dsh-providers-extension
yhyfhgs/dsh-providers-extension
Host-anchored provider, authentication, catalog, policy, and model-selection extension for DeepSeek Harness.
安装
dsh plugin --profile web add github:yhyfhgs/dsh-providers-extensionREADME
DSH Providers Extension
Manage LLM providers, accounts, model catalogs, reasoning effort, and provider execution modes from one DeepSeek Harness interface.
简体中文 · Full guide · 中文使用指南 · Changelog · Security · Contributing · License
Install
0.1.0 supports DeepSeek Harness 0.1.0-rc.7, pi-ai >=0.82.1 <0.83.0, and Node.js ^22.19.0 || >=24.0.0. DSH delegates plugin operations to pnpm, so pnpm must be on PATH.
dsh plugin --profile web add @fhxgs/dsh-providers-extension@0.1.0
Check the composed profile before starting the UI:
dsh --profile web --dump-config
dsh web
The dump must contain the @fhxgs/dsh-providers-extension bundle and the fhgs-providers-extension row. After DSH starts, open Settings → Models.
What it adds
- One Models area: built-in DSH Providers, OAuth accounts, API routes, and custom OpenAI-compatible endpoints share one control plane without losing their separate identities.
- Live catalogs: refresh model lists without signing in again. A failed refresh keeps the last known good catalog and credential.
- Exact selections: every choice retains Provider, route/account, model, reasoning effort, and Provider-owned mode such as
fast,priority, orflex. - Separate defaults and sessions: a new-session default does not rewrite an existing session. Composer and
/modelchanges affect only the current session. - Visibility controls: choose which models, effort values, and modes appear in pickers without silently terminating a running session.
- Replay-safe routing: request history keeps the route and binding identity required to replay against the same account.
- Fail-closed activation: an unknown, incompatible, or drifted Host stays on native DSH.
The complete feature, installation, configuration, compatibility, architecture, security, and release reference is in the full guide.
Provider paths in 0.1.0
| Provider path | Status | Use it through |
|---|---|---|
| DSH built-in Providers | Available | Host API key, environment, Bedrock, Vertex AI, or another native identity chain |
| Custom OpenAI-compatible endpoint | Available | Settings → Models → API → Add custom provider |
| Google Gemini OAuth | Deployment client required | A deployment-owned Google Desktop OAuth client and quota project |
| OpenRouter | API key only | Host/API route; public OAuth is blocked in this release |
| Hugging Face | Fine-grained token only | Host/API route; public OAuth is blocked in this release |
| OpenAI | API/workload identity or explicit Host Agent Bridge | Consumer ChatGPT/Codex login is not imported |
| Anthropic | API or Host-native enterprise identity | Claude subscription and Claude Code credentials are not imported |
An implemented protocol is not automatically an approved public identity path. The extension exposes a login action only after the driver and compliance record both allow it.
Selection model
A durable selection keeps five axes separate:
Provider → Route/account → Model → Effort → Mode
Provider default means that no explicit mode is sent. It is not an explicit mode named default. A high-speed model SKU remains a Model; a Provider service tier is a Mode only when its driver declares the exact wire binding.
Safety boundary
Credentials stay in the Host credential backend. They do not enter settings documents, Browser snapshots, catalog caches, session logs, screenshots, source maps, or npm artifacts. PKCE verifiers and authorization codes remain in Host memory.
Before attaching a saved credential, custom endpoints are checked for HTTPS, public DNS and connected addresses, same-origin redirects and catalogs, supported secret headers, bounded responses, and the absence of query-string secrets. Private, loopback, link-local, metadata, DNS-rebinding, cross-origin, and oversized-response targets are rejected.
Do not edit the compatibility manifest to force activation on another DSH build. Each Host version needs its own reviewed profile.
Local checkout: one command
From a standalone clone with dependencies installed:
npm run dsh:install:local
For a fresh clone:
git clone https://github.com/yhyfhgs/dsh-providers-extension.git
cd dsh-providers-extension
npm ci --ignore-scripts && npm run dsh:install:local
From the private Collab workspace root, point the installer at that workspace's DSH CLI:
DSH_BIN="$PWD/deepseek-harness/apps/cli/lib/bin.js" npm --prefix providers-extension run dsh:install:local
Use -- --profile <name> to link a disposable profile instead of web.
Documentation
| File | Contents |
|---|---|
| README.md / README.zh.md | Public overview and quickest install path |
| docs/GUIDE.md / docs/GUIDE.zh.md | Features, installation, configuration, compatibility, architecture, performance, security, and release verification |
| CHANGELOG.md | Versioned changes |
| .github/SECURITY.md | Private vulnerability reporting and supported versions |
Develop
npm ci --ignore-scripts
npm run check
The repository also contains a credential-free UI prototype:
npm --workspace @fhxgs/providers-extension-prototype run dev -- --host 127.0.0.1 --port 4173
The prototype uses mock data. It demonstrates the interaction contract but does not prove Provider eligibility, real-account OAuth behavior, or compatibility with another Host build.
0.1.0 limits
This release does not provide automatic cross-Provider fallback, multi-account rotation, remote policy downloads, a public third-party driver SDK, implicit vision routing, consumer-subscription credential reuse, public OpenRouter or Hugging Face OAuth, or compatibility with unreviewed DSH builds.
License
MIT © 2026 fhgs.