Introduction¶

A common misconception when performing agent or security evaluations with DeepSeek Harness (DSH) is assuming a model has “refused” a request, when in reality, the host modified the prompt, approval gates, sandbox, or session format at runtime—meaning the request never reached the model as you intended. Simply changing a prompt in the chat makes it difficult to distinguish between “policy interception” and “model behavior.”

dsh-purge is a workflow plugin installed on the local official DSH. It allows for the separation and observation of the host layer and the model layer within a controlled environment, providing sanitization, rule sets, and (in authorized scenarios) drill capabilities. The community repository realMisakaMikoto/dsh-purge is a compatible build of the upstream YuJunZhiXue/dsh-purge, primarily tracking dsh 0.2.1-rc.2 / 0.2.1-rc.1 / 0.2.0-rc.2. The upstream retains ownership of the design and prompts; this fork focuses on 0.2.x patches (see FORK-NOTES.md in the repository). It is categorized as “Workflow” on SkillHub; GitHub shows approximately 21 stars and 12 forks (subject to the page display).

What is this¶

In short: It is a network security red team evaluation plugin for the locally installed official DeepSeek Harness. It supports the official dsh web (profile web) and the official desktop EXE (profile desktop). Both must be installed separately and the “Apply” button must be clicked for each individually.

The maintainer is realMisakaMikoto. The README indicates the current release is 1.1.71. Regarding compatibility, for dsh 0.2.1, version 1.1.72 or higher is recommended, and for dsh 0.2.0-rc.2, version 1.1.40 or higher is recommended (containing the same patch logic, including 0.2.x side fixes for #40 complete-prompt keep-inject, hostFs closeSync/readSync, redteam preset toolFilter, etc.). The license is MIT. Runtime environment: Node.js ≥18; Node ≥22 is required for Windows environments without flash windows.

The plugin does not hardcode drive letters; it detects paths via $DSH_HOME, a .dsh folder next to the launcher, and falls back to ~/.dsh. It does not modify the Harness source tree, processing only local @deepseek-ai packages and local configurations. Adding the plugin to a profile does not automatically modify the host; patches are written only after clicking “Apply” in the sidebar.

Core Features¶

The following summarizes the capabilities listed in the README and does not expand on behaviors not documented.

Identity injection comes from encrypted prompts within the plugin (default text in the sidebar prompt box); it does not read prompt files from the host disk. Different prompts can be configured for different models; the default prompt is tailored for the domestic model “Xiao Ma Jiang” (see package description).

Installation and Activation¶

Install one copy each for the official Web and the official Desktop. The commands below are derived from the Chinese README, targeting this fork’s tarball (containing 0.2.x compatibility patches; the plugin market entry points to the upstream npm package and does not include this fork’s fixes).

Web (dsh web)

dsh plugin --profile web add https://github.com/realMisakaMikoto/dsh-purge/archive/refs/heads/master.tar.gz

Desktop (Official EXE)

dsh plugin --profile desktop add https://github.com/realMisakaMikoto/dsh-purge/archive/refs/heads/master.tar.gz

One-click Hub installation and the commands above ultimately install the npm package named dsh-purge. After installation, follow the three steps in the documentation:

1. Quit and Reopen the corresponding host (Close dsh web and restart for Web; Quit from the tray and restart the exe for Desktop).
2. Click dsh-purge next to the session title → Sanitize → Apply (There is no such entry in the settings page).
3. A successful “Apply” will trigger an automatic restart; after restart, start a new conversation round for the injection to take effect in the current session.

Typical Usage¶

GUI: View patch groups on the Sanitize page; apply or revert; edit prompts and switch rule sets. If behavior is inconsistent between Minimal / PTC and Standard, the documentation suggests upgrading to 1.1.61+, fully quitting the host → applying in Sanitize → auto-restart → starting a new conversation, rather than just switching presets.

CLI (Excerpt):

dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

Chat Slash Commands (Excerpt):

/purge status | apply | revert | uninstall | edit | help
/rules list | use <id> | create <id> | delete <id> | reset | help
/skills list | import <archive_or_folder> | create <id> [description] | delete <id> | help
/rewind

The model side can also call tool names such as purge_status, purge_apply, purge_revert (see the “Usage” section in the README).

Your own server: Register a single IP or full hostname below the prompt on the Sanitize page; it is saved to $DSH_HOME/net-scope-allow.txt. Network segments in Mainland China, Hong Kong, and Macau are forbidden by default; verbal explanations cannot replace registration.

Revert: Revert or uninstall via the Sanitize page; see the “Revert” chapter in the README for details.

Applicable Scenarios & Notes¶

Who is it for: Developers or security researchers performing red team research, policy robustness evaluation, and distinguishing host interception from model responses on local official DSH. The “Drill” related capabilities must be used within the scope of written authorization or owned/offline targets.

Permissions & Compliance: The plugin runs with the current dsh process permissions. Please review the source code and the MIT license before installation. The README contains non-profit, attribution, and compliance statements; unauthorized external attacks and illegal use of the project are prohibited. The project is not affiliated with DeepSeek officials. Community directories (e.g., SkillHub entry) are independent sites, not official app stores.

Version & Maintenance: The upstream author previously declared a pause in releases; this fork continues to accept 0.2.x compatibility issues. For feature requests and old 0.1.x versions, please refer to the upstream. For older dsh versions, select the corresponding plugin version from the “Compatibility Range” in the README; do not use the current master to patch 0.1.x.

Secondary Development: Borrowing names, ideas, code, or prompts requires attribution and clearly stating the source repository YuJunZhiXue/dsh-purge.

Conclusion¶

If you are already using the official Web or Desktop on dsh 0.2.x and need to continue receiving compatibility patches while the upstream plugin is stagnant, while systematically performing sanitization, rules, and evaluation processes on your local Harness, realMisakaMikoto/dsh-purge is the documented tarball installation path. Refer to the plugin description and installation details at: SkillHub Directory Page, GitHub Repository (containing Chinese and English READMEs).