Introduction

DeepSeek Harness adopts an “everything is a plugin” architecture, allowing developers to enhance system functionality through extension components. When integrating external models, authorization flows often require additional orchestration and security handling. The dsh-codex-auth plugin aims to address this issue. It provides ChatGPT/Codex authorization capabilities for DeepSeek Harness, allowing users to complete login through the official Harness authorization service and enable the llm-pi-ai/openai-codex model route.

Plugin Overview

This is a standalone workspace plugin, primarily maintained by mhdfy1988 and licensed under the MIT License. It injects functionality through the Cordis plugin ID codex-auth and handles the authorization orchestration for ChatGPT login, the secure browser remote interface, and the on/off control of model routes.

Core Capabilities

The plugin mainly assumes the following responsibilities:

  1. Login Entry Extension: Add a ChatGPT login action to the openai-codex provider card in “Settings → Models”.
  2. Official Authorization Integration: Call the official Harness authorization service to complete the login flow.
  3. Model Routing Management: Provide a model route toggle to enable the llm-pi-ai/openai-codex route.
  4. Secure Interface: Provide authorization orchestration and a secure browser remote interface.
  5. Metadata Reading: Read metadata such as login status, credential type, and writability.

Installation and Build

Installation, upgrade, and uninstallation of this package should use the dsh-codex-auth-*.tgz package built from packages/plugin. The dsh-codex-auth-cli-proof in the root directory is a private phase-one CLI verification program and is not part of the delivery scope.

If you need to build it yourself, use the following commands:

pnpm.cmd install
pnpm.cmd --filter dsh-codex-auth test
pnpm.cmd --filter dsh-codex-auth build

Generate the versioned package:

Push-Location packages/plugin
npm.cmd pack --pack-destination ..\..\artifacts
Pop-Location

Usage

After obtaining the package, install it into Harness. After installation, the login action entry will appear on the openai-codex provider card in “Settings → Models”. Clicking the login action calls the official Harness authorization service to complete authentication and automatically enables the llm-pi-ai/openai-codex model route.

Notes and Boundaries

When using this plugin, note the following facts and limitations:

  1. Permissions and Security

    • The browser interface can only read metadata such as “whether logged in, credential type, and whether writable”; it cannot read the access token or refresh token.
    • The OAuth URL and device code are returned only during the authorization run and are cleared by the host after success, cancellation, or failure.

  2. Functional Scope

    • This package does not modify agent-loop, does not implement a second set of OAuth, does not create separate token files, and does not silently fall back to the old chain.
    • The read-modify-write for OAuth grant expiration refresh and the cross-process lock are covered by the official Harness llm-pi-ai and credentials-local modules.

  3. Migration Notes

    • When migrating from an early link: development install to a .tgz, first uninstall the old package through the Harness plugin command.
    • Confirm that node_modules/dsh-codex-auth under the Profile is no longer a junction pointing to the source workspace (especially on Windows systems).
    • A remaining junction on Windows can cause pnpm to read development dependencies through the old link and trigger EPERM when importing the official package. You must remove the remaining link before installing the versioned .tgz. Do not fall back to link: to mask the issue.

  4. Others

    • The “Sign Out” button for official credentials does not implement click logic, to avoid deleting the user’s current login; the deletion scope of this package is covered by automated tests.