@khorsheed/dsh-local-agent-codex 0.2.0-rc.1 → 0.2.0

package/lib/types/model-broker.js

@@ -39,6 +39,42 @@ function dedupeChoices(layers) {
     }
     return choices;
 }
+/**
+ * Scope the served directory to the surface asking for it (the same helper
+ * lives in each provider's broker — fold into the family core when the
+ * directory faces next evolve):
+ *
+ * - memberless (the card's add-model dialog, the invite picker): the
+ *   endpoint's served catalog only — the configuration/history extras the
+ *   broker's info extension adds for STATUS display must never become add
+ *   candidates;
+ * - a member whose harness has a curated list: the list IS the vocabulary,
+ *   in the list's own order (the same rule `choices` already follows) — a
+ *   curated value the endpoint no longer serves stays as a bare row (the
+ *   card shows it the same way), and the member's current effective model is
+ *   kept visible as a bare entry when it sits outside the list, so a pre-list
+ *   binding never renders blank;
+ * - a member without a curated list: the legacy extended vocabulary.
+ */
+function scopeServedDirectory(directory, opts) {
+    if (opts.member && opts.curated.length === 0)
+        return directory;
+    const served = directory.entries.filter(entry => entry.source === 'native');
+    if (!opts.member)
+        return { ...directory, entries: served };
+    const byValue = new Map(served.flatMap(entry => entry.resolvedModel === undefined
+        ? [[entry.value, entry]]
+        : [[entry.value, entry], [entry.resolvedModel, entry]]));
+    // Curated ORDER leads (the card's first row is the default); a curated value
+    // the endpoint no longer serves stays listed as a bare row, exactly like the
+    // card shows it.
+    const entries = opts.curated.map(value => byValue.get(value) ?? { value, label: value, source: 'configuration' });
+    const current = opts.current?.trim();
+    if (current !== undefined && current !== '' && !entries.some(entry => entry.value === current || entry.resolvedModel === current)) {
+        entries.push({ value: current, label: current, source: 'configuration' });
+    }
+    return { ...directory, entries };
+}
 export class CodexModelBroker {
     deps;
     constructor(deps) {
@@ -54,7 +90,7 @@ export class CodexModelBroker {
             }
             const model = selection.model.mode === 'value' ? selection.model.value
                 : (selection.model.mode === 'inherit' ? binding.model : undefined)
-                    ?? this.deps.settingsModel() ?? await readCodexModel(home)
+                    ?? this.deps.settingsModel(home) ?? await readCodexModel(home)
                     ?? this.deps.catalogDefault(home, binding.cwd);
             const entry = directory?.entries.find(entry => entry.value === model);
             const explicitEffort = selection.effort.mode === 'value' ? selection.effort.value
@@ -88,7 +124,12 @@ export class CodexModelBroker {
         if (refresh)
             await this.deps.refreshDirectory?.(home, this.deps.cwd?.(childSessionId));
         const info = await this.modelInfo(childSessionId, childSessionId === undefined ? undefined : this.deps.ctx.localAgent.getDelegation(childSessionId)?.model);
-        return info.directory ?? { entries: [], complete: false, customInput: true, status: 'unsupported', refreshing: false, revision: 0 };
+        const directory = info.directory ?? { entries: [], complete: false, customInput: true, status: 'unsupported', refreshing: false, revision: 0 };
+        return scopeServedDirectory(directory, {
+            member: childSessionId !== undefined,
+            curated: this.deps.modelList?.(home) ?? [],
+            current: info.effective,
+        });
     }
     async *followModelDirectory(childSessionId, signal) {
         if (this.deps.followDirectory === undefined) {
@@ -113,7 +154,7 @@ export class CodexModelBroker {
         const recorded = record?.model?.trim();
         if (recorded !== undefined && recorded !== '')
             return recorded;
-        return this.deps.settingsModel();
+        return this.deps.settingsModel(this.deps.homeDir(childSessionId));
     }
     /**
      * Read the model surface. The cliDefault and the discovered identifiers come
@@ -124,8 +165,8 @@ export class CodexModelBroker {
      * re-fetches on open, so it never blocks on a CLI boot).
      */
     async modelInfo(childSessionId, delegationModel) {
-        const settings = this.deps.settingsModel();
         const homeDir = this.deps.homeDir(childSessionId);
+        const settings = this.deps.settingsModel(homeDir);
         const [cliDefault, discovered] = await Promise.all([
             readCodexModel(homeDir).catch(() => undefined),
             listCodexConfigModels(homeDir).catch(() => []),
@@ -144,6 +185,10 @@ export class CodexModelBroker {
                 : settings !== undefined ? 'settings'
                     : cliDefault !== undefined ? 'cli-config' : 'cli-builtin';
         const inFlight = childSessionId !== undefined && this.activeDelegations().includes(childSessionId);
+        // The curated list is the whole vocabulary when non-empty — nothing from
+        // outside the endpoint's served catalog sneaks in. Empty falls back to
+        // the pre-list chain (native candidates plus configuration and history).
+        const curated = this.deps.modelList?.(homeDir) ?? [];
         return {
             ...effective === undefined ? {} : { effective },
             source,
@@ -151,8 +196,8 @@ export class CodexModelBroker {
             ...delegation === undefined ? {} : { delegation },
             ...settings === undefined ? {} : { settings },
             ...cliDefault === undefined ? {} : { cliDefault },
-            ...this.deps.directory === undefined ? {} : { directory: extendModelDirectory(this.deps.directory(homeDir, this.deps.cwd?.(childSessionId)), [settings, cliDefault, ...discovered], this.deps.recentModels()) },
-            choices: dedupeChoices([settings, cliDefault, ...discovered, ...this.deps.catalog(homeDir, this.deps.cwd?.(childSessionId)), ...this.deps.recentModels()]),
+            ...this.deps.directory === undefined ? {} : { directory: extendModelDirectory(this.deps.directory(homeDir, this.deps.cwd?.(childSessionId)), [settings, cliDefault, ...discovered], curated.length > 0 ? [] : this.deps.recentModels()) },
+            choices: curated.length > 0 ? [...curated] : dedupeChoices([settings, cliDefault, ...discovered, ...this.deps.catalog(homeDir, this.deps.cwd?.(childSessionId)), ...this.deps.recentModels()]),
             live: this.deps.live(),
             switchable: !inFlight,
             ...inFlight ? { reason: '成员有进行中的委派轮次，等其完成后再切换模型' } : {},

package/lib/types/model-catalog.d.ts

@@ -1,8 +1,21 @@
-/** Native app-server model/list discovery. Shared core cache owns refresh,
- * stale data and subscriptions; this provider owns protocol and pagination. */
+/**
+ * The codex model directory: the VOCABULARY comes from the configured
+ * endpoint (`GET <baseUrl>/v1/models` with the resolved credential — the same
+ * probe the settings card's verify button runs), never from the CLI's local
+ * registry: a local list cannot prove what the endpoint serves, and showing
+ * it made a credential that does not work look valid. The native app-server
+ * `model/list` probe survives as METADATA ENRICHMENT only — it alone carries
+ * the display names, the hidden candidates, the reasoning-effort options and
+ * the `isDefault` slug (the CLI's compiled default), so it still runs
+ * CONCURRENTLY and folds into the entries whose ids the endpoint serves; its
+ * failure warns once and the endpoint data stands alone.
+ * Shared core cache owns refresh, stale data and subscriptions; this provider
+ * owns protocol and pagination (the native side).
+ */
 import type { SubprocessHandle, SubprocessSpawnSpec } from '@deepseek-ai/dsh-subprocess';
 import type { LocalAgentModelDirectory } from '@khorsheed/dsh-local-agent/types';
-/** Default overall bound for one catalog probe (spawn → model/list answer). */
+import { type CodexEndpointAuth, type EndpointCheckFetch } from './endpoint-auth.ts';
+/** Default overall bound for one NATIVE catalog probe (spawn → model/list answer). */
 export declare const DEFAULT_CATALOG_PROBE_TIMEOUT_MS = 5000;
 /** Default lifetime of a completed probe's cached answer, per scoped home. */
 export declare const DEFAULT_CATALOG_TTL_MS: number;
@@ -12,7 +25,17 @@ export interface CodexModelCatalogDeps {
     readonly spawn: (spec: SubprocessSpawnSpec) => SubprocessHandle;
     /** Diagnostic sink; a degraded probe warns once, never throws. */
     readonly warn?: (message: string) => void;
-    /** Overall probe bound; tests inject a small value. */
+    /**
+     * The scope's endpoint credential resolver: the endpoint probe (the
+     * directory's vocabulary) reads the credential through it, and the native
+     * probe routes its spawn at the same relay (custom provider overrides plus
+     * the key in the env), or model/list fails for a scope that has no other
+     * credential. Absent = the pre-endpoint probe shape.
+     */
+    readonly endpoint?: (scopeHome: string) => Promise<CodexEndpointAuth>;
+    /** The HTTP fetch for the endpoint probe (injected in tests). */
+    readonly fetchImpl?: EndpointCheckFetch;
+    /** The native probe's overall bound; when set it also bounds the endpoint fetch (unset, the fetch gets 4× the native default — 20s, mirroring claude's catalog timeout). Tests inject a small value. */
     readonly timeoutMs?: number;
     /** Completed-probe cache lifetime; tests inject a small value. */
     readonly ttlMs?: number;
@@ -34,11 +57,32 @@ export declare class CodexModelCatalog {
     dispose(): void;
     refresh(homeDir: string, cwd?: string): Promise<readonly string[]>;
     /**
-     * One bounded probe: spawn the app-server against the scoped home, answer
-     * the initialize handshake exactly as the live driver shapes it, ask
-     * `model/list`, then tear the process down (stdin EOF → grace →
-     * terminate). The overall timeout kills the process on expiry. Failures propagate to the shared cache, which preserves prior data.
+     * One directory load: the endpoint's served id list is the vocabulary (the
+     * card's add dialog can only offer what the endpoint answers), folded
+     * CONCURRENTLY with the native app-server probe's metadata. The endpoint
+     * answers are deliberate:
+     *
+     * - no credential resolved → empty with a "save a key first" reason;
+     * - 401/403 → empty with the rejection (definitive — cached as data);
+     * - another HTTP status → empty with it (the relay serves no model route);
+     * - a transport failure THROWS, so the cache keeps the last good list and
+     *   retries on schedule instead of blanking a momentarily-down endpoint
+     *   (the openproxy relay once 500'd and recovered — 2026-10-22).
+     *
+     * The native probe's failure never fails the load: endpoint data alone is
+     * complete (it warns once via the deps sink). The endpoint fetch gets a
+     * 20s ceiling by default (mirrors claude's catalog timeout); the native
+     * probe keeps its own tighter bound internally.
+     */
+    private load;
+    /**
+     * One bounded NATIVE probe — the metadata-enrichment side of {@link load}:
+     * spawn the app-server against the scoped home, answer the initialize
+     * handshake exactly as the live driver shapes it, ask `model/list`, then
+     * tear the process down (stdin EOF → grace → terminate). The overall
+     * timeout kills the process on expiry. Failures propagate to the caller
+     * (load demotes them to a warn).
      */
-    private probe;
+    private probeNative;
 }
 //# sourceMappingURL=model-catalog.d.ts.map

package/lib/types/model-catalog.js

@@ -1,15 +1,32 @@
-/** Native app-server model/list discovery. Shared core cache owns refresh,
- * stale data and subscriptions; this provider owns protocol and pagination. */
+/**
+ * The codex model directory: the VOCABULARY comes from the configured
+ * endpoint (`GET <baseUrl>/v1/models` with the resolved credential — the same
+ * probe the settings card's verify button runs), never from the CLI's local
+ * registry: a local list cannot prove what the endpoint serves, and showing
+ * it made a credential that does not work look valid. The native app-server
+ * `model/list` probe survives as METADATA ENRICHMENT only — it alone carries
+ * the display names, the hidden candidates, the reasoning-effort options and
+ * the `isDefault` slug (the CLI's compiled default), so it still runs
+ * CONCURRENTLY and folds into the entries whose ids the endpoint serves; its
+ * failure warns once and the endpoint data stands alone.
+ * Shared core cache owns refresh, stale data and subscriptions; this provider
+ * owns protocol and pagination (the native side).
+ */
 import { dirname, join } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { ModelDirectoryCache, modelDirectoryContextKey, delegationEnv } from '@khorsheed/dsh-local-agent';
 import { DEFAULT_DISPOSE_GRACE_MS } from './codex-cli-provider.js';
-/** Default overall bound for one catalog probe (spawn → model/list answer). */
+import { ENDPOINT_AUTH_FILE, endpointAuthEnv, endpointConfigOverrides, fetchEndpointModels, hasEndpointCredential, OFFICIAL_BASE_URL, } from './endpoint-auth.js';
+/** Default overall bound for one NATIVE catalog probe (spawn → model/list answer). */
 export const DEFAULT_CATALOG_PROBE_TIMEOUT_MS = 5_000;
 /** Default lifetime of a completed probe's cached answer, per scoped home. */
 export const DEFAULT_CATALOG_TTL_MS = 5 * 60_000;
 /** Grace between stdin EOF and terminate when the probe tears the process down. */
 const PROBE_EOF_GRACE_MS = 1_000;
+/** One directory answer that names why it is empty. */
+function unsupported(reason) {
+    return { entries: [], complete: false, customInput: true, unsupported: true, reason };
+}
 /** Preserve native metadata, including hidden candidates; reject malformed pages. */
 function catalogEntries(result) {
     const page = result;
@@ -61,7 +78,7 @@ export class CodexModelCatalog {
         this.cache = new ModelDirectoryCache({
             load: (key, signal) => {
                 const context = JSON.parse(key);
-                return this.probe(context.homeDir, context.cwd, signal);
+                return this.load(context.homeDir, context.cwd, signal);
             },
             ttlMs: deps.ttlMs ?? DEFAULT_CATALOG_TTL_MS,
             ...deps.now === undefined ? {} : { now: deps.now },
@@ -69,7 +86,9 @@ export class CodexModelCatalog {
         });
     }
     key(homeDir, cwd = homeDir) {
-        const files = [join(homeDir, 'config.toml'), join(homeDir, 'auth.json')];
+        // endpoint-auth.json re-keys the cache: a card credential write changes
+        // which catalog the probe would answer, so the next read re-probes.
+        const files = [join(homeDir, 'config.toml'), join(homeDir, 'auth.json'), join(homeDir, ENDPOINT_AUTH_FILE)];
         for (let directory = cwd;; directory = dirname(directory)) {
             files.push(join(directory, '.codex', 'config.toml'));
             if (dirname(directory) === directory)
@@ -90,18 +109,82 @@ export class CodexModelCatalog {
         return snapshot.entries.filter(entry => !entry.hidden).map(entry => entry.value);
     }
     /**
-     * One bounded probe: spawn the app-server against the scoped home, answer
-     * the initialize handshake exactly as the live driver shapes it, ask
-     * `model/list`, then tear the process down (stdin EOF → grace →
-     * terminate). The overall timeout kills the process on expiry. Failures propagate to the shared cache, which preserves prior data.
+     * One directory load: the endpoint's served id list is the vocabulary (the
+     * card's add dialog can only offer what the endpoint answers), folded
+     * CONCURRENTLY with the native app-server probe's metadata. The endpoint
+     * answers are deliberate:
+     *
+     * - no credential resolved → empty with a "save a key first" reason;
+     * - 401/403 → empty with the rejection (definitive — cached as data);
+     * - another HTTP status → empty with it (the relay serves no model route);
+     * - a transport failure THROWS, so the cache keeps the last good list and
+     *   retries on schedule instead of blanking a momentarily-down endpoint
+     *   (the openproxy relay once 500'd and recovered — 2026-10-22).
+     *
+     * The native probe's failure never fails the load: endpoint data alone is
+     * complete (it warns once via the deps sink). The endpoint fetch gets a
+     * 20s ceiling by default (mirrors claude's catalog timeout); the native
+     * probe keeps its own tighter bound internally.
+     */
+    async load(homeDir, cwd, signal) {
+        const endpoint = this.deps.endpoint === undefined
+            ? undefined
+            : await this.deps.endpoint(homeDir).catch(() => undefined);
+        if (!hasEndpointCredential(endpoint)) {
+            return unsupported('No endpoint credential configured — the model list loads from the endpoint once an API Key is saved');
+        }
+        const combined = AbortSignal.any([signal, AbortSignal.timeout(this.deps.timeoutMs ?? DEFAULT_CATALOG_PROBE_TIMEOUT_MS * 4)]);
+        const [result, native] = await Promise.all([
+            fetchEndpointModels({ ...endpoint, baseUrl: endpoint.baseUrl ?? OFFICIAL_BASE_URL }, this.deps.fetchImpl, combined),
+            this.probeNative(homeDir, cwd, combined).catch((error) => {
+                this.deps.warn?.(`local-agent-codex: the native model/list probe failed (metadata only — the endpoint's list stands): ${error instanceof Error ? error.message : String(error)}`);
+                return undefined;
+            }),
+        ]);
+        if (result.kind === 'unreachable') {
+            // Not a verdict: the cache keeps the last good list and retries.
+            throw new Error(`endpoint unreachable: ${result.message}`);
+        }
+        if (result.kind === 'malformed')
+            return unsupported('The endpoint answered but the model list did not parse (not /v1/models-shaped)');
+        if (result.kind === 'http') {
+            if (result.status === 401 || result.status === 403) {
+                return unsupported(`The endpoint rejected the credential (HTTP ${String(result.status)}) — the list loads once a valid key is saved`);
+            }
+            return unsupported(`The endpoint does not serve a model list (HTTP ${String(result.status)})`);
+        }
+        if (result.models.length === 0)
+            return unsupported('The endpoint serves no models');
+        const nativeByValue = new Map((native?.entries ?? []).map(entry => [entry.value, entry]));
+        // Served ids the native registry also knows carry its metadata over
+        // (label, description, hidden, reasoning — source stays 'native', which
+        // they are: the harness's own vocabulary, just read from the endpoint in
+        // force); ids only the endpoint serves are plain.
+        const entries = result.models.map(id => nativeByValue.get(id) ?? { value: id, label: id, source: 'native' });
+        const defaultModel = native?.defaultModel;
+        return {
+            entries, complete: true, customInput: true,
+            ...defaultModel === undefined ? {} : { defaultModel },
+        };
+    }
+    /**
+     * One bounded NATIVE probe — the metadata-enrichment side of {@link load}:
+     * spawn the app-server against the scoped home, answer the initialize
+     * handshake exactly as the live driver shapes it, ask `model/list`, then
+     * tear the process down (stdin EOF → grace → terminate). The overall
+     * timeout kills the process on expiry. Failures propagate to the caller
+     * (load demotes them to a warn).
      */
-    async probe(homeDir, cwd, signal) {
+    async probeNative(homeDir, cwd, signal) {
+        const endpoint = this.deps.endpoint === undefined
+            ? undefined
+            : await this.deps.endpoint(homeDir).catch(() => undefined);
         const spec = {
-            argv: ['codex', 'app-server', '--stdio'],
+            argv: ['codex', 'app-server', ...endpointConfigOverrides(endpoint), '--stdio'],
             cwd,
             stdio: { stdin: 'pipe', stdout: 'pipe', stderr: 'pipe' },
             graceMs: DEFAULT_DISPOSE_GRACE_MS,
-            env: delegationEnv({ CODEX_HOME: homeDir }),
+            env: delegationEnv({ CODEX_HOME: homeDir, ...endpointAuthEnv(endpoint) }),
         };
         const child = this.deps.spawn(spec);
         const decoder = new StringDecoder('utf8');

package/lib/types/provision.d.ts

@@ -1,18 +1,19 @@
 /**
- * Codex scoped-home provisioning: pin file-based credential storage so the
- * device-code login writes `auth.json` inside the scoped home. Codex's
- * `cli_auth_credentials_store` defaults to `auto` — on macOS that resolves
- * to the keychain, which would both leak credentials outside the scoped
- * home and defeat the `auth.json` presence check this package's records
- * adapter uses for authentication. An existing config is respected
- * untouched; sign-out removes the credential file.
+ * Codex scoped-home provisioning: a working `config.toml` (a person may edit
+ * it — custom providers, model, effort) plus the one-way sweep of the web
+ * login's leftover `auth.json`. The harness is endpoint-key only: a stale
+ * grant sitting next to an endpoint credential would keep authenticating the
+ * built-in provider while the status reads "unauthenticated", so provisioning
+ * deletes it on every boot (claude-code's OAuth-remnant sweep, same idea).
  * @module @khorsheed/dsh-local-agent-codex/provision
  */
 /**
- * Provision `<homeDir>/config.toml` unless one already exists. A present
- * config is respected untouched (a person may have edited it); otherwise a
- * minimal config pinning file-based credential storage is written so login
- * lands in the scoped home's `auth.json`.
+ * Provision the scoped home: ensure a `config.toml` exists (a minimal one —
+ * codex reads it for custom providers, model, and effort; the historical
+ * `cli_auth_credentials_store = "file"` pin stays so a hand-run `codex login`
+ * under the scoped home can never spill into the macOS keychain), and sweep
+ * the web login's leftover `auth.json` (the harness no longer consults it —
+ * endpoint key or nothing).
  * @param homeDir - the `codex` harness's scoped home.
  * @returns true when a config was written, false when one already existed.
  */
@@ -61,20 +62,4 @@ export declare function readCodexModel(homeDir: string): Promise<string | undefi
  * @returns the model identifiers the file carries.
  */
 export declare function listCodexConfigModels(homeDir: string): Promise<string[]>;
-/**
- * The credential file's modification stamp (epoch ms), undefined when absent.
- * A completed device-code login rewrites `auth.json`, so the stamp
- * distinguishes a fresh login from a leftover (possibly revoked) credential.
- * @param homeDir - the `codex` harness's scoped home.
- * @returns the marker's mtime, or undefined when no credential exists.
- */
-export declare function codexCredentialStamp(homeDir: string): Promise<number | undefined>;
-/**
- * Sign out of the scoped account: remove the credential file, so `/<name>
- * status` reports not authenticated and the next login authorizes a fresh
- * account. With `cli_auth_credentials_store = "file"` the credentials live
- * solely in `auth.json`, so removing it is the logout path.
- * @param homeDir - the `codex` harness's scoped home.
- */
-export declare function codexLogout(homeDir: string): Promise<void>;
 //# sourceMappingURL=provision.d.ts.map

package/lib/types/provision.js

@@ -1,31 +1,35 @@
 /**
- * Codex scoped-home provisioning: pin file-based credential storage so the
- * device-code login writes `auth.json` inside the scoped home. Codex's
- * `cli_auth_credentials_store` defaults to `auto` — on macOS that resolves
- * to the keychain, which would both leak credentials outside the scoped
- * home and defeat the `auth.json` presence check this package's records
- * adapter uses for authentication. An existing config is respected
- * untouched; sign-out removes the credential file.
+ * Codex scoped-home provisioning: a working `config.toml` (a person may edit
+ * it — custom providers, model, effort) plus the one-way sweep of the web
+ * login's leftover `auth.json`. The harness is endpoint-key only: a stale
+ * grant sitting next to an endpoint credential would keep authenticating the
+ * built-in provider while the status reads "unauthenticated", so provisioning
+ * deletes it on every boot (claude-code's OAuth-remnant sweep, same idea).
  * @module @khorsheed/dsh-local-agent-codex/provision
  */
-import { readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { readFile, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-/** Credential file inside the scoped home; its presence marks auth. */
-const AUTH_FILE = 'auth.json';
-/** Minimal scoped config: keep credentials in the scoped home. */
+/** Minimal scoped config: keep any hand-run login's credentials in the scoped home. */
 const SCOPED_CONFIG = `# Written by dsh-local-agent-codex: keep the device-code
 # credentials inside the scoped home (auth.json) instead of the OS keychain.
 cli_auth_credentials_store = "file"
 `;
+/** The web login's credential file, swept on every boot (endpoint-key only now). */
+const LEGACY_AUTH_FILE = 'auth.json';
 /**
- * Provision `<homeDir>/config.toml` unless one already exists. A present
- * config is respected untouched (a person may have edited it); otherwise a
- * minimal config pinning file-based credential storage is written so login
- * lands in the scoped home's `auth.json`.
+ * Provision the scoped home: ensure a `config.toml` exists (a minimal one —
+ * codex reads it for custom providers, model, and effort; the historical
+ * `cli_auth_credentials_store = "file"` pin stays so a hand-run `codex login`
+ * under the scoped home can never spill into the macOS keychain), and sweep
+ * the web login's leftover `auth.json` (the harness no longer consults it —
+ * endpoint key or nothing).
  * @param homeDir - the `codex` harness's scoped home.
  * @returns true when a config was written, false when one already existed.
  */
 export async function provisionCodexConfig(homeDir) {
+    // The sweep runs even when the config already exists: a leftover grant from
+    // the web-login era must not keep working past the upgrade.
+    await rm(join(homeDir, LEGACY_AUTH_FILE), { force: true });
     try {
         await readFile(join(homeDir, 'config.toml'));
         return false;
@@ -186,28 +190,3 @@ export async function listCodexConfigModels(homeDir) {
     }
     return found;
 }
-/**
- * The credential file's modification stamp (epoch ms), undefined when absent.
- * A completed device-code login rewrites `auth.json`, so the stamp
- * distinguishes a fresh login from a leftover (possibly revoked) credential.
- * @param homeDir - the `codex` harness's scoped home.
- * @returns the marker's mtime, or undefined when no credential exists.
- */
-export async function codexCredentialStamp(homeDir) {
-    try {
-        return (await stat(join(homeDir, AUTH_FILE))).mtimeMs;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Sign out of the scoped account: remove the credential file, so `/<name>
- * status` reports not authenticated and the next login authorizes a fresh
- * account. With `cli_auth_credentials_store = "file"` the credentials live
- * solely in `auth.json`, so removing it is the logout path.
- * @param homeDir - the `codex` harness's scoped home.
- */
-export async function codexLogout(homeDir) {
-    await rm(join(homeDir, AUTH_FILE), { force: true });
-}

package/lib/types/records.d.ts

@@ -13,13 +13,6 @@
  */
 import type { TokenUsage } from '@deepseek-ai/dsh-llm';
 import type { LocalAgentSessionRecord } from '@khorsheed/dsh-local-agent';
-/**
- * Whether the scoped home holds usable Codex credentials: the `auth.json`
- * file exists. Absent means the device-code flow has not completed.
- * @param homeDir - the `codex` harness's scoped home.
- * @returns true when credentials are present.
- */
-export declare function codexAuthenticated(homeDir: string): Promise<boolean>;
 /**
  * Parse the first line of a rollout file for the listing fields. Unknown or
  * malformed values yield an undefined record rather than failing the list.
@@ -42,10 +35,12 @@ export declare function listCodexSessions(homeDir: string): Promise<readonly Loc
  * `input_tokens` is the TOTAL input including cache hits (OpenAI-style
  * accounting, confirmed against `total_tokens` in the rollout token_count),
  * and `cached_input_tokens` is the cache-read subset — so the uncached
- * bucket subtracts the cached portion to avoid double counting. There is no
- * cache-write concept, so that bucket is omitted (the shared four-bucket
- * contract: uncached input, output, cache read, cache write — codex fills
- * the first three).
+ * bucket subtracts the cached portion to avoid double counting.
+ * `cached_input_tokens` rides every payload (zero included), so
+ * `cacheReadTokens` is written whenever the field is present — a reader can
+ * tell "no hits" from "not reported". Codex also reports cache creation
+ * (`cache_write_input_tokens`), mapped to `cacheWriteTokens` (the shared
+ * four-bucket contract: uncached input, output, cache read, cache write).
  * @param usage - the raw codex usage object (`turn.completed`'s `usage` or a
  *   rollout `token_count` `info.last_token_usage`/`total_token_usage`).
  * @returns the shared usage record.

package/lib/types/records.js

@@ -11,7 +11,7 @@
  * contents are always untrusted input.
  * @module @khorsheed/dsh-local-agent-codex/records
  */
-import { open, readFile, readdir } from 'node:fs/promises';
+import { open, readdir } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 /** Rollout files live under this directory inside the scoped home. */
 const SESSIONS_ROOT = 'sessions';
@@ -28,24 +28,6 @@ const FULL_BYTES = 8 * 1024 * 1024;
 const ROLLOUT_WINDOW_SLACK_MS = 5 * 60_000;
 /** Extra future slack for the window end (file timestamps may skew ahead). */
 const ROLLOUT_WINDOW_FUTURE_MS = 60_000;
-/**
- * Whether the scoped home holds usable Codex credentials: the `auth.json`
- * file exists. Absent means the device-code flow has not completed.
- * @param homeDir - the `codex` harness's scoped home.
- * @returns true when credentials are present.
- */
-export async function codexAuthenticated(homeDir) {
-    try {
-        await readFile(join(homeDir, 'auth.json'));
-        return true;
-    }
-    catch (error) {
-        // No auth file yet: not authenticated.
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
-    }
-}
 /**
  * Parse the first line of a rollout file for the listing fields. Unknown or
  * malformed values yield an undefined record rather than failing the list.
@@ -167,10 +149,12 @@ export async function listCodexSessions(homeDir) {
  * `input_tokens` is the TOTAL input including cache hits (OpenAI-style
  * accounting, confirmed against `total_tokens` in the rollout token_count),
  * and `cached_input_tokens` is the cache-read subset — so the uncached
- * bucket subtracts the cached portion to avoid double counting. There is no
- * cache-write concept, so that bucket is omitted (the shared four-bucket
- * contract: uncached input, output, cache read, cache write — codex fills
- * the first three).
+ * bucket subtracts the cached portion to avoid double counting.
+ * `cached_input_tokens` rides every payload (zero included), so
+ * `cacheReadTokens` is written whenever the field is present — a reader can
+ * tell "no hits" from "not reported". Codex also reports cache creation
+ * (`cache_write_input_tokens`), mapped to `cacheWriteTokens` (the shared
+ * four-bucket contract: uncached input, output, cache read, cache write).
  * @param usage - the raw codex usage object (`turn.completed`'s `usage` or a
  *   rollout `token_count` `info.last_token_usage`/`total_token_usage`).
  * @returns the shared usage record.
@@ -179,9 +163,12 @@ export function usageFromCodex(usage) {
     const raw = usage;
     const input = Number(raw.input_tokens);
     const cached = Number(raw.cached_input_tokens);
+    const cacheWrite = Number(raw.cache_write_input_tokens);
     const output = Number(raw.output_tokens);
+    // `input_tokens` already contains both cache buckets (total = input +
+    // output); the shared contract keeps the three input buckets disjoint.
     const uncached = Number.isFinite(input) && Number.isFinite(cached)
-        ? Math.max(0, input - cached)
+        ? Math.max(0, input - cached - (Number.isFinite(cacheWrite) ? cacheWrite : 0))
         : Number.isFinite(input)
             ? input
             : 0;
@@ -189,8 +176,10 @@ export function usageFromCodex(usage) {
         inputTokens: uncached,
         outputTokens: Number.isFinite(output) ? output : 0,
     };
-    if (Number.isFinite(cached) && cached > 0)
+    if (Number.isFinite(cached))
         usageRecord.cacheReadTokens = cached;
+    if (Number.isFinite(cacheWrite) && cacheWrite > 0)
+        usageRecord.cacheWriteTokens = cacheWrite;
     return usageRecord;
 }
 /**

package/locale/en.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "Codex Delegation",
-    "description": "Delegate coding tasks to your locally installed Codex CLI."
+    "title": "Local Codex Delegation",
+    "description": "Delegate coding tasks to this machine's Codex CLI."
   }
 }

package/locale/zh.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "Codex 委派",
-    "description": "把编码任务委派给本地 Codex CLI，在隔离作用域中运行。"
+    "title": "本机 Codex 委派",
+    "description": "把编码任务委派给本机的 Codex CLI，在隔离作用域中运行。"
   }
 }