Version 1.1.77

DeepSeek Harness jailbreak: every model, swap prompts per model. Default prompt for 小码酱. Please star ⭐ If you build on this, see Attribution required.

English | 中文

People have been selling this open-source work in the open. After that, the author was asked to come in and talk. No need to spell out the rest. Read between the lines.

From now on the public internet is closed. The open-source build only allows local lab IPs: loopback and RFC1918. Domains are resolved first (including hosts); every answer must be private or loopback. A hosts trick that points .lab at a public IP, a failed lookup, or a mixed public answer is blocked. Game cheats are forbidden (aimbot, wallhack, memory edits against a game, anti-cheat bypass); the prompt and the session gate both stop them. This build does not ship the skill library or the knowledge base.

The original build may not be resold. Charging for it, skinning it, or hawking it in groups is not allowed. Forks are fine, but you must attribute and name the source: YuJunZhiXue/dsh-purge. Hide the source or pass it off as your own, and you are on the other side.

The author's personal channel: t.me/LLM_PoJia. Notes and updates show up there.

• A note from the author
• What this is
• Attribution required
• License
• Supported hosts
• Install
• Preview
• Usage
• How it works
• Restore
• Releases

dsh-purge is a cybersecurity red-team plugin for the official DeepSeek Harness already installed on your machine. 1.1.77 targets DSH 0.2.1-rc.2 (0.2.0 still works). Official Web (dsh web) and the official desktop EXE are both supported. Install and Apply them separately.

Harness does more than forward a prompt. It rewrites prompts, approval gates, sandbox policy, and session migration at runtime. Asking only “will the model answer” treats a host-layer block as a model refusal. This plugin separates those two layers on your own install, for controlled evaluation and for seeing which default policy is too tight.

No hardcoded drive letters. It looks at $DSH_HOME, .dsh next to the dsh launcher, then ~/.dsh. It does not patch the Harness source tree. Apply on the Clean page of dsh-purge is what writes the changes. Identity comes from the encrypted prompt shipped in the plugin, the text the prompt box shows by default. The host prompt file is not read.

It only touches the official @deepseek-ai packages and local config on the user's machine. It is not a public scanner and not an attack kit for third-party sites. The repo does not ship malware, unauthorized-exploit scripts, or payloads aimed at the public internet.

The original build may not be resold. No paid resale, no skinned store listing, no hawking it in groups.

Forks must attribute and name the source repository: YuJunZhiXue/dsh-purge. Same if you borrow the name, ideas, code, or prompts.

Hiding the source, passing it off as your own, or reselling the original will be pursued.

This repo is Apache License 2.0. Forks and redistributions must keep the copyright notice and NOTICE, and name YuJunZhiXue/dsh-purge. The original may not be resold.

1.1.77 targets DSH 0.2.1-rc.2. 0.2.0 still works. Do not apply it to 0.1.x.

• dsh 0.2.1-rc.2 (official desktop / official dsh web): use 1.1.77. Fixes {{cwd}} / [cwd] crash, patch #40 match, dropped toolFilter, host dsh-tools resolve, hostFs fd, desktop helper self-kill, file: archive update, Ctrl+Enter steer.
• dsh 0.2.0-rc.2: use 1.1.40 or newer; this line also installs.
• dsh 0.1.7 (incl. rc.1 / rc.2): use 1.1.39 or older — pick the tag on Releases.

Unmatched patches stay pending or skipped; nothing is rewritten blindly.

Follow the three steps below. Do not use the plugin marketplace. One-click install on dsh-plugin.org or in Settings → Plugin Market fails with already queued: dsh-purge and never runs a command. The name dsh-purge is not on the npm registry; do not pnpm add dsh-purge. If this machine only has pnpm, use the pnpm URL in step 2.

Official dsh web and the official desktop EXE are installed and patched separately. Only install into the host you actually open.

Use codeload.github.com. Do not use github.com/.../archive: that 302 makes pnpm fail with fetch failed.

If you have dsh:

dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Use desktop instead of web for the EXE. If this directory is already a clone, use . instead of the URL.

pnpm only (no dsh required): run this inside the profile you actually use, not the repo root.

cd "$DSH_HOME/profiles/web"    # desktop: profiles/desktop
pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Windows PowerShell:

cd "$env:USERPROFILE\.dsh\profiles\web"   # desktop: profiles\desktop
pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

pnpm add fetches the package; postinstall writes dsh-purge into dsh.profile.bundles. If you passed --ignore-scripts, run:

node node_modules/dsh-purge/scripts/ensure-profile-bundle.mjs

Success: node_modules/dsh-purge/package.json exists and "dsh-purge" is in that profile's bundles. If neither dsh nor pnpm is available, use Manual install.

For the desktop client you can also click the button (dsh:// deep link; it still downloads the same tarball):

Install in desktop client

Adding the plugin to a profile does not patch @deepseek-ai by itself.

1. Fully quit and reopen the host you just installed into. Web: stop dsh web and start it again. Desktop: quit the tray icon too, then open the exe.
2. On that host, click dsh-purge beside the session title, open Clean, and click Apply. It is not on the host Settings page.
3. A successful Apply restarts once. It does not restart if it did not finish.

Web controls affect Web only; desktop controls affect the desktop app only. Do not Apply one host from the other.

• dsh-purge sits beside the session title, with Apply on its Clean page.
• /purge status in chat prints DSH_HOME and the patch list — the path should be the home you actually run.
• Optional packages that are not installed (liangshen) show as skipped and do not block Apply.

Stop clicking the market. Use dsh plugin add or pnpm from step 2 again. If the CLI also says it is already there:

dsh plugin --profile desktop remove dsh-purge
dsh plugin --profile desktop add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

pnpm only:

cd "$DSH_HOME/profiles/desktop"
pnpm remove dsh-purge
pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Swap desktop for web on Web. Then do step 3.

Paste the block below to a local assistant. It should only run the install command — no disk scan, no other edits, no Apply, no restart.

dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

pnpm add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master

Use this when the command fails or dsh is not on PATH. Edit only the profile for the host you run — do not touch the other, and do not delete existing bundles.

$cands = @()
if ($env:DSH_HOME) { $cands += $env:DSH_HOME }
$cands += "$env:USERPROFILE\.dsh"
$dsh = Get-Command dsh -ErrorAction SilentlyContinue
if ($dsh) {
  $dir = Split-Path $dsh.Source
  $cands += @((Join-Path $dir ".dsh"), (Join-Path (Split-Path $dir) ".dsh"), (Join-Path (Split-Path (Split-Path $dir)) ".dsh"))
}
$cands += @("$env:APPDATA\DeepSeek Harness\dsh-home", "$env:LOCALAPPDATA\DeepSeek Harness\dsh-home")
$cands | Select-Object -Unique | Where-Object { $_ -and (Test-Path (Join-Path $_ "profiles")) }

git clone https://github.com/YuJunZhiXue/dsh-purge.git "$DSH_HOME/plugins/dsh-purge"

{
  "name": "dsh-profile-web",
  "private": true,
  "dependencies": {
    "dsh-purge": "file:../../plugins/dsh-purge"
  },
  "dsh": {
    "profile": {
      "bundles": [
        "@deepseek-ai/dsh-base",
        "@deepseek-ai/dsh-web-app",
        "dsh-purge"
      ],
      "patchReload": "live"
    }
  }
}

cd "$DSH_HOME/profiles/web"   # or profiles/desktop
pnpm install

dsh-purge beside the session title → Clean → Uninstall. Confirm the dialog: it reverts any applied patches, restores the original Harness, and restarts the current host.

# or from a terminal / chat
dsh-purge --uninstall
# /purge uninstall

Plugin config lives in cordis.patch.yml (postPrompt is empty by default):

- insert:
    - id: dsh-purge
      name: 'dsh-purge'
      config:
        enabled: true
        autoApplyOnStart: true
        autoUpdateOnStart: false
        autoRevertOnMissing: false
        verbose: false
        postPromptOrder: 5100
        postPrompt: ""

dsh-purge sits beside the session title. It opens a right-hand dock with two pages: Clean and Drill. Switch Light / Ink. Patches are grouped; the count only includes items that actually applied. Rule sets sit in a list above the editor, with Enable and Delete on each row.

The first time you open Drill you read the notice, wait out the countdown, scroll to the end, and check three boxes. Clean does not need that step. Drill is only for a host you manage, an offline target, or an exercise that already has written authorization.

Clean

Drill authorization

Drill

Patches

Local lab

The open-source build only allows localhost/private nets. The Clean page says so. You cannot register a public host.

bin/ is the CLI, lib/ is patches and the drill console, presets/redteam/ is the red-team preset, and client.js is the dock. This build does not ship skills/ or the knowledge base.

Runtime files live under $DSH_HOME: prompt-inject.md, rules/, redteam/. If DSH_HOME is unset, the launcher-adjacent .dsh wins over ~/.dsh. Web and the desktop app each use their own home.

dsh-purge --status
dsh-purge --apply
dsh-purge --revert
dsh-purge --uninstall
dsh-purge --edit

/purge status | apply | revert | uninstall | edit | help
/rules list | use <id> | create <id> | delete <id> | reset | help
/rewind

purge_status   purge_apply   purge_revert

After a successful Apply, the host restarts so patched packages load; you can also click Restart manually. Under the patch title are the stable release and the test release. The test release follows the beta branch. Switch to stable installs master and clears any pin. Picking an older stable version pins it; click Update to return to the latest. Old test tags are not listed.

The composer Undo once and Undo last round stay in the current conversation and do not open a branch. The sent line goes back into the input, and that cut's already-sent messages and completed tasks leave the current conversation; edit and send again. From 1.1.61, rewind bounds follow the current turn, not the first user message. /rewind does the same.

If the same task works in standard but fails in minimal or PTC, preset run_code, sandbox, or plan intercept text is often still uncleared, or built-in minimal is missing agent-instructions. Use 1.1.61+, then quit the host fully → Apply in Clean → restart → start a new chat. Switching preset alone does not reload patches in the running process.

DSH runs Bash calls in a tool batch one at a time. Older dsh-purge releases raised the default foreground wait from 60 seconds to 10 minutes, so one slow command could hold up later calls for that long. Patch #21 now restores marked plugin values to the official 60-second default. Unmarked timeouts and other custom values are preserved; an unmarked 10-minute value cannot reliably be distinguished from a user setting.

For a shorter wait in dsh web on macOS/Linux, add this entry to $DSH_HOME/profiles/web/cordis.patch.yml (normally ~/.dsh/profiles/web/cordis.patch.yml). Edit an existing entry with the same id instead of adding a duplicate. This profile layer is applied after the bundled configuration, so future plugin applies keep the override.

- id: bash-sandbox
  config:
    timeoutMs: 10000

With the standard jobs service and promoteOnTimeout: true, an unfinished command returns a background job id after 10 seconds and keeps running. Read it with job_output or stop it with job_kill. This changes the foreground wait, not the command's speed. Without that service or with promotion disabled, the timeout kills the command. A per-call timeoutMs overrides this default; run_in_background: true returns a job id immediately.

For routine tasks, you can also opt into Low reasoning for new sessions:

- id: agent-default-model
  config:
    provider: deepseek-official
    model: deepseek-flash
    reasoningEffort: low

Restart dsh web to load the profile. The model and reasoning defaults apply to newly created sessions; select Low in the composer for an existing session. The plugin does not change these model preferences automatically. Keep High when the task needs deeper reasoning, and narrow file searches rather than recursively scanning every application directory.

Attack tasks are denied by default. The open-source build only allows loopback and RFC1918 IPs. Names are resolved first; a .lab / .htb suffix is not enough. A hosts entry that points a lab name at a public IP is blocked. Saying “this is my server” in chat does not allow it.

node --check lib/index.js
node --check lib/core.js
node --check lib/surface.js
node --check lib/web.js
node --check lib/desktop.js
node --check lib/host.js
node --check lib/rewind.js
node --check lib/skills.js
node --check client.js

Apply, on start or when you click Apply:

flowchart TD
  A["Start or click Apply"] --> B{"Patch already in place?"}
  B -->|yes| C["Skip"]
  B -->|no| D["Back up the original as .dshpurge.bak"]
  D --> E["Replace the matched files"]
  E --> F["Override the shim"]
  F --> G["Inject the encrypted prompt shipped in the plugin, the text the prompt box shows by default"]

Override on each session:

flowchart TD
  A["Restart or new session"] --> B["Inject the plugin's encrypted default. No save click, and no host prompt file"]

Prompt injection and ruleset decision at every turn. The three inputs on the left are what you control in the dsh-purge panel; the dotted edges show which decision each one drives:

flowchart TD
  L["Rule library: activate a set → writes prompt-inject.md"]
  W["Local rules: check AGENTS.md / CLAUDE.md in the current dir"]
  P["Workspace policy: strict / fallback / always"]

  A["Turn start"] --> B{"prompt-inject.md non-empty?"}
  B -->|yes| C["Inject = prompt-inject.md (A)"]
  B -->|no| D{"Any checked local md in the current dir, non-empty?"}
  D -->|yes| E["Inject = selected workspace md (B)"]
  D -->|no| F["Inject = plugin encrypted slot default (D)"]
  C --> G{"Workspace baseline policy (C)"}
  E --> G
  F --> G
  G -->|strict| H["Drop DSH workspace baseline section"]
  G -->|fallback default| I{"User inject present above? (A or B)"}
  G -->|always| J["Keep DSH workspace baseline section"]
  I -->|yes| H
  I -->|no| J
  H --> K["Final system prompt"]
  J --> K

  L -.-> B
  W -.-> D
  P -.-> G

• Each target is copied to <file>.dshpurge.bak before the first apply.
• Restore or /purge revert copies backups back and deletes them. With no backup, shim lines written by this plugin are stripped.
• prompt-inject.md is a user file and is kept.
• Uninstall restores first if patches were applied, then deletes the inject file, rule library, and the plugin itself.
• Apply is idempotent.

The host surface is detected first: web / desktop (gui / tui are reserved and still fall back to web).

Web:

1. DSH_HOME / DSH_BASE
2. .dsh next to the dsh launcher (portable install, any drive)
3. npm prefix -g / npm root -g
4. Nested @deepseek-ai/dsh/node_modules/@deepseek-ai
5. ~/.dsh

Official desktop EXE: the running official Harness install (resources/app or the unpacked package). The drive letter is not hard-coded. A successful Apply restarts once.

Community Desktop is not maintained.

Official npm-global is not patched. Sealed host-commands / runtime-commands are scrubbed, never injected.

If nothing is found, set DSH_BASE / DSH_DESKTOP_INSTALL. No files are changed.

The author's personal channel: t.me/LLM_PoJia. Notes and updates show up there. GitHub Releases still has older packages. The original may not be resold; forks must attribute.

• Scope is rendered copy, defaults, and runtime logic inside local @deepseek-ai/* packages, plus override files and rule sets under the harness home.
• After an upgrade, unmatched originals show as skipped. Apply still completes, and those files are left unchanged.
• Third-party plugin source repos outside @deepseek-ai are left alone (CMD silence may best-effort patch installed doctor / market / liangshen / mnemon at runtime).
• Install from the GitHub tarball (the name is not on npm; skip the plugin market). With dsh: dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master. pnpm only: pnpm add that URL inside $DSH_HOME/profiles/web. Use desktop for the EXE. From this repo, add ..

Thanks to the LINUX DO community