dsh-plugin-sandbox-escalation-fix
Normalize redundant sandbox requests and malformed justifications in DeepSeek Harness tools
43 results
Normalize redundant sandbox requests and malformed justifications in DeepSeek Harness tools
Security scanner for DSH plugins: static and semantic passes over plugin source, DSH-specific attack-surface rules, npm audit, batch scanning, and an HTML report with per-finding severity and evidence.
CC-style auto mode for DeepSeek Harness: deterministic deny/allow rules + pre-execute gate + model-agnostic two-stage classifier. Two-state (allow/reject) classifier since 0.8.0. TypeScript rewrite merging dsh-auto-mode v0.4.1 with Nuo-cl/dsh-auto-mode native integration.
AI approval answerer using the unified ctx.llm route with fail-closed local policy checks
DSH compatibility plugin that treats redundant non-escalating sandbox permission fields as a no-op
OMV Audit Desk: an evidence-first vulnerability audit workbench for DeepSeek Harness
Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval subagent judges every sandbox escalation (risky operations are rejected), with a configurable approval model and a per-session audit trail in the conversation window's 审批 tab.
Local prompt-injection and secret-exfiltration firewall for DeepSeek Harness
Model-facing typed tools wrapping the frozen, reviewed underseal adapter for the DeepSeek Harness
Retrieved ≠ injected: CBDC-gated memory for DeepSeek Harness — decides how memory is USED (use/verify/ignore decisions, feedback learning, full audit); local SQLite + FTS5, bounded, no extra model call
QuickJS/WASM-isolated WorkflowEngine for running model-written DeepSeek Harness orchestration with bounded resource controls.
Register models, assist with portraits, and select the Agent model from a secret-free catalog for DeepSeek Harness.
DeepSeek Harness plugin (temporary, pre-upstream-fix): automatically injects a CPython tempfile shim (PYTHONPATH -> sitecustomize) into every confined shell command on the Windows sandbox, so python/pytest tempfile use works with zero extra tools, zero model-context overhead, and zero escalation.
DSH Web GUI plugin: session-scoped "Allow for this session" option in the approval dialog (per-mode standing grants, localStorage)
Localize leftover DSH UI chrome to Chinese (command palette descriptions, permission presets, reasoning effort) at the display layer, and detect when the official build adapts them
Deterministic DeepSeek Harness Web client plugin that explains the Windows-sandbox `spawn EPERM` failure as a distinct Conversation Node.
Dependency-installation guard for DeepSeek Harness: classifies package-manager commands as ALLOW, ASK, or BLOCK before execution.
NeevSandbox execution providers for DeepSeek Harness
LLM pre-review for sandbox-escalation approvals: an independent-context LLM gate answers sandbox escalation requests before they reach the user, falling back to the user on any failure.
A fail-closed, auditable approval policy plugin for DeepSeek Harness
Fail-closed DSH compatibility guard for redundant GPT/Codex sandbox escalation arguments
Strip sandbox_permissions / justification from model tool-call arguments so sandbox escalation is never triggered when the session already has sufficient permission.
Seatbelt (libsandbox) sandbox provider for the DeepSeek Harness sandbox seam on macOS: a cordis plugin that replaces @deepseek-ai/dsh-sandbox-local's seatbelt rung via a prebuilt seatbelt-run launcher — no dsh source changes, no PR required
DSH web plugin: play a notification chime when the agent asks the user a question (ask_user_question / plan review) or requests approval (sandbox escalation, tool approval).