dsh-codex-auth

DeepSeek Harness ships a complete agent loop, tool calling, and model routing pipeline, but plugging into an OpenAI Codex model route (such as GPT-5.6 Sol) still requires a secure ChatGPT login and authorization entry point. dsh-codex-auth is designed for exactly that: it adds a dedicated Codex section to the Web settings panel, identified by its own key icon, so users can complete a ChatGPT OAuth login entirely through the browser without ever touching a token file by hand.

The plugin keeps its scope deliberately narrow: authorization orchestration, a browser-safe metadata API, and a model-route toggle. The browser side can only read metadata such as login status, credential type, and writable state; it can never access the access token or refresh token. OAuth authorization URLs and device codes are returned only while an authorization run is active and are cleared by the host immediately after success, cancellation, or failure. The package does not reimplement OAuth, does not create a second token store, and does not silently fall back to a legacy path; it relies on @deepseek-ai/dsh-authorization for the authorization lifecycle and on llm-pi-ai for its OpenAI login adaptation and refresh logic.

Best suited for teams already running agents in Harness who want minimal friction to adopt a Codex model route. After installation, host restarts reuse the saved credentials automatically, and the full lifecycle-stable/next coexistence, upgrade, rollback, and uninstall-has been validated against real ChatGPT logins and GPT-5.6 Sol Web requests.