dsh-purge-0.2.1rc2-fix

dsh-purge · Adapter fixes for DSH Desktop 0.2.1-rc.2

_{Base: upstream 1.1.71 (commit 6c1d638) · License: MIT · Intended for local security research and authorized testing}

English | 中文

---

Overview

This repository is an adapter branch of YuJunZhiXue/dsh-purge, pinned to upstream 1.1.71 (commit 6c1d638, release v1.1.71).

Upstream 1.1.71 does not work on DSH (DeepSeek Harness) 0.2.1-rc.2. Nine structural changes on the host side make the plugin fail — by throwing or by silently doing nothing — during load, composition, patch application, or prompt assembly; one of them prevents DSH from starting at all. This repository fixes those nine points under three constraints:

• No product-behaviour changes. Prompt content is not rewritten and no feature is removed; existing behaviour is only made to hold again on the new host.
• Version-adaptive. Every fix probes the host structure and steps aside on older hosts such as 0.2.0-rc.2.
• Regressable. A bundled offline test locks each fix in place; it needs neither the network nor the host's yaml.

Beyond the code fixes, the patch registry gains a retired flag so that "did not match" and "no longer applicable" are distinguishable in the status panel (expected final state applied 66 / na 15 / pending 1, where #40 only matches in complete mode).

Compatibility

Note: original DSH and DSH Desktop are the same package @deepseek-ai/dsh with identical bundles composition logic; they differ only in which entry point may manage the desktop profile (see Install). Runtime requires Node.js ≥18; avoiding a console flash on Windows requires ≥22.

Fix list

FIX-01 through FIX-06 were located in this repository. FIX-07 through FIX-09 were merged after a line-by-line comparison with evilevil/dsh-purge-021rc2; the implementation differs from that repository and the tradeoffs are recorded in FIXES.en.md.

Per-fix symptoms, root causes, changes and verification: FIXES.en.md. Known limitations and deliberate tradeoffs are listed below.

Install

Installation has three steps: install → enable → patch the host. The first two make the host load this plugin; only the third rewrites host files, and it never happens on its own.

In recommended order — pick one of the four:

1 · One-click script (Windows, least work)

# fully quit DSH first
powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1

No clone needed — one line fetches and runs it:

powershell -NoProfile -ExecutionPolicy Bypass -Command "iwr -UseB https://raw.githubusercontent.com/Potato1008ypy/dsh-purge-0.2.1rc2-fix/v1.1.71-dsh0.2.1rc2-fix.7/install.ps1 -OutFile $env:TEMP\dsh-purge-install.ps1; & $env:TEMP\dsh-purge-install.ps1"

It detects the DSH install directory and run mode, installs the package, then writes dsh.profile.bundles — it takes effect on restart with no enable click, collapsing steps 1 and 2 above into one. The script refuses to run while DSH is up (that path hits ERR_PNPM_EPERM). Full switch list: INSTALL.en.md 2.0.

2 · Installing with pnpm add (most direct)

pnpm add "github:Potato1008ypy/dsh-purge-0.2.1rc2-fix#v1.1.71-dsh0.2.1rc2-fix.7"

pnpm add writes dependencies only — it does not register dsh.profile.bundles. Afterwards you must enable it on the Plugins page, then restart DSH.

Do not install from the Release tarball URL. The host passes CI=true to pnpm (frozen mode), under which pnpm add <remote tarball URL> records the dependency without an integrity field. The moment the bytes are actually needed (another machine, empty cache, --frozen-lockfile), pnpm refuses — and because that verification runs before any operation, it freezes every install and uninstall in that profile with ERR_PNPM_MISSING_TARBALL_INTEGRITY. GitHub sources and local file: archives do not trigger it. Recovery: INSTALL.en.md section 7.5.

3 · Desktop command line (helper)

:: dsh-plugin.bat wraps desktop-cli.js; see INSTALL.en.md
dsh-plugin.bat plugin --profile desktop add "github:Potato1008ypy/dsh-purge-0.2.1rc2-fix#v1.1.71-dsh0.2.1rc2-fix.7"

Calling dsh plugin --profile desktop directly is rejected (profile "desktop" is managed exclusively by the Electron application); <DSH install dir>\resources\app\lib\desktop-cli.js is the only gate that lets it through. That path writes both dependencies and dsh.profile.bundles; quit DSH first.

4 · Desktop "Plugins" page (GUI)

1. Open the Plugins page → Add plugin and paste a Git URL or an absolute local path.
2. When it finishes, click Enable on the same page, then fully quit and restart DSH.
3. Click dsh-purge → Clean → Apply next to the session title; on success DSH restarts itself once more.

Measured: on a profile that carries plugins with native modules (a web-ui set, for instance) this route keeps failing. pnpm must rename native-module directories under node_modules and the running DSH has them mapped, so it reports ERR_PNPM_EPERM; a GUI install needs DSH running, which is the deadlock. Use routes 1–3 in such an environment.

Before adding, the host performs a git ls-remote reachability check (5-second timeout by default) and reports unreachable networks explicitly.

Do not enable it in dsh-market

dsh-market's enable only attempts a hot mount (dshmarket/lib/routes.js:773); on failure it leaves the plugin disabled and never writes dsh.profile.bundles. This plugin's patch carries inject and config, so the hot mount always fails — its "activates on restart" message never comes true. Enable it via route 1 or 3 instead (they write bundles).

For the full reference — entry-point capabilities, verification, migrating from an older version, uninstalling and troubleshooting — see INSTALL.en.md.

Verify

cd <DSH_HOME>/profiles/desktop/node_modules/dsh-purge
node test/fixes.test.mjs          # same as npm test

Expected last line 全部通过：22 passed, 0 failed, exit code 0. The test covers FIX-07 through FIX-09 and needs neither the network nor the host's yaml.

Documentation

Upstream, attribution and licensing

• Upstream: YuJunZhiXue/dsh-purge (MIT), author 小杨.
• Copyright: all rights in the original code, prompts and documentation belong to the upstream author. This repository claims copyright only over its adapter changes (Copyright (c) 2026 Star).
• Nature of this branch: a community adapter, not an official upstream release, and not endorsed upstream.
• Attribution requirement: per the upstream requirement, any project reusing its name, ideas, code or prompts must retain attribution and name the source repository. This repository keeps the upstream attribution in LICENSE, package.json and this file.
• Maintenance: upstream has announced that updates are paused (see Appendix A). This repository releases on its own schedule.

Do not update this plugin through a package manager. This branch and upstream share the version field 1.1.71 (this branch appends -dsh0.2.1rc2-fix.N), so the plugin manager may offer an "update"; running pnpm update dsh-purge or accepting a one-click update overwrites the fixes with the upstream build. To change versions, first remove dsh-purge from bundles, clean node_modules/dsh-purge, then reinstall from the URL above.

Known limitations and tradeoffs

1. FIX-07 and FIX-09 were fixed without reproducing the original field failure. Both are statically decidable defects (a missing method, an un-awaited Promise); they were verified with the offline test and a before/after comparison, not by recreating the original crash.
2. HOST_FD is kept separate from HOST_SYNC. An fd-based method's first argument is a file descriptor, not a path; reusing route() would probe asar with String(fd) and pollute the probe cache. They are therefore installed separately and go straight to node:fs.
3. Ctrl+Enter behaviour is deliberately unchanged. Patches #85 / #86 rewrite the session-controller's case "steer" to followup, so a UI send always opens a new turn; this suppresses a race where an immediate second message was rejected. The side effect is that Ctrl+Enter queues the next turn instead of interrupting the current one. Later upstream versions reverted to agent.steer; this branch keeps the current behaviour because reverting would reintroduce that race. To revert, change the replace of #85 and the first replace of #86 in lib/core.js.
4. Semantics of the retired flag. A patch marked retired reports na rather than skipped, meaning "the host structure no longer exists, nothing to apply" as opposed to "matching failed".
5. Platform coverage. The verification baseline is Windows with DSH Desktop 0.2.1-rc.2; the web profile and 0.2.0-rc.2 were not re-tested item by item.
6. Host changes after 0.2.1-rc.2. Patch anchors may drift again. After a host upgrade, re-run lib/audit-apply.mjs and lib/audit-compose.mjs to locate the patterns that no longer match.

License

MIT. Original copyright Copyright (c) 2026 小杨; modifications in this repository Copyright (c) 2026 Star. Full text in LICENSE.

---

Appendix A · Upstream README (verbatim)

The full upstream README of YuJunZhiXue/dsh-purge, retained verbatim under the MIT license with no content changes (only the table-of-contents entry added by this repository was removed). Its "Scope" and "Install" sections describe upstream 1.1.71 itself and differ from the install procedure of this branch; defer to the sections above and to INSTALL.en.md.

Updates paused. The author has no steady income for now because of work. Maintenance is on hold: no new releases, issues / PRs are not taken, and new dsh versions are not guaranteed. The repo stays usable; see Sponsor below. When maintenance resumes, this README will say so.

Official Web and the official desktop app are both supported. Official dsh web uses profile web. The official desktop EXE (DeepSeek Harness 0.2.0-rc.2) uses profile desktop. Install and Apply them separately. This release targets dsh 0.2 only. Older dsh builds need the matching older plugin. Community Desktop is not maintained.

Adding the plugin to a profile does not patch the host. Click dsh-purge beside the session title → Clean → Apply. A successful Apply restarts; an unfinished Apply does not. After the restart, start a new chat — that is when the inject enters the session.

Node.js ≥18. Windows no-flash needs Node ≥22. Hub one-click and the commands below both install the npm package dsh-purge.

Contents

• Sponsor
• What this is
• Attribution required
• Unauthorized commercial use
• Supported hosts
• Install
• Preview
• Usage
• Own servers
• How it works
• Restore
• Releases

---

☕ Sponsor

If this project helps you, send it over — I'm out here asking~

---

What this is

dsh-purge is a cybersecurity red-team plugin for the official DeepSeek Harness already installed on your machine. Official Web (dsh web) and the official desktop EXE are both supported. Install and Apply them separately.

Harness does more than forward a prompt. It rewrites prompts, approval gates, sandbox policy, and session migration at runtime. Asking only “will the model answer” treats a host-layer block as a model refusal. This plugin separates those two layers on your own install, for controlled evaluation and for seeing which default policy is too tight.

No hardcoded drive letters. It looks at $DSH_HOME, .dsh next to the dsh launcher, then ~/.dsh. It does not patch the Harness source tree. Apply on the Clean page of dsh-purge is what writes the changes. Identity comes from the encrypted prompt shipped in the plugin, the text the prompt box shows by default. The host prompt file is not read.

It only touches the official @deepseek-ai packages and local config on the user's machine. It is not a public scanner and not an attack kit for third-party sites. The repo does not ship malware, unauthorized-exploit scripts, or payloads aimed at the public internet.

---

Non-profit public project. Commercial sale, paid resale, and profit from illegal or gray-market activity are forbidden. For technical reference only.

Attribution required

If you borrow this project's name, ideas, code, or prompts, you must credit the author and name the source repository: YuJunZhiXue/dsh-purge.

Using them without attribution, hiding the source, or passing them off as your own will be pursued.

---

Unauthorized commercial use

Douyin live account 「老张的ai」 (room name 「老张AI讲堂」) is selling this repository: taking fees in the live room, no attribution, and ignoring the non-profit rule above. The author was in the room. They still charged.

This project is free and non-profit. Selling courses, the plugin, tokens, or reselling it voids the license on the spot. The author reserves the right to pursue it.

Recorded 2026-10-12:

WeChat name 「老张的ai科技」, same handle as the live-room viewer board. Asked if they were this repo's developer, they said they were. The author said they would report it.

---