GitHub repositories · by ruvnet

ruflo-deepseek-harness

Name: ruflo-deepseek-harness
Author: ruvnet

DeepSeek chat and reasoning completions as ruflo skills (see `commands/ruflo-deepseek-harness.md`).

ruvnet@ruvnet

ruvnet/ruflo/tree/main/plugins/ruflo-deepseek-harness

Translated

About this mod

This plugin exposes DeepSeek chat and reasoning completions as ruflo skills, and since this version it is also a function-hook mod (ADR-445 pattern; requires Claude Code 2.1.287 or later). It never calls the network or spawns a process, and it only tightens: it can refuse a call but never allow one.

Guard (default on): refuses Bash commands that run this plugin's chat.mjs/reason.mjs (which post the prompt to api.deepseek.com) when they contain a key, token or password. The refusal reason names the kind of secret, never the value.
/deepseek-mod: answered locally with no model turn: status, scan <text> (would the guard refuse this?).
Status file: .claude-flow/deepseek-mod/status.json ({version, updatedMs, guard, blocked}), written at session start and when a call is blocked.
Option: guard (on | off, default on) in the plugin's userConfig.

Test it with claude plugin test plugins/ruflo-deepseek-harness and bash plugins/ruflo-deepseek-harness/scripts/smoke.sh.

Installation

Check the author's README for the marketplace and plugin name first. Commands may change as the repository evolves.

claude plugin marketplace add ruvnet/ruflo
claude plugin install ruflo-deepseek-harness

Original text / README

ruflo-deepseek-harness

DeepSeek chat and reasoning completions as ruflo skills (see commands/ruflo-deepseek-harness.md).

As a mod

Since this version the plugin is also a function-hook mod (ADR-445 pattern; needs Claude Code 2.1.287 or later). It never calls the network or spawns a process, and it only tightens: it can refuse a call, never allow one.

Guard (default on): refuses Bash commands that run this plugin's chat.mjs/reason.mjs (they post the prompt to api.deepseek.com) that hold a key, token or password. The reason names the kind of secret, never the value.
/deepseek-mod: answered locally, no model turn: status, scan <text> (would the guard refuse this?).
Status file: .claude-flow/deepseek-mod/status.json ({version, updatedMs, guard, blocked}), written at session start and when a call is blocked.
Option: guard (on | off, default on) in the plugin's userConfig.

Test it: claude plugin test plugins/ruflo-deepseek-harness and bash plugins/ruflo-deepseek-harness/scripts/smoke.sh.

Project information

Author: ruvnet
Use cases: Security & privacy
Added: Oct 5, 2026
Source updated: Oct 5, 2026
Stars: 73,887
Permission footprint: L2
views: 0

claude-codedeepseekguardhookspluginruflosecret-detection

Report this work Is this your work? Claim it

Permission footprint

Automatically scanned data. Review the source before installing. Levels describe capabilities, not a safety certification.

Write files
Intercept tool calls
Read files
Execute commands

View matches (5）

Write files · line16 lineplugins/ruflo-deepseek-harness/hooks/register.tsawait $.fs.write(`${s.root}/${STATUS_PATH}`, statusText(s.stats, s.opts.guard, await $.clock.now()))

Intercept tool calls · line42 lineplugins/ruflo-deepseek-harness/hooks/register.tson('tool.call', async ($, e, next) => {

Read files · line58 lineplugins/ruflo-deepseek-harness/hooks/register.tslist: path => $.fs.list(path),

Execute commands · line108 lineplugins/ruflo-deepseek-harness/hooks/screen.tsconst hit = re.exec(text)

Execute commands · line118 lineplugins/ruflo-deepseek-harness/hooks/screen.tsconst pass = /^[^:]+:\/\/[^\s:@/]+:([^\s@/]+)@/.exec(url)?.[1]

ruflo-deepseek-harness

About this mod

Installation

ruflo-deepseek-harness

As a mod

Similar projects

ruflo-bbs-federation

blast-radius

honmoon-redact