dsh-model-manager

dsh-import-models

Import the models, providers, API keys and OAuth logins that other agent harnesses keep on this machine into DeepSeek Harness, then enable, disable and remove them from a Settings → Model Manager page.

What it reads

Every secret is redacted before it reaches the browser or the model: the page only sees hints like sk-ab…(51 chars). Imports re-read the source inside the Host, so a key value never travels through the page.

What you can do

• Import — scan, tick what you want, preview the plan, import. Per-source "Import" buttons do the same for one harness.
• Providers — disable (the route is stashed, not deleted), re-enable, or remove.
• Models — open a route's model list, search it, disable or re-enable single models.
• Add a provider — any OpenAI-compatible or Anthropic-compatible endpoint, with an optional key written straight to the credential store.
• Agent tools — model_manager_sources, model_manager_plan, model_manager_import, model_manager_routes, model_manager_toggle_route, model_manager_toggle_model, model_manager_add_route, model_manager_remove_route, model_manager_set_secret.

Install

plugin_manager install_bundle  target: <path-to>/dsh-import-models

The bundle inserts one row:

- insert:
    - id: model-manager
      name: 'dsh-import-models'

Refresh the Web GUI once, then open Settings → Model Manager.

Config

How writes work

Only first-class Host seams, never a hand-edited file:

• provider routes go through configEditor.edit() on the live llm-pi-ai row (falling back to settings.mutate('llm-pi-ai', …) when no editor is mounted);
• API keys go to credentials.set(ref, value);
• OAuth logins become the credential record llm-pi-ai/<route> ({ kind: 'grant', payload: { type: 'oauth', access, refresh, expires, accountId } }).

Disabling a provider stashes its route config in the plugin state file and removes it from the live config, so re-enabling restores it exactly. Model toggles rewrite the route's models array the same way.

Security

• HTTP routes are loopback-only; writes additionally require a same-origin Origin/Host pair or Sec-Fetch-Site: same-origin.
• No secret appears in a response, a log line, or the plugin state file.
• Other harnesses' files are read only; nothing outside DSH is modified.

Limitations

• OAuth grants are copied as-is. If the other harness already rotated the refresh token, import again.
• .env keys that match no known provider are stored as credential references only.
• The plugin performs no interactive sign-in of its own; use DSH's own Models page for that.
• Non-chat models (embeddings, TTS, image generation) are filtered out of imported routes and counted in the plan summary.

License

MIT