdicts are advisory policy, not a security kernel.
What happens if the reviewer crashes, times out, or returns a bad schema?
Every abnormal path resolves through `fallbackPolicy`, which defaults to `rejected` (fail closed). The rejection feeds an auditable reason back to the model, so a malfunction never silently grants an action.
Can I audit why a tool call was allowed or denied?
Yes. Every decision reconstructs from the session log: `approval/asked → autoReview/verdict → approval/decided`. The plugin emits log-only `autoReview/*` events you can replay, plus an optional invariant companion that enforces marker ⟺ event.
How do I tune which tools the reviewer sees?
All tunables are Schemastery `Config` fields set in cordis.yml — per-tool policies (`ai`/`human`/`never`), regex risk rules, reviewer model/timeout, circuit breaker, and more. Out of the box it AI-reviews `bash` and `write`; every other tool delegates to the human chain.
07Related DSH workflows
tencentmeeting-cli
by tencentcloud
Tencent Meeting command-line tool with OAuth2 authorization for meeting, recording and attendance-report management.
dsh-permission-rules
by perrylink
Claude Code-style declarative permission rules for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, session-log audit, and HMR reload.
dsh-secure-audit
by pensivefei
Read-only security & compliance plugin for DeepSeek Harness: prompt-injection detection, Chinese-PII redaction, and local configuration audit with redacted, reproducible reports.
dsh-remote
by scspotato
Native Android client to remotely control DeepSeek Harness (DSH) from your phone
08Data and sources
**Second-model AI approval for DeepSeek Harness — a read-only reviewer subagent decides allow/deny on the approval chain…
`dsh-auto-review` puts a second model on the `approval/request` answerer chain:
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-08-25. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.