dsh-open-auth-plugin

dsh-open-auth

English | 简体中文

A DeepSeek Harness LLM plugin that connects every chat provider currently built into pi-ai and provides one OAuth/API-key login CLI. The plugin and CLI share a permission-protected credential file, allowing subscriptions such as OpenAI Codex, Kimi Code, and GitHub Copilot to authenticate DSH model requests.

This does not convert a ChatGPT subscription into an OpenAI API key. The openai-codex provider uses the OpenAI Codex OAuth flow and ChatGPT backend implemented by pi-ai. Availability, supported models, and usage limits remain subject to your OpenAI account and applicable service terms.

Installation

Node.js 22.19 or later is required.

Install the package into a DSH profile (replace web with your profile name when needed):

dsh plugin --profile web add dsh-open-auth

If you manage the DSH runtime as a regular Node.js project instead, install it in that project:

npm install dsh-open-auth

Then add the plugin to your DSH configuration as shown below. Installing through dsh plugin add activates the bundled default configuration automatically.

Authentication

When installed in a DSH profile, run the CLI through that profile. Sign in with an OpenAI Codex subscription:

dsh plugin --profile web exec dsh-open-auth login openai-codex
dsh plugin --profile web exec dsh-open-auth status openai-codex

Sign in with a Kimi Code subscription:

dsh plugin --profile web exec dsh-open-auth login kimi-coding oauth

List all providers and models currently exposed by pi-ai:

dsh plugin --profile web exec dsh-open-auth providers
dsh plugin --profile web exec dsh-open-auth models openai-codex

For a regular local npm installation, replace the prefix above with npx, for example: npx dsh-open-auth login openai-codex.

DSH configuration

The bundled configuration registers every built-in pi-ai chat provider. No extra configuration is required after installing it into a profile. Verify the composed row without starting DSH:

dsh --profile web --dump-config

To restrict the registered routes, add the following override to that profile's cordis.patch.yml:

- id: llm-open-auth
  config:
    providers:
      - openai-codex
      - kimi-coding
      - anthropic
      - openrouter
    streamIdleTimeoutMs: 300000

For a standalone Cordis configuration that does not use DSH profiles, add the package as a normal plugin row:

- id: llm-open-auth
  name: dsh-open-auth
  config: {}

Do not load another LLM plugin that owns any of the same provider routes. For example, registering anthropic from both this plugin and the official llm-pi-ai plugin will be rejected by DSH as a duplicate route.

Credential storage

Default locations:

• macOS: ~/Library/Application Support/dsh-open-auth/auth.json
• Linux: $XDG_CONFIG_HOME/dsh-open-auth/auth.json or ~/.config/dsh-open-auth/auth.json
• Windows: %APPDATA%/dsh-open-auth/auth.json

Use --file PATH in the CLI, set credentialFile in the plugin configuration, or set DSH_OPEN_AUTH_FILE for both. The file is created with mode 0600, replaced atomically, and protected by a cross-process lock during writes and token refreshes. It is not an operating-system keychain and has no additional encryption; never upload, share, or commit it to Git.

API-key providers may continue to use the standard environment variables supported by pi-ai, such as OPENAI_API_KEY, ANTHROPIC_API_KEY, and DEEPSEEK_API_KEY. Running dsh-open-auth login PROVIDER api_key stores the key in the shared credential file instead. Ambient-only providers such as AWS Bedrock and Google Vertex read environment variables or local credential files according to pi-ai conventions.

Architecture

flowchart LR
  CLI["dsh-open-auth CLI"] --> Store["Shared CredentialStore"]
  DSH["DSH dsh-open-auth plugin"] --> Store
  DSH --> Models["pi-ai builtinModels"]
  CLI --> Models
  Models --> OAuth["Provider OAuth / token refresh"]
  Models --> APIs["OpenAI Codex, Kimi, Anthropic, etc."]

This project does not maintain a duplicate provider allowlist. builtinModels() is the single source of truth, so upgrading @earendil-works/pi-ai automatically exposes newly built-in providers to the CLI and the default DSH route set.

Development

npm install
npm run check
npm test
npm run build

Publishing

The package name is dsh-open-auth. The package includes a dsh.bundle manifest and cordis.patch.yml, so dsh plugin add installs and activates it as a profile layer. prepublishOnly runs the type check, tests, and production build automatically before publication.

npm login
npm publish

Use npm pack --dry-run to inspect the files that will be published without uploading anything.

The DSH message, stream-event, and replay mappings in this project are adapted from the MIT-licensed DeepSeek Harness implementation. See NOTICE.