DSH Providers Extension

Manage LLM providers, accounts, model catalogs, reasoning effort, and provider execution modes from one DeepSeek Harness interface.

简体中文 · Features · 功能说明 · Install · 中文安装 · Configuration · 中文配置 · Architecture · 中文架构 · Security · Contributing · License

Install

Version 0.1.0 supports the exact DSH 0.1.0-rc.7 Host profile, pi-ai >=0.82.1 <0.83.0, and Node.js ^22.19.0 || >=24.0.0. DSH delegates plugin installation to pnpm, so pnpm must also be available on PATH.

dsh plugin --profile web add @fhgs/dsh-providers-extension@0.1.0

Restart dsh web, open Settings → Models, and choose Default, OAuth, or API. Confirm the installed layer before starting the UI:

dsh --profile web --dump-config

For a local checkout, one command builds the package, links it into the web profile, and checks the composed DSH configuration:

npm run dsh:install:local

See INSTALL.md for a fresh-clone command, release tarballs, updates, uninstall, rollback, and troubleshooting.

What it adds to DSH

• One provider control plane. Host-native Providers, OAuth accounts, API-key routes, and custom OpenAI-compatible endpoints appear in the same Models area without collapsing their identities.
• Live model catalogs. Refresh models without signing in again. A failed refresh keeps the last known good catalog and does not delete a valid credential.
• Exact model selection. Every choice retains Provider, route/account, model, reasoning effort, and Provider-owned mode such as fast, priority, or flex.
• Separate defaults and active sessions. Changing the new-session default does not rewrite an existing session. Composer and /model changes apply only to the current session.
• Model visibility controls. Choose which models, effort values, and modes appear in pickers. Hiding an item does not silently terminate an existing session.
• Replay-safe routing. Request logs retain the route and binding identity needed to replay a historical request without falling back to a different account.
• Fail-closed Host integration. The extension activates only when the Host version, reviewed module fingerprints, services, slots, RPC schema, and session-log schema match the 0.1.0 compatibility profile.

The complete user-facing capability list and first-release limits are in FEATURES.md.

Provider and authentication support

Provider path	Available in 0.1.0	Notes
DSH built-in Providers	Yes	Keeps the Host's API-key, environment, Bedrock, Vertex AI, and other native identity chains
Custom OpenAI-compatible endpoint	Yes	HTTPS endpoint, secret header, manual models or same-origin /v1/models discovery
Google Gemini OAuth	Conditional	Requires a Google Desktop OAuth client and quota project owned by the deployment
OpenRouter OAuth	No	Use an account-issued API key; the bundled OAuth implementation remains blocked pending client ownership and real-account review
Hugging Face OAuth	No	Use a fine-grained access token; OAuth distribution terms and real-account behavior remain under review
ChatGPT/Codex consumer login	No	It is not treated as a third-party OpenAI API OAuth grant
Claude Free/Pro/Max or Claude Code login	No	Use an API key or a Host-native enterprise identity chain

This table distinguishes an implemented protocol from an identity path that is permitted for public use. CONFIGURATION.md has the setup instructions and compliance boundaries.

How a selection is represented

The extension does not reduce a selection to a display string:

Provider → Route/account → Model → Effort → Mode

For example, a fast service tier is a Mode only when the Provider driver declares it. A separate high-speed model SKU remains a Model. Provider default means the request does not select a mode; it is not an explicit mode named default.

Safety model

Credentials stay in the Host credential backend. They do not enter settings documents, browser snapshots, catalog caches, session logs, screenshots, or npm artifacts. PKCE verifiers and authorization codes remain in Host memory.

Custom endpoints are checked before any stored credential is attached. The network boundary rejects private, loopback, link-local, metadata, DNS-rebinding, cross-origin redirect, query-secret, and oversized-response cases. Read SECURITY.md before connecting a private endpoint or testing a real OAuth account.

If the Host is unknown, incompatible, or drifted, the extension stays inactive and native DSH remains available. Do not edit the compatibility manifest to force activation; install a reviewed Host version instead.

Documentation

Document	Use it for
FEATURES.md / 功能说明	Capabilities, Provider paths, behavior, and first-release limits
INSTALL.md / 安装	npm, local checkout, tarball, update, uninstall, and rollback
CONFIGURATION.md / 配置	OAuth, API routes, custom Providers, model visibility, defaults, and session selection
COMPATIBILITY.md	Exact Host and pi-ai requirements
ARCHITECTURE.md / 架构	Runtime boundaries, activation, storage, and replay design
SECURITY.md	Credential handling, endpoint policy, disclosure, and threat boundaries
PROVENANCE.md	Release checksums, SBOM, attestations, and npm provenance
CHANGELOG.md	Versioned changes and release history

Develop from source

git clone https://github.com/yhyfhgs/dsh-providers-extension.git
cd dsh-providers-extension
npm ci --ignore-scripts
npm run check

The repository includes a credential-free UI prototype:

npm --workspace @fhgs/providers-extension-prototype run dev -- --host 127.0.0.1 --port 4173

The prototype demonstrates the interaction contract with mock data. It does not prove Provider eligibility, real-account OAuth behavior, or compatibility with a different Host build.

Release 0.1.0

The first formal release includes the production Host and Browser integration, packed-tarball install/uninstall/reinstall smoke tests, compatibility containment, catalog and credential fault tests, 5,000-model performance checks, accessibility gates, a CycloneDX SBOM, SHA-256 release artifacts, and a tag-driven publication workflow. See CHANGELOG.md for the full release record.

License

MIT © 2026 fhgs.