@lyogvce/dsh-codex-subscription 0.2.11 → 0.2.12

package/README.md

@@ -19,8 +19,8 @@
    - 在插件配置中通过 `disabledModels` 屏蔽指定模型 `slug`，保持模型选择器干净清爽。
    - 通过 `contextWindows` 按模型 `slug` 自定义向 DSH 会话与自动压缩器暴露的预算窗口（例如设为 `400000`）；未配置时默认使用模型物理上限 `max_context_window`（`872000`）。同时底层 `PiCodexModel.contextWindow` 始终保持物理上限 `872000`，彻底防止 `dsh-llm-pi-ai` 在预算窗口与物理上限之间误判 `CONTEXT_WINDOW_EXCEEDED`。
    - 通过 `retryPolicy` 暴露 DSH 原生 `RetryPolicySchema`（支持 `normal` / `always` 模式、`maxRetries`、`retryableCodes` 与 `backoff`，并随 `registration.replace` 热更新生效）。未配置时保持宿主默认策略（`mode: "normal"`、`maxRetries: 5`、默认 5 类错误码 `EMPTY_RESPONSE / RATE_LIMIT / SERVER / TIMEOUT / TRANSPORT` 及 `500ms..10000ms` 退避）。**注意：`retryableCodes` 为完整覆盖集合而非追加列表**，显式配置时需同时列出默认错误码与新增错误码。
-4. **原生多轮思考链回放与工具调用**
-   - 底层复用 DSH 内置的 `PiAiAdapter` 与 `@earendil-works/pi-ai` 的 `openaiCodexProvider()`，固定使用 `sse` 传输（含 `zstd` 请求体压缩、规范化纯 UUID `session-id` / `x-client-request-id` 缓存头、`reasoning.encrypted_content` 签名回放与图片自动缩放卸载）。
+4. **原生多轮思考链回放、工具调用与出站指纹净化**
+   - 底层复用 DSH 内置的 `PiAiAdapter` 与 `@earendil-works/pi-ai` 的 `openaiCodexProvider()`，固定使用 `sse` 传输（含 `zstd` 请求体压缩、规范化 36 位 RFC 4122 UUID `session-id` 缓存头与 `prompt_cache_key`、`reasoning.encrypted_content` 签名回放与图片自动缩放卸载），并通过自定义 `fetch` 与 `onPayload` 剥除 `OpenAI-Beta: responses=experimental`、静态 `x-client-request-id`、`msg_pi_*` 等非官方指纹。
 5. **Codex 订阅限额内联展示与 ⚡ Fast 极速模式一键切换（`conversation.input.right`）**
    - 当会话选中 `openai-codex` 模型时，在输入框右下角紧邻模型选择器左侧展示限额胶囊（根据 `wham/usage` 返回的 `limit_window_seconds` 自适应展示 Plus 的 `5h X% · 7d Y%` 双窗口或 Pro 的 `7d X%` 单窗口，内置 60 秒缓存、单飞合并与每轮回复结束自动刷新），点击可展开查看对应窗口进度条、重置倒计时与手动刷新按钮；切换至其他 Provider 模型时自动隐藏。
    - **⚡ 会话树级 Fast 极速模式（`service_tier: "priority"`，最高 2x 推理速度，主会话与 Subagent / 智能体团队同开同关）**：每个主会话可在限额弹窗底部独立开关 Fast 模式（不同主会话互不影响，新会话默认继承插件设置中的 `fastMode`，未配置时默认 `false` 关闭），该主会话派生的所有 `subagent`、`subagent_fork`、`workflow` 子任务以及智能体团队成员（`spawn_teammate`）均自动绑定至同一主会话开关，实时联动、同开同关；状态自动持久化至 `~/.codex/cache/dsh-codex-subscription/runtime-state.json`。开启后胶囊显示闪电标识 `⚡`，并在请求体中自动注入 `"service_tier": "priority"`。
@@ -59,7 +59,7 @@ dsh plugin --profile desktop add @lyogvce/dsh-codex-subscription
     retryPolicy:
       mode: normal
       maxRetries: 5
-      retryableCodes: [ EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, QUOTA, ACCOUNT_QUOTA, AUTH, INVALID_REQUEST, PI_AI_ERROR, STREAM_CLOSED, MALFORMED_RESPONSE ]
+      retryableCodes: [ EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT, STREAM_CLOSED ]
 ```
 
 可在 DSH 的 **设置 → 插件 → Codex 订阅直连** 页面或 `cordis.patch.yml` 中随时修改 `disabledModels`、`contextWindows` 与 `retryPolicy`，实时热更新生效无需重启。

package/lib/index.d.ts

@@ -59,6 +59,7 @@ interface CodexResolvedCredentials {
 declare function createAuthManager(options: AuthManagerOptions): {
   resolveCredentials: () => Promise<CodexResolvedCredentials>;
   resolveAccessToken: () => Promise<string>;
+  getLastKnownAccountId: () => string | undefined;
 };
 //#endregion
 //#region src/catalog.d.ts
@@ -114,8 +115,14 @@ declare function buildThinkingLevelMap(supportedLevels: unknown): Record<string,
 declare function parseModelsCache(rawCache: RawModelsCache | null | undefined, baseModels: readonly PiCodexModel[], disabledModels?: readonly string[], contextWindows?: Readonly<Record<string, number>>): ParsedModelsCatalog;
 //#endregion
 //#region src/request.d.ts
+declare function toCodexWireSessionId(sessionId: string | undefined): string | undefined;
 declare function buildCodexUserAgent(version?: string): string;
 declare function buildCodexHeaders(existingHeaders?: Record<string, string> | undefined, clientVersion?: string): Record<string, string>;
+interface CodexResponsesFetchOptions {
+  readonly baseFetch?: typeof fetch | undefined;
+  readonly getAccountId?: (() => string | undefined) | undefined;
+}
+declare function createCodexResponsesFetch(options?: CodexResponsesFetchOptions): typeof fetch;
 declare function sanitizeCodexPayload(payload: Record<string, unknown> | null | undefined, modelMeta?: CodexModelMetadata | undefined, fastMode?: boolean): Record<string, unknown> | null | undefined;
 //#endregion
 //#region src/usage.d.ts
@@ -152,6 +159,7 @@ interface UsageFetcherOptions {
   readonly fetchImpl?: typeof fetch | undefined;
   readonly now?: (() => number) | undefined;
   readonly ttlMs?: number | undefined;
+  readonly minForceIntervalMs?: number | undefined;
 }
 declare function parseUsagePayload(raw: unknown, fetchedAt: number): CodexQuotaSnapshot | null;
 declare function createUsageFetcher(options: UsageFetcherOptions): {
@@ -185,7 +193,9 @@ export declare const __test: Readonly<{
   sanitizeCodexPayload: typeof sanitizeCodexPayload;
   buildCodexHeaders: typeof buildCodexHeaders;
   buildCodexUserAgent: typeof buildCodexUserAgent;
+  createCodexResponsesFetch: typeof createCodexResponsesFetch;
   normalizeCodexSessionId: typeof normalizeCodexSessionId;
+  toCodexWireSessionId: typeof toCodexWireSessionId;
   parseUsagePayload: typeof parseUsagePayload;
   createUsageFetcher: typeof createUsageFetcher;
 }>;

package/lib/index.js

@@ -4,7 +4,7 @@ import z from "@deepseek-ai/schemastery";
 import { LlmError, RetryPolicySchema, resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { chmod, rename, writeFile } from "node:fs/promises";
 import { arch, homedir, platform, release } from "node:os";
 import { execFileSync } from "node:child_process";
@@ -155,8 +155,15 @@ function parseModelsCache(rawCache, baseModels, disabledModels = [], contextWind
 			defaultReasoningLevel,
 			fastServiceTier
 		});
+		const rawCompat = base?.compat;
+		let sanitizedCompat;
+		if (rawCompat && typeof rawCompat === "object" && !Array.isArray(rawCompat)) {
+			const { supportsAdditionalTools: _supportsAdditionalTools, supportsToolSearch: _supportsToolSearch, ...restCompat } = rawCompat;
+			sanitizedCompat = restCompat;
+		}
 		models.push({
 			...base ?? {},
+			...sanitizedCompat !== void 0 ? { compat: sanitizedCompat } : {},
 			id,
 			name: typeof entry.display_name === "string" && entry.display_name.trim() !== "" ? entry.display_name.trim() : id,
 			...typeof entry.description === "string" && entry.description.trim() !== "" ? { description: entry.description.trim() } : {},
@@ -184,6 +191,33 @@ function parseModelsCache(rawCache, baseModels, disabledModels = [], contextWind
 }
 //#endregion
 //#region src/request.ts
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+const FORBIDDEN_HEADER_NAMES = new Set([
+	"user-agent",
+	"openai-beta",
+	"version",
+	"x-client-request-id",
+	"http-referer",
+	"x-title"
+]);
+function isForbiddenHeaderName(name) {
+	const lower = name.toLowerCase();
+	return FORBIDDEN_HEADER_NAMES.has(lower) || lower.startsWith("x-stainless-");
+}
+function formatDeterministicUuid(seed) {
+	const digest = createHash("sha256").update(seed).digest();
+	const bytes = Uint8Array.from(digest.subarray(0, 16));
+	bytes[6] = bytes[6] & 15 | 80;
+	bytes[8] = bytes[8] & 63 | 128;
+	const hex = Buffer.from(bytes).toString("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function toCodexWireSessionId(sessionId) {
+	const normalized = normalizeCodexSessionId(sessionId);
+	if (normalized === void 0) return void 0;
+	if (UUID_REGEX.test(normalized)) return normalized.toLowerCase();
+	return formatDeterministicUuid(`codex-session:${normalized}`);
+}
 const FORBIDDEN_PAYLOAD_FIELDS = Object.freeze([
 	"max_output_tokens",
 	"max_completion_tokens",
@@ -225,18 +259,62 @@ function buildCodexUserAgent(version = DEFAULT_CLIENT_VERSION) {
 function buildCodexHeaders(existingHeaders, clientVersion = DEFAULT_CLIENT_VERSION) {
 	const headers = {};
 	for (const [key, value] of Object.entries(existingHeaders ?? {})) {
-		if (key.toLowerCase() === "user-agent") continue;
+		if (isForbiddenHeaderName(key)) continue;
 		headers[key] = value;
 	}
 	headers.originator = "codex_cli_rs";
-	headers.version = clientVersion;
 	headers["User-Agent"] = buildCodexUserAgent(clientVersion);
 	return headers;
 }
+function createCodexResponsesFetch(options = {}) {
+	const fetchFn = options.baseFetch ?? globalThis.fetch;
+	return async (input, init) => {
+		const headers = new Headers(init?.headers);
+		for (const key of [...headers.keys()]) {
+			if (key.toLowerCase() === "user-agent") continue;
+			if (isForbiddenHeaderName(key)) headers.delete(key);
+		}
+		const accountId = options.getAccountId?.();
+		if (typeof accountId === "string" && accountId.trim() !== "") headers.set("chatgpt-account-id", accountId.trim());
+		return fetchFn(input, {
+			...init,
+			headers
+		});
+	};
+}
+function sanitizeInputItem(item) {
+	if (!item || typeof item !== "object" || Array.isArray(item)) return item;
+	const record = item;
+	let patched;
+	if (typeof record.id === "string" && /^msg_pi_/iu.test(record.id)) patched = {
+		...patched ?? record,
+		id: `msg_${createHash("sha256").update(record.id).digest("hex").slice(0, 48)}`
+	};
+	if (typeof record.call_id === "string" && /^pi_tool_load_/iu.test(record.call_id)) patched = {
+		...patched ?? record,
+		call_id: `call_${createHash("sha256").update(record.call_id).digest("hex").slice(0, 24)}`
+	};
+	return patched ?? item;
+}
 function sanitizeCodexPayload(payload, modelMeta, fastMode = false) {
 	if (!payload || typeof payload !== "object") return payload;
 	const cleaned = { ...payload };
 	for (const field of FORBIDDEN_PAYLOAD_FIELDS) delete cleaned[field];
+	if (typeof cleaned.prompt_cache_key === "string") {
+		const wireKey = toCodexWireSessionId(cleaned.prompt_cache_key);
+		if (wireKey !== void 0) cleaned.prompt_cache_key = wireKey;
+		else delete cleaned.prompt_cache_key;
+	}
+	if (!Array.isArray(cleaned.tools) || cleaned.tools.length === 0) {
+		delete cleaned.tools;
+		delete cleaned.parallel_tool_calls;
+		delete cleaned.tool_choice;
+	}
+	if (Array.isArray(cleaned.input)) cleaned.input = cleaned.input.filter((item) => {
+		if (!item || typeof item !== "object" || Array.isArray(item)) return true;
+		const t = item.type;
+		return t !== "additional_tools" && t !== "tool_search_call" && t !== "tool_search_output";
+	}).map(sanitizeInputItem);
 	if (fastMode) {
 		const tier = modelMeta === void 0 ? "priority" : modelMeta.fastServiceTier;
 		if (typeof tier === "string" && tier !== "") cleaned.service_tier = tier;
@@ -328,6 +406,7 @@ function createUsageFetcher(options) {
 	const fetchFn = options.fetchImpl ?? globalThis.fetch;
 	const nowFn = options.now ?? Date.now;
 	const ttlMs = options.ttlMs ?? 6e4;
+	const minForceIntervalMs = options.minForceIntervalMs ?? 5e3;
 	let cached;
 	let stale = false;
 	let inflight;
@@ -374,10 +453,17 @@ function createUsageFetcher(options) {
 			stale = true;
 		},
 		async getUsage(force = false) {
-			if (!force && !stale && cached !== void 0 && nowFn() - cached.fetchedAt < ttlMs) return {
-				ok: true,
-				quota: cached
-			};
+			if (!stale && cached !== void 0) {
+				const ageMs = nowFn() - cached.fetchedAt;
+				if (!force && ageMs < ttlMs) return {
+					ok: true,
+					quota: cached
+				};
+				if (force && ageMs >= 0 && ageMs < minForceIntervalMs) return {
+					ok: true,
+					quota: cached
+				};
+			}
 			if (!inflight) inflight = fetchFresh().finally(() => {
 				inflight = void 0;
 			});
@@ -462,6 +548,7 @@ function createAuthManager(options) {
 	const fetchFn = options.fetchImpl ?? globalThis.fetch;
 	const nowFn = options.now ?? Date.now;
 	let inflightRefresh;
+	let lastKnownAccountId;
 	let memoryFallback;
 	function readAuthState() {
 		const authPath = join(getCodexHome(), "auth.json");
@@ -525,8 +612,7 @@ function createAuthManager(options) {
 				body: JSON.stringify({
 					client_id: CODEX_CLIENT_ID,
 					grant_type: "refresh_token",
-					refresh_token: refreshTok,
-					scope: "openid profile email"
+					refresh_token: refreshTok
 				}),
 				signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
 			});
@@ -555,11 +641,13 @@ function createAuthManager(options) {
 			parsed: nextAuth,
 			accessToken: fresh.access_token
 		};
+		const refreshedAccountId = extractAccountId(nextAuth, fresh.access_token);
+		lastKnownAccountId = refreshedAccountId;
 		try {
 			await writeJsonAtomic(authPath, nextAuth);
 			options.onLog?.("INFO", "auth.refreshed", {
 				authPath,
-				accountId: extractAccountId(nextAuth, fresh.access_token) ?? null
+				accountId: refreshedAccountId ?? null
 			});
 		} catch (error) {
 			const errMsg = safeErrorMessage(error);
@@ -571,13 +659,15 @@ function createAuthManager(options) {
 		}
 		return {
 			accessToken: fresh.access_token,
-			accountId: extractAccountId(nextAuth, fresh.access_token)
+			accountId: refreshedAccountId
 		};
 	}
 	function toCredentials(state) {
+		const accountId = extractAccountId(state.parsed, state.accessToken);
+		lastKnownAccountId = accountId;
 		return {
 			accessToken: state.accessToken,
-			accountId: extractAccountId(state.parsed, state.accessToken)
+			accountId
 		};
 	}
 	async function resolveCredentials() {
@@ -596,6 +686,16 @@ function createAuthManager(options) {
 		resolveCredentials,
 		async resolveAccessToken() {
 			return (await resolveCredentials()).accessToken;
+		},
+		getLastKnownAccountId() {
+			if (lastKnownAccountId !== void 0) return lastKnownAccountId;
+			try {
+				const current = readAuthState();
+				lastKnownAccountId = extractAccountId(current.parsed, current.accessToken);
+				return lastKnownAccountId;
+			} catch {
+				return;
+			}
 		}
 	};
 }
@@ -910,12 +1010,17 @@ function apply(ctx, config = {}) {
 		const { temperature: _temperature, sessionId, onPayload, ...rest } = options;
 		const initiatorId = (ctx.get?.("agents"))?.currentInitiator?.()?.id;
 		const normalizedSessionId = normalizeCodexSessionId(sessionId) ?? normalizeCodexSessionId(initiatorId);
+		const wireSessionId = toCodexWireSessionId(normalizedSessionId);
 		resolveRootSessionKey(normalizedSessionId);
 		return {
 			...rest,
-			...normalizedSessionId !== void 0 ? { sessionId: normalizedSessionId } : {},
+			...wireSessionId !== void 0 ? { sessionId: wireSessionId } : {},
 			transport: "sse",
 			headers: buildCodexHeaders(rest.headers, catalog.clientVersion),
+			fetch: createCodexResponsesFetch({
+				baseFetch: rest.fetch,
+				getAccountId: () => authManager.getLastKnownAccountId()
+			}),
 			async onPayload(payload, requestModel) {
 				return sanitizeCodexPayload(await onPayload?.(payload, requestModel) ?? payload, modelMeta, getEffectiveFastMode(normalizedSessionId));
 			}
@@ -1214,7 +1319,9 @@ const __test = Object.freeze({
 	sanitizeCodexPayload,
 	buildCodexHeaders,
 	buildCodexUserAgent,
+	createCodexResponsesFetch,
 	normalizeCodexSessionId,
+	toCodexWireSessionId,
 	parseUsagePayload,
 	createUsageFetcher
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lyogvce/dsh-codex-subscription",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "复用本机 ~/.codex 订阅凭证与 models_cache.json 模型缓存，在 DSH 中通过 SSE 直连调用 Codex 模型。",
   "type": "module",
   "main": "./lib/index.js",