Name change

Published first as dsh-grok-build when it only covered Grok Build. The current name matches the full coding-subscription OAuth surface.

✨ Features

• 🧾 Bring your own subscription — SuperGrok, ChatGPT Plus/Pro, Kimi Code, Claude Pro/Max; no extra pay-as-you-go key.
• 🔑 Local OAuth, no key-pasting — authorize in Settings or CLI; access/refresh tokens never enter chat, logs or HTTP status.
• 🧩 One plugin, five providers — Grok Build (cli-chat-proxy.grok.com), Codex, Kimi Code, Claude Code and Google Antigravity.
• 🛡️ Secure by design — credential files are owner-only 0600, atomically written, cross-process locked.
• ⚙️ Dynamic catalog — the selector lists only signed-in routes, labelled (OAuth), including grok-4.6 xhigh.
• 🌐 Proxy-aware — proxies only reviewed subscription domains; Kimi China stays direct by default.

Problems this plugin solves

These are the searches and DSH errors that usually lead here. If one of them is your tab title, you are in the right repo.

Grok Build device login, live /v1/models-v2 and Responses streaming are verified on real deployments. Codex / Kimi / Claude reuse @earendil-works/pi-ai native OAuth instead of re-implementing vendor flows.

Supported providers

Grok Build's device login, dynamic /v1/models-v2 catalog and Responses streaming are verified on real deployments. Codex/Kimi/Claude reuse the provider-native OAuth/refresh from @earendil-works/pi-ai instead of re-implementing vendor flows.

🚀 Quick start

# 1. install the plugin into the web profile
dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth

# 2. optional — Google Antigravity (pinned, reviewed version)
dsh plugin --profile web add dsh-agy@0.1.2

# 3. restart the resident dsh web service
systemctl --user restart dsh-web.service

Then open Settings → Coding OAuth and sign in to any provider. Done — pick your authenticated model from the selector.

📚 Table of contents

• Name change
• Problems this plugin solves
• Install
• Settings page
• CLI
• Kimi in China
• Network proxy
• Resilience
• Credentials
• Architecture
• Technical notes
• Compliance
• Documentation
• Contributing
• License

Install

Requires DeepSeek Harness 0.1.0-rc.6+ and Node.js 22.19+. Full details in the installation notes.

# from GitHub
dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth

# or a local dev checkout
dsh plugin --profile web add ./dsh-coding-subscription-oauth

Restart dsh web after installing. Verification against a live deployment:

npm run verify:deployed            # checks real /api/llm.models + OAuth state
DSH_EXPECT_AGY_AUTH=signed-in npm run verify:deployed   # if Google is signed in

DSH_RESTORE_PROVIDER=openai \
DSH_RESTORE_MODEL=gpt-5.6-sol \
DSH_RESTORE_REASONING=max \
npm run smoke:deployed             # real Codex/Kimi tool-calls + second-turn replay

smoke:deployed creates temporary sessions, exercises Codex and Kimi tool-calls plus a second user turn (regression coverage for INVALID_REPLAY_STATE), restores the declared default model, then archives the sessions.

Settings page

Open Settings → Coding OAuth:

The selector only lists routes that completed authentication; unauthenticated providers return an empty list. Provider names carry (OAuth), and the catalog refreshes via llm/adapters-updated after sign-in/out.

CLI

# `dsh-grok-build` remains a command alias
dsh-coding-oauth login [--pkce] | import | status | logout

# newer providers
dsh-coding-oauth login codex --device-auth | codex --browser | kimi | claude
dsh-coding-oauth status all
dsh-coding-oauth logout codex

# Antigravity (install into web profile first)
pnpm --dir ~/.dsh/profiles/web exec dsh-agy login --headless

dsh-agy CLI edits the account pool outside the DSH process, so it can't emit an in-process catalog event — close and reopen the model selector after signing in/out.

Kimi in China

Kimi Code subscription OAuth uses https://auth.kimi.com; inference uses https://api.kimi.com/coding. https://api.moonshot.cn/v1 is the pay-as-you-go Moonshot Open Platform API-key channel — there is no switchable "China OAuth endpoint". This plugin uses a separate kimi-code-oauth route and doesn't affect an existing kimi-coding API-key config.

Network proxy

Priority: config.proxy → CODING_OAUTH_PROXY → GROK_BUILD_PROXY → HTTPS_PROXY/HTTP_PROXY.

- id: llm-grok-build-oauth
  config:
    proxy: http://127.0.0.1:7890
    proxyKimi: false

Only reviewed subscription domains are proxied (xAI/Grok, OpenAI Codex, Claude/Anthropic, Google Antigravity); all other DSH traffic keeps its original dispatcher. Kimi stays direct by default and only uses the proxy when proxyKimi: true.

Resilience

OAuth access tokens refresh proactively five minutes before their stored expiry (pi-ai 0.84+), so a request never rides a token into its final seconds. If an upstream still rejects a locally-valid token with 401/403 — server-side revocation or clock skew — the plugin backdates the stored credential and the retried step refreshes before reuse, recovering transparently instead of failing the turn.

Request retries use the harness retry policy: transient failures (RATE_LIMIT/SERVER/TIMEOUT/TRANSPORT/EMPTY_RESPONSE) and AUTH retry with exponential backoff (default 2 retries, 500 ms → 10 s, 10% jitter). Quota exhaustion and a dead refresh token are not retried — they fail fast with the real message and a sign-in prompt. Override per deployment:

- id: llm-grok-build-oauth
  config:
    retryPolicy:
      mode: normal
      maxRetries: 2
      retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, AUTH]
      backoff: { initialDelayMs: 500, maxDelayMs: 10000, jitterRatio: 0.1 }

Credentials

Owner-only 0600, atomically written, cross-process file lock:

• $DSH_HOME/.grok-build-auth.json
• $DSH_HOME/.codex-oauth-auth.json
• $DSH_HOME/.kimi-code-oauth-auth.json
• $DSH_HOME/.claude-code-oauth-auth.json

Selection caches live in the matching *-models.json files. No HTTP status, log or UI may ever return a token.

Architecture

flowchart LR
    subgraph DSH["DSH Harness"]
        UI[Settings / Web · Coding OAuth] --> LLM[llm route]
        LLM --> ALIA[Route-alias adapter]
    end
    ALIA --> PI[pi-ai native provider<br/>OAuth · refresh · stream]
    PI --> GROK[Grok Build]
    PI --> COD[Codex]
    PI --> KIMI[Kimi]
    PI --> CLAU[Claude]
    AGY[dsh-agy plugin] --> GAL[Google Antigravity]

Technical notes

• Grok Build: Responses API on cli-chat-proxy.grok.com/v1 (not api.x.ai), CLI fingerprint headers, live /v1/models-v2 including grok-4.6 reasoning.effort: xhigh.
• Codex/Kimi/Claude: pi-ai native providers handle OAuth and refresh; the route-alias adapter maps them to native ids so multi-turn replay does not throw INVALID_REPLAY_STATE.
• The Kimi access token is explicitly converted to Authorization: Bearer — never mistakenly an Anthropic x-api-key.
• Google Antigravity is not reverse-engineered here; it uses a version-pinned dedicated DSH plugin.

Compliance

Using coding subscriptions through a third-party harness may sit in a gray area of each vendor's terms and can trigger quota, regional or account-risk controls. Use only your own accounts; this project does not support bulk accounts, quota resale, remote relay, paywall bypass or client impersonation. For commercial use, prefer the vendors' official API-key channels.

Documentation

Related

• dsh-agy — separate pinned plugin for Google Antigravity.

Contributing

Contributions of all kinds are welcome — features, docs, translations, bug reports. See CONTRIBUTING for the flow, commit conventions and the release loop. If your language isn't listed, PR a README translation and we'll add it to the table above.

License

Apache-2.0 · see NOTICE. Portions derived from the dsh-xai project (Apache-2.0).