dsh-auto-classifier — autonomous ("auto") mode for DeepSeek Harness

English | 中文

A Claude-Code-auto-mode-like permission classifier for DeepSeek Harness. Adds a fourth permission preset auto (Autonomous) beside read-only / workspace-write / danger-full-access: tool calls are classified automatically — dangerous operations are blocked before they run, safe ones flow, and sandbox escalations are decided by the classifier without a human watching the approval prompts.

How it works

Host-plane plugin. Two { prepend: true } listeners decide BEFORE the browser answerer, active only in sessions whose permission preset is auto; every other session keeps the stock interactive behavior (handlers call next()):

Hook	Role
tools/pre-execute (the tool pre-execution waterfall)	Every tool call sees its name + full arguments: dangerous commands (system-directory deletion, formatting, registry writes, git reset --hard / force push, credential access, …) are denied BEFORE anything executes
approval/request (the approval waterfall)	Sandbox escalations (sandbox_permissions) are auto-allowed / auto-rejected by the classifier — no browser prompt in auto sessions
git snapshot	Before an allowed high-risk escalation the workspace is checkpointed (git add -A && git commit, throttled); auto_snapshot tool snapshots manually anytime
systemPrompt section	Injects autonomous-mode discipline: risk tiers, git rescue, no infinite retry loops, email-and-stop when a human decision is needed

Rule engine (Claude Code style, tool-scoped)

• Rule syntax: Tool(pattern) — pwsh(^git\s+commit\b), write,edit(C:\Windows); comma-separated tool names allowed; a bare regex without parens applies to every tool. Patterns are case-insensitive regexes.
• Field projection (no false positives): command tools (pwsh/bash/run_code) scan only command/code (cleaned first: env-var prefixes FOO=bar and > / >> redirections stripped); path tools (write/edit/read) scan only file_path; other tools are not scanned — text in file content or code that merely mentions a dangerous word is not a false positive. Approval requests scan the reason sentence.
• Order: deny rules (highest priority) → allow rules → LLM judge (optional) → pwsh strict default → defaultDecision.
• Default deny table (inspired by Claude Code soft_deny): destructive file ops, disk/boot/system servicing, shutdown/reboot, account/service tampering, registry writes, git push / force-push / reset --hard, external code execution (curl|bash, iwr|iex), privilege escalation (sudo/runas/gsudo), network listeners, system-level package installs, credential files, protected-path writes, DSH/shell config tampering.
• Default allow table: routine git (no push), package managers, language runtimes, gh/dsh/winget/scoop/choco, PowerShell cmdlets.
• LLM judge (llmJudge: true): when no rule matches, the model decides semantically (BLOCK-ALWAYS categories + "err on the side of blocking"); failure degrades to defaultDecision. Applied on the pre-execute path only — escalations use rules + default, since the underlying command was already screened.
• Denial caps: 3 consecutive / 20 total (same as Claude Code denialTracking) — past a cap the classifier hard-stops and hints the agent to notify the user. DSH has no built-in mail: the hint points to the dsh-notify-skill email plugin (also on the awesome-dsh-plugin list) or any notification channel you configure.
• Every decision is logged via ctx.logger; auto_status shows the last 20 and the cap counters.

Install (web profile)

# 1. Pack and add to the profile's dependencies + bundles (physical tarball — do NOT use link:)
#    cd dsh-auto-classifier && npm pack --cache <workspace-path>   # workspace-write sandbox blocks npm's default cache dir
#    package.json dependencies:  "dsh-auto-classifier": "file:C:/.../dsh-auto-classifier-0.1.0.tgz"
#    package.json dsh.profile.bundles: append "dsh-auto-classifier"
cd ~/.dsh/profiles/web
pnpm add "dsh-auto-classifier@file:C:/.../dsh-auto-classifier-0.1.0.tgz" --force

# 2. Validate the composed config (no server start)
dsh --profile web --dump-config   # auto-classifier row + 4 presets

# 3. Restart dsh web, then switch the session preset to auto (or /permission auto)

The plugin's cordis.patch.yml injects its rows as a bundle patch — never manually insert the same row ids in the profile/home layers (duplicate loader entry kills web startup). After source changes: npm pack → pnpm add ... --force (refreshes lockfile integrity).

Configuration (auto-classifier row in cordis.patch.yml)

Key	Default	Meaning
presetName	auto	The permission preset under which the classifier is authoritative
defaultDecision	allow	Decision when no rule matches and no judge (deny = fail closed)
llmJudge	false	Enable the model semantic judge (one call per unmatched operation)
llmProvider / llmModel	deepseek-official / deepseek-v4-flash	Judge model
pwshStrict	true	Unmatched command-tool calls go to the judge / strict default (more conservative than path tools, mirroring Claude Code's default for PowerShell)
denyPatterns / allowPatterns	built-in	Tool(pattern) regex arrays, override or extend
denialLimitConsecutive / denialLimitTotal	3 / 20	Denial caps, hard-stop hint past them
gitSnapshotOnAllow	true	Snapshot the git worktree before allowing an escalation
gitSnapshotIntervalMs	30000	Per-session snapshot interval floor

License

MIT