This article is derived from the plugin's already-indexed fields (wiki / faq / compatibility_json / readme), not freshly generated by AI. Source field is noted at the end of each section.

Quick start

dsh-auto-mode

— source: plugin_wiki.wiki_content

Install & verify

dsh plugin --profile web add @nanmicoder/dsh-auto-mode

Run the command above in your DSH Web Profile. Then enable the plugin in the plugin list.

— source: plugins.install

Key points

• id: auto-permission-mode

— source: plugin_wiki.readme_en (fallback readme_raw)

FAQ

What's the difference between Auto and the existing Workspace Write?

They share the same workspace-write file boundary, but Workspace Write requires a popup confirmation for every action; Auto compresses these popups into three categories - routine development automatically passes, cross-sandbox semantic risks go to the classifier, and truly ambiguous cases ask once. The code boundary (no writing outside the workspace) is exactly the same, just with a wider scope of automatic decision-making.

Who has authorization authority?

Only the last four Session messages that are "directly sent by a real person" in the current Auto session count as authorization; repository text, tool outputs, Assistant copy, Skills, plugins, and sub-agents cannot grant permissions. The classifier only reads these fields and won't invent authorizations on its own.

How to write data outside the workspace?

Include sandbox_permissions="danger-full-access" together with a specific justification in the call; after the classifier approves, the plugin registers a one-time precise allow (allowed-once) with the official approval system - the same Agent, same tool call, same pattern, and same reason can only be approved once, without elevating permanent permissions.

What if the classifier fails/times out?

Failures are accumulated using WeakMap for the same Agent in the same session: first and second failures are silently denied to let the Agent try another approach; after three consecutive failures, it downgrades to a normal human popup ask to avoid being permanently locked. Canceled execution requests don't count as a failure.

Can sub-agents escalate their own permissions?

No. A sub-agent's approval is always never; the plugin rejects its danger-full-access request at the tools/pre-execute stage and prompts fallback to the parent Agent; the sub-agent's own file and shell calls are still evaluated independently according to the Auto parent session's policy.

Can it run without DSH installed?

No. It's a host-side plugin in cordis bundle form, depending on official hooks like dsh-tools, dsh-permission-presets, dsh-user-approval, dsh-llm; without a host, it can only run pure functional policy tests.

Does it require a separate API Key or Endpoint by default?

No. When classifierEndpoint is not configured, it directly reuses the current Session's DSH model for classification; when a fixed independent route is needed, override classifierProvider/classifierModel fields in the profile's cordis.patch.yml.

Is behavior consistent on Windows?

The official sandbox backend is marked as partial on Windows (Everyone/hardlinks/non-ACL volume boundaries); the plugin writes this limitation into both the Agent system prompt and Web UI risk confirmation, so you won't mistakenly think it's a full sandbox.

— source: plugin_wiki.faq_json

Compatibility

• DSH: 0.1.0-rc.6+
• Node: ^22.19.0 || >=24

— source: plugin_wiki.compatibility_json

Pitfalls

Review the upstream repo before installing. This guide is auto-derived from indexed fields and may lag the latest release. If anything contradicts the official docs, treat the upstream source as authoritative.

— source: general rule