Introduction¶
The default behavior of DeepSeek Harness (DSH) is a zero-risk classification, and the pre-execution flow before tool calls defaults to allow. The existing experimental/auto-review approach relies on a generative LLM for classification, which has issues such as high cost, large latency, and parsing uncertainty.
The dsh-jev-interceptor plugin integrates Jev (a non-generative System-1 model) into DSH decision points, providing millisecond-level, low-cost risk assessment. It uses Jev to make judgments about tool calls in terms of risk, irreversibility, task alignment, and injection suspicion, enabling evidence-gated automatic approval, while retaining decision authority for downstream listeners through next().
Core Features¶
The plugin provides the following core capabilities:
- Jev risk classification: Before a tool call, classify the risk level, irreversibility, task alignment, and injection suspicion.
- Evidence-gated automatic approval: Based on captured parameter evidence, automatically approve certain tool calls.
- Session reference takeover: Take over session reference logic, score messages by message value rather than FIFO (first-in, first-out) order, and prioritize retaining critical information.
- Shadow and enforce modes: Support observing decisions in shadow mode, then switching to enforce mode after validation is correct.
- Fail closed: When a timeout, parsing mismatch, or internal error occurs, automatically delegate to DSH’s default behavior to ensure safety.
Installation¶
Install the plugin via the command line. The command automatically generates the corresponding configuration patch file.
dsh plugin --profile <name> add dsh-jev-interceptor
After installation, enable it in the configuration file and specify the mode. The configuration is typically located at <dsh-home>/plugins/dsh-jev-interceptor/cordis.patch.yml.
- id: jev-interceptor
name: dsh-jev-interceptor
config:
enabled: true
mode: shadow # 先启用影子模式：记录决策但不强制执行
provider: typesafe # 指定 Jev 提供商，支持 typesafe 或 openrouter
Usage¶
After installation, no restart or additional configuration is required. Control the plugin behavior through chat commands. These commands are persisted to the configuration file.
- Enable the plugin:
/jev-on
- View statistics:
/jev-stats
This command displays the number of invocations, fallback counts, cache hit count, action distribution (delegation/ask/deny), and estimated cost and latency.
- Switch modes:
After observing the statistics in shadow mode and confirming they are correct, execute the following command to switch the mode to enforce:
/jev-mode enforce
- Disable the plugin:
/jev-off
Mechanisms and Safety¶
Decision Logic¶
The plugin does not directly return allow. All “no objection” outcomes are implemented through next(), ensuring that downstream listeners (including external hooks and automatic review) retain veto power.
Fail Closed¶
The system is designed to be “fail closed.” Any configuration error, provider timeout, parsing mismatch, or internal error triggers the default behavior and does not attempt to guess or relax permissions.
Evidence Gating¶
Automatic approval depends on captured parameter evidence. Only calls that have been escalated to human review (with a new pending entry, matching session, and tool) can be automatically approved. Hook asks and sandbox escalation calls do not carry parameters, and therefore always require human intervention.
Takeover Row Behavior¶
The jev-session-reference row replaces the upstream session-reference row. If this row is disabled only through the plugin UI, the entire session reference feature will be disabled. The takeover must be removed by disabling the entire dsh-jev-interceptor bundle (setBundleEnabled(false)).
Use Cases¶
This plugin is suitable for DSH agent scenarios that require strict control of tool call risk, lower approval costs, and faster response times. Please check the source code and license before installation.
