dsh-sandbox-escalation-fix

In DSH All Access sessions, tools like bash, pwsh, write, and edit still expose sandbox_permissions and justification parameters to the model, even though the session is already at the highest sandbox tier and the approval policy is never. Any escalation request is guaranteed to be rejected, so the model fills those fields, the call is blocked by validation before it runs, and it retries in a loop. Third-party models such as GPT are especially prone to this. dsh-sandbox-escalation-fix addresses the root cause: it projects the model-visible tool schema per session based on the live Sandbox Mode and Approval Policy. In All Access sessions the escalation fields disappear entirely; in workspace-write sessions only the genuinely wider danger-full-access target remains. When the model cannot see a parameter that can never succeed, it stops reaching for it.

The plugin also provides a tightly scoped execution-time fallback: if the model attaches a spurious danger-full-access request to a write or edit call whose resolved path stays inside the current workspace, that redundant field is stripped and DSH proceeds under the existing workspace-write policy. Every other approval path, the strictly-wider check, and the filesystem boundary enforcement remain untouched. No extra permissions are granted and no approval justification is fabricated.

Ideal for users running third-party models under DSH All Access or workspace-write mode who hit repeated tool-call retries, blank justification errors, or retry loops. Zero configuration, single-plugin install, compatible with DSH 0.1.0-rc.5 through 0.1.2-rc.1 and Desktop 2.0.3.