An OAuth adapter for DSH (include ChatGPT-Codex & Github-Copilot now)

[edge-sky]

An adapter between DSH Authorization Service and pi-ai, so it should be compatible with all model providers supported by pi-ai.

Here is repository

You can easy access with setting page:

[werifu]

Have you tried GPT over DSH actually? I also developed a similar plugin https://github.com/werifu/dsh-oai-oauth to support oauth login but according to my real experience, the tool calling capability is horrible.

The errors are generally caused by a wrong format/information

[edge-sky]

Based on my testing, I haven’t encountered this kind of situation.
Which mode are you using? Could you share your case so I can run some comparative tests?

[roslinmahmud]

Thank you; this was useful. I was able to use GitHub Copilot directly with DSH 🫡

[liyangbing]

这个适配器很有价值，但 OAuth 登录成功、DSH Authorization Service 持有 credential reference、以及 pi-ai 实际请求成功是三个不同层次，建议在 README/设置页明确区分。

建议为每个 provider 记录一份不含 secret 的 auth state：providerId、account/issuer 标识（脱敏）、token source（reference/env/manual）、scopes、expiresAt 是否存在、refresh capability 和 last error class。access/refresh token 只进入 DSH 的 credential store，日志、Session event、插件 manifest 和截图都不应出现 token 或完整 redirect URL。

回归矩阵至少覆盖：首次授权、用户拒绝、state/PKCE 不匹配、回调端口或 Origin 不可信、access token 过期可刷新、refresh 被撤销、scope 不足、多个账号切换、注销后的旧 Session，以及 provider 返回 401/429/5xx。设置页可显示“已配置/需要重新授权/不可用”，不要把存在 credential reference 永久当成 provider healthy。

如果 adapter 通过插件暴露登录 UI，权限与 redirect handler 应由 Host/Authorization Service 约束；adapter 只提交 provider-scoped intent，不要自行保存第二套 token 或绕过 DSH 的认证/Origin fence。相关的独立手册边界：credential storage threat model 与 model providers。