dsh-oauth
适用于 DeepSeek Harness 的与提供商无关的 OAuth 账户和凭据生命周期基础
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-oauth@0.2.0Oauth 以 dsh-oauth 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 简体中文
dsh-oauth is a provider-neutral OAuth foundation for DeepSeek Harness. It does not embed OpenAI, ChatGPT, Codex, or any other vendor protocol. Independent provider plugins register drivers while this package owns the shared account and credential lifecycle.
The base provides provider registration, browser/device/input challenges, cancellation and timeouts, token-free account projections, DSH credential storage, per-account cross-process refresh locking, and Typert Remote methods. It keeps a compatibility sign-in entry on the Host Models page and contributes the same OAuth login and account configuration flow to the independent Model Center provided by dsh-model-manager.
It deliberately does not own authorization endpoints, client identifiers, scopes, account-specific protocol details, model catalogs, LLM adapters, model requests, or model-provider configuration. Provider plugins contribute configuration through OAuth child slots and maintain their own model routes. The independent Model Center is the evolution path while the original Host Models page remains available.
import type { Context } from '@deepseek-ai/cordis'
import type {} from 'dsh-oauth'
import type { OAuthProviderDriver } from 'dsh-oauth/types'
const driver: OAuthProviderDriver = {
id: 'example',
displayName: 'Example Account',
authorizationTimeoutMs: 900000,
async authorize(interaction, signal) {
interaction.publish({ kind: 'browser', url: 'https://example.test/oauth/authorize' })
return {
account: { id: 'stable-account-id', displayName: 'Example User' },
credential: { schemaVersion: 1, accessToken: '...', refreshToken: '...' },
}
},
}
export function apply(ctx: Context): void {
ctx.effect(() => ctx.oauth.registerProvider(driver), 'example-oauth-provider')
}
export const inject = ['oauth']
Providers may declare authorizationTimeoutMs for longer authorization flows such as device code. Drivers that omit it use the base loginTimeoutMs setting.
pnpm install
pnpm run typecheck
pnpm test
pnpm run build
pnpm run pack:check
The package ships no real provider. Install a separate provider plugin to make sign-in available.
OAuth credentials are stored through ctx.credentials. The Web Remote and account index never contain access or refresh tokens. The ordinary provider search preference uses dsh.oauth.settings.global.search.v1; one-time codes, passwords, device codes, and live sessions remain transient.
MIT