Introduction

DeepSeek Harness extends functionality through a plugin mechanism. This plugin integrates SuperGrok / X Premium subscriptions directly into DSH. It reuses the token in the local ~/.grok-bridge/auth.json file, so no xAI API key is required.

Core Features

  • Native OAuth provider, no API key required
  • Reuses local grok-bridge tokens
  • Supports headless, web, and any terminal profile
  • Supports device code login
  • Automatic token refresh (5 minutes before expiration and on HTTP 401)
  • Supported models: grok-4.7、grok-4.5、grok-4.3

Installation and Configuration

Before installation, ensure the environment meets the following: Node.js ≥ 22.19 and DeepSeek Harness CLI.

dsh plugin --profile headless add dsh-llm-xai-oauth@latest

After installation, confirm that the plugin has been loaded (ID is llm-xai-oauth); otherwise the /model route may not be available:

dsh --profile headless --dump-config | grep llm-xai-oauth

Authentication Flow

Run the login command, and the plugin will try to reuse an existing local token:

npx dsh-llm-xai-oauth login

If no local token exists or forced re-login is required:

npx dsh-llm-xai-oauth login --force

For Windows desktop builds, because the console may not be visible, the plugin automatically opens a local page in the browser to complete device code authorization.

Token Refresh Mechanism

Access tokens are valid for about 1 hour. If the dsh process is not running, it will not refresh the token. To ensure long-running operation, start a standalone daemon:

npx dsh-llm-xai-oauth daemon --install

This command creates a user-level systemd service that checks the token once every minute and refreshes it 5 minutes before expiration. If you do not want to use system services, you can also schedule it with cron:

*/20 * * * * npx --yes dsh-llm-xai-oauth refresh >/tmp/dsh-xai-refresh.log 2>&1

Usage Examples

Specify the xai provider and grok-4.7 model in any profile:

dsh --profile tui --provider xai --model grok-4.7

Or directly use the default configuration:

dsh --profile headless --provider xai --model grok-4.7

Notes

  • When updating the plugin, you must use @latest; otherwise it will be pinned to an old version.
  • Windows desktop builds require visual guidance on first run.
  • Token refresh depends on the daemon. If dsh is not running and there is no daemon, expired tokens will cause 401 errors.
  • The default model configuration is located in $DSH_HOME/settings.yaml and must be set to agent-default-model -> xai / grok-4.7.

Reference Links