Preface

The plugin philosophy of DSH is “everything is a plugin”. At the LLM seam level, developers often encounter a specific problem: the machine is already logged into AWS Kiro, but DeepSeek Harness still needs a valid provider route to bring in Claude and open-weight models. caopu16/dsh-llm-kiro does exactly this: it registers a kiro provider route, allowing the logged-in Kiro account to provide model services to the harness without needing to maintain a separate set of API keys.

What is this

caopu16/dsh-llm-kiro is a DeepSeek Harness plugin, not a standalone tool. It is maintained by caopu16 and is licensed under MIT.

Its main positioning is:

  • As an AWS Kiro (CodeWhisperer) adapter for the DeepSeek Harness LLM seam.
  • Register the kiro provider route.
  • Allow logged-in Kiro accounts on the same machine to provide Claude and open-weight models via harness.

Two basic conditions must be met before use:

  1. A valid dsh installation.
  2. Kiro sign-in already exists on the same machine. Kiro IDE or kiro-cli writes the token that this adapter reads.

The Node version requirement is:

^22.19 || >=24

Core Capabilities

The following introduces the capabilities of this plugin that have been verified.

Register kiro provider route

The plugin registers a kiro provider route, enabling the harness to call models via the kiro provider. It comes with a patch layer, so after installation, the adapter can be mounted without needing to modify cordis.yml to make the route exist.

Use logged-in Kiro accounts to provide models

Logged-in Kiro accounts can provide Claude and open-weight models to the harness without needing to provide API keys separately. Model IDs are passed directly to the service as the wire modelId. The catalog included with the plugin is advisory only; IDs not listed will still reach the service, and actual availability may vary depending on the account tier.

Configuration namespace supports hot reload

The plugin registers llm-kiro as a settings namespace within $DSH_HOME/settings.yaml. This configuration section supports reload without downtime and takes priority over the composition entry.

Supported configuration fields:

proxyUrl
region
profileArn
thinking
reasoningEffort
defaultContextWindow
models
streamIdleTimeoutMs
tokenExpiryBufferMs
retryPolicy

Proxy connection method

When using a proxy, the plugin opens the proxy using an HTTP CONNECT tunnel and completes TLS negotiation within the tunnel. This means the proxy can only see the target host name, not the request content or the bearer token.

Credential handling

The adapter reads Kiro’s credential cache. If the access token has expired, it exchanges it for a new token using a refresh token in memory and caches it only in memory, without writing a separate copy of the credentials. If Kiro sign-in is missing, the first request will fail with the error MISSING_CREDENTIAL, indicating the expected path.

profileArn discovery and override

The plugin discovers the profileArn from the profile.json written by Kiro, which is located under Kiro’s globalStorage. The profileArn in the configuration takes precedence over automatic discovery. For IdC or Enterprise accounts, if no profile is explicitly specified, the request may be rejected due to a missing default profile, returning a 403.

Installation and Enablement

The following provides a reproducible set of installation steps.

First, execute the official installation command:

dsh plugin --profile web add github:caopu16/dsh-llm-kiro

If running within a harness source checkout instead of relying on the installed dsh command, build first, then add the plugin, and then start:

pnpm run build
pnpm dsh plugin --profile web add github:caopu16/dsh-llm-kiro
pnpm dsh --profile web

The built lib/ has been committed to the repository, so no build script is executed extra when installing from git. If you modify src/, you must rebuild and commit first for changes to reach the user.

Typical Usage

After enabling it, select the provider kiro and then choose the model ID it provides.

Example models include:

claude-opus-5
claude-sonnet-4
deepseek-3.2
glm-5
minimax-m2.5
qwen3-coder-next

These IDs are passed through directly to the service as the wire modelId.

If the Claude model requires access through an allowed network egress, you can configure a proxy in the llm-kiro: section of $DSH_HOME/settings.yaml:

llm-kiro:
  proxyUrl: http://proxy.example:1082
  reasoningEffort: medium

This settings section supports hot reload and takes priority over the composition entry.

If you wish to pin a certain field to a specific profile instead of the current machine, you can also modify the patch file under the profile:

# ~/.dsh/profiles/<name>/cordis.patch.yml
- id: llm-kiro
  config:
    proxyUrl: http://proxy.example:1082

There are two points to note here:

  1. This entry targets an existing row by ID; do not wrap it in an insert: list.
  2. The patch layer only takes effect after a restart; the settings section supports hot reload.

Do not insert a second patch entry with id: llm-kiro, as duplicate loader entries will cause the profile to fail at startup with the error:

duplicate loader entry id: llm-kiro

Applicable Scenarios and Notes

This plugin is suitable for developers who have already completed Kiro sign-in on the local machine and wish to use the kiro provider route in DeepSeek Harness.

Pay attention to the following before use:

  • It depends on a valid dsh installation, not a standalone tool.
  • Claude models require permitted network egress; the plugin does not include a proxy by default.
  • If the proxyUrl value is invalid, the plugin load will fail.
  • If there is no Kiro sign-in, the first request will fail with MISSING_CREDENTIAL.
  • The catalog is advisory only; model IDs not listed will still be sent to the service; availability may vary depending on the account tier.
  • IdC or Enterprise accounts may not have an implicit default profile; if no profileArn is named, the request may be rejected as 403.
  • The plugin runs with the permissions of the current dsh process. It is recommended to check the source code and license before installing; this project is licensed under MIT.
  • The DSH community directory is a separate site and has no official affiliation with DeepSeek / Hypersphere; it should not be understood as an official app store.

Get it

GitHub repository:

https://github.com/caopu16/dsh-llm-kiro

Directory page:

https://www.skillhub.cn/plugins/caopu16/dsh-llm-kiro

Following the steps above, dsh-llm-kiro will register the kiro provider route, allowing logged-in Kiro accounts to provide Claude and open-weight models in DeepSeek Harness, while keeping proxy, credential, and profile configurations within a clear, auditable scope.