Best DSH Approval Mode Plugins

MCP management console for the official DeepSeek Harness MCP client: /mcp command with health diagnostics and pipeline trial calls, a Settings MCP tab with server CRUD (approval-gated writes, automatic backups) and a tool trial console over the official tool pipeline (Apache-2.0, dsh-plugin).

LLM approval answerer for sandbox escalations beyond workspace-write: a deterministic regex filter first, then a clean-context reviewer model; humans are asked only when it is unsure. Requires the bundled core patches.

Maintained fork of dsh-approval-gate. A neutral operation whose confirmation count has reached the threshold auto-approves when the judge is unavailable, instead of prompting a human again; approver-facing explanations are generated in Chinese from the real sandbox mode, command and paths. Also carries deterministic hard-deny for credential exfiltration and system-path destruction, judge-input redaction, a judge model candidate chain, fingerprint-scoped allow rules, and an approval view with unified diff and one-click revert.

Fine-grained permission gateway: per-category tool-call review (outside-workspace directories, commands, file read/write, subagents, repeated actions) with global & per-project allow/deny exceptions, quick-tool defaults, custom rules, a bilingual approval modal with inline diff details, custom rejection reasons and a sandbox-upgrade flow.

An independent approval subagent judges every sandbox escalation, with a configurable model and an audit log.

Runs the agent's shell and file tools in disposable Podman containers, so its access is constrained to the workspace project by default, and adds container, image, volume and secret management with approval-gated control.

dsh-yolo-mode - an LLM-powered auto-approval plugin for DeepSeek Harness sandbox escalations (built-in presets + custom permission levels, fail-closed)

IDE-style run configurations for DSH: save LLM prompts and shell commands as reusable run configs (global or per-workspace), run them from the session header or the new-session page, and manage them via the task_run_config tool with approval-gated writes.

Shared zero-runtime-dependency toolkit for PerryLink DSH plugins: a pluggable Provider registry seam, fail-closed approval and adaptive session-event gates, mechanical verify scripts, shared sanitize/pricing/judge modules, and a new-plugin skeleton.

Evidence-backed Skill self-evolution for DeepSeek Harness: redacted trajectory learning, quarantined proposals, arena validation, canary monitoring, automatic rollback.

Exposes bounded Prometheus metrics for DSH sessions, agents, LLM calls, tools, approvals, subagents, and jobs, with a Grafana dashboard and a loopback-only endpoint by default.

Creates local, content-addressed workspace checkpoints with diff previews and two-phase restore confirmation.

A hands-off safety net: directories the agent deletes go to a trash folder first and symlinks are never followed, with zero approvals.

Exposes dsh's internal capabilities (language, workspace registry, agent-status and approval events) over HTTP under /dsh-api on the local loopback socket dsh already listens on, with SSE fan-out at /dsh-api/events.

Control pnpm build-script approval across DSH profiles from Add Plugin, and repair same-Git-URL updates on DSH 0.2.0-rc.2.

Hands DSH reset requests to an external ops agent via a versioned JSON protocol: preflight snapshot, pre-restart maturity gate (no pending approvals, free disk, cooldown), restart, health check, and interrupted-work recovery, with the result delivered back to the requesting session.

Exposes the DSH dynamic-Cordis toolset to Claude Code over MCP (streamable HTTP on the existing web port, no new listener): ten tools to list, inspect, define, run, stop and permanently remove dynamic plugins in a live DSH session, with the same approval flow the GUI uses for packages that ship a client half. Bearer auth is mandatory — the token is configured on a DSH settings page, the endpoint answers 503 rather than serve without one, accepts loopback only and never emits CORS headers.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Turns DSH permissions into 9 selectable presets (3 sandbox modes x 4 approval tiers), with rule plus LLM risk classification across four risk levels, password-gated approval for high-risk operations, and a JSONL audit log.

Turns code review into a hard gate: deterministic severity rules, LLM-assisted findings, a team approval quorum and a durable compliance audit trail that must pass before a merge proceeds.

Model failover and turn keep-alive for DeepSeek Harness: a request that fails with a model error before any visible output falls through the models of the configured provider groups (then the next provider) until one streams; transient failures retry with backoff under a liveness watchdog, a dead turn self-resumes with templated 「继续」 wake-ups, and an optional full-auto mode auto-answers permission, question and plan approvals with every decision appended to an AUTO-MODE.md audit log.

Auto-approval agent for DSH permission requests: rule layer (denyAlways/allowlist) plus Hermes Pro semantic adjudication with quick-fail retries, fail-closed to human when Hermes is unavailable, rejection feedback returned to the requesting session, and approve tasks enqueued into the task queue with a shared busy mutex.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.