DeepSeek Harness
DeepSeek Harness plugin catalog
sandbox-escalation-compat
Name, description, and notes are shown in the submitted language and are not translated.
Fix Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode。gpt-5.6-sol 常见。tools/execute 事件剥掉非加宽 sandbox_permissions（同级或更窄），真正加宽仍走审批。
For agents: Markdown · JSON · tarball
Install on a machine that already has the plugin market
curl -fsSL https://addon.dshdo.com/install-plugin-market.sh | sh
# then in /plugin-market/ install sandbox-escalation-compat and enable it Open /plugin-market/ → Cloud catalog, install this id, then enable. Install only registers; enable runs it.
Versions
0.1.3· Published0.1.2· Published — 修复 agent preset 作用域下工具包装失效：改用 tools/execute 事件监听覆盖各 preset 的工具调度；仅剥离非加宽 sandbox_permissions，真正升权仍交由官方审批。更新中英文说明与测试。
Files
README
sandbox-escalation-compat
English | 中文
Fix: Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode
Out-of-tree DeepSeek Harness plugin. Some models (GPT-5.6-sol and siblings) retry bash / write / edit with sandbox_permissions that are not strictly wider than the session's standing mode — typically workspace-write while the session is already danger-full-access. The official executor then fails closed with:
Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" modeThis plugin listens on the registry's tools/execute around-dispatch waterfall and strips that non-widening pair (sandbox_permissions + justification) from the call's arguments, so the call continues under the standing mode. A strictly wider request is never touched and still requires user approval.
It does not change the harness tree, does not grant extra permissions, and does not bypass approval for a real escalation.
Why a tools/execute listener and not an execute wrapper
Version 0.1.x wrapped registered tool execute() callbacks (ctx.tools.schemas() + ctx.tools.get()). Since agent presets (dsh-web-app 0.1.x) moved model-facing tools into per-preset scope layers, a host-plane plugin enumerating ctx.tools sees only the global layer — it never reaches the bash / write / edit definitions a session actually dispatches, so the wrap silently did nothing.
The tools/execute waterfall is the documented around-dispatch seam (the timeout policy uses it) and reaches every dispatch regardless of which scope registered the tool. A host-plane (untagged) listener receives each agent's events, resolves the session's standing sandbox mode through ctx.sandboxPolicy, and rewrites exec.arguments only when the call carries a non-widening sandbox_permissions.
Behavior
| Standing mode | Requested mode | Result |
|---|---|---|
danger-full-access | workspace-write | Strip; run as-is |
danger-full-access | danger-full-access | Strip; run as-is (restatement, not escalation) |
workspace-write | danger-full-access | Unchanged; approval still required |
read-only | workspace-write | Unchanged; approval still required |
| any | *(field omitted)* | Unchanged |
If ctx.sandboxPolicy is not composed, or the standing mode cannot be resolved to a known sandbox mode, the listener is a no-op and the official fail-closed path decides.
Install
From the plugin market (/plugin-market/): install catalog id sandbox-escalation-compat, then enable it. Or copy this directory to ~/dsh-plugins/sandbox-escalation-compat/ and enable the local shelf entry.
Search / SEO: this plugin is the fix for Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode on GPT-5.6-sol (and related models) in DeepSeek Harness.
Restart dsh web after updating the plugin so the Loader picks up the new entry (a running process does not hot-reload a patch written while it is up).
Tests
node --test ~/dsh-plugins/sandbox-escalation-compat/tests/*.test.mjs