dsh-auto-review plugin
A DeepSeek Harness plugin: a second AI reviewer reads an approval request and returns a verdict with a reason, denying on failure
- 248 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The plugin itself allows agent actions when the reviewer says so, and the model can be wrong
- The reviewer reads your workspace and tool-call arguments
Install
Manual install
dsh plugin --profile web add dsh-auto-reviewRequires DSH 0.2.1 up to below 0.3.0 and Node.js 22.19 or 24 and newer. Git variant: dsh plugin --profile web add github:PerryLink/dsh-auto-review.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The plugin itself allows agent actions when the reviewer says so, and the model can be wrong
- The reviewer reads your workspace and tool-call arguments
This is third-party code. Review the repository files before installing.
What it does
dsh-auto-review replaces manual approval of agent actions with a second model's verdict. When an action crosses the sandbox boundary a reviewer subagent runs: it reads the workspace only through `read`, `glob` and `grep`, looks at the tool-call arguments (sensitive values masked), the reason for the request and your risk rules. The answer is a structure `{ decision, reason, riskLevel }`. A denial goes back to the calling model with its reason, so the agent understands it and does not blindly retry. By default the plugin reviews `bash`, `write`, `pwsh` and `powershell`, and other tools, `edit` included, stay with a human. If the reviewer crashes, times out or returns a wrong schema, `fallbackPolicy` applies, a denial by default. An automatic breaker trips after three denials in a row or six of the last ten. Every decision can be rebuilt from the session log, and `/auto-review status` shows the counters.
Who it is for. DeepSeek Harness users who leave an agent running for long stretches and want to drop manual approvals without losing control of dangerous actions.
Good fit when
- The agent often asks permission for shell commands and you are tired of clicking allow
- A second model should vet file writes against your risk rules
- You need to rebuild from the log who allowed or denied an action and why
- The agent should receive the denial reason and change its plan instead of repeating the request
Not a fit when
- You do not use DeepSeek Harness: the plugin is built for its approval chain
- You need full autonomy for `edit`: edits stay with a human by default and `edit: ai` is switched on by hand
- You need guarantees with no human at all: a second model can be fooled, and its decision is probabilistic
Example request
/auto-review statusLimitations
The plugin is written by the community and is not affiliated with DeepSeek. It targets DSH 0.2.1 up to below 0.3.0 and Node.js 22.19 or 24 and newer. A git install can make `dsh plugin add` stop at `ERR_PNPM_IGNORED_BUILDS` because of `koffi` and `node-pty`, and then `pnpm approve-builds` is needed. The reviewer judges actions by your risk rules but stays vulnerable to model error. The main documentation is in Chinese, with English, Spanish, Portuguese and Hindi versions.
How to disable. Run `dsh plugin --profile web remove dsh-auto-review` or delete the plugin line from the profile patch, and approvals return to the ordinary human chain.
FAQ
How do I install the plugin?
Run `dsh plugin --profile <name> add dsh-auto-review` (npm) or `dsh plugin --profile web add github:PerryLink/dsh-auto-review` (latest main). Then restart DSH.
What does the reviewer check by default?
The `bash`, `write`, `pwsh` and `powershell` tools. The rest, `edit` included, go down the human approval chain.
What happens if the reviewer fails?
`fallbackPolicy` applies, a denial by default. A crash, timeout or wrong response schema never lets an action through silently.
How do I verify the plugin works?
Run `dsh --profile web --dump-config | grep -A4 'id: auto-review'`, then the `/auto-review status` command: it shows counts of allows, denies and fallbacks.
Does the reviewer see my secrets?
Sensitive values in tool-call arguments are masked, and it reads the workspace only through `read`, `glob` and `grep` on an allowlist.
Discussion
No questions or reviews yet.
Related
PluginsA plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
AgentSafe is an agent API gateway that links an executed operation to a single-use grant and a record in its audit trail.
An AI agent behavior verifier plugin: it compares declared authority with code and settings and reports the gaps.
ai-engineering installs hooks that deny risky agent calls and write a receipt for every verdict into your repository
Agents Shipgate shows in a pull request how an agent permissions and tools changed before the changes reach main
A skill and local program for agent safety: inventory, skill admission checks, human-approved grants and signed receipts.
README in short
The project description explains that the plugin hands the approval decision to a second model and shows a three-step setup. Eight capabilities follow (a separate reviewer, fail-closed default, policy routing, passing the reason to the model, a log, breakers, context), then examples and an FAQ.