73 Patches, Free Rollback in Case of Breakage: Open-Source Plugin DSH Unbound Gives You Back Full Control Over AI Tools
Local AI programming tools like DeepSeek Harness are being integrated into the daily workflows of a growing number of developers. However, the behavioral boundaries of these tools — what prompts are allowed, which operations are permitted, and how to roll back if something breaks — are mostly unilaterally determined by the manufacturer. An undergraduate student of the class of 2027 has developed an open-source plugin that aims to return this layer of control to end users.
1. The Solidified Configuration Layer
The capability boundaries of AI programming tools are mostly hardcoded in their codebase.
Taking DeepSeek Harness as an example, it rewrites prompts at runtime, sets approval thresholds, and defines the scope of the sandbox. The only adjustments users can make are the toggles on the UI, while the parameters that truly determine the tool's behavior are inaccessible to ordinary users.
The issues are concentrated in three aspects: system prompts are solidified by the host, making it impossible to implement team specifications; approval granularity, sandbox scope, and tool paths are determined by upstream providers with no intermediate adjustment options; behavioral changes brought by version upgrades cannot be partially rolled back.
"Many people mistake host interception for model rejection," said the project developer, the two layers are mixed together, making troubleshooting extremely difficult.
This misalignment is particularly prominent in security evaluation scenarios — if it is impossible to distinguish whether the operation is rejected by the model itself or blocked by the host in the middle, the evaluation conclusion will be meaningless.
2. Extract the Configuration Layer to Build a Rollbackable Patch System
The approach of DSH Unbound is to add an independent configuration management layer on top of the host, separating the previously mixed behavioral logics.
The first module is prompt injection, which is responsible for saving and restoring system prompts, and injecting context connection snippets during conversations. The configurations are stored locally on the device, and will not overwrite the user's existing content during installation.
The second module is patch management, which is the most heavyweight part of the entire project — it contains 73 classified patches, each of which allows users to view the current status, apply or restore individually. All patches are implemented to be idempotent, so repeated execution will not cause overlapping effects; the original files are automatically backed up before application, so users can roll back if anything goes wrong; if the original content does not match after an upgrade, the patch will be skipped instead of modifying files arbitrarily.
The third module is execution control, which writes approval policies, sandbox scopes, tool paths and Hooks processing into the configuration layer. These settings can be overwritten by the UI, without locking the environment variables.
The fourth module is the drill workspace, which includes 10 modules such as asset mapping, environment configuration, agents, and session tunnels. Data is stored in local SQLite and shared across sessions. This module is decoupled from the first three modules at the code level, and can be customized and trimmed independently.
A technical tradeoff has been made: zero runtime dependencies. Except for the framework package provided by the host, all other functions are implemented using Node's built-in modules.
"No internet connection is required to pull dependencies during installation, there is no supply chain risk, and it can be used directly in intranet environments," said the project developer. The tradeoff is that some functions need to be developed from scratch, such as SQLite access, compression and unpacking; the benefit is deployment certainty — the tool can run immediately after installation, and will not crash due to dependency version conflicts.
To turn "usable" into "verifiable", the project has established 22 regression checks covering key paths such as prompt compatibility, backup integrity, status judgment, diagnostic export, and plugin registration, which are automatically executed on four test matrices consisting of Windows, Linux and Node 20, 22. All check items are auditable and reproducible, without relying on manual judgment.
In addition, the diagnostic export adopts a field whitelist mechanism, the output content does not contain private prompts, account credentials, target addresses or original paths, and automatic upload is disabled by default.
3. Open Source, Free of Charge, No Plan for Monetization
The project is open-sourced under the MIT license, with all code and installation packages made public: 66 module files, 53,158 lines of code, 31 documents, and the installation package is 909 KB.
There is no paid version, no enterprise edition, and no commercial licensing is accepted.
This choice is made for two reasons. The first is upstream license requirements — the project is modified based on another open-source plugin dsh-purge, which explicitly requires attribution for secondary development and prohibits commercial sales. This project follows the stricter requirement, and fully retains the upstream copyright statement and source description. The second is product attribute — the value of a configuration management tool lies in its usability, not scarcity.
"To achieve continuous improvement, we need more people to use it," he said, charging fees will directly limit the coverage of the tool.
The target users are divided into three groups: individual developers who need a stable working environment, small technical teams that require consistent configurations, and security research and teaching scenarios that need a reproducible drill environment.
The project is currently at v1.0.0, with a team of only one person. The developer is an undergraduate student of the class of 2027, who has internship experience in AI product operation, and regularly practices AI Agent and AIGC toolchains. Requirement definition, code development, test verification, document writing, release and maintenance of the project are all completed by him alone.
The next step is to expand the adaptation for more host versions, supplement FAQ documents, and introduce external contributors to reduce the risk of single-person maintenance. The project does not seek financing.
"What we lack most right now is not capital, but people who actually use it and tell me what is wrong."
Project Information
Project Name: DSH Unbound
Project Positioning: A runtime enhancement layer for DeepSeek Harness, providing prompt injection, local patches, execution control and drill workspace
Launch Date: October 2026
Current Version: v1.0.0
Open Source License: MIT (non-commercial, no paid version available)
Tech Stack: Node.js / JavaScript, zero runtime dependencies
Team: 1 person (Project Initiator / Independent Developer)