dsh-guardian-approval
A DSH Auto Approve reviewer that sends approval requests to a separately configured model and fails closed when review is unavailable.
Install
$ dsh plugin --profile web add -w [email protected]Plugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Uses a separately configured reviewer endpoint, model, reasoning effort, and timeout.
- Reviews approval evidence including tool calls, arguments, and bounded excerpts for egress-shaped actions.
- Applies a built-in, editable Codex Guardian-style risk and authorization policy.
- Supports OpenAI-compatible Responses and Chat Completions API styles.
- Fails closed to the human approval UI when the reviewer channel fails.
- Uses denial and channel-error circuit-breaker thresholds to fast-fail subsequent reviews.
- Appends verdict records to ~/.dsh/auto-approval-audit.jsonl.
- Provides plugin settings, a connectivity test, and a policy editor in DSH Web.
Useful For
- Add an independent model review step to DSH Auto Approve sessions.
- Require scrutiny of potentially risky writes, command execution, or data-egress actions.
- Keep review model configuration separate from an agent's active model selection.
- Audit approval verdicts and rationales in a local JSONL sidecar file.
Who It Fits
- DeepSeek Harness users running DSH Web.
- Teams or individuals using the Auto Approve permission preset.
- Users with an OpenAI-compatible reviewer endpoint and API key.
Documented Limitations
- Requires Node.js 22.19 or later and DSH 0.1.0-rc.6 or later within the 0.1 release line.
- The reviewer receives sanitized tool arguments, bounded recent direct-user messages, and, for egress-shaped actions, up to four 2 KB local-file excerpts.
- Redaction is best-effort and may not detect every secret format.
- Users must trust the configured reviewer endpoint with reviewed workspace data.
- A failed reviewer channel delegates to human approval rather than silently allowing the request.
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 0 runtime, 16 development, 12 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as MIT.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- Scotlight/dsh-guardian-approval
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- bd8c18a · 2026-08-25
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 2GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-08-20
- Last release
- 2026-08-20
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Vision routing and pixel-level visual tool suite for DeepSeek Harness agents with built-in free fallbacks.
View plugin →Local-first AI agent runtime and DSH plugin bundle providing sandboxed sessions, MCP tools, audit logs, and session replay.
View plugin →Persistent multi-model Agent teams and bounded DAG workflows with GUI controls for DeepSeek Harness.
View plugin →Composable three-tier memory control plane for DeepSeek Harness with runtime context, searchable documents, and pluggable long-term memory.
View plugin →