# sandbox-escalation-compat

- id: sandbox-escalation-compat
- version: 0.1.3
- developer: DeepSeek Harness
- packageName: sandbox-escalation-compat
- loaderId: sandbox-escalation-compat
- sha256: fa0cbd8725a647ceb4d72e5c0a2bac6ee73659eeddce044a0b4fefb7a700f185
- byteSize: 6939
- publishedAt: 2026-09-08T03:29:04.735Z
- updatedAt: 2026-09-21T17:16:40.885Z
- releasedAt: 2026-09-21T17:16:40.885Z
- html: https://addon.dshdo.com/plugins/sandbox-escalation-compat
- json: https://addon.dshdo.com/v1/plugins/sandbox-escalation-compat
- markdown: https://addon.dshdo.com/plugins/sandbox-escalation-compat.md
- tarball: https://addon.dshdo.com/v1/plugins/sandbox-escalation-compat/versions/0.1.3/tarball

## Install

```
curl -fsSL https://addon.dshdo.com/install-plugin-market.sh | sh
# then install catalog id sandbox-escalation-compat in /plugin-market/ and enable it
```

## Description

Fix Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode。gpt-5.6-sol 常见。tools/execute 事件剥掉非加宽 sandbox_permissions（同级或更窄），真正加宽仍走审批。

## Changelog

(none)

## Versions

- 0.1.3 (2026-09-21T17:16:40.885Z)
- 0.1.2 (2026-09-08T03:29:04.735Z): 修复 agent preset 作用域下工具包装失效：改用 tools/execute 事件监听覆盖各 preset 的工具调度；仅剥离非加宽 sandbox_permissions，真正升权仍交由官方审批。更新中英文说明与测试。

## README

# sandbox-escalation-compat

English | [中文](README.zh.md)

**Fix:** `Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode`

Out-of-tree DeepSeek Harness plugin. Some models (GPT-5.6-sol and siblings) retry `bash` / `write` / `edit` with `sandbox_permissions` that are **not strictly wider** than the session's standing mode — typically `workspace-write` while the session is already `danger-full-access`. The official executor then fails closed with:

```
Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode
```

This plugin listens on the registry's `tools/execute` around-dispatch waterfall and **strips** that non-widening pair (`sandbox_permissions` + `justification`) from the call's arguments, so the call continues under the standing mode. A **strictly wider** request is never touched and still requires user approval.

It does not change the harness tree, does not grant extra permissions, and does not bypass approval for a real escalation.

## Why a `tools/execute` listener and not an `execute` wrapper

Version 0.1.x wrapped registered tool `execute()` callbacks (`ctx.tools.schemas()` + `ctx.tools.get()`). Since agent presets (dsh-web-app 0.1.x) moved model-facing tools into per-preset **scope layers**, a host-plane plugin enumerating `ctx.tools` sees only the global layer — it never reaches the `bash` / `write` / `edit` definitions a session actually dispatches, so the wrap silently did nothing.

The `tools/execute` waterfall is the documented around-dispatch seam (the timeout policy uses it) and reaches **every** dispatch regardless of which scope registered the tool. A host-plane (untagged) listener receives each agent's events, resolves the session's standing sandbox mode through `ctx.sandboxPolicy`, and rewrites `exec.arguments` only when the call carries a non-widening `sandbox_permissions`.

## Behavior

| Standing mode | Requested mode | Result |
|---|---|---|
| `danger-full-access` | `workspace-write` | Strip; run as-is |
| `danger-full-access` | `danger-full-access` | Strip; run as-is (restatement, not escalation) |
| `workspace-write` | `danger-full-access` | Unchanged; approval still required |
| `read-only` | `workspace-write` | Unchanged; approval still required |
| any | *(field omitted)* | Unchanged |

If `ctx.sandboxPolicy` is not composed, or the standing mode cannot be resolved to a known sandbox mode, the listener is a no-op and the official fail-closed path decides.

## Install

From the plugin market (`/plugin-market/`): install catalog id `sandbox-escalation-compat`, then enable it. Or copy this directory to `~/dsh-plugins/sandbox-escalation-compat/` and enable the local shelf entry.

Search / SEO: this plugin is the fix for `Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode` on GPT-5.6-sol (and related models) in DeepSeek Harness.

Restart `dsh web` after updating the plugin so the Loader picks up the new entry (a running process does not hot-reload a patch written while it is up).

## Tests

```sh
node --test ~/dsh-plugins/sandbox-escalation-compat/tests/*.test.mjs
```