DeepSeek Harness Integration ​

DeepSeek Harness (DSH) supports two ways to connect to 开桥:

Install DeepSeek Harness ​

Install the official @deepseek-ai/dsh package globally with npm:

npm i -g @deepseek-ai/dsh

Verify that the command is available:

dsh --version

If the terminal cannot find dsh, open a new terminal and confirm that npm's global executable directory is included in PATH.

Configure a standard API key ​

The standard configuration reuses DSH's built-in deepseek-official provider and does not require the 开桥 PKCE plugin.

First, set your 开桥 API key:

export OPENQIAO_API_KEY="sk-ai-v1-xxx"

Then edit $DSH_HOME/settings.yaml. If DSH_HOME is not set, the default path is ~/.dsh/settings.yaml:

llm-deepseek:
  apiKeyEnv: OPENQIAO_API_KEY
  baseURL: https://openqiao.com/api/v1

Start DSH and select the built-in DeepSeek-V4-Flash entry or another DeepSeek model supported by 开桥:

dsh web

apiKeyEnv stores only the environment-variable name; the API key itself is not written to settings.yaml. DSH already provides a default model catalog, so the standard configuration does not need to repeat model entries. Add models only when using another model or a custom display name.

For a persistent setup, add export OPENQIAO_API_KEY="..." to ~/.zshrc or ~/.bashrc, depending on the active shell, and then open a new terminal.

Configure a proxy for DeepSeek Harness ​

DeepSeek Harness (dsh) runs on Node.js under the hood. Because the Node.js runtime does not read system http_proxy or https_proxy environment variables by default, you need to explicitly enable proxy support and inject environment variables before starting DSH:

# Enable Node.js proxy support; replace 7890 with your actual proxy port
export NODE_USE_ENV_PROXY="1"
export HTTPS_PROXY="http://127.0.0.1:7890"
export HTTP_PROXY="http://127.0.0.1:7890"

dsh web

# Replace 7890 with your actual proxy port
NODE_USE_ENV_PROXY="1" HTTPS_PROXY="http://127.0.0.1:7890" dsh web

# Enable Node.js to read system proxy environment variables (replace 7890 with your actual proxy port)
export NODE_USE_ENV_PROXY="1"
export HTTPS_PROXY="http://127.0.0.1:7890"
export HTTP_PROXY="http://127.0.0.1:7890"

Use OAuth PKCE ​

The official @openqiao/dsh-plugins npm package uses OAuth 2.0 Authorization Code + PKCE for browser authorization, so no 开桥 API key needs to be created or copied. It also refreshes the sign-in session before the access token expires.

The current PKCE integration targets interactive DSH Web and provides:

• /openqiao login, /openqiao status, and /openqiao logout commands.
• Browser-based 开桥 OAuth PKCE authorization.
• Automatic access-token and refresh-token persistence and rotation.
• Bundled 开桥 DeepSeek V4 Pro and DeepSeek V4 Flash models.
• Anthropic Messages routing for prompt caching and thinking budgets.

Install the plugin ​

Install the package into the DSH Web profile:

dsh plugin --profile web add @openqiao/dsh-plugins

Then start DSH Web:

dsh web

The package automatically mounts the 开桥 OAuth controller and adds a 开桥 provider to DSH's existing pi-ai adapter. It does not replace the built-in DeepSeek route or silently switch existing conversations to a different provider.

Sign in to 开桥 ​

Run this command in DSH Web:

/openqiao login

DSH Web opens the 开桥 authorization page in a new tab and also displays an Open 开桥 login fallback link. Confirm the account and requested access, wait for the callback page to display 开桥 connected, and then return to DSH.

The plugin requests only these scopes:

• inference:invoke: invoke 开桥 models.
• offline_access: refresh the session after the access token expires.

OAuth uses a one-time 127.0.0.1:<ephemeral-port>/callback. The listener validates state and closes after one accepted response or a login timeout.

Select a model ​

After sign-in, select one of these entries from the model selector:

• 开桥 · DeepSeek V4 Pro
• 开桥 · DeepSeek V4 Flash

These bundled models use the 开桥 Anthropic Messages endpoint so DSH/pi-ai can apply Anthropic prompt caching and thinking budgets.

To use other 开桥 models, edit the 开桥 provider's models array under Settings → Models. Enter 开桥 model IDs and configure reasoning levels according to each model's capabilities. Never paste an OAuth token into the model configuration.

Manage the sign-in state ​

Check the current connection and expiration time:

/openqiao status

Sign out:

/openqiao logout

On logout, the plugin attempts to revoke the refresh token at 开桥 and then clears the stored DSH OAuth credentials. You can also revoke the grant from 开桥 Authorized Apps.

Proxy and network configuration ​

OAuth discovery, token, and revocation requests connect directly to 开桥 by default. If the DSH environment requires a proxy, note that the underlying Node.js runtime does not read system http_proxy variables by default. Enable proxy support and inject the environment variables before startup (replace 7890 with your actual proxy port):

# Replace 7890 with your actual proxy port
export NODE_USE_ENV_PROXY="1"
export HTTPS_PROXY="http://127.0.0.1:7890"
export HTTP_PROXY="http://127.0.0.1:7890"

dsh web

Alternatively, configure proxyUrl directly in the DSH profile (explicit proxyUrl in the DSH profile takes priority over environment variables). The plugin supports HTTP, HTTPS, socks4a://, and socks5h:// proxies.

If a corporate proxy reissues TLS certificates through a local CA, load that CA before Node.js starts:

NODE_EXTRA_CA_CERTS=/absolute/path/to/ca.pem dsh web

Do not use NODE_TLS_REJECT_UNAUTHORIZED=0. Disabling TLS verification can expose authorization codes and refresh tokens.

Optional environment variables ​

Production normally requires no additional configuration. These variables are primarily for proxies, development, or self-hosted environments:

Support scope and limitations ​

• The current package targets interactive DSH Web deployments that can execute /openqiao commands.
• Pure headless and automated deployments that do not consume ctx.commands cannot initiate browser sign-in.
• A headless deployment can reuse credentials created by interactive DSH Web under the same Harness home.
• The plugin does not add OAuth state, tokens, or expiration data to model input or conversation history.
• If a configured proxy is unavailable, sign-in and refresh fail instead of silently using another network path.

For the full list of agents that support OAuth PKCE, see Sign in to 开桥 with OAuth PKCE.