Introduction¶

The philosophy of DSH (DeepSeek Harness) is that everything is a plugin, and model access is no exception: what provider is mounted on the LLM seam is determined by the harness composition. When actually integrating a new backend, developers typically have to handle three things—where credentials come from, how to refresh tokens when they expire, and who encapsulates the backend protocol details.

If you are already using kiro-cli or Kiro IDE, your machine actually has a set of valid login credentials. Logging in again specifically for DSH is not only an extra step but also causes the token state to be maintained separately in two places, preventing synchronization.

Below is an introduction to @joshryandavis/dsh-llm-kiro. It is the Kiro (successor to AWS CodeWhisperer/Q) provider for DeepSeek Harness. The idea is to pick up existing credentials, silently refresh them, and wrap the Kiro runtime and management API into a standard provider route.

What is This¶

dsh-llm-kiro is maintained by joshryandavis, licensed under MIT, and is currently at version 0.1.1. It is a standalone Cordis plugin: it can be mounted to any harness composition via cordis.yml, registering a kiro provider route on ctx.llm, without needing to modify the harness itself. The package includes cordis.patch.yml, so it can also be mounted as a profile bundle.

Core Features¶

Reusing Existing Credentials¶

The plugin automatically picks up two types of existing login credentials, requiring no secondary login:

kiro-cli login: Reads the auth_kv table from kiro-cli’s SQLite storage, overwriting IDC and social tokens.
Kiro IDE token: Reads ~/.aws/sso/cache/kiro-auth-token.json and its accompanying OIDC client registration.

For CI / bot scenarios, you can configure bearerTokenEnv in the config to reference a static bearer token, bypassing environment credential discovery.

Silent Token Refresh¶

After a token expires, the plugin silently refreshes it via the AWS SSO OIDC /token endpoint (Builder ID / IAM Identity Center) or the Kiro desktop auth service (Google/GitHub social login), and writes it back to the kiro-cli store, ensuring both consumers stay synchronized.

If a 403 is received during a streaming request, the plugin first re-reads the shared store and then falls back to kiro-cli debug refresh-auth-token; if it ultimately fails, it presents MISSING_CREDENTIAL / AUTH.

Backend Protocol and Stability¶

Region resolution derives the Kiro API region from the SSO region; the management control plane covers List-Available-Profiles and List-Available-Models, and the directory cache is written to the shared ~/.kiro-management-models-cache.json. Runtime calls use generateAssistantResponse on the AWS event-stream protocol (via Smithy framing from @smithy/core), and handle capacity backoff, first token timeout, and the harness idle watchdog.

Each runtime request carries the harness attribution User-Agent (from @deepseek-ai/dsh-llm’s attributionHeaders()) and an AWS SDK-style x-amz-user-agent.

Model Catalog and Reasoning Effort¶

The plugin includes a built-in bootstrap catalog of 15 models, containing context windows, output limits, reasoning capabilities, and image modality; it performs precise parsing between the dashed harness id and dotted wire id; management discovery supports the Models page.

The harness’s off / low / high / max reasoning effort vocabulary is mapped to the authenticated effort schema of each model, and the system prompt is tagged with Kiro thinking.

Installation and Usage¶

The package is ESM, and harness-related packages are declared as peer dependencies (dsh series packages >=0.0.1-rc.1, cordis and schemastery >=3.0.0), provided by the host DSH installation. The installation command:

dsh plugin --profile <profile> add @joshryandavis/dsh-llm-kiro

Replace <profile> with the target profile. After installation, mount it in cordis.yml:

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    region: us-east-1        # Optional; omitted uses the credentials' region
    reasoningEffort: high    # Optional; off | low | high | max (default high)

For users who already have kiro-cli or Kiro IDE login on the machine, this is all the configuration needed: credentials are automatically picked up, silently refreshed, and written back.

Typical Usage¶

Following the steps above, the plugin has registered a kiro route on ctx.llm. Below are two common scenarios.

CI / Bot Using Static Bearer Token¶

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    bearerTokenEnv: KIRO_BEARER_TOKEN   # Stored via harness credentials service

This way, credentials do not come from environment discovery, but from KIRO_BEARER_TOKEN stored in the harness credentials service, suitable for unattended environments.

Runtime Configuration¶

All configuration items are optional. The user-settings segment of llm-kiro uses the same schema and can be edited at runtime; changes take effect on the next request without a restart.

Use Cases and Considerations¶

Suitable for two types of users:

DSH users who already have kiro-cli or Kiro IDE login on their machine and wish to connect to the Kiro backend with zero extra login steps.
CI / bots that provide static credentials via bearerTokenEnv.

Pre-use considerations:

The plugin does not include interactive login: if there are no environment credentials, it fails with MISSING_CREDENTIAL and points to kiro-cli login or Kiro IDE. The device code flow can be added later on the management seam.
Legacy inline thinking dialect: reasoning is delivered via the native thinkingText event; if the model outputs <thinking> tags in the content, they will be preserved in the visible text blocks.
No replay state; when following up, history is resent with provider-neutral content.
Management directory refresh is pull-based (triggered by discovery or cache age), not background warm-up; the directory cache ~/.kiro-management-models-cache.json is shared with pi-provider-kiro.
The project uses a vitest test suite with 95 tests, and credential testing is completely isolated from the host’s real kiro-cli / Kiro IDE storage.

One final security reminder: the plugin runs with the permissions of the current dsh process. It is recommended to check the source code and license (this project is MIT) before installing.

Conclusion¶

dsh-llm-kiro solves a specific problem: it allows DSH to directly reuse your existing Kiro login, consolidating credential picking, silent token refresh, and Kiro runtime / management API protocol details into a single plugin, with all configuration being optional and editable at runtime. If you are using kiro-cli or Kiro IDE together with DSH, it allows both to share the same set of credential states.

Community directory page: https://www.skillhub.cn/plugins/joshryandavis/dsh-llm-kiro
GitHub repository: https://github.com/joshryandavis/dsh-llm-kiro

SkillHub is an independently maintained community plugin directory and has no official affiliation with DeepSeek / 幻方.

dsh-llm-kiro: DeepSeek Harness LLM Provider Plugin for Reusing Existing Kiro Credentials