dsh-AuthInOne

English | 简体中文

dsh-AuthInOne is a DeepSeek Harness plugin for OpenAI Codex and Kimi Code login, experimental compatibility login for seven additional account Providers, API and custom OpenAI-compatible Provider setup, model switching, token usage analytics, and cost tracking inside DSH's native Models and Usage settings.

OpenAI Codex uses browser OAuth with state, S256 PKCE, and a loopback callback. Kimi Code uses an RFC 8628 device flow. xAI Grok, Anthropic, GitHub Copilot, Command Code, Cursor, Google Antigravity, and Kiro are explicitly marked Experimental compatibility. Installed-Host validation reached each Provider's authorization boundary and stopped before user consent; mock/fixture tests cover exchange or polling, refresh rotation, denial, timeout, cancellation, logout, route activation, and secret redaction.

Alpha v0.1.0-alpha.2 · DSH 0.1.0-rc.6 for Host/Usage · the full Models/Auth UI requires the generic settings seams listed under Compatibility · MIT · community-maintained and not a DeepSeek or OpenAI product.

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.1.0-alpha.2
dsh web

Open DSH, then go to Settings → Models or Settings → Usage. The browser receives aggregated usage, redacted status, an authorization URL, and where required a user code. OAuth verifier, authorization code, device code, access token, and refresh token stay on the Host; the plugin never imports ~/.codex/auth.json, OpenCodex state, cookies, browser storage, OTPs, or another product's credentials.

Agent instruction: Install dsh-AuthInOne in the DSH web profile, restart DSH, then verify Settings → Models and Settings → Usage.

Use this plugin when

• you want OpenAI Codex or Kimi Code login inside DSH, or knowingly opt into a labeled compatibility flow;
• you manage API-key or custom OpenAI-compatible Providers in DSH's native Models page;
• you switch the future-session default model without replacing DSH's per-session selector;
• you need reconstructable Provider/model/tool token usage and auditable calculated cost.

Additional real DSH captures: Auth login dialog, Models action area, dark Usage, light narrow Usage, dark narrow Usage, and second-precision time range.

Verified capabilities

Capability	Status	Verification	Minimum DSH
OpenAI Codex browser account authorization	Verified to user-confirmation boundary	Real navigation reached auth.openai.com; mock issuer covers callback, state/PKCE, exchange, refresh, denial, expiry, cancellation, logout, revocation, and redaction	Current DSH build with settings.models.actions
Kimi Code device login	Experimental; verified to user-confirmation boundary	Installed Host returned the Kimi verification page and user code without returning the device code; fixtures cover pending, slow_down, denial, expiry, refresh, cancellation, and logout	Current DSH build with settings.models.actions
Seven compatibility account flows	Experimental; verified to user-confirmation boundary	xAI, Anthropic, GitHub Copilot, Command Code, Cursor, Antigravity, and Kiro each reached their expected authorization boundary; mocked completion registers and later disposes the corresponding model route	Current DSH build with settings.models.actions
Provider subscription quota	Best effort where upstream data exists	Codex, Kimi, xAI, Anthropic, Cursor, and Antigravity have token-free Remote projections; the Models page omits the quota block when the upstream response is missing, incomplete, unsupported, or cannot yield a reliable percentage	Current DSH build with settings.models.insights
Plan/API presets	Available with vendor limits shown	OpenAI, xAI, Gemini, Anthropic, Kimi Code, GLM Coding Plan, and ModelStudio/Qwen presets write credentials through DSH; GLM and Qwen usage restrictions remain visible	Current DSH build with settings.models.actions
DeepSeek API-key Provider and live model call	API-key only	Native Provider remained connected; a real DeepSeek call populated Usage without exposing the key	DSH 0.1.0-rc.6
Custom OpenAI-compatible Base URL, headers, model mapping	Native DSH capability	AuthInOne preserves the native Models cards and reads their public Provider projection	DSH 0.1.0-rc.6
Future-session default model and connection test	Verified	Models contribution and Host/Remote route exercised in the installed Web profile	Current DSH build with settings.models.insights
Cross-session Usage and cost analytics	Verified	Real DSH session logs rebuilt 26,383 Token into KPI, heatmap, model, Provider, bucket, and cost projections	DSH 0.1.0-rc.6
Usage navigation icon	Requires optional DSH seam	Plugin contributes its own currentColor 16 px icon; unknown sections still use the native fallback	Current DSH build with settings.section.icon

Account-login support matrix

Provider	Flow	Stability	Authorization boundary verified	Refresh/logout/model route	Quota
OpenAI Codex	Browser OAuth, state + S256 PKCE + loopback	Stable	auth.openai.com	Yes / Yes / Yes	Primary and secondary windows, best effort
Kimi Code	RFC 8628 device login	Experimental	www.kimi.com	Yes / local logout / Yes	Best effort
xAI Grok	Device login	Experimental	accounts.x.ai	Yes / Yes / Yes	Weekly or monthly, best effort
Anthropic	Browser/manual compatibility login	Experimental compatibility	claude.ai	Yes / local logout / Yes	Best effort
GitHub Copilot	Device login	Experimental compatibility	github.com	Yes / local logout / Yes	Not exposed
Command Code	Browser loopback compatibility login	Experimental compatibility	commandcode.ai	Refresh via returned account credential / local logout / Yes	Not exposed
Cursor	Browser PKCE compatibility login	Experimental compatibility	cursor.com	Yes / local logout / Yes	Best effort
Google Antigravity	Browser PKCE compatibility login	Experimental compatibility	accounts.google.com	Yes / local logout / Yes	Best effort
Kiro	Builder ID device login	Experimental compatibility	view.awsapps.com	Yes / local logout / Yes	Not exposed
Qwen account OAuth	Discontinued	Unsupported	No start action	No	No

“Local logout” means the plugin deletes its DSH credential and unregisters the model route when the observed compatibility protocol exposes no reviewed revoke endpoint. The browser never receives the stored credential. Stability labels describe implementation risk; they do not imply Provider sponsorship or certification.

30-second install, upgrade, and remove

Install the immutable GitHub tag and restart DSH:

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.1.0-alpha.2
dsh web

Upgrade by removing the installed package, adding the newer tag, and restarting. Remove this release with:

dsh plugin --profile web remove dsh-auth-in-one

The CLI owns the profile dependency and bundle row. Do not copy lib/, create a workspace link, edit the profile YAML, or apply the bundle patch by hand. Removal unloads the page, Models contributions, Remote namespace, Host service, styles, and listeners. It intentionally preserves DSH sessions, plugin settings, and credential references; data deletion is a separate explicit action.

Models and authentication

DSH's native Provider cards remain the only place to add, edit, or remove an API-key Provider. They own custom Base URLs, request headers, protocol choice, model mappings, and endpoint model discovery. AuthInOne adds a compact connection/default-route projection, a full-width Add Auth login action, and an Add Plan / API Key action above the two native add-Provider buttons. Per-session switching stays in DSH's conversation model selector.

Every Auth entry uses the same Host transaction surface: start, redacted status, cancel, optional one-time input, refresh, logout, and disposal. Browser/loopback flows keep state and PKCE verifier in the Host. Device flows keep the device code in the Host and expose only the verification URL and user code. A successful credential is written through DSH credentials before its model adapter is registered; terminal refresh failure or logout unregisters the route. Cancellation during a pending write compensates by deleting the credential. Remote revocation is bounded and best effort after local deletion.

OpenAI Codex protocol values were checked against OpenAI's public Codex sources for the login server, auth manager, and PKCE helper. Kimi device polling follows RFC 8628 pending and slow_down semantics. Compatibility entries use reviewed Provider/public-client behavior and remain labeled Experimental.

The Plan/API action includes OpenAI API, xAI API, Google Gemini API, Anthropic API, Kimi Code subscription keys, GLM Coding Plan, and ModelStudio/Qwen Coding Plan. GLM and Qwen presets retain the vendor's supported-tool or interactive-use restrictions. API keys are a separate connection method and never count as account Auth.

The connection test calls the configured OpenAI-compatible /models endpoint from the Host. It rejects redirects before a credential-bearing request can reach another origin and incrementally caps response bytes. The Client receives only success, latency, model ids, or a sanitized failure category; it never receives request headers, upstream response bodies, or credentials.

Usage filters and accounting

• Time, Provider, and output-price filters share one query context and drive every KPI, heatmap point, ranking, Token bucket, and cost value.
• Time is an inclusive local YYYY-MM-DD HH:mm:ss range in the displayed IANA timezone. The Host converts it to a deterministic UTC [start, endExclusive) query. Shortcuts fill the last 7, 15, or 30 days without closing the editor.
• Output-price bands use only outputTokensPerMillion in USD per 1M output Token. The disjoint bands are [0,1), [1,5), [5,15), [15,+∞), and unpriced. Missing/non-USD rows are unpriced; there is no silent currency conversion.
• Refresh keeps the active filters. Failed refreshes remain visible and do not replace the last good result.
• Model calls use their actual logged event time. Tool calls are a separate dimension. DSH does not log an authoritative owner plugin for every tool call, so the UI reports durable tool names and does not invent plugin attribution.
• Total Token is uncached input + output + cache read + cache write. Reasoning is shown separately because some Providers already include it in output. Missing buckets remain unknown.
• Token values below 1M use locale grouping; 1M to below 1B use M; 1B and above use B; exact values remain in title and accessible labels.

The built-in deepseek-usd-2026-08-14 catalog contains only DeepSeek-V4-Flash and DeepSeek-V4-Pro USD rows verified from the official DeepSeek pricing page on 2026-08-14. Every row carries a source URL, verification/update date, effective date, currency, and explicit token-bucket rates. Missing prices remain unknown or partial, never a forged zero or another Provider's price.

Security and data boundaries

AuthInOne creates no separate database. Analytics rebuilds from DSH sessions; non-sensitive overrides use the plugin's DSH settings namespace; OAuth and API credentials stay in DSH credentials. The plugin does not scan user homes, browser stores, keychains, Codex/OpenCodex files, .env files, or unrelated databases.

Authorization URLs and device user codes are public instructions for the current login transaction. The Remote DTO has no verifier, authorization code, device code, access token, refresh token, raw identity, upstream body, or credential value. Tests assert those fields do not cross Remote or logs. Screenshots contain no authorization URL, account, token, user code, or API key.

Provider responses have both time limits and incremental byte limits. Credential-bearing connection tests refuse redirects. The alpha.2 security diff scan reviewed 74 changed/added artifacts, found two medium-severity network-boundary issues, and verified both fixes with Node 24 reproductions and focused tests before release.

Compatibility

DSH environment	Host/Usage	Models status/default	Add Auth login	Usage icon
Official 0.1.0-rc.6	Available	Hidden	Hidden	Native fallback icon
Current DSH main at 47f9438 plus the generic settings seam diff	Available	Available	Available	Plugin icon
Plugin removed	Absent	Native page only	Absent	Absent

Full alpha.2 UI currently needs three generic, optional, backward-compatible DSH declarations: settings.models.insights, settings.models.actions, and the optional settings.section.icon metadata field. They contain no AuthInOne, OAuth, Provider, pricing, or Usage business code. On an unmodified tagged rc6 build, the Host and Usage page continue to work, the Usage section uses the native fallback icon, and the unsupported Models contributions stay hidden. The plugin never patches the DOM. Until these seams ship in a public DSH tag, alpha.2 is an early-adopter build and the full Auth UI is not available on stock rc6.

See Architecture and plugin boundary invariants for plugin-owned code, the exact core seam allowance, lifecycle disposal, safe degradation, and boundary gates.

What this plugin does not claim

• It is not an official DeepSeek, OpenAI, or model-provider product and does not imply endorsement.
• It does not claim every compatibility login is a stable or Provider-endorsed integration. Seven entries are explicitly Experimental, and Qwen account OAuth is discontinued and unavailable.
• It does not replace DSH's Models page, attachment pipeline, session log, or model selector.
• It does not fabricate missing Token buckets, prices, currency conversion, tool ownership, or a successful login.

Local development

Use Node ^22.19 or >=24 and the locked pnpm project:

pnpm install --frozen-lockfile
pnpm typecheck
pnpm test
DSH_SOURCE_ROOT=/path/to/deepseek-harness pnpm verify:boundaries
pnpm build
pnpm pack --dry-run

lib/ is committed because GitHub installs do not run a build. The package has no prepare script and requires no install-time lifecycle permission.

Provenance and licenses

The implementation, module structure, credential representation, settings fields, tests, README prose, React components, CSS modules, and interaction copy were independently written for this repository. DSH public APIs/types and reviewed Provider implementations were protocol references. The local OpenCodex source was read only for responsibility and failure-state comparison; details are in the clean-room comparison and alpha.2 provenance audit.

The following repositories were used only for capability collision and public seam research: usage-report, openai-codex-auth, codex-provider, polyglot, usage-meter, cost-ledger, and dsh-web-ui. No source, README text, CSS, component structure, schema, or tests were copied or vendored from them.

Runtime dependency: Zod (MIT). Build-time Provider transport dependency: @earendil-works/pi-ai 0.82.1 (MIT), bundled into the committed Host artifact and not installed into the DSH profile. Cursor compatibility uses @cursor/sdk 1.0.24 under the Cursor SDK license and Terms of Service; it is bundled into the Host artifact and remains Experimental. Development tools include React, tsdown, Vitest, and Testing Library (MIT), TypeScript (Apache-2.0), and Lightning CSS (MPL-2.0). This repository is licensed under MIT.

DeepSeek, OpenAI, Codex, and other Provider names and marks belong to their respective owners. Their appearance describes compatibility and does not imply sponsorship, certification, or endorsement.