DSH Codex OAuth

Optional DeepSeek Harness plugin that adds Sign in with ChatGPT to the openai-codex card in Settings → Models. It calls the OAuth flow already owned by @deepseek-ai/dsh-llm-pi-ai; DSH's authorization and credential services own browser notices, prompts, durable storage, and token refresh.

This package does not read browser cookies, use an OpenAI API key, proxy through codex app-server, or store credentials itself.

Compatibility

• DeepSeek Harness 0.1.2-alpha.1 (exact peer contract)
• Node.js >=22.5.0
• The web profile, because the sign-in surface uses the browser Models slot

The pinned Harness alpha packages must be available to your package manager. At the time this source artifact was verified, 0.1.2-alpha.1 was not on the public npm registry, so a clean registry-only install could not be completed.

Build from source

Once the pinned Harness packages are available from the configured registry:

pnpm install
pnpm typecheck
pnpm build
pnpm test
node --check lib/index.js
pnpm publint
npm pack --dry-run
npm pack

For verification against a local checkout of the exact pinned Harness source, Typert generation can use the read-only checkout without changing it:

DSH_PINNED_SOURCE_ROOT=/absolute/path/to/deepseek-harness pnpm build
DSH_PINNED_SOURCE_ROOT=/absolute/path/to/deepseek-harness pnpm test

The build validates both Host and Client source against that pinned workspace, lowers Host decorators with the pinned TypeScript compiler before bundling, generates the Typert Remote contribution, and then builds the browser closure. The browser closure inlines that generated contribution and its zod wire codecs; only DSH's production platform seed words remain module-table requires. The final wrapped ESM zod client measured 154,298 raw bytes, 27,921 bytes with Node gzip level 9, and 27,829 bytes with GNU gzip level 9. Release tests allow 180,000 raw / 32,000 Node-gzip bytes (roughly 20% headroom) so an accidental return to zod's full locale graph fails loudly. The browser plugin mounts that contribution before registering its Models card and disposes the card before unmounting the Remote namespace.

Install

Install the published package into the web profile:

dsh plugin --profile web add @yail-peralta/[email protected]

Or install a locally built tarball from any directory:

dsh plugin --profile web add /absolute/path/to/yail-peralta-dsh-codex-oauth-0.1.1.tgz

The package declares a DSH bundle patch. Installing it adds the authorization service and this OAuth controller to the profile composition. No manual cordis.patch.yml edit is required. Restart a running Web Harness after the install if its profile does not apply bundle changes live.

To remove it:

dsh plugin --profile web remove @yail-peralta/dsh-codex-oauth

Configure and sign in

1. Start the Web Harness with the web profile.

2. Open Settings → Models.

3. Find openai-codex. The card first shows Checking connection… while the Host reads credential record metadata. If no OAuth grant exists, select Sign in with ChatGPT.

4. The sign-in action reserves a browser tab and opens the authorization page there as soon as the existing openai-codex OAuth adapter returns it. If the browser blocks or cannot navigate that tab, use Open sign-in page. Follow any displayed device code or prompt.

5. On success the plugin atomically adds this provider profile:

   llm-pi-ai:
     providers:
       openai-codex: {}
   

   Existing llm-pi-ai settings are preserved. If the provider is already configured, the plugin leaves the settings unchanged.

Use

After the UI reports Connected, select an openai-codex model/route through the normal DSH model settings and start a session. Token refresh remains inside @deepseek-ai/dsh-llm-pi-ai and the DSH credential store; this plugin never receives or renders the persisted grant. On reload or remount, the card restores Connected from the credential record's safe configured/kind metadata projection. Reconnect starts the same OAuth flow again without exposing the saved grant.

During authorization, the card presents sanitized browser notices, URLs, device codes, and prompts from the existing adapter. Failures render only the plugin-owned error alias and a Try again action; provider payloads and stack details are never rendered.

Closing the sign-in surface, disconnecting its stream, cancelling, or unloading the plugin aborts the in-flight authorization attempt and withdraws any pending prompt.

Package layout

• cordis.patch.yml — optional host composition layer
• lib/index.js — host authorization controller
• lib/client.js — browser Models-slot extension
• lib/types/client/index.d.ts — browser extension declarations
• lib/typert.host.js — generated host RPC bindings
• lib/typert.remote-client.js — generated browser RPC client