dsh-plugin-subscriptions: subscription OAuth providers for DeepSeek Harness

The API key problem dsh-plugin-subscriptions removes

DeepSeek Harness expects LLM providers to be configured with credentials. For anyone already paying for ChatGPT Plus, Claude Pro or Max, X Premium, GitHub Copilot or Google Antigravity, that means paying twice: once for the subscription and again per token through a metered API key. The plugin's answer is to treat the subscription itself as the provider. Its README states the goal directly: use those subscriptions as LLM providers in DeepSeek Harness, with no API keys.

The audience is narrow and specific. You need DeepSeek Harness installed, you need at least one of those five subscriptions, and you need to be comfortable logging into a third-party account from inside the Harness web UI. The plugin is a TypeScript package published as dsh-plugin-subscriptions, version 0.9.2, under MIT. It is not a proxy you run as a separate daemon. It is a plugin that registers providers, tools and settings pages inside Harness itself, which is why the login flow lives at Settings then Subscriptions rather than in a terminal.

How the five provider routes are wired

The README gives a route table, and the routes are not symmetrical. Codex, Grok and Antigravity log in through OAuth in the dsh web UI. Copilot uses the GitHub OAuth device flow, where you enter a displayed code at github.com/login/device. Claude is the odd one out: it imports credentials from an existing Claude Code session, reading the macOS Keychain or ~/.claude/.credentials.json, and only falls back to the browser OAuth flow when no such session exists. The README is explicit that the Claude Code CLI is not required for that fallback path.

Model catalogs differ in kind, not just in content. Codex pulls a live catalog from chatgpt.com/backend-api/codex/models. Grok pulls chat models from api.x.ai/v1/models and reasoning efforts from the Grok CLI catalog at cli-chat-proxy.grok.com/v1/models. Copilot pulls from api.githubcopilot.com/models. Antigravity pulls from v1internal:fetchAvailableModels and speaks generateContent and streamGenerateContent. Claude is the exception again: its catalog is static and ships with the plugin, covering Opus, Sonnet, Haiku and Fable as available in your subscription.

Tokens live at ~/.dsh/plugins/subscriptions/auth.json with mode 0600 and refresh automatically. Only logged-in providers appear in the session model picker, and the lists refresh on login and logout. Vision-capable models declare ['text', 'image'] input modalities, and image content is translated to each provider's wire format. Reasoning effort is not hardcoded: models that advertise reasoning levels get an Effort selector, and Copilot's capabilities.supports.reasoning_effort array is sent as reasoning_effort on chat completions and reasoning.effort on the Responses wire.

Installing it and logging in a first provider

The README does not print an install command. The repository layout points at the package manager instead: package.json, pnpm-lock.yaml and a prepare script running tsdown -c tsdown.prepare.config.ts, with prepublishOnly running pnpm build and pnpm test. The package declares a dsh field with a bundle patch pointing at ./cordis.patch.yml, and the published files list is lib plus that patch file. So the install path is a package install into a DeepSeek Harness environment, not a clone-and-run.

Check that your Harness satisfies the peer dependencies before you touch anything else. The package.json in the repository lists them as follows:

{
  "peerDependencies": {
    "@deepseek-ai/cordis": "^4.0.1",
    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
    "@deepseek-ai/dsh-home-paths": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2 || ^0.1.2-alpha.1"
  }
}

If your Harness version falls outside those ranges, resolve that first. The plugin also declares a client block with platform web and injects @deepseek-ai/dsh-client-ui-renderer, @deepseek-ai/dsh-client-ui-settings and @deepseek-ai/dsh-client-locale, which is what puts the Subscriptions page in the web UI.

Once the plugin is loaded, open the Harness web UI and go to Settings, then Subscriptions. Each provider card offers login and logout. For Codex, Grok and Antigravity you complete OAuth in the browser. For Copilot you take the device flow code and enter it at github.com/login/device. For Claude the plugin first looks for an existing Claude Code session in the macOS Keychain or ~/.claude/.credentials.json and imports it if found.

After a successful login, the provider joins the session model picker with its live catalog. You should also see a usage card on the logged-in provider, showing the rate-limit window with a used percentage, a progress bar and a reset time, plus a Refresh button. Copilot is the exception: the README says it exposes no usage endpoint, so its card shows no usage section at all.

The tools the plugin registers, and the switch that does not apply retroactively

Three tools ship with the plugin and are registered only when the matching provider is enabled. x_search uses Grok and returns { answer, citations } from xAI's hosted X search. image_generate works through ChatGPT or Grok: gpt-image-2 via the Codex backend, or grok-imagine-image-2.0 via api.x.ai/v1/images/generations. Its provider argument picks the preferred backend, gpt by default or grok, and when the preferred one is logged out the other serves as fallback. Generated images are saved under ~/.dsh/plugins/subscriptions/images/ and the paths are returned. video_generate plays its clip inline in the conversation.

There is a timing constraint worth reading twice. The README says tool switches apply only to sessions created after saving. Toggling image generation on in Settings will not change a session that is already open. That is a defensible design, since changing the tool set mid-session would invalidate the model's context, but it is the kind of detail that produces a bug report from someone who toggled a switch and saw nothing happen.

Codex models whose catalog advertises the fast tier get a Speed toggle in the composer's tool row, next to the model selector, offering Standard or Fast via service_tier: priority, per session. The /fast slash command offers the same choice as a popup, and the README notes it errors with an explanation when the current model has no fast tier. That error behaviour is better than silently ignoring the command.

Where dsh-plugin-subscriptions breaks, and who should not install it

The honest limitation is that this plugin depends on endpoints the providers never documented for third-party use. Codex usage comes from chatgpt.com/backend-api/wham/usage. Grok usage comes from cli-chat-proxy.grok.com/v1/billing, which the README describes as the source of the Grok CLI's own /usage panel. Claude usage comes from api.anthropic.com/api/oauth/usage. These are internal surfaces. A provider can change a response shape, add a header check or rotate a client identifier, and the plugin has no contractual ground to stand on. The README does not document rollback behaviour for a failed token refresh, so what a half-refreshed auth.json looks like is not something you can plan for from the documentation.

Claude's static catalog is a second structural limit. Every other route refreshes its model list from the provider, so a new Codex or Grok model shows up on login. Claude's list is baked into the plugin and only moves when the plugin ships a new version. If Anthropic launches a model between plugin releases, you wait.

Copilot's missing usage endpoint is a third gap, and it is a real one for anyone trying to budget a shared seat. The card simply has no usage section, so you cannot see how close you are to a limit from inside Harness.

This is the wrong tool if you need a stable, auditable provider contract for production traffic, or if your Harness install must run on a machine where storing an OAuth refresh token at ~/.dsh/plugins/subscriptions/auth.json is unacceptable. It is also wrong if you are the only person on the team and nobody else can re-authenticate a provider whose OAuth flow changed. And because Claude credential import reads the macOS Keychain, that specific convenience path is macOS-only; the README gives ~/.claude/.credentials.json as the other source, and the browser OAuth fallback as the general case.

How it compares with running a local subscription proxy

The obvious alternative is a standalone bridge process that exposes subscription-backed models on a local HTTP port and lets any client point at it. The difference is where the integration lives. A proxy is provider-agnostic: DeepSeek Harness, an editor, a script and a curl command all talk to the same localhost endpoint, and the proxy owns the OAuth dance and token storage. dsh-plugin-subscriptions makes the opposite bet. It registers providers, tools and settings inside Harness, so the model picker, the Effort selector, the Speed toggle and the usage pill are native UI rather than something you configure by hand.

That buys tighter integration and costs portability. The plugin's tools, x_search, image_generate and video_generate, exist because the plugin knows which provider is logged in and can route accordingly. A generic proxy would expose those as separate endpoints you wire up yourself. Conversely, a proxy keeps working when you switch Harness versions, while this plugin's peer dependency ranges tie it to specific @deepseek-ai package versions. If you use one client and want the subscription models to feel like first-class citizens in it, the plugin is the better fit. If you use several clients, a proxy avoids doing the OAuth work three times.

Maintenance, licence and what a version bump costs you

The repository is not archived and the last push was on 2026-09-14. The version is 0.9.2, and no releases were retrieved, so there is no changelog to read before upgrading. That matters more here than for a typical library. Because the plugin talks to live provider catalogs, a plugin update can change which models appear, which reasoning efforts are offered and which wire a Copilot request uses. The README documents one such reroute already: models listing both Copilot endpoints, gpt-5.4 and gpt-5-mini, normally speak chat completions but reroute to /responses when a request combines function tools with an effort, because Copilot rejects that combination on the chat wire.

The build is conventional for a TypeScript package. The package.json scripts run tsc and tsdown for the build, and tsc -p tsconfig.test.json plus node --test lib-test/test/ for tests. The peer dependency ranges include pre-release identifiers such as ^0.1.1-rc.2 and ^0.1.2-alpha.1, which means the Harness side is still moving and a Harness upgrade is the most likely trigger for breakage. Budget for re-authentication after any upgrade that touches the OAuth flow.

The licence is MIT, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are preserved. That is the extent of what can be said here; the LICENSE file in the repository is the operative text, and questions about your own redistribution or hosted-service obligations belong with your legal counsel rather than with this article.

Editorial conclusion

Adopt it if you already hold ChatGPT Plus/Pro, Claude Pro/Max, X Premium, Copilot or Antigravity seats and want them inside DeepSeek Harness without minting API keys, and if you can tolerate a plugin that reaches provider endpoints the vendors never documented. Do not adopt it on a machine where you are unwilling to keep a 0600 OAuth token file, or where a provider outage must not become a session outage. Before rolling it out beyond one machine, verify that your DeepSeek Harness version satisfies every peer dependency in package.json, then confirm after login that the usage card for each provider actually returns numbers rather than an error.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. V1ki/dsh-plugin-subscriptions on GitHub