dsh-kimi

中文文档 | English

Kimi (Kimi Code account) integration bundle for DeepSeek Harness (DSH).
Adds Kimi as a first-class model provider to any DSH profile — provider route, models,
device-code login, and automatic token refresh. No manual settings editing required.

Features

• Provider route — kimi provider over https://api.kimi.com/coding/v1 using the
  OpenAI Responses protocol (pi-ai adapter), with four models:
  kimi-for-coding (K2.7 Coding), kimi-for-coding-highspeed, k3 (1M context), k3-256k.
• Login — Kimi Code device-code OAuth flow. dsh owns an independent OAuth session:
  its refresh-token family never touches the Kimi Code CLI's tokens, so refreshing here
  can never log the CLI out.
• Auto refresh — tokens are kept alive automatically (checked every 5 minutes,
  refreshed before expiry); the access token is stored in the KIMI_CODE_ACCESS_TOKEN
  credential ref, which the pi-ai adapter resolves per request.
• Agent tools — kimi_login_begin, kimi_login_status, kimi_login_refresh.
• Future-proof — if the host provides the authorization service, the same device
  flow is registered as an authorization flow for llm-pi-ai/kimi (Models page sign-in).

Install

# download the bundle tarball from GitHub Releases
# https://github.com/myk5010/dsh-kimi/releases
dsh plugin --profile web add ./dsh-kimi-provider-<version>.tgz

Restart the DSH Web process. Then log in once:

1. Ask the agent to run kimi_login_begin (or use the Models page once authorization
   is available) — you get a Kimi authorization URL + device code.
2. Open the URL in your browser and confirm.
3. Done: the picker shows the four Kimi models; tokens refresh automatically.

Works in any profile that mounts dsh-base (web, headless, …) — install per profile:

dsh plugin --profile headless add ./dsh-kimi-provider-<version>.tgz

How it works

• cordis.patch.yml — patch layer: configures the llm-pi-ai row with the kimi
  provider profile (protocol, base URL, models) and inserts the kimi-login row.
• index.js — the plugin main module: device-code login, credential storage
  (KIMI_CODE_ACCESS_TOKEN + KIMI_CODE_REFRESH refs), auto-refresh timer, agent tools,
  optional authorization flow registration.

Security

• Tokens live in the DSH credentials store (~/.dsh/.credentials.yaml, mode 0600).
• The refresh token is stored only in the KIMI_CODE_REFRESH credential ref (JSON string),
  never in source or logs.
• dsh's OAuth session is separate from the Kimi Code CLI's — no cross-session token rotation.

Compatibility

• DSH Host 0.1.2-alpha.4 (or any version with the pi-ai LLM adapter, dsh plugin bundles,
  and the credentials service).
• Node.js ≥ 22.19; curl available for the OAuth HTTP calls.