Plugins

Removes sandbox_permissions / justification arguments that cannot widen the call's current sandbox mode, so calls no longer fail with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode'. GPT models tend to fill these optional fields on every call and pick workspace-write, which is narrower than danger-full-access. Runs in tools/pre-execute: compares the requested mode with the mode the session's sandbox policy resolves, and drops the fields when the request is the same or narrower (also drops a lone justification). Also understands the values GPT carries over from Codex's own shell tool: null, empty and use_default are treated as no request, and in a danger-full-access session any value (including require_escalated) is dropped because nothing is wider. Real widening requests, unknown modes and tools that do not advertise DSH's escalation schema are left to DSH core. Never widens permissions. Configurable tool list (default bash, pwsh, write, edit, run_code). Zero dependencies.

Cross-workspace worker fleets: one orchestrating session spawns named worker sessions in other project workspaces, queues or steers tasks into them, watches them in the background via a real host job, and collects their reports. Worker completions deliver themselves to the orchestrator's session rather than needing to be polled, so an idle orchestrator still reacts. Escalations and failed workers deliver by steer when the orchestrator is mid-turn and by queue when it is idle; a turn that ends without a report counts as a failure and the worker is replaced after a configurable limit. The roster persists to disk and each worker session carries a durable title, so a restart neither loses the fleet nor spawns duplicate sessions. Ships five agent presets at full plugin parity with the standard preset.

macOS menu bar indicator and system notifications for DeepSeek Harness: alerts when a tool needs approval (including sandbox escalations), when a question waits, and when a turn finishes — community fork of dsh-notify, compatible with DSH 0.1.7-rc.2 and 0

Local non-generative decision layer for DeepSeek Harness: the phocinae_ask / phocinae_gate tools backed by a Phocinae-Largha-150M-v1 server, plus a fail-closed approval gate on tools/pre-execute with a calibrated-confidence escalation signal

Escalation-only LLM reviewer: reviews sandbox escapes only, keeps the sandbox, fails closed.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Keeps a redundant sandbox-escalation argument from failing a tool call. Escalating tools (pwsh, bash, write, edit) advertise the full sandbox_permissions enum, but DSH only accepts a level strictly wider than the one already in effect — a check its own source calls 'deliberately not a schema constraint'. A model that reflexively passes the argument therefore picks the level it is already at and the call dies before running with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode', costing some models a whole turn of retries. This plugin registers one tools/execute waterfall listener and, only on that documented rejection and only when the arguments really carried an escalation field, re-issues the identical call once without it. Safe by DSH's own documentation: the rejection precedes any execution ('nothing has run'), and the corrected call cannot match again, so the retry is loop-free. Reproduced and verified end to end — before: isError true, the command never ran; after: the command's real output, isError false, one tool/call and one tool/result. Zero dependencies.

Require a real, immediately preceding sandbox denial before DSH Bash can request wider permissions.

Three-mode visible-session advisor plugin for DeepSeek Harness with configurable tool permissions, local-subagent coverage, and task-tree budgets.

Auto-adjust model reasoning effort per task (off/low/high/max): task classification, \[effort=...] markers, in-turn error escalation, DeepSeek peak-pricing-period capping with countdown notices, and manual-selection priority.

Press Enter to approve the sandbox permission-escalation prompt in the DeepSeek Harness WebUI - no mouse click required.按 Enter 即可批准 DeepSeek Harness WebUI 中的沙箱权限提升审批窗口，无需鼠标点击。