dsh-subscriptions

DeepSeek Harness normally calls models through API keys, but many developers already hold a Claude or ChatGPT/Codex subscription whose quota can only be spent inside each vendor's own client. dsh-subscriptions lets Harness reuse those subscriptions directly: one-time OAuth sign-in, automatic token refresh, and no API key to manage.

The plugin registers claude and codex Provider routes inside Harness, supporting text and image input while remaining fully transparent to the model — no extra tools, no prompt injection, no appended context. It only corrects accounting: Claude's input tokens already exclude cache reads while Codex includes them, and the plugin normalizes both so every cost display reports accurate context figures. Images are inlined as base64 on the Anthropic route and sent as data URLs on the Responses route; if a model's catalog entry does not declare image support the request is refused outright rather than silently dropping the attachment.

On the security side, credentials are written atomically with 0600 permissions under a cross-process writer lock, a failed refresh never overwrites the stored token, and no token ever appears in log lines, error messages, or the /status response. The control server binds to loopback only, keeping the attack surface minimal.

If you already pay for Claude or ChatGPT and want to keep calling them within DeepSeek Harness's unified workflow, this plugin eliminates a second API bill while preserving full streaming, image understanding, and retry behavior out of the box.