deepseekplugins

DeepSeek Harness plugin

dsh-grok-build-auth-bridge

Reuse the official Grok Build CLI subscription login in DeepSeek Harness.

Development & Runtime
Jump to install

Source facts

Repository
shaomingbo/dsh-grok-build-auth-bridge
Latest update
Aug 15, 2026
Category
Development & Runtime
GitHub stars
0
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/shaomingbo/dsh-grok-build-auth-bridge
Plugin: dsh-grok-build-auth-bridge
Author: shaomingbo

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer3 files
README.mdSource · read only

dsh-grok-build-auth-bridge

Reuse the official Grok Build CLI subscription login in DeepSeek Harness (DSH).

This package is a Host Cordis bundle. It reads Grok Build's local session, delegates refresh-token handling to the official grok binary, synchronizes only the short-lived access token into DSH's credential service, and provisions a pi-ai route for the Grok Build subscription proxy.

It does not contain, upload, or commit any token.

Requirements

  • Node.js 22.19 or later
  • DSH with the dsh-llm-pi-ai adapter
  • The official Grok Build CLI installed and logged in:
grok update
grok login
grok models

The login must produce ${GROK_HOME:-~/.grok}/auth.json.

Install

Run this on each device after logging in with Grok Build:

npx --yes github:shaomingbo/dsh-grok-build-auth-bridge#v0.1.0

The installer adds the package and its Cordis bundle to ~/.dsh/profiles/web/package.json, then runs pnpm install. Restart dsh web afterward.

The plugin creates this model route through DSH settings without replacing existing providers:

  • Provider: grok-build
  • Model: grok-4.6
  • Protocol: OpenAI Responses
  • Endpoint: https://cli-chat-proxy.grok.com/v1

How it works

At startup, every ten minutes, and immediately before a grok-build LLM stream:

1. read ${GROK_HOME:-~/.grok}/auth.json; 2. select the first-party xAI OAuth session, excluding plain API-key entries; 3. check expires_at, JWT expiry, or Grok's 30-day fallback lifetime; 4. when near expiry, run the official grok models command and let Grok perform its own locked, race-safe OAuth refresh; 5. re-read the refreshed session and store only its access token as GROK_BUILD_ACCESS_TOKEN in DSH.

Using the official CLI for refresh preserves Grok Build's file-locking, team-principal parameters, refresh-token rotation handling, and sleep/suspend safeguards. The bridge never writes ~/.grok/auth.json itself.

The route sends the subscription proxy headers required by the official client, including X-XAI-Token-Auth, model override, client mode, and the locally installed Grok version from ~/.grok/version.json.

Environment overrides

VariableDefaultPurpose
DSH_GROK_AUTH_PATH${GROK_HOME:-~/.grok}/auth.jsonExact Grok auth file
DSH_GROK_VERSION_PATH${GROK_HOME:-~/.grok}/version.jsonInstalled Grok version metadata
DSH_GROK_BIN${GROK_HOME:-~/.grok}/bin/grokOfficial CLI executable
DSH_GROK_AUTH_SCOPEauto-detectedExact auth.json scope for multiple-session files
DSH_GROK_CREDENTIAL_REFGROK_BUILD_ACCESS_TOKENDSH credential reference
DSH_GROK_PROVIDER_IDgrok-buildDSH provider route ID
DSH_GROK_CLIENT_VERSIONversion.json value; fallback 1.0.3Proxy version header override
DSH_GROK_REFRESH_MARGIN_MS300000Refresh margin before expiry
DSH_GROK_SYNC_INTERVAL_MS600000Background synchronization interval

If you override the provider ID or credential reference after the route has already been created, update or remove the old route in DSH's Models settings.

Security notes

  • ~/.grok/auth.json contains a refresh token. The bridge refuses to read it on Unix if group or other users have access; use chmod 600 ~/.grok/auth.json.
  • Only the short-lived access token is copied to $DSH_HOME/.credentials.yaml through the normal DSH credential service.
  • The plugin never logs credential values or sends the refresh token anywhere.
  • If GROK_BUILD_ACCESS_TOKEN is exported in the parent environment, it shadows DSH's writable credential store. Unset it before starting DSH.

Current model scope

The proxy requires x-grok-model-override at the provider-header level, while DSH provider headers are shared by every model on that route. Version 0.1.0 therefore exposes one verified route, grok-4.6. Additional Grok models can be added as separate provider routes in later releases.

Development

npm install
npm test
npm run check

The primary-source research behind the bridge is in [docs/research.md](docs/research.md).

License

MIT

Back to searchOpen GitHub repository

More related plugins

View category