dsh-llm-openai-codex

The pi-ai adapter in DeepSeek Harness authenticates provider routes with API keys alone, so any OAuth-backed backend is rejected by its own validation. OpenAI's Codex backend is exactly that kind of provider: it speaks ChatGPT subscription OAuth, not a key. dsh-llm-openai-codex closes that gap. It reuses pi-ai's openai-codex provider catalog and generic request machinery, swapping the credential on every request for a ChatGPT OAuth access token, so the backend sees nothing but a normal Codex client.

Three capabilities stand out. First, credential management: browser PKCE or device-code login, automatic token refresh with a 60-second expiry margin, temp-file writes locked to mode 0600, and a hard guarantee that the plugin never deletes an existing shared Codex CLI auth file. Second, live model discovery: the route pulls the same model manifest the Codex CLI and ChatGPT web use, so a newly released OpenAI model appears in your picker without upgrading the plugin, pi-ai, or Harness. Models already in the catalog keep their hand-audited parameters; unknown ones are synthesized from the manifest. Third, route resilience: empty-body and transient provider errors retry twice by default, and modelOverrides lets you correct a single model's context window, thinking levels, or wire spelling without touching code.

Best suited to developers who already hold a ChatGPT subscription with Codex access, or engineers who have a Codex CLI login and want to fold it into a DeepSeek Harness workflow at zero extra API cost. No OPENAI_API_KEY required.