Foreword

A common issue when using the openai-codex model provider in DSH is the fragmented handling of OpenAI subscription login, local credentials, and DSH settings: requiring constant switching between authorization, token status, and model provider configuration. yoke233/dsh-openai-codex-auth is an OpenAI Codex OAuth login plugin for DeepSeek Harness, designed to enable login, view usage, and provide valid credentials to the openai-codex provider within the DSH Web settings page.

What This Is

This plugin, maintained by yoke233 under the MIT license, integrates ChatGPT subscription login into DSH: connecting ChatGPT Plus, Pro, Team, or Enterprise accounts via OAuth and providing valid tokens to the openai-codex model provider.

In DSH’s plugin ecosystem, such capabilities are extended as plugins. The directory page mentioned here is a community directory, an independent site with no official affiliation to DeepSeek / High-Flyer, and should not be interpreted as an official app store.

Core Features

  • Connect ChatGPT Plus, Pro, Team, or Enterprise accounts via OAuth.
  • Display short-term and weekly usage, remaining quotas, and reset times.
  • Refresh tokens when nearing expiration and update local credentials.
  • Provide valid tokens to the openai-codex model provider.
  • Support viewing status, refreshing usage, re-logging in, and logging out.

Installation and Enablement

First, install the plugin to DSH’s web profile:

dsh plugin --profile web add github:yoke233/dsh-openai-codex-auth

After installation, start or restart the profile:

dsh --profile web

First Login

  1. Open DSH Web and go to Settings → OpenAI Codex.
  2. Click “Login to OpenAI” and complete the OpenAI authorization.
  3. Return to DSH and select openai-codex in Settings → Model Providers.

Note: The login management interface only listens on 127.0.0.1, and authorization should be completed on the same computer running the DSH Web profile.

Configuring Credentials Path

By default, the plugin writes credentials to a local file:

$DSH_HOME/openai-codex-auth.json

To change the path, set path in the Cordis configuration:

- insert:
    - id: openai-codex-auth
      name: dsh-openai-codex-auth
      config:
        path: /secure/path/openai-codex-auth.json

The path setting takes precedence over dshHome.

Local Services and Credential Boundaries

  • The control service 127.0.0.1:1456 is not persistent; it starts on demand and closes after a single request completes.
  • The TUI’s /login-codex starts a temporary OAuth callback port localhost:1455, which closes when the process ends or is canceled.
  • Credentials directory and files are created with owner-only permissions and updated via atomic writes.
  • Access tokens and refresh tokens are only stored on the Host side; the web page does not read or save them.
  • State change requests like logout must include a CSRF token.

Connecting via Proxy

If the environment starting DSH requires an HTTP proxy to access OpenAI, add proxy environment variables to the startup command:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://127.0.0.1:7890 HTTPS_PROXY=http://127.0.0.1:7890 dsh --profile web

Use Cases and Considerations

This plugin is suitable for developers already using the openai-codex model provider in DSH who wish to integrate OpenAI subscription login and usage viewing into the DSH Web settings page.

Before use, note:

  • The plugin runs with the permissions of the current dsh process. It is recommended to review the GitHub source code and MIT license before installation.
  • Login authorization must be completed on the same computer running the DSH Web profile.
  • This article is based solely on verified installation, functionality, and credential handling instructions, and does not include unverified conclusions about account quotas or risk controls.
  • Directory page: https://www.skillhub.cn/plugins/yoke233/dsh-openai-codex-auth
  • GitHub: https://github.com/yoke233/dsh-openai-codex-auth