dsh-openai-codex-auth
简体中文 | English
Adds an openai-codex model provider to
DeepSeek Harness. Sign in
with an eligible ChatGPT subscription instead of an OpenAI Platform API key.
Only one plugin should own an LLM provider route. Enabling two implementations
of openai-codex causes an adapter registration conflict.
This includes DSH 0.2.0-rc.2's built-in llm-pi-ai.providers.openai-codex
route: do not configure it alongside this plugin. Coexistence is not supported;
enabling both prevents this plugin from activating.
OpenAI Codex settings in English
Features
- ChatGPT sign-in through the OpenAI Codex OAuth device-code flow.
- Codex models in the DSH model selector, with model-specific reasoning levels.
- Local credential storage and automatic token refresh.
- Login status, rolling usage windows, reset times, and Credits in Settings.
- Reset-card counts, expiry dates, and per-card redemption with confirmation.
- Switch between DSH transport and Windows manual system proxy without restarting.
Requirements
- DSH
0.2.0-rc.2 Web or Windows Desktop (the tested host version).
Also supports DSH 0.2.1-rc.2 with host pi-ai 1.1.0 or 1.3.0,
and DSH 0.2.1-rc.5 Web with host pi-ai 1.4.0.
- Node.js
>=22.19.0 for CLI installations; Desktop includes its own runtime.
- A ChatGPT subscription eligible for Codex, with device-code sign-in enabled.
Models come from the host's pi-ai catalog. DSH 0.2.0-rc.2 ships pi-ai
0.87.1, which includes GPT-6 Sol and GPT-6 Luna. Model availability still depends on your account. This plugin does not
replace the host's model catalog or install a second provider runtime.
Install or update
CLI / Web
dsh plugin --profile web add dsh-openai-codex-auth
Restart DSH after installing or updating.
Windows Desktop
In Desktop's plugin manager, install dsh-openai-codex-auth@0.6.4.
The manager installs into the active Desktop profile and activates the bundle;
no separate global Node.js, pnpm, or CLI installation is needed.
If an update requests a restart, restart Desktop before checking the new UI.
Desktop 0.2.0-rc.2 carries its own DSH runtime and uses the separate desktop
profile. Installing into web does not install into Desktop. Keep
dsh.client.platform: web: Desktop renders the same Web plugin UI.
The following CLI alternative applies only to Desktop 0.2.0-rc.2;
0.2.1-rc.2 reserves the Desktop profile for the app, so use its plugin manager.
Open Desktop once to initialize its profile, then fully quit it, including
the tray process, before using its bundled CLI from PowerShell:
$desktopDsh = "$env:LOCALAPPDATA\Programs\DeepSeek Harness\resources\runtime\cli\bin\dsh.cmd"
& $desktopDsh plugin --profile desktop add dsh-openai-codex-auth@0.6.4
Adjust the path for a custom installation. Do not substitute an npm-installed
dsh for this command. Restart Desktop and open Settings → OpenAI Codex.
Use the same CLI with plugin --profile desktop remove dsh-openai-codex-auth
to uninstall after fully quitting Desktop.
Plugin 0.6.4 supports DSH 0.2.0-rc.2, 0.2.1-rc.2, and 0.2.1-rc.5. For DSH 0.1.7-rc.2, use plugin
0.4.2 instead. Do not bypass compatibility checks.
Validation covers isolated installation, the bundled Desktop runtime and Web
settings/RPC. Native Electron window interactions and real OAuth/model requests
are not part of the automated verification.
From source
The following targets CLI / Web. For Desktop, use its bundled CLI with
plugin --profile desktop add . after fully quitting the app.
npm install
dsh plugin --profile web add .
The package is a DSH bundle, so no separate install script is required.
Usage
- Open Settings → OpenAI Codex and select Sign in with ChatGPT.
- Open the verification page, enter the displayed device code, and authorize.
- Select a model under OpenAI Codex in the model selector.
DSH agents can also call codex_login, codex_status, and codex_logout.
Reset cards
Below usage, the card shows the available reset count and each available Codex
card's expiry in your local time, earliest first. Each row has its own Use reset
button targeting that specific card; confirmation shows its expiry.
Missing expiry or failed detail reads are
shown explicitly, not as zero cards. Use reset opens a confirmation dialog;
only confirming sends a request that may consume one account-wide card.
The server determines which eligible limits reset. Uncertain results
must be retried with the same request; do not start another reset in another window.
This uses a private ChatGPT backend contract and is best-effort. Redemption has
only been tested with mocks, never with real cards.
Network proxy
Choose Settings → OpenAI Codex → Proxy; new requests switch immediately
(stored as this plugin's proxyMode configuration):
host (default): follow DSH. Configure HTTPS_PROXY / HTTP_PROXY / ALL_PROXY
and NO_PROXY before launch, or in $DSH_HOME/.env.system: use the current Windows user's manual HTTP/HTTPS system proxy and
bypass list for sign-in, token refresh, usage and model requests. Model requests
use SSE, not WebSocket. OAuth runs in an isolated Worker; host environment
variables and the global dispatcher are not modified.
PAC, auto-discovery, SOCKS-only and proxy URLs containing credentials are not
supported. Missing/unsupported manual HTTPS proxy settings fail closed rather
than falling back to direct connections. Explicit system bypass entries connect
directly. External browser authorization pages are outside this setting's scope.
Active requests finish using their original route. Click Reload system proxy
after changing Windows proxy settings. A failed change preserves the active mode.
Changing the host's environment variables still requires restarting DSH itself.
For example, in PowerShell (replace the address with your proxy):
$env:HTTPS_PROXY = "http://127.0.0.1:7897"
dsh web
Uninstall
The command below targets CLI / Web. For Desktop, use its plugin manager or
the bundled CLI described above; removing the Web installation does not remove Desktop's copy.
Sign out under Settings → OpenAI Codex first, then run:
dsh plugin --profile web remove dsh-openai-codex-auth
Restart DSH afterward.
Security
- OAuth tokens are stored locally under
PI_OAUTH_OPENAI_CODEX in
$DSH_HOME/.credentials.yaml and are never sent to the settings page.
- Usage data retains aggregate percentages, reset times, Credits, and reset-card counts, expiry timestamps and opaque card IDs for selection.
- Never commit or share
.credentials.yaml, auth.json, or environment files.
Report security issues privately according to SECURITY.md.
Development
npm run check
npm test
npm pack --dry-run
See CONTRIBUTING.md before submitting changes.
License
MIT
