English · 简体中文
dsh-plugin-subscription-oauth
Use the AI subscriptions you already pay for as LLM providers in DeepSeek Harness — no API key.
Sign in once per provider from Settings → Subscriptions and that provider's models join the session model picker, with its plan quota shown live next to the connection. Tokens stay on your machine; every request streams through the provider's own API.
Supported providers
| Provider | What you get | Sign-in |
|---|
| Kimi Code | kimi-for-coding, k3 (1M), k3-256k — read from the endpoint's own model list | OAuth device flow (show code, confirm in browser) |
| Grok (X Premium) | whatever the account's own model list reports (e.g. grok-4.7), ⚡ lightspeed fast variant | Browser OAuth (auto-redirect) |
| Google Antigravity | Claude Sonnet/Opus, Gemini Flash, GPT-OSS, with reasoning tiers — read from the account's own list | Google account OAuth |
| GLM (BigModel) | whatever the coding host lists (e.g. glm-5.3, glm-5.3-flash) | ZCode browser sign-in (polled) |
| Volcengine Ark | the plan's own coding models | Volcengine SSO |
| Xiaomi MiMo | MiMo's own model list, with the app's two-model set as the fallback | Xiaomi account (QR / password) |
| WorkBuddy (国内版) | Hy, GLM, Kimi, DeepSeek, MiniMax models | Browser OAuth (Tencent) |
Every provider also feeds the auto route, which spans them all: pick auto and the harness walks your enabled models in order until one answers.
Features
- One sign-in per provider — no API keys to find, paste, or rotate. The plugin runs the provider's own OAuth/device flow and keeps the token on disk (
~/.dsh/plugins/kimi-oauth/auth.json, mode 0600).
- Live plan usage — the Settings card and the composer chip show each account's remaining quota (Kimi's 5-hour / weekly windows + credit, Grok's weekly credit, Antigravity's Gemini + Claude buckets, GLM/Ark/MiMo/WorkBuddy credits), with a meter and reset time.
- Model picker integration — each provider's models appear in the session picker with context windows and reasoning tiers; hide or re-order them per provider.
- Catalogs come from the provider, not from this build — every route reads its own model list once and caches it as the provider's table, so a model released, renamed or retired server-side shows up (or disappears) without a plugin update. Signing in and the Settings refresh models action are what re-read it; browsing the picker never spends a request.
- ⚡ Fast / lightspeed variants — for models that have one (e.g. Grok 4.7 →
grok-4.7-build-fast), a bolt button beside the model selector switches to the fast variant; it reads as a reasoning rung so the base model always stays selectable.
- Cross-account pool — sign in to several accounts on one provider; the plugin draws on the next account when one's allowance runs out.
- Auto fallback —
auto moves to the next enabled model when a provider refuses the preferred one (renamed, rate-limited, out of quota), and stops falling back once a stream has started.
Install
dsh plugin --profile web add dsh-plugin-subscription-oauth
Then restart DeepSeek Harness and open Settings → Subscriptions (订阅).
To install a specific version, or straight from the repository:
dsh plugin --profile web add dsh-plugin-subscription-oauth@0.10.2
dsh plugin --profile web add github:EricFL1998/dsh-subscription-oauth
How to use
- Open Settings → Subscriptions. You see one card per provider; signed-in providers sort to the front,
auto leads.
- Connect a provider. A browser window (or a device code) starts the provider's own sign-in. Finish it there — the card updates by itself.
- Pick a model. The provider's models now appear in the composer model picker, and the chip shows live usage.
- Expand a card to manage accounts (set default, sign out, refresh token), toggle which models appear, re-order them, add a model id this build doesn't know yet, and see the credential file / endpoints.
Tip: to use a different account on a provider, sign out first, then connect again — the browser sign-in follows whichever account the provider's page is signed in with.
What it registers
| Surface | What appears |
|---|
ctx.llm | the kimi, grok, antigravity, glm, ark, mimo, workbuddy and auto provider routes (models, reasoning, streaming) |
| Settings | a Subscriptions section: one card per provider |
| Model picker | each provider's own models, plus auto spanning them all |
| Composer chip | live plan usage for the provider in force |
Hiding a provider
To keep a provider's models out of the picker without uninstalling, drop it from the route list in your profile's cordis.patch.yml:
# $DSH_HOME/profiles/<profile>/cordis.patch.yml
plugins:
dsh-plugin-subscription-oauth:
providers: [kimi, grok, antigravity, glm, ark, mimo, workbuddy]
Omit the ones you don't want. The list defaults to every implemented route.
Security
- Credentials are stored locally at
~/.dsh/plugins/kimi-oauth/auth.json (mode 0600, written atomically), one section per provider.
- The plugin talks only to the providers' own hosts and OAuth endpoints — no telemetry, no third-party relay.
- Your subscriptions only; nothing is shared across machines.
Develop
See the developer README for the full wire protocol, token lifetimes, troubleshooting, and how to run the test suite.
License
MIT
