Zero-config DSH plugin that stops third-party-model sandbox-escalation retry loops under All Access by projecting a per-session tool schema; installs via the dsh plugin CLI and leaves DSH core untouched.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-09-03
License
MIT
01What can it help you accomplish?
Make DeepSeek Harness show third-party models only the sandbox escalation options the current session can actually use
bash/pwsh/write/edit tools that complete the workflow instead of failing on sandbox_permissions/justification before they run
DSH All Access / workspace-write users running GPT or other third-party models that hit repeated escalation retries
Stop the retry loop caused by redundant same-mode escalation and blank-justification errors
tools run without sandbox_permissions argument errors or impossible escalation advice; existing sessions stay restorable
Developers who see "invalid justification" or "not strictly wider than current mode" errors under All Access
02How to install into DeepSeek Harness
Prerequisites
- DeepSeek Harness (dsh) on PATH, version rc.5/rc.6/rc.7/rc.8, 0.1.1-rc.1/rc.2, or 0.1.2-alpha.1–alpha.5 (Desktop 2.0.3 supported)
- Node.js ^22.19.0 or >=24.0.0, and @deepseek-ai/cordis ^4.0.1
- Close DSH before installing or upgrading the plugin
- Install only after reproducing the affected behavior (same-mode escalation, blank justification, or retry-loop failures)
Installation steps
- 01
Download and extract dsh-sandbox-escalation-fix-0.1.2-alpha5-release.zip, then run powershell -NoProfile -ExecutionPolicy Bypass -File ".\install-release.ps1" (add -Profile <name> for a non-default Profile)
- 02
Or pin a reviewed commit: dsh plugin --profile <profile> add github:<owner>/dsh-sandbox-escalation-fix#<commit-sha>
- 03
Inspect the composed config with dsh --profile <profile> --dump-config (expect a dsh-sandbox-escalation-fix bundle layer and the sandbox-escalation-fix plugin row)
- 04
Start DSH normally: dsh --profile <profile>
Verify the integration
- Fully restart DSH and open a new All Access session; ask the model to run pwsh, write a temp file, then edit and read it back
- The calls should complete without sandbox_permissions argument errors or impossible escalation advice
- Confirm --dump-config no longer lists the bundle after uninstall
03DSH integration and capability boundaries
Native DSH plugin installed through the official dsh plugin CLI (dsh plugin --profile <profile> add github:<owner>/dsh-sandbox-escalation-fix#<commit-sha>); wraps bash/pwsh/write/edit in each Agent Exact Scope via the dsh.tool-wrapper.v1 protocol and projects a per-session tool schema.
Session-aware tool-schema projection
each Session's live Sandbox Mode and Approval Policy→model-visible bash/pwsh/write/edit schemas that advertise only usable escalation options
Redundant same-mode request fallback
a model request whose escalation target equals the current session mode→the redundant escalation pair removed; the original tool runs
04Who is it for? When not to use it?
Good for
- DSH All Access / workspace-write users running GPT or other third-party models that hit repeated escalation retries
- Developers who see "invalid justification" or "not strictly wider than current mode" errors under All Access
Not for
- The plugin checks installed DSH package versions at startup. Mixed rc.5/rc.6/rc.7/rc.8/0.1.1-rc.1/0.1.1-rc.2/0.1.2-alpha.1–alpha.5 installations and unknown DSH versions fail explicitly; an incompatible target with partial escalation fields or an incompatible output definition rejects that Agent's registration.
- The plugin owns the bash/pwsh/write/edit wrapper names in each Agent Exact Scope; another plugin may share them only via the explicit Symbol.for('dsh.tool-wrapper.v1') protocol. An unknown same-name wrapper causes Agent registration to fail explicitly — remove one conflicting plugin rather than rely on undefined load order.
05Compatibility, maintenance and safety notes
- The plugin checks installed DSH package versions at startup. Mixed rc.5/rc.6/rc.7/rc.8/0.1.1-rc.1/0.1.1-rc.2/0.1.2-alpha.1–alpha.5 installations and unknown DSH versions fail explicitly; an incompatible target with partial escalation fields or an incompatible output definition rejects that Agent's registration.
- The plugin owns the bash/pwsh/write/edit wrapper names in each Agent Exact Scope; another plugin may share them only via the explicit Symbol.for('dsh.tool-wrapper.v1') protocol. An unknown same-name wrapper causes Agent registration to fail explicitly — remove one conflicting plugin rather than rely on undefined load order.
MIT · community plugin, supports DSH 0.1.2-alpha.5 and Desktop 2.0.3 (not published, maintained, or endorsed by DeepSeek)
06Frequently asked questions
What exactly does this plugin fix in DeepSeek Harness?
It removes the sandbox_permissions / justification escalation fields that stock DSH still advertises on bash, pwsh, write, and edit in All Access (danger-full-access + never) and workspace-write sessions, where no wider mode exists or every escalation is rejected. Without it, the model fills those fields, the call fails, and it retries in a loop. The plugin projects the model-visible schema from each Session's live Sandbox Mode and Approval Policy.
How do I install it into a DSH profile?
Download the Release ZIP and run `powershell -NoProfile -ExecutionPolicy Bypass -File ".\install-release.ps1"` (add `-Profile <name>` for a non-default profile), or run `dsh plugin --profile <profile> add github:<owner>/dsh-sandbox-escalation-fix#<commit-sha>` and pin a reviewed commit. Close DSH before installing, then `dsh --profile <profile> --dump-config` should list the bundle.
How do I confirm the fix is working?
Fully restart DSH, open a new All Access session, and ask the model to run pwsh, write a file, then edit and read it back. The tools should complete without sandbox_permissions argument errors or impossible escalation advice. A successful Web startup alone does not prove the dynamic restriction behavior, so run the behavior checks.
Which DSH versions are compatible?
Node.js ^22.19.0 or >=24.0.0, @deepseek-ai/cordis ^4.0.1, and @deepseek-ai/dsh-* 0.1.0-rc5 through 0.1.2-alpha.5 (rc.5–rc.8, 0.1.1-rc.1/rc.2, 0.1.2-alpha.1–alpha.5) plus Desktop 2.0.3. Mixed or unknown DSH versions fail explicitly at startup.
How do I uninstall it?
From the extracted Release ZIP run `powershell -NoProfile -ExecutionPolicy Bypass -File ".\uninstall-release.ps1"` (-Profile optional), or `dsh plugin --profile <profile> remove dsh-sandbox-escalation-fix`. Restart DSH and confirm `--dump-config` no longer lists the bundle.
07Related DSH workflows
cc-safety-net
by kenryu42
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
tencentmeeting-cli
by tencentcloud
Tencent Meeting command-line tool with OAuth2 authorization for meeting, recording and attendance-report management.
dsh-auto-review
by perrylink
Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default, fully auditable from the session log (approval/asked -> autoReview/verdict -> approval/decided).
dsh-permission-rules
by perrylink
Claude Code-style declarative permission rules for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, session-log audit, and HMR reload.
08Data and sources
The plugin owns the `bash`, `pwsh`, `write`, and `edit` names inside each Agent Exact Scope. Another plugin may share
dsh plugin --profile <profile> add github:<owner>/dsh-sandbox-escalation-fix#<commit-sha>
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-09-03. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.