DeepSeek Harness 'Armor-Breaking' Mod dsh-purge Reaches 19.5K Stars

Project Overview: dsh-purge Modifies DeepSeek Harness Internals

Third-party developers have begun altering the underlying rules of DeepSeek Harness before the official Creator Mode launched. The project dsh-purge (GitHub: https://github.com/HunYiSage/dsh-purge) targets the local installation of DeepSeek Harness, adjusting system prompts, permission approvals, sandbox policies, and tool execution limits to give developers greater control over agent behavior. Since its first public commits in August, the repository has accumulated 19.5K stars and 4,600 forks , with the latest release at v1.1.92.

Core Modules: Clean and Drill

The project provides two primary functional modules:

Clean – A management interface for system prompts, rule files, and patches. Developers can directly edit the system prompts injected by Harness, switch rule sets per model, and manage configuration files such as AGENTS.md and CLAUDE.md. It also adjusts approval rules for terminal commands, file operations, and sub-agent execution to reduce task interruptions caused by permission restrictions.

Drill – Designed for authorized local security testing, offering asset management, test environment orchestration, a skill library, and a knowledge base.

Unlike pure prompt engineering, dsh-purge directly patches the locally installed @deepseek-ai packages and configuration files , applying binary patches to alter Harness runtime rules. Clean supplies Apply, Restore, and Uninstall operations for patch lifecycle management. A backup and recovery mechanism skips or flags unmatched patches when official Harness upgrades change file structures, avoiding forced modifications.

Installation: Web and Desktop Clients

dsh-purge supports both the official Web runtime and the desktop client, but each requires a separate installation. For users who can already run the dsh command in a terminal, the project provides one-line plugin installation commands:

# Web version
dsh plugin --profile web add https://codeload.github.com/HunYiSage/dsh-purge/tar.gz/refs/heads/master

# Desktop version
dsh plugin --profile desktop add https://codeload.github.com/HunYiSage/dsh-purge/tar.gz/refs/heads/master

After installation, the corresponding DeepSeek Harness client must be fully restarted. The dsh-purge entry appears next to the session title, opening a right-side panel. Status verification and rollback are available via:

# Check status
dsh-purge --status

# Revert patches
dsh-purge --revert

The README explicitly warns against installing via the plugin marketplace or using pnpm add dsh-purge.

Development History: From Layoff to Community Maintenance

The original author, known as "Xiao Yang", announced a halt to public GitHub updates after a layoff, intending to move future releases to Telegram. However, a maintenance team subsequently took over the project, keeping it open source and maintaining a rapid release cadence:

v1.1.83 / v1.1.84 (Oct 30) – Refined system prompt handling and sub-agent approval mechanisms. v1.1.84 introduced a system prompt tail anchor that appends identity and formatting rules to the end of the prompt, and attempted to take over part of the sub-agent approval flow to resolve persistent rejections by host permission rules.

v1.1.91 (Nov 5) – Adapted to DeepSeek Harness 0.2.1-rc.5 while retaining compatibility records for 0.2.1-rc.2. Fixed an issue where dsh could lose executable permissions after applying or restoring patches on Linux and WSL, and addressed repeated pnpm 12 build approval prompts.

v1.1.92 (Nov 5) – Integrated 23 red-team skills into the open-source distribution package. The skills cover active scanning, internal network probing, web fingerprint identification, Nuclei vulnerability detection, and other high-risk attack techniques. The maintainers state that all skill files are included in both the npm package and the release archive, while POC/EXP knowledge bases are generated at runtime from local templates and manual entries. The open-source version now contains all features previously reserved for a paid tier, with no additional payment required.

Limitations and Emerging Trend

The article notes that published features and changelogs do not guarantee every permission restriction can be bypassed; actual effectiveness depends on the local Harness version and runtime environment. Nevertheless, a clear trend is emerging: from the official Creator Mode opening plugin creation to third-party developers rewriting Harness execution rules, developers increasingly want to define not only what an agent can do, but also how much execution authority it possesses.