dsh-oauth is a provider-neutral OAuth foundation for DeepSeek Harness. It does not embed OpenAI, ChatGPT, Codex, or any other vendor protocol. Independent provider plugins register drivers while this package owns the shared account and credential lifecycle.

The base provides provider registration, browser/device/input challenges, cancellation and timeouts, token-free account projections, DSH credential storage, per-account cross-process refresh locking, and Typert Remote methods. It keeps a compatibility sign-in entry on the Host Models page and contributes the same OAuth login and account configuration flow to the independent Model Center provided by dsh-model-manager.

It deliberately does not own authorization endpoints, client identifiers, scopes, account-specific protocol details, model catalogs, LLM adapters, model requests, or model-provider configuration. Provider plugins contribute configuration through OAuth child slots and maintain their own model routes. The independent Model Center is the evolution path while the original Host Models page remains available.

Provider integration

import type { Context } from '@deepseek-ai/cordis'
import type {} from 'dsh-oauth'
import type { OAuthProviderDriver } from 'dsh-oauth/types'

const driver: OAuthProviderDriver = {
  id: 'example',
  displayName: 'Example Account',
  authorizationTimeoutMs: 900000,
  async authorize(interaction, signal) {
    interaction.publish({ kind: 'browser', url: 'https://example.test/oauth/authorize' })
    return {
      account: { id: 'stable-account-id', displayName: 'Example User' },
      credential: { schemaVersion: 1, accessToken: '...', refreshToken: '...' },
    }
  },
}

export function apply(ctx: Context): void {
  ctx.effect(() => ctx.oauth.registerProvider(driver), 'example-oauth-provider')
}

export const inject = ['oauth']

Providers may declare authorizationTimeoutMs for longer authorization flows such as device code. Drivers that omit it use the base loginTimeoutMs setting.

Development

pnpm install
pnpm run typecheck
pnpm test
pnpm run build
pnpm run pack:check

The package ships no real provider. Install a separate provider plugin to make sign-in available.

Security

OAuth credentials are stored through ctx.credentials. The Web Remote and account index never contain access or refresh tokens. The ordinary provider search preference uses dsh.oauth.settings.global.search.v1; one-time codes, passwords, device codes, and live sessions remain transient.