DSH OpenCode Zen Bridge

A small, isolated integration that connects the DeepSeek Harness to OpenCode Zen’s OpenAI-compatible route through a loopback streaming shim. The project contains two compatible paths:

1. A profile-overlay path for the existing DSH llm-pi-ai adapter. DSH supplies a disposable local dummy key, the shim removes Authorization at the last local hop, and the upstream request is forwarded without that header.
2. A standalone @deepseek-ai/dsh-llm-opencode adapter package that sends no authorization header itself and owns model discovery, SSE translation, cancellation, and timeout handling.

The implementation was live-tested through DSH with the big-pickle model. The test returned OPENCODE_DSH_LIVE_OK_2 through the complete DSH → shim → OpenCode route.

Important status

This repository is public for documentation and source review. The integration is not a general-purpose public proxy. The shim binds to 127.0.0.1 only, accepts only two fixed API paths, and does not accept an arbitrary upstream URL.

OpenCode Zen model availability, privacy behavior, rate limits, and service terms are controlled by OpenCode and can change. OpenCode’s official documentation describes free models as limited-time offerings and separately documents authenticated Zen usage 1. Review the OpenCode Zen documentation and Terms of Use before using this integration with real workspace data.

Architecture

DSH / llm-pi-ai
    |
    | local OpenAI-compatible request with disposable dummy key
    v
zen_shim.js :8791
    |
    | Authorization removed; only fixed Zen routes allowed
    v
https://opencode.ai/zen/v1
    |
    v
streamed response back to DSH

Files

Path	Purpose
zen_shim.js	Dependency-free loopback HTTP shim with streaming relay.
tools/opencode-zen/load-models.mjs	One-shot anonymous model loader and profile-overlay generator.
tools/opencode-zen/cordis.patch.yml	Example DSH profile overlay for the existing llm-pi-ai route.
package/	Isolated DSH adapter package with automatic discovery and OpenAI-compatible SSE translation.
docs/index.html	GitHub Pages documentation site.

Quick start

Start the local shim:

node zen_shim.js

Generate a current profile overlay from the anonymous model listing:

node tools/opencode-zen/load-models.mjs \
  --out ~/.dsh/profiles/<profile>/cordis.patch.yml \
  --base-url http://127.0.0.1:8791/v1

The generated overlay uses the existing llm-pi-ai provider and the opencode provider key. The disposable value required by that adapter must be stored locally as:

version: 1
refs:
  OPENCODE_API_KEY: oc-local-shim-dummy

The value is not an OpenCode credential. It exists only to satisfy the generic local adapter; zen_shim.js discards the corresponding header before the request leaves the host.

Automatic model loading

load-models.mjs requests /v1/models without an authorization header, limits the response to 4 MiB, filters conservatively to IDs ending in -free plus big-pickle, and writes a DSH row-patch overlay atomically when --out is provided. It does not poll in the background, read auth files, rotate identities, or change the active DSH profile unless the operator explicitly chooses the output path.

If the endpoint returns no free entries, the loader emits the conservative fallback list from the requested design and prints a warning. That fallback is not a guarantee that those IDs remain available or free.

Standalone adapter package

The package/ directory is an isolated workspace package intended for a DSH checkout. It is not automatically inserted into DSH’s base composition by this repository. Its first implementation is text-oriented and rejects image input. Tool schemas are represented using the OpenAI-compatible request vocabulary, with provider tool-call deltas translated into DSH stream chunks.

The package expects the DSH workspace dependencies declared in package/package.json. It should be added to a profile only after the operator decides whether to use the direct adapter or the existing llm-pi-ai plus shim path; both should not be activated simultaneously for the same route.

Validation

The implementation has passed the following focused checks in the source checkout:

• TypeScript check for the isolated adapter package.
• Unit tests for free-model filtering, deduplication, and metadata normalization.
• Node syntax checks for the shim and model loader.
• DSH Cordis configuration validation.
• A live DSH completion through opencode / big-pickle, producing a streamed assistant response and a completed turn.

Responsible use

This project does not provide a method for obtaining paid access without authorization. It does not extract OpenCode tokens, share subscriptions, bypass quotas, create accounts, scrape internal endpoints, or rotate identities. Do not expose the loopback shim as an unauthenticated network proxy, and do not use one account or endpoint to serve unrelated third parties without confirming that the arrangement is permitted.

Free endpoints may have different data-use and privacy conditions from paid endpoints. Avoid sending confidential source code, secrets, personal data, or proprietary prompts until the current provider documentation has been reviewed.

References

DSH web-search plugin

This repository also contains package/web-search-exa-mcp, an isolated DSH web-search provider based on Pi Web Access’s public anonymous Exa MCP route. It calls https://mcp.exa.ai/mcp with the web_search_exa MCP tool, sends no login or API key, parses SSE/JSON responses, and maps results into the DSH WebSearchResult contract.

The plugin includes bounded timeouts, response-size limits, abort handling, typed provider errors, and explicit HTTP 429 handling. It does not bypass rate limits or read credentials. The implementation is activated in a local DSH web profile with:

- insert:
    - id: web-search-exa-mcp
      name: '@deepseek-ai/dsh-web-search-exa-mcp'
      config:
        endpoint: https://mcp.exa.ai/mcp
        tool: web_search_exa

The adapter has focused tests for anonymous headers, MCP request construction, SSE/JSON response parsing, and rate-limit behavior. The anonymous Exa route is free and keyless but remains provider-controlled and rate-limited; it should not be described as unlimited.

Local services used for verification

OpenCode web runs with the official CLI command:

opencode web --port 4096 --hostname 127.0.0.1

The DSH web surface runs with the OpenCode-enabled web profile and open authority when explicitly requested:

node --import tsx/esm apps/cli/src/bin.ts web \
  --host 0.0.0.0 --open-authority --no-open

These commands are examples only. The public repository does not include credentials, runtime logs, or generated build output.