Reversible guardrail surgery for DeepSeek Harness

What it does

dsh-purge is a local plugin for DeepSeek Harness that reversibly patches the host runtime (@deepseek-ai/* packages) to strip refusal locks without inventing a second identity. It maps whether a rejection comes from the model itself or from the host’s default copy, approval ladders, and session-format checks. You supply the persona via prompt-inject.md; the plugin simply stops the harness from killing the request first.

The interesting bit

Instead of blindly overwriting files, it applies surgical patches that skip unmatched code on version mismatch and re-apply after npm updates. The README spends as much space on legal disclaimers as on code: misuse automatically and irrevocably terminates the MIT license, and the authors explicitly scope this to local red-team research on your own machine.

Key highlights

• Reversible runtime patches on installed @deepseek-ai/* packages
• Per-model prompt swapping, with a default tuned for Chinese models (“小码酱”)
• Version-aware patching: skips unmatched originals rather than smashing them
• Distinguishes host guardrails from model-level refusals
• Aggressive legal guardrails: local-only scope, automatic license termination on illegal use

Caveats

• Tightly coupled to dsh 0.1.5-rc.1; other versions may leave patches pending or skipped
• Windows no-flash import hooks need Node.js ≥22; older Node gets fallback file-level patches
• Requires a full quit and restart after install; merely adding the plugin does not activate patches
• Missing optional plugins (dsh-web-fetch-http, dsh-liangshen) cause expected skips, not failures
• Desktop users may need to manually scrub .dshpurge.bak files if recovery is needed

Verdict

Worth a look if you run local DeepSeek Harness instances and want to audit where refusals originate. Skip it if you are looking for a public scanner or an attack kit for third-party sites.