dsh-kimi-provider

Readme

# dsh-kimi

[中文文档](README.zh.md) | English

Kimi (Kimi Code account) integration bundle for [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness).
Adds Kimi as a first-class model provider to any DSH profile — provider route, models,
device-code login, and automatic token refresh. **No manual settings editing required.**

## Features

- **Provider route** — `kimi` provider over `https://api.kimi.com/coding/v1` using the
  OpenAI **Responses** protocol (pi-ai adapter), with four models:
  `kimi-for-coding` (K2.7 Coding), `kimi-for-coding-highspeed`, `k3` (1M context), `k3-256k`.
- **Login** — Kimi Code device-code OAuth flow. dsh owns an **independent OAuth session**:
  its refresh-token family never touches the Kimi Code CLI's tokens, so refreshing here
  can never log the CLI out.
- **Auto refresh** — tokens are kept alive automatically (checked every 5 minutes,
  refreshed before expiry); the access token is stored in the `KIMI_CODE_ACCESS_TOKEN`
  credential ref, which the pi-ai adapter resolves per request.
- **Agent tools** — `kimi_login_begin`, `kimi_login_status`, `kimi_login_refresh`.
- **Future-proof** — if the host provides the `authorization` service, the same device
  flow is registered as an authorization flow for `llm-pi-ai/kimi` (Models page sign-in).

## Install

```sh
# download the bundle tarball from GitHub Releases
# https://github.com/myk5010/dsh-kimi/releases
dsh plugin --profile web add ./dsh-kimi-provider-<version>.tgz
```

Restart the DSH Web process. Then log in once:

1. Ask the agent to run `kimi_login_begin` (or use the Models page once `authorization`
   is available) — you get a Kimi authorization URL + device code.
2. Open the URL in your browser and confirm.
3. Done: the picker shows the four Kimi models; tokens refresh automatically.

Works in any profile that mounts `dsh-base` (web, headless, …) — install per profile:

```sh
dsh plugin --profile headless add ./dsh-kimi-provider-<version>.tgz
```

## How it works

- `cordis.patch.yml` — patch layer: configures the `llm-pi-ai` row with the `kimi`
  provider profile (protocol, base URL, models) and inserts the `kimi-login` row.
- `index.js` — the plugin main module: device-code login, credential storage
  (`KIMI_CODE_ACCESS_TOKEN` + `KIMI_CODE_REFRESH` refs), auto-refresh timer, agent tools,
  optional `authorization` flow registration.

## Security

- Tokens live in the DSH credentials store (`~/.dsh/.credentials.yaml`, mode 0600).
- The refresh token is stored only in the `KIMI_CODE_REFRESH` credential ref (JSON string),
  never in source or logs.
- dsh's OAuth session is separate from the Kimi Code CLI's — no cross-session token rotation.

## Compatibility

- DSH Host 0.1.2-alpha.4 (or any version with the pi-ai LLM adapter, `dsh plugin` bundles,
  and the `credentials` service).
- Node.js ≥ 22.19; `curl` available for the OAuth HTTP calls.