@pure01fx/dsh-openai-codex-auth 0.12.0 → 0.13.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.13.1
+
+- Serves a concurrent or pool-saturated request over HTTP/SSE instead of failing the turn.
+- Moves a session to HTTP/SSE after a 400-class WebSocket rejection, so one rejected request can no longer fail every later turn in that session.
+- Logs the provider's own rejection code, status and message instead of discarding them.
+- Keeps a Fast alias resolvable when the catalog could not be read and retries one empty catalog read, so a transient catalog outage no longer fails the whole provider group in the model picker; a catalog that answers without Fast still refuses it.
+- Memoizes the managed credential per credential-file signature with one shared resolution, so the model picker's per-model resolutions no longer take a dozen concurrent writer-lock acquisitions on the credential file (measured 2.1 s for 14 concurrent readers against a 2 s lock deadline before this change).
+- Adds `locale/en.json` and `locale/zh.json` so the DSH 0.2.0 plugin panel shows a display name and description instead of the package id.
+
+## 0.13.0
+
+- Targets DSH 0.2.0-rc.2 with exact SDK peers, development dependencies and runtime helpers; retains the tool-message, shell and provenance migration below.
+- Merges GPT-6.1 catalog routing, shared Retry-After handling, assistant phases and deterministic developer instructions from the latest source.
+- Target build/typecheck and all 517 regression tests pass on DSH 0.2.0-rc.2. No live OAuth/model requests were made; collection-level Web validation is recorded separately.
+
 ## 0.12.0
 
 ### Migration
@@ -22,6 +37,15 @@
 - Developer messages: preserved in Responses API requests
 - Cloud context: requires toolCallId === source.callId and !isError
 
+- Shares Retry-After parsing across HTTP, SSE, and WebSocket errors, including nested JSON headers and HTTP dates; preserves server deadlines across retries and HTTP fallback without truncating advice to local backoff limits.
+
+- Preserves commentary, partial_answer, and final_answer phases through response events, durable replay, and WebSocket continuation matching; legacy phase-less replay remains readable.
+
+- Moves Standard base instructions into the same deterministic developer-message prefix used by Lite, preserving each protocol’s tool and reasoning controls; changed instructions invalidate WebSocket prefix reuse.
+
+- Requests the live model catalog as Codex 0.162.0 to discover GPT-6.1 Sol; verified that 0.155.0 omits it for the same account despite the bundled 0.153.0 minimum. Adds its exact Lite fallback and dynamic metadata/routing regressions without fabricating catalog availability.
+
+
 ## 0.11.2
 
 - Requests the live model catalog as Codex 0.155.0 so version-gated GPT-6 Sol can be advertised; preserves dynamic account-specific discovery and routes exact Sol requests through Responses Lite when catalog metadata is unavailable. Fast remains catalog-authorized.

package/CODEX-COMPATIBILITY.md

@@ -1,5 +1,44 @@
 # Codex 云端能力兼容性跟踪
 
+## 重试、消息阶段与 Standard 指令对齐（Unreleased）
+
+本节记录对 `ea27864f` 的三项增量适配，取代下方 Retry-After、phase 和 Standard 指令位置的历史待办；其余工作仍独立跟踪。
+
+- Standard 基础指令改为 input 首部的 developer message，和 Lite 共用稳定 UUID 与 `model.base_instructions` metadata 构造。Standard 顶层 tools、并行工具与 reasoning 参数保留各自协议；Lite 的工具前缀及目录模板/DSH 指令组合保持独立。回归验证相同指令保持 WS 前缀复用，改变指令会触发完整请求，HTTP 历史、图片、工具输出和加密 reasoning 顺序不变。
+- 消息 phase 已接收并保留 commentary / partial_answer / final_answer，通过 v1 描述符的可选字段持久化再回放，并让 WS 复用比较使用同一有效 phase。added-only 的 phase 保留到 done，done 的显式 phase 优先；流中的 null/缺失值表示未提供，非法枚举拒绝。测试覆盖 JSON 保存/恢复、分叉和重启的请求构造、真实传输类的增量匹配与 phase 改变后完整重发。缺少 phase 的旧会话可读；旧插件的严格字段校验无法读取含 phase 的新描述符，降级时需考虑这一限制。
+- Retry-After 共用秒数/HTTP-date 解析，支持 JSON 数字值，嵌套错误 headers 优先；保留单次收到建议的单调时钟截止时间，不用本地退避上限截短服务端等待。HTTP 读取错误正文及其超时不会重置或丢弃等待，WS 最后一次失败后切换 HTTP 也遵守剩余等待。长等待分段使用 Node timer，仍可取消。宿主 `LlmError` 只公开正数 duration，无法跨宿主持久化表达单调时钟 deadline；本插件默认 normal 重试策略在宿主等待超上限时交还错误，不会提前重试。宿主另行配置的 always 策略可能忽略长等待，不属于本次插件内改动。
+
+验证：`npm run build`、`npm test`（27 文件 / 511 项）、`npm run typecheck`、`git diff --check`、`npm pack --dry-run --ignore-scripts` 均通过；所有生成模块与新鲜编译一致，新 retry-after 模块已加入打包清单。独立审查发现的非法日期归一化问题已修复，并加入内层非法日期回退外层有效等待的回归。本轮为源码、模拟传输与 loopback 验证，未执行线上推理、发布、替换 hu profile 或重启 GUI。
+
+## GPT-6.1 Sol 增量对齐（Unreleased，2026-10-08）
+
+`../codex` 已 fast-forward 到 `ea27864f99f0b086cec2f9f0251b7190fb9844f1`（本次获取的 origin/main），工作树干净。此轮针对模型发现与 Lite 路由，不宣称完整运行时对齐，原 Provider/cloud 跟踪提交保持不变。
+
+### 已确认的缺失原因与修复
+
+对同一当前账号执行只读线上目录请求（未调用推理、未记录凭据）：
+
+| client_version | originator | HTTP | 返回目录 |
+| --- | --- | --- | --- |
+| 0.153.4 | dsh | 200 | 不含 gpt-6-sol / gpt-6.1-sol |
+| 0.155.0 | dsh | 200 | 含 gpt-6-sol，不含 gpt-6.1-sol |
+| 0.162.0 | dsh | 200 | 含 gpt-6.1-sol，visibility=list |
+| 0.162.0 | codex_cli_rs | 200 | 同样含 gpt-6.1-sol |
+
+上游 `models-manager/models.json` 将 6.1 Sol 的 minimal_client_version 标为 0.153.0，但它不等于线上实际发现门槛。请求版本升至本次已验证的 0.162.0（上游已有 rust-v0.162.0-alpha.20；目录发送去预发布后缀的整版本）。不更改 originator，不将静态模型强行加入账号目录。
+
+补充精确 `gpt-6.1-sol` 的 Lite 后备，目录存在时仍以 metadata 为准。新增精简上游 fixture，验证动态发现、六档 reasoning、默认 low / multi-agent xhigh、Fast 授权、metadata 优先及未知近似名称不误用 Lite。
+
+当前 3080 GUI 的 hu profile 安装的是插件 0.11.1，请求版本 0.153.4。本轮只修改并构建仓库，未替换 profile 安装或重启当前会话；仓库修改不会自动改变正在运行的 GUI。
+
+验证：`npm run build`、`npm test`（26 文件 / 469 项）、`npm run typecheck`、`git diff --check` 全部通过；生成产物一致性测试通过。使用新构建的 NativeCodexCatalog + NativeCodexAdapter 查询当前账号，已返回 `gpt-6.1-sol` 与 `gpt-6.1-sol-fast`，六档推理配置及默认 low 解析成功。本轮未执行模型推理，因此此结果验证发现与元数据，不代表线上推理端到端验收。
+
+### 独立后续兼容性工作
+
+- Retry-After：新上游从 response.failed.response.error.headers 读取等待提示，WebSocket 优先嵌套 headers，支持数字 JSON 值和 HTTP 日期；插件仍遗漏部分嵌套提示并将等待上限压到 120 秒。建议单独对齐共享解析及 deadline 传递，避免早于服务端建议重试。依据 `codex-api/src/sse/responses_error.rs`、`endpoint/responses_websocket.rs`、`http-client/src/retry_after.rs`。这不是 6.1 模型目录缺失原因。
+- 数字自定义 reasoning effort、Standard instructions 移入 developer input、partial_answer phase 回放保真分别存在增量差异，应单独设计与验证。6.1 现有命名 effort 和 Lite 路径不依赖这些改动。
+
+
 ## 已实现：Sol 与错误协议增量适配（0.11.2）
 
 参考上游 `c44deff7b1083e9660ac55d02122481f1cdf139b`，在既有 0.11.1 工作树上完成以下必要改动。此节取代下方历史审查中相应的“待适配”结论；不代表完整上游运行时对齐。

package/README.md

@@ -17,9 +17,9 @@
 
 ## 快速开始
 
-版本 `0.12.0` 明确适配 DeepSeek Harness `0.1.7-rc.2`，SDK peers/runtime helpers 精确锁定该版本；不声明兼容旧 SDK。旧 DSH `0.1.5-rc.1` profile 应保留原插件 `0.11.2`，升级时在独立 profile 安装新版插件并保留原 profile/锁文件以便回滚。无需迁移账号文件或浏览器隐藏列表；`dsh.engines` 仅作兼容性说明，不当作宿主硬门禁。
+版本 `0.13.0` 明确适配 DeepSeek Harness `0.2.0-rc.2`，SDK peers/runtime helpers 精确锁定该版本；不声明兼容旧 SDK。旧 DSH `0.1.5-rc.1` profile 应保留原插件 `0.11.2`，升级时在独立 profile 安装新版插件并保留原 profile/锁文件以便回滚。无需迁移账号文件或浏览器隐藏列表；`dsh.engines` 仅作兼容性说明，不当作宿主硬门禁。
 
-本版本通过真实目标 LLM/tools 服务与本地 HTTP/SSE/WebSocket 回放、错误/取消回归；模型隐藏覆盖真实目录/catalog/store 的投影更新、重连和重新加载。验证命令为 `pnpm typecheck && pnpm build && pnpm test`；当前版本未执行线上 OAuth/付费模型验收。
+回归范围包含真实目标 LLM/tools 服务、本地 HTTP/SSE/WebSocket 回放、错误/取消，以及模型隐藏在真实目录/catalog/store 的投影更新、重连和重新加载。验证命令为 `pnpm typecheck && pnpm build && pnpm test`；0.13.0 候选版已通过目标版本构建、类型检查和 517 项测试；当前未执行线上 OAuth/付费模型验收。
 
 `0.11.0` 移除了插件额外设置的请求、响应、SSE/WebSocket、图片和重放状态大小上限，以及相应的 transport 选项（含 `maxRequestBodyBytes`）；旧配置中的该字段应删除。搜索结果完整保留，WebSocket 继续优先复用增量上下文。服务端限制、协议校验及 DSH 文件/附件策略仍生效。
 

package/lib/catalog.js

@@ -265,7 +265,8 @@ export class NativeCodexCatalog {
             if (error instanceof LlmError && error.code === 'ABORTED')
                 throw error;
             if (!(error instanceof LlmError) || error.code !== 'MISSING_CREDENTIAL') {
-                this.options.warn?.('native Codex credential is unavailable; model metadata is advisory');
+                const code = error instanceof LlmError ? error.code : 'UNKNOWN';
+                this.options.warn?.(`native Codex credential is unavailable (${code}); model metadata is advisory`);
             }
             return { models: [] };
         }

package/lib/index.d.ts

@@ -132,6 +132,8 @@ export declare class OpenAICodexAuth extends Service {
     private usageAccountId;
     private responseUsage;
     private credentialAccountId;
+    private credentialMemo;
+    private credentialResolution;
     private usageError;
     private usageRefresh;
     private usageGeneration;
@@ -163,6 +165,15 @@ export declare class OpenAICodexAuth extends Service {
     private commitCredential;
     /** Return the current managed bearer token, refreshing and migrating it when needed. */
     bearerToken(signal?: AbortSignal): Promise<string | undefined>;
+    /**
+     * Resolve the managed credential for one native call, reusing a lock-free memo of
+     * the file it was read from. The model picker resolves one credential per listed
+     * model, so one shared resolution replaces a burst of lock acquisitions on the
+     * same credential file.
+     */
+    private cachedManagedCredential;
+    /** Resolve once for every concurrent caller; never memo a credential the file no longer matches. */
+    private resolveManagedCredential;
     private managedCredential;
     private externalNativeCredential;
     private resolveNativeCredential;

package/lib/index.js

@@ -6,7 +6,7 @@ import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { createServer } from 'node:http';
 import { createHash, randomBytes } from 'node:crypto';
-import { readFile, unlink } from 'node:fs/promises';
+import { readFile, stat, unlink } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { INVALID_CREDENTIAL_CODE, LlmError } from '@deepseek-ai/dsh-llm';
 import { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER, NativeCodexAdapter, } from './native-adapter.js';
@@ -256,6 +256,26 @@ async function readCredentialDocument(filename) {
         throw error;
     }
 }
+/**
+ * Cheap lock-free identity of the credential file. Every writer replaces it
+ * atomically, so both parts change and a cached read cannot outlive its file.
+ */
+async function credentialFileSignature(filename) {
+    try {
+        const info = await stat(filename);
+        // An atomic replacement renames a fresh file, so the inode changes with it.
+        return `${info.ino}:${info.mtimeMs}:${info.size}`;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return 'missing';
+        throw error;
+    }
+}
+/** Whether a managed credential still avoids the pre-refresh window `bearerToken` enforces. */
+function managedCredentialUsable(credential, now = Date.now()) {
+    return credential.expires > now + TOKEN_REFRESH_PREEMPT_MS;
+}
 function currentCredential(document) {
     if (document?.currentAccountId === null || document === undefined)
         return undefined;
@@ -722,6 +742,8 @@ export class OpenAICodexAuth extends Service {
     usageAccountId;
     responseUsage;
     credentialAccountId;
+    credentialMemo;
+    credentialResolution;
     usageError;
     usageRefresh;
     usageGeneration = 0;
@@ -1036,6 +1058,8 @@ export class OpenAICodexAuth extends Service {
         throw failure;
     }
     async commitDocument(document, signal) {
+        // A write may publish or replace the managed account, so no read memo survives it.
+        this.credentialMemo = undefined;
         const nextToken = currentCredential(document)?.access;
         const previous = await this.ctx.credentials.resolve(TOKEN_REF);
         throwIfCancelled(signal);
@@ -1143,6 +1167,37 @@ export class OpenAICodexAuth extends Service {
                 return access;
         }
     }
+    /**
+     * Resolve the managed credential for one native call, reusing a lock-free memo of
+     * the file it was read from. The model picker resolves one credential per listed
+     * model, so one shared resolution replaces a burst of lock acquisitions on the
+     * same credential file.
+     */
+    async cachedManagedCredential(signal) {
+        const signature = await credentialFileSignature(this.filename);
+        const memo = this.credentialMemo;
+        if (memo !== undefined && memo.signature === signature && managedCredentialUsable(memo.credential)) {
+            this.setCredentialAccount(memo.credential.accountId);
+            return memo.credential;
+        }
+        const pending = this.credentialResolution ??= this.resolveManagedCredential(signature);
+        return await waitForSignal(pending, signal);
+    }
+    /** Resolve once for every concurrent caller; never memo a credential the file no longer matches. */
+    resolveManagedCredential(signature) {
+        const resolution = this.managedCredential().then(async (credential) => {
+            if (credential !== undefined && await credentialFileSignature(this.filename) === signature) {
+                this.credentialMemo = { signature, credential };
+            }
+            return credential;
+        });
+        const settled = () => {
+            if (this.credentialResolution === resolution)
+                this.credentialResolution = undefined;
+        };
+        void resolution.then(settled, settled);
+        return resolution;
+    }
     async managedCredential(signal) {
         while (true) {
             const access = await this.bearerToken(signal);
@@ -1172,7 +1227,7 @@ export class OpenAICodexAuth extends Service {
     async resolveNativeCredential(signal) {
         try {
             throwIfCancelled(signal);
-            const managed = await this.managedCredential(signal);
+            const managed = await this.cachedManagedCredential(signal);
             if (managed !== undefined) {
                 throwIfCancelled(signal);
                 return { accessToken: managed.access, accountId: managed.accountId };

package/lib/native-adapter.d.ts

@@ -44,6 +44,13 @@ export declare class NativeCodexAdapter extends LlmAdapter {
     private assertNotAborted;
     providerInfo(provider: string): LlmProviderInfo;
     providerRetryPolicy(provider: string): ResolvedRetryPolicy;
+    /**
+     * Read model metadata, retrying once when a fetch returned nothing. The catalog
+     * caches nothing on failure, so a momentary outage otherwise empties every model
+     * list it touches; metadata is advisory and one extra request is cheaper than a
+     * provider that disappears from the picker until the next attempt.
+     */
+    private catalogModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
     resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;

package/lib/native-adapter.js

@@ -57,7 +57,8 @@ function responsesLiteMode(model, requestedModel = model?.slug) {
     if (model !== undefined && !model.useResponsesLite)
         return {};
     // Never downgrade known Lite-only slugs to Standard Responses during catalog outages.
-    if (model === undefined && requestedModel !== 'gpt-6-astra' && requestedModel !== 'gpt-6-sol')
+    if (model === undefined && requestedModel !== 'gpt-6-astra'
+        && requestedModel !== 'gpt-6-sol' && requestedModel !== 'gpt-6.1-sol')
         return {};
     return {
         responsesLite: {
@@ -188,9 +189,22 @@ export class NativeCodexAdapter extends LlmAdapter {
         this.assertProvider(provider);
         return NATIVE_RETRY_POLICY;
     }
+    /**
+     * Read model metadata, retrying once when a fetch returned nothing. The catalog
+     * caches nothing on failure, so a momentary outage otherwise empties every model
+     * list it touches; metadata is advisory and one extra request is cheaper than a
+     * provider that disappears from the picker until the next attempt.
+     */
+    async catalogModels(signal) {
+        const first = await this.catalog?.list(signal) ?? [];
+        if (first.length > 0)
+            return first;
+        this.assertNotAborted(signal);
+        return await this.catalog?.list(signal) ?? [];
+    }
     async listModels(provider) {
         this.assertProvider(provider);
-        const models = await this.catalog?.list() ?? [];
+        const models = await this.catalogModels();
         const aliases = fastRoutes(models);
         return models
             .filter(model => model.visibility === 'list')
@@ -206,7 +220,7 @@ export class NativeCodexAdapter extends LlmAdapter {
     async resolveModel(provider, model, signal) {
         this.assertNotAborted(signal);
         this.assertProvider(provider);
-        const models = await this.catalog?.list(signal) ?? [];
+        const models = await this.catalogModels(signal);
         this.assertNotAborted(signal);
         const exact = models.find(candidate => candidate.slug === model);
         if (exact !== undefined)
@@ -215,7 +229,14 @@ export class NativeCodexAdapter extends LlmAdapter {
         if (fast !== undefined)
             return resolvedModel(provider, fast, true);
         if (model.endsWith(CODEX_FAST_ALIAS_SUFFIX)) {
-            throw new LlmError('native Codex Fast is not advertised for the selected model', 'FAST_UNSUPPORTED');
+            const base = model.slice(0, -CODEX_FAST_ALIAS_SUFFIX.length);
+            // Only a catalog that knows the base model can answer this negatively.
+            // Without any entry for it the metadata is missing rather than negative, and
+            // a caller that resolves every listed model (the picker) must not lose the
+            // whole provider group to an advisory fetch.
+            if (models.some(candidate => candidate.slug === base)) {
+                throw new LlmError('native Codex Fast is not advertised for the selected model', 'FAST_UNSUPPORTED');
+            }
         }
         return { provider, id: model, name: model };
     }

package/lib/native-http.js

@@ -4,6 +4,7 @@ import { networkTelemetry, trackNetwork, observeNetworkOutput } from './network-
 import { EMPTY_RESPONSE_CODE, LlmError, ProviderRequestId, attributionHeaders, } from '@deepseek-ai/dsh-llm';
 import { nativeCodexAuthorityHash } from './catalog.js';
 import { nativeCodexEndpoint } from './endpoint.js';
+import { retryAfterMs, retryError, remainingRetryDelay, sleepRetry, inheritRetryDeadline } from './retry-after.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, NATIVE_CODEX_STREAM_INTERRUPTED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
 import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, streamResponses, responsesFailure, } from './responses.js';
 import { hasNativeCodexReplayKind } from './replay.js';
@@ -19,7 +20,7 @@ const INITIAL_CONNECTION_RETRY_DELAY_MS = 5_000;
 const MAX_CONNECTION_RETRY_DELAY_MS = 60_000;
 const MAX_ERROR_BODY_BYTES = 64 * 1024;
 function aborted(message = 'native Codex request was aborted') {
-    return new LlmError(message, 'ABORTED');
+    return retryError(message, 'ABORTED');
 }
 function throwIfAborted(signal) {
     if (!signal?.aborted)
@@ -29,7 +30,7 @@ function throwIfAborted(signal) {
     throw aborted();
 }
 function fixedFailure(message, code, options) {
-    return new LlmError(message, code, options);
+    return retryError(message, code, options);
 }
 function safePositiveInteger(value, fallback, name) {
     const resolved = value ?? fallback;
@@ -52,24 +53,6 @@ function stablePromptCacheKey(sessionId) {
     const hex = bytes.toString('hex');
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
-function sleep(delayMs, signal) {
-    throwIfAborted(signal);
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(done, delayMs);
-        const abort = () => {
-            clearTimeout(timer);
-            signal?.removeEventListener('abort', abort);
-            const reason = signal?.reason;
-            reject(reason instanceof LlmError
-                ? reason : aborted('native Codex retry wait was aborted'));
-        };
-        function done() {
-            signal?.removeEventListener('abort', abort);
-            resolve();
-        }
-        signal?.addEventListener('abort', abort, { once: true });
-    });
-}
 function attemptWatchdog(parent, requestMs, idleMs) {
     const controller = new AbortController();
     let timeout;
@@ -252,18 +235,8 @@ async function boundedError(response, signal, telemetry) {
         return {};
     }
 }
-function retryAfterMs(response, maxDelayMs) {
-    const raw = response.headers.get('retry-after');
-    if (raw === null)
-        return undefined;
-    const seconds = Number(raw);
-    const value = Number.isFinite(seconds)
-        ? seconds * 1_000
-        : Date.parse(raw) - Date.now();
-    return Number.isFinite(value) && value > 0 ? Math.min(value, maxDelayMs) : undefined;
-}
-function errorFacts(response, maxDelayMs) {
-    const providerRetryAfterMs = retryAfterMs(response, maxDelayMs);
+function errorFacts(response) {
+    const providerRetryAfterMs = retryAfterMs(response.headers.get('retry-after'));
     const requestId = response.headers.get('x-request-id');
     return {
         status: response.status,
@@ -273,37 +246,43 @@ function errorFacts(response, maxDelayMs) {
             : { requestId: ProviderRequestId(requestId) },
     };
 }
-async function httpFailure(response, maxDelayMs, signal, telemetry) {
+async function httpFailure(response, signal, telemetry) {
+    const facts = errorFacts(response);
+    const advice = retryError('native Codex HTTP retry advice', 'SERVER', facts);
+    const fail = (message, code, options) => inheritRetryDeadline(fixedFailure(message, code, options), advice);
     const detail = await boundedError(response, signal, telemetry);
-    const facts = errorFacts(response, maxDelayMs);
     const classified = responsesFailure(detail.code, detail.message);
     if (response.status === 401 || response.status === 403) {
-        return fixedFailure('native Codex rejected the configured credential', 'AUTH', facts);
+        return fail('native Codex rejected the configured credential', 'AUTH', facts);
     }
     if (classified.code !== 'SERVER') {
         const delay = facts?.providerRetryAfterMs ?? classified.failure.providerRetryAfterMs;
-        return fixedFailure(classified.message, classified.code, {
+        return fail(classified.message, classified.code, {
             ...facts,
-            ...(delay === undefined ? {} : { providerRetryAfterMs: Math.min(delay, maxDelayMs) }),
+            ...(delay === undefined ? {} : { providerRetryAfterMs: delay }),
         });
     }
     if (response.status === 429) {
-        return fixedFailure('native Codex request was rate limited', 'RATE_LIMIT', facts);
+        return fail('native Codex request was rate limited', 'RATE_LIMIT', facts);
     }
     if (response.status === 408 || response.status === 504) {
-        return fixedFailure('native Codex request timed out', 'TIMEOUT', facts);
+        return fail('native Codex request timed out', 'TIMEOUT', facts);
     }
     if (response.status >= 500) {
-        return fixedFailure('native Codex server request failed', 'SERVER', facts);
+        return fail('native Codex server request failed', 'SERVER', facts);
     }
-    return fixedFailure('native Codex request was rejected', 'INVALID_REQUEST', facts);
+    return fail('native Codex request was rejected', 'INVALID_REQUEST', facts);
 }
 function mappedFailure(error, watchdog, parent) {
     if (parent?.aborted) {
         return parent.reason instanceof LlmError ? parent.reason : aborted();
     }
     if (watchdog.timedOut())
-        return fixedFailure('native Codex request timed out', 'TIMEOUT');
+        return fixedFailure('native Codex request timed out', 'TIMEOUT', {
+            cause: error,
+            ...(error instanceof LlmError && error.failure.providerRetryAfterMs !== undefined
+                ? { providerRetryAfterMs: error.failure.providerRetryAfterMs } : {}),
+        });
     if (error instanceof LlmError)
         return error;
     return fixedFailure('native Codex transport failed', 'TRANSPORT', { cause: error });
@@ -331,8 +310,7 @@ function retryable(error) {
 }
 function failedStepRetry(error) {
     const failure = error.failure;
-    const providerRetryAfterMs = failure.providerRetryAfterMs === undefined
-        ? undefined : Math.min(failure.providerRetryAfterMs, DEFAULT_MAX_RETRY_DELAY_MS);
+    const providerRetryAfterMs = failure.providerRetryAfterMs;
     return fixedFailure(`native Codex response stream was interrupted: ${error.message}`, NATIVE_CODEX_STREAM_INTERRUPTED_CODE, {
         cause: error,
         ...(failure.status === undefined ? {} : { status: failure.status }),
@@ -362,21 +340,21 @@ export class NativeCodexHttpTransport {
     }
     retryDelay(retry, providerDelay) {
         if (providerDelay !== undefined)
-            return Math.min(providerDelay, this.maxDelayMs);
+            return providerDelay;
         const exponential = Math.min(this.initialDelayMs * (2 ** retry), this.maxDelayMs);
         const random = this.options.random?.() ?? Math.random();
         const jitter = 0.9 + Math.max(0, Math.min(1, random)) * 0.2;
         return Math.max(1, Math.round(exponential * jitter));
     }
     async wait(retry, error, signal, telemetry) {
-        const delay = this.retryDelay(retry, error.failure.providerRetryAfterMs);
+        const delay = this.retryDelay(retry, remainingRetryDelay(error));
         telemetry.retry(delay);
-        await (this.options.sleep ?? sleep)(delay, signal);
+        await (this.options.sleep ?? sleepRetry)(delay, signal);
     }
     async waitForConnection(delayMs, signal, telemetry) {
         telemetry.retry(delayMs, 'connection');
         this.options.warn?.(`native Codex network is unavailable; reconnecting in ${delayMs}ms`);
-        await (this.options.sleep ?? sleep)(delayMs, signal);
+        await (this.options.sleep ?? sleepRetry)(delayMs, signal);
     }
     endpointUrl() { return this.endpoint; }
     async prepare(generation, mode = {}) {
@@ -527,7 +505,7 @@ export class NativeCodexHttpTransport {
                         telemetry.retry(0);
                         continue;
                     }
-                    throw fixedFailure('native Codex rejected the configured credential', 'AUTH', errorFacts(response, this.maxDelayMs));
+                    throw fixedFailure('native Codex rejected the configured credential', 'AUTH', errorFacts(response));
                 }
                 catch (error) {
                     const connection = connectionFailure(error, watchdog, generation.signal);
@@ -542,7 +520,7 @@ export class NativeCodexHttpTransport {
                 }
             }
             if (!response.ok) {
-                let failure = await httpFailure(response, this.maxDelayMs, watchdog.signal, telemetry);
+                let failure = await httpFailure(response, watchdog.signal, telemetry);
                 if (generation.signal?.aborted || watchdog.timedOut()) {
                     failure = mappedFailure(failure, watchdog, generation.signal);
                 }

package/lib/native-websocket-socket.js

@@ -3,11 +3,12 @@ import { LlmError, ProviderRequestId } from '@deepseek-ai/dsh-llm';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import { getProxyForUrl } from 'proxy-from-env';
 import { nativeCodexEndpoint } from './endpoint.js';
+import { retryAfterMs, retryError } from './retry-after.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
 import WebSocket from 'ws';
 const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
 function failure(message, code, cause) {
-    return new LlmError(message, code, cause === undefined ? undefined : { cause });
+    return retryError(message, code, cause === undefined ? undefined : { cause });
 }
 function abortFailure(signal) {
     return signal?.reason instanceof LlmError
@@ -17,9 +18,7 @@ function abortFailure(signal) {
 function handshakeFacts(status, headers) {
     const first = (value) => Array.isArray(value) ? value[0] : value;
     const requestId = first(headers['x-request-id']);
-    const retryAfter = Number(first(headers['retry-after']));
-    const providerRetryAfterMs = Number.isFinite(retryAfter) && retryAfter > 0
-        ? Math.min(retryAfter * 1_000, 120_000) : undefined;
+    const providerRetryAfterMs = retryAfterMs(first(headers['retry-after']));
     return {
         ...(status === undefined ? {} : { status }),
         ...(providerRetryAfterMs === undefined ? {} : { providerRetryAfterMs }),
@@ -202,7 +201,7 @@ export class NodeNativeCodexWebSocketFactory {
                                     ? 'WS_RETRYABLE'
                                     : response.statusCode !== undefined && response.statusCode >= 400
                                         ? 'INVALID_REQUEST' : 'WS_HANDSHAKE';
-                reject(new LlmError(`native Codex WebSocket handshake failed (HTTP ${response.statusCode ?? 0})`, code, handshakeFacts(response.statusCode, response.headers)));
+                reject(retryError(`native Codex WebSocket handshake failed (HTTP ${response.statusCode ?? 0})`, code, handshakeFacts(response.statusCode, response.headers)));
             });
             socket.on('open', () => {
                 options.signal?.removeEventListener('abort', abort);