dsh-sandbox-escalation-fix (0.1.1-rc.2 is now supported)

English | 简体中文

[!IMPORTANT] This is an independent community plugin. It is not published, maintained, or endorsed by DeepSeek, and it does not modify DeepSeek Harness core packages.

[!CAUTION] DSH 0.1.0-rc8, 0.1.1-rc.1, and 0.1.1-rc.2 partially improve this issue through an approval=never runtime instruction, but still use the same static escalation schema and execution-time validation. Users of these versions should first observe the built-in behavior and install this plugin only after reproducing the same-mode escalation, blank justification, or retry-loop failures described below.

DSH 0.1.1-rc.2 focuses on image handling: the DeepSeek adapter prefers Files API uploads, reuses uploaded files, and automatically resizes or converts images for model requirements. The sandbox escalation, Bash, Pwsh, ToolRuntime, and approval implementations used by this plugin are unchanged from 0.1.1-rc.1, so rc.2 neither fixes the issue described here nor requires a plugin logic change.

dsh-sandbox-escalation-fix is a zero-configuration compatibility plugin that directly resolves the issue of third-party models like GPT failing to call tools such as bash, pwsh, write, and edit under DSH All Access, resulting in repeated retries due to incorrect sandbox escalation parameter prompts.

If you've encountered the following errors, this plugin is designed for them:

Error: invalid justification: expected a non-empty sentence
Error: sandbox escalation to "danger-full-access" is not strictly wider than this call's current "danger-full-access" mode
Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode

Contents

• What It Does
• The Problem It Solves
• Before and After
• Why This Plugin
• This Plugin vs. Execution-Only Normalization
• Compatibility
• Quick Start
• Release One-Click Install and Uninstall
• Upgrade
• Install From GitHub
• Manual Windows Installation
• Behavior at a Glance
• Verify the Fix
• Wrapper Conflicts
• Troubleshooting
• Uninstall
• Development
• License

What It Does

This plugin makes DeepSeek Harness show the model only the sandbox escalation options that the current session can actually use.

In an All Access session (danger-full-access + never), the stock DSH tools still advertise sandbox_permissions and justification on bash, pwsh, write, and edit. But in that state:

• the session is already at the highest sandbox mode, so no wider mode exists;
• the approval policy is never, so every escalation request is rejected.

When a model fills in those parameters, the call fails before it runs. The model may then retry with different values and get stuck in a loop.

This plugin projects the model-visible tool schema per session, based on the live Sandbox Mode and Approval Policy. It also adds a minimal execution-time fallback for redundant same-mode requests.

The Problem It Solves

…