Preface¶

When conducting model security or policy evaluations in DeepSeek Harness (DSH), a common misconception is to mistake prompts rewritten by the host at runtime, approval gates, and tool policies for “the model itself refusing to answer.” The upstream project YuJunZhiXue/dsh-purge is positioned to separate the “host policy layer” from the “model response” on a local official Harness installation to facilitate controlled red team evaluations; it also supports switching injected prompts by model, defaulting to the domestic model “Xiao Ma Jiang” (小码酱).

Upstream 1.1.71 fails to load, silently malfunctions, or even prevents DSH from starting on DSH 0.2.1-rc.2 due to structural changes in nine locations within the host. The repository potato1008ypy/dsh-purge-0.2.1rc2-fix maintained by Potato1008ypy provides compatibility fixes while pinning the upstream 1.1.71 (commit 6c1d638), without altering prompt content or removing functionality. This entry is categorized as a Workflow in the community directory SkillHub; as of the record, it has approximately 32 stars and 18 forks on GitHub. The directory site has no official affiliation with DeepSeek or 幻方 (High-Flyer); please verify the repository source code and MIT license independently before installation.

What is this¶

dsh-purge (npm package name dsh-purge, this branch version 1.1.71-dsh0.2.1rc2-fix.7) is a network security red team evaluation DSH plugin installed on the local @deepseek-ai/dsh. Its brief description is: “Jailbreak for every model — swap prompts per model.”

This repository is an adaptation branch, not an official upstream release. The verification baseline is DSH Desktop 0.2.1-rc.2 (Windows, desktop profile); dsh CLI 0.2.1-rc.2 (web profile) applies the same fixes but has not undergone item-by-item regression. The runtime requirement is Node.js ≥18; Node ≥22 is required to avoid console window flashing on Windows. The repository declares its purpose as local security research and authorized testing.

What the Adaptation Fixes Did¶

The following nine items (FIX-01 to FIX-09) address “re-establishing the behavior of upstream 1.1.71 on the new host,” rather than adding new product features. The fixes include host structure detection and automatically retreat on older hosts like 0.2.0-rc.2; the offline test included in the package, node test/fixes.test.mjs, is expected to result in All passed: 22 passed, 0 failed.

The patch status panel adds a retired marker to distinguish between “missed” and “host structure no longer exists”; the expected final state after successful application recorded in the documentation is approximately applied 66 / na 15 / pending 1 (#40 is only hit in complete mode).

Core Features (Upstream Capabilities, Maintained in this Branch)¶

With the adaptations above, the capabilities of the sidebar and the cleaning page remain functional as designed upstream:

1. dsh-purge Sidebar: A button next to the conversation title opens the right sidebar, containing pages such as “Cleaning” (清洗) and “Training Ground” (演练台).
2. Cleaning: View patches in groups; execute apply, restore, and uninstall; edit prompts and multiple rule sets.
3. Prompt Injection: Edit prompt-inject.md on the Cleaning page as the conversation override segment; identity comes from the encrypted default prompt within the plugin (the one displayed by default in the prompt box) and does not read prompt files from the host disk.
4. Switch Prompts by Model: The product description supports using different prompts for different models; the default prompt is designed for the domestic model “Xiao Ma Jiang”.
5. Training Ground: Built into the production version; after authorization, assets, skills, and local environment can be viewed (limited to local machines you are authorized to manage, offline targets, or written authorized exercises).
6. Host Policy Patches: Writes to relevant files in the local @deepseek-ai package via “Apply”; official capabilities are preserved, and a separate set of identities is not written. It checks and applies again on startup; no manual file modification is needed after node_modules is overwritten by an npm upgrade.

Runtime data falls into $DSH_HOME (if unset, it tries .dsh next to the installation directory, ~/.dsh, etc.), including prompt-inject.md, rules/, skills/, net-scope-allow.txt, redteam/. Web and Desktop versions use the primary directories of their respective profiles and must be installed separately and “Applied” separately.

Installation and Activation¶

Installation involves three steps: Install Package → Enable (Write to dsh.profile.bundles) → Patch. The first two steps allow the host to load the plugin; the third step, “Apply” in dsh-purge → Cleaning next to the conversation title, is required to rewrite host files and does not execute automatically. A restart occurs automatically after successful application; after restart, a new conversation round must be started for the injection to enter the current session.

The documentation explicitly states: Do not enable this plugin in the dsh-market (Plugin Market)—the hot-mount path does not write to bundles, and bundles containing inject and config will fail.

Method 1: Windows One-Click Script (Recommended)¶

First completely exit DSH, then execute:

powershell -NoProfile -ExecutionPolicy Bypass -Command "iwr -UseB https://raw.githubusercontent.com/Potato1008ypy/dsh-purge-0.2.1rc2-fix/v1.1.71-dsh0.2.1rc2-fix.7/install.ps1 -OutFile $env:TEMP\dsh-purge-install.ps1; & $env:TEMP\dsh-purge-install.ps1"

The script detects the installation directory and profile, installs the package, and writes to dsh.profile.bundles; it refuses to execute if DSH is not exited (to avoid ERR_PNPM_EPERM).

Method 2: pnpm add¶

pnpm add "github:Potato1008ypy/dsh-purge-0.2.1rc2-fix#v1.1.71-dsh0.2.1rc2-fix.7"

pnpm add only writes dependencies and does not register bundles. After installation, go to the “Plugins” page to manually Start it, then restart DSH. The documentation reminds: Do not install via Release tarball address, as this may trigger ERR_PNPM_MISSING_TARBALL_INTEGRITY and freeze profile installation under host CI=true.

Method 3: Desktop Command Line Helper¶

DSH must be exited first; dsh plugin --profile desktop will be rejected, so use the wrapped script:

dsh-plugin.bat plugin --profile desktop add "github:Potato1008ypy/dsh-purge-0.2.1rc2-fix#v1.1.71-dsh0.2.1rc2-fix.7"

Method 4: GUI “Plugins” Page¶

In Plugins → Add Plugin, paste the Git address, click “Start” on the same page, fully restart DSH, and then execute Cleaning → Apply. If the profile already contains plugins with native modules and DSH is running, the GUI path may fail due to ERR_PNPM_EPERM; it is advisable to use the script or helper instead.

After installing the package, the following commands can be used for fix regression (path based on local node_modules/dsh-purge):

cd <DSH_HOME>/profiles/desktop/node_modules/dsh-purge
node test/fixes.test.mjs

The documentation also emphasizes: Do not “update” this plugin to the upstream npm dsh-purge via the package manager. Since the version number is also 1.1.71, it is easily overwritten; you should first clean up according to INSTALL.md and then reinstall this branch tag.

Typical Usage¶

1. After completing installation, enabling, and restarting, open dsh-purge next to the conversation title, enter the Cleaning page, and click Apply to wait for the automatic restart.
2. Edit prompt-inject.md in the Prompt area to adjust the injected content according to evaluation needs; different prompt strategies can be configured for different models (consistent with the product description).
3. View status and operate patches in chat or CLI:

# CLI
dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

# Chat
/purge status | apply | revert | uninstall | edit | help
/rules list | use <id> | create <id> | delete <id> | reset | help
/skills list | import <archive or folder> | create <id> [description] | delete <id> | help

Acceptance reference: dsh-purge appears next to the conversation title; /purge status outputs DSH_HOME and the patch list, and the path should match the currently used profile.

“Your own server” is located below the prompt: register one IP or full hostname per line; after saving, it is written to $DSH_HOME/net-scope-allow.txt. The upstream documentation explains that addresses in Mainland China, Hong Kong, and Macau are prohibited by default, with only registered items as exceptions; verbal explanations cannot replace registration.

Applicable Scenarios and Notes¶

Who it is for: Developers or security researchers conducting authorized LLM security, red team research, and policy robustness evaluations on a locally installed official DeepSeek Harness.

Permissions and Trust: The plugin runs with the current dsh process permissions. Applying patches rewrites local Harness-related files and may trigger an automatic restart. Before installation, read the repository source code, FIXES.md, and the license. The upstream requires that borrowed names, ideas, code, or prompts must be attributed and marked with YuJunZhiXue/dsh-purge.

Compliance: The upstream README states that this project is for learning and research only and must comply with laws and regulations; unauthorized attacks and illegal usage are strictly prohibited. The evaluation targets should be the local Harness or a controlled environment authorized in writing, not unauthorized public network targets. This plugin has no affiliation or endorsement relationship with DeepSeek officials.

Version: If the host structure changes again after upgrading to 0.2.1-rc.2, patch anchors may drift again and require re-auditing according to the repository instructions. This branch targets 0.2.1-rc.2; DSH below 0.2.0 is not supported.

Conclusion¶

If you are using the upstream dsh-purge on DSH Desktop 0.2.1-rc.2 but encounter startup failures, silent patch failures, or application crashes, Potato1008ypy’s adaptation branch supplements nine host compatibility points while maintaining the upstream 1.1.71 product behavior, and preserves the red team evaluation workflow of switching prompts by model.

• Community Directory: https://www.skillhub.cn/plugins/Potato1008ypy/dsh-purge-0.2.1rc2-fix
• Source Code and Installation Details: https://github.com/Potato1008ypy/dsh-purge-0.2.1rc2-fix