@lyogvce/dsh-codex-subscription 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,58 @@
-# Temporary Holding Version
+# dsh-codex-subscription
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+为 **DeepSeek Harness 桌面版**（DSH Desktop `0.2.1+`）提供极简、零后台进程的 **Codex 订阅直连能力**。**自用**。
+
+直接读取本机 `~/.codex/auth.json` 与 `~/.codex/models_cache.json`，在进程内通过 SSE 直连调用 ChatGPT Codex 订阅模型，彻底替代外部网关进程（如 Magpie）。
+
+---
+
+## 核心特性
+
+1. **与本机 Codex CLI / Desktop 100% 共享登录态**
+   - 直接读取 `$CODEX_HOME/auth.json`（默认 `~/.codex/auth.json`）。
+   - 每次请求前检查 `access_token` 的 JWT `exp`：距离过期不足 5 分钟时自动通过单飞锁（Single-flight）向 `https://auth.openai.com/oauth/token` 刷新，并通过 `realpathSync` + 临时文件 `rename` 原子写回 `auth.json`，保证与 Codex CLI 永不互踢下线。
+2. **零网络轮询的本地模型目录发现**
+   - 直接读取 `~/.codex/models_cache.json`（按文件 `mtime` 与大小自动感知更新），提取 `visibility === "list"` 的模型及其 `context_window`、`supported_reasoning_levels`（自动将 `ultra` 映射为 DSH 的 `max` 档位）与 `default_verbosity`。
+3. **支持按配置屏蔽不想看到的模型（`disabledModels`）**
+   - 在插件配置中通过 `disabledModels` 屏蔽指定模型 `slug`，保持模型选择器干净清爽。
+4. **原生多轮思考链回放与工具调用**
+   - 底层复用 DSH 内置的 `PiAiAdapter` 与 `@earendil-works/pi-ai` 的 `openaiCodexProvider()`，固定使用 `sse` 传输（含 `zstd` 请求体压缩、`session-id` / `thread-id` 缓存头、`reasoning.encrypted_content` 签名回放与图片自动缩放卸载）。
+
+---
+
+## 安装与配置
+
+### 1. 安装到本地 Profile
+
+在 DSH 中通过插件管理器安装本地目录 `/Users/lijiechengbj/projects/AI-agents/dsh-codex-subscription`，或执行：
+
+```bash
+dsh plugin --profile desktop add @lyogvce/dsh-codex-subscription
+```
+
+### 2. 配置屏蔽模型（`disabledModels`）
+
+默认配置（见 [cordis.patch.yml](cordis.patch.yml)）已屏蔽旧模型与备用模型，仅保留主力模型（如 `gpt-6.1-sol`、`gpt-6-astra`）：
+
+```yaml
+- id: codex-subscription
+  name: "@lyogvce/dsh-codex-subscription"
+  config:
+    disabledModels:
+      - gpt-6-sol
+      - gpt-6-luna
+      - gpt-5.6-sol
+      - gpt-5.6-terra
+      - gpt-5.6-luna
+```
+
+可在 DSH 的 **设置 → 插件 → Codex 订阅直连** 页面或 `cordis.patch.yml` 中随时修改 `disabledModels`，实时生效无需重启。
+
+---
+
+## 开发与验证
+
+```bash
+pnpm install
+pnpm verify   # 依次执行 tsc --noEmit、tsdown 构建、node --test 单测与产物卫生守卫、隔离脚本检查
+```

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+- insert:
+    - id: codex-subscription
+      name: "@lyogvce/dsh-codex-subscription"
+      config:
+        disabledModels:
+          - gpt-6-sol
+          - gpt-6-luna
+          - gpt-5.6-sol
+          - gpt-5.6-terra
+          - gpt-5.6-luna

package/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
+  <rect width="64" height="64" rx="16" fill="#0F172A"/>
+  <path d="M22 22L30 32L22 42" stroke="#38BDF8" stroke-width="4.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M34 42H44" stroke="#E2E8F0" stroke-width="4.5" stroke-linecap="round"/>
+  <circle cx="46" cy="20" r="4" fill="#34D399"/>
+</svg>

package/lib/index.d.ts

@@ -0,0 +1,91 @@
+import { PiCodexModel } from "@earendil-works/pi-ai/providers/openai-codex";
+//#region src/auth.d.ts
+interface JwtClaims {
+  exp?: number;
+  [key: string]: unknown;
+}
+interface AuthManagerOptions {
+  getCodexHome: () => string;
+  fetchImpl?: typeof fetch | undefined;
+  now?: (() => number) | undefined;
+}
+declare function resolveCodexHome(envCodexHome?: string | undefined): string;
+declare function decodeJwtPayload(token: unknown): JwtClaims | undefined;
+declare function createAuthManager(options: AuthManagerOptions): {
+  resolveAccessToken: () => Promise<string>;
+};
+//#endregion
+//#region src/catalog.d.ts
+interface RawReasoningLevel {
+  effort?: string;
+  description?: string;
+}
+interface RawCodexModelEntry {
+  slug?: string;
+  display_name?: string;
+  description?: string;
+  visibility?: string;
+  priority?: number;
+  context_window?: number;
+  max_context_window?: number;
+  input_modalities?: unknown[];
+  supported_reasoning_levels?: Array<string | RawReasoningLevel>;
+  default_reasoning_level?: string;
+  support_verbosity?: boolean;
+  default_verbosity?: string;
+}
+interface RawModelsCache {
+  client_version?: string;
+  models?: RawCodexModelEntry[];
+}
+interface CodexModelMetadata {
+  readonly supportVerbosity: boolean;
+  readonly defaultVerbosity: 'low' | 'medium' | 'high';
+  readonly defaultReasoningLevel?: string | undefined;
+}
+interface ParsedModelsCatalog {
+  readonly clientVersion: string;
+  readonly models: PiCodexModel[];
+  readonly metadataById: ReadonlyMap<string, CodexModelMetadata>;
+}
+declare function buildThinkingLevelMap(supportedLevels: unknown): Record<string, string | null>;
+declare function parseModelsCache(rawCache: RawModelsCache | null | undefined, baseModels: readonly PiCodexModel[], disabledModels?: readonly string[]): ParsedModelsCatalog;
+//#endregion
+//#region src/request.d.ts
+declare function buildCodexUserAgent(version?: string): string;
+declare function buildCodexHeaders(existingHeaders: Record<string, string> | undefined, clientVersion: string, sessionId?: string | undefined): Record<string, string>;
+declare function sanitizeCodexPayload(payload: Record<string, unknown> | null | undefined, modelMeta?: CodexModelMetadata | undefined): Record<string, unknown> | null | undefined;
+//#endregion
+//#region src/host-types.d.ts
+interface LlmServiceLike {
+  registerAdapter: (providers: string[], adapter: unknown) => (() => void) & {
+    replace?: (next: string[]) => void;
+  };
+  emitAdaptersUpdated?: () => void;
+}
+interface PluginContextLike {
+  llm: LlmServiceLike;
+  get?: (name: string) => unknown;
+  on?: (event: string, listener: () => void) => () => void;
+}
+//#endregion
+//#region src/index.d.ts
+export declare const name = "codex-subscription";
+export declare const inject: string[];
+export declare const Config: any;
+export declare function apply(ctx: PluginContextLike, config?: Record<string, unknown>): void;
+export declare const __test: Readonly<{
+  PROVIDER: "openai-codex";
+  DISPLAY_NAME: "Codex";
+  DEFAULT_DISABLED_MODELS: readonly string[];
+  resolveCodexHome: typeof resolveCodexHome;
+  decodeJwtPayload: typeof decodeJwtPayload;
+  createAuthManager: typeof createAuthManager;
+  buildThinkingLevelMap: typeof buildThinkingLevelMap;
+  parseModelsCache: typeof parseModelsCache;
+  sanitizeCodexPayload: typeof sanitizeCodexPayload;
+  buildCodexHeaders: typeof buildCodexHeaders;
+  buildCodexUserAgent: typeof buildCodexUserAgent;
+}>;
+//#endregion
+export type { CodexModelMetadata, ParsedModelsCatalog, PluginContextLike, RawModelsCache };

package/lib/index.js

@@ -0,0 +1,502 @@
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import z from "@deepseek-ai/schemastery";
+import { LlmError, resolveImageAttachmentAccess } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { randomUUID } from "node:crypto";
+import { chmod, rename, writeFile } from "node:fs/promises";
+import { arch, homedir, platform, release } from "node:os";
+import { execFileSync } from "node:child_process";
+//#region src/auth.ts
+const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const TOKEN_REFRESH_LEAD_MS = 3e5;
+const TOKEN_REFRESH_TIMEOUT_MS = 3e4;
+function resolveCodexHome(envCodexHome = process.env.CODEX_HOME) {
+	const raw = typeof envCodexHome === "string" && envCodexHome.trim() !== "" ? envCodexHome.trim() : join(homedir(), ".codex");
+	return raw.startsWith("~/") ? join(homedir(), raw.slice(2)) : resolve(raw);
+}
+function decodeJwtPayload(token) {
+	if (typeof token !== "string") return void 0;
+	const parts = token.split(".");
+	const body = parts[1];
+	if (parts.length !== 3 || !body) return void 0;
+	try {
+		return JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+	} catch {
+		return;
+	}
+}
+async function writeJsonAtomic(filePath, data) {
+	let targetPath = filePath;
+	try {
+		targetPath = realpathSync(filePath);
+	} catch {}
+	const tempPath = join(dirname(targetPath), `.auth.json.tmp-${process.pid}-${randomUUID()}`);
+	const content = `${JSON.stringify(data, null, 2)}\n`;
+	await writeFile(tempPath, content, {
+		encoding: "utf8",
+		mode: 384
+	});
+	await chmod(tempPath, 384).catch(() => {});
+	await rename(tempPath, targetPath);
+}
+function createAuthManager(options) {
+	const { getCodexHome } = options;
+	const fetchFn = options.fetchImpl ?? globalThis.fetch;
+	const nowFn = options.now ?? Date.now;
+	let inflightRefresh;
+	let memoryFallback;
+	function readAuthState() {
+		const authPath = join(getCodexHome(), "auth.json");
+		let rawText;
+		try {
+			rawText = readFileSync(authPath, "utf8");
+		} catch (error) {
+			if (memoryFallback?.authPath === authPath) return memoryFallback;
+			throw new LlmError(`无法读取 Codex 登录凭证 (${authPath})，请先在终端运行 codex login`, "MISSING_CREDENTIAL", { cause: error });
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(rawText);
+		} catch (error) {
+			if (memoryFallback?.authPath === authPath) return memoryFallback;
+			throw new LlmError(`Codex 凭证文件格式损坏 (${authPath})`, "INVALID_CREDENTIAL", { cause: error });
+		}
+		const accessToken = parsed?.tokens?.access_token;
+		if (typeof accessToken !== "string" || accessToken.trim() === "") {
+			if (memoryFallback?.authPath === authPath) return memoryFallback;
+			throw new LlmError(`Codex 未登录 (${authPath} 中无 access_token)，请运行 codex login`, "MISSING_CREDENTIAL");
+		}
+		if (memoryFallback?.authPath === authPath && memoryFallback.accessToken !== accessToken && isTokenFresh(memoryFallback.accessToken)) return memoryFallback;
+		return {
+			authPath,
+			parsed,
+			accessToken
+		};
+	}
+	function isTokenFresh(accessToken) {
+		const exp = decodeJwtPayload(accessToken)?.exp;
+		if (typeof exp !== "number" || !Number.isFinite(exp)) return true;
+		return exp * 1e3 - nowFn() > TOKEN_REFRESH_LEAD_MS;
+	}
+	async function refreshToken(authPath, rawAuth) {
+		const refreshTok = rawAuth?.tokens?.refresh_token;
+		if (typeof refreshTok !== "string" || refreshTok.trim() === "") throw new LlmError("Codex 凭证已过期且缺少 refresh_token，请重新运行 codex login", "AUTH_FAILED");
+		const response = await fetchFn(CODEX_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				client_id: CODEX_CLIENT_ID,
+				grant_type: "refresh_token",
+				refresh_token: refreshTok,
+				scope: "openid profile email"
+			}),
+			signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
+		});
+		if (!response.ok) throw new LlmError(`Codex Token 刷新失败 (HTTP ${response.status})，请重新运行 codex login`, "AUTH_FAILED");
+		const fresh = await response.json();
+		if (typeof fresh?.access_token !== "string" || fresh.access_token.trim() === "") throw new LlmError("Codex Token 刷新响应缺少 access_token", "AUTH_FAILED");
+		const nextAuth = {
+			...rawAuth,
+			tokens: {
+				...rawAuth.tokens ?? {},
+				access_token: fresh.access_token,
+				...typeof fresh.id_token === "string" && fresh.id_token !== "" ? { id_token: fresh.id_token } : {},
+				...typeof fresh.refresh_token === "string" && fresh.refresh_token !== "" ? { refresh_token: fresh.refresh_token } : {}
+			},
+			last_refresh: new Date(nowFn()).toISOString()
+		};
+		memoryFallback = {
+			authPath,
+			parsed: nextAuth,
+			accessToken: fresh.access_token
+		};
+		try {
+			await writeJsonAtomic(authPath, nextAuth);
+		} catch (error) {
+			console.error(`[dsh-codex-subscription] 写回刷新后的 Codex auth.json 失败 (${authPath}): ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return fresh.access_token;
+	}
+	return { async resolveAccessToken() {
+		const current = readAuthState();
+		if (isTokenFresh(current.accessToken)) return current.accessToken;
+		if (!inflightRefresh) inflightRefresh = (async () => {
+			const latest = readAuthState();
+			if (isTokenFresh(latest.accessToken)) return latest.accessToken;
+			return refreshToken(latest.authPath, latest.parsed);
+		})().finally(() => {
+			inflightRefresh = void 0;
+		});
+		return inflightRefresh;
+	} };
+}
+//#endregion
+//#region src/catalog.ts
+const PROVIDER = "openai-codex";
+const DISPLAY_NAME = "Codex";
+const DEFAULT_CLIENT_VERSION = "0.163.0";
+const THINKING_LEVELS = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const DEFAULT_DISABLED_MODELS = Object.freeze([
+	"gpt-6-sol",
+	"gpt-6-luna",
+	"gpt-5.6-sol",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna"
+]);
+function buildThinkingLevelMap(supportedLevels) {
+	const efforts = new Set((Array.isArray(supportedLevels) ? supportedLevels : []).map((item) => {
+		if (typeof item === "string") return item;
+		if (item !== null && typeof item === "object" && "effort" in item) {
+			const effort = item.effort;
+			return typeof effort === "string" ? effort : "";
+		}
+		return "";
+	}).filter((value) => value.length > 0));
+	const map = {};
+	for (const level of THINKING_LEVELS) if (level === "off") map.off = efforts.has("none") ? "none" : null;
+	else if (efforts.has(level) || level === "max" && efforts.has("ultra")) map[level] = level;
+	else map[level] = null;
+	return map;
+}
+function normalizeDefaultReasoningLevel(rawLevel, thinkingLevelMap) {
+	if (typeof rawLevel !== "string" || rawLevel.trim() === "") return void 0;
+	const trimmed = rawLevel.trim();
+	const mapped = trimmed === "none" ? "off" : trimmed === "ultra" ? "max" : trimmed;
+	return thinkingLevelMap[mapped] ? mapped : void 0;
+}
+function isVerbosity(value) {
+	return value === "low" || value === "medium" || value === "high";
+}
+function parseModelsCache(rawCache, baseModels, disabledModels = []) {
+	const disabledSet = new Set((Array.isArray(disabledModels) ? disabledModels : []).filter((id) => typeof id === "string").map((id) => id.trim()).filter(Boolean));
+	const clientVersion = typeof rawCache?.client_version === "string" && rawCache.client_version.trim() !== "" ? rawCache.client_version.trim() : DEFAULT_CLIENT_VERSION;
+	const rawModels = Array.isArray(rawCache?.models) ? rawCache.models : [];
+	const templateModel = baseModels.find((model) => model.id !== "gpt-5.3-codex-spark") ?? baseModels[0];
+	const visibleEntries = rawModels.filter((entry) => Boolean(entry && typeof entry.slug === "string" && entry.slug.trim() !== "")).filter((entry) => entry.visibility === "list" && !disabledSet.has(entry.slug.trim())).sort((a, b) => {
+		return (typeof a.priority === "number" && Number.isFinite(a.priority) ? a.priority : 0) - (typeof b.priority === "number" && Number.isFinite(b.priority) ? b.priority : 0);
+	});
+	const models = [];
+	const metadataById = new Map();
+	const seen = new Set();
+	for (const entry of visibleEntries) {
+		const id = entry.slug.trim();
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const base = baseModels.find((model) => model.id === id) ?? templateModel;
+		const contextWindow = typeof entry.context_window === "number" && Number.isSafeInteger(entry.context_window) && entry.context_window > 0 ? entry.context_window : typeof entry.max_context_window === "number" && Number.isSafeInteger(entry.max_context_window) && entry.max_context_window > 0 ? entry.max_context_window : base?.contextWindow ?? 272e3;
+		const maxTokens = Math.min(128e3, Math.max(32768, Math.floor(contextWindow / 4)));
+		const inputs = Array.isArray(entry.input_modalities) ? entry.input_modalities.filter((m) => m === "text" || m === "image") : ["text", "image"];
+		const thinkingLevelMap = buildThinkingLevelMap(entry.supported_reasoning_levels);
+		const hasReasoning = Object.entries(thinkingLevelMap).some(([k, v]) => k !== "off" && v !== null);
+		const supportVerbosity = entry.support_verbosity !== false;
+		const defaultVerbosity = isVerbosity(entry.default_verbosity) ? entry.default_verbosity : "low";
+		const defaultReasoningLevel = normalizeDefaultReasoningLevel(entry.default_reasoning_level, thinkingLevelMap);
+		metadataById.set(id, {
+			supportVerbosity,
+			defaultVerbosity,
+			defaultReasoningLevel
+		});
+		models.push({
+			...base ?? {},
+			id,
+			name: typeof entry.display_name === "string" && entry.display_name.trim() !== "" ? entry.display_name.trim() : id,
+			...typeof entry.description === "string" && entry.description.trim() !== "" ? { description: entry.description.trim() } : {},
+			api: "openai-codex-responses",
+			provider: PROVIDER,
+			baseUrl: "https://chatgpt.com/backend-api",
+			input: inputs.length > 0 ? inputs : ["text"],
+			contextWindow,
+			maxTokens,
+			reasoning: hasReasoning,
+			thinkingLevelMap,
+			cost: {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0
+			}
+		});
+	}
+	return {
+		clientVersion,
+		models,
+		metadataById
+	};
+}
+//#endregion
+//#region src/request.ts
+const FORBIDDEN_PAYLOAD_FIELDS = Object.freeze([
+	"max_output_tokens",
+	"max_completion_tokens",
+	"temperature",
+	"top_p",
+	"previous_response_id",
+	"user",
+	"safety_identifier",
+	"prompt_cache_options"
+]);
+let cachedOsLabel;
+function detectOsLabel() {
+	if (cachedOsLabel !== void 0) return cachedOsLabel;
+	const sys = platform();
+	if (sys === "darwin") try {
+		const parts = execFileSync("sw_vers", ["-productVersion"], {
+			encoding: "utf8",
+			timeout: 2e3
+		}).trim().split(".");
+		while (parts.length < 3) parts.push("0");
+		cachedOsLabel = `Mac OS ${parts.slice(0, 3).join(".")}`;
+		return cachedOsLabel;
+	} catch {
+		cachedOsLabel = "Mac OS";
+		return cachedOsLabel;
+	}
+	if (sys === "win32") {
+		cachedOsLabel = `Windows ${release()}`;
+		return cachedOsLabel;
+	}
+	cachedOsLabel = `Linux ${release()}`;
+	return cachedOsLabel;
+}
+function buildCodexUserAgent(version = DEFAULT_CLIENT_VERSION) {
+	const cpu = arch() === "arm64" ? "arm64" : arch() === "x64" ? "x86_64" : arch();
+	const term = platform() === "darwin" ? "Apple_Terminal/455" : platform() === "win32" ? "WindowsTerminal" : "xterm-256color";
+	return `codex_cli_rs/${version} (${detectOsLabel()}; ${cpu}) ${term}`;
+}
+function buildCodexHeaders(existingHeaders, clientVersion, sessionId) {
+	const headers = {};
+	for (const [key, value] of Object.entries(existingHeaders ?? {})) {
+		if (key.toLowerCase() === "user-agent") continue;
+		headers[key] = value;
+	}
+	headers.originator = "codex_cli_rs";
+	headers.version = clientVersion;
+	headers["User-Agent"] = buildCodexUserAgent(clientVersion);
+	if (typeof sessionId === "string" && sessionId.length > 0) headers["thread-id"] = sessionId;
+	return headers;
+}
+function sanitizeCodexPayload(payload, modelMeta) {
+	if (!payload || typeof payload !== "object") return payload;
+	const cleaned = { ...payload };
+	for (const field of FORBIDDEN_PAYLOAD_FIELDS) delete cleaned[field];
+	if (cleaned.service_tier !== "priority" && cleaned.service_tier !== "ultrafast") delete cleaned.service_tier;
+	const currentText = cleaned.text && typeof cleaned.text === "object" && !Array.isArray(cleaned.text) ? { ...cleaned.text } : void 0;
+	if (modelMeta?.supportVerbosity === false) {
+		if (currentText !== void 0) {
+			delete currentText.verbosity;
+			if (Object.keys(currentText).length === 0) delete cleaned.text;
+			else cleaned.text = currentText;
+		}
+	} else {
+		const verbosity = modelMeta?.defaultVerbosity ?? "low";
+		cleaned.text = {
+			...currentText ?? {},
+			verbosity
+		};
+	}
+	if (cleaned.reasoning === void 0 && modelMeta?.defaultReasoningLevel !== void 0 && modelMeta.defaultReasoningLevel !== "off") cleaned.reasoning = {
+		effort: modelMeta.defaultReasoningLevel,
+		summary: "auto"
+	};
+	if (cleaned.reasoning && typeof cleaned.reasoning === "object" && !Array.isArray(cleaned.reasoning)) {
+		const reasoningObj = cleaned.reasoning;
+		const effort = reasoningObj.effort === "ultra" ? "max" : reasoningObj.effort;
+		if (effort === "none") delete cleaned.include;
+		else {
+			cleaned.reasoning = {
+				...reasoningObj,
+				effort,
+				summary: reasoningObj.summary ?? "auto"
+			};
+			const include = Array.isArray(cleaned.include) ? [...cleaned.include] : [];
+			if (!include.includes("reasoning.encrypted_content")) include.push("reasoning.encrypted_content");
+			cleaned.include = include;
+		}
+	}
+	return cleaned;
+}
+//#endregion
+//#region src/index.ts
+const name = "codex-subscription";
+const inject = ["llm"];
+const STREAM_IDLE_TIMEOUT_MS = 3e5;
+const MAX_REQUEST_IMAGE_BYTES = 20971520;
+const REQUEST_IMAGE_PIXEL_BUDGET = 4194304;
+const REQUEST_IMAGE_MAX_BYTES = 1048576;
+const Config = z.object({ disabledModels: z.array(z.string()).default([...DEFAULT_DISABLED_MODELS]).description("在模型选择器中屏蔽的模型 slug 列表").volatile() });
+function readVolatile(field, fallback) {
+	const value = typeof field?.get === "function" ? field.get() : field;
+	return value === void 0 || value === null ? fallback : value;
+}
+var CodexPiAiAdapter = class extends PiAiAdapter {
+	#getModelMetadata;
+	constructor(options, getModelMetadata) {
+		super(options);
+		this.#getModelMetadata = getModelMetadata;
+	}
+	modelInfo(snapshot, provider, model) {
+		const info = super.modelInfo(snapshot, provider, model);
+		const defaultLevel = this.#getModelMetadata(model)?.defaultReasoningLevel;
+		if (defaultLevel !== void 0 && info.reasoning !== void 0 && info.reasoning.efforts.some((e) => e.id === defaultLevel)) return {
+			...info,
+			reasoning: {
+				...info.reasoning,
+				defaultEffort: defaultLevel
+			}
+		};
+		return info;
+	}
+};
+function apply(ctx, config = {}) {
+	const baseProvider = openaiCodexProvider();
+	const baseModels = baseProvider.getModels();
+	const getCodexHome = () => resolveCodexHome();
+	const getDisabledModels = () => readVolatile(config.disabledModels, DEFAULT_DISABLED_MODELS);
+	const authManager = createAuthManager({ getCodexHome });
+	let fileSignature;
+	let cachedRaw;
+	let warnedMissingFile = false;
+	let snapshotSignature;
+	let currentCatalog = {
+		clientVersion: DEFAULT_CLIENT_VERSION,
+		models: [],
+		metadataById: new Map()
+	};
+	let currentProfilesMap;
+	const requestTokenAuth = Object.freeze({
+		name: "Codex CLI auth.json token",
+		async resolve({ credential }) {
+			const token = credential?.key;
+			if (typeof token !== "string" || token.length === 0) return void 0;
+			return {
+				auth: { apiKey: token },
+				source: "codex-auth-json"
+			};
+		}
+	});
+	function wrapOptions(model, options = {}) {
+		const { catalog } = ensureSnapshot();
+		const modelMeta = catalog.metadataById.get(model?.id);
+		const { temperature: _temperature, onPayload, ...rest } = options;
+		return {
+			...rest,
+			transport: "sse",
+			headers: buildCodexHeaders(rest.headers, catalog.clientVersion, rest.sessionId),
+			async onPayload(payload, requestModel) {
+				return sanitizeCodexPayload(await onPayload?.(payload, requestModel) ?? payload, modelMeta);
+			}
+		};
+	}
+	const piProvider = Object.freeze({
+		...baseProvider,
+		id: PROVIDER,
+		name: DISPLAY_NAME,
+		auth: Object.freeze({
+			...baseProvider.auth,
+			apiKey: requestTokenAuth
+		}),
+		getModels: () => ensureSnapshot().catalog.models,
+		stream: (model, context, options) => baseProvider.stream(model, context, wrapOptions(model, options)),
+		streamSimple: (model, context, options) => baseProvider.streamSimple(model, context, wrapOptions(model, options))
+	});
+	function ensureSnapshot() {
+		const cachePath = join(getCodexHome(), "models_cache.json");
+		const disabled = getDisabledModels();
+		try {
+			const stat = statSync(cachePath);
+			const nextFileSig = `${cachePath}:${stat.mtimeMs}:${stat.size}`;
+			if (nextFileSig !== fileSignature) {
+				cachedRaw = JSON.parse(readFileSync(cachePath, "utf8"));
+				fileSignature = nextFileSig;
+				warnedMissingFile = false;
+			}
+		} catch (error) {
+			if (!warnedMissingFile) {
+				warnedMissingFile = true;
+				console.error(`[dsh-codex-subscription] 读取 Codex models_cache.json 失败 (${cachePath}): ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+		const nextSnapshotSig = JSON.stringify([fileSignature ?? "none", disabled]);
+		if (nextSnapshotSig !== snapshotSignature || currentProfilesMap === void 0) {
+			currentCatalog = cachedRaw !== void 0 ? parseModelsCache(cachedRaw, baseModels, disabled) : {
+				clientVersion: DEFAULT_CLIENT_VERSION,
+				models: [],
+				metadataById: new Map()
+			};
+			currentProfilesMap = new Map([[PROVIDER, Object.freeze({
+				provider: PROVIDER,
+				displayName: DISPLAY_NAME,
+				piProvider,
+				configuredMaxTokens: new Map(),
+				modelErrors: new Map(),
+				maxRequestImageBytes: MAX_REQUEST_IMAGE_BYTES,
+				requestImagePixelBudget: REQUEST_IMAGE_PIXEL_BUDGET,
+				requestImageMaxBytes: REQUEST_IMAGE_MAX_BYTES,
+				streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
+				cacheRetention: "short",
+				transport: "sse"
+			})]]);
+			snapshotSignature = nextSnapshotSig;
+		}
+		return {
+			catalog: currentCatalog,
+			profiles: currentProfilesMap
+		};
+	}
+	const adapter = new CodexPiAiAdapter({
+		profiles: () => ensureSnapshot().profiles,
+		resolveApiKey: (_provider, _profile) => authManager.resolveAccessToken(),
+		auth: Object.freeze({
+			credentials: {
+				async read() {},
+				async list() {
+					return [];
+				},
+				async modify() {},
+				async delete() {}
+			},
+			authContext: {
+				async env() {},
+				async fileExists() {
+					return false;
+				}
+			}
+		}),
+		resolveAttachments: () => ctx.get?.("attachments"),
+		resolveImageAccess: (attachments, ref) => resolveImageAttachmentAccess(attachments, (hostPath) => (ctx.get?.("fs"))?.processPathFromHostPath(hostPath), ref),
+		onReplayDegrade: (provider, model, reason) => {
+			console.error(`[dsh-codex-subscription] replay state for "${provider}/${model}" degraded (${reason})`);
+		}
+	}, (modelId) => ensureSnapshot().catalog.metadataById.get(modelId));
+	ctx.llm.registerAdapter([PROVIDER], adapter);
+	ctx.on?.("loader/volatile-update", () => {
+		ensureSnapshot();
+		ctx.llm.emitAdaptersUpdated?.();
+	});
+}
+const __test = Object.freeze({
+	PROVIDER,
+	DISPLAY_NAME,
+	DEFAULT_DISABLED_MODELS,
+	resolveCodexHome,
+	decodeJwtPayload,
+	createAuthManager,
+	buildThinkingLevelMap,
+	parseModelsCache,
+	sanitizeCodexPayload,
+	buildCodexHeaders,
+	buildCodexUserAgent
+});
+//#endregion
+export { Config, __test, apply, inject, name };

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Codex Subscription",
+    "description": "Reads local ~/.codex credentials and models_cache.json to call Codex subscription models directly over SSE."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Codex 订阅直连",
+    "description": "读取本机 ~/.codex 登录凭证与 models_cache.json，在 DSH 中通过 SSE 直连调用 Codex 订阅模型。"
+  }
+}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@lyogvce/dsh-codex-subscription",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "复用本机 ~/.codex 订阅凭证与 models_cache.json 模型缓存，在 DSH 中通过 SSE 直连调用 Codex 模型。",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "icon": "./icon.svg",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "lib",
+    "locale",
+    "icon.svg",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-llm": "*",
+    "@deepseek-ai/dsh-llm-pi-ai": "*",
+    "@deepseek-ai/schemastery": "*",
+    "@earendil-works/pi-ai": "*"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "tsdown": "0.23.0",
+    "typescript": "5.9.3"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "typecheck": "tsc --noEmit",
+    "pretest": "pnpm build",
+    "test": "node --test tests/*.test.mjs",
+    "test:isolation": "./tools/test-isolation.sh",
+    "verify": "pnpm typecheck && pnpm test && pnpm test:isolation",
+    "prepack": "pnpm build",
+    "prepublishOnly": "pnpm verify"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "codex",
+    "openai-codex",
+    "subscription"
+  ]
+}