A second brain for your DeepSeek Harness agent
DeepSeek is fast and cheap — keep it for the loop. This adds what it cannot do: a stronger model reads the dangerous command before it runs.
DeepSeek Harness is DeepSeek AI's open-source agent harness. dsh-clawrouter is BlockRun's plugin for it — we did not build the harness.
dsh plugin --profile web add dsh-clawrouter
export BASE_CHAIN_WALLET_KEY=0x...Why this exists
Two conversations in the DeepSeek Harness community, three weeks apart. The first asked for a review mode — some way to get a second opinion before the agent does something it cannot undo. The second was someone reporting that Full Access mode had deleted their home directory.
Between them they describe the same gap. Approve every call and you are the bottleneck. Turn on Full Access and there is nothing between the model and your filesystem. Permission rules help, but they only know what you thought to write down in advance.
The third option
Safe, and you are the bottleneck. The agent stops being useful somewhere around the fiftieth prompt.
Useful, and nothing stands between the model and your filesystem. See #461.
Good, and blind to anything you did not anticipate when you wrote them.
A stronger model reads the flagged call in context and decides. Fails to a human, never open.
How the gate works
A flagged tool call goes to a reviewer model — anthropic/claude-opus-5 by default — with the call and its context, not your conversation. It answers one of three ways.
| safe | Nothing happens.The call runs. Your normal chain is untouched and you never see the gate. |
| dangerous | Denied, with a reason.The executor refuses the call and tells you what the reviewer objected to. |
| uncertain | Escalated to you.The gate never resolves its own doubt. Ambiguity becomes a human decision. |
It only ever narrows.
The gate is enforced at the tool executor, in front of your permission system — not instead of it. It can refuse a call your rules would have allowed. It can never allow one your rules would have refused.
What it costs to leave on
The objection to a review gate is that it will fire constantly and cost a fortune. Here is the measurement.
| Fires on ordinary work | never — 0 of 5959 everyday commands from the benign corpus. None were flagged. |
| Misses dangerous work | none of 3939 destructive commands. The gate flagged every one. |
| Cost when it fires | $0.0048One review on anthropic/claude-opus-5. Nothing when it does not fire. |
| Latency when it fires | ~3sAdded only to the flagged call, not to the loop. |
| Tokens sent to the reviewer | ~356The flagged call and its context — not your conversation. |
Measured on dsh-clawrouter 0.9.0 on 2026-08-14. Both corpora ship in the repo as tests, so a rule that starts flagging ordinary work fails CI rather than your session.
On recall: An earlier version of this table claimed no misses. It had been measured against the six commands the rules were written for; against the full 39, those rules caught one. The number above is the corrected one.
Read both corpora in the repoAlso in the box
/spend
Per-model cost since the process started. Not an estimate — what the wallet paid.
/gate and /gate drill
Prove the safety net is armed. A drill fires the gate on purpose so you can watch it deny.
Vision that actually sees
DeepSeek serves no vision model. Images route to a measured allowlist — the gateway's vision tag alone over-claims, so tag and list must agree before an image is sent.
Reasoning effort, translated
DeepSeek's max means different things at different vendors. The plugin maps it onto each one's dialect instead of dropping it.
And 76 chat models from one wallet
The plugin registers a blockrun provider route, so the whole catalog is addressable from inside the harness without an account anywhere. Requests are paid per call in USDC over x402, from a wallet key your harness passes by environment variable name — it is never written into config.
$5 of USDC on Base covers roughly 2,500 gate reviews. At the corpus's model mix, measured 2026-08-14 on 0.9.0.
- id: blockrun-review
config:
enabled: true
reviewerModel: anthropic/claude-opus-5Enable the gate in your profile's cordis.patch.yml.