Preface¶

The philosophy of DSH is “everything is a plugin,” and the model side is no exception: if you are already using Qoder’s domestic or international accounts and want to select the same batch of models directly in DSH’s model selector, you need to write a provider yourself to adapt to Qoder’s gateway. Qoder does not provide an OpenAI-compatible endpoint. The official SDK is just the agent launcher; the three things regarding the protocol (COSY signature headers, substituted base64 request bodies, and double-layer SSE) must be implemented yourself.

The dsh-connect-qoder introduced below turns this into a ready-made plugin. Before reading, one point must be clarified first: this repository is no longer maintained. The README homepage clearly states it only supports up to dsh-0.21.5, and relevant capabilities have been merged into dingminhua’s repository of the same name. Therefore, the subject of this article is “the repository pointed to by the plugin clue,” while stating its actual status and available alternatives at the front.

Repository Status and Attribution¶

The repository pointed to by the plugin clue is hdhgsysh/dsh-connect-qoder. The README on GitHub directly explains two things:

1. This project is no longer maintained and supports up to dsh-0.21.5;
2. Relevant functions have been merged into the dingminhua version.

The same README also contains a fork description: this repository is a fork of eghrhegpe’s repository of the same name, and the accompanying scoped npm package is @eghrhegpe/dsh-connect-qoder (the unscoped dsh-connect-qoder is published by upstream, installing the upstream version). The current version is 0.7.6, updated on 2026-11-03, and the README notes an MIT license. The plugin package’s keywords are dsh-plugin / deepseek-harness / qoder / model-provider, and engines requires Node ^22.19.0 || >=24.0.0.

In other words, the version currently installable and maintained is the scoped package branch. The community plugin directory classifies it under “Model Inference” (the dshfind plugin page shows 11 stars, +2 in the last 7 days).

Core Features¶

What the plugin does is bring the account quota from the Qoder desktop app or the plugin’s own login into DSH, without the user needing to manage signatures and encoding themselves. The following capabilities all come from the README.

1. Dual Provider Parallelism: The domestic version qoder-cn (https://gateway.qoder.com.cn/) and the international version qoder (https://api3.qoder.sh/) are two independent providers. Installing one presents that set of models; installing both results in two sets existing simultaneously, each using its own account and quota.

2. Three Credential Sources, Desktop Priority:

   • Qoder desktop app’s own login state (on Windows, decrypting Chromium OSCrypt formatted credentials via PowerShell + DPAPI; new versions read auth.v1.dat, old versions read state.vscdb);
   • Plugin’s own device login: Approve a code in the browser; refreshable tokens are saved to $DSH_HOME/.qoder-auth.<region>.json, separated by region;
   • Environment Variable PAT: QODERCN_PAT for domestic, QODER_PAT for international.

   The plugin only reports “not logged in” when none of the three sources yield available credentials; expired desktop credentials no longer override the latter two.

3. Usage Capsule: Displays the region prefix plus the remaining main quota Credits next to the input box (e.g., Qoder CN · 2,222). Clicking opens the usage panel, including quota and remaining within the package, today’s request count and token consumption via this client (including cache hits), 7-day trends, and today’s check-in status. When a model not previously recorded on this machine appears in the roster, the capsule adds a third segment · 3 new models, listing only those first seen within the last 7 days.

4. Protocol Adaptation: Every gateway request carries Cosy-* signature headers and Authorization: Bearer COSY.<payload>.<sig>; request bodies with Encode=1 are base64-encoded, then character-replaced according to a substitution alphabet, and finally rotated by one-third; each data: frame is an envelope object, where the body field itself is a JSON string containing the OpenAI-style chunk. These three things are why Qoder is not an OpenAI-compatible endpoint, and also the main workload of this plugin.

5. Upstream Errors Visible: When the upstream fails, it returns an error object inside a regular 200 frame instead of a chunk. The plugin translates this into a readable error. Some models (e.g., GLM-5.3-Flash, Kimi-K3 in the README example) declare a reasoning tier but do not allow disabling thinking. After identifying this, the plugin omits the enable_thinking field entirely, allowing the model to use its default tier instead of sending a request that would be rejected by provider_error 1210.

Installation¶

Installation commands come from the README; do not concatenate dsh plugin add github:owner/repo based on the name.

Install from npm (recommended by README):

dsh plugin --profile web add @eghrhegpe/dsh-connect-qoder

The --profile is the profile name you set yourself. Remember to restart the DSH process after changing; the bundle patch is read at startup.

DSH desktop users can also paste this source in the “Plugin Market”:

github:eghrhegpe/dsh-connect-qoder

The github: source is zero-config: the host artifact lib/ (host + client bundle) is committed with the repo; cloning is enough to load it. The installation process does not require approving build scripts or pulling devDependencies. If DSH instead prompts that the package has unapproved build scripts, it means you got an old clone missing lib/; delete and reinstall (since docs/issues/19, lib/ must be in the repo, and CI has freshness gates).

Local development mode:

dsh plugin --profile web add <本仓库路径>

During local development, lib/ corresponds to the source code at the commit moment. After modifying src/, you must first npm install && npm run build, then point DSH to this directory; otherwise, it runs the old artifact.

To get the latest, use npm: npm rebuilds artifacts on every publish (prepack), so the npm artifact is more likely to be newer than the repo commit for the same version number; the github: source installs the artifact at the corresponding commit moment.

Typical Usage¶

1. After installing the plugin, restart DSH. If the Qoder desktop app is running on the local machine and the login is not expired, the plugin directly reuses it; the models appear in DSH’s model selector without extra configuration.

2. Without the desktop app, use the plugin’s own device login: Approve a code in the browser; the returned refreshable token lands in $DSH_HOME/.qoder-auth.<region>.json. This path does not read anything from the desktop app and is platform-agnostic. The README also honestly notes that this path has only been tested once for each region on a real machine on Windows; on macOS / Linux, “actually working” is still unverified.

3. If you don’t even want to use device login, set environment variables as a fallback:

# Domestic version
export QODERCN_PAT=<你的长期令牌>

# International version
export QODER_PAT=<你的长期令牌>

The plugin uses the PAT to exchange for a job token before sending the request.

4. When checking usage, click the usage capsule next to the input box. The expanded panel uses the same readings and thresholds as the Plugins page card. Logging out of the plugin only deletes $DSH_HOME/.qoder-auth.<region>.json, it does not affect desktop login or the PAT in environment variables.

Applicable Scenarios and Notes¶

Suitable for people who: have already logged into Qoder (domestic or international) on the local machine, want to call those models directly in DSH and see the quota and check-in status, and do not want to write the gateway adaptation themselves.

A few points to know:

1. Only supports Windows desktop credential decryption. The README clearly states there are no macOS / Linux unpacking branches in src/host/: on non-Windows platforms, the application directory can be correctly parsed by platform (Windows %APPDATA, macOS ~/Library/Application Support, Linux $XDG_CONFIG_HOME/~/.config), but credentials cannot be read; loadCredential returns undefined, and the account panel honestly prompts to use device login or PAT. A green light on CI Ubuntu only means the test runs, not that zero-config exists on Linux.

2. The plugin runs with the permissions of the current DSH process. It will read local credential files, read/write JSON under $DSH_HOME, and temporarily write the decrypted master key to disk in plaintext at %TEMP%. Before installing, you should open the repo to review the source code and license (README notes MIT).

3. This repository is no longer maintained and only supports up to dsh-0.21.5. If you need capabilities like login state reuse or dual provider access, you can try the merged subsequent version; the subsequent version also provides account pools, daily check-ins, and model management capabilities, and there is also eghrhegpe’s scoped package updating on the community directory.

Conclusion¶

The value of this plugin lies in hiding Qoder’s private protocol details: signatures, substituted base64, and double-layer SSE are all handled by the plugin; the user only needs to select an account and view the quota. What needs to be noted is that it stopped at dsh-0.21.5 and can only reuse desktop login state on Windows; other platforms can use device login or PAT.

Repository page pointed to by the plugin clue: https://github.com/hdhgsysh/dsh-connect-qoder
Directory page: https://www.skillhub.cn/plugins/hdhgsysh/dsh-connect-qoder
Directly installable scoped package: https://www.npmjs.com/package/@eghrhegpe/dsh-connect-qoder
Merged subsequent repository: https://github.com/dingminhua/dsh-connect-qoder
Community plugin page: https://dshfind.com/plugins/eghrhegpe/dsh-connect-qoder