dsh-grok-build-auth-bridge

The hardest part of using a Grok Build subscription inside DeepSeek Harness (DSH) is the authentication gap. Grok's refresh token, file locking, and race-safety are all sealed inside the official CLI, while DSH's credential service only understands tokens it manages itself. dsh-grok-build-auth-bridge is a thin Cordis bundle that closes that gap in three moves: read the first-party xAI OAuth session from the local auth.json, delegate the actual token refresh to the official grok binary when the short-lived access token is about to expire, and write only the access token into DSH's credential store. The bridge never reads, writes, or uploads a refresh token, and it never touches ~/.grok/auth.json.

It also auto-registers a grok-build provider route in DSH (grok-4.6, OpenAI Responses protocol, pointing at cli-chat-proxy.grok.com) and attaches the subscription-proxy headers the official client expects: X-XAI-Token-Auth, model override, client mode, and the locally installed Grok version. A background loop checks token validity every ten minutes and again right before each grok-build streaming request, triggering a refresh through the official CLI so Grok's own locked, race-safe rotation is preserved. File-permission checks (chmod 600) and credential isolation mean that even if auth.json were exposed, the leaked access token would expire within minutes.

This plugin is aimed at developers who already route multiple LLM providers through DSH and hold a Grok Build subscription. There is no separate proxy to deploy and no token to copy by hand: once the plugin is installed and the CLI is logged in, Grok models appear alongside your existing providers in DSH's model list, ready for both chat and agentic workloads.