v0.2.0-alpha.4 — self-contained installer

v0.2.0-alpha.4

v0.2.0-alpha.4 makes AuthInOne installation self-contained. The package now owns an explicit bootstrap command that installs through the official DSH plugin CLI and replaces a standard running DSH Web Host on its original loopback port. No patched DSH core is required.

Self-contained bootstrap

pnpm dlx github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.4 install --profile web

• The bootstrap validates the profile, loopback URL, unique listener PID, DSH process identity, working directory, launcher, and exact supported DSH owner fingerprints before stopping the Host.
• Plugin mutation still goes through dsh plugin --profile web add; AuthInOne does not edit profile YAML, copy runtime files into DSH, or patch the DSH checkout.
• A package-owned detached supervisor waits for the installer to return, terminates only the validated listener PID, starts standard dsh web from the same working directory on the same port, and waits for the original URL.
• There is no alternate-port fallback. Unsupported launch provenance and owner drift fail before interruption.
• Restart status is stored with owner-only permissions under the selected profile. The serialized handoff contains no environment values, credentials, authorization URLs, cookies, Provider responses, or request headers.

Use --url http://127.0.0.1:<port>/ for a non-default loopback port. A DSH source checkout is inferred from the listener working directory or can be passed as --source-root /path/to/deepseek-harness.

Status and removal

pnpm dlx github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.4 status --profile web
pnpm dlx github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.4 uninstall --profile web

Removal uses the official DSH plugin remove path and the same validated same-port replacement. DSH sessions, plugin settings, and credential references remain preserved; deleting user data is outside this command.

Compatibility

This remains an alpha prerelease for official DSH 47f9438. The bootstrap supports a standard installed dsh launcher and macOS/Linux source-checkout launchers. It rejects unknown/new compatibility-owner artifacts and arbitrary process-manager wrappers instead of replaying unverified shell commands. Provider Auth, vision fallback, Usage, and Kimi authorization behavior are unchanged from v0.2.0-alpha.3.

v0.2.0-alpha.3

v0.2.0-alpha.3

v0.2.0-alpha.3 fixes the Kimi Code authorization handoff while retaining the Provider, vision fallback, Usage, and exact-DSH compatibility behavior from v0.2.0-alpha.2.

Kimi authorization feedback

• Kimi still uses its published RFC 8628 device grant internally, but DSH opens the complete Provider authorization link that already carries the short code.
• The Auth dialog no longer renders that short code as a separate user step when the complete link is available.
• Returning focus to DSH, or making its tab visible again, immediately refreshes the redacted Auth state instead of waiting for a background polling timer.
• A successful Host transition to connected invalidates the Models projection so the Kimi account card and models appear without a manual page reload.
• The Host-only device code, access token, and refresh token remain outside the browser.

Install

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.3

AuthInOne loads on the next normal DSH restart. Preserve the existing launcher, working directory, Node/runtime environment, arguments, and port. An Agent running inside the target DSH must not stop its own Host or start a second Web instance on a temporary port.

This remains an alpha prerelease for official DSH 47f9438. It is community-maintained and is not a DeepSeek, OpenAI, Moonshot AI, or other model-vendor product.

v0.2.0-alpha.2

v0.2.0-alpha.2

v0.2.0-alpha.2 keeps the Auth, Provider, vision fallback, Usage, and exact-DSH compatibility behavior from v0.2.0-alpha.1. It corrects the installation handoff for people who ask an Agent running inside DSH to install the plugin.

Installation handoff fix

• The install command no longer implies that a second dsh web process should be started immediately.
• AuthInOne loads after the existing DSH service is restarted through its original terminal, supervisor, or launcher.
• An Agent running inside the target DSH must not stop its own Host, start an alternate-port Web instance, or replace the original Node/runtime environment.
• An external supervisor may restart DSH only while preserving the working directory, executable, runtime environment, arguments, and port.
• Source-checkout users may use pnpm dsh; packaged installations should continue using their own dsh launcher.

Install

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.2

Confirm that the package and Bundle are registered. Then restart the existing DSH service through the same launcher and verify the original URL, Settings → Models, and Settings → Usage. Do not leave a temporary validation port as the final service address.

This remains an alpha prerelease for official DSH 47f9438. It is community-maintained and is not a DeepSeek, OpenAI, or other model-vendor product.

v0.2.0-alpha.1

v0.2.0-alpha.1

v0.2.0-alpha.1 is a prerelease for the official DeepSeek Harness (DSH)
47f9438 runtime. It adds image understanding for a text-only main model while
keeping native multimodal models on DSH's original call path.

Highlights

• Optional vision fallback, off by default. It runs only when the main model
  explicitly declares text-only input and the selected auxiliary route
  explicitly declares image input.
• One source of configured routes: connected account Auth, configured API
  Providers, and custom OpenAI-compatible Providers. Selection stores stable
  Provider-instance and model ids, never display names.
• Custom Provider models have an explicit, default-off Supports image input
  capability flag. Unknown capabilities are never guessed from model names.
• PNG, JPEG, WebP, and GIF use DSH attachment references. The plugin does not
  add audio, video, PDF, image generation, filesystem paths, browser object
  URLs, or plugin-owned image storage.
• Vision-assist calls retain their real Provider/model identity and are counted
  separately from the main model. Missing usage or pricing remains unknown or
  unpriced; no token, quota, or cost is invented.
• A single standard plugin Bundle carries exact-47f compatible Settings General
  and Models owners. It preserves native Provider cards and adds generic Models
  insights/actions and section-icon seats without DOM patching or DSH checkout
  changes.
• The Models page restores the distinct Add Auth login entry, connected Auth
  cards, grouped vision route selectors, and native Provider add/edit/test/default
  behavior. Usage uses a three-bar currentColor navigation icon.

Compatibility and safety

• Exact target: official DSH commit
  47f943859bef60e4160492346772ded9b24f765a.
• Owner version and client SHA guards fail with
  AUTH_IN_ONE_COMPAT_UNSUPPORTED_DSH on unknown/new owner artifacts. A DSH
  build with native seams is not double-registered or silently overwritten.
• Credentials remain in DSH Host credentials; image bytes remain in DSH
  attachment storage. Removing the plugin removes its Bundle contributions but
  does not force account logout or delete Provider credentials.
• DeepSeek's MIT notice and the exact vendored runtime provenance ship in
  THIRD_PARTY_NOTICES.md.

Verification

• Node 24 typecheck passed.
• Vitest passed: 17 files, 110 tests.
• DSH ownership/boundary audit and production build passed.
• A single packed TGZ was installed through the official plugin CLI on the
  unmodified official 47f runtime. Real Models/Auth/Vision/Usage interactions
  passed in light/dark desktop and 760 px layouts with no horizontal overflow
  and no post-load console warnings or errors.
• Standard remove restored native Models and removed AuthInOne's compat owners,
  Auth action, Usage section, vision block, and Remote. Reinstalling the same
  TGZ reproduced the accepted state.

Install

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.1

AuthInOne loads on the next normal DSH restart. Restart the existing service
through the same launcher while preserving its working directory, Node/runtime
environment, arguments, and port. An Agent running inside the target DSH must
not stop its own Host or leave a second Web instance on a temporary port; it
should finish the install and ask the operator to restart from outside that
session.

This remains an alpha prerelease. It is community-maintained and is not a
DeepSeek, OpenAI, or other model-vendor product.

v0.1.0-alpha.3

v0.1.0-alpha.3

This patch keeps the alpha.2 Auth, API/custom Provider, model switching, quota, token-usage, and cost-tracking scope while correcting two installed Web UI regressions.

Fixed

• Daily Token activity now keeps a GitHub-style 365-day calendar with seven weekday rows and up to 53 week columns. Empty dates remain visible, month labels stay on the horizontal axis, and narrow layouts do not add horizontal scrolling.
• Models now distinguishes the Auth Provider catalog from configured instances. Never-started, cancelled, failed, or expired catalog entries no longer appear as placeholder cards.
• A connected OpenAI Codex account is projected immediately and after restart. Auth cards use Provider-specific model discovery and logout instead of the generic Base URL probe.
• Updated real DSH dark, light, desktop, and 760 px screenshots.

Security and compatibility

• OAuth, device codes, access tokens, refresh tokens, and API keys remain Host-only in DSH credentials; this patch does not change credential storage or Auth transaction formats.
• Quota UI is shown only for complete real-time upstream windows. Missing or failed quota reads remain hidden.
• Host/Usage runs on DSH 0.1.0-rc.6; the full Models/Auth UI still requires the generic settings contribution seams documented in the README.
• No image/vision fallback capability is included in this release.

Install:

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.1.0-alpha.3
dsh web

v0.1.0-alpha.2 — Provider authentication and usage analytics

dsh-AuthInOne v0.1.0-alpha.2 adds OpenAI Codex and Kimi Code account login, seven explicitly experimental compatibility account flows, API/Plan and custom OpenAI-compatible Provider setup, default-model switching, and DSH-native token usage and cost analytics.

Highlights

• OpenAI Codex browser OAuth with Host-owned state, S256 PKCE, loopback callback, refresh, bounded revocation, cancellation cleanup, and redacted Client state.
• Kimi Code RFC 8628 device login plus experimental xAI, Anthropic, GitHub Copilot, Command Code, Cursor, Google Antigravity, and Kiro compatibility flows.
• DSH Models contributions for Auth login, Plan/API presets, Provider health, model selection, and complete live upstream quota windows. Missing, partial, unsupported, or failed quota responses render no quota block and never fall back to invented local allowances.
• Usage settings with second-precision time ranges, Provider and USD output-price filters, KPI and Token heatmap views, model Token share, Provider/model/tool rankings, M/B Token formatting, and auditable price-source metadata.
• Credentials, device codes, OAuth verifiers, access tokens, and refresh tokens remain Host-only in DSH credentials. The browser receives only redacted state, authorization URLs, user codes when required, and aggregated analytics.

Compatibility

Host and Usage work with DSH 0.1.0-rc.6. Full Models/Auth integration requires the generic settings contribution seams documented in the README. This alpha is a community plugin and is not a DeepSeek, OpenAI, or Provider-endorsed product.

Install

dsh plugin --profile web add github:Stormycry-cryp/dsh-AuthInOne#v0.1.0-alpha.2
dsh web

Open Settings → Models and Settings → Usage. Remove with dsh plugin --profile web remove dsh-auth-in-one.