DeepSeek Harness Plugin

Run API relay audits from DeepSeek Harness

The v2.4.0 DSH bundle registers /relay-audit on compatible web and cc-tui profiles, reuses the selected route, and keeps credentials out of command arguments.

API Relay Audit does not certify that a relay is safe. Results remain local evidence with explicit clean, anomaly, and inconclusive states.

Install the immutable release

DSH_PLUGIN_REF=v2.4.0
dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"
dsh plugin --profile cc-tui add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"

Run the audit

# Lower-cost route and credential check
/relay-audit --connectivity

# Full 14-step audit
/relay-audit

# Profile-gated Web3 relay audit
/relay-audit --profile web3 --fast-context

Runtime boundaries

The plugin requires the DSH profile loader and @deepseek-ai/dsh-commands registry.
The selected route must identify as Claude; current identity and stream baselines are Claude-specific.
The credential is resolved on every invocation and passed to the local child process through API_RELAY_AUDIT_KEY, not argv.
Reports are written under the current session workspace by default.

Evidence scope

The plugin preserves separate API relay audit, prompt injection audit, model substitution signals, and Web3 relay audit query families. Model identity is a consistency signal, not standalone provider proof. The v2.4.0 release was installed in isolated web and cc-tui profiles and passed fake-relay connectivity and secret-sentinel scans.

Review the exact tool versions, commit resolution, standalone hash, and test boundary in the v2.4.0 distribution verification.