DSH Custom Provider Raw API Key

Use an opaque API key with a hand-declared custom provider in DeepSeek Harness, without modifying the Harness source checkout.

This is an independent DSH bundle. It replaces the official Models runtime and browser settings section together, so the key policy is consistent when a provider is edited, saved, discovered, and used.

Release 0.1.1 also implements the prepareCall(provider, model, signal) adapter contract used by DSH 0.1.1-rc.2; installing an older archive against that host produces registration.adapter.prepareCall is not a function.

中文文档 · GitHub repository

What it changes

• Custom providers accept a non-empty opaque key without a generic sk- or printable-ASCII format check.
• The key is kept as entered; the plugin does not add a prefix, trim it, or reinterpret it.
• Providers in the pi-ai catalog keep the official validation and authentication behavior.
• The bundle disables the two official loader rows before inserting the replacements, preventing duplicate runtime and settings registrations.

This plugin does not bypass transport rules. HTTP headers, fetch, gateways, and the upstream provider may still reject bytes that cannot be transported safely.

Install from source

The public repository currently contains the source and a reproducible bundle build. Build the bundle with Bun, then install the generated archive into the selected DSH profile:

git clone https://github.com/ARCJ137442/dsh-plugin-custom-provider-raw-key.git
Set-Location dsh-plugin-custom-provider-raw-key
bun run build
bun run test
Set-Location packages\bundle
bun pm pack --destination .

Install the generated dsh-plugin-custom-provider-raw-key-0.1.1.tgz into the target Web profile:

$env:DSH_HOME = '<dsh-home>'
$env:NODE_PATH = '<dsh-home>\profiles\web\node_modules;<dsh-home>\profiles\node_modules'
Set-Location '<dsh-home>\profiles\web'
bun add '<plugin-checkout>\packages\bundle\dsh-plugin-custom-provider-raw-key-0.1.0.tgz'
bun install

For the Bun-only workflow, install the archive directly with bun add. This avoids the current DSH plugin subcommand's legacy package-manager path. Restart the Web profile after installation:

Set-Location '<dsh-root>'
bun x --bun @deepseek-ai/dsh web --no-open

If a custom key contains Unicode format characters, line breaks, or other bytes that the selected protocol puts into an HTTP header, the provider client may reject it at request time. That is a transport limitation, not the plugin's custom-provider format policy; the plugin does not silently rewrite the stored secret.

Use

1. Open Settings → Models.
2. Create or edit a provider under Custom settings.
3. Enter the provider name, API address, protocol, model catalog, and API key.
4. Save the provider and reopen it to confirm the route configuration remains intact.

The plugin has no additional configuration section. Its behavior is determined by whether the provider is a hand-declared route or a provider present in the pi-ai catalog.

Provider policy

Provider	Key policy	Request behavior
Hand-declared custom provider	Opaque, non-empty value; no generic format rule	Passed to the custom route unchanged
pi-ai catalog provider	Official validator and normalization	Uses the official provider adapter behavior

“Unchanged” applies to the plugin policy. It is not a promise that an HTTP client, gateway, or upstream API accepts every possible byte sequence.

How it works

Models settings page
    │  edit / validate / save
    ▼
raw-key client bundle ── credentials reference ──► raw-key runtime
                                                       │
                         catalog lookup ──────────────┤
                         custom route: opaque key     │
                         catalog route: official key policy
                                                       ▼
                                                  pi-ai adapter

Both halves are required. Replacing only the browser client leaves runtime validation in place; replacing only the runtime leaves the settings page rejecting the key before save.

Verification

Validate the profile that users actually run, not only an isolated test profile:

1. --dump-config shows the official llm-pi-ai and ui-settings-models rows disabled and both raw-key rows inserted.
2. The process is bun.exe, remains alive, and reports no plugin loader error.
3. The root page returns HTTP 200 and /plugins/dsh-plugin-custom-provider-raw-key/client.js is reachable.
4. The browser completes a custom-provider create/edit/save/reopen flow with a non-standard key.

An upstream discovery or model request should be tested separately with the target provider. A successful settings save does not prove that the upstream endpoint accepts the route.

Development

The repository has three package surfaces:

packages/llm-pi-ai-raw-key/                  runtime fork and key policy
packages/client-ui-settings-models-raw-key/  browser Models settings fork
packages/bundle/                             single profile installation entry

Use Bun for installation, build, test, and packaging:

bun run build
bun run test
Set-Location packages\bundle
bun pm pack --dry-run

The client build reuses the published Models manifest only as dependency metadata for the host preset. It rewrites the generated loader/style identity inside the plugin checkout and never creates a temporary manifest or copies a package into deepseek-harness.

More detail:

• Architecture
• Maintainer release runbook
• Development lessons and handoff
• Changelog

Compatibility and privacy

The bundle declares its DSH peer ranges in packages/bundle/package.json. Test the bundle against the actual release installed in the target profile, not only against a newer local checkout.

Credential values and credential references must not be logged or committed. The repository ignores profile material, environment files, dependency trees, build maps outside the release bundle, and generated archives.

License

The packages are currently marked UNLICENSED. No license grant is made by this repository.