@lyogvce/dsh-codex-subscription 0.0.0-stage → 0.2.0

package/lib/index.js

@@ -0,0 +1,666 @@
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import z from "@deepseek-ai/schemastery";
+import { LlmError, resolveImageAttachmentAccess } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { randomUUID } from "node:crypto";
+import { chmod, rename, writeFile } from "node:fs/promises";
+import { arch, homedir, platform, release } from "node:os";
+import { execFileSync } from "node:child_process";
+//#region src/auth.ts
+const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const TOKEN_REFRESH_LEAD_MS = 3e5;
+const TOKEN_REFRESH_TIMEOUT_MS = 3e4;
+function resolveCodexHome(envCodexHome = process.env.CODEX_HOME) {
+	const raw = typeof envCodexHome === "string" && envCodexHome.trim() !== "" ? envCodexHome.trim() : join(homedir(), ".codex");
+	return raw.startsWith("~/") ? join(homedir(), raw.slice(2)) : resolve(raw);
+}
+function decodeJwtPayload(token) {
+	if (typeof token !== "string") return void 0;
+	const parts = token.split(".");
+	const body = parts[1];
+	if (parts.length !== 3 || !body) return void 0;
+	try {
+		return JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+	} catch {
+		return;
+	}
+}
+function extractAccountId(parsed, accessToken) {
+	const fileAccountId = parsed?.tokens?.account_id;
+	if (typeof fileAccountId === "string" && fileAccountId.trim() !== "") return fileAccountId.trim();
+	const authClaim = decodeJwtPayload(accessToken)?.["https://api.openai.com/auth"];
+	if (authClaim && typeof authClaim === "object" && !Array.isArray(authClaim)) {
+		const jwtAccountId = authClaim.chatgpt_account_id;
+		if (typeof jwtAccountId === "string" && jwtAccountId.trim() !== "") return jwtAccountId.trim();
+	}
+}
+async function writeJsonAtomic(filePath, data) {
+	let targetPath = filePath;
+	try {
+		targetPath = realpathSync(filePath);
+	} catch {}
+	const tempPath = join(dirname(targetPath), `.auth.json.tmp-${process.pid}-${randomUUID()}`);
+	const content = `${JSON.stringify(data, null, 2)}\n`;
+	await writeFile(tempPath, content, {
+		encoding: "utf8",
+		mode: 384
+	});
+	await chmod(tempPath, 384).catch(() => {});
+	await rename(tempPath, targetPath);
+}
+function createAuthManager(options) {
+	const { getCodexHome } = options;
+	const fetchFn = options.fetchImpl ?? globalThis.fetch;
+	const nowFn = options.now ?? Date.now;
+	let inflightRefresh;
+	let memoryFallback;
+	function readAuthState() {
+		const authPath = join(getCodexHome(), "auth.json");
+		let rawText;
+		try {
+			rawText = readFileSync(authPath, "utf8");
+		} catch (error) {
+			if (memoryFallback?.authPath === authPath) return memoryFallback;
+			throw new LlmError(`无法读取 Codex 登录凭证 (${authPath})，请先在终端运行 codex login`, "MISSING_CREDENTIAL", { cause: error });
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(rawText);
+		} catch (error) {
+			if (memoryFallback?.authPath === authPath) return memoryFallback;
+			throw new LlmError(`Codex 凭证文件格式损坏 (${authPath})`, "INVALID_CREDENTIAL", { cause: error });
+		}
+		const accessToken = parsed?.tokens?.access_token;
+		if (typeof accessToken !== "string" || accessToken.trim() === "") {
+			if (memoryFallback?.authPath === authPath) return memoryFallback;
+			throw new LlmError(`Codex 未登录 (${authPath} 中无 access_token)，请运行 codex login`, "MISSING_CREDENTIAL");
+		}
+		if (memoryFallback?.authPath === authPath && memoryFallback.accessToken !== accessToken && isTokenFresh(memoryFallback.accessToken)) return memoryFallback;
+		return {
+			authPath,
+			parsed,
+			accessToken
+		};
+	}
+	function isTokenFresh(accessToken) {
+		const exp = decodeJwtPayload(accessToken)?.exp;
+		if (typeof exp !== "number" || !Number.isFinite(exp)) return true;
+		return exp * 1e3 - nowFn() > TOKEN_REFRESH_LEAD_MS;
+	}
+	async function refreshToken(authPath, rawAuth) {
+		const refreshTok = rawAuth?.tokens?.refresh_token;
+		if (typeof refreshTok !== "string" || refreshTok.trim() === "") throw new LlmError("Codex 凭证已过期且缺少 refresh_token，请重新运行 codex login", "AUTH_FAILED");
+		const response = await fetchFn(CODEX_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				client_id: CODEX_CLIENT_ID,
+				grant_type: "refresh_token",
+				refresh_token: refreshTok,
+				scope: "openid profile email"
+			}),
+			signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
+		});
+		if (!response.ok) throw new LlmError(`Codex Token 刷新失败 (HTTP ${response.status})，请重新运行 codex login`, "AUTH_FAILED");
+		const fresh = await response.json();
+		if (typeof fresh?.access_token !== "string" || fresh.access_token.trim() === "") throw new LlmError("Codex Token 刷新响应缺少 access_token", "AUTH_FAILED");
+		const nextAuth = {
+			...rawAuth,
+			tokens: {
+				...rawAuth.tokens ?? {},
+				access_token: fresh.access_token,
+				...typeof fresh.id_token === "string" && fresh.id_token !== "" ? { id_token: fresh.id_token } : {},
+				...typeof fresh.refresh_token === "string" && fresh.refresh_token !== "" ? { refresh_token: fresh.refresh_token } : {}
+			},
+			last_refresh: new Date(nowFn()).toISOString()
+		};
+		memoryFallback = {
+			authPath,
+			parsed: nextAuth,
+			accessToken: fresh.access_token
+		};
+		try {
+			await writeJsonAtomic(authPath, nextAuth);
+		} catch (error) {
+			console.error(`[dsh-codex-subscription] 写回刷新后的 Codex auth.json 失败 (${authPath}): ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return {
+			accessToken: fresh.access_token,
+			accountId: extractAccountId(nextAuth, fresh.access_token)
+		};
+	}
+	function toCredentials(state) {
+		return {
+			accessToken: state.accessToken,
+			accountId: extractAccountId(state.parsed, state.accessToken)
+		};
+	}
+	async function resolveCredentials() {
+		const current = readAuthState();
+		if (isTokenFresh(current.accessToken)) return toCredentials(current);
+		if (!inflightRefresh) inflightRefresh = (async () => {
+			const latest = readAuthState();
+			if (isTokenFresh(latest.accessToken)) return toCredentials(latest);
+			return refreshToken(latest.authPath, latest.parsed);
+		})().finally(() => {
+			inflightRefresh = void 0;
+		});
+		return inflightRefresh;
+	}
+	return {
+		resolveCredentials,
+		async resolveAccessToken() {
+			return (await resolveCredentials()).accessToken;
+		}
+	};
+}
+//#endregion
+//#region src/catalog.ts
+const PROVIDER = "openai-codex";
+const DISPLAY_NAME = "Codex";
+const DEFAULT_CLIENT_VERSION = "0.163.0";
+const THINKING_LEVELS = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const DEFAULT_DISABLED_MODELS = Object.freeze([
+	"gpt-6-sol",
+	"gpt-6-luna",
+	"gpt-5.6-sol",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna"
+]);
+function buildThinkingLevelMap(supportedLevels) {
+	const efforts = new Set((Array.isArray(supportedLevels) ? supportedLevels : []).map((item) => {
+		if (typeof item === "string") return item;
+		if (item !== null && typeof item === "object" && "effort" in item) {
+			const effort = item.effort;
+			return typeof effort === "string" ? effort : "";
+		}
+		return "";
+	}).filter((value) => value.length > 0));
+	const map = {};
+	for (const level of THINKING_LEVELS) if (level === "off") map.off = efforts.has("none") ? "none" : null;
+	else if (efforts.has(level) || level === "max" && efforts.has("ultra")) map[level] = level;
+	else map[level] = null;
+	return map;
+}
+function normalizeDefaultReasoningLevel(rawLevel, thinkingLevelMap) {
+	if (typeof rawLevel !== "string" || rawLevel.trim() === "") return void 0;
+	const trimmed = rawLevel.trim();
+	const mapped = trimmed === "none" ? "off" : trimmed === "ultra" ? "max" : trimmed;
+	return thinkingLevelMap[mapped] ? mapped : void 0;
+}
+function isVerbosity(value) {
+	return value === "low" || value === "medium" || value === "high";
+}
+function parseModelsCache(rawCache, baseModels, disabledModels = []) {
+	const disabledSet = new Set((Array.isArray(disabledModels) ? disabledModels : []).filter((id) => typeof id === "string").map((id) => id.trim()).filter(Boolean));
+	const clientVersion = typeof rawCache?.client_version === "string" && rawCache.client_version.trim() !== "" ? rawCache.client_version.trim() : DEFAULT_CLIENT_VERSION;
+	const rawModels = Array.isArray(rawCache?.models) ? rawCache.models : [];
+	const templateModel = baseModels.find((model) => model.id !== "gpt-5.3-codex-spark") ?? baseModels[0];
+	const visibleEntries = rawModels.filter((entry) => Boolean(entry && typeof entry.slug === "string" && entry.slug.trim() !== "")).filter((entry) => entry.visibility === "list" && !disabledSet.has(entry.slug.trim())).sort((a, b) => {
+		return (typeof a.priority === "number" && Number.isFinite(a.priority) ? a.priority : 0) - (typeof b.priority === "number" && Number.isFinite(b.priority) ? b.priority : 0);
+	});
+	const models = [];
+	const metadataById = new Map();
+	const seen = new Set();
+	for (const entry of visibleEntries) {
+		const id = entry.slug.trim();
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const base = baseModels.find((model) => model.id === id) ?? templateModel;
+		const contextWindow = typeof entry.context_window === "number" && Number.isSafeInteger(entry.context_window) && entry.context_window > 0 ? entry.context_window : typeof entry.max_context_window === "number" && Number.isSafeInteger(entry.max_context_window) && entry.max_context_window > 0 ? entry.max_context_window : base?.contextWindow ?? 272e3;
+		const maxTokens = Math.min(128e3, Math.max(32768, Math.floor(contextWindow / 4)));
+		const inputs = Array.isArray(entry.input_modalities) ? entry.input_modalities.filter((m) => m === "text" || m === "image") : ["text", "image"];
+		const thinkingLevelMap = buildThinkingLevelMap(entry.supported_reasoning_levels);
+		const hasReasoning = Object.entries(thinkingLevelMap).some(([k, v]) => k !== "off" && v !== null);
+		const supportVerbosity = entry.support_verbosity !== false;
+		const defaultVerbosity = isVerbosity(entry.default_verbosity) ? entry.default_verbosity : "low";
+		const defaultReasoningLevel = normalizeDefaultReasoningLevel(entry.default_reasoning_level, thinkingLevelMap);
+		metadataById.set(id, {
+			supportVerbosity,
+			defaultVerbosity,
+			defaultReasoningLevel
+		});
+		models.push({
+			...base ?? {},
+			id,
+			name: typeof entry.display_name === "string" && entry.display_name.trim() !== "" ? entry.display_name.trim() : id,
+			...typeof entry.description === "string" && entry.description.trim() !== "" ? { description: entry.description.trim() } : {},
+			api: "openai-codex-responses",
+			provider: PROVIDER,
+			baseUrl: "https://chatgpt.com/backend-api",
+			input: inputs.length > 0 ? inputs : ["text"],
+			contextWindow,
+			maxTokens,
+			reasoning: hasReasoning,
+			thinkingLevelMap,
+			cost: {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0
+			}
+		});
+	}
+	return {
+		clientVersion,
+		models,
+		metadataById
+	};
+}
+//#endregion
+//#region src/request.ts
+const FORBIDDEN_PAYLOAD_FIELDS = Object.freeze([
+	"max_output_tokens",
+	"max_completion_tokens",
+	"temperature",
+	"top_p",
+	"previous_response_id",
+	"user",
+	"safety_identifier",
+	"prompt_cache_options"
+]);
+let cachedOsLabel;
+function detectOsLabel() {
+	if (cachedOsLabel !== void 0) return cachedOsLabel;
+	const sys = platform();
+	if (sys === "darwin") try {
+		const parts = execFileSync("sw_vers", ["-productVersion"], {
+			encoding: "utf8",
+			timeout: 2e3
+		}).trim().split(".");
+		while (parts.length < 3) parts.push("0");
+		cachedOsLabel = `Mac OS ${parts.slice(0, 3).join(".")}`;
+		return cachedOsLabel;
+	} catch {
+		cachedOsLabel = "Mac OS";
+		return cachedOsLabel;
+	}
+	if (sys === "win32") {
+		cachedOsLabel = `Windows ${release()}`;
+		return cachedOsLabel;
+	}
+	cachedOsLabel = `Linux ${release()}`;
+	return cachedOsLabel;
+}
+function buildCodexUserAgent(version = DEFAULT_CLIENT_VERSION) {
+	const cpu = arch() === "arm64" ? "arm64" : arch() === "x64" ? "x86_64" : arch();
+	const term = platform() === "darwin" ? "Apple_Terminal/455" : platform() === "win32" ? "WindowsTerminal" : "xterm-256color";
+	return `codex_cli_rs/${version} (${detectOsLabel()}; ${cpu}) ${term}`;
+}
+function buildCodexHeaders(existingHeaders, clientVersion, sessionId) {
+	const headers = {};
+	for (const [key, value] of Object.entries(existingHeaders ?? {})) {
+		if (key.toLowerCase() === "user-agent") continue;
+		headers[key] = value;
+	}
+	headers.originator = "codex_cli_rs";
+	headers.version = clientVersion;
+	headers["User-Agent"] = buildCodexUserAgent(clientVersion);
+	if (typeof sessionId === "string" && sessionId.length > 0) headers["thread-id"] = sessionId;
+	return headers;
+}
+function sanitizeCodexPayload(payload, modelMeta) {
+	if (!payload || typeof payload !== "object") return payload;
+	const cleaned = { ...payload };
+	for (const field of FORBIDDEN_PAYLOAD_FIELDS) delete cleaned[field];
+	if (cleaned.service_tier !== "priority" && cleaned.service_tier !== "ultrafast") delete cleaned.service_tier;
+	const currentText = cleaned.text && typeof cleaned.text === "object" && !Array.isArray(cleaned.text) ? { ...cleaned.text } : void 0;
+	if (modelMeta?.supportVerbosity === false) {
+		if (currentText !== void 0) {
+			delete currentText.verbosity;
+			if (Object.keys(currentText).length === 0) delete cleaned.text;
+			else cleaned.text = currentText;
+		}
+	} else {
+		const verbosity = modelMeta?.defaultVerbosity ?? "low";
+		cleaned.text = {
+			...currentText ?? {},
+			verbosity
+		};
+	}
+	if (cleaned.reasoning === void 0 && modelMeta?.defaultReasoningLevel !== void 0 && modelMeta.defaultReasoningLevel !== "off") cleaned.reasoning = {
+		effort: modelMeta.defaultReasoningLevel,
+		summary: "auto"
+	};
+	if (cleaned.reasoning && typeof cleaned.reasoning === "object" && !Array.isArray(cleaned.reasoning)) {
+		const reasoningObj = cleaned.reasoning;
+		const effort = reasoningObj.effort === "ultra" ? "max" : reasoningObj.effort;
+		if (effort === "none") delete cleaned.include;
+		else {
+			cleaned.reasoning = {
+				...reasoningObj,
+				effort,
+				summary: reasoningObj.summary ?? "auto"
+			};
+			const include = Array.isArray(cleaned.include) ? [...cleaned.include] : [];
+			if (!include.includes("reasoning.encrypted_content")) include.push("reasoning.encrypted_content");
+			cleaned.include = include;
+		}
+	}
+	return cleaned;
+}
+//#endregion
+//#region src/usage.ts
+const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const USAGE_ROUTE_PATH = "/api/codex-subscription/usage";
+const DEFAULT_USAGE_TTL_MS = 6e4;
+const USAGE_FETCH_TIMEOUT_MS = 15e3;
+function clampPercent(value) {
+	return Math.max(0, Math.min(100, Math.round(value)));
+}
+function parseWindow(raw, fetchedAtMs) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	const usedRaw = record.used_percent;
+	if (typeof usedRaw !== "number" || !Number.isFinite(usedRaw)) return null;
+	const resetAtRaw = record.reset_at;
+	const resetAfterRaw = record.reset_after_seconds;
+	let resetAt = null;
+	if (typeof resetAtRaw === "number" && Number.isFinite(resetAtRaw) && resetAtRaw > 0) resetAt = Math.round(resetAtRaw);
+	else if (typeof resetAfterRaw === "number" && Number.isFinite(resetAfterRaw) && resetAfterRaw >= 0) resetAt = Math.floor(fetchedAtMs / 1e3) + Math.round(resetAfterRaw);
+	return {
+		usedPercent: clampPercent(usedRaw),
+		resetAt
+	};
+}
+function parseUsagePayload(raw, fetchedAt) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	const rateLimit = record.rate_limit;
+	if (!rateLimit || typeof rateLimit !== "object" || Array.isArray(rateLimit)) return null;
+	const rateRecord = rateLimit;
+	const primary = parseWindow(rateRecord.primary_window, fetchedAt);
+	if (primary === null) return null;
+	const secondary = parseWindow(rateRecord.secondary_window, fetchedAt);
+	return {
+		planType: typeof record.plan_type === "string" && record.plan_type.trim() !== "" ? record.plan_type.trim() : "plus",
+		limitReached: rateRecord.limit_reached === true || rateRecord.allowed === false || primary.usedPercent >= 100 || secondary !== null && secondary.usedPercent >= 100,
+		primary,
+		secondary,
+		fetchedAt
+	};
+}
+function createUsageFetcher(options) {
+	const fetchFn = options.fetchImpl ?? globalThis.fetch;
+	const nowFn = options.now ?? Date.now;
+	const ttlMs = options.ttlMs ?? 6e4;
+	let cached;
+	let stale = false;
+	let inflight;
+	async function fetchFresh() {
+		try {
+			const creds = await options.resolveCredentials();
+			const headers = options.buildHeaders({
+				Authorization: `Bearer ${creds.accessToken}`,
+				Accept: "application/json",
+				...creds.accountId !== void 0 ? { "ChatGPT-Account-Id": creds.accountId } : {}
+			});
+			const response = await fetchFn(CODEX_USAGE_URL, {
+				method: "GET",
+				headers,
+				signal: AbortSignal.timeout(USAGE_FETCH_TIMEOUT_MS)
+			});
+			if (!response.ok) return {
+				ok: false,
+				error: `Codex 限额查询失败 (HTTP ${response.status})`,
+				...cached !== void 0 ? { quota: cached } : {}
+			};
+			const parsed = parseUsagePayload(await response.json(), nowFn());
+			if (parsed === null) return {
+				ok: false,
+				error: "Codex 限额响应格式无法解析",
+				...cached !== void 0 ? { quota: cached } : {}
+			};
+			cached = parsed;
+			stale = false;
+			return {
+				ok: true,
+				quota: parsed
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error),
+				...cached !== void 0 ? { quota: cached } : {}
+			};
+		}
+	}
+	return {
+		invalidate() {
+			stale = true;
+		},
+		async getUsage(force = false) {
+			if (!force && !stale && cached !== void 0 && nowFn() - cached.fetchedAt < ttlMs) return {
+				ok: true,
+				quota: cached
+			};
+			if (!inflight) inflight = fetchFresh().finally(() => {
+				inflight = void 0;
+			});
+			return inflight;
+		}
+	};
+}
+//#endregion
+//#region src/index.ts
+const name = "codex-subscription";
+const inject = ["llm"];
+const STREAM_IDLE_TIMEOUT_MS = 3e5;
+const MAX_REQUEST_IMAGE_BYTES = 20971520;
+const REQUEST_IMAGE_PIXEL_BUDGET = 4194304;
+const REQUEST_IMAGE_MAX_BYTES = 1048576;
+const Config = z.object({ disabledModels: z.array(z.string()).default([...DEFAULT_DISABLED_MODELS]).description("在模型选择器中屏蔽的模型 slug 列表").volatile() });
+function readVolatile(field, fallback) {
+	const value = typeof field?.get === "function" ? field.get() : field;
+	return value === void 0 || value === null ? fallback : value;
+}
+var CodexPiAiAdapter = class extends PiAiAdapter {
+	#getModelMetadata;
+	constructor(options, getModelMetadata) {
+		super(options);
+		this.#getModelMetadata = getModelMetadata;
+	}
+	modelInfo(snapshot, provider, model) {
+		const info = super.modelInfo(snapshot, provider, model);
+		const defaultLevel = this.#getModelMetadata(model)?.defaultReasoningLevel;
+		if (defaultLevel !== void 0 && info.reasoning !== void 0 && info.reasoning.efforts.some((e) => e.id === defaultLevel)) return {
+			...info,
+			reasoning: {
+				...info.reasoning,
+				defaultEffort: defaultLevel
+			}
+		};
+		return info;
+	}
+};
+function apply(ctx, config = {}) {
+	const baseProvider = openaiCodexProvider();
+	const baseModels = baseProvider.getModels();
+	const getCodexHome = () => resolveCodexHome();
+	const getDisabledModels = () => readVolatile(config.disabledModels, DEFAULT_DISABLED_MODELS);
+	const authManager = createAuthManager({ getCodexHome });
+	let fileSignature;
+	let cachedRaw;
+	let warnedMissingFile = false;
+	let snapshotSignature;
+	let currentCatalog = {
+		clientVersion: DEFAULT_CLIENT_VERSION,
+		models: [],
+		metadataById: new Map()
+	};
+	let currentProfilesMap;
+	const requestTokenAuth = Object.freeze({
+		name: "Codex CLI auth.json token",
+		async resolve({ credential }) {
+			const token = credential?.key;
+			if (typeof token !== "string" || token.length === 0) return void 0;
+			return {
+				auth: { apiKey: token },
+				source: "codex-auth-json"
+			};
+		}
+	});
+	function wrapOptions(model, options = {}) {
+		const { catalog } = ensureSnapshot();
+		const modelMeta = catalog.metadataById.get(model?.id);
+		const { temperature: _temperature, onPayload, ...rest } = options;
+		return {
+			...rest,
+			transport: "sse",
+			headers: buildCodexHeaders(rest.headers, catalog.clientVersion, rest.sessionId),
+			async onPayload(payload, requestModel) {
+				return sanitizeCodexPayload(await onPayload?.(payload, requestModel) ?? payload, modelMeta);
+			}
+		};
+	}
+	const usageFetcher = createUsageFetcher({
+		resolveCredentials: () => authManager.resolveCredentials(),
+		buildHeaders: (authHeaders) => buildCodexHeaders(authHeaders, ensureSnapshot().catalog.clientVersion)
+	});
+	const piProvider = Object.freeze({
+		...baseProvider,
+		id: PROVIDER,
+		name: DISPLAY_NAME,
+		auth: Object.freeze({
+			...baseProvider.auth,
+			apiKey: requestTokenAuth
+		}),
+		getModels: () => ensureSnapshot().catalog.models,
+		stream: (model, context, options) => {
+			usageFetcher.invalidate();
+			return baseProvider.stream(model, context, wrapOptions(model, options));
+		},
+		streamSimple: (model, context, options) => {
+			usageFetcher.invalidate();
+			return baseProvider.streamSimple(model, context, wrapOptions(model, options));
+		}
+	});
+	function ensureSnapshot() {
+		const cachePath = join(getCodexHome(), "models_cache.json");
+		const disabled = getDisabledModels();
+		try {
+			const stat = statSync(cachePath);
+			const nextFileSig = `${cachePath}:${stat.mtimeMs}:${stat.size}`;
+			if (nextFileSig !== fileSignature) {
+				cachedRaw = JSON.parse(readFileSync(cachePath, "utf8"));
+				fileSignature = nextFileSig;
+				warnedMissingFile = false;
+			}
+		} catch (error) {
+			if (!warnedMissingFile) {
+				warnedMissingFile = true;
+				console.error(`[dsh-codex-subscription] 读取 Codex models_cache.json 失败 (${cachePath}): ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+		const nextSnapshotSig = JSON.stringify([fileSignature ?? "none", disabled]);
+		if (nextSnapshotSig !== snapshotSignature || currentProfilesMap === void 0) {
+			currentCatalog = cachedRaw !== void 0 ? parseModelsCache(cachedRaw, baseModels, disabled) : {
+				clientVersion: DEFAULT_CLIENT_VERSION,
+				models: [],
+				metadataById: new Map()
+			};
+			currentProfilesMap = new Map([[PROVIDER, Object.freeze({
+				provider: PROVIDER,
+				displayName: DISPLAY_NAME,
+				piProvider,
+				configuredMaxTokens: new Map(),
+				modelErrors: new Map(),
+				maxRequestImageBytes: MAX_REQUEST_IMAGE_BYTES,
+				requestImagePixelBudget: REQUEST_IMAGE_PIXEL_BUDGET,
+				requestImageMaxBytes: REQUEST_IMAGE_MAX_BYTES,
+				streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
+				cacheRetention: "short",
+				transport: "sse"
+			})]]);
+			snapshotSignature = nextSnapshotSig;
+		}
+		return {
+			catalog: currentCatalog,
+			profiles: currentProfilesMap
+		};
+	}
+	const adapter = new CodexPiAiAdapter({
+		profiles: () => ensureSnapshot().profiles,
+		resolveApiKey: (_provider, _profile) => authManager.resolveAccessToken(),
+		auth: Object.freeze({
+			credentials: {
+				async read() {},
+				async list() {
+					return [];
+				},
+				async modify() {},
+				async delete() {}
+			},
+			authContext: {
+				async env() {},
+				async fileExists() {
+					return false;
+				}
+			}
+		}),
+		resolveAttachments: () => ctx.get?.("attachments"),
+		resolveImageAccess: (attachments, ref) => resolveImageAttachmentAccess(attachments, (hostPath) => (ctx.get?.("fs"))?.processPathFromHostPath(hostPath), ref),
+		onReplayDegrade: (provider, model, reason) => {
+			console.error(`[dsh-codex-subscription] replay state for "${provider}/${model}" degraded (${reason})`);
+		}
+	}, (modelId) => ensureSnapshot().catalog.metadataById.get(modelId));
+	ctx.llm.registerAdapter([PROVIDER], adapter);
+	const mountUsageRoute = (connCtx) => {
+		const connection = connCtx.get?.("connection");
+		const registerFetch = connection?.fetch?.register;
+		if (typeof registerFetch !== "function") return;
+		const registerRoute = () => registerFetch.call(connection?.fetch, {
+			path: USAGE_ROUTE_PATH,
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				const force = new URL(request.url, "http://localhost").searchParams.get("force") === "1";
+				const result = await usageFetcher.getUsage(force);
+				return new Response(JSON.stringify(result), {
+					status: 200,
+					headers: { "content-type": "application/json" }
+				});
+			}
+		});
+		if (typeof connCtx.effect === "function") connCtx.effect(() => registerRoute(), "codex-subscription: usage route");
+		else registerRoute();
+	};
+	if (typeof ctx.inject === "function") ctx.inject(["connection"], mountUsageRoute);
+	else mountUsageRoute(ctx);
+	ctx.on?.("loader/volatile-update", () => {
+		ensureSnapshot();
+		ctx.llm.emitAdaptersUpdated?.();
+	});
+}
+const __test = Object.freeze({
+	PROVIDER,
+	DISPLAY_NAME,
+	DEFAULT_DISABLED_MODELS,
+	CODEX_USAGE_URL,
+	USAGE_ROUTE_PATH,
+	DEFAULT_USAGE_TTL_MS,
+	resolveCodexHome,
+	decodeJwtPayload,
+	extractAccountId,
+	createAuthManager,
+	buildThinkingLevelMap,
+	parseModelsCache,
+	sanitizeCodexPayload,
+	buildCodexHeaders,
+	buildCodexUserAgent,
+	parseUsagePayload,
+	createUsageFetcher
+});
+//#endregion
+export { Config, __test, apply, inject, name };

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Codex Subscription",
+    "description": "Reads local ~/.codex credentials and models_cache.json to call Codex subscription models directly over SSE."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Codex 订阅直连",
+    "description": "读取本机 ~/.codex 登录凭证与 models_cache.json，在 DSH 中通过 SSE 直连调用 Codex 订阅模型。"
+  }
+}