dsh-prompt-drift
System-prompt surface drift gate for
DeepSeek Harness (dsh).
Any plugin or preset can contribute sections to the assembled system prompt.
Upgrading one can silently rewrite what the model is told; a malicious
one can inject "ignore all safety rules" straight into the prompt. This
plugin hooks the system-prompt/assemble waterfall, hashes every section
(name → sha256(text)), baselines the surface, and diffs every later
assembly against it. dsh-mcp-test guards what the model can call; this
guards what the model is told. Zero LLM calls in the trust path.
Why now (checked 2026-10-12)
Empty lane. The nearest neighbour (dsh-modelprint, 0★) fingerprints model
config, not the prompt surface. Prompt-injection plugins scan content
flowing in; nobody watches the assembled prompt itself — the one channel
every plugin can write to without anyone reviewing a diff.
How it works
system-prompt/assemble ──> sections [{name, sha256(text)}] name-sorted
──> baseline absent? freeze it (commit the file)
──> diff: added / removed / changed sections
──> warn once per distinct drift (signature dedup)
Dynamic sections (cwd, timestamps) can be excluded via ignoreSections.
Baseline file is stable, name-sorted JSON — commit it; it is the contract.
Install
dsh plugin --profile default add github:zhengqiuyang/dsh-prompt-drift
Prebuilt lib/ ships in the repo — git installs need no build step and no
allowBuilds authorization.
Configure
- id: dsh-prompt-drift
name: dsh-prompt-drift
config:
baselinePath: .dsh-prompt-drift/baseline.json
rebaselineOnDrift: false
ignoreSections: []
Develop
npm install && npm test
Kill criteria
If dsh ships first-party prompt-surface pinning, this freezes at its last
working version with a postmortem here.
