Repair candidate / 修复候选：0.8.2-rc.1。See usage, migration and rollback. It uses the npm next tag and does not replace the stable latest release.

🔐 dsh-coding-subscription-oauth

v0.8.2-rc.1 · repair candidate · formerly dsh-grok-build

Coding-subscription OAuth for DeepSeek Harness. Use SuperGrok / X Premium (Grok Build), ChatGPT Plus/Pro (Codex), Kimi Code, Claude Pro/Max and Google Antigravity inside DSH — without a second API-key bill and without pasting any token into chat.

English · 中文版 · 日本語 · 한국어 · Português (BR) · Español · Français · Deutsch · Русский

Upgrade / 升级： Follow the versioned steps in INSTALL.md. 0.8.0 adds opt-in OpenCode Go compatibility (sticky x-opencode-session on the local gateway). Current main pins the shared dispatcher runtime on dsh-coding-oauth-core@0.1.2 and undici@7.29.0, and restricts gateway key reveal/rotate to loopback access; no configuration, credential, data, or route migration is required. Grok Imagine retains its explicit pinned dispatcher. Releases from 0.6.2 onward include the strict Cordis injection startup fix and DSH 0.1.1-rc.2 support; keep profile/config/credential files and restart one existing DSH Web process only after updating.

Name change

Published first as dsh-grok-build when it only covered Grok Build. The current name matches the full coding-subscription OAuth surface.

	Use this	Still works
npm (recommended)	Repair candidate `0.8.2-rc.1` on the `next` tag: `dsh plugin --profile web add dsh-coding-subscription-oauth@0.8.2-rc.1`	No legacy npm package was published
GitHub / development	`dsh-coding-subscription-oauth`	Previous GitHub repo `dsh-grok-build` was removed
CLI	`dsh-coding-oauth`	`dsh-grok-build`
Cordis plugin id	`llm-grok-build-oauth`	unchanged
Settings HTTP API	`/plugins/dsh-grok-build/*`	unchanged
Credential files	`$DSH_HOME/.grok-build-auth.json` and the other `*-oauth-auth.json` files	unchanged

✨ Features

🧽 Bring your own subscription — SuperGrok, ChatGPT Plus/Pro, Kimi Code, Claude Pro/Max; no extra pay-as-you-go key.
🔑 Local OAuth, no key-pasting — authorize in Settings or CLI; access/refresh tokens never enter chat, logs or HTTP status.
🧩 One plugin, five providers — Grok Build (cli-chat-proxy.grok.com), Codex, Kimi Code, Claude Code and Google Antigravity.
🛡️ Secure by design — credential files are owner-only 0600, atomically written, cross-process locked.
⚙️ Dynamic catalog — the selector lists only signed-in routes, labelled (OAuth), including grok-4.6 xhigh.
🌐 Proxy-aware — proxies only reviewed subscription domains; Kimi China stays direct by default.
📥 Manual CLI Pull — Settings discovers allowlisted official Grok/Codex/Kimi/Claude CLI OAuth files read-only; you pull a one-way copy after preview and overwrite confirmation.
🗂️ Tabbed Settings — Accounts, Gateway, Capabilities, and About; remote hosts prefer device-code sign-in with quieter CLI-missing tips; signed-in cards stay collapsed until expanded.
🎛️ Optional capabilities, default off — Codex search, usage/quota, image generate/edit, Fast, and Grok Imagine apply live when you turn them on. An additional default-off switch lets non-Codex model routes call Codex image tools while preserving Codex sign-in, session, and attachment-ownership checks.
🔌 Opt-in local API gateway — default-off loopback OpenAI/Anthropic-compatible server for your own tools, with copyable base URLs and Bearer key; never a public relay.
OpenCode Go — Connect OpenCode Go in Accounts & Models and use the existing DSH model route without enabling Gateway. External tools use explicitly configured opencode-go/ routes and the matching protocol, with a stable conversation header. The local gateway key and upstream credential are separate; missing session IDs are rejected. Review the migration preview before replacing the old global mode.

Problems this plugin solves

These are the searches and DSH errors that usually lead here. If one of them is your tab title, you are in the right repo.

You searched / saw	What was actually broken	What this plugin does
SuperGrok / X Premium in DSH, “Grok Build vs `api.x.ai`”	The built-in `xai` route is the pay-as-you-go API. Coding-plan inference is `cli-chat-proxy.grok.com`	Dedicated `grok-build` route + official CLI fingerprint headers (`X-XAI-Token-Auth`, `x-grok-client-identifier`, `x-grok-client-version`) so you do not get a silent 403
`本轮运行失败` API key is invalid / `AUTH` mid-turn	The GUI maps every `AUTH` code to that banner. Often the OAuth access token just expired (Kimi ~15 min)	Refresh 5 minutes before expiry; on a 401, invalidate the stored token and retry the step after refresh
`INVALID_REPLAY_STATE` on the second Codex / Kimi turn	Replay state still carried the native pi-ai provider id after the Harness route alias	Keep the Harness route id in replay state and heal older poisoned messages
grok-4.6 xhigh / Extra High Effort missing	Live `GET /v1/models-v2` already returns `reasoning_efforts` including `xhigh`; cloning the grok-4.5 template hides it (pi-ai treats absent `xhigh` as unsupported)	Parse live `reasoning_efforts` into `thinkingLevelMap`. grok-4.6 gets `xhigh`; grok-4.5 stays low/medium/high
Kimi Code 401, or requests going out as Anthropic `x-api-key`	The OAuth token was attached as an Anthropic key	Wire only `Authorization: Bearer` on `api.kimi.com/coding`
Unsigned-in Grok / Codex / Claude still in the model picker	Every registered route was listed	Unauthenticated routes expose no models; signed-in names show `(OAuth)`
Device login on a remote / headless DSH	Browser PKCE cannot reach `localhost`	Device-code for Grok, Codex and Kimi; Claude accepts a pasted localhost redirect URL
Proxy works for Grok/Codex but breaks Kimi in China	One global `HTTPS_PROXY`	Allowlisted proxy; Kimi stays direct unless `proxyKimi: true`. `auth.kimi.com` ≠ `api.moonshot.cn`
ChatGPT Plus / Claude Pro in DSH without another API bill	Separate OpenAI / Anthropic API keys	Local OAuth on `codex-oauth` / `claude-code-oauth`, coexist with existing `openai` / `kimi-coding` API-key routes
OpenCode Go: `MissingSessionID`	Missing stable conversation ID	DSH: use Accounts & Models; external tools: provide `x-opencode-session`. See migration.

Grok Build device login, live /v1/models-v2 and Responses streaming are verified on real deployments. Codex / Kimi / Claude reuse @earendil-works/pi-ai native OAuth instead of re-implementing vendor flows.

Supported providers

Provider	Route	Auth	Coexists with
xAI Grok Build	`grok-build`	SuperGrok / X Premium OAuth	`xai`
OpenAI Codex	`codex-oauth` · optional `codex-oauth-fast`	ChatGPT Plus/Pro OAuth	`openai`
Kimi Code	`kimi-code-oauth`	Kimi Code OAuth	`kimi-coding`
Claude Code	`claude-code-oauth`	Claude Pro/Max OAuth	—
Google Antigravity	`agy`	`dsh-agy` Google OAuth	—

Grok Build's device login, dynamic /v1/models-v2 catalog and Responses streaming are verified on real deployments. Codex/Kimi/Claude reuse the provider-native OAuth/refresh from @earendil-works/pi-ai instead of re-implementing vendor flows.

🚀 Quick start

# 1. install the current npm release into the web profile
dsh plugin --profile web add dsh-coding-subscription-oauth@0.8.2-rc.1

# 2. optional — Google Antigravity (pinned, reviewed version)
dsh plugin --profile web add dsh-agy@0.1.2

# 3. restart the existing DSH Web process with its configured process manager
# `dsh web` is the official CLI alias for the web profile, not a service-unit name.

Then open Settings → Coding OAuth and sign in to any provider. Done — pick your authenticated model from the selector.

📚 Table of contents

Name change
Features
Problems this plugin solves
Supported providers
Quick start
Install
Settings page
Optional capabilities
Local API gateway
CLI
Kimi in China
Network proxy
Resilience
Credentials
Architecture
Technical notes
Compliance
Documentation
Related
Contributing
License

Install

Requires DeepSeek Harness 0.1.1-rc.2 (verified BOM) and Node.js 22.19+. Unverified candidates such as 0.1.5-rc.1 are recorded in compatibility/dsh-bom.json only — see INSTALL.md. OAuth profiles initialize an empty modelErrors map so candidate hosts do not crash on model resolution (#38).

# current npm release
dsh plugin --profile web add dsh-coding-subscription-oauth@0.8.2-rc.1

# development / alternative: from GitHub
dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth

# local development checkout (alternative)
# dsh plugin --profile web add ./dsh-coding-subscription-oauth

Restart the existing DSH Web process after installing. Maintainers can verify a live deployment from a source checkout (npm installs do not include these scripts):

pnpm run verify:deployed            # checks real /api/llm.models + OAuth state
DSH_EXPECT_AGY_AUTH=signed-in pnpm run verify:deployed   # if Google is signed in

DSH_RESTORE_PROVIDER=openai \
DSH_RESTORE_MODEL=gpt-5.6-sol \
DSH_RESTORE_REASONING=max \
pnpm run smoke:deployed             # real Codex/Kimi tool-calls + second-turn replay

smoke:deployed creates temporary sessions, exercises Codex and Kimi tool-calls plus a second user turn (regression coverage for INVALID_REPLAY_STATE), restores the declared default model, then archives the sessions.

Settings page

Open Settings → Coding OAuth. The page uses segmented tabs — Accounts, Gateway, Capabilities, and About — with live status hints, semantic badges, and skeleton loading states. On a remote (non-loopback) host, Accounts prefers device-code sign-in and collapses noisy CLI-missing hints into one tip. Signed-in provider cards collapse to a compact summary; expand one for model search/filter, quota progress bars, or CLI Pull controls. Gateway adds quick-setup snippets (cURL / Python / IDE), and Capabilities uses toggle switches with dependency-aware disabled states plus Imagine status.

DSH Web remains loopback-only. Remote Settings must travel through an SSH tunnel or an owner-authenticated HTTPS reverse proxy. The plugin prefers a DSH-native ownerRequestPolicy; its fallback requires the real trusted TCP peer, exact HTTPS Origin/Host, same-origin Fetch Metadata, a proxy-injected owner proof, and an independent mutation CSRF proof. Forwarded headers never grant access, and incomplete policy fails closed. See INSTALL.md.

  [![Coding OAuth Accounts tab](https://raw.githubusercontent.com/lninghaha/dsh-coding-subscription-oauth/fa18c9718dbb63e1e61c9d7e429f5b7c1a143f5d/media/en/settings_accounts.png)](https://raw.githubusercontent.com/lninghaha/dsh-coding-subscription-oauth/fa18c9718dbb63e1e61c9d7e429f5b7c1a143f5d/media/en/settings_accounts.png)

  Accounts


  [![Coding OAuth Gateway tab](https://raw.githubusercontent.com/lninghaha/dsh-coding-subscription-oauth/fa18c9718dbb63e1e61c9d7e429f5b7c1a143f5d/media/en/settings_gateway.png)](https://raw.githubusercontent.com/lninghaha/dsh-coding-subscription-oauth/fa18c9718dbb63e1e61c9d7e429f5b7c1a143f5d/media/en/settings_gateway.png)

  Gateway


  [![Coding OAuth Capabilities tab](https://raw.githubusercontent.com/lninghaha/dsh-coding-subscription-oauth/fa18c9718dbb63e1e61c9d7e429f5b7c1a143f5d/media/en/settings_capabilities.png)](https://raw.githubusercontent.com/lninghaha/dsh-coding-subscription-oauth/fa18c9718dbb63e1e61c9d7e429f5b7c1a143f5d/media/en/settings_capabilities.png)

  Capabilities

Provider	Methods
Grok	auth code · device code · model selection
Codex	device code (recommended on remote DSH) · browser PKCE
Kimi	device code
Claude	browser PKCE (remote browser can paste the full localhost redirect URL)
Antigravity	`dsh-agy` install status + profile-local CLI commands

Use device code when the DSH host is remote. Browser/PKCE sign-in opens the provider URL; if the localhost callback cannot reach this DSH host, paste either the returned authorization code or the complete redirect URL into the waiting Settings card.

Settings also discovers allowlisted official Grok / Codex / Kimi / Claude CLI OAuth files (read-only). Synchronization is an explicit one-way Pull — not auto-import: discover → preview → conflict/fingerprint check → confirm overwrite. Official CLI files are never written. Reads refuse symlinks, non-regular files, non-owner files, group/other access, and oversized documents (O_NOFOLLOW). Preview tickets are one-use, expire in five minutes, and are capped at 32.

The selector only lists routes that completed authentication; unauthenticated providers return an empty list. Provider names carry (OAuth), and the catalog refreshes via llm/adapters-updated after sign-in/out.

Optional capabilities

All eight switches start off and apply live (no restart): codexSearch, codexImages, codexImageEdits, codexImagesAnyModel, codexUsage, codexFast, grokImagineImage, and grokImagineVideo. codexImagesAnyModel only relaxes the calling-model route gate; it still requires signed-in Codex, codexImages (and the edits flag for edit), and keeps session attachment ownership and edit authorization. Numeric controls are searchResults (1–20, default 5), imageCount (1–4, default 1), and videoArtifactTtlMs (1 hour–7 days, default 7 days; the UI shows 1–168 hours). Lowering video retention shortens and cleans existing artifacts immediately; raising it affects only artifacts created afterward. Administrators may provide secret-free composition defaults under plugin config capabilities; live user settings in the coding-subscription-oauth settings section override that base, and omitting it keeps every switch off.

codex-oauth-fast is advertised only after a fresh live catalog lists at least one priority-eligible model. Those requests send service_tier: priority plus a routing hint. The UI says Fast requested and never guarantees latency or that upstream will honor the request.

Codex search, usage, and images are opt-in private chatgpt.com/backend-api endpoints. Image generation uses the fixed model gpt-image-2. Image edit accepts only current-session top-level attachment ids that this session already owns.

Grok Imagine calls official https://api.x.ai with grok-imagine-image-2.0 and grok-imagine-video-1.5. It uses a separate DSH credential reference XAI_API_KEY — never Grok OAuth and never a process-env fallback. Generated outputs are fetched under MIME / size / time / redirect / DNS controls from frozen hosts imgen.x.ai, videogen.x.ai, and vidgen.x.ai, stored privately (256 MiB hard caps for one object and aggregate unique bytes, seven days), and served only on same-origin loopback routes.

Local API gateway

Default off. When enabled it starts an isolated node:http server (not the DSH web port) on 127.0.0.1:18080 and reuses the same signed-in OAuth session

dsh-coding-subscription-oauth

安装

说明文档