dsh-zed-provider

dsh plugin --profile web add dsh-zed-provider

dsh-zed-provider

Run your Zed AI subscription (Zed Pro / Student — the monthly prompt credits)

inside DeepSeek Harness. The bundle registers one LLM provider route,

zed-agent, whose turns are minted and streamed through Zed Cloud

(https://cloud.zed.dev) exactly as the Zed editor does it.

Install

dsh plugin --profile web add dsh-zed-provider

Link your Zed account

Type /zed-login in the Harness composer. The command opens Zed's native-app

sign-in page, waits for the loopback callback, and stores the resulting grant in

the Harness credential store (llm-zed/zed-agent). Later requests reuse it, and

the short-lived gateway token is minted automatically and refreshed on demand.

Credentials are resolved in this order, so any one of them is enough:

1. config.credentials — a literal "<userId> <accessToken>" (or JSON) value.

2. config.apiKeyEnv (default ZED_CREDENTIALS) — resolved through the

credential seam. The Models settings page shows this as the Zed card's key

field, so a credential pasted there works without /zed-login.

3. The llm-zed/zed-agent grant record written by /zed-login.

4. The Zed editor's own local keyring entry, on macOS (zed.dev) and Linux

(secret-tool), imported once into the grant record — sign in inside Zed and

this plugin picks it up by itself.

apiKeyEnv is spelled that way because the Models page reads exactly that field

name; its value is a credential reference, and what it holds is the

"<userId> <accessToken>" pair Zed issues.

Settings UI

Settings → Models → the Zed card carries this bundle's own editor

(lib/client.js, a client-module half registered on the page's

settings.models.provider-card seat for the llm-zed namespace):

• credential status, from the card's credential join plus a live

credentials/describe;

• a credential field that stores "<userId> <accessToken>" under the reference

apiKeyEnv names (read live from the settings document, default

ZED_CREDENTIALS), with Remove to unset it;

• a refusal instead of a silent no-op when that reference is supplied by a

read-only source such as an environment variable.

It also carries the model chooser: the Host registers

llm.registerModelDiscovery for this namespace, the page reads it through

llm/discoverModels, and the tick boxes write visibleModels through

settings/mutate. That field is volatile, so a tick changes the picker on the

next catalog read without a reload; an empty or complete selection unsets it,

meaning "offer every model this plugin can run".

baseUrl stays a composition-only field in cordis.patch.yml.

The client fiber hard-injects only slots, locale and remote, and picks the

credential remote up through ctx.inject(['remote.credentials'], …). That is

deliberate: the web boot asserts that every client entry activated, so a root

client plugin that waits on a service the settings UI keeps private (such as

settingsScope) takes the whole GUI boot down with

<package>: pending (waiting for service: …).

Models

listModels reads GET /models with your credential and advertises the models

Zed reports for the backends this plugin implements — Claude (Anthropic

Messages) and GPT (OpenAI Responses). Zed's Gemini and Grok entries are

filtered out rather than offered broken; selecting one anyway fails fast with

UNSUPPORTED_CONTENT.

Each model carries Zed's own context window, output cap, and — when

supports_thinking — the effort levels off / low / high / max, mapped

onto Anthropic extended thinking budgets.

Configuration

Field · Default · Meaning

apiKeyEnv · ZED_CREDENTIALS · Credential reference holding "<userId> <accessToken>".

credentials · absent · Literal credential value; highest priority, composition-time.

baseUrl · https://cloud.zed.dev · Zed Cloud endpoint.

visibleModels · all supported · Narrow the catalog to these model ids.

Quota

Zed owns the accounting: no plan or no credits left answers HTTP 402, which

surfaces as a QUOTA failure naming https://zed.dev/account. The plugin does

not invent percentages or limits.

Development

pnpm install (which runs the prepare hook), then pnpm check —

typecheck, build, tests. Sources are TypeScript under src/; lib/ is build

output and is git-ignored, because the prepare/prepack hooks rebuild it

wherever the package is consumed and the published tarball carries the built

copy through the files allowlist.

A profile can install this bundle as a link: to a working copy, in which case

that copy's lib/ is what the Host imports: rebuild after changing src/, or

the Host keeps running the previous build.

node --test test/*.test.mjs covers the pieces that fail silently in

production: the NDJSON → StreamChunk translation for both backends

(src/frames.ts framing, src/parse.ts Anthropic events, src/responses.ts

Responses events), the RSA sign-in handshake (src/signin.ts), the request

projections (src/anthropic.ts, src/responses.ts), and the card's slot

registration, credential and model-selection wiring (src/client.ts, loaded

under a stubbed module loader in test/client.test.mjs). The tests import the

built lib/, because that is what the Harness actually runs. Only

src/index.ts touches the Harness runtime.

Two install-time facts worth knowing: the Host half is re-imported only by a

profile restart (ESM caches by URL), and the client half is composed from the

Loader's entries at Host boot, so adding or removing exports["./client"] takes

a restart too — after that it is served per request under a content hash, so

client-side edits reach the browser on the next load.