Removes redundant sandbox arguments from GPT-family tool calls when they do not exceed the session policy.
For GPT-family tool calls, this plugin removes sandbox_permissions and justification before tool execution when the requested access does not exceed the current session policy. Requests for wider access remain with the DSH host; unmatched models are not changed.
Requires Node.js 22 or later and the DSH tools service. GPT, o1, o3 and o4 models are recognized by default. Configure includeOpenAiReasoning, extraModelPatterns, injectPrompt and logStrips to adjust matching, prompts and logging.
The plugin wraps tool execution. Its session prompt has loaded on the current desktop host, but tool wrapping and complete escalation behavior have not been independently verified on other hosts. It is not a replacement for host authorization or security boundaries.