dsh-account-authorization

DSH Account Authorization

简体中文 | English

dsh-account-authorization is a Provider-neutral DeepSeek Harness model-account sign-in plugin. It owns one native Settings → Model sign-in section and renders only the model authorization flows already registered by Harness. On a Harness build that projects committed authorization records into Provider routes, successful authorization activates the same route used by the IDE model selector. The plugin copies no credentials and owns no Provider catalog, model catalog, credential format, or Provider protocol.

The browser receives only sanitized connection state, sign-in URLs, device codes, and non-secret choices. OAuth tokens remain inside the Provider flow and Harness credentials service. Required text and secret prompts fail closed. An abortable manual fallback paired with a safe browser sign-in URL waits only inside the Host for the official callback; the fallback content is never rendered, accepted, or forwarded. API keys stay in the native Models editor, and API-key-only flows do not produce empty account cards.

The UI and authorization flow are validated against Harness 0.1.1-rc.2. DSH Desktop 2.0.3 accepts a Flow's opaque target metadata but omits it from list() and describe(). When the profile has no authorization owner, this package mounts a compatibility subclass that restores only that projection while retaining the official service's flow, attempt, and credential behavior. An existing target-capable owner is reused; an incompatible legacy owner remains authoritative and the model list fails closed instead of creating a second service. Remove this compatibility entry once Desktop ships the upstream projection implemented by Harness commit 732a504. Direct model-route activation still requires that authorized-route projection in the LLM adapter. See README.zh-CN.md for installation, boundaries, and compatibility details.