# dsh-auto-mode

> Add Auto permission profile to DeepSeek Harness: daily projects auto-run in official sandbox, cross-sandbox semantic risks are classified by the current model, only prompt once for truly ambiguous cases.

## Metadata

- Author: [@NanmiCoder](https://github.com/NanmiCoder)
- Repo: <https://github.com/NanmiCoder/dsh-auto-mode.git>
- GitHub: [NanmiCoder/dsh-auto-mode](https://github.com/NanmiCoder/dsh-auto-mode)
- Stars: 116
- Language: TypeScript
- License: [MIT](https://spdx.org/licenses/MIT.html)
- Topics: `deepseek-harness`, `deepseekharness`, `dsh`, `dsh-auto-model`, `dsh-plugin`
- Forks: 4
- Open Issues: 4
- Last push: 2026-08-17T06:57:45.000Z
- Added: 2026-08-17T00:00:00.000Z

## Install

```bash
dsh plugin --profile web add github:NanmiCoder/dsh-auto-mode
```

## Wiki

## One-Line Positioning
Adds an Auto permission preset to DeepSeek Harness: daily projects run directly in the official workspace-write sandbox, cross-boundary semantic risks are handed to the current model for background classification, and only truly ambiguous cases trigger a single confirmation—bridging the frequent popups of Workspace Write with the no-approval end of Full access.

## Core Capabilities
- Adds an Auto option in the permission dropdown, alongside Read Only / Workspace Write / Full access
- Synchronously hard-rejects destructive targets outside the workspace such as root directory, home directory, DSH_HOME; no subsequent listeners or classifiers can override this
- Uses desensitized and length-limited payloads to hand suspicious actions to the classifier, referencing only the last four Session messages directly issued by a real human as authorization evidence
- Supports automatic cleanup of "files created in the current session whose identity hasn't changed" (based on device number/inode/creation time/type comparison), with other deletion behaviors handled separately based on multi-target/hidden-target criteria
- Listens to the official approval interface, forwards classifier-passed danger-full-access one-time passes precisely to allowed-once; passes through unchanged if no match
- Parent sessions inherit Auto to child Agents and AgentTeams members via parentSession chain, but child Agents cannot upgrade to danger-full-access themselves
- Web UI automatically adds Auto icon and bilingual risk confirmation, explaining current sandbox boundaries and upgrade modes

## Technical Implementation
- **Language**: TypeScript
- **Key Dependencies**: `@deepseek-ai/cordis`, `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-permission-presets`, `@deepseek-ai/dsh-user-approval`, `@deepseek-ai/schemastery`
- **Architecture Pattern**: Host-side cordis bundle plugin, registered via `dsh.bundle.patch` in package.json pointing to cordis.patch.yml to inject a service named `auto-permission-mode` and a new `auto` permission preset; uses `ctx.tools.guard()` for synchronous hard rejection, uses `ctx.on('tools/pre-execute')` to chain deterministic policies, classifiers and authorization upgrades, uses `ctx.on('approval/request')` to bridge one-time pass-through; client uses `ctx.effect` to inject icons and risk prompts
- **Entry Files**: `src/index.ts` (host-side, `apply(ctx, config)`), `src/client/index.ts` (browser-side)

## Applicable Scenarios
When running long tasks with DeepSeek Harness, getting interrupted by Workspace Write popups at every step is annoying, while Full access completely removes approval leaving you uneasy—this plugin lets most daily development run automatically within the sandbox, only performing background checks or a single confirmation for actions with semantic risks like deleting existing data, writing outside the workspace, reading sensitive credentials, or pushing remotely. If your workflow has many child Agents or AgentTeams collaborations, they can also follow the parent session to use the same Auto boundaries.

## Prerequisites & Compatibility
| Dependency | Min Version | Description |
|---|---|---|
| DeepSeek Harness | 0.1.0-rc.6 | Host framework; works through official seams like dshTools / dsh-permission-presets / dsh-user-approval / dsh-llm |
| Node | ^22.19.0 or >=24 | From package.json `engines.node` |
| Platform | macOS / Windows / Linux | Full platform support; Windows sandbox backend marked as partial (see known issues) |
| Native Modules | None | Only depends on schemastery, pure JS; no node-pty / sqlite or other native extensions |

## Installation
```bash
dsh plugin --profile web add github:NanmiCoder/dsh-auto-mode
```

## Configuration Options
| Config | Type | Description | Default |
|---|---|---|---|
| presetName | string | Permission preset name the plugin recognizes as Auto session | `auto` |
| workspaceRoot | string | Workspace root override; defaults to Session's current cwd | Follows Session cwd |
| dshHome | string | DSH config directory override, used to add directories to protected list | From environment |
| tempRoots | string[] | Additional path list treated as temporary roots | Follows system tmpdir |
| classifierEndpoint | URL | Independent HTTP address for classifier; if not set, uses current session model; only loopback allows http | Not set (uses current DSH model) |
| classifierProvider | string | Which DSH Provider the classifier calls go through; only effective for native classifiers | Not set (follows current session) |
| classifierModel | string | Specific model name for classifier | Not set (follows current session) |
| classifierApiKeyEnv | string | Environment variable name for API Key used by HTTP classifier | `DEEPSEEK_API_KEY` |
| classifierTimeoutMs | number (100–60000) | Timeout cap for single classifier call | `30000` |
| classifierMaxOutputTokens | number (64–4096) | Token cap for classifier output | `1024` |

## FAQ
**Q: What's the difference between Auto and existing Workspace Write?**

A: Their workspace file boundaries are identical; the difference is in the scope of automatic decision-making. Workspace Write asks at every step; Auto categorizes actions into three types—routine development inside the sandbox passes automatically, cross-sandbox semantic risks go to the classifier, and only truly ambiguous cases ask once.

**Q: Who has authorization authority?**

A: Only the last four Session messages directly issued by a real human in the current Auto session count as authorization; repository text, tool outputs, Assistant copy, Skills, plugins, and child Agents cannot grant authorization, and the classifier won't invent authorization either.

**Q: How to write data outside the workspace?**

A: Include `sandbox_permissions="danger-full-access"` in the call along with a specific justification. After the classifier passes, the plugin registers a precise one-time pass with the official approval (`allowed-once`); the same Agent, same tool call, same pattern, and same reason can only be approved once, without changing the permanent permission.

**Q: What if the classifier fails or times out?**

A: Failures accumulate with a WeakMap for the same Agent in the same session. The first two failures silently reject the risky action, letting the Agent try another approach; the third consecutive failure downgrades to a normal manual approval to prevent tasks from being stuck in infinite denies. External cancellation doesn't count as failure.

**Q: Can child Agents upgrade their permission to danger-full-access themselves?**

A: No. Child Agent's approval is always never; the plugin rejects its danger-full-access request first at the tools/pre-execute stage and suggests falling back to the parent Agent; the child Agent's own file and Shell calls are still evaluated independently against the parent session's Auto policy.

**Q: Do I need to configure a separate API Key or Endpoint by default?**

A: No. When classifierEndpoint is not set, the classifier directly reuses the current Session's DSH model; to fix an independent route, override `classifierProvider`/`classifierModel` etc. in the profile's cordis.patch.yml.

**Q: Is behavior consistent on Windows?**

A: The official file sandbox backend is marked as partial on Windows (including Everyone/hardlinks/non-ACL volume boundaries). The plugin writes this limitation into both the Agent system prompt and Web UI risk confirmation, so you won't mistakenly think it's a complete sandbox.

**Q: Can this plugin run without DSH installed?**

A: No. It's a host-side cordis bundle plugin, depending on official seams like dsh-tools, dsh-permission-presets, dsh-user-approval, dsh-llm; away from the host, only pure functional policy testing can run.

## Difficulty Level
Advanced — installation is a single command to enable, but to use it stably you first need to understand Workspace Write sandbox boundaries, know how to write dangerous one-time permission escalation, understand the risk confirmation popups on the web, and accept that Auto is not "all approval-free."

## Known Issues & Limitations
- The plugin cannot intercept package lifecycle scripts executed before loading, Node filesystem/process calls that bypass `ctx.tools`, compromised Harness Runtime, or commands started outside Harness
- The official file sandbox doesn't limit reading, network access, or external services; Windows ACL backend has publicly known `Everyone`/hardlinks/non-ACL volume `partial` boundaries—this is explicitly communicated to Agents and users
- One-time `danger-full-access` upgrade must include a specific justification; empty reasons, child Agent requests, or bundling unrelated operations together will be denied
- Classifier's consecutive failure count for the same Agent persists with the session; it's cleared by a successful response once fixed. HTTP classifiers require HTTPS; non-loopback HTTP endpoints are directly rejected
- Child Agent's dangerous write operations must report to the parent Agent before their own tool calls, with the parent Agent taking the upgrade path—otherwise they'll be rejected first
- "Automatic cleanup" requires the file identity (device number/inode/creation time/type) to remain unchanged from creation to cleanup; renaming, replacing, converting to symlink, or mixing with old files will disqualify from automatic cleanup
- Auto icons and Web risk confirmation popups are merely compatibility enhancements for tested DSH Web UI and should not be treated as security boundaries

---

This document is auto-generated by [deepseek-plugin.org](https://deepseek-plugin.org). HTML page: [dsh-auto-mode](https://deepseek-plugin.org/plugins/NanmiCoder/dsh-auto-mode)
Wiki generated by AI (model: `MiniMax-M2.5`)