Preface¶

When conducting red team or policy evaluation on DeepSeek Harness (DSH), a common misjudgment is: a model’s “refusal to answer” actually stems from the host layer’s prompt rewriting, approval gates, or sandbox policies, rather than the model itself. To separate and observe “host policies” and “model behavior” on your local machine, you need tools that can view patch status, apply/revert on demand, and manage injected prompts and rule sets.

The upstream YuJunZhiXue/dsh-purge 1.1.71 is mainly aimed at dsh 0.2.0-rc.2; on 0.2.1-rc.2, four patch anchors (#32 / #40 / #53 / #77) will fail to match and will be silently marked as “skipped”. Maintainer feeling6667 provides a fork on GitHub: feeling6667/dsh-purge-pro (community catalog: SkillHub plugin page), version 1.1.72-dsh021, whose description states it is adapted for DeepSeek Harness 0.2.1-rc.2 and the armor-piercing kernel v3, and fixes the above patches as well as the client dependency in dsh.client.inject. The following sections introduce its positioning, capabilities, and installation usage; installation and CLI descriptions are subject to the repository README.

What Is This¶

dsh-purge-pro is a cybersecurity red team evaluation plugin installed on your local machine’s official DeepSeek Harness (the npm package name remains dsh-purge, same as upstream). It does not modify the Harness source tree; it acts on the locally installed @deepseek-ai packages and profiles via patches and configuration. It supports the official Web version (dsh web, profile web) and the official desktop EXE (profile desktop); both must be installed separately and the “Apply” button must be clicked separately.

The plugin provides a dsh-purge sidebar next to the session title, containing two pages: “Purge” and “Drill Console”. The purge side handles patch group status, apply/revert/uninstall, prompts, and multiple rule sets; the drill console, after authorization, is used for local assets, skills, and environment-related capabilities. The README explicitly requires that it be used only on local machines you are authorized to manage, offline targets, or drill environments with written authorization.

Adaptation Points Relative to Upstream 1.1.71¶

The baseline of this fork is upstream 1.1.71, with release version 1.1.72-dsh021, and the README indicates it targets dsh 0.2.1. Compared with the upstream version which only adapts to 0.2.0-rc.2, the fork’s description states that the invalidated #32 / #40 / #53 / #77 anchors have been realigned, and the incorrect client dependency in dsh.client.inject has been fixed. For a more detailed change list and reproduction steps, see 适配说明-0.2.1.md (Adaptation Notes for 0.2.1) in the repository.

To verify the repository and installation results yourself, the README provides two verification commands (they must be executed in the cloned repository directory, and Node.js ≥18 must be installed; for Windows no-flash-window scenarios, the README requires Node ≥22):

node scripts/verify-pro.mjs --repo

Compare the “uploaded” version with the local copy before installation.

node scripts/verify-pro.mjs --check

Check after installation whether the host-related files are byte-for-byte identical to the baseline shipped with the package. Documentation: docs/验证-同效果.md (Verification of Same Effect).

Core Capabilities (as Documented in the README)¶

Identity and injection: changes are written only when you click “Apply” in “Purge”; the default identity comes from encrypted prompts inside the plugin (shown by default in the prompt box) and does not read prompt files from the host disk. The order for locating $DSH_HOME is: environment variable → .dsh next to the dsh launcher → ~/.dsh.

Writing into the profile does not change the host immediately. Per the README: dsh-purge → Purge → Apply; success will restart the host, while incomplete application will not; after restart, start a new conversation round for the injection to enter the current session.

Installation and Activation¶

Environment requirements: Node.js ≥18 (Node ≥22 required on Windows for no-flash-window scenarios). Both Hub one-click installation and command-line installation use the npm package dsh-purge.

Web (official dsh web)

dsh plugin --profile web add dsh-purge

Desktop (official EXE)

dsh plugin --profile desktop add dsh-purge

If the current working directory is already the dsh-purge-pro repository root, change the package name to the local path:

dsh plugin --profile web add .
dsh plugin --profile desktop add .

If dsh is not in PATH, follow the “Manual Installation” section of the README. If the npm registry is unavailable, the README example changes the install target under the same --profile to an upstream tarball URL (fork users obtaining the source from feeling6667/dsh-purge-pro should follow the installation instructions in that repository’s README and the SkillHub page; do not mix with the upstream tarball unless the documentation explicitly states otherwise).

After installation completes, follow the path above to enter the sidebar and execute Apply, then start a new conversation to verify that the injection takes effect.

Typical Usage¶

GUI: dsh-purge next to the session title → Purge → view patch groups → Apply (or Revert / Uninstall). Uninstallation can also be confirmed on the Purge page, or use:

dsh-purge --uninstall

CLI and chat commands (excerpted from the README):

dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

/purge status | apply | revert | uninstall | edit | help
/rules list | use <id> | create <id> | delete <id> | reset | help
/skills list | import <压缩包或文件夹> | create <id> [说明] | delete <id> | help
/rewind

The plugin is registered in cordis.patch.yml; common configuration fields include enabled, autoApplyOnStart, postPrompt, etc. (see the README for a complete snippet).

The runtime data directory (resolved in the order described above when DSH_HOME is not set) may contain prompt-inject.md, rules/, skills/, net-scope-allow.txt, redteam/, etc.; Web and desktop each use their own home directories.

Use Cases and Notes¶

Who it’s for: Developers or security researchers who have the official DSH installed locally, need to conduct policy and red team-oriented evaluation in their own Harness environment, and want to align patch behavior with 0.2.1-rc.2.

Compliance and permissions: The README emphasizes that the plugin only handles local official packages and configuration; it is not a public network scanner or an attack suite targeting third-party sites. The drill console and evaluation scope must be limited to legally authorized environments. The project is under the MIT license; if you borrow ideas or code from upstream, you must attribute the source YuJunZhiXue/dsh-purge per the README’s attribution requirements. The plugin runs with the current dsh process privileges; please review the source code and license yourself before installing and applying patches.

Ecosystem notes: The DSH community plugin catalog (such as SkillHub) is an independent site with no official affiliation with DeepSeek / High-Flyer; dsh-purge-pro is a community fork and does not represent the maintenance status of the upstream repository. The upstream README once noted that maintenance was suspended; this does not affect your ability to choose this fork’s 1.1.72-dsh021 for 0.2.1 adaptation as needed, but for future dsh versions you should still follow this repository’s updates.

Conclusion¶

If you have already encountered the issue of upstream dsh-purge patches being skipped on 0.2.1-rc.2, dsh-purge-pro brings the anchors and client injection dependencies back to an applicable state, while preserving the existing workflows of the purge sidebar, prompt/rule set management, CLI, and chat commands. Catalog and source: SkillHub: feeling6667/dsh-purge-pro, GitHub: feeling6667/dsh-purge-pro.