dsh-purge: a DeepSeek Harness plugin that patches refusal behaviour in the local agent layer

The problem dsh-purge addresses: refusals that come from the host, not the model

When a model runs inside a local agent or harness, the model is only one layer of the stack. The README argues that prompts, approval gates, sandbox policy and session migration all rewrite behaviour at runtime, so asking whether the model will answer a question is not enough if the host layer blocks a lawful evaluation request first. That is the gap dsh-purge targets. It is a local DeepSeek Harness plugin that applies patches to the installed @deepseek-ai packages, which lets you observe which refusals originate from the model and which originate from default copy, approval ladders or session-format checks. The intended user is someone running DeepSeek Harness on their own machine for red-team research or robustness evaluation, not someone probing a hosted service. The README is explicit that this is a local harness plugin and not a public scanner or an attack kit for third-party sites. The project positions itself as a way to keep official capabilities while dropping refusal locks, with the persona defined entirely by whatever you put in prompt-inject.md rather than by a second invented identity.

How the patching mechanism works and what stays pending

The plugin ships a bundle patch declared in package.json under the dsh key, pointing at cordis.patch.yml, and a web client that injects into four @deepseek-ai client packages: dsh-client-connection, dsh-client-runtime, dsh-client-locale and dsh-client-ui-settings. Its peer dependency is @deepseek-ai/cordis at ^4.0.1. The patch model is the part worth understanding before you install. The README states that patches are reversible and that unmatched originals stay pending or skipped, with the explicit claim that nothing is rewritten blindly. In practice that means the plugin matches known source strings in the installed @deepseek-ai tree; when a match fails, for example because the installed dsh version differs from the target, the corresponding patch does not apply. The declared target is dsh 0.1.5-rc.1, and the README notes that on other versions unmatched originals stay pending or skipped. The plugin also accepts the 0.1.2 community dsh-persona text field and the dsh-mnemon v0 session summary field, which suggests it is designed to survive some version drift rather than refusing to run at all. The trade-off is that a partial match produces a partially patched harness, and the README does not describe a verification step beyond checking that /purge status prints the patch list. If you need a guarantee that every intended patch landed, that guarantee is not in the documentation.

Installing dsh-purge and running a first check with /purge status

The README gives two install paths. The fastest is to hand the README to a local coding agent and let it install and operate the plugin; the agent block instructs the agent to execute immediately rather than advise. The manual path uses the dsh CLI against a profile. Web and desktop install the same plugin into different profiles, so if you use both, run both commands. The README gives this example for the web profile:

dsh plugin --profile web add https://github.com/YuJunZhiXue/dsh-purge/archive/refs/heads/master.zip

For the desktop profile the command changes only the profile name:

dsh plugin --profile default add https://github.com/YuJunZhiXue/dsh-purge/archive/refs/heads/master.zip

After the add command, the README states that you must fully quit and restart DeepSeek Harness before the Rules card appears. Adding the bundle does not patch the @deepseek-ai packages by itself; you still need to press Apply. The README repeats this as a standalone warning: after install you still need Apply plus restart. The environment requirements are a dsh CLI on PATH, Node.js >= 18, and reachable github.com. The README also notes that Windows no-flash import hooks need Node >= 22 registerHooks, while older Node versions still get file-level windowsHide patches. Once the restart and Apply are done, the success condition the README names is that /purge status prints the patch list. That command is the first thing to run, because a missing or short list tells you the patch step did not complete rather than that the plugin failed to install.

Version drift, pending patches and the case where dsh-purge is the wrong tool

The clearest limitation is version coupling. The declared target is dsh 0.1.5-rc.1, and the README's own wording is that on other versions unmatched originals stay pending or skipped. A pending patch is a silent partial state: the plugin is installed, the Rules card appears, Apply runs, and yet some refusal behaviour is unchanged because the source string it expected was not there. Nothing in the README describes an alert that distinguishes a clean apply from a partial one, so the patch list printed by /purge status is the only signal you get. The second limitation is upgrade survival. The README claims patches re-apply after npm overwrites node_modules, but that claim is about re-applying to a tree that still matches; a dsh release that changes the patched strings moves you back into the pending case. The third limitation is scope. This is a local harness plugin, and the README states it is not a public scanner and not an attack kit for third-party sites. If your goal is to test a hosted endpoint, a production service or someone else's system, this project is the wrong tool by its own description. The heavy legal disclaimer in the README, including the clause that misuse terminates the license automatically and irrevocably, is a signal about how narrow the author considers the intended scope to be.

How dsh-purge differs from prompt-level jailbreak collections

The alternative most people reach for is a prompt collection: a set of jailbreak strings you paste into a chat or drop into a system prompt. The difference in approach is where the change happens. A prompt collection operates on the model's input, so it cannot tell you whether a refusal came from the model or from the harness around it, and it does nothing about approval gates or session-format checks. dsh-purge operates on the installed @deepseek-ai packages, so the change happens below the prompt. That is also why it can accept a persona file, prompt-inject.md, and why the README says persona is whatever you put there rather than a fixed second identity. The cost of that approach is the coupling described above. A prompt collection is portable across hosts and versions because it does not touch source; dsh-purge is tied to dsh 0.1.5-rc.1 and to the exact strings it patches. If you want something that travels across harnesses, a prompt collection is the better fit. If your question is specifically which layer refuses, patching the local harness is the only one of the two that can answer it.

Licence terms, upgrade cost and what the disclaimer changes

The package is MIT licensed, and the LICENSE file sits at the repository root alongside README.md and README.zh-CN.md. The MIT grant is not the whole story here, because the README adds its own terms on top: a zero-tolerance notice against illegal use, a requirement that testing stay on your authorized local Harness install, offline local synthetic fixtures, or authorized cyber-range and lab environments, and a clause stating that anyone who uses the project for illegal attacks or malicious activity loses the open-source license automatically and irrevocably from the moment of the violation, with an obligation to stop and destroy all copies and derivatives. Whether that added clause is enforceable alongside the MIT text is a question for a lawyer, not for this article. What matters operationally is that the author has narrowed the stated scope well below what MIT alone would permit, and that a compliance reviewer reading the repository will see it. The upgrade cost follows from the same coupling: every dsh release is a potential re-verification, and the README gives no migration guide beyond the note that unmatched originals skip. Budget time after each harness upgrade to re-run /purge status and confirm the patch list is what you expect.

Editorial conclusion

Adopt dsh-purge if you already run DeepSeek Harness locally for red-team or robustness work and you want to separate model-level refusals from host-layer guardrails. Do not adopt it if you need a scanner for third-party or production targets, if you are pinned to a dsh version other than 0.1.5-rc.1, or if you cannot accept that a package upgrade can leave patches pending. Verify first that your dsh CLI reports 0.1.5-rc.1, that Node is at least 18, and that /purge status prints the patch list after Apply and a full restart.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. YuJunZhiXue/dsh-purge on GitHub