Introduction

In the DeepSeek Harness plugin ecosystem, subscription login is typically implemented by multiple plugins separately, with each plugin hard-coding its list of supported providers. This approach has high maintenance costs and is difficult to adapt to new providers.

dsh-subscription-login addresses this issue. It reads the Harness ctx.authorization seam to dynamically obtain the currently registered OAuth login flows. This allows it to provide a unified console that displays all available login flows without code changes.

Plugin Overview

  • Name: dsh-subscription-login
  • Owner: woodfood111
  • License: MIT
  • Category: Client

Core Features

  1. Dynamic Flow List: Providers are not hard-coded in code; instead, the OAuth flow list is read from ctx.authorization. When dsh-llm-pi-ai registers new login flows, the plugin can display them without modification.
  2. Security Protection: All requests are checked through ctx.connection.requestRejection(). This includes Host/Origin protection (preventing DNS rebinding) and browser authentication. Bare requests return 401 instead of 200.
  3. Key Management: The plugin does not handle keys; it only calls describeRecord(). All flows run inside dsh-llm-pi-ai and write to Harness credential storage.
  4. Unclaimed Record Cleanup: Provides cleanup for unclaimed records, used to handle llm-pi-ai scoped records that are no longer claimed by any flow.
  5. Unified Management Interface: Provides a unified entry point for login management under Settings → Plugins → Subscriptions.

Installation and Enabling

The installation command is as follows:

dsh plugin --profile web add dsh-subscription-login

After installation, you must restart dsh web for the changes to take effect. This is because the authorization seam and this plugin itself are inserted via a Bundle Patch, and hot reload cannot reliably load these file-writing changes.

After restarting, visit Settings → Plugins → Subscriptions to access the management interface.

Usage

In the plugin interface, each row represents an account that can be logged in:

  1. Login: Clicking Login starts a flow that guides the user to open the designated page and enter a verification code. The plugin supports canceling a login attempt at any time.
  2. Logout: Clicking Logout deletes the local record. This operation requires a second confirmation.
  3. Delete Unclaimed Records: For expired records that are no longer claimed by any flow, click delete directly.

After a successful login, the Settings → Models page displays the corresponding provider row and its credential status.

Notes

  • Request Body Limit: The request body size is limited to 64 KiB. Non-JSON request bodies return a 400 error.
  • Feature Scope: Server-side revocation is not supported (only local records are deleted). Recoverable login attempts are not supported (refreshing the page starts over). Recommendations, quota tracking, and health checks are not included.
  • Scope Limitation: Only processes and deletes records in the llm-pi-ai/<provider> scope.

Technical Details

  • No Build Step: lib/client.js is a directly executable client module format (window.__ModuleLoader__.load factory pattern) and does not require compilation.
  • Test Coverage: Includes 52 offline tests covering registration, routing, trust fences, and client interactions.

Reference Resources

  • GitHub: https://github.com/woodfood111/dsh-subscription-login
  • Plugin Directory: https://www.skillhub.cn/plugins/woodfood111/dsh-subscription-login