dsh-gpt-perm-strip

DSH's sandbox escalation check enforces a strict rule: the sandbox_permissions carried by a tool call must be strictly wider than the current session. The same or a narrower mode is rejected outright. But GPT-family models have a habit—even when the session already grants that level of access, they still attach a leftover sandbox_permissions field, causing perfectly valid calls to fail the sandbox gate. This plugin exists to remove exactly that friction.

It works quietly and precisely: it matches by model ID (gpt-4o, gpt-5.6-sol, chatgpt-4o-latest, and optionally o1/o3/o4), wraps each tool's execute step with a cloned argument object, and strips permission fields that are not strictly wider than the session. Genuine escalations—say, workspace-write to danger-full-access—pass through untouched. Calls made by Grok or DeepSeek are left completely alone.

Who does this help? DSH operators who route GPT-family models alongside other backends and keep hitting sandbox rejections caused by redundant permission fields. No per-tool post-processing hacks needed: install the plugin, and every strip is logged for audit while the durable tool/call record still reflects what the model originally emitted.