@deepseek-harness-tui/dsh-auth

Subscription OAuth sign-in for dsh-TUI and DeepSeek Harness

Use your ChatGPT (Plus/Pro), Claude (Pro/Max) and SuperGrok / X Premium subscriptions as model providers — sign in with the official account, no API keys, and no dsh source patch. This plugin is developed alongside (and bundled into) dsh-TUI, the Claude Code style terminal front door for DeepSeek Harness; it also installs standalone into any dsh profile.

dsh-tui → /provider → 订阅账号登录（OAuth）→ sign in   ← the TUI integration
          /auth login openai-codex                     ← the plugin command
          /model → OpenAI Codex → gpt-5.6-sol          ← routes & models

Status: experimental (M1). The OAuth flows themselves are pi-ai's shipped implementations (device-code and loopback callback included); this plugin adds the hosting: credential storage, automatic token refresh, adapter registration, and a login surface over the userQuestions seam that works in the TUI, the web client, and refuses cleanly on headless hosts.

Install

With dsh-TUI — nothing to do: dsh-auth ships inside the dsh-tui package (bundled dependency). Update dsh-tui and the /provider wizard gains its subscription sign-in branch automatically.

Standalone, into any dsh profile:

dsh plugin --profile <name> add @deepseek-harness-tui/dsh-auth

Then restart the host; / lists auth, and every model picker gains the signed-in providers' catalogs (credential-gated — see below).

What it does

• Mounts the pi-ai catalog providers that ship OAuth flows as llm registry routes: openai-codex, anthropic, xai. Models appear in a picker only after that provider is signed in (credential-gated listing) — sign in and the catalog appears, sign out and it disappears; model ids already saved in sessions stay resolvable either way.
• /auth login [provider] runs the provider's OAuth flow interactively. The waiting panel behaves the way pi's host does: the authorization URL is opened in your browser automatically (never hand-copied — the URL is hundreds of characters and wrap artifacts corrupt its redirect_uri), and the panel offers Copy authorization link / Open browser again / Cancel sign-in. Device-code flows open the verification page and make the short code the copy target. OpenAI Codex also offers a device-code login method — the most robust path on headless or locked-down machines (no localhost:1455 callback needed).
• Stored access tokens refresh automatically before each request, serialized per provider under the credential store's lock — concurrent requests never double-refresh a rotated token.
• /auth status / /auth logout <provider>; the ctx.dshAuth service exposes the same api for UIs (the dsh-tui /provider wizard and /login ride it).

Usage

/auth                          # status: which providers are signed in
/auth login                    # pick a provider interactively
/auth login openai-codex       # ChatGPT (Plus/Pro)
/auth login anthropic          # Claude (Pro/Max)
/auth login xai                # SuperGrok / X Premium
/auth logout anthropic

Model requests against a provider you have not signed in to fail loudly with the /auth login <provider> hint — never silently.

Configuration

- id: dsh-auth
  name: '@deepseek-harness-tui/dsh-auth'
  config:
    providers: [openai-codex, anthropic, xai]   # any non-empty subset
    # credentialsFile: /secure/path/credentials.json

• credentialsFile defaults to $DSH_HOME/dsh-auth/credentials.json (~/.dsh/dsh-auth/credentials.json), overridable with the DSH_AUTH_CREDENTIALS environment variable. The directory is created 0700, the file 0600 (best-effort on Windows), and every write is atomic (temp file + rename).
• A route another adapter family already owns — an llm-pi-ai settings profile naming the same provider — is refused by the registry; the plugin logs the refusal and mounts the remaining routes. Keep one provider on one adapter.

Security notes

• The credential file holds long-lived refresh tokens. It is never logged, never echoed through status surfaces (/auth status shows expiry metadata only), and a corrupt file fails loudly instead of being overwritten.
• Secret prompts warn that terminal input is not masked on this surface.
• Login refuses to run where no interactive surface is registered (no browser/GUI assumptions — remote and headless hosts get a clear error, per the ecosystem spec's remote-determinism rule, TUI-RUN-001).
• Subscription authentication and API-key access are different products: this plugin uses each provider's subscription backend only (ChatGPT Codex backend for OpenAI, Claude Pro/Max for Anthropic) and does not turn a subscription into a general-purpose API credential.

Development

pnpm install
pnpm verify     # build + headless smoke (credential store, refresh
                # serialization, prompt bridging, gating, service api)

The smoke suite runs without cordis or a harness: the pure modules are exercised directly. Real end-to-end login needs an interactive host (dsh-tui) and is verified manually per release. The plugin is developed in the dsh-TUI repository as the dsh-auth/ submodule and mirrors to this repository.

Roadmap

• M2 (landed) — dsh-tui integration: /provider OAuth branch, /login account section, two-level /model picker with a pinned recently-used group.
• M3 — dsh-ecosystem-spec conformance (manifest validation, admission fixtures) plus the remaining pi-ai OAuth providers (GitHub Copilot, OpenRouter, Kimi); community list entry.
• M4 — Gemini: a custom Google device-code flow (pi-ai ships none; this is the one wheel this project plans to build itself).

License

MIT