Preface¶

When using third-party models like GPT as agents in DeepSeek Harness (DSH), a common failure type occurs: the session is already set to All Access (danger-full-access + approval=never), but the model still sees sandbox_permissions and justification in the schemas for bash, pwsh, write, and edit. After filling in parameters, it fails during validation, then retries with different parameters, getting stuck in a loop.

DSH versions 0.1.0-rc8, 0.1.1-rc.1, and 0.1.1-rc.2 partially improved this via runtime hints for approval=never, but the tool registration still exposes static escalation fields, and the runtime validation logic remains unchanged. The update in 0.1.1-rc.2 focused on image processing, unrelated to this issue. Below introduces the community plugin dsh-sandbox-escalation-fix: it projects the model-visible schema based on each session’s real-time Sandbox Mode and Approval Policy, and can take effect immediately after zero-configuration installation into a profile.

What It Is¶

dsh-sandbox-escalation-fix is published by community maintainer JUSTMONIKA2022, categorized as admin-security, with a current package version of 0.1.1-rc2 and an MIT license. It is an independent community plugin, not released or endorsed by DeepSeek, and does not modify the DSH core package.

In one sentence: it ensures DSH only shows the model the sandbox escalation options that are truly usable for the current session, and performs minimal fallback checks for redundant escalation requests within the same mode before execution.

If you’ve encountered the following errors, the README indicates this plugin specifically targets such scenarios:

Error: invalid justification: expected a non-empty sentence
Error: sandbox escalation to "danger-full-access" is not strictly wider than this call's current "danger-full-access" mode
Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode

Core Features¶

Dynamic Projection of Tool Schema per Session¶

DSH exposes static escalation fields during tool registration, but the actual escalation targets that can be requested depend on the session’s current Sandbox Mode and Approval Policy. This plugin projects the model-visible parameters based on real-time status within the Agent Exact Scope:

The projection covers bash, pwsh, write, and edit; both Native Tool Call and Code Mode SDK read the same definition, avoiding the issue where “fixing one side still misleads the model on the other.”

Minimal Runtime Fallback¶

When requestedMode === effectiveMode, the wrapper removes redundant sandbox_permissions and justification before delegating to the original tool for execution. Downgrade requests, invalid targets, missing paired parameters, and genuine escalation requests are still handed over to DSH’s existing validation; the plugin does not auto-fill fake justifications and does not bypass the strict widening check of approveEscalation().

Cleanup of Contradictory Escalation Prompts¶

When the session has no valid escalation targets, the plugin trims the escalation guidance paragraphs in shell tool descriptions and cleans up the escalation available prompts that no longer apply in shell, file tools, and job_output results, preventing contradictions among the parameter schema, tool descriptions, and failure outputs.

Lifecycle and Multi-Session Isolation¶

The plugin wraps independently per Agent/Session, listening to events such as agent creation, destruction, preset switching, and agent.ctx.tools.restrict(). After dynamic restrictions are lifted, the projection is restored without needing to rebuild the agent. Different sessions within the same process do not affect each other. The README records 28 automated tests covering paths such as schema projection, Code Mode SDK, dynamic restrictions, multi-agent isolation, and unloading.

Installation and Activation¶

Before installation, it’s recommended to reproduce similar errors on your actual profile; users of DSH 0.1.0-rc8 / 0.1.1-rc.1 / 0.1.1-rc.2 should first observe the built-in behavior to confirm the issue persists before installing. DSH must be completely shut down before installation or upgrade.

Command Line Installation (Recommended)¶

The README suggests locking the commit SHA from a trusted repository and installing it into a specific profile:

dsh plugin --profile <profile> add github:JUSTMONIKA2022/dsh-sandbox-escalation-fix#<commit-sha>

Replace <profile> with your actual profile name (e.g., web) and <commit-sha> with the commit hash you’ve reviewed. Git installation will run the package’s prepare build script; pnpm 10 might refuse to execute it the first time. Follow the DSH output to add the following to the profile’s pnpm-workspace.yaml:

allowBuilds:
  dsh-sandbox-escalation-fix: true

Then re-run the installation command, and use the following command to confirm the plugin layer has loaded:

dsh --profile <profile> --dump-config

The output should include the dsh-sandbox-escalation-fix layer and the sandbox-escalation-fix line.

Release One-Click Installation (Windows)¶

The 0.1.1-rc1 release package provides install-release.ps1 and .tgz, compatible with DSH rc5, rc6, rc7, rc8, 0.1.1-rc.1, and 0.1.1-rc.2. Open PowerShell in the release directory and install to the default web profile:

powershell -NoProfile -ExecutionPolicy Bypass -File ".\install-release.ps1"

The script locates the unique .tgz in the same directory and executes dsh plugin --profile web add <tgz-absolute-path>. To install to a different profile, add parameters like -Profile headless. After completion, restart DSH.

Uninstallation¶

dsh plugin --profile <profile> remove dsh-sandbox-escalation-fix

After uninstalling, run --dump-config again to confirm that the dsh-sandbox-escalation-fix layer no longer appears in the output.

Typical Usage¶

The plugin is zero-configuration: after installing it into your used profile, start it as usual without needing to change model configurations, Sandbox Mode, or Agent Presets:

dsh --profile <profile>

To verify the fix, the README suggests:

1. Start DSH with the profile where the plugin is installed.
2. Select the OAI series model that was previously affected under All Access.
3. Set permissions to All Access (danger-full-access + Approval Policy never).
4. Create a new session, ensuring the Agent Scope is created with the plugin loaded.
5. Ask the model to execute a simple shell command or write a file to the workspace.

When the fix is effective, the model-visible schema for bash, pwsh, write, and edit no longer includes sandbox_permissions and justification; even if the model sends redundant escalation parameters within the same mode, the tool will remove that pair of parameters and execute normally.

Applicable Scenarios and Notes¶

Who it’s for: Users who use third-party models like GPT under DSH All Access or approval=never, and experience repeated validation failures in bash, pwsh, write, and edit due to sandbox escalation parameters.

Version Requirements: Node.js ^22.19.0 or >=24.0.0; @deepseek-ai/dsh-* supports 0.1.0-rc.5 to 0.1.0-rc.8, 0.1.1-rc.1, and 0.1.1-rc.2; @deepseek-ai/cordis 4.0.1. Mixing different rc versions will be rejected at startup.

Security Boundary: The plugin does not modify the DSH installation directory or core packages, does not automatically approve escalations when approval=never, and does not grant additional permissions. approveEscalation(), approval processes, and one-time authorization semantics remain unchanged.

Plugin Collaboration: This plugin occupies the bash, pwsh, write, and edit in the Agent Exact Scope. Another wrapping plugin must implement the Symbol.for('dsh.tool-wrapper.v1') protocol to chain collaboratively; if the protocol is not implemented, agent registration will fail explicitly, requiring the user to choose one to retain.

Pre-Installation Self-Check: The plugin runs with the current DSH process permissions. Before installation, you should read the source code and MIT license to ensure the behavior aligns with your security policy. The SkillHub community directory (https://www.skillhub.cn/plugins/JUSTMONIKA2022/dsh-sandbox-escalation-fix) is an independent site with no official affiliation to DeepSeek / High-Flyer; if the page is unavailable, refer directly to the GitHub repository.

Summary¶

dsh-sandbox-escalation-fix addresses the root cause of the inconsistency between third-party models’ sandbox escalation schemas and real-time session states under DSH: it projects visible parameters per session, cleans up invalid escalation prompts, and provides restrained fallback for redundant requests within the same mode. After zero-configuration installation into a profile, it restores continuous calls to bash, pwsh, write, and edit.

• SkillHub Directory: https://www.skillhub.cn/plugins/JUSTMONIKA2022/dsh-sandbox-escalation-fix
• GitHub Repository: https://github.com/JUSTMONIKA2022/dsh-sandbox-escalation-fix