@dsh-cove/dsh-web-all 0.0.0-stage → 0.4.3

package/lib/types/host/services/codex-bridge/dsh-integration.d.ts

@@ -0,0 +1,58 @@
+/**
+ * DSH integration for the codex-bridge service domain: registers the codex
+ * proxy as a `llm-pi-ai` provider route and stores the client api key in the
+ * DSH credential store. Both writes are live — pi-ai settings apply with no
+ * restart, and the credentials file reloads through its own watcher.
+ *
+ * Ported from the pre-merge @dsh-cove/dsh-codex-bridge package
+ * (src/dsh-integration.ts) into the dsh-web-all host services. Deviation
+ * forced by the dependency layout: the old module value-imported
+ * `credentialRef` from `@deepseek-ai/dsh-credentials`, which is not a
+ * dependency of the entity package. `credentialRef` only brands an
+ * environment-variable name; the runtime value is that plain string, so the
+ * reference is passed through a structural `ctx.credentials` seam exactly
+ * like the media-gen service domain does.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Credential reference name the pi-ai profile points at. */
+export declare const PROXY_KEY_REF = "DSH_API_PROXY_KEY";
+/** Provider route registered into llm-pi-ai. */
+export declare const PROVIDER_ROUTE = "codex-local";
+/** Wire protocol of the proxy. */
+export declare const PROXY_API = "openai-completions";
+export declare function serviceableModels(modelIds: string[]): string[];
+export interface CodexProviderProfile {
+    displayName: string;
+    apiKeyEnv: string;
+    api: string;
+    baseURL: string;
+    reasoning: 'off' | 'low' | 'medium' | 'high';
+    defaultContextWindow: number;
+    defaultMaxTokens: number;
+    models: Array<{
+        id: string;
+        name: string;
+        contextWindow: number;
+        maxTokens: number;
+        input: string[];
+        reasoningEfforts: Record<string, string | null>;
+    }>;
+}
+/**
+ * Build the pi-ai provider profile for one codex model list. Reasoning
+ * efforts mirror the OpenAI codex-model vocabulary (low/medium/high, shared
+ * by the gpt-5.x and gpt-6.x families); omitting `max` keeps the upstream
+ * from receiving an unsupported value.
+ */
+export declare function buildProviderProfile(baseURL: string, modelIds: string[]): CodexProviderProfile;
+export interface RegisterResult {
+    registered: boolean;
+    keyStored: boolean;
+    models: string[];
+}
+/**
+ * Store the proxy api key in the DSH credential store and merge the
+ * provider profile into the `llm-pi-ai` settings namespace. Live applies.
+ */
+export declare function registerProvider(ctx: Context, baseURL: string, apiKey: string, modelIds: string[]): Promise<RegisterResult>;
+//# sourceMappingURL=dsh-integration.d.ts.map

package/lib/types/host/services/codex-bridge/dsh-integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-integration.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/dsh-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,6DAA6D;AAC7D,eAAO,MAAM,aAAa,sBAAsB,CAAA;AAEhD,gDAAgD;AAChD,eAAO,MAAM,cAAc,gBAAgB,CAAA;AAE3C,kCAAkC;AAClC,eAAO,MAAM,SAAS,uBAAuB,CAAA;AAc7C,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAI9D;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC5C,oBAAoB,EAAE,MAAM,CAAA;IAC5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;KAChD,CAAC,CAAA;CACH;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAsB9F;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAsCD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,cAAc,CAAC,CAuBzB"}

package/lib/types/host/services/codex-bridge/dsh-integration.js

@@ -0,0 +1,120 @@
+/**
+ * DSH integration for the codex-bridge service domain: registers the codex
+ * proxy as a `llm-pi-ai` provider route and stores the client api key in the
+ * DSH credential store. Both writes are live — pi-ai settings apply with no
+ * restart, and the credentials file reloads through its own watcher.
+ *
+ * Ported from the pre-merge @dsh-cove/dsh-codex-bridge package
+ * (src/dsh-integration.ts) into the dsh-web-all host services. Deviation
+ * forced by the dependency layout: the old module value-imported
+ * `credentialRef` from `@deepseek-ai/dsh-credentials`, which is not a
+ * dependency of the entity package. `credentialRef` only brands an
+ * environment-variable name; the runtime value is that plain string, so the
+ * reference is passed through a structural `ctx.credentials` seam exactly
+ * like the media-gen service domain does.
+ */
+/** Credential reference name the pi-ai profile points at. */
+export const PROXY_KEY_REF = 'DSH_API_PROXY_KEY';
+/** Provider route registered into llm-pi-ai. */
+export const PROVIDER_ROUTE = 'codex-local';
+/** Wire protocol of the proxy. */
+export const PROXY_API = 'openai-completions';
+/**
+ * Models the codex backend advertises but that are not usable chat targets.
+ * `gpt-reserve` and `codex-auto-review` stay excluded at every CLI version.
+ */
+const EXCLUDED_MODELS = new Set(['gpt-reserve', 'codex-auto-review']);
+// gpt-5*/gpt-6* (the codex model families the ChatGPT backend serves), o\d*
+// (o3, o4-mini), codex-* — but NOT legacy gpt-3/gpt-4* and not the excluded
+// slugs. The family gate must stay in sync with the proxy's own codex route
+// regex (tools/dsh-api-proxy/src/providers/codex.ts MODEL_RE); upstream
+// version-gates visibility (gpt-6 requires client_version >= 0.162.0), and
+// the bridge only ever sees models the proxy's live list already resolved.
+export function serviceableModels(modelIds) {
+    return modelIds
+        .filter((id) => !EXCLUDED_MODELS.has(id))
+        .filter((id) => /^(gpt-[56]|o\d|codex-)/i.test(id));
+}
+/**
+ * Build the pi-ai provider profile for one codex model list. Reasoning
+ * efforts mirror the OpenAI codex-model vocabulary (low/medium/high, shared
+ * by the gpt-5.x and gpt-6.x families); omitting `max` keeps the upstream
+ * from receiving an unsupported value.
+ */
+export function buildProviderProfile(baseURL, modelIds) {
+    const models = serviceableModels(modelIds).map((id) => ({
+        id,
+        name: id,
+        contextWindow: 400_000,
+        maxTokens: 32_768,
+        input: ['text'],
+        reasoningEfforts: { off: null, low: 'low', medium: 'medium', high: 'high' },
+    }));
+    return {
+        displayName: 'Codex (local proxy)',
+        apiKeyEnv: PROXY_KEY_REF,
+        api: PROXY_API,
+        baseURL,
+        reasoning: 'high',
+        defaultContextWindow: 400_000,
+        defaultMaxTokens: 32_768,
+        models,
+    };
+}
+/** 可选读取 credentials 缝隙：0.2 严格注入下访问未声明的服务会直接抛错。 */
+function optionalCredentials(ctx) {
+    try {
+        return ctx.credentials;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * credentials 服务就绪后再写入代理 key（一次性钩子）。
+ * 0.2 里插件只有在自己的 inject 声明中才能访问服务，因此这里用局部 inject 等待，
+ * 而不是在 registerProvider 里直接取属性；组合里没有该服务时静默跳过。
+ */
+function storeKeyWhenAvailable(ctx, apiKey) {
+    try {
+        ctx.inject(['credentials'], (cctx) => {
+            const seam = cctx.credentials;
+            if (seam?.set === undefined)
+                return;
+            void seam.set(PROXY_KEY_REF, apiKey).catch(() => undefined);
+        });
+    }
+    catch {
+        // 该 profile 没有 credentials 服务：provider 仍然注册，key 交由环境变量或手工配置。
+    }
+}
+/**
+ * Store the proxy api key in the DSH credential store and merge the
+ * provider profile into the `llm-pi-ai` settings namespace. Live applies.
+ */
+export async function registerProvider(ctx, baseURL, apiKey, modelIds) {
+    const serviceable = serviceableModels(modelIds);
+    if (serviceable.length === 0) {
+        throw new Error('no serviceable codex models to register');
+    }
+    const credentials = optionalCredentials(ctx);
+    let keyStored = false;
+    if (credentials?.set) {
+        await credentials.set(PROXY_KEY_REF, apiKey);
+        keyStored = true;
+    }
+    else {
+        // 0.2 严格注入：先不阻塞 provider 注册，等服务就绪后补写 key。
+        storeKeyWhenAvailable(ctx, apiKey);
+    }
+    const settings = ctx.settings;
+    if (settings?.update) {
+        await settings.update('llm-pi-ai', {
+            providers: { [PROVIDER_ROUTE]: buildProviderProfile(baseURL, serviceable) },
+        });
+    }
+    else {
+        throw new Error('DSH settings service unavailable; cannot register the codex provider');
+    }
+    return { registered: true, keyStored, models: serviceable };
+}

package/lib/types/host/services/codex-bridge/http.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, and each family's route
+ * module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-shared/host/http
+ */
+import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http';
+/**
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
+ */
+export declare function readBoundedJson(req: IncomingMessage, maxBytes: number): Promise<unknown>;
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export declare function readJsonBody(req: IncomingMessage, opts?: {
+    maxBytes?: number;
+    objectOnly?: boolean;
+}): Promise<unknown | null>;
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export declare function asJsonObject(value: unknown): Record<string, unknown> | undefined;
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export declare function writeJson(res: ServerResponse, status: number, body: unknown, headers?: OutgoingHttpHeaders): void;
+//# sourceMappingURL=http.d.ts.map

package/lib/types/host/services/codex-bridge/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/http.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAWrF;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBzB;AAOD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,mBAAwB,GAChC,IAAI,CAIN"}

package/lib/types/host/services/codex-bridge/http.js

@@ -0,0 +1,92 @@
+// Generated by scripts/sync-shared.mjs from shared/host/http.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, and each family's route
+ * module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-shared/host/http
+ */
+/** Default body cap for readJsonBody: 64 KiB. */
+const DEFAULT_JSON_BODY_MAX_BYTES = 64 * 1024;
+/** Family-default JSON response headers; callers may append or override. */
+const JSON_HEADERS = {
+    'content-type': 'application/json; charset=utf-8',
+    'referrer-policy': 'no-referrer',
+};
+/**
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
+ */
+export async function readBoundedJson(req, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > maxBytes)
+            throw new Error('body too large');
+        chunks.push(buffer);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export async function readJsonBody(req, opts = {}) {
+    const maxBytes = opts.maxBytes ?? DEFAULT_JSON_BODY_MAX_BYTES;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > maxBytes) {
+            req.destroy();
+            return null;
+        }
+        chunks.push(buffer);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text === '')
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        if (opts.objectOnly && !isJsonObject(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether a value is a JSON object: typeof object, not null, not an array. */
+function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export function asJsonObject(value) {
+    return isJsonObject(value) ? value : undefined;
+}
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export function writeJson(res, status, body, headers = {}) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, { ...JSON_HEADERS, ...headers });
+    res.end(payload);
+}

package/lib/types/host/services/codex-bridge/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * codex-bridge host 服务域（node 半区，按旧包原交互恢复）。
+ *
+ * The pre-merge @dsh-cove/dsh-codex-bridge plugin ran a host half inside the dsh
+ * web process: it spawns/adopts the standalone dsh-api-proxy service that
+ * turns the ChatGPT Codex login into an OpenAI-compatible API, checks the
+ * Codex CLI auth file, drives a device-code login when no valid credential
+ * exists, and automatically registers the proxy as a `llm-pi-ai` provider
+ * route so DSH can use codex models from the model picker. The browser half
+ * (src/client/settings/codex-bridge) renders the restored status/login card.
+ *
+ * Ported into the dsh-web-all host services with the import layout adapted:
+ * the `dsh-codex-bridge` settings namespace is owned by the
+ * settings-experiences service (schema identical to the old host Config), so
+ * the bridge reads its live document value at boot instead of installing a
+ * section of its own. The /api/dsh-codex-bridge route family, the bridge
+ * process management and the device-code flow keep the original envelopes
+ * and semantics; edits in the settings form take effect on the next harness
+ * restart, exactly like the old package.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Stable route prefix of the codex bridge capability. */
+export declare const CODEX_BRIDGE_API_PREFIX = "/api/dsh-codex-bridge";
+/** Settings namespace of this capability (owned by settings-experiences). */
+export declare const CODEX_BRIDGE_SETTINGS_NAMESPACE = "dsh-codex-bridge";
+/** Settings the bridge reads at boot (mirrors the old host Config). */
+export interface CodexBridgeServiceConfig {
+    /** Master switch. */
+    enabled?: boolean;
+    /**
+     * Directory containing the dsh-api-proxy npm project (dist/index.js +
+     * build/install scripts). Defaults to `$DSH_CODEX_PROXY_DIR`, then the
+     * assembler fallback, then `<cwd>/tools/dsh-api-proxy`.
+     */
+    proxyDir?: string;
+    /** Loopback bind address of the proxy service. */
+    host?: string;
+    /** Port of the proxy service. */
+    port?: number;
+    /** Codex CLI auth file the proxy reads and the login flow writes. */
+    authFile?: string;
+    /** Spawn/adopt the proxy and provision the DSH provider automatically. */
+    autoStart?: boolean;
+    /** Register the provider into `llm-pi-ai` once codex auth exists. */
+    autoRegister?: boolean;
+}
+/** Assembler-supplied seams. */
+export interface CodexBridgeServiceDeps {
+    /** Fallback proxy directory (used when no config/env value names one). */
+    proxyDir?: string;
+    logger?: {
+        warn(error: unknown): void;
+    };
+}
+/**
+ * 服务域注册入口：读取 dsh-codex-bridge 设置分区，挂载路由，并在存在有效
+ * codex 凭据时启动代理与 provider 注册（与旧包 apply 一致；设置改动重启生效）。
+ * @param ctx - host plugin context。
+ * @param deps - 装配器提供的回退目录与日志缝隙。
+ * @returns 统一 disposer。
+ */
+export declare function register(ctx: Context, deps?: CodexBridgeServiceDeps): () => void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/host/services/codex-bridge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAUlD,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,0BAA0B,CAAA;AAE9D,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,qBAAqB,CAAA;AAQjE,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC,qBAAqB;IACrB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,qEAAqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,gCAAgC;AAChC,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CACxC;AAoCD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,sBAA2B,GAAG,MAAM,IAAI,CAuCpF"}

package/lib/types/host/services/codex-bridge/index.js

@@ -0,0 +1,111 @@
+/**
+ * codex-bridge host 服务域（node 半区，按旧包原交互恢复）。
+ *
+ * The pre-merge @dsh-cove/dsh-codex-bridge plugin ran a host half inside the dsh
+ * web process: it spawns/adopts the standalone dsh-api-proxy service that
+ * turns the ChatGPT Codex login into an OpenAI-compatible API, checks the
+ * Codex CLI auth file, drives a device-code login when no valid credential
+ * exists, and automatically registers the proxy as a `llm-pi-ai` provider
+ * route so DSH can use codex models from the model picker. The browser half
+ * (src/client/settings/codex-bridge) renders the restored status/login card.
+ *
+ * Ported into the dsh-web-all host services with the import layout adapted:
+ * the `dsh-codex-bridge` settings namespace is owned by the
+ * settings-experiences service (schema identical to the old host Config), so
+ * the bridge reads its live document value at boot instead of installing a
+ * section of its own. The /api/dsh-codex-bridge route family, the bridge
+ * process management and the device-code flow keep the original envelopes
+ * and semantics; edits in the settings form take effect on the next harness
+ * restart, exactly like the old package.
+ */
+import { join } from 'node:path';
+import { familyNamespace } from "../family-config.js";
+import { ApiProxyBridge } from "./bridge.js";
+import { makeRoutes } from "./routes.js";
+import { checkCodexAuth } from "./codex-auth.js";
+import { registerProvider } from "./dsh-integration.js";
+import { registerResources } from "../resources.js";
+/** Stable route prefix of the codex bridge capability. */
+export const CODEX_BRIDGE_API_PREFIX = '/api/dsh-codex-bridge';
+/** Settings namespace of this capability (owned by settings-experiences). */
+export const CODEX_BRIDGE_SETTINGS_NAMESPACE = 'dsh-codex-bridge';
+/** Environment variable override for the proxy directory. */
+const PROXY_DIR_ENV = 'DSH_CODEX_PROXY_DIR';
+/** Default codex auth file location (the Codex CLI's own). */
+const DEFAULT_AUTH_FILE = '~/.codex/auth.json';
+/** Read the live `dsh-codex-bridge` namespace value, when served. */
+function liveConfig(ctx) {
+    void ctx;
+    return familyNamespace(CODEX_BRIDGE_SETTINGS_NAMESPACE);
+}
+/** Resolve the proxy directory in the old precedence: config, env, deps, cwd default. */
+function resolveProxyDir(config, deps) {
+    if (config.proxyDir)
+        return config.proxyDir;
+    const fromEnv = process.env[PROXY_DIR_ENV];
+    if (fromEnv)
+        return fromEnv;
+    if (deps.proxyDir)
+        return deps.proxyDir;
+    return join(process.cwd(), 'tools', 'dsh-api-proxy');
+}
+/**
+ * Provision the whole chain: ensure the proxy runs, and when codex auth is
+ * valid, register the provider into DSH.
+ */
+async function provision(bridge, ctx, autoRegister) {
+    await bridge.start();
+    if (!autoRegister)
+        return { started: true, registered: false, models: [] };
+    const models = await bridge.listModels();
+    if (models.length === 0) {
+        return { started: true, registered: false, models: [] };
+    }
+    await registerProvider(ctx, bridge.baseURL, bridge.apiKey(), models);
+    return { started: true, registered: true, models };
+}
+/**
+ * 服务域注册入口：读取 dsh-codex-bridge 设置分区，挂载路由，并在存在有效
+ * codex 凭据时启动代理与 provider 注册（与旧包 apply 一致；设置改动重启生效）。
+ * @param ctx - host plugin context。
+ * @param deps - 装配器提供的回退目录与日志缝隙。
+ * @returns 统一 disposer。
+ */
+export function register(ctx, deps = {}) {
+    const warn = deps.logger?.warn ?? ((error) => console.warn('[web-all:codex-bridge]', error));
+    const config = liveConfig(ctx) ?? {};
+    if (config.enabled === false)
+        return () => { };
+    const authFile = config.authFile ?? DEFAULT_AUTH_FILE;
+    const autoRegister = config.autoRegister ?? true;
+    const bridge = new ApiProxyBridge({
+        proxyDir: resolveProxyDir(config, deps),
+        host: config.host ?? '127.0.0.1',
+        port: config.port ?? 8317,
+        authFile,
+    });
+    const onLoginComplete = async () => {
+        try {
+            await provision(bridge, ctx, autoRegister);
+        }
+        catch (error) {
+            warn(error);
+        }
+    };
+    return registerResources(own => {
+        own(() => { bridge.stop(); });
+        const routes = makeRoutes({ bridge, ctx, authFile, autoRegister, onLoginComplete });
+        for (const route of routes)
+            own(ctx.webServer.register(route));
+        // Boot-time provisioning: no codex credential means no point starting the
+        // proxy — the settings card offers the device-code login instead.
+        if (config.autoStart ?? true) {
+            const auth = checkCodexAuth(authFile);
+            if (auth.valid) {
+                void provision(bridge, ctx, autoRegister).catch((error) => {
+                    warn(error);
+                });
+            }
+        }
+    });
+}

package/lib/types/host/services/codex-bridge/loopback.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-shared/host/loopback
+ */
+import type { IncomingMessage } from 'node:http';
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export declare function isIPv4Loopback(v4: string): boolean;
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export declare function isLoopbackRequest(request: IncomingMessage): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/lib/types/host/services/codex-bridge/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/loopback.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAKlD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMtE;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAmBnE"}

package/lib/types/host/services/codex-bridge/loopback.js

@@ -0,0 +1,68 @@
+// Generated by scripts/sync-shared.mjs from shared/host/loopback.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-shared/host/loopback
+ */
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export function isIPv4Loopback(v4) {
+    const parts = v4.split('.');
+    return parts.length === 4
+        && parts[0] === '127'
+        && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address) {
+    if (address === undefined)
+        return false;
+    const normalized = address.toLowerCase();
+    if (normalized === '::1')
+        return true;
+    if (normalized.startsWith('::ffff:'))
+        return isIPv4Loopback(normalized.slice('::ffff:'.length));
+    return isIPv4Loopback(normalized);
+}
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '[::1]')
+        return true;
+    return isIPv4Loopback(hostname);
+}
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export function isLoopbackRequest(request) {
+    if (!isLoopbackAddress(request.socket.remoteAddress))
+        return false;
+    const host = request.headers.host;
+    if (typeof host !== 'string')
+        return false;
+    let hostUrl;
+    try {
+        hostUrl = new URL('http://' + host);
+    }
+    catch {
+        return false;
+    }
+    if (!isLoopbackHostname(hostUrl.hostname))
+        return false;
+    if (request.headers['sec-fetch-site'] === 'cross-site')
+        return false;
+    const origin = request.headers.origin;
+    if (origin === undefined)
+        return true;
+    try {
+        return new URL(origin).host === hostUrl.host;
+    }
+    catch {
+        return false;
+    }
+}

package/lib/types/host/services/codex-bridge/routes.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The /api/dsh-codex-bridge route family: bridge status, device-code login
+ * lifecycle, proxy restart, and chain verification. Every route carries the
+ * shared loopback-only trust fence (plus browser same-origin markers) — the
+ * device login and proxy control are local operations and must never be
+ * served to LAN-exposed dsh web deployments.
+ *
+ * The fence is the generated copy of `shared/host/loopback.ts` (synced by
+ * `node scripts/sync-shared.mjs`, checked by `pnpm test:scripts`), so this
+ * family applies exactly the shared strict rule.
+ *
+ * This is a host-only control surface: the browser half of this package has no
+ * consumer for it, and the envelopes stay byte-for-byte compatible with the
+ * pre-merge `@dsh-cove/dsh-codex-bridge` responses for external callers.
+ */
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import type { ApiProxyBridge } from './bridge.ts';
+import type { Context } from '@deepseek-ai/cordis';
+export interface BridgeRoutesDeps {
+    bridge: ApiProxyBridge;
+    /** Host context used for DSH provider registration. */
+    ctx: Context;
+    /** Path of the codex auth file (status only; login writes through the bridge). */
+    authFile: string;
+    /** Whether automatic DSH registration is enabled. */
+    autoRegister: boolean;
+    /** Re-run automatic registration after a successful login. */
+    onLoginComplete?: () => Promise<void>;
+}
+export declare function makeRoutes(deps: BridgeRoutesDeps): WebRoute[];
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/host/services/codex-bridge/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAI/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,uDAAuD;IACvD,GAAG,EAAE,OAAO,CAAA;IACZ,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,YAAY,EAAE,OAAO,CAAA;IACrB,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAWD,wBAAgB,UAAU,CAAC,IAAI,EAAE,gBAAgB,GAAG,QAAQ,EAAE,CAgG7D"}