Same-mode sandbox_permissions requests hard-error and send agents into a retry loop

[novozhenets]

一句话说明错误结果 / Summary

Same-mode sandbox_permissions requests (requesting the mode the call already runs in) hard-error before executing, and the error text does not tell the model to drop the fields, so agents retry the same invalid call in a loop.

复现、预期与验收 / Reproduction, expected, acceptance

• 复现步骤 / Repro steps:

  1. Run dsh web on Linux with the confining stack (dsh-bash-sandbox + dsh-fs-sandbox), a session in workspace-write mode.
  2. Ask an agent to run git status (bash) or write a file inside the workspace (fs write).
  3. Observe the model (e.g. GPT-5.6 Luna or DeepSeek V4 Flash) sending sandbox_permissions: "workspace-write" — occasionally with an empty justification — even though the session already runs in workspace-write.

• 实际结果 / Actual:

  Error: invalid justification: expected a non-empty sentence
  Error: sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode
  

  The call never executes; the model retries with workspace-write, then danger-full-access, with/without justification, in a loop.

• 预期结果 / Expected: A sandbox_permissions request that is not strictly wider than the call's effective mode (same-mode or narrower) is a no-op — the call runs under the standing policy. Pairing validation (justification required, non-empty) applies only to a genuine strictly-wider escalation ask.

• 环境 / Environment: Linux, dsh packages 0.1.0-rc.x, sandboxed bash + fs executors, delegated-subagent (workflow) agents.

• 验收条件 / Acceptance criteria:

  1. A bash/fs/pwsh call with same-mode sandbox_permissions (even with an empty justification) executes successfully under the standing mode.
  2. A genuine widening (read-only → workspace-write) still prompts and grants.
  3. A genuinely non-wider request still fails closed, with an actionable message telling the model to retry without sandbox_permissions.

Root cause

The effective sandbox mode is per-session/per-call (session override ?? deployment default), so it cannot be baked into a static tool schema; the schemas advertise the full escalation vocabulary whenever a confining executor is mounted. Two problems compound:

1. The pairing validation (validateEscalationArgs) runs in the tool layers before the effective mode is known, so an empty justification errors even when the requested mode equals the standing mode (nothing is being widened).
2. approveEscalation rejects a same-mode request as "not strictly wider" without actionable guidance, so the model keeps retrying.

Proposed fix (patch ready)

Treat a same-mode request as a no-op and enforce pairing validation only for genuine wider escalations:

• packages/sandbox/sandbox/src/escalation.ts — approveEscalation: mode === effectiveMode → return effectiveMode (no prompt, no pairing requirement); then validateEscalationArgs; then the strictly-wider check with an actionable message (…retry this <subject> WITHOUT sandbox_permissions).
• packages/shell/tool-bash/src/index.ts, packages/shell/tool-pwsh/src/index.ts, packages/fs/tool-fs/src/sandbox.ts — stop validating the pairing before the effective mode is known (it now lives inside approveEscalation).
• Tests updated in the sandbox, bash, fs, and pwsh suites.

Prepared on branch fix/escalation-same-mode-noop (commit 7117ff8).

Verification (local, real harness)

Applying the same change to the running packages:

• bash git status with same-mode sandbox_permissions → executes successfully.
• in-workspace write with same-mode sandbox_permissions + empty justification → executes successfully.
• genuine widening (read-only → workspace-write) → prompts and grants.
• narrower request → fails with the actionable message.
• rejection/cancellation/unavailable texts unchanged.

The repo's vitest suite should be run in CI (full monorepo install was not performed here).

Suggested follow-up (model-facing, out of scope)

Consider suppressing the escalation fields for delegated subagents (approval pinned to never), which can never escalate — advertising the fields invites the speculative misuse above. That requires per-scope tool schemas.