[Plugin] dsh-codex-oauth — use your OpenAI Codex (ChatGPT) subscription in DeepSeek Harness

[birat-chapagain]

Hi! I built a small community bundle that fills a documented gap: the shipped multi-provider adapter (dsh-llm-pi-ai) withholds openai-codex because Codex authenticates through ChatGPT OAuth, and that adapter holds no credential store and runs no login flow (it's listed under Known Limitations).

dsh-codex-oauth supplies exactly those pieces as an installable bundle — no fork, no core change:

• a codex provider route registered on ctx.llm (LlmAdapter from @deepseek-ai/dsh-llm), serving the gpt-5.x-codex catalog models through @earendil-works/pi-ai's openai-codex provider;
• a /codex login human command (browser flow with local callback, plus /codex login device for headless) and a dsh-codex-oauth CLI bin with login / logout / status;
• a file-backed pi-ai CredentialStore at $DSH_HOME/codex-oauth.json (0600, owner-only dir, atomic writes, cross-process writer lock), with pi-ai's automatic token refresh.

I verified it against the published @deepseek-ai/dsh@0.1.0-rc.7: the bundle loads in a profile, the route registers, and a headless run dispatches through the seam to the adapter (ending at the expected AUTH error until you log in).

Install:

dsh plugin --profile web add github:birat-chapagain/dsh-codex-oauth
# then: /codex login  (or npx dsh-codex-oauth login --method device)

Repo: https://github.com/birat-chapagain/dsh-codex-oauth

If first-party Codex OAuth support is ever on the roadmap, I'd be happy to contribute these pieces (OAuth credential store + login-flow wiring) upstream — happy to hear what shape the maintainers would want that to take.

[birat-chapagain]

Update: installs are now zero-friction. The repo ships its prebuilt lib/ and runs no lifecycle scripts on install, so this just works with no allowBuilds permission:

dsh plugin --profile web add github:birat-chapagain/dsh-codex-oauth

A release tarball is also published:

dsh plugin --profile web add https://github.com/birat-chapagain/dsh-codex-oauth/releases/latest/download/dsh-codex-oauth.tgz

Verified live against @deepseek-ai/dsh@0.1.0-rc.7 with a real ChatGPT Plus/Pro account.

[birat-chapagain]

Install is now one command:

npx --yes https://github.com/birat-chapagain/dsh-codex-oauth/releases/latest/download/dsh-codex-oauth.tgz install

It writes the one-time pnpm build approvals (pi-ai transitive deps) and runs dsh plugin add for you; the package itself is prebuilt with no install-time scripts. Then restart dsh, run /codex login once (browser or device code), and pick a codex model. v0.1.4.

[birat-chapagain]

Update: install is now one command, hardened against a pnpm 11 gotcha.

npx --yes https://github.com/birat-chapagain/dsh-codex-oauth/releases/download/v0.1.5/dsh-codex-oauth.tgz install

pnpm 11 approves build scripts through an allowBuilds map in the profile's pnpm-workspace.yaml; pasting pnpm's suggested snippet verbatim leaves set this to true or false placeholders, which pnpm reads as a denial (ERR_PNPM_IGNORED_BUILDS even though the keys "look" present). v0.1.5's installer parses the workspace file and normalizes the values (list form, placeholders, and pnpm 10's onlyBuiltDependencies are all migrated), then runs dsh plugin add for you. Verified end-to-end against @deepseek-ai/dsh@0.1.0-rc.7 with pnpm 11.