dsh-escalation-tolerance

@deepseek-ai/dsh-escalation-tolerance

Tolerate redundant sandbox_permissions requests – a Cordis plugin that turns hard failures into harmless no‑ops when a tool asks for a permission mode that is already active.

Problem

Some GPT‑family models (e.g., gpt-5.6-luna, azure/gpt-5.4-mini) speculatively send sandbox_permissions on ordinary tool calls, even when the session already runs at that permission level. The shared escalation validator (@deepseek-ai/dsh-sandbox) expects any escalation request to be strictly wider than the call’s effective mode; otherwise it fails with:

sandbox escalation to "<mode>" is not strictly wider than this call's current "<mode>" mode

This means a trivial pwd can crash the tool if the model adds a redundant sandbox_permissions field.

Solution

This plugin hooks into the tools/execute waterfall and inspects the requested sandbox_permissions. If the requested mode is not strictly wider than the session's standing mode, it strips both sandbox_permissions and justification from the arguments. The tool then executes at the standing mode – exactly what would have happened had the model not sent the redundant request.

Genuine escalations (modes that are strictly wider) are left untouched and still go through the normal approval flow.

Security note: No security boundary is changed. Stripping the redundant request is equivalent to ignoring it; the tool always runs under the session's current effective mode.

Installation

npm install @deepseek-ai/dsh-escalation-tolerance

The package includes a Cordis patch (cordis.patch.yml) that registers the plugin automatically when bundled with the @deepseek-ai/cordis bundle system.

If you are using Cordis manually, add the plugin to your configuration:

import { App } from '@deepseek-ai/cordis';
import * as escalationTolerance from '@deepseek-ai/dsh-escalation-tolerance';

const app = new App();
app.plugin(escalationTolerance);

How It Works

The plugin listens on the tools/execute event and:

1. Extracts sandbox_permissions from the tool call arguments.

2. Resolves the session’s effective sandbox mode using the sandboxPolicy service.

3. Compares the requested mode against the WIDER_MODES table:

   Current mode	Allowed wider modes
   read-only	workspace-write, danger-full-access
   workspace-write	danger-full-access

4. If the requested mode is not in that list, the plugin:

   • Copies the arguments,
   • Deletes sandbox_permissions and justification,
   • Replaces exec.arguments with the sanitised copy,
   • Lets the tool execute normally.

5. If the requested mode is in the list, the plugin does nothing – the escalation request proceeds through the usual approval flow.

If no sandbox policy is available (or resolution fails), the plugin silently bypasses and lets the call proceed.

Dependencies

• @deepseek-ai/cordis (peer dependency, ^4.0.1)
• The sandboxPolicy service (provided by @deepseek-ai/dsh-sandbox or a compatible implementation)

License

MIT