@deepseek-harness-tui/dsh-tui 0.13.0 → 0.14.0

package/lib/types/backends/claude/translate/types.d.ts

@@ -0,0 +1,114 @@
+/** Input, attempt and activity types carried by the Claude translator. */
+import type { ImageRef, PendingItem, UsageDelta } from '../../../agent/events.js';
+import type { TodoPanelItem } from '../../../adapter/ports/channel-view.js';
+/** How confirmed user inputs become user rows. */
+export type ClaudeUserRows = 
+/** On `command_lifecycle{started}` (CLI capability `msg_lifecycle_v1`). */
+'lifecycle'
+/** On the CLI's `user{isReplay:true}` echo of our message (fallback). */
+ | 'replay';
+export interface ClaudeTranslatorOptions {
+    readonly cwd: string;
+    readonly userRows: ClaudeUserRows;
+    /** Wall clock for event times (injected by fixtures for determinism). */
+    readonly now?: () => number;
+    readonly debug?: (message: string) => void;
+    /**
+     * Where a resumed session's numbering continues: the turn
+     * and sequence counters the replayed history ended at, and the model it
+     * last ran. Live events after a resume must neither reuse a replayed
+     * (turn, step) — the projector binds attempts by position — nor a
+     * replayed `seq` (settled assistant messages are deduplicated by it).
+     */
+    readonly start?: {
+        readonly turn: number;
+        readonly seq: number;
+        readonly model?: string;
+        /** The replayed conversation's task table (replay.ts `taskSeeds()`):
+         * seeded as the live table so a resumed TaskUpdate finds its id. */
+        readonly tasks?: readonly ClaudeTaskSeed[];
+    };
+}
+/** A pushed input awaiting the CLI's confirmation. */
+export interface RegisteredInput {
+    readonly text: string;
+    readonly placement: PendingItem['placement'] | 'turn' | 'now';
+    /** Images the message carries (facades for the user row). */
+    readonly images?: readonly ImageRef[];
+}
+/** The attempt (one API response) being assembled. */
+export interface OpenAttempt {
+    readonly id: string;
+    readonly step: number;
+    readonly model?: string;
+    reasoning: string;
+    text: string;
+    /** Visible TEXT streamed for this attempt (the settled blocks land in
+     *  `text` only when the CLI sends the whole assistant message; a streamed
+     *  response never does, so the narration window reads this). */
+    streamText: string;
+    /** Blocks received via `assistant` messages. */
+    blocks: number;
+    aborted: boolean;
+    /** Usage from `message_start` / `assistant` (input side). */
+    usage: UsageDelta | undefined;
+    /** Cumulative output tokens from `message_delta`. */
+    outputTokens: number | undefined;
+    /** Stream block index → tool call (for `input_json_delta`). */
+    readonly streamTools: Map<number, string>;
+}
+/**
+ * One task of the CLI's task family (2.1.284+: TaskCreate/TaskUpdate/
+ * TaskList/TaskGet replaced TodoWrite for plan tracking), as the todo panel
+ * projects it. Keyed by the id the CLI assigned (a TaskCreate result).
+ */
+export interface TrackedTask {
+    /** The `subject` line (the panel's content). */
+    content: string;
+    status: TodoPanelItem['status'];
+    /** The spinner line while in_progress — tracked for parity with the
+     *  family's input contract, never emitted (the panel shape is
+     *  content/status only, exactly like TodoWrite's path). */
+    activeForm?: string;
+    /** Creation order: the snapshot's row order. */
+    seq: number;
+}
+/**
+ * One tracked task as a resumed session hands it to its live translator (a
+ * resumed TaskUpdate names an id the replay tracked). Serializable: the
+ * replay and the live session are two translator instances.
+ */
+export interface ClaudeTaskSeed {
+    readonly id: string;
+    readonly content: string;
+    readonly status: TodoPanelItem['status'];
+    readonly activeForm?: string;
+    /** Creation order: the snapshot's row order. */
+    readonly seq: number;
+}
+/**
+ * The translator's own state as the working-activity fold reads it (the
+ * Claude counterpart of the DSH working-activity plugin's inputs): everything
+ * the working line shows, already tracked here, so the fold (activity.ts)
+ * re-parses nothing. A snapshot is taken after each translated message.
+ */
+export interface ClaudeActivityState {
+    /** A turn is open (the line works only inside one). */
+    readonly turnOpen: boolean;
+    /** Wall clock the open (or last) turn began (0 before the first). */
+    readonly turnStartedAt: number;
+    /** The newest tool call not yet settled, main lane or subagent lane. */
+    readonly openTool: {
+        readonly name: string;
+        readonly input: unknown;
+    } | undefined;
+    /** Tool results settled in the current turn (main lane). */
+    readonly toolCount: number;
+    /** The in_progress tracked task's `activeForm` — the CLI's own spinner
+     *  wording, the closest thing to a DSH phrase this backend has. */
+    readonly activeForm: string | undefined;
+    /** The leading `⏵` self-narration line of the streaming reply, if any
+     *  (the narrate contract: exactly one, at the very top). */
+    readonly narration: string | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/types/backends/claude/translate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/backends/claude/translate/types.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAE3E,kDAAkD;AAClD,MAAM,MAAM,cAAc;AACxB,2EAA2E;AACzE,WAAW;AACb,yEAAyE;GACvE,QAAQ,CAAA;AAEZ,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACrF;4EACoE;QACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;KAAE,CAAA;CAC/C;AAED,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,MAAM,GAAG,KAAK,CAAA;IAC7D,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;CACtC;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ;;oEAEgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,6DAA6D;IAC7D,KAAK,EAAE,UAAU,GAAG,SAAS,CAAA;IAC7B,qDAAqD;IACrD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/B;;+DAE2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAA;IACjF,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;uEACmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;gEAC4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;CACvC"}

package/lib/types/backends/claude/translate/types.js

@@ -0,0 +1 @@
+export {};

package/lib/types/backends/claude/translate.d.ts

@@ -0,0 +1,9 @@
+/** Translate Claude SDK messages and expose replay helpers without changing import paths. */
+export { createClaudeTranslator } from './translate/core.js';
+export type { ClaudeTranslator } from './translate/core.js';
+export type { ClaudeActivityState, ClaudeTaskSeed, ClaudeTranslatorOptions, ClaudeUserRows } from './translate/types.js';
+export { COMMAND_TAG, INTERRUPT_ECHO, LOCAL_COMMAND_TAG, userText } from './translate/content.js';
+export { backgroundOutputPath } from './translate/lanes.js';
+export { formatDuration } from './translate/system.js';
+export { claudeEmits } from './translate/events.js';
+//# sourceMappingURL=translate.d.ts.map

package/lib/types/backends/claude/translate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.d.ts","sourceRoot":"","sources":["../../../../src/backends/claude/translate.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACxH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA"}

package/lib/types/backends/claude/translate.js

@@ -0,0 +1,6 @@
+/** Translate Claude SDK messages and expose replay helpers without changing import paths. */
+export { createClaudeTranslator } from './translate/core.js';
+export { COMMAND_TAG, INTERRUPT_ECHO, LOCAL_COMMAND_TAG, userText } from './translate/content.js';
+export { backgroundOutputPath } from './translate/lanes.js';
+export { formatDuration } from './translate/system.js';
+export { claudeEmits } from './translate/events.js';

package/lib/types/backends/codex/auth/external-tokens.d.ts

@@ -0,0 +1,66 @@
+/** Managed ChatGPT auth, one instance per hub. Token material stays between
+ * the host credential source, JWT claims parsing, and JSON-RPC writes. */
+import type { OAuthAccess, OAuthCredentialSource } from '../../../agent/backend.js';
+import type { AccountView, SessionAuthView } from '../../../agent/capabilities.js';
+import { type Rec } from '../narrow.js';
+import { type RpcClock } from '../rpc/client.js';
+import type { CodexHub } from '../rpc/hub.js';
+import { type CodexAuthRoute } from './route.js';
+export declare const CODEX_OAUTH_PROVIDER = "openai-codex";
+export declare const CODEX_REFRESH_BUDGET_MS = 8000;
+export type CodexTokenSource = 'channel' | 'dsh-auth' | 'codex-login' | 'api-key' | 'missing' | 'unknown';
+export interface CodexAuthNotice {
+    readonly level: 'warning' | 'error';
+    readonly key: string;
+    readonly text: string;
+}
+export interface CodexDeviceLogin {
+    readonly loginId: string;
+    readonly verificationUrl: string;
+    readonly userCode: string;
+    readonly done: Promise<boolean>;
+    cancel(): Promise<void>;
+}
+export interface CodexAuthRuntime {
+    readonly source: CodexTokenSource;
+    readonly route: CodexAuthRoute;
+    /** External auth failed after injection; this hub is not verified native. */
+    readonly managedFailed: boolean;
+    start(): Promise<void>;
+    reconnect(): Promise<void>;
+    status(): Promise<SessionAuthView>;
+    account(): Promise<AccountView>;
+    subscribe(listener: (notice: CodexAuthNotice) => void): () => void;
+    deviceLogin(): Promise<CodexDeviceLogin>;
+    apiKeyLogin(apiKey: string): Promise<void>;
+}
+export interface CodexAuthDeps {
+    readonly hub: CodexHub;
+    readonly cwd: string;
+    readonly config?: Rec;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly channel?: {
+        readonly name: string;
+        readonly baseUrl?: string;
+    };
+    readonly credential?: OAuthCredentialSource;
+    /** Native-only hubs must never acquire managed auth on a later reconnect. */
+    readonly externalAllowed?: boolean;
+    /** Clean fallback does not retry stored auth until explicit reconnect. */
+    readonly skipStoredCredential?: boolean;
+    readonly clock?: RpcClock;
+    readonly debug?: (message: string) => void;
+}
+interface ExternalTokens {
+    readonly accessToken: string;
+    readonly chatgptAccountId: string;
+    readonly chatgptPlanType: string | null;
+}
+/** Decode our own stored JWT payload only; signature verification is the
+ * provider's job. Missing account identity is not an injectable credential. */
+export declare function externalTokensOf(access: OAuthAccess): ExternalTokens | undefined;
+export declare function createCodexAuth(deps: CodexAuthDeps): CodexAuthRuntime;
+/** All attached sessions share one login and one refresh handler per hub. */
+export declare function acquireCodexAuth(deps: CodexAuthDeps): CodexAuthRuntime;
+export {};
+//# sourceMappingURL=external-tokens.d.ts.map

package/lib/types/backends/codex/auth/external-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-tokens.d.ts","sourceRoot":"","sources":["../../../../../src/backends/codex/auth/external-tokens.ts"],"names":[],"mappings":"AAAA;0EAC0E;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAElF,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,cAAc,CAAA;AAEjD,OAAO,EAAyB,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAoB,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhE,eAAO,MAAM,oBAAoB,iBAAiB,CAAA;AAClD,eAAO,MAAM,uBAAuB,OAAO,CAAA;AAC3C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;AACzG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAA;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAA;IAClC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/B,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAClE,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACxC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AACD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAC3C;AAED,UAAU,cAAc;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CACxC;AACD;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAUhF;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,gBAAgB,CA8NrE;AAGD,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,gBAAgB,CAItE"}

package/lib/types/backends/codex/auth/external-tokens.js

@@ -0,0 +1,325 @@
+import { t } from '../../../i18n.js';
+import { rec, str } from '../narrow.js';
+import { CLIENT, NOTIFY, SERVER_REQUEST } from '../protocol/index.js';
+import { REAL_CLOCK, RPC_ERROR } from '../rpc/client.js';
+import { codexAuthRoute } from './route.js';
+export const CODEX_OAUTH_PROVIDER = 'openai-codex';
+export const CODEX_REFRESH_BUDGET_MS = 8000;
+/** Decode our own stored JWT payload only; signature verification is the
+ * provider's job. Missing account identity is not an injectable credential. */
+export function externalTokensOf(access) {
+    const parts = access.access.split('.');
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const payload = rec(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
+        const claims = rec(payload?.['https://api.openai.com/auth']);
+        const id = str(claims?.chatgpt_account_id);
+        if (id === undefined || id.trim() === '')
+            return undefined;
+        return { accessToken: access.access, chatgptAccountId: id, chatgptPlanType: str(claims?.chatgpt_plan_type) ?? null };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createCodexAuth(deps) {
+    const { hub } = deps;
+    const clock = deps.clock ?? REAL_CLOCK;
+    const debug = deps.debug ?? (() => undefined);
+    const env = deps.env ?? {};
+    let config = deps.config;
+    let route = codexAuthRoute(config, env, deps.channel !== undefined);
+    let source = deps.channel === undefined ? 'unknown' : 'channel';
+    let ownSource = source;
+    let subscription;
+    let injected;
+    let managedFailed = false;
+    let externalLoaded = false;
+    let skipStoredCredential = deps.skipStoredCredential === true;
+    let epoch = 0;
+    let starting;
+    let startedGeneration = 0;
+    const listeners = new Set();
+    const notices = new Map();
+    const note = (key, level, text) => {
+        const notice = { key, level, text };
+        notices.set(key, notice);
+        for (const listener of [...listeners]) {
+            try {
+                listener(notice);
+            }
+            catch {
+                debug('codex auth: notice listener failed');
+            }
+        }
+    };
+    const disable = () => { epoch += 1; injected = undefined; source = ownSource; subscription = undefined; };
+    const failed = (key) => {
+        const mayHaveLoaded = injected !== undefined || externalLoaded;
+        disable();
+        managedFailed = mayHaveLoaded;
+        if (managedFailed)
+            source = 'unknown';
+        debug('codex auth: managed credential failed; injection stopped');
+        note('codex-auth', 'error', t(key));
+    };
+    const fresh = async (rejected) => {
+        if (deps.credential === undefined)
+            return undefined;
+        const controller = new AbortController();
+        let timer;
+        const budget = new Promise((_resolve, reject) => {
+            timer = clock.setTimeout(() => { controller.abort(); reject(new Error('refresh failed')); }, CODEX_REFRESH_BUDGET_MS);
+        });
+        const options = { ...(rejected === undefined ? {} : { rejected }), signal: controller.signal };
+        try {
+            return await Promise.race([deps.credential.fresh(options), budget]);
+        }
+        finally {
+            clock.clearTimeout(timer);
+        }
+    };
+    const readOwnAccount = async () => {
+        if (deps.channel !== undefined) {
+            ownSource = 'channel';
+            source = 'channel';
+            return;
+        }
+        try {
+            const result = rec(await hub.call(CLIENT.accountRead, { refreshToken: false }));
+            const account = rec(result?.account);
+            if (account?.type === 'apiKey')
+                ownSource = 'api-key';
+            else if (account?.type === 'chatgpt')
+                ownSource = 'codex-login';
+            else if (result?.requiresOpenaiAuth === true && account === undefined)
+                ownSource = 'missing';
+            else
+                ownSource = 'unknown';
+            if (injected === undefined && !managedFailed) {
+                source = ownSource;
+                subscription = str(account?.planType);
+            }
+        }
+        catch {
+            debug('codex auth: account/read failed');
+        }
+    };
+    const refresh = async (request) => {
+        const previous = injected;
+        const version = epoch;
+        if (previous === undefined || !route.firstParty || deps.externalAllowed === false) {
+            request.respondError(RPC_ERROR.timeout, 'refresh failed');
+            return;
+        }
+        try {
+            const access = await fresh(previous.accessToken);
+            const tokens = access === undefined ? undefined : externalTokensOf(access);
+            if (tokens === undefined)
+                throw new Error('refresh failed');
+            if (!request.live())
+                return;
+            // A simultaneous login or degradation wins over this in-flight refresh.
+            if (epoch !== version) {
+                if (injected === undefined) {
+                    request.respondError(RPC_ERROR.timeout, 'refresh failed');
+                    return;
+                }
+                request.respond(injected);
+                return;
+            }
+            injected = tokens;
+            source = 'dsh-auth';
+            subscription = tokens.chatgptPlanType ?? undefined;
+            request.respond(tokens);
+        }
+        catch {
+            request.respondError(RPC_ERROR.timeout, 'refresh failed');
+            if (request.generation === hub.generation && epoch === version)
+                failed('codex-auth-refresh-failed');
+        }
+    };
+    hub.onGlobalRequest(SERVER_REQUEST.chatgptAuthTokensRefresh, request => { void refresh(request); });
+    hub.onGlobal((method, params) => {
+        if (method === NOTIFY.accountLoginCompleted && params.loginId == null && params.success === false && injected !== undefined)
+            failed('codex-auth-login-failed');
+    });
+    const select = async () => {
+        route = codexAuthRoute(config, env, deps.channel !== undefined);
+        await readOwnAccount();
+        if (deps.channel !== undefined)
+            return;
+        if (route.firstParty && deps.externalAllowed !== false && deps.credential !== undefined && !skipStoredCredential) {
+            try {
+                const access = await fresh();
+                if (access !== undefined) {
+                    const tokens = externalTokensOf(access);
+                    if (tokens === undefined) {
+                        note('codex-auth', 'warning', t('codex-auth-claims-missing'));
+                    }
+                    else {
+                        epoch += 1;
+                        injected = tokens;
+                        source = 'dsh-auth';
+                        subscription = tokens.chatgptPlanType ?? undefined;
+                        await hub.call(CLIENT.accountLoginStart, { type: 'chatgptAuthTokens', ...tokens });
+                        externalLoaded = true;
+                        if (injected !== undefined)
+                            managedFailed = false;
+                    }
+                }
+            }
+            catch {
+                failed('codex-auth-refresh-failed');
+            }
+        }
+        if (source === 'missing')
+            note('codex-auth-required', 'warning', t('codex-auth-login-needed'));
+    };
+    const runtime = {
+        get source() { return source; },
+        get route() { return route; },
+        get managedFailed() { return managedFailed; },
+        start() {
+            if (starting === undefined || startedGeneration !== hub.generation) {
+                if (startedGeneration !== hub.generation) {
+                    externalLoaded = false;
+                    managedFailed = false;
+                    injected = undefined;
+                }
+                startedGeneration = hub.generation;
+                starting = select();
+            }
+            return starting;
+        },
+        async reconnect() {
+            skipStoredCredential = false;
+            epoch += 1;
+            injected = undefined;
+            notices.clear();
+            try {
+                config = rec(rec(await hub.call(CLIENT.configRead, { includeLayers: false, cwd: deps.cwd }))?.config);
+            }
+            catch {
+                config = undefined;
+                debug('codex auth: config/read failed; managed injection disabled');
+            }
+            startedGeneration = hub.generation;
+            starting = select();
+            await starting;
+        },
+        async status() {
+            await runtime.start();
+            const account = await runtime.account();
+            const labels = {
+                channel: t('codex-auth-source-channel', { name: deps.channel?.name ?? '' }),
+                'dsh-auth': t('codex-auth-source-oauth'),
+                'codex-login': t('codex-auth-source-native'),
+                'api-key': t('codex-auth-source-api-key'),
+                missing: t('codex-auth-source-missing'),
+                unknown: t('codex-auth-source-unknown'),
+            };
+            return { lines: [labels[source], ...(account.subscription === undefined ? [] : [t('codex-auth-plan', { plan: account.subscription })]), ...(route.host === undefined ? [] : [t('codex-auth-host', { host: route.host })]), ...(!route.firstParty || deps.externalAllowed === false ? [t('codex-auth-route-blocked')] : []), ...[...notices.values()].map(notice => notice.text)] };
+        },
+        async account() {
+            await readOwnAccount();
+            return { provider: route.provider, tokenSource: source, ...(subscription === undefined ? {} : { subscription }) };
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            for (const notice of notices.values())
+                listener(notice);
+            return () => { listeners.delete(listener); };
+        },
+        async deviceLogin() {
+            if (deps.channel !== undefined)
+                throw new Error(t('codex-auth-channel-active'));
+            let finish;
+            const done = new Promise(resolve => { finish = resolve; });
+            const early = [];
+            let loginId;
+            const complete = (params) => {
+                if (params.loginId !== loginId)
+                    return;
+                off();
+                if (params.success === true) {
+                    disable();
+                    managedFailed = false;
+                    externalLoaded = false;
+                    ownSource = 'codex-login';
+                    source = 'codex-login';
+                }
+                finish(params.success === true);
+            };
+            const off = hub.onGlobal((method, params) => {
+                if (method !== NOTIFY.accountLoginCompleted)
+                    return;
+                if (loginId === undefined)
+                    early.push(params);
+                else
+                    complete(params);
+            });
+            try {
+                const answer = rec(await hub.call(CLIENT.accountLoginStart, { type: 'chatgptDeviceCode' }));
+                loginId = str(answer?.loginId);
+                const verificationUrl = str(answer?.verificationUrl);
+                const userCode = str(answer?.userCode);
+                if (loginId === undefined || verificationUrl === undefined || userCode === undefined)
+                    throw new Error('login failed');
+                const url = new URL(verificationUrl);
+                if (url.protocol !== 'https:' || !['auth.openai.com', 'chatgpt.com'].includes(url.hostname) || url.username !== '' || url.password !== '')
+                    throw new Error('login failed');
+                for (const params of early)
+                    complete(params);
+                const id = loginId;
+                return {
+                    loginId: id, verificationUrl, userCode, done,
+                    async cancel() {
+                        off();
+                        finish(false);
+                        try {
+                            await hub.call(CLIENT.accountLoginCancel, { loginId: id });
+                        }
+                        catch {
+                            debug('codex auth: device login cancel failed');
+                        }
+                    },
+                };
+            }
+            catch {
+                off();
+                finish(false);
+                throw new Error(t('codex-auth-login-failed'));
+            }
+        },
+        async apiKeyLogin(apiKey) {
+            if (deps.channel !== undefined)
+                throw new Error(t('codex-auth-channel-active'));
+            if (apiKey.trim() === '')
+                throw new Error(t('codex-auth-api-key-required'));
+            try {
+                await hub.call(CLIENT.accountLoginStart, { type: 'apiKey', apiKey });
+                disable();
+                managedFailed = false;
+                externalLoaded = false;
+                ownSource = 'api-key';
+                source = 'api-key';
+            }
+            catch {
+                throw new Error(t('codex-auth-login-failed'));
+            }
+        },
+    };
+    return runtime;
+}
+const managed = new WeakMap();
+/** All attached sessions share one login and one refresh handler per hub. */
+export function acquireCodexAuth(deps) {
+    let runtime = managed.get(deps.hub);
+    if (runtime === undefined) {
+        runtime = createCodexAuth(deps);
+        managed.set(deps.hub, runtime);
+    }
+    return runtime;
+}

package/lib/types/backends/codex/auth/route.d.ts

@@ -0,0 +1,14 @@
+/** The only gate for injecting a dsh-auth ChatGPT token (§5.10).
+ * Failed config/read and every non-first-party override fail closed. */
+import { type Rec } from '../narrow.js';
+export interface CodexAuthRoute {
+    readonly firstParty: boolean;
+    readonly provider: string;
+    readonly host?: string;
+    readonly reason?: 'config-unavailable' | 'channel' | 'provider' | 'provider-url' | 'base-url' | 'environment-url';
+}
+/** A host-only diagnostic: never URL credentials, path, query or fragment. */
+export declare function codexOriginHost(value: unknown): string | undefined;
+/** config is the config/read response's config member, not its envelope. */
+export declare function codexAuthRoute(config: Rec | undefined, env?: Readonly<Record<string, string | undefined>>, channelActive?: boolean): CodexAuthRoute;
+//# sourceMappingURL=route.d.ts.map

package/lib/types/backends/codex/auth/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/backends/codex/auth/route.ts"],"names":[],"mappings":"AAAA;wEACwE;AACxE,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,cAAc,CAAA;AAEjD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,GAAG,UAAU,GAAG,iBAAiB,CAAA;CAClH;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGlE;AAaD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,SAAS,EAAE,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,EAAE,aAAa,UAAQ,GAAG,cAAc,CAerJ"}

package/lib/types/backends/codex/auth/route.js

@@ -0,0 +1,52 @@
+/** The only gate for injecting a dsh-auth ChatGPT token (§5.10).
+ * Failed config/read and every non-first-party override fail closed. */
+import { rec, str } from '../narrow.js';
+/** A host-only diagnostic: never URL credentials, path, query or fragment. */
+export function codexOriginHost(value) {
+    if (typeof value !== 'string' || value === '')
+        return undefined;
+    try {
+        return new URL(value).host || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function officialUrl(value) {
+    if (value === undefined || value === null || value === '')
+        return true;
+    if (typeof value !== 'string')
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && (url.hostname === 'api.openai.com' || url.hostname === 'chatgpt.com')
+            && (url.port === '' || url.port === '443') && url.username === '' && url.password === ''
+            && !value.includes('?') && !value.includes('#') && !value.includes('\\');
+    }
+    catch {
+        return false;
+    }
+}
+/** config is the config/read response's config member, not its envelope. */
+export function codexAuthRoute(config, env = {}, channelActive = false) {
+    const provider = str(config?.model_provider) || 'openai';
+    const providers = rec(config?.model_providers);
+    const current = rec(providers?.[provider]);
+    const environmentUrls = Object.entries(env).filter(([key, value]) => key.toUpperCase() === 'OPENAI_BASE_URL' && value !== undefined && value !== '').map(([, value]) => value);
+    const host = codexOriginHost(current?.base_url ?? config?.openai_base_url ?? config?.chatgpt_base_url ?? environmentUrls[0]);
+    const blocked = (reason) => ({ firstParty: false, provider, ...(host === undefined ? {} : { host }), reason });
+    if (config === undefined)
+        return blocked('config-unavailable');
+    if (channelActive)
+        return blocked('channel');
+    if (provider !== 'openai' || (config.model_provider != null && typeof config.model_provider !== 'string'))
+        return blocked('provider');
+    const openai = providers?.openai;
+    if ((config.model_providers != null && providers === undefined) || (openai != null && rec(openai) === undefined) || rec(openai)?.base_url != null)
+        return blocked('provider-url');
+    if (!officialUrl(config.openai_base_url) || !officialUrl(config.chatgpt_base_url))
+        return blocked('base-url');
+    if (!environmentUrls.every(officialUrl))
+        return blocked('environment-url');
+    return { firstParty: true, provider, host: host ?? 'chatgpt.com' };
+}

package/lib/types/backends/codex/auth/status.d.ts

@@ -0,0 +1,16 @@
+import type { QuestionAnswers, SessionCapabilities } from '../../../agent/capabilities.js';
+import type { AgentEvent } from '../../../agent/events.js';
+import { type CodexAuthRuntime } from './external-tokens.js';
+export interface CodexAuthCapabilityBridge {
+    readonly capability: NonNullable<SessionCapabilities['auth']> & {
+        login(loginOAuth?: () => Promise<boolean>): Promise<void>;
+    };
+    /** True means this was our prompt, so do not pass it to native approvals. */
+    respondQuestion(requestId: string, answers: QuestionAnswers): boolean;
+    cancelQuestion(requestId: string): boolean;
+    /** Withdraw current prompts without preventing login after a reconnect. */
+    withdrawAll(): void;
+    dispose(): void;
+}
+export declare function createCodexAuthCapability(runtime: CodexAuthRuntime, emit: (events: readonly AgentEvent[]) => void): CodexAuthCapabilityBridge;
+//# sourceMappingURL=status.d.ts.map

package/lib/types/backends/codex/auth/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../../../src/backends/codex/auth/status.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,0BAA0B,CAAA;AAE5E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAElF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG;QAC9D,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1D,CAAA;IACD,6EAA6E;IAC7E,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAA;IACrE,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1C,2EAA2E;IAC3E,WAAW,IAAI,IAAI,CAAA;IACnB,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,KAAK,IAAI,GAAG,yBAAyB,CAoF7I"}