dsh-model-compat-guard

DSH compatibility guard: repairs compaction limits, fail-safe sandbox escalation, and missing tool descriptions for third-party models; capability lookups are cached and the deprecated prompt-injection path is off by default.