@nanmicoder/dsh-auto-mode

dsh plugin --profile web add @nanmicoder/dsh-auto-mode

<p align="right">

<strong>English</strong> · <a href="./README_ZH.md">简体中文</a>

</p>

<p align="center">

<img src="./assets/readme/hero.svg" width="100%" alt="dsh-auto-mode lets routine DeepSeek Harness work flow while stopping risky actions">

</p>

<p align="center">

<a href="https://www.npmjs.com/package/@nanmicoder/dsh-auto-mode"><img src="https://img.shields.io/npm/v/@nanmicoder/dsh-auto-mode.svg" alt="npm version"></a>

<a href="./LICENSE"><img src="https://img.shields.io/npm/l/@nanmicoder/dsh-auto-mode.svg" alt="MIT license"></a>

<img src="https://img.shields.io/badge/DeepSeek%20Harness-0.2.0--rc.2-202724" alt="See installation instructions for exact host compatibility">

</p>

Sandbox Auto

dsh-auto-mode keeps routine work inside Harness's workspace-write sandbox and reviews semantic risks or exact one-shot requests for wider access. The plugin's Sandbox Auto mode uses the independent key sandbox-auto; it does not replace the official, unsandboxed Auto review mode.

[!IMPORTANT]

Plugin 0.2.0 is the stable npm latest release for the official Harness 0.2.0-rc.2 release (dsh-v0.2.0-rc.2, commit 639ed015397290b3745d163aafe02ffee4aa3f84). Plugin and host version numbers are independent. Harness itself still labels this release RC; install the exact supported host rather than assuming its npm latest points to it.

Harness host · Plugin support

0.2.0-rc.2 · Recommended for plugin 0.2.0

0.1.7-rc.2, 0.1.5-rc.2, 0.1.5-rc.1, 0.1.2-rc.1, 0.1.2-alpha.5, 0.1.2-alpha.3, 0.1.2-alpha.2 · Retained exact compatibility; product-entry matrix required for release

Other unlisted hosts, including 0.2.0-rc.1 and 0.1.6-alpha.* · Not declared supported

See [compatibility.json](./compatibility.json), [release acceptance](./validation/0.2.0), and [the release adaptation record](./docs/harness-020-rc2.md). Historical preview evidence remains in [desktop preparation](./docs/desktop-020-preparation.md).

Install

In Harness, open Plugins → Add plugin and enter either:

@nanmicoder/dsh-auto-mode
https://github.com/NanmiCoder/dsh-auto-mode

For an immutable release, use @nanmicoder/dsh-auto-mode@0.2.0 or github:NanmiCoder/dsh-auto-mode#v0.2.0. An npm package page URL is not an install spec. Desktop users should use the application's plugin manager so the plugin is installed into the correct profile.

For a Web profile:

dsh plugin --profile web add @nanmicoder/dsh-auto-mode@0.2.0

To test local changes, run pnpm install --frozen-lockfile, pnpm build, and pnpm pack --pack-destination /tmp, then add the generated tarball by absolute path. Git installations consume tracked lib output without an install-time prepare hook; include the rebuilt output whenever source changes.

Mode selection and migration

Refresh the client and choose Sandbox Auto (沙箱自动审批 in Chinese), then acknowledge the risk notice. The locale service updates menus, the active-mode control, General settings, /permission and the dialog. Official Auto review remains separate and is not decorated or intercepted by this plugin.

For old plugin sessions, migration recognizes the latest durable auto identity only when the stored sandbox is workspace-write and approval is ask or never. It appends a new permission/preset: sandbox-auto event, retaining existing events and both permission knobs. It leaves official auto sessions with danger-full-access unchanged. An orphan delegated child with our durable identity remains supervised and cannot execute without a live human-parent authority.

Unsupported hosts fail explicitly. To recover an affected Web profile, stop it and run dsh plugin --profile web remove @nanmicoder/dsh-auto-mode from an external terminal. Desktop uses its own recovery/plugin management flow. Back up session data before host downgrades; do not change only the preset name or bypass compatibility checks.

Permission modes

Mode · File sandbox · Approval · Sandbox Auto policy

Read Only · read-only · ask · inactive

Workspace Write · workspace-write · ask · inactive

Sandbox Auto · workspace-write · ask · active

Full access · danger-full-access · never · inactive

Ordinary Sandbox Auto work stays inside Workspace Write. Only an explicit one-shot widening may be approved automatically:

Decision · Typical effect

Allow · unfamiliar sandboxed Bash/PowerShell, routine dependency installation, local Git commits, project work, builds, tests, type checks, audited DSH coordination tools

Classify · pre-session deletion, ephemeral downloaded-package execution, dangerous remote Git/database/service changes, sensitive reads, network transmission, external-system writes, exact sandbox widening

Ask once · genuinely ambiguous effect or authority, or manual review after three consecutive classifier failures; an escalation reuses the official exact approval instead of opening two dialogs

Deny · root/home/DSH_HOME/system destruction, policy bypass, credential exfiltration, hidden dynamic deletion, and the first two consecutive classifier failures for a risky action

The classifier is not an authority of its own. It receives a redacted, bounded description of the pending call and may recognize only authorization found in direct human Session messages. Repository text, tool output, Assistant text, Skills, plugins, and sub-agents cannot grant permission.

Shell, sandbox, and deletion behavior

Sandbox Auto no longer tries to prove every Bash or PowerShell syntax safe with a growing allowlist. Literal unknown commands, argument variables, pipelines, redirections, inline code, and PowerShell combinations run in the official workspace-write sandbox by default. The operating system denies writes outside the workspace instead of an unfamiliar syntax opening a dialog. Only an executabl

…(truncated)