DSH Providers Extension

Manage LLM providers, accounts, model catalogs, reasoning effort, and provider execution modes from one DeepSeek Harness interface.

简体中文 · Full guide · 中文使用指南 · Changelog · Security · Contributing · License

Install

0.1.5 supports four reviewed DSH closures: an 0.1.0-rc.7 launcher with either an all-rc.7 or rc.8 runtime, an 0.1.0-rc.8 launcher with an all-rc.8 runtime, and the current 0.1.1-rc.1 launcher/runtime closure. It also requires pi-ai >=0.82.1 <0.83.0, Node.js ^22.19.0 || >=24.0.0, and pnpm on PATH.

One-command install or upgrade

Fully stop any DSH Host currently using the web profile, then run:

dsh plugin --profile web add @fhxgs/dsh-providers-extension@0.1.5 && dsh --profile web --dump-config && dsh web

The explicit version is intentional. Immediately after a release, DSH's pnpm minimumReleaseAge policy can temporarily resolve @latest to the preceding version. Pinning 0.1.5 preserves that supply-chain policy while installing the current fix immediately. The command prints the composed profile and starts one fresh Host.

If the command stops after the config dump, do not start DSH: inspect the reported composition error first. A successful dump must contain the @fhxgs/dsh-providers-extension bundle, exactly one fhgs-providers-extension row, and exactly one native ui-settings-models and ui-model-selection row. Version 0.1.5 acquires those two native owners transactionally even while a brand-new profile is finishing its first Loader composition; it does not require a second Host start. After DSH starts, open Settings → Models.

To install without starting DSH immediately:

dsh plugin --profile web add @fhxgs/dsh-providers-extension@0.1.5

Upgrade from 0.1.2–0.1.4

Install the fixed version into the same Profile and restart the Host; refreshing the browser alone is not enough:

dsh plugin --profile web add @fhxgs/dsh-providers-extension@0.1.5
dsh --profile web --dump-config
dsh web

The Host health endpoint must return HTTP 200 with result.ok: true and compatibility.state: "compatible"; see the health check and rollback commands. Version 0.1.4 can fail closed only on a cold profile's first concurrent composition and then activate after a restart; install 0.1.5 instead of relying on that restart. Versions 0.1.0 and 0.1.1 are not safe rollback targets: 0.1.0 loses client injection metadata under the real loader, while 0.1.1 can lose exclusive ownership during app-boot patch replay. Remove the extension to return to native Models instead.

What it adds

• One Models area: built-in DSH Providers, OAuth accounts, API routes, and custom OpenAI-compatible endpoints share one control plane without losing their separate identities.
• Live catalogs: refresh model lists without signing in again. A failed refresh keeps the last known good catalog and credential.
• Exact selections: every choice retains Provider, route/account, model, reasoning effort, and Provider-owned mode such as fast, priority, or flex.
• Separate defaults and sessions: a new-session default does not rewrite an existing session. Composer and /model changes affect only the current session.
• Visibility controls: choose which models, effort values, and modes appear in pickers without silently terminating a running session.
• Replay-safe routing: request history keeps the route and binding identity required to replay against the same account.
• Fail-closed activation: an unknown, incompatible, or drifted Host stays on native DSH.

The complete feature, installation, configuration, compatibility, architecture, security, and release reference is in the full guide.

Provider paths in 0.1.5

Provider path	Status	Use it through
DSH built-in Providers	Available	Host API key, environment, Bedrock, Vertex AI, or another native identity chain
Custom OpenAI-compatible endpoint	Available	Settings → Models → API → Add custom provider
Google Gemini OAuth	Deployment client required	A deployment-owned Google Desktop OAuth client and quota project
OpenRouter	API key only	Host/API route; public OAuth is blocked in this release
Hugging Face	Fine-grained token only	Host/API route; public OAuth is blocked in this release
OpenAI	API/workload identity or explicit Host Agent Bridge	Consumer ChatGPT/Codex login is not imported
Anthropic	API or Host-native enterprise identity	Claude subscription and Claude Code credentials are not imported

An implemented protocol is not automatically an approved public identity path. The extension exposes a login action only after the driver and compliance record both allow it.

Selection model

A durable selection keeps five axes separate:

Provider → Route/account → Model → Effort → Mode

Provider default means that no explicit mode is sent. It is not an explicit mode named default. A high-speed model SKU remains a Model; a Provider service tier is a Mode only when its driver declares the exact wire binding.

Safety boundary

Credentials stay in the Host credential backend. They do not enter settings documents, Browser snapshots, catalog caches, session logs, screenshots, source maps, or npm artifacts. PKCE verifiers and authorization codes remain in Host memory.

Before attaching a saved credential, custom endpoints are checked for HTTPS, public DNS and connected addresses, same-origin redirects and catalogs, supported secret headers, bounded responses, and the absence of query-string secrets. Private, loopback, link-local, metadata, DNS-rebinding, cross-origin, and oversized-response targets are rejected.

Do not edit the compatibility manifest to force activation on another DSH build. Each Host version needs its own reviewed profile.

Local checkout: one command

From a standalone clone with dependencies installed:

npm run dsh:install:local

For a fresh clone:

git clone https://github.com/yhyfhgs/dsh-providers-extension.git
cd dsh-providers-extension
npm ci --ignore-scripts && npm run dsh:install:local

From the private Collab workspace root, point the installer at that workspace's DSH CLI:

DSH_BIN="$PWD/deepseek-harness/apps/cli/lib/bin.js" npm --prefix providers-extension run dsh:install:local

Use -- --profile <name> to link a disposable profile instead of web.

Documentation

File	Contents
README.md / README.zh.md	Public overview and quickest install path
docs/GUIDE.md / docs/GUIDE.zh.md	Features, installation, configuration, compatibility, architecture, performance, security, and release verification
CHANGELOG.md	Versioned changes
.github/SECURITY.md	Private vulnerability reporting and supported versions

Develop

npm ci --ignore-scripts
npm run check

The repository also contains a credential-free UI prototype:

npm --workspace @fhxgs/providers-extension-prototype run dev -- --host 127.0.0.1 --port 4173

The prototype uses mock data. It demonstrates the interaction contract but does not prove Provider eligibility, real-account OAuth behavior, or compatibility with another Host build.

0.1.5 limits

This release does not provide automatic cross-Provider fallback, multi-account rotation, remote policy downloads, a public third-party driver SDK, implicit vision routing, consumer-subscription credential reuse, public OpenRouter or Hugging Face OAuth, or compatibility with unreviewed DSH builds.

License

MIT © 2026 fhgs.