dsh-approval-gate
Maintained fork of dsh-approval-gate. A neutral operation whose confirmation count has reached the threshold auto-approves when the judge is unavailable, instead of prompting a human again; approver-facing explanations are generated in Chinese from the real sandbox mode, command and paths. Also carries deterministic hard-deny for credential exfiltration and system-path destruction, judge-input redaction, a judge model candidate chain, fingerprint-scoped allow rules, and an approval view with unified diff and one-click revert.
dsh-approval-gate 的维护中 fork。判定器不可用时，确认次数已达阈值的中立操作直接自动放行，不再重复弹人工审批；审批说明由真实的沙箱模式、命令与路径生成中文。另含凭据外泄与系统路径销毁的确定性硬拒、判定输入脱敏、判定模型候选链、带操作指纹的放行规则，以及可查看 unified diff 与一键撤销的审批视图。
How to install
dsh plugin add dsh-approval-gate About
**简体中文** | English dsh-approval-gate **DeepSeek Harness 自动审批门控 —— 最小人工介入，安全自动放行、危险转人工（fail-safe）。** 判定模型预判每次沙箱越界：常规操作自动放行，硬风险操作（删除 / 凭据 / 远程 / 系统 / 批量）永远转人工确认；学习沉淀只针对你确认过的操作，并提供界面化人工审查入口。 判定管道：**硬拒（凭据 / 系统路径，判定模型无权推翻）→ 硬事实人工 → 危险词 → 白名单 → denyRules → 脱敏 → 判定（JSON 硬类别优先 → allow/ask/deny）→ 学习沉淀**。 **来源**：本项目是 moon09300731/dsh-approval-gate 的 fork， 在其基础上修复了若干缺陷并扩展了多机规则共享。原作者版权与 MIT 许可见 LICENSE。 本仓库（IamNewHands/dsh-approval-gate）为维护中的版本。 其中 5 项能力移植自 NanmiCoder/dsh-auto-mode（MIT），见下文「吸收自 dsh-auto-mode」。 ✨ 特性 ⚡ **模型风险预判**：每次沙箱越界由判定模型给出**严格 JSON** 裁决（allow / ask / deny），可回补操作自动放行 🛑 **确定性硬拒**（吸收）：凭据外…
Recommendation signals
Meta
- License
- MIT
- Language
- JavaScript
- GitHub stars
- 0
- mo. downloads
- –
- Last push
- 2026-09-24
- Created
- 2026-09-14
Basic safety check
- Findings
- None
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- deepseek-harness, dsh-plugin
Related plugins
dsh-auto-mode
NanmiCoder/dsh-auto-mode
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
sofagent
KongFangXun/sofagent/tree/main/engine/dsh-plugins/cordis-plugin-sofagent-audit
Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.
dsh-vault
Ox0400/dsh-vault
Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.