dsh-llm-pi-ai-oauth

dsh-llm-pi-ai-oauth

OpenAI Codex / ChatGPT OAuth support for DeepSeek Harness.

This package is a replacement-type DSH Bundle based on @deepseek-ai/dsh-llm-pi-ai@0.1.0-rc.6. It adds:

• /login-codex browser and device-code login;
• OAuth credential storage under OPENAI_CODEX_OAUTH;
• request-time access-token refresh;
• the openai-codex provider in the configurable-provider directory.

Compatibility

Package	Version
DeepSeek Harness	0.1.0-rc.6
@deepseek-ai/dsh-llm-pi-ai baseline	0.1.0-rc.6
@earendil-works/pi-ai	0.82.1
Node.js	>=22.19.0

Install

dsh.cmd plugin --profile web add dsh-llm-pi-ai-oauth@0.1.0-rc.6.0

The package declares a dsh.bundle patch. Installation therefore disables the stock llm-pi-ai row and inserts this package. Do not keep an older profile-local patch that inserts ./plugins/dsh-llm-pi-ai-oauth/lib/index.js, or the row may be inserted twice.

Restart the DSH Web process and run:

/login-codex

The browser callback uses pi-ai's fixed port 1455. For a remote server, use device-code login or provide the required local forwarding.

Credential safety

The OAuth credential is stored by the DSH credential service, normally in $DSH_HOME/.credentials.yaml. Never commit that file, print its contents, or place an access/refresh token in a test fixture.

Architecture note

The stock rc.6 adapter has no external OAuth resolver hook and the LLM registry uses single ownership. This package must therefore replace the stock row rather than load beside it. The public package contract is the Cordis plugin root; ./oauth is an implementation/testing subpath.

Upgrade and rollback

Publish a new package version for each incompatible DSH or pi-ai baseline. Pin the package version in deployments:

dsh.cmd plugin --profile web add dsh-llm-pi-ai-oauth@0.1.0-rc.6.0

To remove it:

dsh.cmd plugin --profile web remove dsh-llm-pi-ai-oauth

After removal, switch any openai-codex default model back to a provider that the stock adapter supports.