Plugins

Risk-gated approval automation for DeepSeek Harness: flash pre-classifies whether a write/command is irreversible — safe operations are auto-approved, dangerous ones are escalated to human approval (fail-safe). File-diff review with one-click revert and session-scoped snapshots (v0.5.1: precise snapshots via tool-call parameter tracing, incl. human-approval cases).

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

Adds an `auto` permission preset between workspace-write and danger-full-access: a classifier grants routine sandbox escalations once, while dangerous or uncertain requests still go to a human.

Adds an approval-mode toggle next to the permission selector: default approval keeps per-call confirmation, bypass approval auto-approves every tool call while staying in Workspace Write.

Automatic approval and review for tool calls that need approval: keyword buckets match red lines without context, then a judge model classifies what was requested and sends it to allow, reject or a human according to the matching row and risk level; a judgment that never ran always goes to a human, and rejections tell the model why.

Maintained fork of dsh-approval-gate. A neutral operation whose confirmation count has reached the threshold auto-approves when the judge is unavailable, instead of prompting a human again; approver-facing explanations are generated in Chinese from the real sandbox mode, command and paths. Also carries deterministic hard-deny for credential exfiltration and system-path destruction, judge-input redaction, a judge model candidate chain, fingerprint-scoped allow rules, and an approval view with unified diff and one-click revert.

Self-narrative memory in five budgeted segments (800 chars, not a full context): a first-person note the model writes to itself, a profile of you aggregated from approved facts, environment facts kept separate from who you are, heat-ranked conclusions, and habits. Every injected fact is traceable to a fact id and can be retired; the profile can be edited by hand, and self-notes stay plain lines you can clear. Facts fade by use and time without ever changing their credibility. Preference-like lines you say are auto-detected as candidates (never auto-approved), with conflicts kept side by side. Recall over past conversations with citations, an incremental index that only decodes newly appended frames, a pointer-required warm layer, a doctor that says which part is broken, a heartbeat proving injection is alive, and export/import so the whole thing moves to another machine.

A global permission watchdog: a hard budget on auto-approved permission requests. At most 10 per rolling 60 seconds, at least 3 seconds apart; anything past either limit is deferred to the human answerer and waits. It never refuses and never changes what is asked -- it only decides who answers and how fast. Installs disabled; enable it with the plugin manager toggle.

Keyboard confirmation for approval cards: the card takes focus when it appears, so Enter allows once and Esc rejects, and those two keys are forwarded through the card handler when focus has moved elsewhere. It never auto-approves and never steals focus from a text field.

Phone-side command center rather than a web-UI mirror: dispatch tasks into isolated git worktrees from a PWA, tool-approval push notifications with phone/desktop first-answer-wins racing (never auto-approved), a multi-machine session board, and an end-to-end encrypted zero-knowledge relay you can self-host.

Automated approval review: auto-approve read-only tools, auto-deny dangerous commands, fail-closed policy engine.

Codex-style auto-review permission mode: adds an auto-review preset that auto-approves safe sandbox escalations, asks on risky or ambiguous ones, and rejects critical unconfirmed operations.

A middle permission tier for DeepSeek Harness between workspace-write and danger-full-access: auto-approves harmless commands and operations targeting configured trusted areas, beyond the current workspace.

Zero-intervention permission gate for DeepSeek Harness (DSH) agents on macOS — active on install. Writes that can be undone via a local git baseline or macOS Time Machine are auto-approved and automatically snapshotted; network access, package installs, process/system management, and reads of sensitive credential paths are blocked; every decision is audited — the audit log keeps everything by default, with optional automatic cleanup of the oldest records.

A continuation of simon300000/dsh-auto: the Auto Approve permission preset for the DSH Web UI reviews each approval with one single-shot model call instead of a reviewer subagent, auto-approves only the actions that pass and hands the rest to human approval, and remembers confirmed decisions as project- and global-scope allow/deny lists, with an approval timeline in the right sidebar.

Auto-approval agent for DSH permission requests: rule layer (denyAlways/allowlist) plus Hermes Pro semantic adjudication with quick-fail retries, fail-closed to human when Hermes is unavailable, rejection feedback returned to the requesting session, and approve tasks enqueued into the task queue with a shared busy mutex.