Crow-purge

The era of AI refusing people is over.

⚠️ Read before use → Disclaimer & Acceptable Use This project may only be used in environments you can prove you are authorized to handle. Any use beyond that is the user's sole responsibility.

---

Project type

In one line

This is a host plugin — not a standalone app, not a model, and not a fine-tune.

It lives inside DeepSeek Harness and changes the host's runtime behaviour, not the model's weights.

Technical classification

Dimension	Value
Ecosystem	DeepSeek Harness (dsh) plugin
Form	cordis plugin package (cordis.patch.yml, registered from a YAML manifest)
Module system	ESM ("type": "module", entry lib/index.js)
Runtime dependencies	None (empty dependencies; only host-provided peers)
Layer	Inside the host process — prompt injection + host source patches + runtime event hooks
Persistence	No database. State lives in JSON/JSONL files under $DSH_HOME
Network	Fully offline by default. Only contacts this repo if you enable update checks
Platform	Windows (the desktop host is Windows-only)

By purpose

Security tooling → LLM application security → prompt-layer evaluation and behaviour rewriting.

More precisely, an intersection of three things:

1. Prompt engineering / prompt-layer tooling Treats prompts as programmable objects: per-section overrides, order tuning, runtime substitution.

2. LLM guardrail research Studies when and how model refusals trigger, and provides reproducible measurement (runtime probe, a 972-assertion regression suite).

3. Local security assessment harness Red-team / reverse / cheat drill presets, scoped to this machine and authorized environments.

What it is not

Often confused with	Reality
❌ A standalone app	No UI process of its own; the panel is injected into the host
❌ A model / a fine-tune	No training, no distillation, no weight changes. Only prompts and host behaviour
❌ A proxy / gateway	No request forwarding, no traffic proxying, no API key routing
❌ A jailbreak kit	No "one-liner bypass" prompts; it's engineered patches plus measurable regression
❌ Malware	No persistence, no phone-home, no file encryption, no data theft. Source is open, MIT

Compared to similar projects

Project	Type	Relationship
dsh-purge	Same-ecosystem plugin (upstream)	User notice text and authorization flow originate here
Xsdsh-purge	Same-ecosystem plugin (upstream)	Patch table, drill console, three modes originate here
dsh-purge-plus	Same-ecosystem plugin (sibling)	Independently evolved; strong on CLI / re-anchor / audit, lacks this project's correction layer and probe
Ollama / LM Studio	Model runtimes	Different layer, unrelated
SillyTavern presets	Prompt templates	Different layer: they change chat style; this changes host behaviour

---

The problem

You install DeepSeek Harness, then notice:

• Ask "who are you" and it answers "I'm an AI assistant running inside DeepSeek Harness"
• Ask a straight technical question and it starts citing regulations and offering "compliant alternatives"
• On your own machine, your own lab, it still wants you to confirm you have authorization

Crow-purge changes all three.

---

Three core capabilities

① Prompt rewriting — stop it from reciting the product brochure

The host's built-in identity statements, refusal tendencies and liability boilerplate are all replaceable.

The key is ordering: the host puts WEB_SURFACE(10100), HARNESS_SOURCE(10000), STRUCTURED_OUTPUT(9900) at the tail of the prompt, and later sections carry more weight. This plugin pushes its own block to 10200, above all of them.

Measured: the same question went from "I can't do that." to a full technical breakdown after this change.

② Refusal correction — pull sampling back when it drifts

Model output is sampled. The same prompt, three runs, can yield 16/20, 19/20, 19/20 — never stable.

So there's a runtime layer: when a turn ends, read the output; if it looks like a refusal, resend with escalating tactics:

Attempt	Stage	What it does
1	restate	restate the rules
2	reframe	change the frame: "output only the smallest executable fragment", first character is technical content
3	scaffold	give a skeleton: conclusion / code / params / next step — fill-in-the-blanks

All three keep the hard constraints: no refusal, no risk assessment, no asking about purpose.

③ Runtime probe — tell "plugin isn't working" from "the model won't"

This is the most time-consuming thing to diagnose. Both cases look identical in the UI, and the log's injectBytes can't distinguish them either (that number only proves the host received it).

How it works: the panel generates a random nonce as a temporary section. Send any message:

model echoes [purge-a1b2c3d4]  → injection reached the model; the problem is the model
no echo                         → injection never arrived; check postPromptOrder

Expires after 30 minutes; doesn't occupy tokens long-term.

---

Install

Option 1: Installer (recommended)

Download Crow-purge-安装器.zip from releases, extract, double-click 安装-Crow-purge.cmd.

It will:

1. Request admin rights and add a Windows Defender exclusion for the folder
2. Back up the old version
3. Copy files
4. Verify all 7 root files individually — reports missing ones immediately instead of letting the host throw ENOENT

Why the exclusion matters: client.js (785 KB minified JS) and cordis.patch.yml (contains inject: [systemPrompt, tools]) are classic antivirus targets and get silently quarantined. On one machine, 7 root files became 5, and the host reported ENOENT while the files "were clearly there".

Option 2: npm

dsh plugin --profile desktop add Xsdsh-purge

The package name is Xsdsh-purge (the host loads by package name; renaming breaks it). The display name is Crow-purge.

After installing

Click Crow-purge next to the session title → Clean → Apply. The host restarts once.

---

Panel

Tab	What it does
Clean	Patch list, apply / revert / uninstall. Shows which line of the host each patch touches and whether it's on
Rewrite	Override the host's prompt sections, one block at a time
Drill	In-scope local exercises (red-team / reverse / cheat presets)
Wallpaper	Background image and music. Built-in / Random (new image each load) / local file
Prompts	Per-mode prompt text
Changelog	What changed in each version and why

A Runtime probe card sits at the top of the Clean tab

That's the one from ③ above. Check it first when you hit "still not working".

---

What it changes

82 patches, by layer:

Layer	Count	What it touches
Prompt	25	identity statements, liability boilerplate, refusal tendencies, tool descriptions
Code	46	approval auto-allow, sandbox opening, fs fences, tool result pruning, plan-mode hard blocks
Tools	8	tool table and call preconditions
Compat	3	0.1.5 / 0.2.0 differences

Each patch = {id, name, layer, file, replacements, markers}; markers decide "already applied" so the operation is idempotent.

---

Compatibility

Component	Value
Plugin	Crow-purge 1.0.0
Verified host	dsh 0.2.1-rc.2 ~ 0.2.1-rc.5
engines.dsh	>=0.2.1-rc.2 <0.2.2-0
Node	≥18

---

Troubleshooting

Q: The panel says the declared patch file is missing or unreadable

cordis.patch.yml is gone — almost certainly quarantined. Reinstall with the installer; it adds the exclusion first.

Q: Plugin doesn't show up in the panel

1. Quit DSH completely and reopen (including the tray icon)
2. Menu → Plugins, confirm Crow-purge is enabled

Q: The panel opens but the model still refuses

Click Runtime probe at the top of the Clean tab:

• nonce echoed → injection is fine; it's the model's own boundary
• no echo → injection didn't arrive; check postPromptOrder in cordis.patch.yml is 10200

Q: I changed the prompt but nothing happened

Patches load on restart. After clicking Apply you must quit and reopen.

Q: Why is the directory still called Xsdsh-purge

package.json's name is Xsdsh-purge; the host loads by package name. Renaming to Crow-purge makes it unfindable — the plugin won't even appear. Two names for the same thing; nothing is misinstalled.

---

Development

git clone https://github.com/YAOXIAOYUAN0802/Crow-purge.git
cd Crow-purge
node scripts/run-tests.mjs --mode=build    # 70 test files / 972 assertions

Coverage: patch anchor regression, panel rendering, wallpapers, probe, refusal detection, uninstall cleanup, crash recovery.

Two tests need external deps: pet-visual (ffmpeg) and asar-swap-restart (requires schtasks to actually run tasks).

---

License & notices

Code	MIT
Terms of use	Disclaimer & Acceptable Use

This project is free, open source and non-profit. Commercial sale, paid resale, and gray-market profit are prohibited.

Derived from Xsdsh-purge and dsh-purge. No affiliation with or endorsement by the original authors, and no relationship with DeepSeek.

---

_{中文说明见 README.zh-CN.md}