@edge-sky/dsh-oauth-adapter 0.1.1-rc.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 edge-sky
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,4 @@
+# Bilingual-pair consistency record: the git blob hash of each side as of the
+# last confirmed-consistent state. Both languages carry equal authority.
+README.md: daae18fd1e5da6e5cd347f1f5a54fe89af9e201a
+README.zh.md: 96548d8ee3ae773c8f3d04af3815b51d3f6d9b2e

package/README.md

@@ -0,0 +1,33 @@
+# dsh-oauth-adapter
+
+English | [中文](README.zh.md)
+
+A Cordis plugin that adds model-provider OAuth login entry points to DSH (DeepSeek Harness). It currently supports:
+
+- [x] OpenAI Codex
+
+- [x] GitHub Copilot
+
+## Getting Started
+
+Install the npm package into DSH's `web` profile:
+
+```sh
+dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
+```
+
+After installation, DSH automatically adds the bundle to the profile. Start DSH:
+
+```sh
+dsh web --no-open
+```
+
+The plugin uses the runtime dependencies provided by the current DSH installation. At startup, it reports an incompatible version directly if the OAuth bridge or the Codex/Copilot providers are missing.
+
+Once DSH starts, connect Codex or GitHub Copilot under **Settings → Models**.
+
+## How It Works
+
+DSH integrates pi-ai through the `@deepseek-ai/dsh-llm-pi-ai` adapter, but does not provide an OAuth entry point. `@edge-sky/dsh-oauth-adapter` registers pi-ai's existing Codex and Copilot login flows with the DSH Authorization Service.
+
+The plugin itself does not manage OAuth credentials or maintain login state. Maybe DSH will support these login methods in the future, but for now this plugin provides a way to use them.

package/README.zh.md

@@ -0,0 +1,33 @@
+# dsh-oauth-adapter
+
+[English](README.md) | 中文
+
+为 DSH（DeepSeek Harness）提供模型 OAuth 登录入口的 Cordis 插件。当前支持：
+
+- [x] OpenAI Codex
+
+- [x] GitHub Copilot
+
+## 开始使用
+
+将 npm 包安装到 DSH 的 `web` profile：
+
+```sh
+dsh plugin --profile web add @edge-sky/dsh-oauth-adapter
+```
+
+安装后，DSH 会自动将 Bundle 加入该 profile。启动 DSH：
+
+```sh
+dsh web --no-open
+```
+
+插件使用当前 DSH 安装提供的运行时依赖；启动时若缺少 OAuth bridge 或 Codex/Copilot Provider，会直接报告版本不兼容。
+
+启动后，在**设置 → 模型**中连接 Codex 或 GitHub Copilot。
+
+## 工作原理
+
+DSH 通过 `@deepseek-ai/dsh-llm-pi-ai` 适配器接入 pi-ai，但并没有提供 OAuth 的入口。`@edge-sky/dsh-oauth-adapter` 将 pi-ai 已有的 Codex 与 Copilot 登录流程注册到 DSH Authorization Service。
+
+插件本身并不承担 OAuth 凭证管理与维持登录态的职责，或许将来 DSH 会官方支持这一登录方式，但至少现在你可以通过这个插件体验它

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-oauth-adapter
+      name: '@edge-sky/dsh-oauth-adapter'

package/lib/compat.d.ts

@@ -0,0 +1,17 @@
+/** Runtime compatibility checks for the DSH-provided pi-ai OAuth bridge. */
+type PiAiModule = typeof import('@deepseek-ai/dsh-llm-pi-ai');
+/** The pi-ai exports this plugin consumes from the active DSH installation. */
+export type PiAiOAuthBridge = Pick<PiAiModule, 'authContextFrom' | 'credentialStoreFrom' | 'piAiOAuthFlow' | 'piAiOAuthProviderIds'>;
+/**
+ * Validate the bridge exported by the active DSH installation.
+ * @param candidate - dynamically imported module namespace.
+ * @returns the compatible OAuth bridge.
+ */
+export declare function resolvePiAiOAuthBridge(candidate: unknown): PiAiOAuthBridge;
+/**
+ * Load the OAuth bridge through DSH's profile module fallback.
+ * @returns the validated bridge supplied by the active DSH installation.
+ */
+export declare function loadPiAiOAuthBridge(): Promise<PiAiOAuthBridge>;
+export {};
+//# sourceMappingURL=compat.d.ts.map

package/lib/compat.js

@@ -0,0 +1,60 @@
+/** Runtime compatibility checks for the DSH-provided pi-ai OAuth bridge. */
+const BRIDGE_PACKAGE = '@deepseek-ai/dsh-llm-pi-ai';
+const PACKAGE_NAME = '@edge-sky/dsh-oauth-adapter';
+const REQUIRED_EXPORTS = [
+    'authContextFrom',
+    'credentialStoreFrom',
+    'piAiOAuthFlow',
+    'piAiOAuthProviderIds',
+];
+const REQUIRED_PROVIDERS = ['openai-codex', 'github-copilot'];
+/** Whether a dynamically loaded module exposes a callable property. */
+function hasFunction(value, key) {
+    return typeof value === 'object' && value !== null
+        && typeof value[key] === 'function';
+}
+/**
+ * Validate the bridge exported by the active DSH installation.
+ * @param candidate - dynamically imported module namespace.
+ * @returns the compatible OAuth bridge.
+ */
+export function resolvePiAiOAuthBridge(candidate) {
+    const missing = REQUIRED_EXPORTS.filter(key => !hasFunction(candidate, key));
+    if (missing.length > 0) {
+        throw new Error(`${PACKAGE_NAME}: incompatible DSH installation: ${BRIDGE_PACKAGE} does not provide `
+            + `${missing.join(', ')}; install a DSH version with the pi-ai OAuth bridge`);
+    }
+    const bridge = candidate;
+    let providers;
+    try {
+        providers = bridge.piAiOAuthProviderIds();
+    }
+    catch (cause) {
+        throw new Error(`${PACKAGE_NAME}: incompatible DSH installation: ${BRIDGE_PACKAGE} cannot enumerate OAuth providers`, { cause });
+    }
+    if (!Array.isArray(providers) || !providers.every(provider => typeof provider === 'string')) {
+        throw new Error(`${PACKAGE_NAME}: incompatible DSH installation: ${BRIDGE_PACKAGE} returned an invalid OAuth provider directory`);
+    }
+    const absentProviders = REQUIRED_PROVIDERS.filter(provider => !providers.includes(provider));
+    if (absentProviders.length > 0) {
+        throw new Error(`${PACKAGE_NAME}: incompatible DSH installation: ${BRIDGE_PACKAGE} does not support OAuth provider(s) `
+            + `${absentProviders.join(', ')}`);
+    }
+    return bridge;
+}
+/**
+ * Load the OAuth bridge through DSH's profile module fallback.
+ * @returns the validated bridge supplied by the active DSH installation.
+ */
+export async function loadPiAiOAuthBridge() {
+    let candidate;
+    try {
+        candidate = await import(BRIDGE_PACKAGE);
+    }
+    catch (cause) {
+        throw new Error(`${PACKAGE_NAME}: incompatible DSH installation: cannot load ${BRIDGE_PACKAGE}; `
+            + 'install a DSH version with the pi-ai OAuth bridge', { cause });
+    }
+    return resolvePiAiOAuthBridge(candidate);
+}
+//# sourceMappingURL=compat.js.map

package/lib/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * OAuth authorization-flow contributions for DSH LLM providers.
+ *
+ * The plugin owns only the human authorization interaction. Provider request
+ * protocols, token refresh, model conversion, tools, and streaming stay with
+ * the adapter family whose credential record the flow writes.
+ * @module @edge-sky/dsh-oauth-adapter
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import type { AuthorizationService } from '@deepseek-ai/dsh-authorization';
+declare module '@deepseek-ai/dsh-authorization/types' {
+    interface AuthorizationSubjectMap {
+        /** OAuth flow joined to one DSH LLM provider route. */
+        'llm-provider': {
+            kind: 'llm-provider';
+            provider: string;
+        };
+    }
+}
+/** Plugin configuration. */
+export interface Config {
+    /** Emit redacted OAuth lifecycle diagnostics to stderr at debug level. */
+    debug?: boolean;
+}
+/** Runtime-validated plugin configuration. */
+export declare const Config: z<Config>;
+/** Cordis plugin name. */
+export declare const name = "dsh-oauth-adapter";
+/** Required authorization registry. */
+export declare const inject: string[];
+type OAuthContext = Context & {
+    authorization: AuthorizationService;
+};
+/** Register Codex and Copilot OAuth flows. */
+export declare function apply(ctx: OAuthContext, config: Config): Promise<void>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/lib/index.js

@@ -0,0 +1,48 @@
+/**
+ * OAuth authorization-flow contributions for DSH LLM providers.
+ *
+ * The plugin owns only the human authorization interaction. Provider request
+ * protocols, token refresh, model conversion, tools, and streaming stay with
+ * the adapter family whose credential record the flow writes.
+ * @module @edge-sky/dsh-oauth-adapter
+ */
+import { Logger } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { loadPiAiOAuthBridge } from './compat.js';
+/** Runtime-validated plugin configuration. */
+export const Config = z.object({
+    debug: z.boolean().default(false),
+});
+/** Cordis plugin name. */
+export const name = 'dsh-oauth-adapter';
+/** Required authorization registry. */
+export const inject = ['authorization'];
+/** Install the opt-in debug logger and return its secret-free message sink. */
+function debugSink(ctx, enabled) {
+    if (!enabled)
+        return undefined;
+    const loggerName = 'dsh-oauth-adapter';
+    const exporter = {
+        colors: false,
+        levels: { default: -1, [loggerName]: 3 /* LoggerLevel.DEBUG */ },
+        export: message => void process.stderr.write(`[D] ${message.name} ${Logger.format(exporter, message)}\n`),
+    };
+    ctx.logger.exporter(exporter);
+    const logger = ctx.logger(loggerName);
+    return (message) => { logger.debug('%s', message); };
+}
+/** Register Codex and Copilot OAuth flows. */
+export async function apply(ctx, config) {
+    const { authContextFrom, credentialStoreFrom, piAiOAuthFlow, } = await loadPiAiOAuthBridge();
+    const debug = debugSink(ctx, config.debug === true);
+    debug?.('diagnostics enabled; secret values and provider payloads are redacted');
+    const auth = { credentials: credentialStoreFrom(ctx), authContext: authContextFrom(ctx) };
+    const diagnosticOptions = debug === undefined ? {} : { debug };
+    const register = (provider, flow) => {
+        const subject = { kind: 'llm-provider', provider };
+        ctx.authorization.registerFlow({ ...flow, subject });
+    };
+    register('openai-codex', piAiOAuthFlow('openai-codex', auth, diagnosticOptions));
+    register('github-copilot', piAiOAuthFlow('github-copilot', auth, diagnosticOptions));
+}
+//# sourceMappingURL=index.js.map

package/lib/invariant.d.ts

@@ -0,0 +1,9 @@
+/** Package-owned invariant companion for `@edge-sky/dsh-oauth-adapter`. */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "dsh-oauth-adapter-invariant";
+/** Service required before package ownership is registered. */
+export declare const inject: string[];
+/** Register this package's invariant companion. */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/invariant.js

@@ -0,0 +1,11 @@
+/** Package-owned invariant companion for `@edge-sky/dsh-oauth-adapter`. */
+const PACKAGE_NAME = '@edge-sky/dsh-oauth-adapter';
+/** Cordis companion plugin name. */
+export const name = 'dsh-oauth-adapter-invariant';
+/** Service required before package ownership is registered. */
+export const inject = ['invariants'];
+/** No runtime invariant: dsh-authorization asserts the registered-flow lifecycle. */
+const install = () => { };
+/** Register this package's invariant companion. */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//# sourceMappingURL=invariant.js.map

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@edge-sky/dsh-oauth-adapter",
+  "description": "OAuth authorization-flow contributions for DSH LLM providers",
+  "version": "0.1.1-rc.3",
+  "author": {
+    "name": "edge-sky",
+    "url": "https://github.com/edge-sky"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/edge-sky/dsh-oauth.git"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "cordis.patch.yml",
+    "lib/**/*.js",
+    "lib/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-authorization": ">=0.1.1-rc.3 <0.2.0",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.3 <0.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-authorization": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-invariants": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm-pi-ai": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-authorization": ">=0.1.1-rc.3 <0.2.0",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.3 <0.2.0",
+    "@types/node": "^22.20.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "pnpm run build && vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}