dsh-native-codex-oauth

English | 简体中文

Add native ChatGPT sign-in controls to DeepSeek Harness's built-in openai-codex provider. One install contributes the Host authorization controller, generated Remote descriptors, and the Models-page Web UI without modifying the Harness agent loop or replacing its LLM adapter.

Why this plugin is small

DeepSeek Harness already owns the important parts:

• llm-pi-ai registers the openai-codex model catalog, sends model requests, and refreshes grants;
• credentials stores grants on the Host and exposes only value-free record status;
• authorization owns one-attempt-per-key login lifecycle.

This plugin only connects those native seams to the Web Models page. It does not create a second Codex adapter, copy ~/.codex/auth.json, or store OAuth tokens in browser state.

Compatibility

This alpha targets the DeepSeek Harness source line at 0.1.2-alpha.3 (verified against commit dd6322d604e00eec1ba5e0c8541159906a21094a). It requires the native settings.models.provider-card slot and the llm-pi-ai authorization flow introduced on that line. Published 0.1.0-rc.x releases that lack either capability are not supported.

Install

Install the repository into the Web profile, restart dsh web, then open Settings → Models → Add provider → OpenAI Codex:

dsh plugin --profile web add github:kfc966/dsh-native-codex-oauth
dsh web

Click Sign in with ChatGPT, finish the provider-owned OAuth flow, save the provider, and select a Codex model in the normal model picker.

For a local checkout:

dsh plugin --profile web add /absolute/path/to/dsh-native-codex-oauth

Remove the plugin with:

dsh plugin --profile web remove dsh-native-codex-oauth

Security properties

• The browser receives flow labels, prompts, notices, and value-free credential status only.
• OAuth grants remain in the Harness Host credential service.
• Secret prompts use password inputs and are sent only as answers to the exact opaque prompt id.
• Sign-out deletes the owned credential record through the Host service.

This plugin uses the provider flow exposed by the installed Harness/pi-ai version. Users remain responsible for account eligibility and compliance with applicable provider terms.

Distribution

The repository commits prebuilt lib/ artifacts and has no install-time lifecycle script. A Git installation therefore does not request allowBuilds permission. src/ is included for source review; the generated Typert descriptors and browser closure bundle are checked into lib/ so the installed package is self-contained.

Development

npm run verify
npm test
npm pack --dry-run

The source and generated artifacts currently track the compatibility commit above. Regenerate the Typert and Client artifacts from a compatible DeepSeek Harness checkout when its Remote or browser-module contracts change.

License

MIT