dsh-cliproxy

Running Claude, OpenAI/Codex, and Gemini side by side in DeepSeek Harness means juggling three incompatible auth systems, request protocols, and key stores. dsh-cliproxy collapses that surface into a single local loop: one CLIProxyAPI instance handles browser login, token refresh, protocol translation, and model routing, while the plugin simply fires OpenAI-compatible streaming requests to 127.0.0.1. The three provider routes (cliproxy-claude, cliproxy-openai, cliproxy-gemini) appear in the DSH model catalog the moment you restart the harness.\n\nThe Gemini path uses Google Antigravity OAuth, so a one-time browser authorization is all that is required and no separate Gemini API key is needed. CLIProxyAPI owns the OAuth scopes, project discovery, Antigravity envelope wrapping, tool-schema sanitization, token refresh, and model-specific output caps on the wire. The plugin never copies Google's client secret or account tokens and never assembles an upstream request body itself, eliminating the risk of a second, independently drifting protocol implementation.\n\nThis plugin is built for developers who already operate inside a DSH pipeline and need to orchestrate across vendors without repeatedly switching credential stores or config files. Google access and refresh tokens live exclusively in CLIProxyAPI's auth directory; the plugin neither reads them nor writes them to logs. Local-config discovery is guarded by the readLocalProxyKey flag and is automatically disabled for any non-loopback destination, so the proxy access key is never sent implicitly to a remote endpoint. The current release is text-only: image, audio, and video inputs are refused before a request leaves the host.