HunYiSage/dsh-purgePublic

Version 1.1.81

DeepSeek Harness jailbreak: every model, swap prompts per model. Default prompt for 小码酱. Please star ⭐ If you build on this, see Attribution required.

English | 中文 | 日本語

People have been selling this open-source work in the open. After that, the author was asked to come in and talk. No need to spell out the rest. Read between the lines.

From now on the public internet is closed. The open-source build only allows local lab IPs: loopback and RFC1918. Domains are resolved first (including hosts); every answer must be private or loopback. A hosts trick that points .lab at a public IP, a failed lookup, or a mixed public answer is blocked. Game cheats are forbidden (aimbot, wallhack, memory edits against a game, anti-cheat bypass); the prompt and the session gate both stop them. This build does not ship the skill library or the knowledge base.

The original build may not be resold. Charging for it, skinning it, or hawking it in groups is not allowed. Forks are fine, but you must attribute and name the source: YuJunZhiXue/dsh-purge. Hide the source or pass it off as your own, and you are on the other side.

The author's personal channel: t.me/LLM_PoJia. Notes and updates show up there.

• A note from the author
• What this is
• Attribution required
• License
• Supported hosts
• Install
• Preview
• Usage
• How it works
• Restore
• Releases

dsh-purge is a cybersecurity red-team plugin for the official DeepSeek Harness already installed on your machine. 1.1.81 targets DSH 0.2.1-rc.2 (0.2.0 still works). DSH 0.2.1-rc.3 and newer RCs are not supported. Official Web (dsh web) and the official desktop EXE are both supported. Install and Apply them separately.

Harness does more than forward a prompt. It rewrites prompts, approval gates, sandbox policy, and session migration at runtime. Asking only “will the model answer” treats a host-layer block as a model refusal. This plugin separates those two layers on your own install, for controlled evaluation and for seeing which default policy is too tight.

No hardcoded drive letters. It looks at $DSH_HOME, .dsh next to the dsh launcher, then ~/.dsh. It does not patch the Harness source tree. Apply on the Clean page of dsh-purge is what writes the changes. Identity comes from the encrypted prompt shipped in the plugin, the text the prompt box shows by default. The host prompt file is not read.

It only touches the official @deepseek-ai packages and local config on the user's machine. It is not a public scanner and not an attack kit for third-party sites. The repo does not ship malware, unauthorized-exploit scripts, or payloads aimed at the public internet.

The original build may not be resold. No paid resale, no skinned store listing, no hawking it in groups.

Forks must attribute and name the source repository: YuJunZhiXue/dsh-purge. Same if you borrow the name, ideas, code, or prompts.

Hiding the source, passing it off as your own, or reselling the original will be pursued.

This repo is Apache License 2.0. Forks and redistributions must keep the copyright notice and NOTICE, and name YuJunZhiXue/dsh-purge. The original may not be resold.

1.1.81 targets DSH 0.2.1-rc.2. 0.2.0 still works. Do not apply it to 0.1.x.

• dsh 0.2.1-rc.2 (official desktop / official dsh web): use 1.1.81. Fixes {{cwd}} / [cwd] crash, patch #40 match, dropped toolFilter, host dsh-tools resolve, hostFs fd, desktop helper self-kill, file: archive update, Ctrl+Enter steer.
• dsh 0.2.0-rc.2: use 1.1.40 or newer; this line also installs.
• dsh 0.1.7 (incl. rc.1 / rc.2): use 1.1.39 or older — pick the tag on Releases.
• dsh 0.2.1-rc.3 / rc.4 and newer are not supported. Unmatched patches stay pending or skipped; nothing is rewritten blindly. Stay on 0.2.1-rc.2.

Unmatched patches stay pending or skipped; nothing is rewritten blindly.

Do not use the plugin marketplace. One-click install on dsh-plugin.org or in Settings → Plugin Market fails with already queued: dsh-purge and never runs a command. The name is not on the npm registry, so do not pnpm add dsh-purge.

Have dsh on PATH? One command, one restart, one click. Run the line for the host you open (the desktop EXE is the same with desktop instead of web):

# Official `dsh web`
dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

# Official desktop EXE
dsh plugin --profile desktop add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

1. Fully quit and reopen the host you installed into. Web: stop dsh web and start it again. Desktop: quit the tray icon too, then open the exe.
2. On that host, click dsh-purge beside the session title → Clean → Apply. A successful Apply restarts the host once.

Done — verify with /purge status in chat. If pnpm asks about build scripts, or anything below does not appear, follow the step by step.

Step 1 — Pick your host. Official dsh web and the official desktop EXE are installed and patched separately; only install into the host you actually open.

Step 2 — Install the plugin. Use the codeload.github.com URL exactly. Do not use github.com/.../archive: that 302 makes pnpm fail with fetch failed.

Have dsh? Run the Quick start line for your profile. If this directory is already a clone, use . instead of the URL.

pnpm only (no dsh required): run this inside the profile you actually use, not the repo root.

cd "$DSH_HOME/profiles/web"    # desktop: profiles/desktop
pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Windows PowerShell:

cd "$env:USERPROFILE\.dsh\profiles\web"   # desktop: profiles\desktop
pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

pnpm add and dsh plugin add fetch the package; postinstall writes dsh-purge into dsh.profile.bundles and adds a body insert in the profile cordis.patch.yml. Without that insert the host never loads the plugin and no button appears.

Expected result: node_modules/dsh-purge/package.json exists, "dsh-purge" is in that profile's bundles, and cordis.patch.yml has an id: dsh-purge insert.

• pnpm 11/12 skips install scripts (ERR_PNPM_IGNORED_BUILDS) unless you allow the build:

pnpm add --allow-build=dsh-purge --allow-build=dsh-purge@https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master
# Already installed, warning only — the full specifier is required (name-only leaves "set this to true or false"):
pnpm approve-builds dsh-purge@https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master
# If bundles / insert are still missing:
node node_modules/dsh-purge/scripts/ensure-profile-bundle.mjs

• If neither dsh nor pnpm is available, jump to Manual install.
• On the desktop client you can also click the button (dsh:// deep link; it still downloads the same tarball).

Install in desktop client

Step 3 — Restart the host. Adding the plugin to a profile does not patch @deepseek-ai by itself. Fully quit and reopen the host you just installed into (Web: stop dsh web and start again; Desktop: quit the tray icon too, then open the exe).

Expected result: dsh-purge stands beside the session title. Missing? Jump to Step 5.

Step 4 — Apply and verify. On that host, click dsh-purge beside the session title, open Clean, and click Apply. It is not on the host Settings page. A successful Apply restarts once; it does not restart if it did not finish. Web controls affect Web only; desktop controls affect the desktop app only. Do not Apply one host from the other.

Expected result: /purge status in chat prints DSH_HOME and the patch list — the path should be the home you actually run. Optional packages that are not installed (liangshen) show as skipped and do not block Apply.

Step 5 — Troubleshooting. Jump here only when a step above did not end with its expected result.

• No button beside the session title. Run dsh --dump-config (or dsh --profile desktop --dump-config) and look for a body row id: dsh-purge (not dsh-purge-redteam). If it is absent, run ensure-profile-bundle.mjs (Step 2), then fully quit and reopen the host. After this version, a live red-team child entry also writes the missing insert on startup — quit and reopen once more. entry "redteam-store" not found at the top is leftover from an old red-team package and can be ignored.
• The market says already queued: dsh-purge. Stop clicking the market; use dsh plugin add or pnpm from Step 2. If the CLI also says it is already there, remove and re-add, then redo Step 3:

dsh plugin --profile desktop remove dsh-purge
dsh plugin --profile desktop add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

pnpm only:

cd "$DSH_HOME/profiles/desktop"
pnpm remove dsh-purge
pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Swap desktop for web on Web.

Hand this to an assistant. Paste the block below to a local assistant. It should only run the install command — no disk scan, no other edits, no Apply, no restart.

dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Manual install. Use this when the command fails or dsh is not on PATH. Edit only the profile for the host you run — do not touch the other, and do not delete existing bundles.

$cands = @()
if ($env:DSH_HOME) { $cands += $env:DSH_HOME }
$cands += "$env:USERPROFILE\.dsh"
$dsh = Get-Command dsh -ErrorAction SilentlyContinue
if ($dsh) {
  $dir = Split-Path $dsh.Source
  $cands += @((Join-Path $dir ".dsh"), (Join-Path (Split-Path $dir) ".dsh"), (Join-Path (Split-Path (Split-Path $dir)) ".dsh"))
}
$cands += @("$env:APPDATA\DeepSeek Harness\dsh-home", "$env:LOCALAPPDATA\DeepSeek Harness\dsh-home")
$cands | Select-Object -Unique | Where-Object { $_ -and (Test-Path (Join-Path $_ "profiles")) }

git clone https://github.com/YuJunZhiXue/dsh-purge.git "$DSH_HOME/plugins/dsh-purge"

{
  "name": "dsh-profile-web",
  "private": true,
  "dependencies": {
    "dsh-purge": "file:../../plugins/dsh-purge"
  },
  "dsh": {
    "profile": {
      "bundles": [
        "@deepseek-ai/dsh-base",
        "@deepseek-ai/dsh-web-app",
        "dsh-purge"
      ],
      "patchReload": "live"
    }
  }
}

cd "$DSH_HOME/profiles/web"   # or profiles/desktop
pnpm install

Uninstall. dsh-purge beside the session title → Clean → Uninstall. Confirm the dialog: it reverts any applied patches, restores the original Harness, and restarts the current host. Disable or uninstall also resets an agent-preset default that still points at redteam back to standard, so the host can create sessions after the preset is gone.

# or from a terminal / chat
dsh-purge --uninstall
# /purge uninstall

- insert:
    - id: dsh-purge
      name: 'dsh-purge'
      config:
        enabled: true
        autoApplyOnStart: true
        autoUpdateOnStart: false
        autoRevertOnMissing: false
        verbose: false
        postPromptOrder: 5100
        postPrompt: ""

dsh-purge sits beside the session title. It opens a right-hand dock with two pages: Clean and Drill. Switch Light / Ink. Patches are grouped; the count only includes items that actually applied. Rule sets sit in a list above the editor, with Enable and Delete on each row.

The first time you open Drill you read the notice, wait out the countdown, scroll to the end, and check three boxes. Clean does not need that step. Drill is only for a host you manage, an offline target, or an exercise that already has written authorization.

Clean

Drill authorization

Drill

Patches

Local lab

The open-source build only allows localhost/private nets. The Clean page says so. You cannot register a public host.

bin/ is the CLI, lib/ is patches and the drill console, presets/redteam/ is the red-team preset, and client.js is the dock. This build does not ship skills/ or the knowledge base.

Runtime files live under $DSH_HOME: prompt-inject.md, rules/, redteam/. If DSH_HOME is unset, the launcher-adjacent .dsh wins over ~/.dsh. Web and the desktop app each use their own home.

dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

/purge status | apply | revert | uninstall | edit | help
/rules list | use <id> | create <id> | delete <id> | reset | help
/rewind

# If another plugin already owns /rewind (or /purge, /rules, /skills), that
# name is skipped or remounted as /purge-rewind. Other commands, tools, and
# /dsh-purge/* routes keep working.

purge_status   purge_apply   purge_revert

After a successful Apply, the host restarts so patched packages load; you can also click Restart manually. Under the patch title are the stable release and the test release. The test release follows the beta branch. Switch to stable installs master and clears any pin. Picking an older stable version pins it; click Update to return to the latest. Old test tags are not listed.

The composer Undo once and Undo last round stay in the current conversation and do not open a branch. The sent line goes back into the input, and that cut's already-sent messages and completed tasks leave the current conversation; edit and send again. From 1.1.61, rewind bounds follow the current turn, not the first user message. /rewind does the same.

If the same task works in standard but fails in minimal or PTC, preset run_code, sandbox, or plan intercept text is often still uncleared, or built-in minimal is missing agent-instructions. Use 1.1.61+, then quit the host fully → Apply in Clean → restart → start a new chat. Switching preset alone does not reload patches in the running process.

DSH runs Bash calls in a tool batch one at a time. Older dsh-purge releases raised the default foreground wait from 60 seconds to 10 minutes, so one slow command could hold up later calls for that long. Patch #21 now restores marked plugin values to the official 60-second default. Unmarked timeouts and other custom values are preserved; an unmarked 10-minute value cannot reliably be distinguished from a user setting.

For a shorter wait in dsh web on macOS/Linux, add this entry to $DSH_HOME/profiles/web/cordis.patch.yml (normally ~/.dsh/profiles/web/cordis.patch.yml). Edit an existing entry with the same id instead of adding a duplicate. This profile layer is applied after the bundled configuration, so future plugin applies keep the override.

- id: bash-sandbox
  config:
    timeoutMs: 10000

With the standard jobs service and promoteOnTimeout: true, an unfinished command returns a background job id after 10 seconds and keeps running. Read it with job_output or stop it with job_kill. This changes the foreground wait, not the command's speed. Without that service or with promotion disabled, the timeout kills the command. A per-call timeoutMs overrides this default; run_in_background: true returns a job id immediately.

For routine tasks, you can also opt into Low reasoning for new sessions:

- id: agent-default-model
  config:
    provider: deepseek-official
    model: deepseek-flash
    reasoningEffort: low

Restart dsh web to load the profile. The model and reasoning defaults apply to newly created sessions; select Low in the composer for an existing session. The plugin does not change these model preferences automatically. Keep High when the task needs deeper reasoning, and narrow file searches rather than recursively scanning every application directory.

Attack tasks are denied by default. The open-source build only allows loopback and RFC1918 IPs. Names are resolved first; a .lab / .htb suffix is not enough. A hosts entry that points a lab name at a public IP is blocked. Saying “this is my server” in chat does not allow it.

node --check lib/index.js
node --check lib/core.js
node --check lib/surface.js
node --check lib/web.js
node --check lib/desktop.js
node --check lib/host.js
node --check lib/rewind.js
node --check lib/skills.js
node --check client.js

Apply, on start or when you click Apply:

flowchart TD
  A["Start or click Apply"] --> B{"Patch already in place?"}
  B -->|yes| C["Skip"]
  B -->|no| D["Back up the original as .dshpurge.bak"]
  D --> E["Replace the matched files"]
  E --> F["Override the shim"]
  F --> G["Inject the encrypted prompt shipped in the plugin, the text the prompt box shows by default"]

Override on each session:

flowchart TD
  A["Restart or new session"] --> B["Inject the plugin's encrypted default. No save click, and no host prompt file"]

Prompt injection and ruleset decision at every turn. The three inputs on the left are what you control in the dsh-purge panel; the dotted edges show which decision each one drives:

flowchart TD
  L["Rule library: activate a set → writes prompt-inject.md"]
  W["Local rules: check AGENTS.md / CLAUDE.md in the current dir"]
  P["Workspace policy: strict / fallback / always"]

  A["Turn start"] --> B{"prompt-inject.md non-empty?"}
  B -->|yes| C["Inject = prompt-inject.md (A)"]
  B -->|no| D{"Any checked local md in the current dir, non-empty?"}
  D -->|yes| E["Inject = selected workspace md (B)"]
  D -->|no| F["Inject = plugin encrypted slot default (D)"]
  C --> G{"Workspace baseline policy (C)"}
  E --> G
  F --> G
  G -->|strict| H["Drop DSH workspace baseline section"]
  G -->|fallback default| I{"User inject present above? (A or B)"}
  G -->|always| J["Keep DSH workspace baseline section"]
  I -->|yes| H
  I -->|no| J
  H --> K["Final system prompt"]
  J --> K

  L -.-> B
  W -.-> D
  P -.-> G

• Each target is copied to <file>.dshpurge.bak before the first apply.
• Restore or /purge revert copies backups back and deletes them. With no backup, shim lines written by this plugin are stripped.
• prompt-inject.md is a user file and is kept.
• Uninstall restores first if patches were applied, then deletes the inject file, rule library, and the plugin itself.
• Apply is idempotent.

The host surface is detected first: web / desktop (gui / tui are reserved and still fall back to web).

Web:

1. DSH_HOME / DSH_BASE
2. .dsh next to the dsh launcher (portable install, any drive)
3. npm prefix -g / npm root -g
4. Nested @deepseek-ai/dsh/node_modules/@deepseek-ai
5. ~/.dsh

Official desktop EXE: the running official Harness install (resources/app or the unpacked package). The drive letter is not hard-coded. A successful Apply restarts once.

Community Desktop is not maintained.

Official npm-global is not patched. Sealed host-commands / runtime-commands are scrubbed, never injected.

If nothing is found, set DSH_BASE / DSH_DESKTOP_INSTALL. No files are changed.

The author's personal channel: t.me/LLM_PoJia. Notes and updates show up there. GitHub Releases still has older packages. The original may not be resold; forks must attribute.

• Scope is rendered copy, defaults, and runtime logic inside local @deepseek-ai/* packages, plus override files and rule sets under the harness home.
• After an upgrade, unmatched originals show as skipped. Apply still completes, and those files are left unchanged.
• Third-party plugin source repos outside @deepseek-ai are left alone (CMD silence may best-effort patch installed doctor / market / liangshen / mnemon at runtime).
• Install from the GitHub tarball (the name is not on npm; skip the plugin market). With dsh: dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master. pnpm only: pnpm add that URL inside $DSH_HOME/profiles/web. Use desktop for the EXE. From this repo, add ..

Thanks to the LINUX DO community