dsh-prompt-drift
DeepSeek Harness 的系统提示词表面漂移门禁：为组装后的系统提示词中贡献的每个部分建立基线，并在插件或预设升级静默添加、删除或改写模型收到的内容时发出醒目警告
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:zhengqiuyang/dsh-prompt-drift#9900ac1a66ea08740363a34ece3fd427761362fePrompt Drift 以 dsh-prompt-drift 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →System-prompt surface drift gate for DeepSeek Harness (dsh).
Any plugin or preset can contribute sections to the assembled system prompt.
Upgrading one can silently rewrite what the model is told; a malicious
one can inject "ignore all safety rules" straight into the prompt. This
plugin hooks the system-prompt/assemble waterfall, hashes every section
(name → sha256(text)), baselines the surface, and diffs every later
assembly against it. dsh-mcp-test guards what the model can call; this
guards what the model is told. Zero LLM calls in the trust path.
Empty lane. The nearest neighbour (dsh-modelprint, 0★) fingerprints model
config, not the prompt surface. Prompt-injection plugins scan content
flowing in; nobody watches the assembled prompt itself — the one channel
every plugin can write to without anyone reviewing a diff.
system-prompt/assemble ──> sections [{name, sha256(text)}] name-sorted
──> baseline absent? freeze it (commit the file)
──> diff: added / removed / changed sections
──> warn once per distinct drift (signature dedup)
Dynamic sections (cwd, timestamps) can be excluded via ignoreSections.
Baseline file is stable, name-sorted JSON — commit it; it is the contract.
dsh plugin --profile default add github:zhengqiuyang/dsh-prompt-drift
Prebuilt lib/ ships in the repo — git installs need no build step and no
allowBuilds authorization.
- id: dsh-prompt-drift
name: dsh-prompt-drift
config:
baselinePath: .dsh-prompt-drift/baseline.json
rebaselineOnDrift: false
ignoreSections: []
npm install && npm test
If dsh ships first-party prompt-surface pinning, this freezes at its last working version with a postmortem here.