dsh-anthropic-oauth
Bridge your existing Claude Code OAuth session (Pro / Max / Team) into DeepSeek Harness (DSH) — with zero hardcoding.
- Reads
~/.claude/.credentials.json claudeAiOauth live (same file Claude Code writes)
- Auto-refreshes
accessToken via https://platform.claude.com/v1/oauth/token when <5 min remains
- Syncs
ANTHROPIC_OAUTH_TOKEN (+ CLAUDE_CODE_OAUTH_TOKEN alias) into ~/.dsh/.credentials.yaml — the credential seam dsh-llm-pi-ai already resolves
- Ensures
llm-pi-ai.providers.anthropic (api: anthropic-messages) exists in ~/.dsh/settings.yaml
- Pulls the model catalog live from
GET /v1/models (id, display name, context window, max output, thinking/effort capabilities) — no hardcoded model list; new Claude releases appear automatically
- Sends the current Claude Code request identity (up-to-date OAuth beta set +
claude-cli impersonation headers) with no real user identifier — cch is a zeroed placeholder
- Billed to your subscription, not a console API key (
Bearer + oauth-2025-04-20)
- Live quota panel: shows your subscription's 5-hour and 7-day usage with a reset countdown, read from the
anthropic-ratelimit-unified-* headers on a cheap max_tokens:1 probe (these headers ride only on /v1/messages, never /v1/models)
This does not embed or persist your tokens beyond the two standard DSH/Claude files.
Quota display
In the DSH web UI, the plugin's client half docks a themed quota panel in the composer's ambient readout slot (conversation.composer.dock) — non-invasive (touches no shell chrome) and theme-aware (uses --dsw-* tokens, so it adapts to light/dark):
- 5h / 7d bars with per-window utilization (green → amber ≥70% → red ≥90%)
- live reset countdown to the representative (usually 5-hour) window
- Check quota button forcing a fresh probe (also refreshes after every completed Anthropic turn, with a 60s fallback poll)
- model-aware: the panel only appears while the session's active model routes through the Anthropic provider. Switch to a non-Anthropic model (Qwen, DeepSeek, GLM, …) and it hides itself; switch back and it returns — read live from the shared model-selection directory, so it reacts immediately. If the model-selection service is unavailable, the gate is skipped (panel shown) rather than hidden forever.
The client half is authored directly in the DSH client-bundle format (window.__ModuleLoader__.load) and served verbatim — no bundler or build step. It reads two JSON endpoints the host half serves:
| Endpoint | Purpose |
|---|
GET /api/anthropic-oauth/status | Bridge state + last rateLimit snapshot (folded into lastAuthState) |
GET /api/anthropic-oauth/quota | Live quota (60s TTL); ?force=1 or POST bypasses the cache |
The quota probe spends a negligible amount (Haiku, 1 output token) and is throttled to 60s + manual refresh.
Install
# stable — from npm (once published):
dsh plugin --profile headless add dsh-anthropic-oauth
dsh plugin --profile web add dsh-anthropic-oauth # optional; bridge is headless but harmless in web
# bleeding edge — from GitHub:
dsh plugin --profile headless add github:TrueNix/dsh-anthropic-oauth
Prerequisites
Claude Code logged in: claude login or claude setup-token at least once — ~/.claude/.credentials.json must contain claudeAiOauth- DSH
~0.1.0-rc.6+ (has dsh-llm-pi-ai, credentials, settings, fs)
How it works
~/.claude/.credentials.json --watch--> dsh-anthropic-oauth Host plugin
claudeAiOauth {accessToken, refreshToken, expiresAt}
│
refreshIfNeeded() if expiry <5m
POST https://platform.claude.com/v1/oauth/token
{grant_type: refresh_token, client_id: 9d1c25…f5e}
│
├─► ~/.claude/.credentials.json (updated expiry)
└─► ~/.dsh/.credentials.yaml
ANTHROPIC_OAUTH_TOKEN: sk-ant-oat01-…
CLAUDE_CODE_OAUTH_TOKEN: sk-ant-oat01-…
└─► GET /v1/models (live catalog)
→ llm-pi-ai.providers.anthropic.models
[{id, name, contextWindow, maxTokens,
reasoning, effortLevels}, …]
~/.dsh/settings.yaml llm-pi-ai.providers.anthropic {apiKeyEnv: ANTHROPIC_OAUTH_TOKEN}
│
└─► pi-ai anthropicMessagesApi — Authorization: Bearer sk-ant-oat01-…
anthropic-beta: oauth-2025-04-20,claude-code-20250219,…
The model catalog is refreshed from GET /v1/models (≤6h TTL, or on demand via
POST /api/anthropic-oauth/sync); if discovery fails the provider keeps a minimal
Sonnet-4.5 seed so it still resolves offline. Quota is probed from
POST /v1/messages (max_tokens:1, Haiku — fractions of a cent, 60s TTL)
and exposed at /api/anthropic-oauth/quota.
Set as default model
# ~/.dsh/settings.yaml
agent-default-model:
provider: anthropic
model: claude-sonnet-4-5
Or pick per-session in Settings → Models after a reload.
Logs & manual sync
# DSH console (bridge + quota probe):
# [anthropic-oauth] pulled N models from /v1/models
# [anthropic-oauth] refreshed, new expiry …
# Force-refresh the model catalog (also syncs quota):
curl -X POST http://127.0.0.1:3080/api/anthropic-oauth/sync
# Live quota (60s TTL; ?force=1 bypasses cache):
curl http://127.0.0.1:3080/api/anthropic-oauth/quota
curl "http://127.0.0.1:3080/api/anthropic-oauth/quota?force=1"
Troubleshooting
MISSING_CREDENTIAL llm-pi-ai: no credential for provider route "anthropic" — bridge hasn't synced yet; re-login with claude login.- 401 from Anthropic — token expired and refresh failed;
claude login again.
- Quota
ok:false with a refresh error — subscription may have changed; re-login, then check /api/anthropic-oauth/quota?force=1.
Security
- Never commits tokens —
.gitignore excludes *.oat*, *.credentials.*.
- Tokens live only in
0600 files owned by you: ~/.claude/.credentials.json and ~/.dsh/.credentials.yaml.
- A Feb-2026 Anthropic docs note declares Pro/Max OAuth for official clients only — personal use at your own risk; use a console
ANTHROPIC_API_KEY for production.
License
MIT
