2.0.0

2.0.0

Target DeepSeek Harness 0.1.5-alpha.1. Overlay Cloudflare JWT on the original /api, /api/remote.mux, and index fallback.

A valid Access JWT on a remote trusted host skips DSH's launch-token cookie, including Access login callbacks with sec-fetch-site: cross-site. Loopback still requires the official token.

• Map privileged RPCs to Typert Remote endpoints (settings/describe, agentPresets/deletePreset, and the rest of the 0.1.5 configuration surface).
• Treat /api/remote.mux as the ordinary events WebSocket.
• Peer @deepseek-ai/dsh-client-connection and @deepseek-ai/dsh-host-webserver 0.1.5-alpha.1, plus @deepseek-ai/cordis 4.0.2.

Plugin 1.0.x remains the DSH 0.1.1-rc.2 / pre-0.1.2 line.

v1.0.0

npm: dsh-cloudflare-access@1.0.0

Changes

• Normalize teamDomain to an http(s) origin so a host without https:// still produces a valid issuer and JWKS URL.
• Skip JWT signature verification when it cannot change the allow/deny decision (ordinary=off APIs and failed Host/Origin).
• Skip the prepare build during dependency installs so github: installs use committed lib/ without TypeScript or esbuild.
• Fail CI when committed lib/ does not match a fresh pnpm build.
• Allow 30 seconds of clock skew on JWT exp / nbf so Origin time drift does not reject live Access tokens.
• Return 502 from the privileged HTTP bridge when apiProxy.fetch throws, instead of leaving the client hanging.
• Cover loopback wrap, missing apiProxy, events upgrade denial, unsigned JWT, and future nbf in tests.
• Enable weekly Dependabot for npm and GitHub Actions.
• Use the same 401/403 split on /api/events.* upgrades as on HTTP APIs.
• Stop committing unused lib/client/index.js; the browser runtime is lib/client.js.
• Tighten the README, add a Chinese README, and document architecture figures.

Compatibility

Plugin	DSH	Status
1.0.x	0.1.1-rc.2	Live-tested (Web profile, remote Settings / Credentials)

This release was published to npm without provenance.

v0.1.0

Cloudflare Access JWT verification and remote privileged authorization for DeepSeek Harness.

• Origin re-validation of Cf-Access-Jwt-Assertion
• Remote Settings / Credentials / Agent Preset management / llm.discoverModels
• Ordinary API modes off | optional | required
• Web client capability enablement with dsh.client.immediately: true
• Install: dsh plugin --profile web add dsh-cloudflare-access

npm: https://www.npmjs.com/package/dsh-cloudflare-access