How It Works
dsh-auto-review integrates a second AI model into the approval workflow of DeepSeek Harness, acting as a read-only reviewer subagent. When an action crosses the sandbox boundary, this reviewer model evaluates the request by examining the workspace, tool-call arguments (with sensitive values redacted), and the request reason. The reviewer then returns a structured verdict—either allow or deny—along with a reason for its decision. This process ensures that no unsafe action is approved without human oversight while maintaining a clear audit trail.
The system operates on a fail-closed principle by default. If the reviewer crashes, times out, or encounters a schema mismatch, the fallback policy (defaulting to rejection) ensures safety. Denied requests return the reviewer’s reasoning to the calling model, preventing blind retries. The entire decision-making process is logged, with events transitioning from approval/asked to autoReview/verdict (or autoReview/rejection) and finally to approval/decided, ensuring full audibility.
The reviewer subagent is a one-shot fork with a restricted toolset—limited to read, glob, and grep operations—to prevent delegation or unintended actions. Its decisions are non-delegating, relying instead on a predefined allow-list and configurable depth limits. This design ensures the reviewer remains isolated and predictable, adhering strictly to its designated role.
Configuration is driven by a cordis.yml file, where policies for tools, risk rules, and reviewer behavior are defined. Policies can be set per-tool (e.g., ai, human, or never) or via regex patterns to match specific risk scenarios. The reviewer’s timeout, tool allow-list, and fallback behavior are all tunable, allowing administrators to balance automation with safety.
A key feature is the injection of denial reasons into the model’s output, linking them to the call ID. This ensures transparency: if a tool is denied, the model receives an explanation, reducing the likelihood of repeated unsafe attempts. Additionally, the system includes safety knobs such as a rejection circuit breaker (triggered by 3 consecutive denials or 6 denials in the last 10 verdicts) and a risk-level policy that delegates or denies actions exceeding a predefined threshold.
The reviewer’s context is bounded by a compact transcript budget, including the current turn and the preceding one, to prevent excessive memory usage. Optional guidance text, such as a Codex-style ruling policy, can be appended to the reviewer’s prompt to refine its decision-making.
Every decision is reconstructible from the session log, ensuring accountability. The audit trail includes autoReview/verdict and autoReview/rejection events, with optional invariant enforcement to link markers to events. This design ensures that even if the session log is examined later, the sequence of approvals and denials remains verifiable and tamper-evident.
Unlike pattern-based auto-approvers that decide before dispatch, dsh-auto-review evaluates evidence dynamically. The reviewer model assesses the actual workspace state, tool arguments, and risk rules before rendering a verdict. This evidence-based approach reduces false positives and ensures that approvals are context-aware rather than rule-of-thumb.
The plugin is part of a larger ecosystem of over 40 DeepSeek Harness plugins, all licensed under Apache 2.0. It is compatible with DeepSeek Harness version dsh-v0.1.7-rc.2 and supports dual-line npm dependencies, ensuring seamless integration with existing setups. Installation is straightforward, with options for GitHub, npm, or tarball channels, and configuration can be adjusted via command-line flags or direct edits to the profile patch.
Use Cases
This reduces operational overhead while maintaining a strict security posture.
For instance, an agent might be allowed to execute bash or write operations automatically, but only after the reviewer model confirms their safety. High-risk operations, such as modifying system files or running destructive commands, are explicitly blocked or delegated to human oversight.
The structured verdicts and full session logs provide a clear record of every approval decision, which can be essential for regulatory compliance or forensic analysis. The fail-closed default ensures that no unauthorized action slips through without explicit review, aligning with strict security policies.
The optional Web review panel extends functionality to environments where remote oversight is required. The panel leverages the session-projection capability of DeepSeek Harness, enabling visibility into the reviewer’s decisions without compromising the sandbox’s isolation.
For organizations using DeepSeek Harness in production, dsh-auto-review provides a scalable way to enforce granular tool policies. The ability to override policies per-tool or via regex patterns allows fine-tuned control over agent behavior. For example, a team might allow AI-driven edits to configuration files in a staging environment but require human approval for production deployments, all managed through the same plugin.
The rejection circuit breaker and risk-level policies further tailor the plugin to specific threat models. In high-security contexts, the system can be configured to delegate or deny actions that exceed a medium risk level, ensuring that only explicitly vetted operations proceed. This adaptability makes dsh-auto-review suitable for a range of security-sensitive applications, from internal tooling to external-facing AI services.
Structured Verdicts with Reasons
The reviewer subagent returns verdicts in a structured format: { decision, reason, riskLevel }. This clarity ensures that both the calling model and administrators understand the rationale behind approvals or denials.
Fail-Closed Default
By default, the plugin operates on a fail-closed principle. If the reviewer encounters an error—such as a timeout, crash, or schema mismatch—the fallback policy (configurable as rejected, delegate, or allow-once) ensures safety.
Full Audit Trail
Every decision is logged with events transitioning from approval/asked to autoReview/verdict (or autoReview/rejection) and finally to approval/decided. This audit trail is fully reconstructible from the session log, ensuring transparency and accountability. Optional invariant enforcement links markers to events, further safeguarding against tampering or loss of context.
Configurable Tool Policies
Tool policies can be set individually or via regex patterns. Risk rules allow administrators to block patterns such as rm -rf or git push --force entirely, providing granular control over agent behavior.
Safety Knobs and Circuit Breakers
A rejection circuit breaker triggers if 3 consecutive denials or 6 denials in the last 10 verdicts occur, defaulting to delegation to prevent deadlocks. Risk-level policies ensure that high-risk actions are either denied or delegated, while a one-shot /auto-review approve command allows temporary overrides for trusted operations.
Context-Bounded Reviewer
The reviewer operates within a bounded context, limited to the current turn and the preceding one, with a character budget to prevent excessive memory usage. Optional guidance text, such as a ruling policy, can be appended to the reviewer’s prompt to refine its decision-making process.
Optional Web Review Panel
For environments requiring remote oversight, the plugin supports an optional Web review panel.
Compatibility and Integration
dsh-auto-review is compatible with DeepSeek Harness version dsh-v0.1.7-rc.2 and supports dual-line npm dependencies, ensuring seamless integration with existing setups. Installation is supported via GitHub, npm, or tarball channels, with configuration managed through the profile patch layer. The plugin is part of a larger ecosystem of over 40 DeepSeek Harness plugins, all licensed under Apache 2.0.
Performance and Scalability
The cache is bounded by a maximum entry limit (default: 256) and a time-to-live (default: 60,000 ms), ensuring efficiency without sacrificing freshness.