@deepseek-harness-tui/dsh-auth
订阅 OAuth 登录（ChatGPT/Codex、Claude Pro/Max、SuperGrok），作为 DeepSeek Harness 的 LLM 提供商路由——无需修改 dsh 源代码，随 dsh-tui 提供
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @deepseek-harness-tui/dsh-auth@0.1.0Auth 以 @deepseek-harness-tui/dsh-auth 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Subscription OAuth sign-in for dsh-TUI and DeepSeek Harness
Use your ChatGPT (Plus/Pro), Claude (Pro/Max) and SuperGrok / X Premium subscriptions as model providers — sign in with the official account, no API keys, and no dsh source patch. This plugin is developed alongside (and bundled into) dsh-TUI, the Claude Code style terminal front door for DeepSeek Harness; it also installs standalone into any dsh profile.
dsh-tui → /provider → 订阅账号登录（OAuth）→ sign in ← the TUI integration
/auth login openai-codex ← the plugin command
/model → OpenAI Codex → gpt-5.6-sol ← routes & models
Status: experimental (M1). The OAuth flows themselves are
pi-ai's shipped
implementations (device-code and loopback callback included); this plugin
adds the hosting: credential storage, automatic token refresh, adapter
registration, and a login surface over the userQuestions seam that works in
the TUI, the web client, and refuses cleanly on headless hosts.
With dsh-TUI — nothing to do: dsh-auth ships inside the dsh-tui package
(bundled dependency). Update dsh-tui and the /provider wizard gains its
subscription sign-in branch automatically.
Standalone, into any dsh profile:
dsh plugin --profile <name> add @deepseek-harness-tui/dsh-auth
Then restart the host; / lists auth, and every model picker gains the
signed-in providers' catalogs (credential-gated — see below).
llm registry
routes: openai-codex, anthropic, xai. Models appear in a picker
only after that provider is signed in (credential-gated listing) — sign
in and the catalog appears, sign out and it disappears; model ids already
saved in sessions stay resolvable either way./auth login [provider] runs the provider's OAuth flow interactively. The
waiting panel behaves the way pi's host does: the authorization URL is
opened in your browser automatically (never hand-copied — the URL is
hundreds of characters and wrap artifacts corrupt its redirect_uri),
and the panel offers Copy authorization link / Open browser again /
Cancel sign-in. Device-code flows open the verification page and make
the short code the copy target. OpenAI Codex also offers a device-code
login method — the most robust path on headless or locked-down machines
(no localhost:1455 callback needed)./auth status / /auth logout <provider>; the ctx.dshAuth service
exposes the same api for UIs (the dsh-tui /provider wizard and /login
ride it)./auth # status: which providers are signed in
/auth login # pick a provider interactively
/auth login openai-codex # ChatGPT (Plus/Pro)
/auth login anthropic # Claude (Pro/Max)
/auth login xai # SuperGrok / X Premium
/auth logout anthropic
Model requests against a provider you have not signed in to fail loudly with
the /auth login <provider> hint — never silently.
- id: dsh-auth
name: '@deepseek-harness-tui/dsh-auth'
config:
providers: [openai-codex, anthropic, xai] # any non-empty subset
# credentialsFile: /secure/path/credentials.json
credentialsFile defaults to $DSH_HOME/dsh-auth/credentials.json
(~/.dsh/dsh-auth/credentials.json), overridable with the
DSH_AUTH_CREDENTIALS environment variable. The directory is created
0700, the file 0600 (best-effort on Windows), and every write is
atomic (temp file + rename).llm-pi-ai settings
profile naming the same provider — is refused by the registry; the plugin
logs the refusal and mounts the remaining routes. Keep one provider on one
adapter./auth status shows expiry
metadata only), and a corrupt file fails loudly instead of being
overwritten.pnpm install
pnpm verify # build + headless smoke (credential store, refresh
# serialization, prompt bridging, gating, service api)
The smoke suite runs without cordis or a harness: the pure modules are
exercised directly. Real end-to-end login needs an interactive host
(dsh-tui) and is verified manually per release. The plugin is developed in
the dsh-TUI repository as the
dsh-auth/ submodule and mirrors to this repository.
/provider OAuth branch, /login
account section, two-level /model picker with a pinned recently-used
group.dsh-ecosystem-spec conformance (manifest validation, admission
fixtures) plus the remaining pi-ai OAuth providers (GitHub Copilot,
OpenRouter, Kimi); community list entry.MIT