DeepSeek Harness — OpenAI Codex Plugin
Use a ChatGPT Plus or Pro subscription as an LLM provider in DeepSeek Harness.
The plugin adds device-code OAuth login through the Web settings UI and an interactive Harness /codex slash command. It does not run a browser callback server or localhost listener. After login, Codex models appear with other providers, tokens refresh automatically, and Web shows 5-hour and weekly limits in a Codex limits popup.
Dark-theme OpenAI Codex usage limits popup in DeepSeek Harness
Rendered by the real plugin UI with sanitized demonstration balances.
The limits view uses OpenAI's undocumented Codex usage endpoint. Its availability and response shape may change without notice.
Requirements
- A ChatGPT Plus or Pro subscription with Codex access.
- DeepSeek Harness
0.1.0-rc.6 or a compatible release.
- Node.js 18 or newer.
- pnpm available to the
dsh plugin command.
- Outbound HTTPS access to
auth.openai.com and chatgpt.com.
Install
DSH reconciles plugins per profile. Install the package in every profile where the provider or /codex command is needed; web is shown here:
dsh plugin --profile web add -w @syncended/dsh-codex
For local development, install a checkout instead:
dsh plugin --profile web add -w /absolute/path/to/deepseek-harness-openai-codex
The package declares a DSH bundle. It registers the openai-codex route and maps its credential automatically, so no dsh settings set command is needed. Restart the selected profile after installing or upgrading.
To remove it:
dsh plugin --profile web remove @syncended/dsh-codex
Connect a ChatGPT account
Web GUI
- Open Settings → OpenAI Codex.
- Click Sign in. The plugin opens OpenAI's device-login page in another tab.
- Return to DSH, copy the one-time code displayed there, and paste it into the OpenAI page.
- Approve access and return to DSH. The settings page updates to Connected automatically.
- Choose an
openai-codex/... model from the standard model selector and send a test prompt.
- Use Codex limits above Settings to inspect the normalized 5-hour and weekly balances.
Like other DSH credential settings, Web login is restricted to a loopback/same-origin Host session. For a remote Host, use an authenticated SSH/local tunnel to its loopback Web UI rather than exposing credential operations publicly.
Interactive Harness command
/codex is a Harness slash command, not a shell executable. Run it inside an interactive profile that has this plugin installed:
| Command | Description |
|---|
/codex login | Start the device-code flow and print the verification URL and code. |
/codex status | Show token status and expiry. |
/codex logout | Delete the stored token file and unpublish the live credential. |
How it works
- The plugin stores
{ access, refresh, expires } in $DSH_HOME/openai-codex.json by default.
- It publishes only the live access token to the DSH credential service as
OPENAI_CODEX_TOKEN.
- The bundled
llm-pi-ai route uses the openai-codex-responses API, keeps the installed pi-ai Codex models, and adds a gpt-6-astra fallback until pi-ai ships that catalog entry.
- The refresh loop renews credentials shortly before expiry without requiring a Host restart.
- The Web limits API calls OpenAI from the Host and returns only normalized percentages, reset times, and optional credit balances; OAuth tokens never cross into browser JavaScript.
Protect $DSH_HOME: the token file is sensitive local credential state. /codex logout removes it and clears the published credential.
Configuration
The defaults normally need no changes. To override them, edit the existing openai-codex row in $DSH_HOME/profiles/<profile>/cordis.patch.yml and restart that profile:
- id: openai-codex
config:
# clientId: app_EMoamEEZ…hrann
credentialRef: OPENAI_CODEX_TOKEN
deviceCodeTimeoutSeconds: 900
refreshWindowMs: 300000
# dshHome: /absolute/path/to/dsh-home
# tokenFile: /absolute/private/path/openai-codex.json
| Key | Default | Description |
|---|
clientId | built in | OpenAI OAuth client ID used by the device flow. |
credentialRef | OPENAI_CODEX_TOKEN | DSH credential ref receiving the live access token. |
deviceCodeTimeoutSeconds | 900 | Maximum time to approve a device login. |
refreshWindowMs | 300000 | Refresh-loop scheduling window; the implementation still refreshes only near expiry. |
dshHome | normal DSH home | Alternate base directory used to derive the default token path. |
tokenFile | $DSH_HOME/openai-codex.json | Absolute token persistence path; takes precedence over dshHome. |
Token-path precedence is tokenFile, then dshHome, then DSH_HOME, then ~/.dsh.
If credentialRef is changed, update the matching provider mapping in the existing llm-pi-ai row as well; otherwise the route continues reading OPENAI_CODEX_TOKEN:
- id: llm-pi-ai
config:
providers:
openai-codex:
displayName: OpenAI Codex
apiKeyEnv: MY_CODEX_TOKEN_REF
Troubleshooting
- No Codex models: confirm the plugin is installed in the active profile, restart that profile, and verify
/codex status reports a credential.
- Login never completes: confirm outbound access to OpenAI endpoints, repeat
/codex login, and approve before the 15-minute timeout.
- Remote Web login is rejected: connect through loopback using an authenticated tunnel; credential mutation is intentionally restricted.
- Limits fail but models work: the undocumented usage endpoint may have changed or be unavailable; model requests use a separate API path.
- Repeated sign-in after configuration changes: verify the token path is writable and
credentialRef matches the llm-pi-ai provider mapping.
Development
npm test
npm pack --dry-run
Tag-driven publication is documented in RELEASING.md.
License
MIT — see LICENSE.
