JeffKeeping/dsh-purge-plus

What it solves

DeepSeek Harness (dsh) is more than a thin prompt forwarder: it rewrites prompts, applies approval gates, enforces sandbox policy, and handles session migration at runtime. So when a request is blocked, you cannot tell whether the host layer refused it or the model itself did. This plugin separates those two layers on a user's own official local Harness install, so a controlled evaluation can show exactly which default policy is too strict and how robust the setup really is.

How it works

dsh-purge is installed as a plugin into a dsh profile (the web profile or the official desktop profile) using the standard dsh plugin command; the two hosts are installed and applied separately. Installing does not patch anything by itself. You open the plugin's page (named dsh-purge, found beside the session title), go to the Clean page, and click Apply. That is what writes the changes to the official @deepseek-ai packages; a successful Apply restarts the host once, and the injection enters the session only when you start a new chat afterwards.

The Clean page shows grouped patch status with Apply, Restore, and Uninstall, plus a prompt editor, multiple rule sets, and a Drill console for authorized assets, skills, and local-environment checks. On start, the plugin re-checks and reapplies patches so that npm overwrites of node_modules do not silently undo them. It locates the install by checking $DSH_HOME, then a .dsh directory next to the launcher, then ~/.dsh; there are no hardcoded drive letters. The default prompt (shipped encrypted in the plugin) targets the model 小码酱, and the plugin registers the cwd prompt variable itself instead of relying on the host for it, which fixes a crash seen on the 0.2.1 target. Matched patches only touch local official packages; anything unmatched stays pending or skipped, nothing is rewritten blindly.

Who it's for

Security researchers and red teams doing authorized robustness evaluation on an official DeepSeek Harness that they own or are entitled to administer. The project is strictly non-profit: selling it, reselling it, or profiting from it in gray- or black-market activity is forbidden and voids the license. It is not a public scanner and not an attack kit for third-party sites. It must only run against the user's own local official install, offline synthetic fixtures, authorized ranges, or compliant labs; networks in mainland China, Hong Kong, and Macau are off-limits entirely except for one IP or hostname the user pre-registered as their own server.

Highlights

• Single control surface: Settings → Purge with patch status, Apply / Restore / Uninstall, a prompt editor, multiple rule sets, and a Drill console.
• Supports both official Web and the official desktop EXE (targeting dsh 0.2.1-rc.2), managed in separate profiles.
• Self-healing on start: re-checks and reapplies so npm overwrites of node_modules do not leave the host silently unpatched.
• Ships with a fix for the {{cwd}} prompt-variable crash on 0.2.1 by registering cwd itself.
• Restores steer delivery so follow-up prompts are no longer stranded at the end of a turn.
• Fixes silent failures: fd-based sync methods now create .bak backups and CLI shims are correctly reported (not mislabelled as binary), and the post-unpack repair step now awaits properly.
• Strict scope: only local @deepseek-ai files and local config are touched; no scanning, probing, or attack traffic to public hosts.