DSH AuthMux
One login plane. Many model subscriptions.
简体中文
AuthMux is a DSH-native OAuth multiplexer. It puts subscription-backed model providers behind one compact sign-in surface, while DeepSeek Harness Core continues to own credentials, settings, model routes, and token refresh.
AuthMux in DSH Settings
Why AuthMux
- One surface for every OAuth flow registered by DSH Core.
- No private credential store — grants live in
dsh-credentials-local.
- No duplicate model adapter — requests stay on Core
llm-pi-ai.
- No custom HTTP server — the browser uses loopback-fenced DSH Connection RPC.
- Provider differences stay provider-owned — browser callbacks, device codes, PKCE, and refresh logic remain inside the Core flow.
OpenAI Codex is pinned first. The current DSH Core catalog also exposes OAuth flows for Anthropic, GitHub Copilot, Kimi For Coding, OpenRouter, and xAI.
Install
dsh plugin --profile web add github:Q-xuan/dsh-authmux
dsh --profile web
Open Settings → AuthMux, sign in, and select the enabled model from DSH's normal model picker.
Architecture
AuthMux UI
│ DSH Connection RPC (loopback only)
▼
DSH AuthorizationService ──► provider-owned OAuth flow
│
├──► DSH Credentials / GrantRecord
└──► llm-pi-ai Settings ──► DSH model picker and requests
AuthMux owns only the browser interaction bridge and the UI. It does not own model transport or OAuth token refresh.
Migration from dsh-simple-oauth
On first start, AuthMux detects $DSH_HOME/simple-oauth.json, imports valid credentials into llm-pi-ai/<provider> Core records, enables their model routes, and renames the legacy file to simple-oauth.json.migrated as a recovery backup.
Security
- OAuth payloads never cross into the browser.
- Refresh runs inside Core's serialized
modifyRecord() path.
- The AuthMux RPC channel is restricted to loopback authority.
- Model tools cannot call the authorization surface.
Treat every provider subscription according to that provider's terms and billing rules.
Development
npm ci
npm run verify
verify runs TypeScript checks, tests, Host and Web builds, and a package dry run.
License
MIT
