Introduction

DSH supports extending tool calling behavior via plugins. Below is a community plugin: dsh-gpt-perm-strip.

In DSH, tool calling parameters may include sandbox_permissions or justification. DSH’s requirement for sandbox escalation is that these permission fields must be strictly wider than the current session. Fields that are the same or narrower will fail directly, for example:

sandbox escalation to "danger-full-access" is not strictly wider than this call's current "danger-full-access" mode

GPT series models sometimes still send these fields even when the current session already has the corresponding permissions. dsh-gpt-perm-strip is a DeepSeek Harness plugin that runs exclusively on GPT series models; it removes sandbox_permissions / justification that are not strictly wider than the current session before tool execution.

What is this

dsh-gpt-perm-strip is maintained by FengLingYaaa, package name dsh-gpt-perm-strip, license MIT, repo version 0.1.0.

It solves the issue where GPT series models trigger DSH sandbox escalation check failures when carrying “non-escalation” sandbox permission fields during tool calls. The plugin only handles GPT series models and does not alter permission parameters for non-GPT models.

Core Features

Below are the verified behavior boundaries of this plugin.

  • Matches GPT series models by model id rather than provider. Matching examples given in the README include gpt-4o, gpt-5.6-sol, chatgpt-4o-latest, openai/gpt-4.1, ft:gpt-4o:….
  • Removes sandbox_permissions / justification that are not strictly wider than the current session before the DSH sandbox escalation check.
  • Preserves genuine permission escalations, for example from workspace-write to danger-full-access, and from read-only to workspace-write.
  • Treats o1 / o3 / o4 as GPT series via includeOpenAiReasoning; this config is enabled by default.
  • Ignores Grok and DeepSeek unless extraModelPatterns is configured.
  • Since tools/pre-execute cannot rewrite frozen parameters, the plugin wraps the execute of each tool and passes a cloned parameters object with extra fields removed.
  • permission / permissions are only considered sandbox fields when their values are known sandbox modes.
  • Persistent tool/call records will still display the content originally output by the model; the plugin only affects the parameters object entering the DSH check before execution.

Installation and Usage

Plugin runtime requires Node >=22, with optional peer dependency @deepseek-ai/cordis >=4.0.0.

If installing from GitHub, execute the following command first. This command adds the specified GitHub repository as a DSH plugin to the web profile:

dsh plugin --profile web add github:FengLingYaaa/dsh-gpt-perm-strip

If viewing source code locally or making changes, you can install as follows:

git clone https://github.com/FengLingYaaa/dsh-gpt-perm-strip.git
cd dsh-gpt-perm-strip
pnpm install
pnpm test
pnpm build
dsh plugin --profile web add .

Note: This plugin wraps tool execution logic within the current dsh process. Review source code, dependencies, and license before installing. Information in this article is based on the repository.

Configuration

Below is the default configuration given in the README.

Field Default Meaning
includeOpenAiReasoning true Treats o1 / o3 / o4 as GPT series
extraModelPatterns [] Appends regex matches to provider, model, or provider/model
injectPrompt true Injects reminders into GPT series runtime context
logStrips true Logs every removal as [gpt-perm-strip] stripped …

By default, Grok and DeepSeek are ignored; extra models are only included if extraModelPatterns is added.

Typical Behavior

Below are the results of the same plugin under different session permissions.

Current Session Permissions GPT Tool Parameters Result
danger-full-access sandbox_permissions: danger-full-access Removed, call continues
workspace-write sandbox_permissions: workspace-write Removed
workspace-write sandbox_permissions: danger-full-access Preserved, genuine upgrade
read-only sandbox_permissions: workspace-write Preserved, genuine upgrade
Non-GPT Model Any permission field Unchanged

In other words, the plugin only removes sandbox permission fields that are “same or narrower”; if the field represents an escalation from the current session to higher permissions, it is retained for the DSH escalation check to handle.

Use Cases and Notes

Suitable for scenarios where GPT series models are used, the current DSH session already possesses certain sandbox permissions, and the model still sends sandbox_permissions / justification. It helps avoid escalation failures triggered by same permission fields while preserving genuine upgrades.

Notes:

  • It only targets GPT series models and does not handle Grok or DeepSeek unless explicitly extended via extraModelPatterns.
  • It does not rewrite the model’s output itself; persistent tool/call records will still display the content originally output by the model.
  • It is a community plugin, not an official app from DeepSeek or Hypersphere’s official app store; source code review is recommended before installation.
  • DSH’s plugin mechanism allows extending tool calling behavior, but permission cleanup should remain within auditable configuration and source code.

Conclusion

The scope of dsh-gpt-perm-strip is limited: it only removes sandbox_permissions / justification that are not strictly wider than the current session before GPT series models execute tool calls. This reduces escalation failures caused by same or narrower permission fields while preserving genuine permission escalations.

GitHub Repository: https://github.com/FengLingYaaa/dsh-gpt-perm-strip

Community Directory Page: The verified information in this article does not provide a directly listed directory page URL; you can search for the plugin name dsh-gpt-perm-strip in the DSH community directory.