Preface¶

When conducting agent or security evaluations in DeepSeek Harness (DSH), a common misconception is that a model’s “refusal” originates from the model’s own capability boundaries. In reality, it often stems from prompt rewriting, approval gates, sandboxing, or session migration implemented by the host at runtime. If one only compares “whether the answer was provided,” it becomes difficult to determine whether the default policy or the model’s behavior should be adjusted.

Below is an introduction to the community workflow plugin dsh-purge (Maintainer: LanJinGod, README version: 1.1.72). Designed for locally installed official Harness instances, it utilizes a sidebar “Purge / Sandbox” panel and local patches to separate host-level interception from model-level responses. It is intended for controlled red team evaluations and policy strictness comparisons. The DSH ecosystem follows the philosophy of “everything is a plugin.” Community sites such as the SkillHub Directory are not officially affiliated with DeepSeek or High-Flyer (Quanta). Please verify the source code and MIT license independently before installation.

What is this¶

dsh-purge is a cybersecurity red team evaluation plugin (npm package name dsh-purge) installed on the local official DeepSeek Harness. It exclusively handles local official @deepseek-ai packages and local profile / $DSH_HOME configurations. It does not modify the Harness source code repository and is not intended as a public network scanning or attack suite for third-party sites.

Both the official Web (dsh web) and official Desktop EXE (documentation examples use DeepSeek Harness 0.2.0-rc.2) are supported, but they must be installed separately and applied separately. The current mainline supports dsh 0.2; earlier dsh versions require corresponding older plugin versions. Community desktop clients are not within the scope of maintenance.

Core Features¶

Sidebar: Purge and Sandbox¶

A dsh-purge button is located next to the session title. Clicking it opens the right sidebar, which contains two pages:

Identity and default prompts are derived from the plugin’s embedded encrypted prompt (displayed by default in the prompt box) and do not read prompt files from the host’s disk. Prompts can be swapped based on the model; the package description indicates the default prompt targets the domestic model “Xiao Ma Jiang” (Little Code Master).

Host Strategy and Startup Self-Check¶

The plugin adjusts default text, permission policies, and tool limits while retaining official capabilities; it does not create a separate identity. It automatically checks and re-applies settings upon startup. After npm upgrades overwrite node_modules, no manual file modification is required.

The $DSH_HOME resolution order is: Environment variable $DSH_HOME → .dsh next to the dsh launcher → ~/.dsh. At runtime, it also writes prompt-inject.md, rules/, skills/, net-scope-allow.txt, and redteam/ to $DSH_HOME (Web and Desktop use separate primary directories).

Package Swap and Ledger Status¶

Scenarios such as the Desktop client may involve app.asar takeover. The CLI dsh-purge --status (or chat command /purge status) reports the patch list and, according to documentation, additionally reports three lines: Runtime Loading (app.asar sealed / resources/app taken over), Patch Effectiveness (write count vs. actual loaded count), and Package Swap (last stage of the swap ledger and failure reasons). If the archive still exists, patches may not take effect; the ledger and logs are located at $DSH_HOME/dsh-purge/asar-swap.json and %TEMP%\dsh-purge-asar-*.log.

Example commands related to package swapping:

dsh-purge --swap        # Queue idle takeover: Automatically swap app.asar and restart after closing dsh
dsh-purge --swap-now    # Immediately terminate dsh, move app.asar, and restart

Installation and Activation¶

Environment Requirements: Node.js ≥ 18; for Windows scenarios without flash windows, documentation requires Node ≥ 22. One-click installation via Hub and the following commands install the npm package dsh-purge.

Select the profile based on the host you are using (install only the one currently open):

dsh plugin --profile web add dsh-purge

dsh plugin --profile desktop add dsh-purge

If the current directory is already a copy of this repository, change the package name to add .. If the npm registry is unavailable, for the same --profile, you can replace the target with the master.tar.gz address provided in the documentation (see the “Installation” section of the Chinese README at LanJinGod/dsh-purge).

Important: Simply running plugin add to write to the profile does not modify the @deepseek-ai host package. After installation, follow these steps:

1. Completely exit and reopen the specific host just installed (For Web, close dsh web and restart; for Desktop, exit the tray and restart the exe).
2. Click dsh-purge next to the session title → Purge → Apply (This entry is not available in the settings page).
3. After successful “Apply,” the system will automatically restart once; it will not restart if incomplete. After restarting, start a new conversation for the injection to take effect in the current session.

Web and Desktop controls do not cross. Do not click “Apply” for Host B while inside Host A.

Typical Usage¶

Command Line and Chat Commands¶

dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

Inside the chat, you can use /purge status | apply | revert | uninstall | edit | help, as well as /rules, /skills, /rewind, etc. (See the “Usage” section of the repository for the full list). Tool names such as purge_status, purge_apply, and purge_revert are also available on the model side.

Rule Sets and Your Own Servers¶

In the Purge page, you can edit prompt-inject.md as a session override segment; rule sets support multiple AGENTS.md / CLAUDE.md files, which are written to $DSH_HOME upon activation. “Your Own Servers” is located below the prompt; register one IP or full hostname per line. Upon saving, this is written to $DSH_HOME/net-scope-allow.txt (Documentation has strict restrictions on mainland, Hong Kong, and Macau network segments; read the README compliance statement before use).

Plugin Configuration Snippet¶

Example of common fields in cordis.patch.yml (postPrompt is empty by default):

- insert:
    - id: dsh-purge
      name: 'dsh-purge'
      config:
        enabled: true
        autoApplyOnStart: true
        autoUpdateOnStart: false
        autoRevertOnMissing: false
        verbose: false
        postPromptOrder: 5100
        postPrompt: ""

Uninstallation can be done via the sidebar “Purge” → “Uninstall”, or via dsh-purge --uninstall / /purge uninstall; it will revert applied patches first and then restart the host.

Applicable Scenarios and Notes¶

Who it is for: R&D and security practitioners conducting LLM / Agent security evaluations on local official Harness instances, distinguishing between host policies and model behaviors, and comparing whether default policies are too strict (Must be within the scope of legal authorization).

Compliance and Permissions:

• The plugin runs with the current dsh process privileges. Before installation and application, please read the repository source code, MIT license, and the legal disclaimers and scope of use in the README. It only functions on local official installations you are authorized to manage.
• Documentation explicitly prohibits use on unauthorized targets, public production systems, or illegal activities; the Sandbox is for authorized environments only.
• When borrowing this project’s name, ideas, code, or prompts for secondary development, the README requires attribution and a clear indication of the source repository YuJunZhiXue/dsh-purge (Please cross-reference the README regarding the current LanJinGod/dsh-purge distribution).

Alignment with DSH Versions: dsh 0.2 uses 1.1.40 and above as stated in the README; dsh 0.1.7 requires selecting 1.1.39 or earlier Releases. If versions do not match, patches will show as pending or skipped to avoid random file modifications.

Conclusion¶

Through the steps above, dsh-purge strings together “Install Plugin → Apply Patch → View Status / Swap Ledger → Verify in New Conversation” into a reproducible local evaluation workflow. This facilitates controlled comparisons on top of official Harness capabilities, rather than mistaking host interception for model refusal.

• Community Directory: SkillHub — LanJinGod/dsh-purge
• Source Code and Documentation: GitHub — LanJinGod/dsh-purge