dsh-gpt-perm-strip
A DeepSeek Harness plugin that runs only for GPT-family models. Before a tool body hits DSH's sandbox escalation check, it removes sandbox_permissions / justification that are not strictly wider than the current session.
Why
DSH requires sandbox_permissions to be strictly wider than the session. The same (or a narrower) mode fails immediately:
sandbox escalation to "danger-full-access" is not strictly wider than this call's current "danger-full-access" modeGPT-family models habitually send a permission field even when the session already has that access. This plugin drops those leftover fields and leaves real escalations (workspace-write → danger-full-access) untouched.
tools/pre-execute cannot rewrite frozen arguments. The plugin wraps each tool's execute and passes a cloned argument object with the unnecessary fields removed. The durable tool/call record still shows what the model emitted.
GPT-only
Matching is by model id, not provider (OpenAI-compatible gateways often host GPT, Grok, and DeepSeek under one provider):
gpt-4o,gpt-5.6-sol,chatgpt-4o-latest,openai/gpt-4.1,ft:gpt-4o:…- optional:
o1/o3/o4(includeOpenAiReasoning, default on)
Grok and DeepSeek are ignored unless you add extraModelPatterns.
Repo: https://github.com/FengLingYaaa/dsh-gpt-perm-strip
Install
dsh plugin --profile web add github:FengLingYaaa/dsh-gpt-perm-stripOr from a local checkout:
git clone https://github.com/FengLingYaaa/dsh-gpt-perm-strip.git
cd dsh-gpt-perm-strip
pnpm install
pnpm test
pnpm build
dsh plugin --profile web add .Config
| Field | Default | Meaning |
|---|---|---|
includeOpenAiReasoning | true | Treat o1/o3/o4 as GPT-family |
extraModelPatterns | [] | Extra regexes against provider, model, or provider/model |
injectPrompt | true | GPT-only runtime-context reminder |
logStrips | true | Log each strip as [gpt-perm-strip] stripped … |
Behavior
| Session | GPT argument | Result |
|---|---|---|
danger-full-access | sandbox_permissions: danger-full-access | stripped, call runs |
workspace-write | sandbox_permissions: workspace-write | stripped |
workspace-write | sandbox_permissions: danger-full-access | kept (real escalation) |
read-only | sandbox_permissions: workspace-write | kept |
| non-GPT model | any permission | unchanged |
permission / permissions are treated as sandbox fields only when the value is a known sandbox mode.