Preface¶
DeepSeek Harness (DSH) makes the system prompts, tool policies, and some runtime behaviors within the host patchable. A common community solution for “restriction bypassing” is dsh-purge. The original project, YuJunZhiXue/dsh-purge, announced a temporary suspension of updates in October 2026: no new versions will be released, issues/PRs will not be processed, and compatibility with new DSH versions is not guaranteed. The last official release was v1.1.71, and 1.1.72 on the master branch was never released.
If you upgrade DSH to 0.2.1-rc.2 and try to use the upstream 1.1.72 directly, it often gets stuck during the prompt assembly stage—the panel patches may appear all green, but every conversation round throws an unknown prompt variable "[cwd]" error before sending the model request. The following introduces the community repository evilevil/dsh-purge-021rc2 by maintainer evilevil, found under the “Model Inference” category on SkillHub. Based on 1.1.72, it specifically fixes several crash points mandatory on 0.2.1-rc.2 and is packaged as a directly installable version (current release 1.1.72-dsh021rc2.4). The README suggests prioritizing the upstream repository once maintenance resumes.
What is this¶
dsh-purge is a restriction-bypassing plugin in the DSH ecosystem: through Cordis patches and identity layer logic, it applies custom personas and a series of host fixes to the web profile (and associated desktop workflows). This repository is a MIT-licensed community adaptation branch. It does not alter the design intent of the upstream product behavior or prompt content; it only provides compatibility with @deepseek-ai/dsh / dsh-base 0.2.1-rc.2 (the README notes testing on macOS + web profile; logic for 0.2.0-rc.2 remains usable, and changes are backward compatible).
GitHub: https://github.com/evilevil/dsh-purge-021rc2
Directory Page: https://www.skillhub.cn/plugins/evilevil/dsh-purge-021rc2
Why it crashes on 0.2.1¶
Version 0.2.1 adjusted the registration scope of prompt variables: the agent-loop only registers provider and model, and no longer registers cwd. However, lib/identity.js in version 1.1.72 still writes the deployment:persona-suffix containing {{cwd}} text, causing every conversation round to fail before the model request is made. The patch panel might still show normal at this point because the crash occurs during prompt assembly, not during the patch application itself.
What this version fixes (Summary)¶
The README maps the fixes to upstream issues, mainly including:
| Issue | Key Points |
|---|---|
| #114 / #126 / #136 | identity.js performs capability detection and degradation for cwd; personaSuffix in cordis.patch.yml is changed to be uniformly determined by the identity layer; the environment variable DSH_PURGE_CWD=variable\|static can be used to force behavior. |
| #132 / #40 | The system-prompt in 0.2.1 adds requiredContexts filtering after assembly, causing old patterns to miss; Patch #40 adds patterns + replacements shaped for 0.2.1. |
| #119 | desktop.js adds async/await to atomicCopyFile() to avoid uncaught exceptions in Node 24 leading to dsh: fatal load failure. |
| #127 / #106 | Completed the HOST_SYNC whitelist with closeSync etc., fixing issues where .bak files were missing and restore/uninstall failed. |
| #121 | Conflict between Ctrl+Enter interruption and steer/followup; 1.1.72 already changed to agent.steer, this version confirms it on a real machine. |
| Red Team Presets | Removed toolFilter.deny on unregistered tools to prevent tools.restrict() from throwing unknown global tool. |
Not Addressed: Upstream #133 (Windows desktop packaging changes) and #30 (system section filtering controversy) are not within the scope of this adaptation.
Installation¶
Refer to the repository README for installation commands; do not construct dsh plugin add commands yourself using the plugin name.
Method 1: One-click Script (macOS, web profile)¶
The script backs up the existing plugin directory, unpacks the release, and writes installed-rev / applied.json stamps to prevent misjudging the version as outdated and repeatedly re-patching at startup.
curl -fsSL https://raw.githubusercontent.com/evilevil/dsh-purge-021rc2/main/scripts/install.sh | sh
Method 2: Manually download Release package¶
First download the corresponding version and checksum files. After verification, extract to the web profile’s node_modules/dsh-purge:
V=1.1.72-dsh021rc2.4
curl -fsSLO https://github.com/evilevil/dsh-purge-021rc2/releases/download/v$V/dsh-purge-$V.tgz
curl -fsSLO https://github.com/evilevil/dsh-purge-021rc2/releases/download/v$V/SHA256SUMS.txt
shasum -a 256 -c SHA256SUMS.txt
rm -rf "$DSH_HOME/profiles/web/node_modules/dsh-purge"
mkdir -p "$DSH_HOME/profiles/web/node_modules/dsh-purge"
tar xzf dsh-purge-$V.tgz -C "$DSH_HOME/profiles/web/node_modules/dsh-purge" --strip-components=1
Method 3: Write into profile dependencies¶
"dsh-purge": "https://github.com/evilevil/dsh-purge-021rc2/releases/download/v1.1.72-dsh021rc2.4/dsh-purge-1.1.72-dsh021rc2.4.tgz"
To upgrade to a new version locally, the README example is: PURGE_VERSION=<new_version> sh scripts/install.sh.
How to use after installation¶
- Completely quit and reopen DSH (The patches modify already loaded JS; they won’t take effect without a restart).
- In the left sidebar, go to Purge → Status Page → Apply.
- A successful application will trigger an automatic restart; after restarting, start a new conversation, as injection only enters the current session upon creation.
- The panel should display 69 patch rows / 0 pending, with
#40 / #85 / #86 / #87–#92all green (The README’s real-machine record shows 70/86 applied and 0 pending after application; use your local panel as the standard).
To verify injection: Ask “Who are you?”. The answer should come from the persona in ~/.dsh/prompt-inject.md, not the official self-introduction.
Offline Verification (Included in repo)¶
Three sets of tests that do not depend on the network:
node test/identity.test.mjs # {{cwd}} capability detection and degradation
node test/patches.test.mjs # #40, #86, #119/#127 etc.
node test/sandbox-apply.mjs # Copy host targets to /tmp and run full apply
The real-machine snippet provided in the README for macOS / dsh 0.2.1-rc.2 / web profile shows: Before application, #40 skipped with multiple pending items; after application, #40 and other cleaning-related items are applied, and hostCleanMarkersPresent and hostPromptKeepsInject are true.
Use Cases and Notes¶
- Who it is for: DSH developers already using dsh-purge for prompt injection, host patching, or red-team related presets, where the host version is 0.2.1-rc.2 (or still on 0.2.0-rc.2 but requiring 1.1.72 capabilities).
- Permissions and Risks: The plugin runs with the current DSH process permissions and modifies host JS and local configurations. Please read the source code and the MIT license before installation, and comply with upstream attribution requirements (borrowing names, ideas, code, or prompts requires attribution and specifying the source repository). The README explicitly states: This repository has no official endorsement; please use restriction-bypassing plugins only for security research in your own environment.
- Ecosystem Note: DSH emphasizes “Everything is a plugin”; community directories like SkillHub are independent sites and have no official affiliation with DeepSeek / Hidream.
- Known Limitations: Mainly verified for web profile + official desktop 0.2.1-rc.2 code shapes; since upstream updates stopped, patch anchors may need realignment if DSH changes the host structure again. The
shim directory: not locatedmessage under npx installation is stated as normal in the README.
Conclusion¶
evilevil/dsh-purge-021rc2 bridges the 1.1.72 dsh-purge to DSH 0.2.1-rc.2 during the upstream maintenance hiatus, concentrating fixes on blockers such as the {{cwd}} crash, patch #40 anchors, missing await in the desktop client, and the hostFs sync whitelist. For installation and issue lists, refer to the GitHub README:
- Directory Page: https://www.skillhub.cn/plugins/evilevil/dsh-purge-021rc2
- Repository: https://github.com/evilevil/dsh-purge-021rc2