@sipi/dsh-openai-codex-auth

English | 中文

An independently versioned, installable OpenAI Codex device-login plugin for @deepseek-ai/dsh-llm-pi-ai. It contributes OAuth storage and the openai-codex interactive-auth controller without adding a second model adapter.

Install

dsh plugin --profile web add @sipi/dsh-openai-codex-auth

The bundle inserts one openai-codex-auth configuration row. Remove the same package to unload its controller and credential contribution without changing the base adapter:

dsh plugin --profile web remove @sipi/dsh-openai-codex-auth

The Models page then offers a ChatGPT device-code login. OAuth requests run in the DSH Node process; on Node 24, proxy environment variables require NODE_USE_ENV_PROXY=1 (or --use-env-proxy).

Configuration

Structured credentials are stored at $DSH_HOME/.llm-oauth.json. path overrides that file, dshHome changes the default home, lockTimeoutMs defaults to 30 seconds, lockStaleMs to 60 seconds, loginTimeoutMs to 16 minutes, and startupTimeoutMs to 30 seconds.

- id: openai-codex-auth
  name: '@sipi/dsh-openai-codex-auth'
  config:
    dshHome: ~/.dsh

The store serializes mutations in process and across processes. A provider generation prevents a login completing after logout from restoring a deleted credential. POSIX files are atomically replaced at mode 0600; Windows users must protect DSH_HOME with their account ACL. Browser RPC state never includes tokens or raw provider responses.

Extension Role

The plugin claims openai-codex in ctx.piAiCredentials and registers its controller on ctx.llm. dsh-llm-pi-ai snapshots that mapping with each Models collection, so an active request retains its original store while later requests observe load or unload. A second plugin claiming the provider fails loud.

Development

The current DSH release has no published pi-ai credential contribution seam. Develop this package beside the SIPI-patched deepseek-harness checkout that provides ctx.piAiCredentials and ctx.llm.registerProviderAuth(). Installing against an unpatched upstream release fails at startup rather than silently losing OAuth persistence. See compatibility notes.

Model Experience

OAuth authentication

What the model sees

Nothing. openai-codex login state and OAuth credentials stay outside model requests.

Token effect

Zero direct token effect.

KV Cache effect

Independent of cache identity. The selected openai-codex model request determines provider cache behavior.

Known Limitations and Deferred Work

• One login method — only OpenAI's device authorization is exposed.
• pi-ai catalog dependency — activation fails when the installed catalog does not expose openai-codex OAuth.