Introduction¶

DSH’s positioning is “everything is a plugin,” and inference providers are no exception. There has long been a TeleAgent plugin in the community (dsh-codearts-auth) that connects China Telecom’s Tiantian AI “Star Super Agent” into DSH. However, it was always broken regarding login state and signature protocol: after a request was sent, users would only see a prompt saying “API Key Invalid,” and repeatedly refilling tokens or checking points was useless because the problem wasn’t actually with the key.

In November 2026, the Cloud Native Gateway began actually verifying signatures, changing this problem from “occasional failure” to “massive 401s.” The dsh-connect-teleagent introduced in this article (maintainer alvinhuang0509-design, category “Network Tools”) is an independent plugin rewritten specifically for this pain point: fixing the signature, reusing existing credentials, and adding check-in and account bar features. Below is an introduction to what it does, how to install it, and how to use it.

Overview¶

dsh-connect-teleagent is a standalone DeepSeek Harness plugin that connects China Telecom’s Tiantian AI “Star Super Agent” into DSH. The core change is switching the Cloud Native Gateway’s signature protocol from the incorrect local-v1 single-round scheme to the valid v1 two-round HMAC-SHA256 scheme, accompanied by balance, daily check-in, account bar in the input box, and other capabilities.

Its provider ID is teleagent, same as dsh-codearts-auth, and they cannot be enabled simultaneously.

Why change the signature instead of swapping the key¶

The scene of the original plugin’s request failure was like this:

teleagent: HTTP 401 — code=40104 unsupported sign version
→ DSH classifies it as AUTH, interface shows "API Key Invalid"

“API Key Invalid” is misleading copy, coming from hardcoded code if (errorCode === "AUTH") return "API Key Invalid" in dsh-client-ui-trajectory. The real reason is the signature protocol is wrong, having nothing to do with the key, points, or login status.

The contrast between the old dangerous implementation and this plugin’s correction is as follows:

A point worth noting: local-v1 adding a random sessionKey is actually the authentication method of the official App’s local kernel (127.0.0.1:4397). The original plugin sent this directly to the Cloud Native Gateway, which naturally didn’t recognize it.

Core Features¶

• Fixed v1 Cloud Native Gateway Signature: Nested two-round HMAC-SHA256, header version v1, scheme constant superagent-auth-v1.
• Points and Check-in: Query points balance, plan, today’s check-in / daily claim / total days and points, event titles, support one-click claiming.
• Account Bar in Input Box: Rendered left of the model name. Click to open account panel. Only appears when the teleagent model is selected in the current session. Automatically hides when switching to other providers and does not send requests.
• Browser Auto Login (1.2.0+): The plugin launches an independent browser window via CDP to intercept the login callback for the token. Users do not need to copy anything from the Network panel.
• Slash Commands: Can complete login, repair credentials, etc., even in headless environments.
• Reuse Existing Credentials: No need to go through the login process again.

Key Points of the Signature Algorithm (for Implementers)¶

The correct v1 algorithm is as follows:

K        = 3rd segment of JWT (signature segment) after removing "<tenant>:" from X-Token
m1       = ["superagent-auth-v1", token, installId, tsSec, nonce].join("/")   # slash
sig1     = hex(HMAC_SHA256(K, m1))
bodyHash = hex(SHA256(actual request body raw bytes))
m2       = ["superagent-auth-v1", METHOD, signPath, tsSec, nonce,
            appVersion, bodyHash].join("\n")                                  # newline
sig2     = hex(HMAC_SHA256(sig1, m2))   => X-Superagent-Signature

A few easy-to-trap pitfalls:

• signPath = /superCowork/sapi/api/v1/chat/completions
• The version in the header is v1, the constant in the message is superagent-auth-v1, these are two different strings.
• The first round uses /, the second round uses \n, different separators are the easiest place to make mistakes.
• ts uses seconds; using milliseconds will result in 40103 time sync mismatch.
• The body must be serialized only once; the signature and sending must use the same bytes, otherwise the gateway’s recalculated bodyHash won’t match.

This plugin references liao96312/teleagent-proxy’s docs/signature-algorithms.md and scripts/teleagent-shim.js. According to the README, it has verified HTTP 200 with a real account single signature request on 2026-11-04, and also has byte-by-byte verification integration tests with a local mock gateway.

Installation and Enablement¶

Uninstall dsh-codearts-auth before installing, otherwise there will be a provider ID conflict. The installation commands come from the original README; the Desktop CLI path is fixed:

DSH="/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh"

# Install from npm
"$DSH" plugin --profile desktop add dsh-connect-teleagent

# Or install from source code directory (development)
"$DSH" plugin --profile desktop install /path/to/dsh-connect-teleagent

# Restart DeepSeek Harness after installation

One point needs clarification: this package does not require building during installation. lib/client.js (client panel) is pre-built and released with the package, so there are no prepare / install / postinstall scripts. dsh-codearts-auth failed to install initially because its prepare calls pnpm, but the Desktop CLI’s PATH does not have pnpm, resulting in spawn ENOENT. When installing from git or npm, no pnpm or allowBuilds allowance is needed for this plugin.

You only need to locally rebuild if you want to modify plugin-src/client/index.js: run npm i then npm run build:client; the devDependency only has esbuild.

Credentials: Ready to use out of the box¶

The plugin reuses credentials written by dsh-codearts-auth to ~/.dsh/.credentials.yaml:

• TELEAGENT_ACCOUNT_<HEX>: Account pool entry, selected from enabled teleagent accounts in ~/.dsh/jet-hub/state.json.
• TELEAGENT_ACCESS_TOKEN: Default ref, fallback.
• TELEAGENT_DEVICE_ID: 12-digit hex device identifier.

The new signature also requires a stable installId (UUID), which is not present in old credentials. The plugin will generate and persist it to TELEAGENT_INSTALL_ID on first use and reuse it thereafter. You can also manually complete it by clicking “Repair Credentials” in the panel.

Note: Once installId is generated, do not delete the TELEAGENT_INSTALL_ID reference. Changing device identity increases the risk control hit rate.

Typical Usage¶

Browser Auto Login (Recommended, 1.2.0+). Click “Browser Login (Recommended)” in Settings → TeleAgent or in the Account Bar, and the plugin will:

1. Launch an independent Chrome/Edge/Chromium window using a temporary configuration directory, which doesn’t affect the daily browser and doesn’t read cookies.
2. Open the official login page; you log in normally in the window.
3. Listen via CDP for network events and extract the token from the callback hit.
4. Automatically save, close the window, and clean up the temporary directory.

The manual login path is still retained, suitable for machines without a browser: open the official login page in Settings → TeleAgent, or paste the captured token / callback URL.

Slash commands also work in headless environments:

/teleagent status                      # Login status
/teleagent login [callbackURLOrToken]  # Without args, shows official login page
/teleagent repair                      # Complete installId / deviceId
/teleagent balance                     # Points balance
/teleagent checkin                     # Check-in status
/teleagent claim                       # Claim points
/teleagent user                        # Account info

Select the model under the teleagent provider in the module selector to start a conversation.

Regarding the Location of Login Token¶

This is a segment emphasized in the README specifically because early documentation had incorrect guidance, leading users to repeatedly paste failures. After authorization, the browser stays at:

https://agent.teleai.com.cn/superCowork/sapi/cowork/auth?code=ucc.XXXXXX
                                            ↑ Only code, no token

The token actually travels via the teleai-cowork://auth?token=… deep link, which is intercepted by the official desktop client for navigation. It never appears in the address bar, and the browser does not print cross-protocol navigation to the Console. The code is one-time; a consumed code cannot be exchanged for a token by the plugin, so there is no path of “giving the code to the plugin, and the plugin exchanges it for the token”.

The plugin accepts four inputs: full callback URL, teleai-cowork:// deep link, bare token, or a sentence carrying the token. If you paste an address containing only code, the plugin will say “This is an authorization code, not a token,” rather than generally reporting “Token not found.”

Use Cases and Notes¶

Suitable for these developers and users: those who have already configured the TeleAgent provider in DSH, are blocked by 40104, or need points and check-in entry. The plugin provides both a graphical panel and slash commands, usable on desktop and in headless environments.

A few notes:

• The plugin runs with the permissions of the current DSH process; you should check the source code and license before installing. The license is MIT, and the repository address is at the end of the text.
• It conflicts with dsh-codearts-auth’s provider ID; uninstall the latter before installing and do not enable them simultaneously.
• Browser auto login starts an independent browser process and relies on Chrome / Chromium / Edge / Brave / Vivaldi being present locally. If no browser is found, the plugin will explicitly report “Chrome/Edge/Chromium not found,” at which point it falls back to manually pasting the token.
• Only one login attempt is allowed at a time; two windows will fight for the same one-time code.
• Requires Node 22.19.0 or higher (as per engines declaration), community category “Network Tools”.

Conclusion¶

The value of this plugin lies not in having an extra provider, but in clearly defining and fixing the “wrong signature protocol” issue, saving developers time on the misleading “API Key Invalid” error message. Once installed, you can reuse old credentials and add an installId to use it; daily usage focuses on balance and check-in entry.

• Community Directory: https://www.skillhub.cn/plugins/alvinhuang0509-design/dsh-connect-teleagent
• Repository: https://github.com/alvinhuang0509-design/dsh-connect-teleagent
• npm: https://www.npmjs.com/package/dsh-connect-teleagent