dsh-llm-kiro

A Kiro provider for the DeepSeek Harness LLM seam.

The package is a standalone Cordis plugin: it mounts in any harness composition through
cordis.yml, registers the kiro provider route on ctx.llm, and needs no changes to the
harness itself.

What it handles

Every runtime request carries the harness attribution User-Agent (from @deepseek-ai/dsh-llm
attributionHeaders()) plus the AWS SDK-shaped x-amz-user-agent telemetry header the backend expects.

Install

The package is ESM and declares the harness packages it talks to as peer dependencies — the host
DSH installation provides them. It also declares the dsh bundle manifest
(cordis.patch.yml ships with the package), so it mounts as a profile bundle as well as a
plain plugin dependency.

npx -y @deepseek-ai/dsh plugin --profile web install @joshryandavis/dsh-llm-kiro

Mount it in cordis.yml:

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    region: us-east-1        # optional; the credential's region wins when omitted
    reasoningEffort: high    # optional; off | low | high | max (default high)

That is the whole configuration for an existing kiro-cli or Kiro IDE login: credentials are picked
up ambiently, refreshed silently, and written back. A static bearer token works too:

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    bearerTokenEnv: KIRO_BEARER_TOKEN   # stored via the harness credentials service

Config reference

All fields are optional; the llm-kiro user-settings section uses the same schema and can be
edited at runtime — a change reaches the next request without a restart.

Models

Bootstrap catalog (harness id → wire id):

Both dashed and dotted spellings resolve to the wire id. The authenticated management catalog
(per credential, per region) overrides capacities and effort ladders when discovery has run; the
catalog cache at ~/.kiro-management-models-cache.json is shared with pi-provider-kiro.

Development

pnpm install
pnpm run build       # tsc -b: compiles this package; deps resolve from the published @deepseek-ai packages
pnpm test            # vitest suite (95 tests): endpoints, store, refresh, models, serialize,
                     # translate, adapter transport, real Loader composition

Tests resolve the harness packages from the published @deepseek-ai/* packages in node_modules
(peer dependencies plus the dev-dependency set at the versions the code is developed against), so
they exercise the exact published APIs. Credential tests are fully isolated from the host
machine's real kiro-cli / Kiro IDE stores.

Known limitations and deferred work

• Interactive login is not bundled: with no ambient credentials the provider fails with
  MISSING_CREDENTIAL and points at kiro-cli login or the Kiro IDE. A device-code flow can be
  added later on the management seam.
• Legacy inline thinking dialect: reasoning arrives through the native thinkingText events;
  models that emit <thinking> tags inside content keep them in the visible text block.
• Replay state is not emitted; history is resent as provider-neutral content on follow-ups.
• The management catalog refresh is pull-based (discovery or cache age), not background-warmed.

License

MIT