Introduction¶

DeepSeek Harness (DSH) is a plugin-architecture-based LLM invocation framework. When using Kiro (the successor to AWS CodeWhisperer/Q) as the backend model, developers usually need to manually handle credential storage, token refresh, and interaction details with the Kiro API. The dsh-llm-aws-kiro plugin is designed to solve these problems. It integrates Kiro into DSH, handles credential pickup, silent refresh, and model invocation logic, and enables developers to access Kiro model services directly through DSH interfaces.

Core Features¶

This plugin is mounted as an independent Cordis plugin. Through cordis.yml, it registers the kiro provider routed to ctx.llm, without modifying Harness itself. Core capabilities include:

• Credential management: Automatically picks up existing kiro-cli login credentials (including the auth_kv table in the SQLite store, IDC, and social tokens) and the Kiro IDE token (~/.aws/sso/cache/kiro-auth-token.json). It supports using the bearerTokenEnv environment variable to specify a static token and bypass environment discovery, making it suitable for CI or bot scenarios.
• Silent refresh: Automatically refreshes expired tokens via AWS SSO OIDC or the Kiro desktop authentication service and writes them back to the kiro-cli store, ensuring all consumers stay synchronized. If a 403 error is encountered, it attempts to re-read the shared store or invokes kiro-cli debug refresh-auth-token.
• Backend handling: Responsible for region/endpoint resolution (SSO region to Kiro API region), management control plane operations (such as fetching Profiles and model lists), and runtime generateAssistantResponse calls using the AWS event stream protocol.
• Model catalog: Provides a bootstrap catalog for quick model resolution and supports authenticated discovery, fetching latest published model metadata and updating the cache.
• Reasoning capabilities: Supports Thinking markers and reasoning effort mapping, mapping DSH effort vocabulary (off/low/high/max) to the Kiro effort schema.

Installation and Activation¶

This plugin declares Harness packages as peer dependencies and requires the DSH main process to provide the corresponding package versions. When installing, ensure the environment satisfies the dependency requirements.

Run the following command to install the plugin:

dsh plugin --profile <profile> add @joshryandavis/dsh-llm-kiro

After installation, mount the plugin configuration in cordis.yml:

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    region: us-east-1        # 可选；省略时使用凭证区域
    reasoningEffort: high    # 可选；off | low | high | max

Configuration Reference¶

All configuration options are optional. Changes take effect on the next request without restarting.

Notes¶

• Credential requirements: The plugin does not include interactive login functionality. If environment credentials are not detected, it reports a MISSING_CREDENTIAL error. Ensure that you have already logged in locally via kiro-cli login or the Kiro IDE.
• Peer Dependencies: Requires the same version of the @deepseek-ai series of packages; otherwise it cannot run.
• Model list: The model list consists of a bootstrap catalog and authenticated discovery. By default, it uses the bootstrap catalog and refreshes authenticated discovery data in the background to keep the model selector available.

Summary¶

dsh-llm-aws-kiro is a practical plugin for integrating Kiro services into DeepSeek Harness. Through environment credential pickup and silent refresh mechanisms, it lowers the integration barrier for the Kiro API while providing complete support for model management and reasoning capabilities.

Plugin Directory
GitHub Repository