deepseekplugins

DeepSeek Harness plugin

dsh-python-tempfile-shim

DeepSeek Harness plugin (temporary, pre-upstream-fix): automatically injects a CPython tempfile shim (PYTHONPATH -> sitecustomize) into every confined shell command on the Windows sandbox, so

Tools & Capabilities
Jump to install

Source facts

Repository
AngelosZou/dsh-python-tempfile-shim
Latest update
Aug 16, 2026
Category
Tools & Capabilities
GitHub stars
1
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/AngelosZou/dsh-python-tempfile-shim
Plugin: dsh-python-tempfile-shim
Author: AngelosZou

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer4 files
README.mdSource · read only
README language

dsh-python-tempfile-shim

简体中文

Temporary plugin that works around one Windows sandbox incompatibility until DeepSeek Harness ships an upstream fix. It is not published to npm; install it from a local clone. Read [SECURITY.md](./SECURITY.md) before installing.

The plugin lets Python (including pytest) use temporary directories inside the DSH Windows sandbox. Background: CPython on Windows builds a directory DACL from os.mkdir's mode argument; 0o700 produces an owner-only directory. tempfile.mkdtemp and pytest's basetemp chain both use 0o700. The DSH Windows sandbox runs commands under a WRITE_RESTRICTED token whose restricting-SID list excludes the user's own SID, so the confined process cannot read or write the directories it just created. pytest tmp_path/ tmpdir tests fail with [Errno 13] / WinError 5 and the [sandbox: file access denied under workspace-write mode] marker.

How it works — fully automatic, no extra tools

The plugin patches the mounted shell executor's resolve() — the single chokepoint every shell consumer passes through (the pwsh tool, background jobs, in-process plugin bridges) — so that every confined command (workspace-write / read-only) inherits PYTHONPATH=<plugin assets dir>. The bundled assets/sitecustomize.py then makes os.mkdir ignore the mode argument, so new directories inherit the parent ACL (which carries the sandbox's workspace/temp write ACEs) instead of CPython's owner-only DACL.

Because the injection happens at the executor level:

  • No extra tools to remember — python, pytest, pip, tox, nox,

venvs, and any child Python process all get the fix automatically.

  • No extra model context — the agent just runs Python normally through

pwsh. A compact always-on system-prompt section tells it the fix is automatic so it never reaches for workarounds.

  • Zero escalation — the sandbox boundary is untouched: token, ACEs,

policy, and escalation surface are all left alone.

PYTHONPATH is inert for non-Python commands, so adding it to every confined command is safe; a command that sets $env:PYTHONPATH itself still overrides it. The shim is deliberately not injected for unsandboxed compositions or danger-full-access runs (the bug does not exist there, and 0o700 is CPython's privacy hardening that unconfined runs should keep).

A python-tempfile-shim skill is also registered for humans and for the rare case where a failure still appears (diagnose + report).

Scope

  • All 0o700 directory creation routes through os.mkdir: tempfile.mkdtemp,

tempfile.TemporaryDirectory, os.makedirs(mode=0o700), pathlib.Path.mkdir(mode=0o700), pytest, tox/nox (the shim propagates to subprocesses via PYTHONPATH).

  • Windows only; on other platforms apply() registers nothing.
  • File creation (os.open/mkstemp modes) is not affected and needs no patch.

Install

git clone https://github.com/AngelosZou/dsh-python-tempfile-shim.git
dsh plugin --profile web add link:<local repository path>

Restart DSH afterwards.

Uninstall: remove the plugin from the DSH settings page, then restart DSH.

Verification

  • Environment: Windows, DSH workspace-write sandbox, Python 3.11.15 / 3.13.14,

pytest 9.1.1. - Without the plugin: tmp_path test fails with PermissionError: [WinError 5]. - With the plugin: 1 passed; mkdtemp, TemporaryDirectory, mkstemp, and basetemp cleanup work — run through the ordinary pwsh tool, no special arguments.

  • Subprocess propagation: parent Python process to child Python process

(inherited PYTHONPATH) works.

  • Smoke test: npm test covers the resolve-patch contract (confined modes

injected, danger-full-access/unsandboxed left alone, idempotency, disposal, no spec mutation) plus prompt-section and skill registration.

Security

See [SECURITY.md](./SECURITY.md). Note: do not install assets/sitecustomize.py into global site-packages or a machine-wide PYTHONPATH; 0o700 is CPython's privacy hardening and unsandboxed runs should keep it.

Upstream status

Uninstall this plugin once an upstream fix ships.

License

MIT

Back to searchOpen GitHub repository

More related plugins

View category