プラグイン

DeepSeek Harness/DSH 用のセッション対応サンドボックス昇格互換プラグイン — サードパーティモデルセッションのサンドボックス昇格互換プラグイン

DeepSeek Harness（DSH）のサードパーティモデル向け、セッション単位のサンドボックス権限昇格互換プラグイン。

DeepSeek Harness sandbox provider backed by MXC (Microsoft eXecution Containers): wraps ctx.sandbox.confine() argv as `wxc-exec --config-base64 <policy> -- <command>` on the BaseContainer backend. One runtime dependency (@microsoft/mxc-sdk, for the wxc-ex

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Removes sandbox_permissions / justification arguments that cannot widen the call's current sandbox mode, so calls no longer fail with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode'. GPT models tend to fill these optional fields on every call and pick workspace-write, which is narrower than danger-full-access. Runs in tools/pre-execute: compares the requested mode with the mode the session's sandbox policy resolves, and drops the fields when the request is the same or narrower (also drops a lone justification). Also understands the values GPT carries over from Codex's own shell tool: null, empty and use_default are treated as no request, and in a danger-full-access session any value (including require_escalated) is dropped because nothing is wider. Real widening requests, unknown modes and tools that do not advertise DSH's escalation schema are left to DSH core. Never widens permissions. Configurable tool list (default bash, pwsh, write, edit, run_code). Zero dependencies.

Keeps a redundant sandbox-escalation argument from failing a tool call. Escalating tools (pwsh, bash, write, edit) advertise the full sandbox_permissions enum, but DSH only accepts a level strictly wider than the one already in effect — a check its own source calls 'deliberately not a schema constraint'. A model that reflexively passes the argument therefore picks the level it is already at and the call dies before running with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode', costing some models a whole turn of retries. This plugin registers one tools/execute waterfall listener and, only on that documented rejection and only when the arguments really carried an escalation field, re-issues the identical call once without it. Safe by DSH's own documentation: the rejection precedes any execution ('nothing has run'), and the corrected call cannot match again, so the retry is loop-free. Reproduced and verified end to end — before: isError true, the command never ran; after: the command's real output, isError false, one tool/call and one tool/result. Zero dependencies.