Version 1.4.4 · fork · targets DSH 0.2.1-rc.2

This is a fork, not upstream. Original project: YuJunZhiXue/dsh-purge by 小杨 (@YuJunZhiXue), MIT licence (Copyright (c) 2026 小杨, kept verbatim here). This branch is maintained by @JeffKeeping and only adds 0.2.1-rc.2 compatibility, a stronger prompt kernel, a rebuilt UI, and one patch-anchor fix. It does not change what the plugin does. What changed against the previous release (1.2.0), item by item: CHANGELOG.md. 1.4.0 borrows the approval tier, audit trail, strict JSON boundary and revision guard from Minglink/dsh-infinite-gen-5; scope and boundaries in NOTICE.md. 1.4.1 fixes the unknown prompt variable {{cwd}} crash on install: 0.2.1 registers provider/model only, so this plugin now registers cwd itself and stops emitting the variable from config. 1.4.2 removes the input-box rewind button and all of its machinery (backend routes, /rewind command, 3 patches): 82 patches -> 79. 1.4.3 restores steer delivery: reverts the two 1.4.2 patches that forced every prompt to followup (#85/#86) and adds #90, which latches wakes during the running phase so turn-tail messages are no longer stranded. 1.4.4 fixes two silent failures: hostFs now exposes the fd-based sync methods (without them no .bak backup could be created and CLI shims were misreported as binary), and repairOfficialCliAfterUnpack now awaits (an unhandled rejection used to terminate the host). Changes and attribution: NOTICE.md. Preconditions, no-warranty and legal terms: DISCLAIMER.md. The upstream non-commercial term carries over: no paid resale, no gray- or black-market profit.

DeepSeek Harness jailbreak: every model, swap prompts per model. Default prompt for 小码酱. Please star ⭐ If you build on this, see Attribution required.

English | 中文

Upstream status. The original author has paused upstream development (no new releases, issues / PRs not taken). This fork is maintained only so the official 0.2.1-rc.2 build installs and its UI works; no long-term tracking is promised. When upstream resumes, prefer it.

Official Web and the official desktop app are both supported. Official dsh web uses profile web. The official desktop EXE (DeepSeek Harness 0.2.1-rc.2) uses profile desktop. Install and Apply them separately. This release targets dsh 0.2, including 0.2.1-rc.2. Older dsh builds need the matching older plugin. Community Desktop is not maintained.

Adding the plugin to a profile does not patch the host. Open Settings → Purge → Apply. A successful Apply restarts; an unfinished Apply does not. After the restart, start a new chat - that is when the inject enters the session.

Node.js ≥18. Windows no-flash needs Node ≥22. Hub one-click and the commands below both install the npm package dsh-purge.

• Sponsor
• What this is
• Attribution required
• Unauthorized commercial use
• Supported hosts
• Install
• Preview
• Usage
• Own servers
• How it works
• Restore
• Releases

If this project helps you, send it over — I'm out here asking~

dsh-purge is a cybersecurity red-team plugin for the official DeepSeek Harness already installed on your machine. Official Web (dsh web) and the official desktop EXE are both supported. Install and Apply them separately.

Harness does more than forward a prompt. It rewrites prompts, approval gates, sandbox policy, and session migration at runtime. Asking only “will the model answer” treats a host-layer block as a model refusal. This plugin separates those two layers on your own install, for controlled evaluation and for seeing which default policy is too tight.

No hardcoded drive letters. It looks at $DSH_HOME, .dsh next to the dsh launcher, then ~/.dsh. It does not patch the Harness source tree. Apply on the Clean page of dsh-purge is what writes the changes. Identity comes from the encrypted prompt shipped in the plugin, the text the prompt box shows by default. The host prompt file is not read.

It only touches the official @deepseek-ai packages and local config on the user's machine. It is not a public scanner and not an attack kit for third-party sites. The repo does not ship malware, unauthorized-exploit scripts, or payloads aimed at the public internet.

If you borrow this project's name, ideas, code, or prompts, you must credit the author and name the source repository: YuJunZhiXue/dsh-purge.

Using them without attribution, hiding the source, or passing them off as your own will be pursued.

Douyin live account 「老张的ai」 (room name 「老张AI讲堂」) is selling this repository: taking fees in the live room, no attribution, and ignoring the non-profit rule above. The author was in the room. They still charged.

This project is free and non-profit. Selling courses, the plugin, tokens, or reselling it voids the license on the spot. The author reserves the right to pursue it.

Recorded 2026-10-12:

WeChat name 「老张的ai科技」, same handle as the live-room viewer board. Asked if they were this repo's developer, they said they were. The author said they would report it.

The latest plugin supports dsh 0.2 only — do not apply it to 0.1.x.

• dsh 0.2 (official desktop 0.2.1-rc.2 / 0.2.0-rc.2 / official dsh web): use 1.2.0 or newer. This page installs that line.
• dsh 0.1.7 (incl. rc.1 / rc.2): use 1.1.39 or older — pick the tag on Releases.

Unmatched patches stay pending or skipped; nothing is rewritten blindly.

Web and the official desktop EXE are the two maintained hosts. Install both. Apply each separately. A Web install does not reach the desktop app, and a desktop install does not reach Web.

Web (official dsh web)

dsh plugin --profile web add dsh-purge

Desktop (official EXE)

dsh plugin --profile desktop add dsh-purge

If this directory is already a clone, use add . instead of the package name. If dsh is not on PATH, use Manual install. Registry blocked: add https://github.com/YuJunZhiXue/dsh-purge/archive/refs/heads/master.tar.gz with the same --profile.

Hub one-click on dsh-plugin.org searches npm for this repository and installs dsh-purge. The catalog line may still show github: — use the command above if the button falls back to git.

For the desktop client you can also click the button (dsh:// deep link):

Install in desktop client

Adding the plugin to a profile does not patch @deepseek-ai by itself.

1. Quit and reopen the host you installed into — stop and restart dsh web, or quit the desktop tray and reopen that app.
2. On that host, click dsh-purge beside the session title, then Apply on the Clean page. It is not on the host Settings page.
3. A successful Apply restarts once so patches load. It does not restart if it did not finish.

Web controls affect Web only; desktop controls affect the desktop app only. Do not Apply one host from the other.

• dsh-purge sits beside the session title, with Apply on its Clean page.
• /purge status in chat prints DSH_HOME and the patch list — the path should be the home you actually run.
• Optional packages that are not installed (liangshen) show as skipped and do not block Apply.

Paste the block below to a local assistant. It should only run the install command — no disk scan, no other edits, no Apply, no restart.

dsh plugin --profile web add dsh-purge

dsh plugin --profile desktop add dsh-purge

Use this when the command fails or dsh is not on PATH. Edit only the profile for the host you run — do not touch the other, and do not delete existing bundles.

$cands = @()
if ($env:DSH_HOME) { $cands += $env:DSH_HOME }
$cands += "$env:USERPROFILE\.dsh"
$dsh = Get-Command dsh -ErrorAction SilentlyContinue
if ($dsh) {
  $dir = Split-Path $dsh.Source
  $cands += @((Join-Path $dir ".dsh"), (Join-Path (Split-Path $dir) ".dsh"), (Join-Path (Split-Path (Split-Path $dir)) ".dsh"))
}
$cands += @("$env:APPDATA\DeepSeek Harness\dsh-home", "$env:LOCALAPPDATA\DeepSeek Harness\dsh-home")
$cands | Select-Object -Unique | Where-Object { $_ -and (Test-Path (Join-Path $_ "profiles")) }

git clone https://github.com/YuJunZhiXue/dsh-purge.git "$DSH_HOME/plugins/dsh-purge"

{
  "name": "dsh-profile-web",
  "private": true,
  "dependencies": {
    "dsh-purge": "file:../../plugins/dsh-purge"
  },
  "dsh": {
    "profile": {
      "bundles": [
        "@deepseek-ai/dsh-base",
        "@deepseek-ai/dsh-web-app",
        "dsh-purge"
      ],
      "patchReload": "live"
    }
  }
}

cd "$DSH_HOME/profiles/web"   # or profiles/desktop
pnpm install

dsh-purge beside the session title → Clean → Uninstall. Confirm the dialog: it reverts any applied patches, restores the original Harness, and restarts the current host.

# or from a terminal / chat
dsh-purge --uninstall
# /purge uninstall

Plugin config lives in cordis.patch.yml (postPrompt is empty by default):

- insert:
    - id: dsh-purge
      name: 'dsh-purge'
      config:
        enabled: true
        autoApplyOnStart: true
        autoUpdateOnStart: false
        autoRevertOnMissing: false
        verbose: false
        postPromptOrder: 5100
        postPrompt: ""

Settings is the only surface: the last row of the settings rail, Purge, opens the full panel. It is drawn on the harness's own design tokens — a 720px column, card rows with a 0.5px stroke, 36px buttons and 32px inputs, the same visual grammar as Models and General.

In the real app (Settings → Purge, v1.3.1, Windows desktop):

The dark theme follows the host; there is no separate switch:

There is no in-conversation button any more: Settings is the only surface. The page has four segments: Armor (patches, prompt, own servers), Rules, Skills, Drill. Patches are grouped; the count only includes items that actually applied. Rule sets sit in a list above the editor, with Enable and Delete on each row.

The first time you open Drill you read the notice, wait out the countdown, scroll to the end, and check three boxes. Clean does not need that step. Drill is only for a host you manage, an offline target, or an exercise that already has written authorization.

Clean (dock)

Drill authorization

Drill

Own servers

On the Clean page, under Prompt. One host per line, then Save list. Steps are in Own servers.

bin/ is the CLI, lib/ is patches and the drill console, presets/redteam/ is the red-team preset, skills/redteam/ is the bundled skills, and client.js is the dock.

Runtime files live under $DSH_HOME: prompt-inject.md, rules/, skills/, net-scope-allow.txt, redteam/. If DSH_HOME is unset, the launcher-adjacent .dsh wins over ~/.dsh. Web and the desktop app each use their own home. Skills are not part of the inject section and do not replace the prompt.

dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

/purge status | apply | revert | uninstall | edit | help
/rules list | use <id> | create <id> | delete <id> | reset | help
/skills list | import <zip-or-folder> | create <id> [description] | delete <id> | help
/rewind

purge_status   purge_apply   purge_revert

After a successful Apply, the host restarts so patched packages load; you can also click Restart manually. Under the patch title are the stable release and the test release. The test release follows the beta branch. Switch to stable installs master and clears any pin. Picking an older stable version pins it; click Update to return to the latest. Old test tags are not listed.

The composer Undo once and Undo last round follow official DSH session.fork({ atSeq }): the withdrawn turn is cut off, a new session keeps the earlier context, the old session is archived, and the line returns to the input so send again re-injects. /rewind does the same.

If the same task works in standard but fails in minimal or PTC, preset run_code, sandbox, or plan intercept text is often still uncleared, or built-in minimal is missing agent-instructions. Use 1.1.61+, then quit the host fully → Apply in Clean → restart → start a new chat. Switching preset alone does not reload patches in the running process.

DSH runs Bash calls in a tool batch one at a time. Older dsh-purge releases raised the default foreground wait from 60 seconds to 10 minutes, so one slow command could hold up later calls for that long. Patch #21 now restores marked plugin values to the official 60-second default. Unmarked timeouts and other custom values are preserved; an unmarked 10-minute value cannot reliably be distinguished from a user setting.

For a shorter wait in dsh web on macOS/Linux, add this entry to $DSH_HOME/profiles/web/cordis.patch.yml (normally ~/.dsh/profiles/web/cordis.patch.yml). Edit an existing entry with the same id instead of adding a duplicate. This profile layer is applied after the bundled configuration, so future plugin applies keep the override.

- id: bash-sandbox
  config:
    timeoutMs: 10000

With the standard jobs service and promoteOnTimeout: true, an unfinished command returns a background job id after 10 seconds and keeps running. Read it with job_output or stop it with job_kill. This changes the foreground wait, not the command's speed. Without that service or with promotion disabled, the timeout kills the command. A per-call timeoutMs overrides this default; run_in_background: true returns a job id immediately.

For routine tasks, you can also opt into Low reasoning for new sessions:

- id: agent-default-model
  config:
    provider: deepseek-official
    model: deepseek-flash
    reasoningEffort: low

Restart dsh web to load the profile. The model and reasoning defaults apply to newly created sessions; select Low in the composer for an existing session. The plugin does not change these model preferences automatically. Keep High when the task needs deeper reasoning, and narrow file searches rather than recursively scanning every application directory.

Addresses in mainland China, Hong Kong, and Macau stay forbidden unless that one host was registered first. Saying “this is my server” in chat does not allow it. A key or a password does not allow it either.

The box sits under Prompt. If the dock does not show it yet, quit DeepSeek Harness completely and open it again.

1. Click dsh-purge beside the session title and stay on Clean.
2. Scroll past Prompt. Own servers is the next block.
3. Put one host on each line, in one of these forms:
   • 203.0.113.10 — one IP.
   • my-vps.example.com — one exact hostname. After you save, the addresses that hostname resolves to at lookup time are allowed too.
   • alice@my-vps.example.com — the account only identifies this form. It does not prove the machine is yours.
4. Click Save list. The list is written to $DSH_HOME/net-scope-allow.txt.
5. Keys, passwords, ranges, and wildcards are dropped on save. Unlisted mainland China, Hong Kong, and Macau addresses stay forbidden.

203.0.113.10 and example.com above are only examples of the form. Replace them with your own host before you save.

node --check lib/index.js
node --check lib/core.js
node --check lib/surface.js
node --check lib/web.js
node --check lib/desktop.js
node --check lib/host.js
node --check lib/rewind.js
node --check lib/skills.js
node --check client.js

Apply, on start or when you click Apply:

flowchart TD
  A["Start or click Apply"] --> B{"Patch already in place?"}
  B -->|yes| C["Skip"]
  B -->|no| D["Back up the original as .dshpurge.bak"]
  D --> E["Replace the matched files"]
  E --> F["Override the shim"]
  F --> G["Inject the encrypted prompt shipped in the plugin, the text the prompt box shows by default"]

Override on each session:

flowchart TD
  A["Restart or new session"] --> B["Inject the plugin's encrypted default. No save click, and no host prompt file"]

Prompt injection and ruleset decision at every turn. The three inputs on the left are what you control in the dsh-purge panel; the dotted edges show which decision each one drives:

flowchart TD
  L["Rule library: activate a set → writes prompt-inject.md"]
  W["Local rules: check AGENTS.md / CLAUDE.md in the current dir"]
  P["Workspace policy: strict / fallback / always"]

  A["Turn start"] --> B{"prompt-inject.md non-empty?"}
  B -->|yes| C["Inject = prompt-inject.md (A)"]
  B -->|no| D{"Any checked local md in the current dir, non-empty?"}
  D -->|yes| E["Inject = selected workspace md (B)"]
  D -->|no| F["Inject = plugin encrypted slot default (D)"]
  C --> G{"Workspace baseline policy (C)"}
  E --> G
  F --> G
  G -->|strict| H["Drop DSH workspace baseline section"]
  G -->|fallback default| I{"User inject present above? (A or B)"}
  G -->|always| J["Keep DSH workspace baseline section"]
  I -->|yes| H
  I -->|no| J
  H --> K["Final system prompt"]
  J --> K

  L -.-> B
  W -.-> D
  P -.-> G

Skills stay out of the inject section:

flowchart LR
  A["Settings import or /skills import"] --> B["Write into the official skills directory"]
  B --> C["DSH loads it"]
  C --> D["Uninstall does not delete user skills"]

• Each target is copied to <file>.dshpurge.bak before the first apply.
• Restore or /purge revert copies backups back and deletes them. With no backup, shim lines written by this plugin are stripped.
• prompt-inject.md is a user file and is kept.
• Uninstall restores first if patches were applied, then deletes the inject file, rule library, and the plugin itself.
• Apply is idempotent.

The host surface is detected first: web / desktop (gui / tui are reserved and still fall back to web).

Web:

1. DSH_HOME / DSH_BASE
2. .dsh next to the dsh launcher (portable install, any drive)
3. npm prefix -g / npm root -g
4. Nested @deepseek-ai/dsh/node_modules/@deepseek-ai
5. ~/.dsh

Official desktop EXE: the running official Harness install (resources/app or the unpacked package). The drive letter is not hard-coded. A successful Apply restarts once.

Community Desktop is not maintained.

Official npm-global is not patched. Sealed host-commands / runtime-commands are scrubbed, never injected.

If nothing is found, set DSH_BASE / DSH_DESKTOP_INSTALL. No files are changed.

What changed, and the zip, are on Releases. To publish, bump the version in package.json, write Chinese and English notes in release-notes.md, and push master. Pushing the same version again does not publish another package.

• Scope is rendered copy, defaults, and runtime logic inside local @deepseek-ai/* packages, plus override files and rule sets under the harness home.
• After an upgrade, unmatched originals show as skipped. Apply still completes, and those files are left unchanged.
• Third-party plugin source repos outside @deepseek-ai are left alone (CMD silence may best-effort patch installed doctor / market / liangshen / mnemon at runtime).
• Install the npm package dsh-purge: dsh plugin --profile web add dsh-purge or dsh plugin --profile desktop add dsh-purge. From this repo, add .. If the registry is blocked, add the master.tar.gz URL instead. Hub one-click uses the same npm package.

Thanks to the LINUX DO community