deepseekplugins

DeepSeek Harness plugin

dsh-same-mode-sandbox-noop

DSH compatibility plugin that treats redundant non-escalating sandbox permission fields as a no-op

Security & Permissions
Jump to install

Source facts

Repository
zhangzujian/dsh-same-mode-sandbox-noop
Latest update
Aug 14, 2026
Category
Security & Permissions
GitHub stars
4
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/zhangzujian/dsh-same-mode-sandbox-noop
Plugin: dsh-same-mode-sandbox-noop
Author: zhangzujian

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer3 files
README.mdSource · read only

dsh-same-mode-sandbox-noop

A removable compatibility plugin for DeepSeek Harness / DSH 0.1.0-rc.6.

That release rejects a tool call when sandbox_permissions names a mode that is already covered by the call's effective sandbox mode:

Error: sandbox escalation to "danger-full-access" is not strictly wider than
this call's current "danger-full-access" mode

The plugin wraps both ctx.tools.execute() and the rc.6 Agent Loop scheduler's preparation entry point before DSH snapshots and freezes tool arguments. For bash, pwsh, write, and edit, it removes the paired sandbox_permissions and justification fields when the requested mode is equal to or narrower than the calling session's effective mode. The original runtime then executes the call under its standing policy. For example, a workspace-write request in a danger-full-access session is not an escalation, so the redundant pair is removed.

Genuinely wider requests, unknown modes, malformed argument pairs, unrelated tools, and calls without escalation fields pass to DSH unchanged. For a known non-escalating request, an empty justification is removed with the redundant permission fields before DSH validates it; for a genuinely wider request, the same empty justification remains subject to DSH's original validation. Disposal restores the original runtime methods.

This is an out-of-tree compatibility workaround. Prefer a DSH release that handles non-escalating requests in the shared sandbox escalation layer when one is available.

Install into a DSH profile

Until this package is published to npm, clone it and add the local directory:

git clone https://github.com/zhangzujian/dsh-same-mode-sandbox-noop.git
cd dsh-same-mode-sandbox-noop
npx @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add "$PWD"

The package declares a DSH bundle, so dsh plugin adds its patch layer to the profile automatically. Restart dsh web after installation.

To remove it:

npx @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web remove @zhangzujian/dsh-same-mode-sandbox-noop

For a one-off local overlay without profile installation, insert the plugin by file URL in a patch loaded after the base bundle:

- insert:
    - id: same-mode-sandbox-noop
      name: file:///absolute/path/to/dsh-same-mode-sandbox-noop/index.mjs

Test

Unit tests require only Node.js:

npm test

Integration tests run against an installed DSH tree:

DSH_INSTALL_DIR=/path/to/npx/cache/package npm run test:integration

DSH_INSTALL_DIR is the directory containing node_modules/@deepseek-ai.

License

MIT

Back to searchOpen GitHub repository

More related plugins

View category