{"ok":true,"value":{"id":"sandbox-escalation-compat","name":"sandbox-escalation-compat","version":"0.1.3","developer":"DeepSeek Harness","description":"Fix Error: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode。gpt-5.6-sol 常见。tools/execute 事件剥掉非加宽 sandbox_permissions（同级或更窄），真正加宽仍走审批。","sha256":"fa0cbd8725a647ceb4d72e5c0a2bac6ee73659eeddce044a0b4fefb7a700f185","byteSize":6939,"publishedAt":"2026-09-08T03:29:04.735Z","updatedAt":"2026-09-21T17:16:40.885Z","releasedAt":"2026-09-21T17:16:40.885Z","packageName":"sandbox-escalation-compat","loaderId":"sandbox-escalation-compat","changelog":"","readme":{"md":"# sandbox-escalation-compat\n\nEnglish | [中文](README.zh.md)\n\n**Fix:** `Error: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode`\n\nOut-of-tree DeepSeek Harness plugin. Some models (GPT-5.6-sol and siblings) retry `bash` / `write` / `edit` with `sandbox_permissions` that are **not strictly wider** than the session's standing mode — typically `workspace-write` while the session is already `danger-full-access`. The official executor then fails closed with:\n\n```\nError: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode\n```\n\nThis plugin listens on the registry's `tools/execute` around-dispatch waterfall and **strips** that non-widening pair (`sandbox_permissions` + `justification`) from the call's arguments, so the call continues under the standing mode. A **strictly wider** request is never touched and still requires user approval.\n\nIt does not change the harness tree, does not grant extra permissions, and does not bypass approval for a real escalation.\n\n## Why a `tools/execute` listener and not an `execute` wrapper\n\nVersion 0.1.x wrapped registered tool `execute()` callbacks (`ctx.tools.schemas()` + `ctx.tools.get()`). Since agent presets (dsh-web-app 0.1.x) moved model-facing tools into per-preset **scope layers**, a host-plane plugin enumerating `ctx.tools` sees only the global layer — it never reaches the `bash` / `write` / `edit` definitions a session actually dispatches, so the wrap silently did nothing.\n\nThe `tools/execute` waterfall is the documented around-dispatch seam (the timeout policy uses it) and reaches **every** dispatch regardless of which scope registered the tool. A host-plane (untagged) listener receives each agent's events, resolves the session's standing sandbox mode through `ctx.sandboxPolicy`, and rewrites `exec.arguments` only when the call carries a non-widening `sandbox_permissions`.\n\n## Behavior\n\n| Standing mode | Requested mode | Result |\n|---|---|---|\n| `danger-full-access` | `workspace-write` | Strip; run as-is |\n| `danger-full-access` | `danger-full-access` | Strip; run as-is (restatement, not escalation) |\n| `workspace-write` | `danger-full-access` | Unchanged; approval still required |\n| `read-only` | `workspace-write` | Unchanged; approval still required |\n| any | *(field omitted)* | Unchanged |\n\nIf `ctx.sandboxPolicy` is not composed, or the standing mode cannot be resolved to a known sandbox mode, the listener is a no-op and the official fail-closed path decides.\n\n## Install\n\nFrom the plugin market (`/plugin-market/`): install catalog id `sandbox-escalation-compat`, then enable it. Or copy this directory to `~/dsh-plugins/sandbox-escalation-compat/` and enable the local shelf entry.\n\nSearch / SEO: this plugin is the fix for `Error: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode` on GPT-5.6-sol (and related models) in DeepSeek Harness.\n\nRestart `dsh web` after updating the plugin so the Loader picks up the new entry (a running process does not hot-reload a patch written while it is up).\n\n## Tests\n\n```sh\nnode --test ~/dsh-plugins/sandbox-escalation-compat/tests/*.test.mjs\n```\n","zhMd":"# sandbox-escalation-compat\n\n[English](README.md) | 中文\n\n**Fix:** `Error: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode`\n\n树外 DeepSeek Harness 插件。部分模型（gpt-5.6-sol 及其系列）会在 `bash` / `write` / `edit` 上带上**并不比当前模式更宽**的 `sandbox_permissions`——典型情况是会话已是 `danger-full-access`，模型仍请求 `workspace-write`。官方执行器会失败并返回：\n\n```\nError: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode\n```\n\n本插件监听工具注册表的 `tools/execute` 环绕分派 waterfall，把这种非加宽的 `sandbox_permissions` + `justification` 从调用参数里**剥掉**，让调用按当前模式继续。**真正加宽**的请求原样交给官方审批，不会被绕过。\n\n不改 harness 主仓，不额外授权，不绕过真实升权审批。\n\n## 为什么用 `tools/execute` 事件而不是包装 `execute`\n\n0.1.x 是包装已注册工具的 `execute()`（`ctx.tools.schemas()` + `ctx.tools.get()`）。agent preset（dsh-web-app 0.1.x）把模型可见工具移到**每个 preset 的 scope layer** 之后，host 平面的插件枚举 `ctx.tools` 只能看到 global layer——根本拿不到会话真正分派的 `bash` / `write` / `edit` 定义，包装静默失效。\n\n`tools/execute` waterfall 是官方文档化的环绕分派接缝（timeout policy 就用它），无论工具注册在哪个 scope 都能拦到**每一次**分派。host 平面（无 tag）监听器能收到每个 agent 的事件，通过 `ctx.sandboxPolicy` 解析会话当前沙箱模式，仅当调用带了非加宽 `sandbox_permissions` 时改写 `exec.arguments`。\n\n## 行为\n\n| 当前模式 | 请求模式 | 结果 |\n|---|---|---|\n| `danger-full-access` | `workspace-write` | 剥掉；按当前模式执行 |\n| `danger-full-access` | `danger-full-access` | 剥掉；按当前模式执行（重复申明，非升权） |\n| `workspace-write` | `danger-full-access` | 不改；仍走审批 |\n| `read-only` | `workspace-write` | 不改；仍走审批 |\n| 任意 | *(未带该字段)* | 不改 |\n\n未组合 `ctx.sandboxPolicy`，或当前模式无法解析为已知沙箱档位时，监听器为空操作，由官方 fail-closed 路径裁决。\n\n## 安装\n\n在插件市场（`/plugin-market/`）安装目录 id `sandbox-escalation-compat`，再启用。或把本目录放到 `~/dsh-plugins/sandbox-escalation-compat/`，从本机货架启用。\n\n搜索 / SEO：本插件修复 DeepSeek Harness 在 gpt-5.6-sol（及其系列）上的报错 `Error: sandbox escalation to \"workspace-write\" is not strictly wider than this call's current \"danger-full-access\" mode`。\n\n更新插件后请重启 `dsh web`，让 Loader 读到新入口（运行中的进程不会热加载运行期间写入的 patch）。\n\n## 测试\n\n```sh\nnode --test ~/dsh-plugins/sandbox-escalation-compat/tests/*.test.mjs\n```\n"},"versions":[{"version":"0.1.3","changelog":"","sha256":"fa0cbd8725a647ceb4d72e5c0a2bac6ee73659eeddce044a0b4fefb7a700f185","byteSize":6939,"releasedAt":"2026-09-21T17:16:40.885Z","reviewStatus":"approved"},{"version":"0.1.2","changelog":"修复 agent preset 作用域下工具包装失效：改用 tools/execute 事件监听覆盖各 preset 的工具调度；仅剥离非加宽 sandbox_permissions，真正升权仍交由官方审批。更新中英文说明与测试。","sha256":"92fd560d86570536569ccaf93f445ef14cb031f2477e951a46b25a73deb5d9cf","byteSize":6563,"releasedAt":"2026-09-08T03:29:04.735Z","reviewStatus":"approved"}],"urls":{"html":"https://addon.dshdo.com/plugins/sandbox-escalation-compat","markdown":"https://addon.dshdo.com/plugins/sandbox-escalation-compat.md","json":"https://addon.dshdo.com/v1/plugins/sandbox-escalation-compat","tarball":"https://addon.dshdo.com/v1/plugins/sandbox-escalation-compat/versions/0.1.3/tarball"}}}