dsh-oauth-openai

dsh-oauth-openai

English | 中文

Scope change. DeepSeek Harness now owns the provider side: @deepseek-ai/dsh-llm-pi-ai registers the OpenAI Codex OAuth flow, credential storage, refresh, and model routing through @deepseek-ai/dsh-authorization. What the product still lacks is a browser surface for that seam. This package is that surface, and nothing else.

A provider card extension for the Models settings page: it lets a person sign in with a provider subscription (ChatGPT Plus/Pro, and any other flow the Host exposes for a provider) instead of pasting an API key.

What it adds

• A Host Remote namespace (codexAuth) that drives ctx.authorization for one browser surface: start an attempt, read its notices and prompts, answer, cancel.
• A Client registration on the settings.models.provider-card seat for the llm-pi-ai family. Cards whose provider reports nativeAuth.oauth get a "Sign in with …" button; every other card renders nothing.

It does not ship an OAuth driver, a model adapter, or credential storage. Those belong to the provider plugin, and installing both would mean two owners for one credential.

Requirements

• DeepSeek Harness 0.2.1-rc.2 or newer.
• A provider plugin that registers an authorization flow, such as @deepseek-ai/dsh-llm-pi-ai.

Install

dsh plugin --profile <profile> add dsh-oauth-openai

For a checkout:

dsh plugin --profile <profile> add /path/to/dsh-oauth-openai

Restart the profile, open Settings → Models, and add or edit a provider that offers a subscription login.

How it works

Settings → Models card (Client)
  └─ remote.codexAuth.start / state / answer / cancel
       └─ Host ProviderSignInController
            └─ ctx.authorization.begin({ key, method, signal, interaction })
                 └─ provider flow (dsh-llm-pi-ai)

The Host keeps one attempt per credential key, projects the seam's notices and prompts into plain views, and retains a finished attempt for five minutes so a late poll still sees its outcome. The Client polls state while an attempt runs; the stream is deliberately not used, so the plugin needs no uplink support.

Secrets never cross the wire. The seam reports authorized only after the credential is stored, and the views carry a message, a URL, a short code, and prompt text — never a token or a credential record. Failures keep the seam's own sentence when the error is an AuthorizationError, and collapse everything else to authorization failed.

Development

pnpm install
pnpm run check   # build the client bundle, run the controller tests, verify the package

src/controller.js is Host logic and runs under node:test with a fake seam. src/client.jsx is bundled by scripts/build.mjs into dist/client.js in the window.__ModuleLoader__ wrapper the Web client expects.

Known limitations

• The card's copy is English only; the page's locale service is not wired yet.
• One card shows the first flow whose key matches llm-pi-ai/<provider>.
• Signing in does not refresh the card's own key state; reopen the card to see it.

License

MIT