dsh-oauth

1. 安装并启动 DeepSeek Harness：npx @deepseek-ai/dsh web
2. 在终端执行上面的安装命令（CLI 会解析插件并核验来源）
3. 用 dsh plugins list 确认已安装，必要时重启 Harness 生效

插件以当前 dsh 进程的权限运行，安装时可能执行代码。请先通读仓库源码与许可证，确认无破坏性命令与越权访问；本站只做索引，不对第三方插件安全性作担保。

事实信息来自公开插件目录快照（2026-10-03），介绍文案由本站再加工。

以下为插件仓库 README 全文（原始内容，由公开目录抓取整理）。

# dsh-oauth

English | [简体中文](README.zh-CN.md)

`dsh-oauth` is a provider-neutral OAuth foundation for DeepSeek Harness. It does not embed OpenAI, ChatGPT, Codex, or any other vendor protocol. Independent provider plugins register drivers while this package owns the shared account and credential lifecycle.

The base provides provider registration, browser/device/input challenges, cancellation and timeouts, token-free account projections, DSH credential storage, per-account cross-process refresh locking, and Typert Remote methods. It keeps a compatibility sign-in entry on the Host Models page and contributes the same OAuth login and account configuration flow to the independent Model Center provided by `dsh-model-manager`.

It deliberately does not own authorization endpoints, client identifiers, scopes, account-specific protocol details, model catalogs, LLM adapters, model requests, or model-provider configuration. Provider plugins contribute configuration through OAuth child slots and maintain their own model routes. The independent Model Center is the evolution path while the original Host Models page remains available.

## Provider integration

```ts
import type { Context } from '@deepseek-ai/cordis'
import type {} from 'dsh-oauth'
import type { OAuthProviderDriver } from 'dsh-oauth/types'

const driver: OAuthProviderDriver = {
  id: 'example',
  displayName: 'Example Account',
  authorizationTimeoutMs: 900000,
  async authorize(interaction, signal) {
    interaction.publish({ kind: 'browser', url: 'https://example.test/oauth/authorize' })
    return {
      account: { id: 'stable-account-id', displayName: 'Example User' },
      credential: { schemaVersion: 1, accessToken: '...', refreshToken: '...' },
    }
  },
}

export function apply(ctx: Context): void {
  ctx.effect(() => ctx.oauth.registerProvider(driver), 'example-oauth-provider')
}

export const inject = ['oauth']
```

Providers may declare `authorizationTimeoutMs` for longer authorization flows such as device code. Drivers that omit it use the base `loginTimeoutMs` setting.

## Development

```sh
pnpm install
pnpm run typecheck
pnpm test
pnpm run build
pnpm run pack:check
```

The package ships no real provider. Install a separate provider plugin to make sign-in available.

## Security

OAuth credentials are stored through `ctx.credentials`. The Web Remote and account index never contain access or refresh tokens. The ordinary provider search preference uses `dsh.oauth.settings.global.search.v1`; one-time codes, passwords, device codes, and live sessions remain transient.

## License

MIT