dsh-codebuddy-auth
CodeBuddy (Tencent IOA) 作为原生 DeepSeek Harness llm 提供商：浏览器 OAuth 登录、令牌自动续期、凭据存储以及 /v3/config 模型同步。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:cainiao1992/dsh-codebuddy-auth#500e2acf90c1d3c27433e22b702eeffc44a861a3Codebuddy Auth 以 dsh-codebuddy-auth 发布，当前版本为 0.8.4。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 简体中文
Use Tencent CodeBuddy (IOA) chat models directly in DeepSeek Harness (DSH): browser OAuth login, automatic token renewal, and model-list sync. Log in once, and craft-agent models such as deepseek-v4-pro, glm-5.2, kimi-k3-1, and minimax-m3 appear in the model picker.
The plugin registers a native ctx.llm adapter on the codebuddy provider and owns the whole request path: browser OAuth, token storage in ctx.credentials, model discovery from /v3/config, and its own SSE streaming + message serialization. Two deliberate identities, one per plane:
| Plane | Identity | Why |
|---|---|---|
Chat (POST /v2/chat/completions) | CLI client (User-Agent: CLI/2.96.0 CodeBuddy/2.96.0, minimal headers) | The CLI identity is what the chat endpoint expects; using it avoids IDE-identity blocks. |
Model discovery (GET /v3/config) | Craft / VSCode (X-Agent-Intent: craft, X-IDE-*) | The craft catalog is the only one disclosing per-model reasoning metadata (supportedEfforts, canDisableThinking, defaultEffort) and the curated model list. The CLI catalog answers the same endpoint but carries only fixed effort values. |
The catalog is cached for 5 minutes and refreshed on demand (sync-models).
Verified against the DeepSeek Harness desktop app 0.2.0-rc.2 (@deepseek-ai/dsh-llm 0.2.0-rc.2). The adapter follows the current harness contract: tool-call ids are branded via ToolCallId (CallId no longer exists), and tool results replay as standalone role: 'tool' messages. Version 0.8.2 and older serialized tool results as plain user text, so any tool-using conversation failed with CodeBuddy API error (HTTP 400) (11148 tool calls and tool results do not match) on its second turn.
DSH installs profile plugins through its official dsh plugin CLI (a thin pnpm forwarder: installs the dependency, appends the package to the profile's dsh.profile.bundles layer stack, and mounts the plugin via the bundle's in-package patch — no manual file editing).
Prerequisite: make sure pnpm is on your PATH, e.g. via Homebrew:
brew install pnpm
dsh plugin --profile web add github:cainiao1992/dsh-codebuddy-auth
This single command resolves the dependency from GitHub, installs it, and activates the plugin as a profile layer.
Restart DSH. The plugin registers the codebuddy provider natively on ctx.llm at startup, so CodeBuddy already appears in the Models page — unauthenticated — before you log in.
You can log in either through the agent, or from the command line. Pick one.
Tell the agent "log in with codebuddy". The agent calls the codebuddy tool, which opens the IOA login page in your browser and polls in the background; once the token arrives it writes credentials and warms the catalog, and the next request hits the chat endpoint directly.
# Directly, no npm deps, Node >= 18 only:
node ~/.dsh/profiles/web/node_modules/dsh-codebuddy-auth/bin/login-flow.mjs
# Or via the package bin from the install directory:
cd ~/.dsh/profiles/web && pnpm exec codebuddy-login
# Add --no-browser on a remote server / headless box
The CLI only writes the credentials — the native adapter owns the route, so there is no settings route to manage; --international merely selects the OAuth endpoints the login itself uses.
dsh plugin --profile web remove dsh-codebuddy-auth
This removes the dependency and takes the plugin back out of the profile layer stack. Restart DSH to unload it.
The plugin targets the China edition by default (copilot.tencent.com / www.codebuddy.cn). Select the international edition (www.codebuddy.ai) through the mount row's edition: intl config:
# your cordis.patch.yml mount row:
- id: codebuddy-auth
name: dsh-codebuddy-auth
edition: intl # omitted = China edition
The adapter and the login/model-discovery endpoints then all use www.codebuddy.ai. The CLI's --international only selects the international OAuth endpoints for the login itself.
deepseek-v4-pro)codebuddy tool's status actionsync-modelsEach model is declared with its full real reasoning capability from /v3/config, so the model picker shows the levels each model actually offers:
supportedEfforts mirrors straight into the picker — deepseek-v4-pro offers low / high / xhigh, hy3 offers low / high, fixed-effort models (e.g. glm-5.1) offer their single medium. Sent on the wire as reasoning_effort: "<level>".defaultEffort its /v3/config entry reports (e.g. glm-5.2 defaults to high); every declared level stays selectable in the picker.lib/index.js — the Cordis host plugin (host composition row). Registers the codebuddy provider and the codebuddy tool; refreshes/syncs at startup and every 30 minutes.lib/codebuddy-adapter.mjs — the native ctx.llm adapter: SSE streaming, message serialization, reasoning metadata, error mapping. Ported from shatyuka/dsh-llm-codebuddy (MIT).lib/codebuddy-core.mjs — OAuth, JWT decoding, identity headers, and /v3/config discovery; dependency-free.bin/login-flow.mjs — standalone login CLI; no npm dependencies.cordis.patch.yml — in-package patch (self-mount row for bundle consumers).Plugin manager shows failed to import / the codebuddy tool never appears. The desktop app reports only the summary; boot a copy of the profile to see the real import error:
cp -R ~/.dsh/profiles/desktop ~/.dsh/profiles/cbprobe
dsh --profile cbprobe --no-open # the failed entry and its cause print on stderr
rm -rf ~/.dsh/profiles/cbprobe
Verified causes:
CallId to ToolCallId; plugin ≤0.8.2 fails ESM linking (does not provide an export named 'CallId') and its entry stays inactive. Fixed in 0.8.3 — upgrade below.@deepseek-ai/* inside ~/.dsh/profiles/<profile>/node_modules. Check and remove such links; DSH itself routes installation-scope packages into the desktop app.asar copy, so no asar extraction or manual symlinks are needed.Upgrade (desktop: fully quit the app first — its profile is Electron-managed):
dsh plugin --profile desktop update dsh-codebuddy-auth # desktop, after quitting the app
dsh plugin --profile web update dsh-codebuddy-auth # other profiles, any time
A git dependency stays pinned by pnpm-lock.yaml: pnpm install and a repeated dsh plugin add reuse the pinned commit. dsh plugin update <pkg> is what re-resolves github:<owner>/<repo> to a new HEAD.
Do not verify resolution with a bare node --input-type=module -e "import('@deepseek-ai/dsh-llm')" — it bypasses DSH's module-resolution interception and always fails from a profile directory. The probe-profile boot above is the real signal.
POST /v2/chat/completions does not check User-Agent — any UA works; but the request must be stream: true (non-streaming returns code 11101). DSH's llm adapters are streaming by default, so nothing to handle.GET /v3/config (model discovery) requires the craft / VSCode identity (X-Agent-Intent: craft + X-IDE-* headers) to disclose reasoning metadata; the plugin sends its own direct request for that.supportsReasoning on every craft model. Models are declared with their real reasoning capability (levels per supportedEfforts), so reasoning is selectable in the model picker rather than stripped.MIT