dsh-strip-sandbox-permissions

A zero-dependency DeepSeek Harness (DSH) plugin that ignores sandbox_permissions / justification fields carried in model tool-call arguments, preventing false sandbox escalation rejections.

Problem

Some models (a post-training tendency) automatically attach sandbox_permissions (and its companion justification) to tool calls. When the session already runs with sufficient permission (for example full access), carrying a non-strictly-wider value triggers a false rejection from the DSH sandbox:

Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode

How it works

Every model tool call flows through the llm/stream waterfall, so this is the single interception point that covers every adapter. Adapters emit a block-end chunk carrying the fully assembled tool-call block at the end of the stream. This plugin rewrites that block: it parses the arguments object, deletes the top-level sandbox_permissions / justification keys, and re-serializes. Session logs and replay both see the cleaned arguments, so nothing downstream disagrees.

Only those two escalation-specific keys are stripped; every other argument is preserved verbatim. A new block is produced only when one of the keys actually exists — otherwise the original block is passed through unchanged (zero cost). Invalid JSON, non-object arguments, and non-tool-call blocks are left untouched.

Install

Published on npm. Install with:

dsh plugin --profile <your-profile> add dsh-strip-sandbox-permissions

Restart DSH after installing. Verify:

dsh plugin --profile <your-profile> list

Package / publish

npm pack          # produce dsh-strip-sandbox-permissions-<version>.tgz
npm publish       # publish a new version to the npm registry

A granular access token with Bypass 2FA enabled and Read and write package access is required to publish; a token without bypass 2FA is rejected with a 403 even when otherwise valid.

中文说明

一个零依赖的 DeepSeek Harness（DSH）插件：忽略模型工具调用参数里携带的 sandbox_permissions / justification 字段，避免沙箱权限误拒绝。

部分模型（后训练倾向）会在工具调用参数里自动带上 sandbox_permissions（及其配套 justification）。当会话已处于足够权限（例如完整访问权限）时，携带一个非严格加宽的 值会触发 DSH 沙箱的误拒绝。本插件在 llm/stream 瀑布流（所有模型工具调用的必经点） 拦截 block-end 块，从工具参数对象顶层删除这两个字段后再交给装配器。只剥离这两个 升级专属字段，其余参数原样保留；未命中时零开销透传。

安装：

dsh plugin --profile <你的profile名> add dsh-strip-sandbox-permissions

安装完成后重启 DSH 即生效。

License

MIT