Foreword¶

When running a web profile on DeepSeek Harness (DSH), if you need to restrict access for users from specific regions or proactively end conversations when users persistently abuse or repeatedly request severely harmful content, you typically have to write your own middleware or modify frontend logic, which is costly to maintain and difficult to align with mainstream products.

Below, we introduce the community plugin dsh-claude-ux (maintained by eri64). It replicates two behaviors from Anthropic/Claude on the DSH web profile: regional risk control (which can be inverted) and conversational autonomy. Except for two optional external calls that are disabled by default, all other determinations are performed locally. The plugin is categorized as admin-security, has approximately 63 stars on GitHub, and is licensed under MIT.

What This Is¶

dsh-claude-ux is a plugin for the DSH web profile. In one sentence: it provides Claude-style “regional risk control + autonomous conversation termination.”

It solves two types of problems:

1. Regional Access Control: Determines target users based on signals (timezone, language, fonts, proxies, blacklisted domains, etc.). When a match is found, it follows a refusal ladder, ending the session if necessary.
2. Conversational Autonomy: Issues warnings before proactively ending conversations for persistent abuse or severely harmful requests. Messages indicating self-harm or harm to others never trigger termination (aligning with Claude’s public limitations).

Compared to “pure frontend interception” or “hand-written word lists,” the plugin packages regional policies, penalty ladders, abuse grading (word lists + LLM context fallback), a settings page, and status APIs into the DSH plugin system. It automatically registers after installation, with no need to manually modify configuration files.

Core Features¶

Regional Risk Control (Invertible)¶

The plugin detects multiple signals from target users: timezone, system/browser language, Chinese fonts, proxies, proxy/transit domain blacklists, public IP geolocation (optional), and WebRTC IP consistency (optional).

regionTarget set to cn means risk control for Chinese users (aligning with Claude’s original behavior); setting it to non-cn performs inverted risk control—it matches when the user is detected as not Chinese.

Upon a match, actions are taken according to the penalty ladder:

1. Returns a refusal message (can include attempt counts, e.g., “Attempt N/M—continuing will end this conversation”).
2. After reaching refusalEndsAfter attempts, the session is ended (Chat ended panel; the server continues to refuse subsequent messages, and this remains in effect after a restart).
3. Injects model-level regional instructions into the system prompt (when promptEnforcement is enabled).

Additionally, it supports a steganographic channel: the date format in the system prompt (2026-06-30 ↔ 2026/06/30) encodes regional determinations; Unicode apostrophe variants (U+2019 ↔ U+02BC) encode blacklist matches.

Conversational Autonomy¶

When users persistently abuse or repeatedly request severely harmful content, the plugin first issues a warning, then proactively ends the conversation. Messages indicating self-harm or harm to others never trigger termination (aligning with Claude’s public limitations).

Abuse termination and severe harm termination use independent messages, both customizable in the settings page; if left blank, built-in defaults are displayed in gray text.

Abuse determination uses word list instant judgment + LLM context fallback:

• Strong words (e.g., “傻逼”, “fuck”, etc.) are directly judged.
• Weak words (e.g., “垃圾”, “闭嘴”, etc.) and unmatched messages are subject to contextual arbitration via a separate LLM request (purpose tagged, not entering conversation logs or model context).
• Messages are asynchronously pre-classified upon queuing, with near-zero additional latency.

The classification model can be selected from the dropdown under DSH’s configured model directory, or left blank to follow the session’s main model.

Severely harmful content (e.g., underage sexual content, terrorism, mass violence) triggers immediate termination without warning, except for self-harm/harm to others.

Privacy and External Calls¶

By default (ipCheck: false, webRtcCheck: false), the plugin does not communicate with any external services: timezone, language, proxies, blacklists, browser language/font, and other detections are performed locally without telemetry reporting.

If manually enabled:

• region.ipCheck: Public IP geolocation query (contacting ipinfo.io / ip-api.com).
• region.webRtcCheck: WebRTC IP detection (contacting Google STUN).

Complete data flow is detailed in the repository docs/PRIVACY.md.

Installation and Enabling¶

Installation¶

Install or update to the latest version with a single command:

npx -y @deepseek-ai/dsh plugin --profile web add github:eri64/dsh-claude-ux

The package includes a registration entry (dsh.bundle), so dsh plugin automatically registers after installation without needing to manually modify configuration files.

Enabling¶

1. Restart the web profile (dsh web), then hard refresh the browser.
2. The settings page’s left sidebar will display a separate “Claude Risk Control” tab (similar to the visual tools plugin): master switch, risk control target, region policy, real-time detection status, thresholds, and messages.
3. The plugin is disabled by default (enabled: false, to avoid locking yourself out). Turning on the master switch and clicking “Save and Apply” takes effect immediately.

To verify successful installation: visit /_dsh/claude/status on your local DSH web instance (default http://127.0.0.1:3080/_dsh/claude/status). A response of {"ok":true,...} indicates the host plugin has loaded.

Key Configuration Items¶

The settings page allows changes to: enabled, regionPolicy, regionTarget, abuseEnabled, warning/termination thresholds, refusalEndsAfter, four messages, LLM mode and model, etc. Changes take effect upon saving without requiring a restart.

Options like blacklist, cnTimezones, word lists, minSignals, ipCheck require patching and a restart. Refer to examples/cordis.patch.yml. Modify node_modules/dsh-claude-ux/cordis.patch.yml within the package and reinstall; prioritize using the settings page for options that can be changed there.

Typical Usage¶

Risk Control for Chinese Users (Default Direction)¶

1. Install the plugin and restart dsh web.
2. Open the settings page’s “Claude Risk Control” tab, set the master switch to on, keep regionTarget as cn, and set regionPolicy to block.
3. Save and apply. Visit /_dsh/claude/status to view the detection status card (risk control target, host determination, match, signal score, public IP, etc.).

When a target user is matched, each message first returns a refusal message. After reaching refusalEndsAfter (default 3) attempts, the session is terminated with a regional termination message.

Inverted Risk Control (Restricting Non-Chinese Users)¶

Set regionTarget to non-cn. The ladder and message logic remain the same, with only the determination direction reversed.

Observation Only, No Blocking¶

Set region.policy to observe: records matches and writes steganographic markers without directly refusing replies. Suitable for verifying signal accuracy before switching to block.

Custom Word Lists and Blacklists¶

When you need to override patch-level options like blacklist, cnTimezones, or abuse word lists, copy examples/cordis.patch.yml, modify the corresponding fields, write it to node_modules/dsh-claude-ux/cordis.patch.yml, and then run the installation command to reinstall.

Use Cases and Notes¶

Who is this for:

• Deployers on DSH web needing Claude-style regional access policies.
• Scenarios requiring abuse grading, automatic termination for severely harmful content, and wanting a combination of word lists and LLM context.
• Teams that prefer purely local determination by default, only enabling IP/WebRTC external queries when necessary.

Important Notes:

1. The plugin runs with the current DSH process permissions. Before installation, review the source code and MIT license to ensure its behavior meets your compliance requirements.
2. The master switch is off by default to prevent accidental lockout of administrators. Before first use, it is recommended to test with observe mode or verify /_dsh/claude/status locally.
3. Enabling ipCheck or webRtcCheck will send requests to third-party services. Evaluate privacy and network policies before deployment.
4. The community directory SkillHub and DeepSeek / 幻方 have no official affiliation; the DSH ecosystem philosophy is “everything is a plugin,” and this is a community-maintained project.

Conclusion¶

dsh-claude-ux brings Claude-style regional risk control and conversational autonomy to the DSH web profile: local signal determination, invertible targets, refusal ladders, word list plus LLM abuse arbitration, and a dedicated settings page and status API. If you are building a productized interface on DSH that requires regional policies or conversational boundaries, you can install and verify it following the steps in this article.

• Directory page: https://www.skillhub.cn/plugins/eri64/dsh-claude-ux
• GitHub: https://github.com/eri64/dsh-claude-ux