Non-widening sandbox escalation fails closed when the session is already danger-full-access

[chenls20]

dsh-non-widening-escalation-fix.patch

Summary

In any session whose effective policy is danger-full-access (the most common harness deployment), a model that mechanically attaches sandbox_permissions: "workspace-write" — or any non-widening mode — receives a sandbox escalation to "<mode>" is not strictly wider than this call's current "<effective>" mode throw instead of running the command. The model then retries without the field, the retry succeeds, and every such session pays a wasted round trip + a red tool card for a behavior that harmed no one.

The tool schema's sandbox_permissions enum is registry-global, while the effective mode is per-call truth. Under a danger-full-access default the enum still offers workspace-write and danger-full-access, and the description still coaches escalation as the recovery path. A model that learned the recovery habit in a confined session will reproduce it in a danger-full-access one and trigger this fail-closed path constantly.

Reproduction

1. Run dsh web with default sandbox policy danger-full-access (the project default).
2. Trigger any ordinary bash call.
3. Have the model attach sandbox_permissions: "workspace-write" plus a justification. (This is what current models naturally do when following the tool's own coaching: "retry the exact call with the narrowest wider mode that suffices.")

Without any model cooperation, simulate it against packages/sandbox/sandbox/src/escalation.ts:

const result = await approveEscalation(
  { requestedMode: 'workspace-write', effectiveMode: 'danger-full-access', justification: '...', subject: {} },
  { approver: async () => ({ outcome: 'granted-once' }) },
)

Current behavior

approveEscalation throws sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode. The tool registry turns the throw into isError, no command runs, and the model pays a retry round trip on every subsequent call. Across a long-running agent loop this becomes "the harness is broken in a way that's invisible to most users but constant for anyone who uses the default policy".

Expected behavior

A target that is equal to or narrower than the call's effective mode resolves to that effective mode itself — a no-op grant that runs without prompting a human and without recording an approval event. Strict-widening remains the safety boundary for asks that genuinely widen; a forged or bogus sandbox/mode override cannot leverage the change because the ladder still gates what can widen.

Proposed fix

A 4-line change in packages/sandbox/sandbox/src/escalation.ts plus paired test + docs updates across packages/sandbox/sandbox/, packages/shell/tool-bash/, and packages/shell/tool-pwsh/. Test coverage moves from the stale fail-closed error text to a pinned "no-op grant + never asks" invariant for all three packages. 157 unit tests pass.

The exhaustive alternatives considered and rejected are documented in the accompanying Agent Note .agents/notes/implemented/bug-fix/2026-09-07-non-widening-escalation-noop.md:

• Harder prompt steering only is rejected because schemas are registry-global — the enum cannot shrink per session.
• Silently stripping the fields before the escalation path is rejected — decisions belong in approveEscalation, not in argument validation (hidden ?? default inside run()).
• Warn-but-run (grant the no-op but append a model-facing correction marker) is rejected as added model-visible surface for a condition that is already harmless.

Patch

📎 See the attached dsh-non-widening-escalation-fix.patch file (47.5 KB, git format-patch -1 HEAD). Apply with git am < dsh-non-widening-escalation-fix.patch.

Patch includes:

• packages/sandbox/sandbox/src/escalation.ts: replace the throw with return effectiveMode
• packages/sandbox/sandbox/tests/escalation.spec.ts: pin the no-op grant + never-ask invariant
• packages/shell/tool-bash/tests/tools.spec.ts and packages/shell/tool-pwsh/tests/tools.spec.ts: same-pin for the bash/pwsh tool surfaces
• README, i18n, and feature-note files updated in both English and Chinese (per repo's bilingual README convention)

Environment

• dsh 0.1.5-alpha.1 (5dda764ed3)
• Any OS, Node ≥ 22
• Default sandbox executor with default policy danger-full-access

Impact

Costs every danger-full-access deployment one wasted model round trip per escalation-shaped call. Multiplied across every such session — the exact composition where the error is guaranteed to keep firing — this reads as "the harness is broken on every new session" and trains users to distrust sandbox messaging entirely.

I'm carrying the patch locally (commit da07fe834c) and posting here since I noticed external PRs aren't being accepted right now. Happy to refine the approach or test any alternate fix the team prefers.