@zenmux/dsh-plugins
ZenMux OAuth 2.0 PKCE login, token refresh, and Harness credential mirroring
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:ZenMux/dsh-plugins说明文档
阅读完整 README ↗Configuration
| Field | Default | Meaning |
|---|---|---|
oauthOrigin | ZENMUX_OAUTH_ORIGIN or https://zenmux.ai | Authorization-server origin; HTTPS is required except for loopback development |
clientId | ZenMux Harness public client | Registered public OAuth client id |
scopes | inference:invoke, offline_access | Required inference and refresh scopes |
callbackPort | 0 | Loopback port; zero selects a free OS port |
proxyUrl | empty | Optional deployment-supplied http://, https://, socks4a://, or socks5h:// proxy; otherwise inherits HTTPS_PROXY/https_proxy, then connects directly |
browserAutoOpen | disabled only when ZENMUX_OAUTH_NO_BROWSER=1 | Automatically open the login URL in DSH Web while retaining the manual link |
accessTokenRef | ZENMUX_OAUTH_ACCESS_TOKEN | Raw access-token mirror read by the LLM provider |
tokenSetRef | ZENMUX_OAUTH_TOKENS | Versioned JSON access/refresh token set |
loginTimeoutMs | 300000 | Pending loopback-login lifetime |
requestTimeoutMs | 30000 | Discovery, token, and revocation request timeout |
refreshSkewMs | 60000 | Refresh lead time before expiry |
refreshRetryMs | 30000 | Delay between failed background refresh attempts |
Both credential references must be distinct writable references. Environment-supplied credentials are intentionally read-only in dsh-credentials-local; choose unshadowed references rather than expecting OAuth login to overwrite an exported variable.
Environment variables
| Variable | Default | Purpose |
|---|---|---|
ZENMUX_OAUTH_ORIGIN | https://zenmux.ai | OAuth authorization-server origin |
ZENMUX_OAUTH_CLIENT_ID | bundled public client | Override the OAuth public client ID |
ZENMUX_OAUTH_SCOPES | inference:invoke offline_access | Whitespace-separated login scopes |
ZENMUX_API_BASE_URL | https://zenmux.ai/api/v1 | Generic ZenMux API base; its origin is used to derive /api/anthropic |
ZENMUX_ANTHROPIC_BASE_URL | derived from ZENMUX_API_BASE_URL | Exact Anthropic Messages endpoint override |
ZENMUX_OAUTH_NO_BROWSER | unset | Set to 1 to suppress automatic browser opening |
HTTPS_PROXY / https_proxy | unset | OAuth discovery/token/revocation proxy when proxyUrl is empty |
CODEX_HOME, ZENMUX_OAUTH_STATE_DIR, and ZENMUX_OAUTH_STORAGE belong to Codex-style file/keychain clients and are intentionally not consumed: DSH owns persistence through its credentials service. ZENMUX_MODELS_CATALOG_URL and ZENMUX_ANTHROPIC_MODELS_CATALOG_URL are build-time inputs for pnpm sync:models; they do not change a running DSH profile.