@eddyskywalker/dsh-chatgpt-subscription 0.1.4 → 0.1.6

package/lib/index.js

@@ -1,6 +1,8 @@
 import { CallId, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import http from "node:http";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, stat, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -122,6 +124,141 @@ var CodexChatGptAdapter = class extends LlmAdapter {
 	}
 };
 //#endregion
+//#region src/host/subagent-report-scheduling-compat.ts
+/**
+* DSH_COMPAT_REMOVE(subagent-report-settlement-dedup)
+*
+* Temporary compatibility shim for DSH 0.1.0-rc.6. A continuable child is told
+* to report its result before finishing, while DSH also unconditionally sends
+* the same closing output in a `subagent-settled` notice. The report is often
+* still queued when the settlement reaches the parent, so the parent sees the
+* result once and the equivalent report remains as duplicate next-turn work.
+*
+* Remove this module, its installation in `src/index.ts`, and its focused test
+* once upstream coalesces an equivalent final report with settlement delivery.
+*/
+const DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER = "__dshChatgptSubscriptionSubagentReportDedupCompatV1";
+function sourceOf(message) {
+	return message.source;
+}
+function isTextBlock(value, text) {
+	return typeof value === "object" && value !== null && value.type === "text" && value.text === text;
+}
+function sameValue(left, right) {
+	if (left === right) return true;
+	if (Array.isArray(left) || Array.isArray(right)) return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((value, index) => sameValue(value, right[index]));
+	if (typeof left !== "object" || left === null || typeof right !== "object" || right === null) return false;
+	const leftRecord = left;
+	const rightRecord = right;
+	const leftKeys = Object.keys(leftRecord).sort();
+	const rightKeys = Object.keys(rightRecord).sort();
+	return leftKeys.length === rightKeys.length && leftKeys.every((key, index) => key === rightKeys[index] && sameValue(leftRecord[key], rightRecord[key]));
+}
+function duplicatePendingReports(agent, settlement) {
+	const settlementSource = sourceOf(settlement);
+	if (settlementSource.kind !== "subagent-settled" || settlementSource.senderSessionId === void 0) return [];
+	if (settlement.content.length < 2 || !isTextBlock(settlement.content[1], "Its closing message:")) return [];
+	const closingContent = settlement.content.slice(2);
+	return [...agent.inbox.nextStep, ...agent.inbox.nextTurn].filter((pending) => {
+		const pendingSource = sourceOf(pending);
+		return pendingSource.kind === "subagent-report" && pendingSource.senderSessionId === settlementSource.senderSessionId && sameValue(pending.content.slice(1), closingContent);
+	});
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Discard only an exact, same-child report duplicate immediately before DSH
+* delivers the corresponding settlement notice. Partial reports, reports with
+* different content, and all unrelated inbox work remain untouched.
+*/
+function installSubagentReportDedupCompat(ctx) {
+	const patches = /* @__PURE__ */ new Map();
+	const patch = (agent) => {
+		if (patches.has(agent)) return;
+		const shared = agent.followup[DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER];
+		if (shared?.wrappers.followup === agent.followup && shared.wrappers.steer === agent.steer && shared.wrappers.inject === agent.inject) {
+			shared.owners += 1;
+			patches.set(agent, shared);
+			return;
+		}
+		const originals = {
+			followup: agent.followup,
+			steer: agent.steer,
+			inject: agent.inject
+		};
+		let record;
+		const deliver = (name, message) => {
+			for (const duplicate of duplicatePendingReports(agent, message)) try {
+				agent.inbox.remove(duplicate.id);
+			} catch (error) {
+				ctx.logger.warn("[dsh-chatgpt-subscription] Could not discard a duplicate DSH subagent report: " + errorMessage(error));
+			}
+			originals[name].call(agent, message);
+		};
+		const wrappers = {
+			followup(message) {
+				deliver("followup", message);
+			},
+			steer(message) {
+				deliver("steer", message);
+			},
+			inject(message) {
+				deliver("inject", message);
+			}
+		};
+		record = {
+			originals,
+			wrappers,
+			owners: 1
+		};
+		for (const wrapper of Object.values(wrappers)) Object.defineProperty(wrapper, DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER, { value: record });
+		try {
+			agent.followup = wrappers.followup;
+			agent.steer = wrappers.steer;
+			agent.inject = wrappers.inject;
+			patches.set(agent, record);
+		} catch (error) {
+			record.owners = 0;
+			for (const name of [
+				"followup",
+				"steer",
+				"inject"
+			]) if (agent[name] === wrappers[name]) try {
+				agent[name] = originals[name];
+			} catch {}
+			ctx.logger.warn("[dsh-chatgpt-subscription] Could not install temporary DSH subagent dedup compatibility: " + errorMessage(error));
+		}
+	};
+	const unpatch = (agent) => {
+		const record = patches.get(agent);
+		if (!record) return;
+		patches.delete(agent);
+		record.owners -= 1;
+		if (record.owners > 0) return;
+		for (const name of [
+			"followup",
+			"steer",
+			"inject"
+		]) {
+			if (agent[name] !== record.wrappers[name]) continue;
+			try {
+				agent[name] = record.originals[name];
+			} catch (error) {
+				ctx.logger.warn("[dsh-chatgpt-subscription] Could not remove temporary DSH subagent dedup compatibility: " + errorMessage(error));
+			}
+		}
+	};
+	for (const agent of ctx.agents.list()) patch(agent);
+	const disposeCreated = ctx.on("agent/created", ({ agent }) => patch(agent));
+	const disposeDisposed = ctx.on("agent/disposed", ({ agent }) => unpatch(agent));
+	return () => {
+		disposeDisposed();
+		disposeCreated();
+		for (const agent of [...patches.keys()]) unpatch(agent);
+	};
+}
+//#endregion
 //#region src/compat.ts
 /**
 * Compatibility constants for the ChatGPT-backed Codex flow. The backend and
@@ -293,13 +430,16 @@ var OAuthService = class {
 			return this.statusFromCredentials(credentials);
 		} catch {
 			return {
-				...this.statusFromCredentials(null),
+				...this.statusFromCredentials(null, false),
 				error: publicError(new OAuthServiceError("storage-failed", "Secure credential storage could not be read."))
 			};
 		}
 	}
 	async startLogin() {
 		this.assertAvailable();
+		await this.store.load().catch(() => {
+			throw new OAuthServiceError("storage-failed", "Secure credential storage is unavailable. Fix its ownership or permissions before signing in.");
+		});
 		if (this.activeLogin !== null) throw new OAuthServiceError("login-active", "A ChatGPT sign-in is already in progress.");
 		this.lastLoginError = void 0;
 		const loginId = this.random(24).toString("base64url");
@@ -452,14 +592,14 @@ var OAuthService = class {
 		if (stored === null) throw new OAuthServiceError("not-authenticated", "Sign in with ChatGPT first.");
 		return stored;
 	}
-	statusFromCredentials(credentials) {
+	statusFromCredentials(credentials, storageAvailable = true) {
 		const active = this.activeLogin;
 		if (credentials === null) return {
 			authenticated: false,
 			account: null,
 			storage: {
-				kind: "windows-dpapi",
-				encrypted: true
+				...this.store.storage,
+				available: storageAvailable
 			},
 			login: {
 				active: active !== null,
@@ -478,8 +618,8 @@ var OAuthService = class {
 				tokenExpiresAt: Math.floor(credentials.expiresAt / 1e3)
 			},
 			storage: {
-				kind: "windows-dpapi",
-				encrypted: true
+				...this.store.storage,
+				available: storageAvailable
 			},
 			login: {
 				active: active !== null,
@@ -718,7 +858,7 @@ async function buildResponsesPayload(options, attachments, localRawImages = {})
 }
 function runCodeInstruction(tools) {
 	if (!tools?.some((tool) => tool.name === "run_code")) return void 0;
-	return "run_code compatibility rule: its code is parsed as strict JavaScript/TypeScript before execution. On Windows, do not embed PowerShell containing $, ${...}, backslashes, or here-strings in JavaScript template literals; String.raw does not disable ${...} interpolation. Prefer arrays of ordinary quoted strings joined with \"\\n\", escaping backslashes, or use a file-write tool for large scripts and then invoke pwsh.";
+	return "run_code compatibility rule: its code is parsed as strict JavaScript/TypeScript before execution. Shell commands are nested string data: JavaScript template literals may consume ${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them. On Windows, avoid embedding PowerShell containing $, ${...}, backslashes, or here-strings in template literals; String.raw does not disable ${...} interpolation. On Linux, prefer ordinary quoted strings or write a script file before invoking bash/sh, especially for commands containing backticks or ${...}. Prefer arrays of ordinary quoted strings joined with \"\\n\", escaping backslashes, or use a file-write tool for large scripts.";
 }
 function localRawImageInstruction(stats) {
 	if (stats.failed === 0) return void 0;
@@ -728,18 +868,25 @@ function supportsImageInput(options) {
 	return options.provider === "codex-chatgpt" && options.model.toLowerCase().startsWith("gpt-");
 }
 function toolDescriptionForCodex(name, description) {
-	if (name === "run_code") return `${description}\n\nCompatibility: code is strict JavaScript/TypeScript. When composing PowerShell, avoid JavaScript template literals containing $, \${...}, Windows backslashes, or PowerShell here-strings. Prefer ordinary quoted string arrays joined with "\\n", or write a script file with a dedicated file tool before invoking pwsh.`;
+	if (name === "run_code") return `${description}\n\nCompatibility: code is strict JavaScript/TypeScript and nested shell commands are string data. Template literals may consume \${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them. Prefer ordinary quoted string arrays joined with "\\n", or write a script file with a dedicated file tool before invoking the shell.`;
 	if (isCommandTool(name)) return `${description}\n\n${commandToolCompatibilityText(name)}`;
 	return description;
 }
 function commandToolInstruction(tools) {
 	const names = tools?.filter((tool) => isCommandTool(tool.name)).map((tool) => tool.name);
 	if (!names?.length) return void 0;
-	return `Command tool compatibility rule (${[...new Set(names)].join(", ")}): each command call runs in a fresh process, so do not rely on cd, aliases, functions, or variables from previous calls; set workdir when the tool supports it. On Windows/pwsh, keep commands in native PowerShell syntax and native Windows paths. For deletion or move operations, first resolve and verify exact absolute target paths, then operate on those literal paths only; avoid dynamically deleting paths built from $HOME, wildcards, command substitution, or another shell's output. Treat [auto-mode hard deny] and similar policy denials as non-retriable; choose a safer non-destructive inspection or report the limitation instead of repeating the same command or adding sandbox escalation. If downloads fail with TLS credential or connection-closed errors, treat that as an environment/network failure and use local sources or report the limitation instead of cycling through equivalent download commands.`;
+	const uniqueNames = [...new Set(names)];
+	const normalized = uniqueNames.map((name) => name.toLowerCase());
+	const shellGuidance = [
+		normalized.some((name) => name === "pwsh" || name.includes("powershell")) ? "For pwsh/PowerShell, use native PowerShell syntax and native Windows paths." : void 0,
+		normalized.includes("bash") ? "For bash, use native POSIX paths and Bash syntax in a fresh non-interactive process." : void 0,
+		normalized.some((name) => name === "sh" || name === "shell") ? "For sh/generic shell, prefer portable POSIX syntax and avoid Bash-only arrays, [[ ... ]], process substitution, and source." : void 0
+	].filter((value) => value !== void 0).join(" ");
+	return `Command tool compatibility rule (${uniqueNames.join(", ")}): each command call runs in a fresh process, so do not rely on cd, aliases, functions, or variables from previous calls; set workdir when the tool supports it. ${shellGuidance} For deletion or move operations, first resolve and verify exact absolute target paths, then operate on those literal paths only; avoid dynamically deleting paths built from home-directory expansion, wildcards, command substitution, or another shell's output. Treat [auto-mode hard deny] and similar policy denials as non-retriable; choose a safer non-destructive inspection or report the limitation instead of repeating the same command or adding sandbox escalation. If downloads fail with TLS credential or connection-closed errors, treat that as an environment/network failure and use local sources or report the limitation instead of cycling through equivalent download commands.`;
 }
 function commandToolCompatibilityText(name) {
 	const shell = name.toLowerCase();
-	return `Compatibility: command execution is stateless between calls.${shell === "pwsh" || shell.includes("powershell") ? " Use native PowerShell syntax and native Windows paths; prefer workdir over cd because every call starts a fresh process." : " Prefer workdir over cd because every call starts a fresh process."} For destructive operations, verify exact absolute targets first and use literal paths; policy hard-deny results require a safer command shape, not sandbox escalation.`;
+	return `Compatibility: command execution is stateless between calls.${shell === "pwsh" || shell.includes("powershell") ? " Use native PowerShell syntax and native Windows paths." : shell === "bash" ? " Use Bash syntax and native POSIX paths." : " Use portable POSIX syntax and native POSIX paths; avoid Bash-only arrays, [[ ... ]], process substitution, and source."} Prefer workdir over cd because every call starts a fresh process. For destructive operations, verify exact absolute targets first and use literal paths; policy hard-deny results require a safer command shape, not sandbox escalation.`;
 }
 function sandboxToolInstruction(tools, sandboxRetryTools) {
 	if (!tools?.some((tool) => hasSandboxControls(tool.parameters))) return void 0;
@@ -761,7 +908,7 @@ function toolParametersForCodex(toolName, parameters, allowSandboxRetry) {
 		const code = record$2(properties.code);
 		if (code !== null) {
 			const current = typeof code.description === "string" ? code.description.trim() : "";
-			const compatibility = "Strict JavaScript/TypeScript source. For PowerShell on Windows, avoid JavaScript template literals containing $, ${...}, backslashes, or here-strings; String.raw still performs ${...} interpolation. Prefer ordinary quoted string arrays joined with \"\\n\" and escape backslashes, or write a script file with a dedicated file tool.";
+			const compatibility = "Strict JavaScript/TypeScript source. Nested shell commands are string data: template literals may consume ${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them; String.raw still performs ${...} interpolation. Prefer ordinary quoted string arrays joined with \"\\n\", or write a script file with a dedicated file tool.";
 			code.description = current ? `${current}\n\n${compatibility}` : compatibility;
 		}
 	}
@@ -784,7 +931,7 @@ function appendPropertyDescription(value, addition) {
 }
 function isCommandTool(name) {
 	const normalized = name.toLowerCase();
-	return normalized === "pwsh" || normalized === "powershell" || normalized === "bash" || normalized === "shell";
+	return normalized === "pwsh" || normalized === "powershell" || normalized === "bash" || normalized === "sh" || normalized === "shell";
 }
 function hasSandboxControls(parameters) {
 	const properties = record$2(parameters.properties);
@@ -828,7 +975,7 @@ function appendMissingToolCalls(input, knownToolCalls, message) {
 }
 function runCodeErrorOutput(output) {
 	if (!isRunCodeParserError(output)) return output;
-	return `${output}\n\nCompatibility hint: run_code failed while parsing strict JavaScript/TypeScript, before the nested tool ran. Avoid JavaScript template literals for PowerShell containing $, \${...}, Windows backslashes, or here-strings; String.raw does not prevent \${...} interpolation. Build the script from ordinary quoted strings joined with "\\n" (escaping backslashes), or write a script file with a dedicated file tool and then invoke pwsh.`;
+	return `${output}\n\nCompatibility hint: run_code failed while parsing strict JavaScript/TypeScript, before the nested tool ran. Shell commands are nested string data; template literals can consume \${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them, and String.raw does not prevent \${...} interpolation. Build the script from ordinary quoted strings joined with "\\n", or write a script file with a dedicated file tool and then invoke the shell.`;
 }
 function isRunCodeParserError(output) {
 	return /(?:Legacy octal escape is not permitted in strict mode|Unexpected token|Invalid or unexpected token|Unterminated template|Expected ['"]?\}['"]?)/i.test(output);
@@ -1833,6 +1980,100 @@ function parseStoredCredentials(value) {
 	};
 }
 //#endregion
+//#region src/host/token-store-linux.ts
+const DIRECTORY_MODE = 448;
+const FILE_MODE = 384;
+function defaultLinuxCredentialPath() {
+	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "storages", "dsh-chatgpt-subscription", "oauth.json");
+}
+/**
+* Linux credential storage protected by owner-only filesystem permissions.
+* The payload is not encrypted at rest, so callers must report that distinction
+* instead of presenting this store as equivalent to Windows DPAPI.
+*/
+var LinuxFileTokenStore = class {
+	path;
+	storage = {
+		kind: "linux-file",
+		encrypted: false
+	};
+	noFollow = constants.O_NOFOLLOW;
+	constructor(path = defaultLinuxCredentialPath()) {
+		this.path = path;
+		if (process.platform !== "linux") throw new Error("Linux credential storage requires Linux");
+		if (this.noFollow === void 0) throw new Error("Linux credential storage requires O_NOFOLLOW support");
+		if (dirname(path) === path) throw new Error("invalid Linux credential path");
+	}
+	async load() {
+		let handle;
+		try {
+			handle = await open(this.path, constants.O_RDONLY | this.noFollow);
+		} catch (error) {
+			if (isMissing(error)) return null;
+			throw new Error("Linux credential read failed", { cause: error });
+		}
+		try {
+			const stats = await handle.stat();
+			if (!stats.isFile()) throw new Error("credential path is not a regular file");
+			if (typeof process.getuid === "function" && stats.uid !== process.getuid()) throw new Error("credential file is owned by another user");
+			if ((stats.mode & 511) !== FILE_MODE) throw new Error("credential file permissions must be 0600");
+			const payload = await handle.readFile({ encoding: "utf8" });
+			return parseStoredCredentials(JSON.parse(payload));
+		} catch (error) {
+			throw new Error("Linux credential payload is invalid or insecure", { cause: error });
+		} finally {
+			await handle.close();
+		}
+	}
+	async save(value) {
+		const directory = dirname(this.path);
+		const temporary = `${this.path}.tmp-${randomUUID()}`;
+		try {
+			const existing = await lstat(this.path);
+			if (existing.isSymbolicLink() || !existing.isFile()) throw new Error("credential path is not a regular file");
+			assertOwnedByCurrentUser(existing.uid, "credential file");
+		} catch (error) {
+			if (!isMissing(error)) throw new Error("Linux credential write failed", { cause: error });
+		}
+		await mkdir(directory, {
+			recursive: true,
+			mode: DIRECTORY_MODE
+		});
+		const directoryStats = await stat(directory);
+		if (!directoryStats.isDirectory()) throw new Error("Linux credential directory is invalid");
+		assertOwnedByCurrentUser(directoryStats.uid, "credential directory");
+		await chmod(directory, DIRECTORY_MODE);
+		let handle;
+		try {
+			handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, FILE_MODE);
+			await handle.writeFile(JSON.stringify(value), { encoding: "utf8" });
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			await rename(temporary, this.path);
+			await chmod(this.path, FILE_MODE);
+		} catch (error) {
+			await handle?.close().catch(() => void 0);
+			await unlink(temporary).catch(() => void 0);
+			throw new Error("Linux credential write failed", { cause: error });
+		}
+	}
+	async clear() {
+		try {
+			await unlink(this.path);
+		} catch (error) {
+			if (isMissing(error)) return;
+			throw new Error("Linux credential deletion failed", { cause: error });
+		}
+	}
+};
+function assertOwnedByCurrentUser(owner, label) {
+	if (typeof process.getuid === "function" && owner !== process.getuid()) throw new Error(`${label} is owned by another user`);
+}
+function isMissing(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+//#endregion
 //#region src/host/token-store-windows.ts
 const PROTECT_SCRIPT = String.raw`
 $ErrorActionPreference = 'Stop'
@@ -1866,6 +2107,10 @@ function defaultDpapiCredentialPath() {
 }
 var WindowsDpapiTokenStore = class {
 	path;
+	storage = {
+		kind: "windows-dpapi",
+		encrypted: true
+	};
 	constructor(path = defaultDpapiCredentialPath()) {
 		this.path = path;
 		if (process.platform !== "win32") throw new Error("Windows DPAPI storage requires Windows");
@@ -1938,14 +2183,22 @@ function runPowerShell(script, path, stdin) {
 	});
 }
 //#endregion
+//#region src/host/platform-token-store.ts
+function createPlatformTokenStore(platform = process.platform) {
+	if (platform === "win32") return new WindowsDpapiTokenStore();
+	if (platform === "linux") return new LinuxFileTokenStore();
+	throw new Error(`Unsupported platform ${platform}; dsh-chatgpt-subscription supports Windows and Linux.`);
+}
+//#endregion
 //#region src/index.ts
 const inject = [
 	"webServer",
 	"llm",
-	"attachments"
+	"attachments",
+	"agents"
 ];
 function apply(ctx) {
-	const oauth = new OAuthService(new WindowsDpapiTokenStore(), { logger: ctx.logger });
+	const oauth = new OAuthService(createPlatformTokenStore(), { logger: ctx.logger });
 	const usage = new UsageService(oauth);
 	const adapter = new CodexChatGptAdapter(new ResponsesClient(oauth, ctx.attachments, {
 		localRawImages: { baseUrl: localWebServerBaseUrl(ctx.webServer.host, ctx.webServer.port) },
@@ -1954,7 +2207,9 @@ function apply(ctx) {
 	ctx.effect(() => {
 		const disposeRoutes = registerRoutes(ctx, oauth, usage);
 		const disposeAdapter = ctx.llm.registerAdapter([PROVIDER_ID], adapter);
+		const disposeSubagentReportCompat = installSubagentReportDedupCompat(ctx);
 		return () => {
+			disposeSubagentReportCompat();
 			disposeAdapter();
 			disposeRoutes();
 			oauth.dispose();
@@ -1965,4 +2220,4 @@ function localWebServerBaseUrl(host, port) {
 	return `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${port}`;
 }
 //#endregion
-export { CodexChatGptAdapter, OAuthService, ResponsesClient, UsageService, apply, inject, mapCodexUsage, parseResponsesStream };
+export { CodexChatGptAdapter, LinuxFileTokenStore, OAuthService, ResponsesClient, UsageService, WindowsDpapiTokenStore, apply, createPlatformTokenStore, inject, mapCodexUsage, parseResponsesStream };

package/lib/types/client/CodexSubscriptionSection.d.ts

@@ -1,9 +1,11 @@
 import type { PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
-import type { QuotaWindowDto } from '../shared/contracts.ts';
+import type { CredentialStorageDto, QuotaWindowDto } from '../shared/contracts.ts';
 import { NS } from './locales.ts';
 type Props = PropsRuntime<'settings.section'> & PropsLocale<typeof NS>;
 type Translate = Props['t'];
 export declare function CodexSubscriptionSection({ t }: Props): React.JSX.Element;
+export declare function storageLabel(storage: CredentialStorageDto | undefined, t: Translate): string;
+export declare function storageNotice(storage: CredentialStorageDto | undefined, t: Translate): string;
 export declare function QuotaBar({ label, window, t }: {
     label: string;
     window: QuotaWindowDto;

package/lib/types/client/CodexSubscriptionSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CodexSubscriptionSection.d.ts","sourceRoot":"","sources":["../../../src/client/CodexSubscriptionSection.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACjF,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE7F,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAEjC,KAAK,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;AAEtE,KAAK,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;AAI3B,wBAAgB,wBAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAoMxE;AAyBD,wBAAgB,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAczH;AAMD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAQxE;AAWD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUnD"}
+{"version":3,"file":"CodexSubscriptionSection.d.ts","sourceRoot":"","sources":["../../../src/client/CodexSubscriptionSection.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAmC,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEnH,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAEjC,KAAK,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;AAEtE,KAAK,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;AAI3B,wBAAgB,wBAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAoMxE;AAiBD,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAM5F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAM7F;AAUD,wBAAgB,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAczH;AAMD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAQxE;AAWD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUnD"}

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAI/D,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0BAA0B,EAAE,SAAS,CAAA;KACtC;CACF;AAED,eAAO,MAAM,MAAM,UAAsB,CAAA;AAEzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAW9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAG/D,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0BAA0B,EAAE,SAAS,CAAA;KACtC;CACF;AAED,eAAO,MAAM,MAAM,UAAsB,CAAA;AAEzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAU9C"}

package/lib/types/client/locales.d.ts

@@ -9,8 +9,14 @@ export declare const zh: {
     readonly accountId: "账号 ID";
     readonly expires: "令牌到期";
     readonly storage: "凭据存储";
-    readonly storageValue: "Windows DPAPI（当前用户加密）";
-    readonly securityNotice: "令牌仅保存在 Host 端的 DPAPI 加密文件中，不会进入浏览器、settings.yaml 或日志。";
+    readonly storageWindows: "Windows DPAPI（当前用户加密）";
+    readonly storageLinuxFile: "Linux 用户私有文件（权限 0600）";
+    readonly storageMemory: "仅 Host 内存（不持久化）";
+    readonly storageUnavailable: "凭据存储不可用";
+    readonly securityWindows: "令牌 Windows CurrentUser DPAPI 加密。";
+    readonly securityLinuxFile: "令牌仅写入 Host 上当前 Linux 用户可读的 0600 文件。";
+    readonly securityMemory: "令牌仅保留在 Host 内存中，Host 退出后丢失。";
+    readonly securityUnavailable: "Host 无法安全访问凭据存储；请修复文件所有者或权限后重试。";
     readonly signIn: "使用 ChatGPT 登录";
     readonly signInAgain: "重新登录";
     readonly cancel: "取消登录";
@@ -60,8 +66,14 @@ export declare const dictionaries: {
         readonly accountId: "账号 ID";
         readonly expires: "令牌到期";
         readonly storage: "凭据存储";
-        readonly storageValue: "Windows DPAPI（当前用户加密）";
-        readonly securityNotice: "令牌仅保存在 Host 端的 DPAPI 加密文件中，不会进入浏览器、settings.yaml 或日志。";
+        readonly storageWindows: "Windows DPAPI（当前用户加密）";
+        readonly storageLinuxFile: "Linux 用户私有文件（权限 0600）";
+        readonly storageMemory: "仅 Host 内存（不持久化）";
+        readonly storageUnavailable: "凭据存储不可用";
+        readonly securityWindows: "令牌由 Host 使用 Windows CurrentUser DPAPI 加密，不会进入浏览器、settings.yaml 或日志。";
+        readonly securityLinuxFile: "令牌仅写入 Host 上当前 Linux 用户可读的 0600 文件，但不会额外加密；同 UID 进程、root、备份和磁盘快照仍可能读取。";
+        readonly securityMemory: "令牌仅保留在 Host 内存中，Host 退出后丢失。";
+        readonly securityUnavailable: "Host 无法安全访问凭据存储；请修复文件所有者或权限后重试。";
         readonly signIn: "使用 ChatGPT 登录";
         readonly signInAgain: "重新登录";
         readonly cancel: "取消登录";
@@ -98,6 +110,6 @@ export declare const dictionaries: {
         readonly retry: "重试";
         readonly unknown: "未知";
     };
-    en: Record<"title" | "intro" | "account" | "signedOut" | "signedIn" | "plan" | "accountId" | "expires" | "storage" | "storageValue" | "securityNotice" | "signIn" | "signInAgain" | "cancel" | "signOut" | "refreshToken" | "pending" | "popupBlocked" | "continueLogin" | "loading" | "connection" | "provider" | "connectionState" | "connected" | "untested" | "testConnection" | "testing" | "latency" | "models" | "quota" | "quotaIntro" | "refreshQuota" | "refreshing" | "noQuota" | "quotaSignedOut" | "stale" | "updated" | "primary" | "secondary" | "limitWindow" | "used" | "remaining" | "exhausted" | "resets" | "retry" | "unknown", string>;
+    en: Record<"quota" | "account" | "storage" | "stale" | "pending" | "title" | "intro" | "signedOut" | "signedIn" | "plan" | "accountId" | "expires" | "storageWindows" | "storageLinuxFile" | "storageMemory" | "storageUnavailable" | "securityWindows" | "securityLinuxFile" | "securityMemory" | "securityUnavailable" | "signIn" | "signInAgain" | "cancel" | "signOut" | "refreshToken" | "popupBlocked" | "continueLogin" | "loading" | "connection" | "provider" | "connectionState" | "connected" | "untested" | "testConnection" | "testing" | "latency" | "models" | "quotaIntro" | "refreshQuota" | "refreshing" | "noQuota" | "quotaSignedOut" | "updated" | "primary" | "secondary" | "limitWindow" | "used" | "remaining" | "exhausted" | "resets" | "retry" | "unknown", string>;
 };
 //# sourceMappingURL=locales.d.ts.map

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE,EAAG,0BAAmC,CAAA;AAErD,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CL,CAAA;AAEV,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,CA+C9C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AACvC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE,EAAG,0BAAmC,CAAA;AAErD,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDL,CAAA;AAEV,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,CAqD9C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AACvC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAA"}

package/lib/types/client/styles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../src/client/styles.ts"],"names":[],"mappings":"AAwDA,wBAAgB,aAAa,IAAI,MAAM,IAAI,CAQ1C"}
+{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../src/client/styles.ts"],"names":[],"mappings":"AAiDA,wBAAgB,aAAa,IAAI,MAAM,IAAI,CAQ1C"}

package/lib/types/host/oauth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../../../src/host/oauth-service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACf,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE1E,KAAK,SAAS,GAAG,OAAO,KAAK,CAAA;AAC7B,KAAK,aAAa,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;AASnD,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACvC,6BAA6B,CAAC,EAAE;QAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAA;QAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACxC,CAAA;CACF;AASD,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC;gBAA5B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;CAInE;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACjC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;IACvC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,YAAY;IAaX,OAAO,CAAC,QAAQ,CAAC,KAAK;IAZlC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAQ;gBAEK,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,mBAAwB;IAQ3E,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC;IAYjC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAoC1C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAOlC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI;IAgBlE,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IAOlC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAWvB,WAAW,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQxE,OAAO,IAAI,IAAI;YAUD,YAAY;IA0B1B,OAAO,CAAC,kBAAkB;YAQZ,cAAc;YA8Bd,iBAAiB;IAQ/B,OAAO,CAAC,qBAAqB;IAkC7B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,eAAe;CAGxB;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe7E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAUjF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAE,cAAc,CAAC,MAAM,CAAc,GAAG,cAAc,CAGzG"}
+{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../../../src/host/oauth-service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACf,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE1E,KAAK,SAAS,GAAG,OAAO,KAAK,CAAA;AAC7B,KAAK,aAAa,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;AASnD,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACvC,6BAA6B,CAAC,EAAE;QAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAA;QAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACxC,CAAA;CACF;AASD,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC;gBAA5B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;CAInE;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACjC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;IACvC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,YAAY;IAaX,OAAO,CAAC,QAAQ,CAAC,KAAK;IAZlC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAQ;gBAEK,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,mBAAwB;IAQ3E,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC;IAYjC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAuC1C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAOlC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI;IAgBlE,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IAOlC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAWvB,WAAW,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQxE,OAAO,IAAI,IAAI;YAUD,YAAY;IA0B1B,OAAO,CAAC,kBAAkB;YAQZ,cAAc;YA8Bd,iBAAiB;IAQ/B,OAAO,CAAC,qBAAqB;IAkC7B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,eAAe;CAGxB;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe7E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAUjF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAE,cAAc,CAAC,MAAM,CAAc,GAAG,cAAc,CAGzG"}

package/lib/types/host/platform-token-store.d.ts

@@ -0,0 +1,3 @@
+import type { TokenStore } from './token-store.ts';
+export declare function createPlatformTokenStore(platform?: NodeJS.Platform): TokenStore;
+//# sourceMappingURL=platform-token-store.d.ts.map

package/lib/types/host/platform-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-token-store.d.ts","sourceRoot":"","sources":["../../../src/host/platform-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAIlD,wBAAgB,wBAAwB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,UAAU,CAIjG"}

package/lib/types/host/subagent-report-scheduling-compat.d.ts

@@ -0,0 +1,21 @@
+import type { Context } from '@deepseek-ai/cordis';
+/**
+ * DSH_COMPAT_REMOVE(subagent-report-settlement-dedup)
+ *
+ * Temporary compatibility shim for DSH 0.1.0-rc.6. A continuable child is told
+ * to report its result before finishing, while DSH also unconditionally sends
+ * the same closing output in a `subagent-settled` notice. The report is often
+ * still queued when the settlement reaches the parent, so the parent sees the
+ * result once and the equivalent report remains as duplicate next-turn work.
+ *
+ * Remove this module, its installation in `src/index.ts`, and its focused test
+ * once upstream coalesces an equivalent final report with settlement delivery.
+ */
+export declare const DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER: "__dshChatgptSubscriptionSubagentReportDedupCompatV1";
+/**
+ * Discard only an exact, same-child report duplicate immediately before DSH
+ * delivers the corresponding settlement notice. Partial reports, reports with
+ * different content, and all unrelated inbox work remain untouched.
+ */
+export declare function installSubagentReportDedupCompat(ctx: Context): () => void;
+//# sourceMappingURL=subagent-report-scheduling-compat.d.ts.map

package/lib/types/host/subagent-report-scheduling-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-report-scheduling-compat.d.ts","sourceRoot":"","sources":["../../../src/host/subagent-report-scheduling-compat.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC,EAClD,qDAA8D,CAAA;AA4EhE;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAyGzE"}

package/lib/types/host/token-store-linux.d.ts

@@ -0,0 +1,20 @@
+import type { TokenStore, StoredOAuthCredentials } from './token-store.ts';
+export declare function defaultLinuxCredentialPath(): string;
+/**
+ * Linux credential storage protected by owner-only filesystem permissions.
+ * The payload is not encrypted at rest, so callers must report that distinction
+ * instead of presenting this store as equivalent to Windows DPAPI.
+ */
+export declare class LinuxFileTokenStore implements TokenStore {
+    private readonly path;
+    readonly storage: {
+        readonly kind: "linux-file";
+        readonly encrypted: false;
+    };
+    private readonly noFollow;
+    constructor(path?: string);
+    load(): Promise<StoredOAuthCredentials | null>;
+    save(value: StoredOAuthCredentials): Promise<void>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=token-store-linux.d.ts.map

package/lib/types/host/token-store-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store-linux.d.ts","sourceRoot":"","sources":["../../../src/host/token-store-linux.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAM1E,wBAAgB,0BAA0B,IAAI,MAAM,CAGnD;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,UAAU;IAIxC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,OAAO;;;MAAoD;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;gBAEnB,IAAI,SAA+B;IAM1D,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IA2B9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B"}

package/lib/types/host/token-store-windows.d.ts

@@ -2,6 +2,10 @@ import type { TokenStore, StoredOAuthCredentials } from './token-store.ts';
 export declare function defaultDpapiCredentialPath(): string;
 export declare class WindowsDpapiTokenStore implements TokenStore {
     private readonly path;
+    readonly storage: {
+        readonly kind: "windows-dpapi";
+        readonly encrypted: true;
+    };
     constructor(path?: string);
     load(): Promise<StoredOAuthCredentials | null>;
     save(value: StoredOAuthCredentials): Promise<void>;

package/lib/types/host/token-store-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store-windows.d.ts","sourceRoot":"","sources":["../../../src/host/token-store-windows.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAiC1E,wBAAgB,0BAA0B,IAAI,MAAM,CAGnD;AAED,qBAAa,sBAAuB,YAAW,UAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,SAA+B;IAK1D,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAW9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}
+{"version":3,"file":"token-store-windows.d.ts","sourceRoot":"","sources":["../../../src/host/token-store-windows.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAiC1E,wBAAgB,0BAA0B,IAAI,MAAM,CAGnD;AAED,qBAAa,sBAAuB,YAAW,UAAU;IAG3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,QAAQ,CAAC,OAAO;;;MAAsD;gBAEzC,IAAI,SAA+B;IAK1D,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAW9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/lib/types/host/token-store.d.ts

@@ -1,3 +1,4 @@
+import type { CredentialStorageDto } from '../shared/contracts.ts';
 export interface StoredOAuthCredentials {
     accessToken: string;
     refreshToken: string;
@@ -8,12 +9,17 @@ export interface StoredOAuthCredentials {
     planType?: string;
 }
 export interface TokenStore {
+    readonly storage: Omit<CredentialStorageDto, 'available'>;
     load(): Promise<StoredOAuthCredentials | null>;
     save(value: StoredOAuthCredentials): Promise<void>;
     clear(): Promise<void>;
 }
 /** Test seam and non-persistent development store. Never used by apply(). */
 export declare class MemoryTokenStore implements TokenStore {
+    readonly storage: {
+        readonly kind: "memory";
+        readonly encrypted: false;
+    };
     private value;
     load(): Promise<StoredOAuthCredentials | null>;
     save(value: StoredOAuthCredentials): Promise<void>;

package/lib/types/host/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/host/token-store.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,6EAA6E;AAC7E,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,KAAK,CAAsC;IAE7C,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAI9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAqB7E"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/host/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAElE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAA;IACzD,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,6EAA6E;AAC7E,qBAAa,gBAAiB,YAAW,UAAU;IACjD,QAAQ,CAAC,OAAO;;;MAAgD;IAChE,OAAO,CAAC,KAAK,CAAsC;IAE7C,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAI9C,IAAI,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAqB7E"}

package/lib/types/index.d.ts

@@ -5,5 +5,8 @@ export { OAuthService } from './host/oauth-service.ts';
 export { CodexChatGptAdapter } from './host/adapter.ts';
 export { ResponsesClient, parseResponsesStream } from './host/responses-client.ts';
 export { UsageService, mapCodexUsage } from './host/usage-service.ts';
+export { createPlatformTokenStore } from './host/platform-token-store.ts';
+export { LinuxFileTokenStore } from './host/token-store-linux.ts';
+export { WindowsDpapiTokenStore } from './host/token-store-windows.ts';
 export type { TokenStore, StoredOAuthCredentials } from './host/token-store.ts';
 //# sourceMappingURL=index.d.ts.map