@eddyskywalker/dsh-chatgpt-subscription 0.1.5 → 0.1.7

package/lib/index.js

@@ -1,6 +1,8 @@
 import { CallId, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import http from "node:http";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, stat, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -122,6 +124,260 @@ var CodexChatGptAdapter = class extends LlmAdapter {
 	}
 };
 //#endregion
+//#region src/host/subagent-report-scheduling-compat.ts
+/**
+* DSH_COMPAT_REMOVE(subagent-report-settlement-dedup)
+*
+* Temporary compatibility shim for DSH 0.1.0-rc.6. A continuable child is told
+* to report its result before finishing, while DSH also unconditionally sends
+* the same closing output in a `subagent-settled` notice. The report is often
+* still queued when the settlement reaches the parent, so the parent sees the
+* result once and the equivalent report remains as duplicate next-turn work.
+*
+* Remove this module, its installation in `src/index.ts`, and its focused test
+* once upstream coalesces an equivalent final report with settlement delivery.
+*/
+const DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER = "__dshChatgptSubscriptionSubagentReportDedupCompatV1";
+function sourceOf(message) {
+	return message.source;
+}
+function isTextBlock(value, text) {
+	return typeof value === "object" && value !== null && value.type === "text" && value.text === text;
+}
+function sameValue(left, right) {
+	if (left === right) return true;
+	if (Array.isArray(left) || Array.isArray(right)) return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((value, index) => sameValue(value, right[index]));
+	if (typeof left !== "object" || left === null || typeof right !== "object" || right === null) return false;
+	const leftRecord = left;
+	const rightRecord = right;
+	const leftKeys = Object.keys(leftRecord).sort();
+	const rightKeys = Object.keys(rightRecord).sort();
+	return leftKeys.length === rightKeys.length && leftKeys.every((key, index) => key === rightKeys[index] && sameValue(leftRecord[key], rightRecord[key]));
+}
+function duplicatePendingReports(agent, settlement) {
+	const settlementSource = sourceOf(settlement);
+	if (settlementSource.kind !== "subagent-settled" || settlementSource.senderSessionId === void 0) return [];
+	if (settlement.content.length < 2 || !isTextBlock(settlement.content[1], "Its closing message:")) return [];
+	const closingContent = settlement.content.slice(2);
+	return [...agent.inbox.nextStep, ...agent.inbox.nextTurn].filter((pending) => {
+		const pendingSource = sourceOf(pending);
+		return pendingSource.kind === "subagent-report" && pendingSource.senderSessionId === settlementSource.senderSessionId && sameValue(pending.content.slice(1), closingContent);
+	});
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Discard only an exact, same-child report duplicate immediately before DSH
+* delivers the corresponding settlement notice. Partial reports, reports with
+* different content, and all unrelated inbox work remain untouched.
+*/
+function installSubagentReportDedupCompat(ctx) {
+	const patches = /* @__PURE__ */ new Map();
+	const patch = (agent) => {
+		if (patches.has(agent)) return;
+		const shared = agent.followup[DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER];
+		if (shared?.wrappers.followup === agent.followup && shared.wrappers.steer === agent.steer && shared.wrappers.inject === agent.inject) {
+			shared.owners += 1;
+			patches.set(agent, shared);
+			return;
+		}
+		const originals = {
+			followup: agent.followup,
+			steer: agent.steer,
+			inject: agent.inject
+		};
+		let record;
+		const deliver = (name, message) => {
+			for (const duplicate of duplicatePendingReports(agent, message)) try {
+				agent.inbox.remove(duplicate.id);
+			} catch (error) {
+				ctx.logger.warn("[dsh-chatgpt-subscription] Could not discard a duplicate DSH subagent report: " + errorMessage(error));
+			}
+			originals[name].call(agent, message);
+		};
+		const wrappers = {
+			followup(message) {
+				deliver("followup", message);
+			},
+			steer(message) {
+				deliver("steer", message);
+			},
+			inject(message) {
+				deliver("inject", message);
+			}
+		};
+		record = {
+			originals,
+			wrappers,
+			owners: 1
+		};
+		for (const wrapper of Object.values(wrappers)) Object.defineProperty(wrapper, DSH_SUBAGENT_REPORT_DEDUP_COMPAT_MARKER, { value: record });
+		try {
+			agent.followup = wrappers.followup;
+			agent.steer = wrappers.steer;
+			agent.inject = wrappers.inject;
+			patches.set(agent, record);
+		} catch (error) {
+			record.owners = 0;
+			for (const name of [
+				"followup",
+				"steer",
+				"inject"
+			]) if (agent[name] === wrappers[name]) try {
+				agent[name] = originals[name];
+			} catch {}
+			ctx.logger.warn("[dsh-chatgpt-subscription] Could not install temporary DSH subagent dedup compatibility: " + errorMessage(error));
+		}
+	};
+	const unpatch = (agent) => {
+		const record = patches.get(agent);
+		if (!record) return;
+		patches.delete(agent);
+		record.owners -= 1;
+		if (record.owners > 0) return;
+		for (const name of [
+			"followup",
+			"steer",
+			"inject"
+		]) {
+			if (agent[name] !== record.wrappers[name]) continue;
+			try {
+				agent[name] = record.originals[name];
+			} catch (error) {
+				ctx.logger.warn("[dsh-chatgpt-subscription] Could not remove temporary DSH subagent dedup compatibility: " + errorMessage(error));
+			}
+		}
+	};
+	for (const agent of ctx.agents.list()) patch(agent);
+	const disposeCreated = ctx.on("agent/created", ({ agent }) => patch(agent));
+	const disposeDisposed = ctx.on("agent/disposed", ({ agent }) => unpatch(agent));
+	return () => {
+		disposeDisposed();
+		disposeCreated();
+		for (const agent of [...patches.keys()]) unpatch(agent);
+	};
+}
+//#endregion
+//#region src/host/bash-prompt-scheduling-compat.ts
+/**
+* DSH_COMPAT_REMOVE(persistent-bash-prompt-mismatch)
+*
+* Temporary compatibility shim for DSH 0.1.0-rc.6. The persistent bash tool
+* (`@deepseek-ai/dsh-tool-bash-persistent`) configures the bash shell PS1 to
+* `__DSH_PERSISTENT_BASH_PROMPT__ `, while the underlying PTY backend
+* (`@deepseek-ai/dsh-terminal-bash`) only checks for a hardcoded `dsh> `
+* prompt with a 6-character truncation limit.
+*
+* When the prompt does not match, `promptTextSeen` remains false and the PTY
+* session falls back to the 3.5s idle silence timeout (`idleSilenceMs: 3000ms`
+* + `handoffGraceMs: 500ms`) on every command execution.
+*
+* This compatibility module patches the PTY session `onData` handler so that
+* both `dsh> ` and `__DSH_PERSISTENT_BASH_PROMPT__ ` (and its trimmed variants)
+* satisfy `promptTextSeen`, restoring instant 50ms readiness settling.
+*
+* Remove this module, its installation in `src/index.ts`, and its focused test
+* once upstream aligns `CONTROLLED_PROMPT` with persistent bash tools.
+*/
+const DSH_BASH_PROMPT_COMPAT_MARKER = "__dshChatgptSubscriptionBashPromptCompatV1";
+const KNOWN_CONTROLLED_PROMPTS = [
+	"dsh> ",
+	"dsh>",
+	"__DSH_PERSISTENT_BASH_PROMPT__ ",
+	"__DSH_PERSISTENT_BASH_PROMPT__"
+];
+const MAX_PROMPT_BUFFER_LENGTH = 64;
+function isKnownControlledPrompt(tail) {
+	if (!tail) return false;
+	const cleaned = tail.replaceAll(/[\x00-\x1f\x7f]/g, "").trim();
+	for (const known of KNOWN_CONTROLLED_PROMPTS) if (cleaned === known.replaceAll(/[\x00-\x1f\x7f]/g, "").trim()) return true;
+	return false;
+}
+function patchSessionOnData(target) {
+	const obj = target.prototype ?? target;
+	if (!obj || typeof obj.onData !== "function") return () => {};
+	const existing = obj.onData[DSH_BASH_PROMPT_COMPAT_MARKER];
+	if (existing) {
+		existing.owners += 1;
+		return () => {
+			existing.owners -= 1;
+			if (existing.owners <= 0 && obj.onData["__dshChatgptSubscriptionBashPromptCompatV1"] === existing) obj.onData = existing.originalOnData;
+		};
+	}
+	const originalOnData = obj.onData;
+	const record = {
+		originalOnData,
+		owners: 1
+	};
+	function wrapper(data) {
+		const sanitized = this.sanitizer.push(data);
+		this.appendOutput(sanitized.text);
+		if (sanitized.prompt) {
+			this.promptSeen = true;
+			this.promptTail = "";
+			this.lastOutputAt = Date.now();
+		}
+		if (this.promptSeen && sanitized.promptTail !== void 0) {
+			const remaining = Math.max(0, MAX_PROMPT_BUFFER_LENGTH - this.promptTail.length);
+			this.promptTail += sanitized.promptTail.slice(0, remaining);
+			if (sanitized.promptTail.length > remaining) this.promptTail = `${this.promptTail}\0`;
+			this.promptTextSeen = isKnownControlledPrompt(this.promptTail);
+		}
+	}
+	Object.defineProperty(wrapper, DSH_BASH_PROMPT_COMPAT_MARKER, { value: record });
+	obj.onData = wrapper;
+	return () => {
+		record.owners -= 1;
+		if (record.owners <= 0 && obj.onData === wrapper) obj.onData = originalOnData;
+	};
+}
+/**
+* Installs the persistent bash prompt compatibility patch onto registered and
+* future PTY backends.
+*/
+function installBashPromptCompat(ctx) {
+	const disposers = [];
+	const patchBackend = (backend) => {
+		if (!backend) return;
+		if (typeof backend.createSession === "function") {
+			const originalCreate = backend.createSession;
+			backend.createSession = function(terminal, config) {
+				const session = originalCreate.call(this, terminal, config);
+				if (session) patchSessionOnData(session);
+				return session;
+			};
+			disposers.push(() => {
+				if (backend.createSession) backend.createSession = originalCreate;
+			});
+		}
+	};
+	const terminals = ctx.terminals;
+	if (terminals?.backends) {
+		for (const backend of terminals.backends.values()) patchBackend(backend);
+		if (typeof terminals.registerBackend === "function") {
+			const originalRegister = terminals.registerBackend;
+			terminals.registerBackend = function(backend) {
+				patchBackend(backend);
+				return originalRegister.call(this, backend);
+			};
+			disposers.push(() => {
+				if (terminals.registerBackend) terminals.registerBackend = originalRegister;
+			});
+		}
+	}
+	return () => {
+		while (disposers.length > 0) {
+			const dispose = disposers.pop();
+			try {
+				dispose?.();
+			} catch (error) {
+				ctx.logger.warn("[dsh-chatgpt-subscription] Could not remove bash prompt compatibility: " + (error instanceof Error ? error.message : String(error)));
+			}
+		}
+	};
+}
+//#endregion
 //#region src/compat.ts
 /**
 * Compatibility constants for the ChatGPT-backed Codex flow. The backend and
@@ -293,13 +549,16 @@ var OAuthService = class {
 			return this.statusFromCredentials(credentials);
 		} catch {
 			return {
-				...this.statusFromCredentials(null),
+				...this.statusFromCredentials(null, false),
 				error: publicError(new OAuthServiceError("storage-failed", "Secure credential storage could not be read."))
 			};
 		}
 	}
 	async startLogin() {
 		this.assertAvailable();
+		await this.store.load().catch(() => {
+			throw new OAuthServiceError("storage-failed", "Secure credential storage is unavailable. Fix its ownership or permissions before signing in.");
+		});
 		if (this.activeLogin !== null) throw new OAuthServiceError("login-active", "A ChatGPT sign-in is already in progress.");
 		this.lastLoginError = void 0;
 		const loginId = this.random(24).toString("base64url");
@@ -452,14 +711,14 @@ var OAuthService = class {
 		if (stored === null) throw new OAuthServiceError("not-authenticated", "Sign in with ChatGPT first.");
 		return stored;
 	}
-	statusFromCredentials(credentials) {
+	statusFromCredentials(credentials, storageAvailable = true) {
 		const active = this.activeLogin;
 		if (credentials === null) return {
 			authenticated: false,
 			account: null,
 			storage: {
-				kind: "windows-dpapi",
-				encrypted: true
+				...this.store.storage,
+				available: storageAvailable
 			},
 			login: {
 				active: active !== null,
@@ -478,8 +737,8 @@ var OAuthService = class {
 				tokenExpiresAt: Math.floor(credentials.expiresAt / 1e3)
 			},
 			storage: {
-				kind: "windows-dpapi",
-				encrypted: true
+				...this.store.storage,
+				available: storageAvailable
 			},
 			login: {
 				active: active !== null,
@@ -718,7 +977,7 @@ async function buildResponsesPayload(options, attachments, localRawImages = {})
 }
 function runCodeInstruction(tools) {
 	if (!tools?.some((tool) => tool.name === "run_code")) return void 0;
-	return "run_code compatibility rule: its code is parsed as strict JavaScript/TypeScript before execution. On Windows, do not embed PowerShell containing $, ${...}, backslashes, or here-strings in JavaScript template literals; String.raw does not disable ${...} interpolation. Prefer arrays of ordinary quoted strings joined with \"\\n\", escaping backslashes, or use a file-write tool for large scripts and then invoke pwsh.";
+	return "run_code compatibility rule: its code is parsed as strict JavaScript/TypeScript before execution. Shell commands are nested string data: JavaScript template literals may consume ${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them. On Windows, avoid embedding PowerShell containing $, ${...}, backslashes, or here-strings in template literals; String.raw does not disable ${...} interpolation. On Linux, prefer ordinary quoted strings or write a script file before invoking bash/sh, especially for commands containing backticks or ${...}. Prefer arrays of ordinary quoted strings joined with \"\\n\", escaping backslashes, or use a file-write tool for large scripts.";
 }
 function localRawImageInstruction(stats) {
 	if (stats.failed === 0) return void 0;
@@ -728,18 +987,25 @@ function supportsImageInput(options) {
 	return options.provider === "codex-chatgpt" && options.model.toLowerCase().startsWith("gpt-");
 }
 function toolDescriptionForCodex(name, description) {
-	if (name === "run_code") return `${description}\n\nCompatibility: code is strict JavaScript/TypeScript. When composing PowerShell, avoid JavaScript template literals containing $, \${...}, Windows backslashes, or PowerShell here-strings. Prefer ordinary quoted string arrays joined with "\\n", or write a script file with a dedicated file tool before invoking pwsh.`;
+	if (name === "run_code") return `${description}\n\nCompatibility: code is strict JavaScript/TypeScript and nested shell commands are string data. Template literals may consume \${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them. Prefer ordinary quoted string arrays joined with "\\n", or write a script file with a dedicated file tool before invoking the shell.`;
 	if (isCommandTool(name)) return `${description}\n\n${commandToolCompatibilityText(name)}`;
 	return description;
 }
 function commandToolInstruction(tools) {
 	const names = tools?.filter((tool) => isCommandTool(tool.name)).map((tool) => tool.name);
 	if (!names?.length) return void 0;
-	return `Command tool compatibility rule (${[...new Set(names)].join(", ")}): each command call runs in a fresh process, so do not rely on cd, aliases, functions, or variables from previous calls; set workdir when the tool supports it. On Windows/pwsh, keep commands in native PowerShell syntax and native Windows paths. For deletion or move operations, first resolve and verify exact absolute target paths, then operate on those literal paths only; avoid dynamically deleting paths built from $HOME, wildcards, command substitution, or another shell's output. Treat [auto-mode hard deny] and similar policy denials as non-retriable; choose a safer non-destructive inspection or report the limitation instead of repeating the same command or adding sandbox escalation. If downloads fail with TLS credential or connection-closed errors, treat that as an environment/network failure and use local sources or report the limitation instead of cycling through equivalent download commands.`;
+	const uniqueNames = [...new Set(names)];
+	const normalized = uniqueNames.map((name) => name.toLowerCase());
+	const shellGuidance = [
+		normalized.some((name) => name === "pwsh" || name.includes("powershell")) ? "For pwsh/PowerShell, use native PowerShell syntax and native Windows paths." : void 0,
+		normalized.includes("bash") ? "For bash, use native POSIX paths and Bash syntax in a fresh non-interactive process." : void 0,
+		normalized.some((name) => name === "sh" || name === "shell") ? "For sh/generic shell, prefer portable POSIX syntax and avoid Bash-only arrays, [[ ... ]], process substitution, and source." : void 0
+	].filter((value) => value !== void 0).join(" ");
+	return `Command tool compatibility rule (${uniqueNames.join(", ")}): each command call runs in a fresh process, so do not rely on cd, aliases, functions, or variables from previous calls; set workdir when the tool supports it. ${shellGuidance} For deletion or move operations, first resolve and verify exact absolute target paths, then operate on those literal paths only; avoid dynamically deleting paths built from home-directory expansion, wildcards, command substitution, or another shell's output. Treat [auto-mode hard deny] and similar policy denials as non-retriable; choose a safer non-destructive inspection or report the limitation instead of repeating the same command or adding sandbox escalation. If downloads fail with TLS credential or connection-closed errors, treat that as an environment/network failure and use local sources or report the limitation instead of cycling through equivalent download commands.`;
 }
 function commandToolCompatibilityText(name) {
 	const shell = name.toLowerCase();
-	return `Compatibility: command execution is stateless between calls.${shell === "pwsh" || shell.includes("powershell") ? " Use native PowerShell syntax and native Windows paths; prefer workdir over cd because every call starts a fresh process." : " Prefer workdir over cd because every call starts a fresh process."} For destructive operations, verify exact absolute targets first and use literal paths; policy hard-deny results require a safer command shape, not sandbox escalation.`;
+	return `Compatibility: command execution is stateless between calls.${shell === "pwsh" || shell.includes("powershell") ? " Use native PowerShell syntax and native Windows paths." : shell === "bash" ? " Use Bash syntax and native POSIX paths." : " Use portable POSIX syntax and native POSIX paths; avoid Bash-only arrays, [[ ... ]], process substitution, and source."} Prefer workdir over cd because every call starts a fresh process. For destructive operations, verify exact absolute targets first and use literal paths; policy hard-deny results require a safer command shape, not sandbox escalation.`;
 }
 function sandboxToolInstruction(tools, sandboxRetryTools) {
 	if (!tools?.some((tool) => hasSandboxControls(tool.parameters))) return void 0;
@@ -761,7 +1027,7 @@ function toolParametersForCodex(toolName, parameters, allowSandboxRetry) {
 		const code = record$2(properties.code);
 		if (code !== null) {
 			const current = typeof code.description === "string" ? code.description.trim() : "";
-			const compatibility = "Strict JavaScript/TypeScript source. For PowerShell on Windows, avoid JavaScript template literals containing $, ${...}, backslashes, or here-strings; String.raw still performs ${...} interpolation. Prefer ordinary quoted string arrays joined with \"\\n\" and escape backslashes, or write a script file with a dedicated file tool.";
+			const compatibility = "Strict JavaScript/TypeScript source. Nested shell commands are string data: template literals may consume ${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them; String.raw still performs ${...} interpolation. Prefer ordinary quoted string arrays joined with \"\\n\", or write a script file with a dedicated file tool.";
 			code.description = current ? `${current}\n\n${compatibility}` : compatibility;
 		}
 	}
@@ -784,7 +1050,7 @@ function appendPropertyDescription(value, addition) {
 }
 function isCommandTool(name) {
 	const normalized = name.toLowerCase();
-	return normalized === "pwsh" || normalized === "powershell" || normalized === "bash" || normalized === "shell";
+	return normalized === "pwsh" || normalized === "powershell" || normalized === "bash" || normalized === "sh" || normalized === "shell";
 }
 function hasSandboxControls(parameters) {
 	const properties = record$2(parameters.properties);
@@ -828,7 +1094,7 @@ function appendMissingToolCalls(input, knownToolCalls, message) {
 }
 function runCodeErrorOutput(output) {
 	if (!isRunCodeParserError(output)) return output;
-	return `${output}\n\nCompatibility hint: run_code failed while parsing strict JavaScript/TypeScript, before the nested tool ran. Avoid JavaScript template literals for PowerShell containing $, \${...}, Windows backslashes, or here-strings; String.raw does not prevent \${...} interpolation. Build the script from ordinary quoted strings joined with "\\n" (escaping backslashes), or write a script file with a dedicated file tool and then invoke pwsh.`;
+	return `${output}\n\nCompatibility hint: run_code failed while parsing strict JavaScript/TypeScript, before the nested tool ran. Shell commands are nested string data; template literals can consume \${...}, backticks, backslashes, and escape sequences before PowerShell, Bash, or POSIX sh sees them, and String.raw does not prevent \${...} interpolation. Build the script from ordinary quoted strings joined with "\\n", or write a script file with a dedicated file tool and then invoke the shell.`;
 }
 function isRunCodeParserError(output) {
 	return /(?:Legacy octal escape is not permitted in strict mode|Unexpected token|Invalid or unexpected token|Unterminated template|Expected ['"]?\}['"]?)/i.test(output);
@@ -1833,6 +2099,100 @@ function parseStoredCredentials(value) {
 	};
 }
 //#endregion
+//#region src/host/token-store-linux.ts
+const DIRECTORY_MODE = 448;
+const FILE_MODE = 384;
+function defaultLinuxCredentialPath() {
+	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "storages", "dsh-chatgpt-subscription", "oauth.json");
+}
+/**
+* Linux credential storage protected by owner-only filesystem permissions.
+* The payload is not encrypted at rest, so callers must report that distinction
+* instead of presenting this store as equivalent to Windows DPAPI.
+*/
+var LinuxFileTokenStore = class {
+	path;
+	storage = {
+		kind: "linux-file",
+		encrypted: false
+	};
+	noFollow = constants.O_NOFOLLOW;
+	constructor(path = defaultLinuxCredentialPath()) {
+		this.path = path;
+		if (process.platform !== "linux") throw new Error("Linux credential storage requires Linux");
+		if (this.noFollow === void 0) throw new Error("Linux credential storage requires O_NOFOLLOW support");
+		if (dirname(path) === path) throw new Error("invalid Linux credential path");
+	}
+	async load() {
+		let handle;
+		try {
+			handle = await open(this.path, constants.O_RDONLY | this.noFollow);
+		} catch (error) {
+			if (isMissing(error)) return null;
+			throw new Error("Linux credential read failed", { cause: error });
+		}
+		try {
+			const stats = await handle.stat();
+			if (!stats.isFile()) throw new Error("credential path is not a regular file");
+			if (typeof process.getuid === "function" && stats.uid !== process.getuid()) throw new Error("credential file is owned by another user");
+			if ((stats.mode & 511) !== FILE_MODE) throw new Error("credential file permissions must be 0600");
+			const payload = await handle.readFile({ encoding: "utf8" });
+			return parseStoredCredentials(JSON.parse(payload));
+		} catch (error) {
+			throw new Error("Linux credential payload is invalid or insecure", { cause: error });
+		} finally {
+			await handle.close();
+		}
+	}
+	async save(value) {
+		const directory = dirname(this.path);
+		const temporary = `${this.path}.tmp-${randomUUID()}`;
+		try {
+			const existing = await lstat(this.path);
+			if (existing.isSymbolicLink() || !existing.isFile()) throw new Error("credential path is not a regular file");
+			assertOwnedByCurrentUser(existing.uid, "credential file");
+		} catch (error) {
+			if (!isMissing(error)) throw new Error("Linux credential write failed", { cause: error });
+		}
+		await mkdir(directory, {
+			recursive: true,
+			mode: DIRECTORY_MODE
+		});
+		const directoryStats = await stat(directory);
+		if (!directoryStats.isDirectory()) throw new Error("Linux credential directory is invalid");
+		assertOwnedByCurrentUser(directoryStats.uid, "credential directory");
+		await chmod(directory, DIRECTORY_MODE);
+		let handle;
+		try {
+			handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, FILE_MODE);
+			await handle.writeFile(JSON.stringify(value), { encoding: "utf8" });
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			await rename(temporary, this.path);
+			await chmod(this.path, FILE_MODE);
+		} catch (error) {
+			await handle?.close().catch(() => void 0);
+			await unlink(temporary).catch(() => void 0);
+			throw new Error("Linux credential write failed", { cause: error });
+		}
+	}
+	async clear() {
+		try {
+			await unlink(this.path);
+		} catch (error) {
+			if (isMissing(error)) return;
+			throw new Error("Linux credential deletion failed", { cause: error });
+		}
+	}
+};
+function assertOwnedByCurrentUser(owner, label) {
+	if (typeof process.getuid === "function" && owner !== process.getuid()) throw new Error(`${label} is owned by another user`);
+}
+function isMissing(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+//#endregion
 //#region src/host/token-store-windows.ts
 const PROTECT_SCRIPT = String.raw`
 $ErrorActionPreference = 'Stop'
@@ -1866,6 +2226,10 @@ function defaultDpapiCredentialPath() {
 }
 var WindowsDpapiTokenStore = class {
 	path;
+	storage = {
+		kind: "windows-dpapi",
+		encrypted: true
+	};
 	constructor(path = defaultDpapiCredentialPath()) {
 		this.path = path;
 		if (process.platform !== "win32") throw new Error("Windows DPAPI storage requires Windows");
@@ -1938,14 +2302,22 @@ function runPowerShell(script, path, stdin) {
 	});
 }
 //#endregion
+//#region src/host/platform-token-store.ts
+function createPlatformTokenStore(platform = process.platform) {
+	if (platform === "win32") return new WindowsDpapiTokenStore();
+	if (platform === "linux") return new LinuxFileTokenStore();
+	throw new Error(`Unsupported platform ${platform}; dsh-chatgpt-subscription supports Windows and Linux.`);
+}
+//#endregion
 //#region src/index.ts
 const inject = [
 	"webServer",
 	"llm",
-	"attachments"
+	"attachments",
+	"agents"
 ];
 function apply(ctx) {
-	const oauth = new OAuthService(new WindowsDpapiTokenStore(), { logger: ctx.logger });
+	const oauth = new OAuthService(createPlatformTokenStore(), { logger: ctx.logger });
 	const usage = new UsageService(oauth);
 	const adapter = new CodexChatGptAdapter(new ResponsesClient(oauth, ctx.attachments, {
 		localRawImages: { baseUrl: localWebServerBaseUrl(ctx.webServer.host, ctx.webServer.port) },
@@ -1954,7 +2326,11 @@ function apply(ctx) {
 	ctx.effect(() => {
 		const disposeRoutes = registerRoutes(ctx, oauth, usage);
 		const disposeAdapter = ctx.llm.registerAdapter([PROVIDER_ID], adapter);
+		const disposeSubagentReportCompat = installSubagentReportDedupCompat(ctx);
+		const disposeBashPromptCompat = installBashPromptCompat(ctx);
 		return () => {
+			disposeBashPromptCompat();
+			disposeSubagentReportCompat();
 			disposeAdapter();
 			disposeRoutes();
 			oauth.dispose();
@@ -1965,4 +2341,4 @@ function localWebServerBaseUrl(host, port) {
 	return `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${port}`;
 }
 //#endregion
-export { CodexChatGptAdapter, OAuthService, ResponsesClient, UsageService, apply, inject, mapCodexUsage, parseResponsesStream };
+export { CodexChatGptAdapter, LinuxFileTokenStore, OAuthService, ResponsesClient, UsageService, WindowsDpapiTokenStore, apply, createPlatformTokenStore, inject, mapCodexUsage, parseResponsesStream };

package/lib/types/client/CodexSubscriptionSection.d.ts

@@ -1,9 +1,11 @@
 import type { PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
-import type { QuotaWindowDto } from '../shared/contracts.ts';
+import type { CredentialStorageDto, QuotaWindowDto } from '../shared/contracts.ts';
 import { NS } from './locales.ts';
 type Props = PropsRuntime<'settings.section'> & PropsLocale<typeof NS>;
 type Translate = Props['t'];
 export declare function CodexSubscriptionSection({ t }: Props): React.JSX.Element;
+export declare function storageLabel(storage: CredentialStorageDto | undefined, t: Translate): string;
+export declare function storageNotice(storage: CredentialStorageDto | undefined, t: Translate): string;
 export declare function QuotaBar({ label, window, t }: {
     label: string;
     window: QuotaWindowDto;

package/lib/types/client/CodexSubscriptionSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CodexSubscriptionSection.d.ts","sourceRoot":"","sources":["../../../src/client/CodexSubscriptionSection.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACjF,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE7F,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAEjC,KAAK,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;AAEtE,KAAK,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;AAI3B,wBAAgB,wBAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAoMxE;AAyBD,wBAAgB,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAczH;AAMD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAQxE;AAWD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUnD"}
+{"version":3,"file":"CodexSubscriptionSection.d.ts","sourceRoot":"","sources":["../../../src/client/CodexSubscriptionSection.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAmC,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEnH,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAEjC,KAAK,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;AAEtE,KAAK,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;AAI3B,wBAAgB,wBAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAoMxE;AAiBD,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAM5F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAM7F;AAUD,wBAAgB,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAczH;AAMD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAQxE;AAWD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUnD"}

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAI/D,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0BAA0B,EAAE,SAAS,CAAA;KACtC;CACF;AAED,eAAO,MAAM,MAAM,UAAsB,CAAA;AAEzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAW9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAG/D,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0BAA0B,EAAE,SAAS,CAAA;KACtC;CACF;AAED,eAAO,MAAM,MAAM,UAAsB,CAAA;AAEzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAU9C"}

package/lib/types/client/locales.d.ts

@@ -9,8 +9,14 @@ export declare const zh: {
     readonly accountId: "账号 ID";
     readonly expires: "令牌到期";
     readonly storage: "凭据存储";
-    readonly storageValue: "Windows DPAPI（当前用户加密）";
-    readonly securityNotice: "令牌仅保存在 Host 端的 DPAPI 加密文件中，不会进入浏览器、settings.yaml 或日志。";
+    readonly storageWindows: "Windows DPAPI（当前用户加密）";
+    readonly storageLinuxFile: "Linux 用户私有文件（权限 0600）";
+    readonly storageMemory: "仅 Host 内存（不持久化）";
+    readonly storageUnavailable: "凭据存储不可用";
+    readonly securityWindows: "令牌 Windows CurrentUser DPAPI 加密。";
+    readonly securityLinuxFile: "令牌仅写入 Host 上当前 Linux 用户可读的 0600 文件。";
+    readonly securityMemory: "令牌仅保留在 Host 内存中，Host 退出后丢失。";
+    readonly securityUnavailable: "Host 无法安全访问凭据存储；请修复文件所有者或权限后重试。";
     readonly signIn: "使用 ChatGPT 登录";
     readonly signInAgain: "重新登录";
     readonly cancel: "取消登录";
@@ -60,8 +66,14 @@ export declare const dictionaries: {
         readonly accountId: "账号 ID";
         readonly expires: "令牌到期";
         readonly storage: "凭据存储";
-        readonly storageValue: "Windows DPAPI（当前用户加密）";
-        readonly securityNotice: "令牌仅保存在 Host 端的 DPAPI 加密文件中，不会进入浏览器、settings.yaml 或日志。";
+        readonly storageWindows: "Windows DPAPI（当前用户加密）";
+        readonly storageLinuxFile: "Linux 用户私有文件（权限 0600）";
+        readonly storageMemory: "仅 Host 内存（不持久化）";
+        readonly storageUnavailable: "凭据存储不可用";
+        readonly securityWindows: "令牌由 Host 使用 Windows CurrentUser DPAPI 加密，不会进入浏览器、settings.yaml 或日志。";
+        readonly securityLinuxFile: "令牌仅写入 Host 上当前 Linux 用户可读的 0600 文件，但不会额外加密；同 UID 进程、root、备份和磁盘快照仍可能读取。";
+        readonly securityMemory: "令牌仅保留在 Host 内存中，Host 退出后丢失。";
+        readonly securityUnavailable: "Host 无法安全访问凭据存储；请修复文件所有者或权限后重试。";
         readonly signIn: "使用 ChatGPT 登录";
         readonly signInAgain: "重新登录";
         readonly cancel: "取消登录";
@@ -98,6 +110,6 @@ export declare const dictionaries: {
         readonly retry: "重试";
         readonly unknown: "未知";
     };
-    en: Record<"title" | "intro" | "account" | "signedOut" | "signedIn" | "plan" | "accountId" | "expires" | "storage" | "storageValue" | "securityNotice" | "signIn" | "signInAgain" | "cancel" | "signOut" | "refreshToken" | "pending" | "popupBlocked" | "continueLogin" | "loading" | "connection" | "provider" | "connectionState" | "connected" | "untested" | "testConnection" | "testing" | "latency" | "models" | "quota" | "quotaIntro" | "refreshQuota" | "refreshing" | "noQuota" | "quotaSignedOut" | "stale" | "updated" | "primary" | "secondary" | "limitWindow" | "used" | "remaining" | "exhausted" | "resets" | "retry" | "unknown", string>;
+    en: Record<"quota" | "account" | "storage" | "stale" | "pending" | "title" | "intro" | "signedOut" | "signedIn" | "plan" | "accountId" | "expires" | "storageWindows" | "storageLinuxFile" | "storageMemory" | "storageUnavailable" | "securityWindows" | "securityLinuxFile" | "securityMemory" | "securityUnavailable" | "signIn" | "signInAgain" | "cancel" | "signOut" | "refreshToken" | "popupBlocked" | "continueLogin" | "loading" | "connection" | "provider" | "connectionState" | "connected" | "untested" | "testConnection" | "testing" | "latency" | "models" | "quotaIntro" | "refreshQuota" | "refreshing" | "noQuota" | "quotaSignedOut" | "updated" | "primary" | "secondary" | "limitWindow" | "used" | "remaining" | "exhausted" | "resets" | "retry" | "unknown", string>;
 };
 //# sourceMappingURL=locales.d.ts.map

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE,EAAG,0BAAmC,CAAA;AAErD,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CL,CAAA;AAEV,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,CA+C9C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AACvC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE,EAAG,0BAAmC,CAAA;AAErD,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDL,CAAA;AAEV,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,CAqD9C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AACvC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAA"}

package/lib/types/client/styles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../src/client/styles.ts"],"names":[],"mappings":"AAwDA,wBAAgB,aAAa,IAAI,MAAM,IAAI,CAQ1C"}
+{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../src/client/styles.ts"],"names":[],"mappings":"AAiDA,wBAAgB,aAAa,IAAI,MAAM,IAAI,CAQ1C"}