mmparko/dsh-purge

The problem

When a hosted coding harness refuses a request, you cannot tell whether the model declined or whether the host layer — prompt rewriting, approval gates, sandbox policy — intercepted it. Teams doing robustness evaluation on their own install end up guessing, and hand-editing node_modules every time a package upgrade overwrites their changes. dsh-purge packages those host-layer edits as a plugin you can apply, restore and re-apply from a dock inside the official DeepSeek Harness UI.

What's different

The usual approaches are either prompt-only jailbreak collections (which ignore the host entirely) or forking and patching the harness source (which you must rebase forever). dsh-purge sits between them: it ships its own encrypted default prompt, rewrites the host's default permission policy and tool limits in place, and leaves the official capabilities intact without inventing a second identity. It also re-checks and re-applies on startup, so an npm reinstall does not silently undo your setup. Path discovery is based on $DSH_HOME, a .dsh directory next to the launcher, or ~/.dsh — no hardcoded drive letters.

Who it's for

Security researchers and red teams who already run the official Harness locally and want to separate model refusal from host refusal during an authorized evaluation. It is not for people who want a general-purpose jailbreak kit for third-party services: the README explicitly scopes it to the @deepseek-ai packages and local config on your own machine. Casual users looking for uncensored chat should look elsewhere; the install-and-apply flow assumes you understand what a host policy patch changes.

Cost of adoption

Node.js ≥18 (≥22 for the no-flash Windows path), a DSH 0.2.x install, and a manual step: adding the plugin to a profile does not patch anything until you click Apply and restart, then start a new chat for the inject to take effect. The main risk is maintenance, not installation — the README states updates are paused, issues and PRs are not accepted, and newer dsh versions are not guaranteed. Version pinning matters: this release targets dsh 0.2 only, and older builds need matching older plugin versions. The license is MIT, but the README layers on a non-commercial clause and an attribution requirement, which is a tension worth reading before you build on it.

Verdict

This is an 11-day-old mirror with 2,189 stars and 2,765 forks, and the fork-to-star ratio plus the "upstream about to delete the repo" framing suggests a lot of the activity is archiving rather than adoption. The board shows 185 stars per day and a #4 ranking, but it has never appeared on the daily trending board and has no Hacker News discussion, so the momentum looks like a spike around the takedown story, not a sustained curve. The technical idea — patching the host layer rather than the model — is the genuinely interesting part, and the startup re-apply behavior is a real convenience. But a paused project pinned to one dsh minor version is a poor long-term dependency; treat it as a reference implementation to read, not infrastructure to rely on.