DSH AuthMux

One login plane. Many model subscriptions.

简体中文

AuthMux is a DSH-native OAuth multiplexer. It puts subscription-backed model providers behind one compact sign-in surface, while DeepSeek Harness Core continues to own credentials, settings, model routes, and token refresh.

Why AuthMux

• One surface for every OAuth flow registered by DSH Core.
• No private credential store — grants live in dsh-credentials-local.
• No duplicate model adapter — requests stay on Core llm-pi-ai.
• No custom HTTP server — the browser uses loopback-fenced DSH Connection RPC.
• Provider differences stay provider-owned — browser callbacks, device codes, PKCE, and refresh logic remain inside the Core flow.

OpenAI Codex is pinned first. The current DSH Core catalog also exposes OAuth flows for Anthropic, GitHub Copilot, Kimi For Coding, OpenRouter, and xAI.

Install

dsh plugin --profile web add github:Q-xuan/dsh-authmux
dsh --profile web

Open Settings → AuthMux, sign in, and select the enabled model from DSH's normal model picker.

Architecture

AuthMux UI
   │  DSH Connection RPC (loopback only)
   ▼
DSH AuthorizationService ──► provider-owned OAuth flow
   │
   ├──► DSH Credentials / GrantRecord
   └──► llm-pi-ai Settings ──► DSH model picker and requests

AuthMux owns only the browser interaction bridge and the UI. It does not own model transport or OAuth token refresh.

Migration from dsh-simple-oauth

On first start, AuthMux detects $DSH_HOME/simple-oauth.json, imports valid credentials into llm-pi-ai/ Core records, enables their model routes, and renames the legacy file to simple-oauth.json.migrated as a recovery backup.

Security

• OAuth payloads never cross into the browser.
• Refresh runs inside Core's serialized modifyRecord() path.
• The AuthMux RPC channel is restricted to loopback authority.
• Model tools cannot call the authorization surface.

Treat every provider subscription according to that provider's terms and billing rules.

Development

npm ci
npm run verify

verify runs TypeScript checks, tests, Host and Web builds, and a package dry run.

License

MIT