dsh-oauth-copilot

The Models page in DeepSeek Harness does not yet expose an OAuth surface, and the community dsh-oauth release is semver-incompatible with the 0.1.1-rc.2 package line. As a result, the GitHub Copilot model catalog has long lacked a clean sign-in and inference path for Harness users. dsh-oauth-copilot closes that gap by working directly against dsh official seams—ctx.credentials, ctx.authorization, and ctx.llm adapters—so the github-copilot model route is live the moment the plugin loads, with no third-party OAuth base and no local build step required.

The core capability is a human-driven terminal CLI that walks through GitHub device-code flow, writes the Copilot grant into the harness credential record with atomic 0600 permissions, and never routes the operation through an LLM. This structural isolation means a prompt-injection attack cannot start or drop an authorization. Once the grant is stored, pi-ai's catalog of 29 Copilot models registers as a selectable LLM route; a single refresh call narrows the picker to only the models enabled on your account. Security is layered: the endpoint whitelist accepts only the official host, any non-empty enterpriseUrl rejects the record outright, provider errors are JWT-and-token-pattern redacted before display, and the device-flow scope is pinned to read:user—ensuring credentials never leak.

Built for developers running dsh 0.1.1-rc.2 who want GitHub Copilot models as part of their daily inference stack without contending with third-party OAuth compatibility headaches. If you value an auditable credential lifecycle, a sign-in flow structurally isolated from the model layer, and a path free of unofficial middleware, this plugin is the one to reach for.