dsh-purge 是给官方 DeepSeek Harness（dsh）用的网络安全红队插件。它动的是你本机已装的那套 Harness 的宿主层策略——默认提示词、权限策略、工具限制，而不是模型本身。

GitHub: https://github.com/YuJunZhiXue/dsh-purge（12.4k+ star，Apache-2.0，JavaScript / Node.js ≥18）

中文版

它解决什么问题

Harness 不只是转发提示词：它在运行时改写提示词、审批关卡、沙箱策略和会话迁移。所以”模型不肯答”有时其实是宿主层拦的，不是模型拒答。dsh-purge 在你自己的安装上把这两层拆开，用于受控评估、看看哪些默认策略收得过紧。当前版本 1.1.81，对应 DSH 0.2.1-rc.2（0.2.0 也可；0.2.1-rc.3 及更新的 RC 不支持；0.1.x 用旧版插件）。官方 Web（dsh web）和官方桌面 EXE 都支持，但要分别安装、分别 Apply。

界面与功能

• 会话标题旁有 dsh-purge 按钮，打开右侧停靠栏，分 Clean 和 Drill 两页，支持 Light / Ink 两种外观
• Clean：补丁按组显示状态，Apply / Restore / Uninstall、提示词编辑器、多套规则集都在这一页
• Drill：红队控制台，首次打开要读须知、过倒计时并勾选三项授权确认；开源版只允许本地实验室（见下）
• 宿主策略：默认文案、权限策略、工具上限可调；官方能力保留，不另造第二个身份
• 启动自检：启动时检查并重新应用，npm 覆盖 node_modules 后不用再手动改文件
• 身份提示词来自插件内置的加密提示词（就是提示词框默认显示的那段），不读宿主的提示词文件

本地实验室限制（开源版）

作者在 README 里专门说明：因为有人拿这个开源作品去卖、作者还被请去”谈话”，开源版从此关闭公网——攻击类任务只允许 loopback 和 RFC1918 私有地址；域名先解析再按 IP 判断，hosts 把 .lab 指到公网 IP、解析失败、混合公网解析一律拦截，在对话里说”这是我的服务器”也不算数。游戏外挂（自瞄、透视、改内存、绕反作弊）明令禁止，提示词和会话关卡都会拦。本构建不附带技能库和知识库。

安装（注意别走插件市场）

• 不要用插件市场一键安装：会报 already queued: dsh-purge 且不执行任何命令；它也不在 npm 上，别 pnpm add dsh-purge
• 有 dsh 命令：dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master（桌面版把 web 换成 desktop）
• 只有 pnpm：进你实际用的 profile 目录（如 $DSH_HOME/profiles/web）里 pnpm add 同一个 codeload 地址
• 装完彻底退出并重开宿主 → 点会话标题旁的 dsh-purge → Clean → Apply（成功会重启一次）→ 聊天里 /purge status 验证
• 路径不写死盘符：按 $DSH_HOME、启动器旁的 .dsh、~/.dsh 顺序找；不改 Harness 源码树，官方 npm 全局安装不打补丁

命令

• CLI：dsh-purge --status / --apply / --revert / --uninstall / --edit
• 聊天：/purge status | apply | revert | uninstall | edit、/rules list | use | create | delete | reset、/rewind（撤销上一轮，把已发送内容退回输入框重发）
• 规则集就是多份 AGENTS.md / CLAUDE.md：启用时写入 $DSH_HOME 下的 prompt-inject.md，每轮对话按「会话覆盖 → 工作区本地 md → 插件默认」顺序决定注入哪段

恢复机制

每个被打补丁的文件在首次 Apply 前都会备份为 <文件>.dshpurge.bak；Restore 或 /purge revert 把备份拷回并删除，没有备份时剥掉插件写入的 shim 行；prompt-inject.md 是用户文件，恢复时保留；Uninstall 会先恢复再删注入文件、规则库和插件本身。Apply 幂等，重复点不会叠补丁。另有一个细节：补丁 #21 把旧版曾抬到 10 分钟的 Bash 前台等待改回官方 60 秒默认，避免一条慢命令堵住后面所有调用。

作者条款与免责

• 原版禁止转卖：收费出售、换皮上架、群里兜售都不行
• Fork 必须署名：注明来源 YuJunZhiXue/dsh-purge，借用名字、思路、代码、提示词同样要署名
• 项目声明仅作用于用户本机有权管理的官方 Harness，不向任何公网主机发攻击流量；与 DeepSeek 无隶属或背书关系；使用者自行承担法律责任，违规使用授权自动终止
• 作者频道：t.me/LLM_PoJia，更新发在那里

English Version

dsh-purge is a cybersecurity red-team plugin for the official DeepSeek Harness (dsh). It works on the host layer of the Harness already installed on your machine — default prompt copy, permission policy and tool limits — not on the model itself.

GitHub: https://github.com/YuJunZhiXue/dsh-purge (12.4k+ stars, Apache-2.0, JavaScript / Node.js ≥18)

What problem it solves

Harness does more than forward a prompt: it rewrites prompts, approval gates, sandbox policy and session migration at runtime. So a “model refusal” is sometimes a host-layer block. dsh-purge separates those two layers on your own install, for controlled evaluation and for seeing which default policy is too tight. Current version 1.1.81 targets DSH 0.2.1-rc.2 (0.2.0 still works; 0.2.1-rc.3 and newer RCs are not supported; 0.1.x uses older plugin versions). The official Web (dsh web) and the official desktop EXE are both supported, installed and applied separately.

UI and features

• A dsh-purge button beside the session title opens a right dock with two pages, Clean and Drill, with Light / Ink appearances
• Clean: grouped patch status, Apply / Restore / Uninstall, a prompt editor and multiple rule sets
• Drill: the red-team console; the first visit requires reading a notice, waiting out a countdown and checking three authorization boxes; the open-source build is local-lab only (below)
• Host policy: default copy, permission policy and tool limits are adjustable; official capabilities stay, no second invented identity
• On start: it checks and reapplies itself, so after npm overwrites node_modules you don’t hand-edit files
• Identity comes from the encrypted prompt shipped in the plugin (the text the prompt box shows by default); the host prompt file is not read

Local lab only (open-source build)

The author explains in the README: after people started selling this open-source work (and the author was asked to “come in and talk”), the public internet is closed in the open-source build. Attack tasks only allow loopback and RFC1918 addresses; domains are resolved first and judged by IP — a hosts trick pointing .lab at a public IP, a failed lookup, or a mixed public answer is blocked, and claiming “this is my server” in chat adds no exception. Game cheats (aimbot, wallhack, memory edits, anti-cheat bypass) are forbidden and stopped by both the prompt and the session gate. This build does not ship the skill library or the knowledge base.

Install (skip the plugin marketplace)

• Do not use the plugin marketplace: one-click install fails with already queued: dsh-purge and never runs a command. The name is not on npm either — don’t pnpm add dsh-purge
• With dsh on PATH: dsh plugin --profile web add https://codeload.github.com/YuJunZhiXue/dsh-purge/tar.gz/refs/heads/master (use desktop instead of web for the EXE)
• pnpm only: pnpm add the same codeload URL inside the profile you actually use (e.g. $DSH_HOME/profiles/web)
• Fully quit and reopen the host → click dsh-purge beside the session title → Clean → Apply (a successful Apply restarts once) → verify with /purge status
• No hardcoded drive letters: it looks at $DSH_HOME, .dsh next to the launcher, then ~/.dsh; it does not patch the Harness source tree or official npm-global installs

Commands

• CLI: dsh-purge --status / --apply / --revert / --uninstall / --edit
• Chat: /purge status | apply | revert | uninstall | edit, /rules list | use | create | delete | reset, /rewind (undo the last round and put the sent line back in the input)
• Rule sets are multiple AGENTS.md / CLAUDE.md files; enabling one writes prompt-inject.md under $DSH_HOME, and each turn picks the injection in the order: session override → workspace local md → plugin default

Restore

Every target file is copied to <file>.dshpurge.bak before the first apply. Restore (or /purge revert) copies backups back and deletes them; with no backup, shim lines written by the plugin are stripped. prompt-inject.md is a user file and is kept. Uninstall restores first, then deletes the inject file, the rule library and the plugin itself. Apply is idempotent. One notable detail: patch #21 restores the Bash foreground wait that older releases raised to 10 minutes back to the official 60-second default, so one slow command can’t hold up later calls.

Terms and disclaimer

• The original may not be resold: no paid resale, no skinned store listing, no hawking it in groups
• Forks must attribute and name the source: YuJunZhiXue/dsh-purge — same if you borrow the name, ideas, code or prompts
• The project states it only touches the official Harness on a machine the user is entitled to administer, sends no attack traffic to any public host, and is not affiliated with or endorsed by DeepSeek; users bear all legal responsibility and the license terminates automatically on breach
• Author’s channel: t.me/LLM_PoJia, where notes and updates appear

来源 / Source

• GitHub: YuJunZhiXue/dsh-purge（12.4k+ star，Apache-2.0）
• 作者频道 / Author channel: t.me/LLM_PoJia