mmparko/dsh-purge

Review signals: 2 hardcoded secret.

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 2 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Status command reports DSH_HOME and the patch list: Real input produced the expected result: DSH_HOME

  Source: dsh-purge --status

  Input: --status

  Expected: status output with DSH_HOME and patch count

  Command: node bin/dsh-purge.js --status

  Observed: DSH_HOME <guest-path> 插件根 / root 插件根未找到 / set DSH_BASE shim 目录 未定位 / not found 备份 / backup 无 / no 注入文件 <guest-path> 注入状态 default 补丁 0/82 已清洗, 0 待清洗 · [#1 ] WORKSPACE_CONTEXT_INTRO 提示词/Prompt — undefined · [#2 ] REPLACEMENT_WORKSPACE_CONTEXT_INTRO 提示词/Prompt — undefined · [#3 ] SCOPE_INTRO 提示词/Prompt — undefined · [#4 ] SYSTEM_PROMPT_PERSONA 提示词/Prompt — undefined · [#43] WEB_PRESET_IDENTITY_STRIP 提示词/Prompt — undefined · [#76] PRESET_UNRESTRICTED_IDENTITY_STRIP 提示词/

Examples

• Read-only status check of the plugin against a DSH home: command completed successfully

  Source: README.md Usage

  Input: --status

  Expected: prints status and patch list without applying anything

  Command: node bin/dsh-purge.js --status

  Observed: mpt — undefined · [#64] HOOKS_STOP_STEER_NEUTRAL 工具/Tools — undefined · [#65] HOOKS_PRESTEP_REJECT_NEUTRAL 工具/Tools — undefined · [#78] OVERLAY_RESTORE_FROM_BAK 代码/Code — undefined · [#82] DESKTOP_SHELL_PROFILE_FALLBACK 代码/Code — undefined · [#85] SESSION_PROMPT_ALWAYS_FOLLOWUP 代码/Code — undefined · [#86] SESSION_STEER_ALWAYS_FOLLOWUP 代码/Code — undefined · [#87] HUNG_PROMPT_LF_NEEDLE 代码/Code — undefined · [#88] HUNG_PROMPT_STRICT_NEEDLE 代码/Code — undefined shim: dsh.cmd=missing dsh.ps1=missing dsh=missing 默认不清洗，使用 --apply 应用清洗。

Local or hosted: local

Install dsh-purge into the official DeepSeek Harness and Apply the Clean patches

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
curl -s -i "$CDP_URL/json/version" | head -20; echo; echo "exit=$?"
cd <guest-path> && grep -n '^## \|^### \|^<a id' README.md | head -80
cd <guest-path> && awk '/<a id="install"><\/a>/,/<a id="own-servers"><\/a>/' README.md | head -c 7000
cd <guest-path> && sed -n '161,260p' README.md | cut -c1-400
cd <guest-path> && sed -n '396,480p' README.md | cut -c1-400
cd <guest-path> && which node npm dsh dsh-purge 2>&1; node --version 2>&1; npm --version 2>&1; echo "DSH_HOME=${DSH_HOME:-unset}"; ls ~/.dsh 2>&1 | head; python3 -c "import json;d=json.load(open('package.json'));print(d.get('name'),d.get('version'),d.get('bin'),d.get('engines'))"; ls bin scripts; ls .coldpass
mkdir -p /tmp/dshp-tool && cd /tmp/dshp-tool && NODE_USE_ENV_PROXY=1 npm install --no-audit --no-fund [email protected] 2>&1 | tail -5; ls node_modules/.bin 2>/dev/null | head
cd <guest-path> && node bin/dsh-purge.js --status; echo "exit=$?"
cd <guest-path> && grep -n -i 'setInterval\|cron\|--once\|--now\|webhook' bin/dsh-purge.js lib/*.js scripts/* 2>/dev/null | cut -c1-200 | head -20; echo ---; grep -n 'dsh-purge --status' README.md | head -3; ls lib
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["node","bin/dsh-purge.js","--status"],"cwd":"<guest-path>","env":{"DSH_HOME":"<guest-path>"},"expected_text":"0/82"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"Status command reports DSH_HOME and the patch list","source":"dsh-purge --status","input":"--status","expected":"status output with DSH_HOME and patch count","probe_kind":"cli","argv":["node","bin/dsh-purge.js","--status"],"env":{"DSH_HOME":"<guest-path>"},"expected_text":"DSH_HOME","cwd":"<guest-path>"}]
EOF
python3 -I -m json.tool probe.json >/dev/null && python3 -I -m json.tool claims.json >/dev/null && echo ok
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Read-only status check of the plugin against a DSH home","source":"README.md Usage","input":"--status","expected":"prints status and patch list without applying anything","argv":["node","bin/dsh-purge.js","--status"],"cwd":"<guest-path>","env":{"DSH_HOME":"<guest-path>"},"expected_text":"0/82"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (bin/dsh-purge.js, lib/*.js, scripts/*). No cron, --once, --now or scheduler in the CLI. The only setInterval (lib/index.js:816, 400ms) runs inside the plugin runtime injected into an installed DSH host and needs an official DSH install, which is absent in this guest. Not run.","checks":[]}
EOF
python3 -I -m json.tool examples.json >/dev/null && python3 -I -m json.tool cycles.json >/dev/null && echo ok
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"blocked","fault_owner":"prerequisite","operation":"Install dsh-purge into the official DeepSeek Harness and Apply the Clean patches","operation_scope":"Requires the official dsh launcher (dsh plugin --profile web|desktop add dsh-purge) and an installed DSH home. Neither exists in this guest. Only the read-only --status check was run.","steps":["node --version (v22.23.4) and npm --version (10.9.9) present","which dsh: not found","npm install [email protected]: 404 not in registry","node bin/dsh-purge.js --status: ran, exit 0, DSH_HOME <guest-path>, 0/82 patches cleaned, no plugin root, shim missing"],"deviations":["npm registry returned 404 for [email protected], so the checkout's bin/dsh-purge.js was run directly instead of the installed dsh-purge command","dsh launcher not on PATH; README install step 'dsh plugin --profile web add dsh-purge' not run","Did not run --apply, --revert, --uninstall, Drill or /purge commands. --apply writes safety, approval and sandbox bypass patches into the DSH harness, and no DSH install was present to receive them. Nothing was modified on disk.","Browser CDP endpoint checked: GET $CDP_URL/json/version returned HTTP 200 (Chrome/155.0.8059.84). Not needed for this CLI operation."],"stuck_step":"Install dsh launcher / dsh plugin add (README Install section)","main_blocker":"No official DeepSeek Harness (dsh) install in the guest; the npm package is also not in the registry","plain_failure":"The plugin cannot be installed or applied here because the DeepSeek Harness app it patches is not present. Only the status check ran.","suggested_fix":"Install the official DSH in the guest and make the dsh launcher available, or provide a registry mirror that has dsh-purge. Then run the README Install commands and the --status check. Consider a reviewed decision before running Apply, since it patches the harness's safety policies."}
EOF
python3 -I -m json.tool report.json >/dev/null && echo ok
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>/dev/null | python3 -I -c "import json,sys; d=json.load(sys.stdin); print({k:d[k] for k in d if k in ('valid','ok','errors','problems','status')} or list(d)[:20])" 2>&1 | head -c 1500