Preface

In DeepSeek Harness (DSH), models sometimes still carry sandbox_permissions even when they already have higher sandbox privileges. If the requested permissions are not higher than the current Session’s permissions, such parameters have no practical effect but can trigger errors like not strictly wider, or bring invalid requests into the approval path. dsh-plugin-sandbox-escalation-fix provides a small compatibility layer for this issue: it only handles invalid parameters that are not higher than the current permissions, while preserving DSH’s original privilege escalation approval and invalid parameter validation.

What This Is

inmny/dsh-sandbox-escalation-fix is an MIT-licensed DSH plugin. The package name in npm/README is dsh-plugin-sandbox-escalation-fix, and the current installation version provided is 0.1.2.

It addresses the noise caused by mismatched sandbox_permissions and justification parameters in DSH 0.1.0-rc.6: when the model already has equal or higher permissions, duplicate requests no longer incorrectly enter the approval flow; genuinely wider requests still go through DSH’s original approval process.

Core Features

The plugin normalizes redundant or outdated privilege escalation parameters on the Host side for bash, pwsh, write, and edit. The corresponding tools visible in standard, code, cordis, minimal, and custom presets share this fix without requiring additional configuration.

Key behaviors are as follows:

  • Ignores invalid sandbox_permissions requests that are not higher than the Session’s current permissions, preventing repeated not strictly wider errors when the model already has higher or equal permissions.
  • Automatically fills in "Empty justification" when a genuine escalation request is missing or has a blank justification.
  • Ignores orphaned justifications that only contain justification without sandbox_permissions, avoiding invalid escalation parameter pairing errors.
  • Genuinely wider requests still enter the DSH approval flow; legitimate non-empty justifications remain unchanged.
  • Invalid values such as read-only, unknown targets, or non-string justification are still rejected by DSH.
  • The plugin is installed only as a bundle layer to the target profile and does not modify the DSH installation directory.
  • The plugin listens to tool and Agent lifecycles, handling global definitions, preset scoped shadows, post-created Agents, and tool HMR; after tool replacement or Agent destruction, wrappers that are no longer visible are restored and released; after plugin uninstallation, old wrappers only pass through parameters lazily.

Note: This is not a permission escalation enabler. approval: never means approval requests are automatically rejected, not that permissions are automatically granted.

Installation and Enabling

Runtime requirements:

  • Node.js 24 or higher
  • DSH 0.1.0-rc.6
  • Host platforms supported by DSH

Install a pinned version to the Web profile via npm:

dsh plugin --profile web add dsh-plugin-sandbox-escalation-fix@0.1.2

Use the same command to update an existing installation. After installation, restart dsh web to allow the Host to load the new plugin, then create a new session.

To install the latest version, omit the version number:

dsh plugin --profile web add dsh-plugin-sandbox-escalation-fix

When developing a local version, pass the checkout path:

dsh plugin --profile web add C:\path\to\dsh-sandbox-escalation-fix

To remove the plugin:

dsh plugin --profile web remove dsh-plugin-sandbox-escalation-fix

For full validation during development:

pnpm install
pnpm test
pnpm run pack:check

Typical Usage

After installation, no additional configuration is needed for bash, pwsh, write, or edit. The plugin checks the current Session’s sandbox permissions before tool calls:

  • If the requested sandbox_permissions is not higher than the current permissions, the plugin ignores the invalid privilege escalation parameter and executes the tool with the current Session’s permissions.
  • If the request is genuinely wider, the plugin preserves the parameter and proceeds with DSH’s original approval flow.
  • If only justification is present without sandbox_permissions, the plugin ignores this orphaned justification.
  • If an escalation is needed but the reason is missing or blank, the plugin uses "Empty justification" as a fallback.

This behavior is equivalent to “only cleaning up invalid parameters without changing the semantics of legitimate approvals.”

Use Cases and Considerations

This is suitable for developers using DSH 0.1.0-rc.6 who encounter repeated errors caused by equal-level or outdated sandbox permission parameters in bash, pwsh, write, and edit. It works well as a transitional compatibility plugin: if DSH natively accepts such invalid privilege escalation no-ops in the future, the plugin can simply be removed.

Before use, it is recommended to review the repository source code, dependencies, and MIT license, and confirm that the target profile’s permission model matches expectations. The plugin runs with the current DSH process permissions, and after installation it will affect the normalization of execution parameters for visible tools in the corresponding profile.

Some edge cases:

  • This is a compatibility plugin tailored to the ToolDefinition structure of DSH 0.1.0-rc.6; after upgrading DSH, tests should be run first and upstream should be checked to see whether such invalid privilege escalation no-ops are already natively supported.
  • In package.json, peerDependencies strictly require @deepseek-ai/cordis 4.0.1 and multiple @deepseek-ai/* 0.1.0-rc.6 packages.
  • The plugin only handles parameter normalization; it does not allow genuine privilege escalation requests, nor does it replace DSH’s invalid parameter validation.
  • Naming differences exist: the repository clue is inmny/dsh-sandbox-escalation-fix, while the npm/README package name is dsh-plugin-sandbox-escalation-fix.

Repository:

  • https://github.com/inmny/dsh-sandbox-escalation-fix

Directory page clue (from plugin clues, not verified in this material):

  • https://www.skillhub.cn/plugins/inmny/dsh-sandbox-escalation-fix

Ecosystem note: DSH’s plugin ecosystem follows the “everything is a plugin” approach; the directory page mentioned here belongs to a community directory and is not equivalent to an official app store from DeepSeek or High-Flyer.