Security automatic permission plug-in

Project overview

Coding agents need broad access to build, test, and inspect a project without stopping every few steps. But DeepSeek Harness currently leaves a sharp choice: restricted modes interrupt normal development, while Full access removes approval entirely.

The classifier is not an authority of its own. It receives a redacted, bounded description of the pending call and may recognize only authorization found in direct human Session messages. Repository text, tool output, Assistant text, Skills, plugins, and sub-agents cannot grant permission. Shell and deletion behavior

Every Bash and PowerShell call is inspected segment by segment, including compound commands, pipelines, and redirections. Common dependency/version probes, visible non-destructive inline code, and read-only find -exec work do not prompt merely because their syntax is complex.