dsh-subscription-oauth

English · 简体中文

dsh-plugin-subscription-oauth

Use the AI subscriptions you already pay for as LLM providers in DeepSeek Harness — no API key.

Sign in once per provider from Settings → Subscriptions and that provider's models join the session model picker, with its plan quota shown live next to the connection. Tokens stay on your machine; every request streams through the provider's own API.

Supported providers

Every provider also feeds the auto route, which spans them all: pick auto and the harness walks your enabled models in order until one answers.

Features

• One sign-in per provider — no API keys to find, paste, or rotate. The plugin runs the provider's own OAuth/device flow and keeps the token on disk (~/.dsh/plugins/kimi-oauth/auth.json, mode 0600).
• Live plan usage — the Settings card and the composer chip show each account's remaining quota (Kimi's 5-hour / weekly windows + credit, Grok's weekly credit, Antigravity's Gemini + Claude buckets, GLM/Ark/MiMo/WorkBuddy credits), with a meter and reset time.
• Model picker integration — each provider's models appear in the session picker with context windows and reasoning tiers; hide or re-order them per provider.
• Catalogs come from the provider, not from this build — every route reads its own model list once and caches it as the provider's table, so a model released, renamed or retired server-side shows up (or disappears) without a plugin update. Signing in and the Settings refresh models action are what re-read it; browsing the picker never spends a request.
• ⚡ Fast / lightspeed variants — for models that have one (e.g. Grok 4.7 → grok-4.7-build-fast), a bolt button beside the model selector switches to the fast variant; it reads as a reasoning rung so the base model always stays selectable.
• Cross-account pool — sign in to several accounts on one provider; the plugin draws on the next account when one's allowance runs out.
• Auto fallback — auto moves to the next enabled model when a provider refuses the preferred one (renamed, rate-limited, out of quota), and stops falling back once a stream has started.

Install

dsh plugin --profile web add dsh-plugin-subscription-oauth

Then restart DeepSeek Harness and open Settings → Subscriptions (订阅).

To install a specific version, or straight from the repository:

dsh plugin --profile web add dsh-plugin-subscription-oauth@0.10.2
dsh plugin --profile web add github:EricFL1998/dsh-subscription-oauth

How to use

1. Open Settings → Subscriptions. You see one card per provider; signed-in providers sort to the front, auto leads.
2. Connect a provider. A browser window (or a device code) starts the provider's own sign-in. Finish it there — the card updates by itself.
3. Pick a model. The provider's models now appear in the composer model picker, and the chip shows live usage.
4. Expand a card to manage accounts (set default, sign out, refresh token), toggle which models appear, re-order them, add a model id this build doesn't know yet, and see the credential file / endpoints.

Tip: to use a different account on a provider, sign out first, then connect again — the browser sign-in follows whichever account the provider's page is signed in with.

What it registers

Hiding a provider

To keep a provider's models out of the picker without uninstalling, drop it from the route list in your profile's cordis.patch.yml:

# $DSH_HOME/profiles/<profile>/cordis.patch.yml
plugins:
  dsh-plugin-subscription-oauth:
    providers: [kimi, grok, antigravity, glm, ark, mimo, workbuddy]

Omit the ones you don't want. The list defaults to every implemented route.

Security

• Credentials are stored locally at ~/.dsh/plugins/kimi-oauth/auth.json (mode 0600, written atomically), one section per provider.
• The plugin talks only to the providers' own hosts and OAuth endpoints — no telemetry, no third-party relay.
• Your subscriptions only; nothing is shared across machines.

Develop

See the developer README for the full wire protocol, token lifetimes, troubleshooting, and how to run the test suite.

License

MIT