dsh-kimi
中文文档 | English
Kimi (Kimi Code account) integration bundle for DeepSeek Harness (DSH).
Adds Kimi as a first-class model provider to any DSH profile — provider route, models,
device-code login, and automatic token refresh. No manual settings editing required.
Features
- Provider route —
kimi provider over https://api.kimi.com/coding/v1 using the
OpenAI Responses protocol (pi-ai adapter), with four models:
kimi-for-coding (K2.7 Coding), kimi-for-coding-highspeed, k3 (1M context), k3-256k.
- Login — Kimi Code device-code OAuth flow. dsh owns an independent OAuth session:
its refresh-token family never touches the Kimi Code CLI's tokens, so refreshing here
can never log the CLI out.
- Auto refresh — tokens are kept alive automatically (checked every 5 minutes,
refreshed before expiry); the access token is stored in the
KIMI_CODE_ACCESS_TOKEN
credential ref, which the pi-ai adapter resolves per request.
- Agent tools —
kimi_login_begin, kimi_login_status, kimi_login_refresh.
- Future-proof — if the host provides the
authorization service, the same device
flow is registered as an authorization flow for llm-pi-ai/kimi (Models page sign-in).
Install
# local bundle
dsh plugin --profile web add /path/to/dsh-kimi
# or from npm/GitHub releases, once published
# dsh plugin --profile web add dsh-kimi-provider
Restart the DSH Web process. Then log in once:
- Ask the agent to run
kimi_login_begin (or use the Models page once authorization
is available) — you get a Kimi authorization URL + device code.
- Open the URL in your browser and confirm.
- Done: the picker shows the four Kimi models; tokens refresh automatically.
Works in any profile that mounts dsh-base (web, headless, …) — install per profile:
dsh plugin --profile headless add /path/to/dsh-kimi
How it works
cordis.patch.yml — patch layer: configures the llm-pi-ai row with the kimi
provider profile (protocol, base URL, models) and inserts the kimi-login row.index.js — the plugin main module: device-code login, credential storage
(KIMI_CODE_ACCESS_TOKEN + KIMI_CODE_REFRESH refs), auto-refresh timer, agent tools,
optional authorization flow registration.
Security
- Tokens live in the DSH credentials store (
~/.dsh/.credentials.yaml, mode 0600).
- The refresh token is stored only in the
KIMI_CODE_REFRESH credential ref (JSON string),
never in source or logs.
- dsh's OAuth session is separate from the Kimi Code CLI's — no cross-session token rotation.
Compatibility
- DSH Host 0.1.2-alpha.4 (or any version with the pi-ai LLM adapter,
dsh plugin bundles,
and the credentials service).
- Node.js ≥ 22.19;
curl available for the OAuth HTTP calls.
