dsh-cloudflare-access: Cloudflare Access Authentication Plugin for DeepSeek Harness

dsh-cloudflare-access is a plugin that runs inside the DeepSeek Harness (DSH) process to securely validate the legitimacy of remote access requests. It reads and verifies JWT headers injected by Cloudflare Access and uses them as authentication tokens, enabling remote management of privileged features such as Settings and Credentials. The plugin supports Profile Bundle + Web Client mode and does not provide a login page or password storage. Installation requires a Web profile, with Team Domain and Audiences configured via environment variables. It is recommended that only Cloudflare be allowed to access the Origin, and JWTs are not mandatory for loopback addresses.