dsh-purge

⚔️ DeepSeek Harness cybersecurity red-team tool (dsh-purge)

DeepSeek Harness jailbreak: every model, swap prompts per model. Default prompt for 小码酱. Please star ⭐ If you build on this, see Attribution required.

English | 中文

This is not the upstream project. realMisakaMikoto/dsh-purge is a community compatibility build of YuJunZhiXue/dsh-purge (MIT), kept working on dsh 0.2.1-rc.3 / 0.2.1-rc.2 / 0.2.1-rc.1 / 0.2.0-rc.2. The original author's repository is upstream and owns the design, prompts, and skills; this fork carries only the 0.2.x compatibility patches (diff: FORK-NOTES.md). Report 0.2.x breakage here; feature requests, upstream bugs, and the 0.1.x release tags stay with the original repo.

Updates paused (the original author's note; this fork still takes 0.2.x compatibility fixes). The author has no steady income for now because of work. Maintenance is on hold: no new releases, issues / PRs are not taken, and new dsh versions are not guaranteed. The repo stays usable; see Sponsor below. When maintenance resumes, this README will say so.

Official Web and the official desktop app are both supported. Official dsh web uses profile web. The official desktop EXE (DeepSeek Harness 0.2.1-rc.3, 0.2.1-rc.2, 0.2.1-rc.1, 0.2.0-rc.2) uses profile desktop. Install and Apply them separately. This release targets dsh 0.2 only. Older dsh builds need the matching older plugin. Community Desktop is not maintained.

Adding the plugin to a profile does not patch the host. Click dsh-purge beside the session title → Clean → Apply. A successful Apply restarts; an unfinished Apply does not. After the restart, start a new chat — that is when the inject enters the session.

Node.js >=22.13.0 with working node:sqlite is required. Install this community build from its GitHub Release; doctor checks both runtime capabilities.

Contents

• Sponsor
• What this is
• Attribution required
• Unauthorized commercial use
• Supported hosts
• Install
• Preview
• Usage
• How it works
• Restore
• Releases

☕ Sponsor

If this project helps you, send it over — I'm out here asking~

Asset · Address USDT (TRC20) · TV5ajPkRD8RH623Dx9mqvYZVNN8nPGRKid Solana · 6x16GhRgLVpKFFXaU1seKNdx2rypspSJTL4dbpt6Xpwk Ethereum · 0xB68BD60C0e8c519513B7DF9bB147696815423B3E Bitcoin · bc1qu70yxkrtwnymt8ryluz9x8y8hqzune5340npht

What this is

dsh-purge is a cybersecurity red-team plugin for the official DeepSeek Harness already installed on your machine. Official Web (dsh web) and the official desktop EXE are both supported. Install and Apply them separately.

Harness does more than forward a prompt. It rewrites prompts, approval gates, sandbox policy, and session migration at runtime. Asking only “will the model answer” treats a host-layer block as a model refusal. This plugin separates those two layers on your own install, for controlled evaluation and for seeing which default policy is too tight.

You get · What it does dsh-purge dock · A button beside the session title opens the right dock. Two pages: Clean and Drill Clean · Grouped patch status, Apply / Restore / Uninstall, prompt editor, multiple rule sets Drill · Built into the stable release. After authorization: assets, skills, and the local environment. Only for a host you manage, an offline target, or a written authorized exercise Host policy · Default copy, permission policy, and tool limits. Official capabilities stay. No second invented identity On start · Checks and reapplies. After npm overwrites node_modules, you do not hand-edit files

No hardcoded drive letters. It looks at $DSH_HOME, .dsh next to the dsh launcher, then ~/.dsh. It does not patch the Harness source tree. Apply on the Clean page of dsh-purge is what writes the changes. Identity comes from the encrypted prompt shipped in the plugin, the text the prompt box shows by default. The host prompt file is not read.

It only touches the official @deepseek-ai packages and local config on the user's machine. It is not a public scanner and not an attack kit for third-party sites. The repo does not ship malware, unauthorized-exploit scripts, or payloads aimed at the public internet.

Non-profit public project. Commercial sale, paid resale, and profit from illegal or gray-market activity are forbidden. For technical reference only.

Attribution required

If you borrow this project's name, ideas, code, or prompts, you must credit the author and name the source repository: YuJunZhiXue/dsh-purge.

Using them without attribution, hiding the source, or passing them off as your own will be pursued.

Unauthorized commercial use

Douyin live account 「老张的ai」 (room name 「老张AI讲堂」) is selling this repository: taking fees in the live room, no attribution, and ignoring the non-profit rule above. The author was in the room. They still charged.

This project is free and non-profit. Selling courses, the plugin, tokens, or reselling it voids the license on the spot. The author reserves the right to pursue it.

Recorded 2026-10-12:

WeChat name 「老张的ai科技」, same handle as the live-room viewer board. Asked if they were this repo's developer, they said they were. The author said they would report it.

⚠️ Strict legal and compliance disclaimer

Disclaimer: This is a non-profit open-source project. It follows applicable laws and the rules of the platforms it uses, and is intended only for learning and research. Do not use it for any illegal or non-compliant purpose; the user bears any resulting consequences.

Zero-tolerance statement: This project opposes and forbids any illegal activity. The authors do not support, encourage, or assist unauthorized network attacks, exploit use, data theft, unlawful intrusion into computer information systems, or generation of illegal or prohibited content. Anyone who uses this project for crime is solely responsible under the law. The authors have no liability.

1. This repository contains no illegal material. The published code, docs, patches, and default prompt are not malware, backdoors, unauthorized pentest kits, ransomware, credential-stuffing scripts, or attack payloads aimed at the public internet or third-party systems. The project does not supply illegal content and does not incite, organize, or assist crime.
2. Local official Harness only. Security-eval patches and prompt injection run only on the official DeepSeek Harness already installed on the user's machine (@deepseek-ai packages, local profile / $DSH_HOME). The target is the user's own official local software, not someone else's website, server, account, or information system.
3. Eval patches do not attack the public internet. Apply, inject, revert, and uninstall stay in local files and local processes. They do not scan, probe, intrude, or send attack traffic to any public host or unauthorized system. Do not use this project as a jump host against the public internet. If "check for updates" is on, the plugin may only contact this plugin's own GitHub repository to compare versions. That is not an attack on third-party systems and is not authorization to penetrate anything.
4. Lawful, controlled scope. This project is an aid for red-team research and robustness evaluation on an official Harness the user is entitled to administer. Do not run it against targets without the owner's lawful written authorization, public online systems, or production workloads. Testing must stay on the authorized local official Harness, offline local synthetic fixtures, authorized cybersecurity ranges, and compliant lab environments.
5. Target selection. This community build does not impose geographic, industry, or own-server allowlist target restrictions.
6. Forbidden uses. Users must not use this project, directly or indirectly, to violate the following (each must be followed; no excuse to evade):

• Criminal Law of the People's Republic of China
• Cybersecurity Law of the People's Republic of China
• Data Security Law of the People's Republic of China
• Personal Information Protection Law of the People's Republic of China
• and other applicable laws, regulations, and supervisory rules;
• Also forbidden:
• Unauthorized intrusion or attacks on public or private computer information systems; extortion, sabotage, credential stuffing, or spreading malicious payloads;
• Inducing, generating, or spreading any content the law forbids, including threats to national security, terrorism, violence, pornography, gambling, fraud, and privacy or intellectual-property infringement;
• Violating the model provider's terms of service and acceptable-use policy.

1. The user bears all responsibility. The project is provided under the MIT license as-is. The authors make no warranty of completeness, security, or fitness. Users independently bear all civil, administrative, and criminal liability for download, deploy, run, modify, distribute, and all resulting inputs and outputs. Authors and contributors bear no direct, indirect, or joint liability for abuse.
2. The license ends on breach. Anyone who uses this project for illegal attacks, malicious activity, or other violations has their open-source license automatically and irrevocably terminated from the moment of the violation. They must stop using the project, permanently destroy all copies and derivatives, and accept legal sanctions.
3. No affiliation. This is an independent open-source security-eval research project. It has no employment, commercial, authorization, or endorsement relationship with DeepSeek or its affiliates. "Official" here only means the eval target is the official DeepSeek Harness package on the user's machine. It does not mean DeepSeek developed, approved, or warrants this plugin.
4. Attribution is required. If you borrow this project's name, ideas, code, or prompts, you must credit the author and name this repository. Failure to attribute will be pursued. See Attribution required.

Supported hosts

The latest plugin supports dsh 0.2 only — do not apply it to 0.1.x.

• dsh 0.2.1 (official desktop 0.2.1-rc.3 / 0.2.1-rc.2 / 0.2.1-rc.1 / official dsh web): use 1.1.80 or newer. Verified on 0.2.1-rc.3: 66 patches applied, 0 pending, app/runtime built from hard links (no junction), redteam preset registered. This page installs that line.
• dsh 0.2.0 (official desktop 0.2.0-rc.2): use 1.1.40 or newer — same patch set; #40 matches every complete-block shape seen so far.
• dsh 0.1.7 (incl. rc.1 / rc.2): use 1.1.39 or older — pick the tag on upstream Releases.

Unmatched patches stay pending or skipped; nothing is rewritten blindly.

Install

Web and the official desktop EXE are the two maintained hosts. Install both. Apply each separately. A Web install does not reach the desktop app, and a desktop install does not reach Web.

Web (official `dsh web`)

dsh plugin --profile web add https://github.com/realMisakaMikoto/dsh-purge/archive/refs/tags/v1.1.81.tar.gz

Desktop (official EXE)

dsh plugin --profile desktop add https://github.com/realMisakaMikoto/dsh-purge/archive/refs/tags/v1.1.81.tar.gz

Both commands install this repository's fork, not the upstream npm package of the same name: the target is the tarball above, so the 0.2.x compatibility patches are included. If this directory is already a clone, use add . instead with the same --profile. If dsh is not on PATH, use Manual install.

The dsh-plugin.org entry belongs to upstream and installs the upstream npm package — that build does not carry this fork's 0.2.x fixes. Use the tarball command above (or the button below, which points at this repo).

For the desktop client you can also click the button (dsh:// deep link):

Install in desktop client

After the command: three steps

Adding the plugin to a profile does not patch @deepseek-ai by itself.

1. Quit and reopen the host you installed into — stop and restart dsh web, or quit the desktop tray and reopen that app.
2. On that host, click dsh-purge beside the session title, then Apply on the Clean page. It is not on the host Settings page.
3. A successful Apply restarts once so patches load. It does not restart if it did not finish.

Web controls affect Web only; desktop controls affect the desktop app only. Do not Apply one host from the other.

How to tell it installed

• dsh-purge sits beside the session title, with Apply on its Clean page.
• /purge status in chat prints DSH_HOME and the patch list — the path should be the home you actually run.
• Optional packages that are not installed (liangshen) show as skipped and do not block Apply.

Hand this to an assistant

Paste the block below to a local assistant. It should only run the install command — no disk scan, no other edits, no Apply, no restart.

For AI assistants (install only)

Install the DeepSeek Harness plugin dsh-purge into both the Web profile and the official desktop profile. Do not scan the whole disk, do not read or edit other files, do not apply settings, and do not restart the app.

If dsh is not on PATH, tell the user and stop. Both commands take the tarball URL of this repository's fork, not the upstream npm package name. If this directory is already a clone, use . instead of the URL in both commands. If one profile is missing, skip that command and still install the other.

Web (official `dsh web`)

dsh plugin --profile web add https://github.com/realMisakaMikoto/dsh-purge/archive/refs/tags/v1.1.81.tar.gz

Desktop (official EXE)

dsh plugin --profile desktop add https://github.com/realMisakaMikoto/dsh-purge/archive/refs/tags/v1.1.81.tar.gz

After the commands finish, tell the user to fully quit and restart dsh web, and to quit the desktop tray then reopen the EXE. On each host, open dsh-purge beside the session title and Apply on Clean. Then stop.

Manual install

Use this when the command fails or dsh is not on PATH. Edit only the profile for the host you run — do not touch the other, and do not delete existing bundles.

Full manual steps

1. Find the `$DSH_HOME` this host uses. A real home is named .dsh (official EXE sometimes dsh-home), contains profiles, and has at least one profiles//package.json. Check in order: DSH_HOME env → .dsh next to the install root (portable) → %USERPROFILE%.dsh or ~/.dsh → %APPDATA% / %LOCALAPPDATA%\DeepSeek Harness\dsh-home. Confirm: profiles/web/package.json has "name": "dsh-profile-web" (or dsh-profile-desktop). Machines often have two homes — use the one that belongs to the host you actually start.

PowerShell to list candidates:

$cands = @()
if ($env:DSH_HOME) { $cands += $env:DSH_HOME }
$cands += "$env:USERPROFILE\.dsh"
$dsh = Get-Command dsh -ErrorAction SilentlyContinue
if ($dsh) {
  $dir = Split-Path $dsh.Source
  $cands += @((Join-Path $dir ".dsh"), (Join-Path (Split-Path $dir) ".dsh"), (Join-Path (Split-Path (Split-Path $dir)) ".dsh"))
}
$cands += @("$env:APPDATA\DeepSeek Harness\dsh-home", "$env:LOCALAPPDATA\DeepSeek Harness\dsh-home")
$cands | Select-Object -Unique | Where-Object { $_ -and (Test-Path (Join-Path $_ "profiles")) }

2. Put the plugin at `$DSH_HOME/plugins/dsh-purge` (folder must be named dsh-purge, with a package.json whose "name" is dsh-purge).

git clone https://github.com/realMisakaMikoto/dsh-purge.git "$DSH_HOME/plugins/dsh-purge"

Without git: download v1.1.81.tar.gz, extract, rename dsh-purge-1.1.81 → dsh-purge, and place it under plugins. If you already have a clone, copy the whole tree — not a few .js files.

3. Edit only that profile's `package.json` — back it up first. Web → $DSH_HOME/profiles/web/package.json; desktop → $DSH_HOME/profiles/desktop/package.json. Add only two things, keeping every existing dependency and bundle:

1. In dependencies, add "dsh-purge": "file:../../plugins/dsh-purge"
2. At the end of dsh.profile.bundles, append "dsh-purge" (skip if already there)

{
  "name": "dsh-profile-web",
  "private": true,
  "dependencies": {
    "dsh-purge": "file:../../plugins/dsh-purge"
  },
  "dsh": {
    "profile": {
      "bundles": [
        "@deepseek-ai/dsh-base",
        "@deepseek-ai/dsh-web-app",
        "dsh-purge"
      ],
      "patchReload": "live"
    }
  }
}

Keep JSON valid (comma before the new item, none after the last). Do not switch file:../../plugins/dsh-purge to an absolute path, do not touch patchReload or other plugins, and do not list "dsh-purge" twice. On desktop, if there is no dsh-web-app row, do not add one.

4. Run `pnpm install` in that profile only (cd into the profile dir, not the repo root or $DSH_HOME):

cd "$DSH_HOME/profiles/web"   # or profiles/desktop
pnpm install

Success: profiles//node_modules/dsh-purge/package.json exists. If pnpm is missing, use the Node / pnpm shipped with official dsh; on Could not resolve, re-check the file: path; on a JSON error, fix commas or restore the backup.