@pure01fx/dsh-openai-codex-auth 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.13.1
+
+- Serves a concurrent or pool-saturated request over HTTP/SSE instead of failing the turn.
+- Moves a session to HTTP/SSE after a 400-class WebSocket rejection, so one rejected request can no longer fail every later turn in that session.
+- Logs the provider's own rejection code, status and message instead of discarding them.
+- Keeps a Fast alias resolvable when the catalog could not be read and retries one empty catalog read, so a transient catalog outage no longer fails the whole provider group in the model picker; a catalog that answers without Fast still refuses it.
+- Memoizes the managed credential per credential-file signature with one shared resolution, so the model picker's per-model resolutions no longer take a dozen concurrent writer-lock acquisitions on the credential file (measured 2.1 s for 14 concurrent readers against a 2 s lock deadline before this change).
+- Adds `locale/en.json` and `locale/zh.json` so the DSH 0.2.0 plugin panel shows a display name and description instead of the package id.
+
 ## 0.13.0
 
 - Targets DSH 0.2.0-rc.2 with exact SDK peers, development dependencies and runtime helpers; retains the tool-message, shell and provenance migration below.

package/lib/catalog.js

@@ -265,7 +265,8 @@ export class NativeCodexCatalog {
             if (error instanceof LlmError && error.code === 'ABORTED')
                 throw error;
             if (!(error instanceof LlmError) || error.code !== 'MISSING_CREDENTIAL') {
-                this.options.warn?.('native Codex credential is unavailable; model metadata is advisory');
+                const code = error instanceof LlmError ? error.code : 'UNKNOWN';
+                this.options.warn?.(`native Codex credential is unavailable (${code}); model metadata is advisory`);
             }
             return { models: [] };
         }

package/lib/index.d.ts

@@ -132,6 +132,8 @@ export declare class OpenAICodexAuth extends Service {
     private usageAccountId;
     private responseUsage;
     private credentialAccountId;
+    private credentialMemo;
+    private credentialResolution;
     private usageError;
     private usageRefresh;
     private usageGeneration;
@@ -163,6 +165,15 @@ export declare class OpenAICodexAuth extends Service {
     private commitCredential;
     /** Return the current managed bearer token, refreshing and migrating it when needed. */
     bearerToken(signal?: AbortSignal): Promise<string | undefined>;
+    /**
+     * Resolve the managed credential for one native call, reusing a lock-free memo of
+     * the file it was read from. The model picker resolves one credential per listed
+     * model, so one shared resolution replaces a burst of lock acquisitions on the
+     * same credential file.
+     */
+    private cachedManagedCredential;
+    /** Resolve once for every concurrent caller; never memo a credential the file no longer matches. */
+    private resolveManagedCredential;
     private managedCredential;
     private externalNativeCredential;
     private resolveNativeCredential;

package/lib/index.js

@@ -6,7 +6,7 @@ import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { createServer } from 'node:http';
 import { createHash, randomBytes } from 'node:crypto';
-import { readFile, unlink } from 'node:fs/promises';
+import { readFile, stat, unlink } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { INVALID_CREDENTIAL_CODE, LlmError } from '@deepseek-ai/dsh-llm';
 import { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER, NativeCodexAdapter, } from './native-adapter.js';
@@ -256,6 +256,26 @@ async function readCredentialDocument(filename) {
         throw error;
     }
 }
+/**
+ * Cheap lock-free identity of the credential file. Every writer replaces it
+ * atomically, so both parts change and a cached read cannot outlive its file.
+ */
+async function credentialFileSignature(filename) {
+    try {
+        const info = await stat(filename);
+        // An atomic replacement renames a fresh file, so the inode changes with it.
+        return `${info.ino}:${info.mtimeMs}:${info.size}`;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return 'missing';
+        throw error;
+    }
+}
+/** Whether a managed credential still avoids the pre-refresh window `bearerToken` enforces. */
+function managedCredentialUsable(credential, now = Date.now()) {
+    return credential.expires > now + TOKEN_REFRESH_PREEMPT_MS;
+}
 function currentCredential(document) {
     if (document?.currentAccountId === null || document === undefined)
         return undefined;
@@ -722,6 +742,8 @@ export class OpenAICodexAuth extends Service {
     usageAccountId;
     responseUsage;
     credentialAccountId;
+    credentialMemo;
+    credentialResolution;
     usageError;
     usageRefresh;
     usageGeneration = 0;
@@ -1036,6 +1058,8 @@ export class OpenAICodexAuth extends Service {
         throw failure;
     }
     async commitDocument(document, signal) {
+        // A write may publish or replace the managed account, so no read memo survives it.
+        this.credentialMemo = undefined;
         const nextToken = currentCredential(document)?.access;
         const previous = await this.ctx.credentials.resolve(TOKEN_REF);
         throwIfCancelled(signal);
@@ -1143,6 +1167,37 @@ export class OpenAICodexAuth extends Service {
                 return access;
         }
     }
+    /**
+     * Resolve the managed credential for one native call, reusing a lock-free memo of
+     * the file it was read from. The model picker resolves one credential per listed
+     * model, so one shared resolution replaces a burst of lock acquisitions on the
+     * same credential file.
+     */
+    async cachedManagedCredential(signal) {
+        const signature = await credentialFileSignature(this.filename);
+        const memo = this.credentialMemo;
+        if (memo !== undefined && memo.signature === signature && managedCredentialUsable(memo.credential)) {
+            this.setCredentialAccount(memo.credential.accountId);
+            return memo.credential;
+        }
+        const pending = this.credentialResolution ??= this.resolveManagedCredential(signature);
+        return await waitForSignal(pending, signal);
+    }
+    /** Resolve once for every concurrent caller; never memo a credential the file no longer matches. */
+    resolveManagedCredential(signature) {
+        const resolution = this.managedCredential().then(async (credential) => {
+            if (credential !== undefined && await credentialFileSignature(this.filename) === signature) {
+                this.credentialMemo = { signature, credential };
+            }
+            return credential;
+        });
+        const settled = () => {
+            if (this.credentialResolution === resolution)
+                this.credentialResolution = undefined;
+        };
+        void resolution.then(settled, settled);
+        return resolution;
+    }
     async managedCredential(signal) {
         while (true) {
             const access = await this.bearerToken(signal);
@@ -1172,7 +1227,7 @@ export class OpenAICodexAuth extends Service {
     async resolveNativeCredential(signal) {
         try {
             throwIfCancelled(signal);
-            const managed = await this.managedCredential(signal);
+            const managed = await this.cachedManagedCredential(signal);
             if (managed !== undefined) {
                 throwIfCancelled(signal);
                 return { accessToken: managed.access, accountId: managed.accountId };

package/lib/native-adapter.d.ts

@@ -44,6 +44,13 @@ export declare class NativeCodexAdapter extends LlmAdapter {
     private assertNotAborted;
     providerInfo(provider: string): LlmProviderInfo;
     providerRetryPolicy(provider: string): ResolvedRetryPolicy;
+    /**
+     * Read model metadata, retrying once when a fetch returned nothing. The catalog
+     * caches nothing on failure, so a momentary outage otherwise empties every model
+     * list it touches; metadata is advisory and one extra request is cheaper than a
+     * provider that disappears from the picker until the next attempt.
+     */
+    private catalogModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
     resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;

package/lib/native-adapter.js

@@ -189,9 +189,22 @@ export class NativeCodexAdapter extends LlmAdapter {
         this.assertProvider(provider);
         return NATIVE_RETRY_POLICY;
     }
+    /**
+     * Read model metadata, retrying once when a fetch returned nothing. The catalog
+     * caches nothing on failure, so a momentary outage otherwise empties every model
+     * list it touches; metadata is advisory and one extra request is cheaper than a
+     * provider that disappears from the picker until the next attempt.
+     */
+    async catalogModels(signal) {
+        const first = await this.catalog?.list(signal) ?? [];
+        if (first.length > 0)
+            return first;
+        this.assertNotAborted(signal);
+        return await this.catalog?.list(signal) ?? [];
+    }
     async listModels(provider) {
         this.assertProvider(provider);
-        const models = await this.catalog?.list() ?? [];
+        const models = await this.catalogModels();
         const aliases = fastRoutes(models);
         return models
             .filter(model => model.visibility === 'list')
@@ -207,7 +220,7 @@ export class NativeCodexAdapter extends LlmAdapter {
     async resolveModel(provider, model, signal) {
         this.assertNotAborted(signal);
         this.assertProvider(provider);
-        const models = await this.catalog?.list(signal) ?? [];
+        const models = await this.catalogModels(signal);
         this.assertNotAborted(signal);
         const exact = models.find(candidate => candidate.slug === model);
         if (exact !== undefined)
@@ -216,7 +229,14 @@ export class NativeCodexAdapter extends LlmAdapter {
         if (fast !== undefined)
             return resolvedModel(provider, fast, true);
         if (model.endsWith(CODEX_FAST_ALIAS_SUFFIX)) {
-            throw new LlmError('native Codex Fast is not advertised for the selected model', 'FAST_UNSUPPORTED');
+            const base = model.slice(0, -CODEX_FAST_ALIAS_SUFFIX.length);
+            // Only a catalog that knows the base model can answer this negatively.
+            // Without any entry for it the metadata is missing rather than negative, and
+            // a caller that resolves every listed model (the picker) must not lose the
+            // whole provider group to an advisory fetch.
+            if (models.some(candidate => candidate.slug === base)) {
+                throw new LlmError('native Codex Fast is not advertised for the selected model', 'FAST_UNSUPPORTED');
+            }
         }
         return { provider, id: model, name: model };
     }

package/lib/native-websocket.js

@@ -191,6 +191,22 @@ function eventFailure(event) {
     }
     return retryError('native Codex WebSocket request was rejected', 'INVALID_REQUEST', facts);
 }
+/**
+ * One bounded log line naming the provider's own rejection, so an operator can
+ * see why the socket refused a request. The provider's free-form text stays in
+ * the log; it never becomes the provider-neutral error message.
+ */
+function rejectionDiagnostic(event) {
+    const error = typeof event.error === 'object' && event.error !== null
+        ? event.error : event;
+    const code = typeof error.code === 'string' && error.code.length > 0 ? error.code : undefined;
+    const raw = typeof error.message === 'string' ? error.message : '';
+    const message = raw.replace(/\s+/g, ' ').trim().slice(0, 300);
+    const status = typeof event.status === 'number' ? ` status=${String(event.status)}` : '';
+    const detail = [code, message.length === 0 ? undefined : message]
+        .filter((part) => part !== undefined).join(': ');
+    return `native Codex WebSocket rejected the request${status}${detail.length === 0 ? '' : ` (${detail})`}`;
+}
 /** Prefer WebSocket v2; once safe retries exhaust, keep that DSH session on HTTP. */
 export class NativeCodexWebSocketTransport {
     options;
@@ -399,8 +415,10 @@ export class NativeCodexWebSocketTransport {
             publishCodexRateLimits(accountId, parseCodexRateLimitHeaders(typeof rawEvent.headers === 'object' && rawEvent.headers !== null
                 ? rawEvent.headers : undefined), this.options.onRateLimits, this.options.warn);
             const wrapped = eventFailure(rawEvent);
-            if (wrapped !== undefined)
+            if (wrapped !== undefined) {
+                this.options.warn?.(rejectionDiagnostic(rawEvent));
                 throw wrapped;
+            }
             if (entry.turnState === undefined) {
                 const nextTurnState = codexResponseTurnState(event);
                 if (nextTurnState !== undefined)
@@ -478,10 +496,16 @@ export class NativeCodexWebSocketTransport {
             throw failure('native Codex WebSocket transport was disposed', 'DISPOSED');
         const key = sessionKey(generation, prepared.routingId);
         const entry = this.entry(key);
-        if (entry.busy)
-            throw failure('native Codex WebSocket session already has an active request', 'CONCURRENT_REQUEST');
-        if (this.active.size >= this.maxSessions) {
-            throw failure('native Codex WebSocket active session limit was reached', 'WS_SESSION_LIMIT');
+        // A second request for the same DSH session (the session-title call racing
+        // the first step, for example) cannot share one socket chain, and a
+        // saturated pool has no socket to lend. Both still have a correct transport
+        // over HTTP/SSE, so neither may fail the turn.
+        if (entry.busy || this.active.size >= this.maxSessions) {
+            this.options.warn?.(entry.busy
+                ? 'native Codex WebSocket session already has an active request; serving this request over HTTP/SSE'
+                : 'native Codex WebSocket active session limit was reached; serving this request over HTTP/SSE');
+            yield* this.http.stream(activeGeneration, mode, telemetry);
+            return;
         }
         entry.busy = true;
         this.active.set(entry, lifecycle);
@@ -545,6 +569,16 @@ export class NativeCodexWebSocketTransport {
                             throw failedStepRetry(failureValue);
                         throw failureValue;
                     }
+                    // A rejected request is not a transient socket condition: retrying the
+                    // socket repeats the rejection. The same payload has a correct
+                    // transport over HTTP/SSE, so keep this DSH session on HTTP from now on
+                    // instead of failing every later turn.
+                    if (failureValue.code === 'INVALID_REQUEST') {
+                        entry.disabled = true;
+                        yield* this.http.stream(activeGeneration, fallbackMode(), telemetry);
+                        requestCompleted = true;
+                        return;
+                    }
                     // Credential resolution may need the network itself, so wait until it recovers.
                     // Once a credential is available, however, a WebSocket-only outage must consume
                     // the bounded reconnect budget and then fall back to HTTP/SSE instead of leaving

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "OpenAI Codex Auth",
+    "description": "Native ChatGPT Codex provider with device-code login, its own model catalog and usage reporting, wired into the DSH Web GUI from the same origin."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "OpenAI Codex 认证",
+    "description": "原生 ChatGPT Codex 提供方：设备码登录、自带的模型目录与用量统计，与 DSH Web GUI 同源集成。"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {
@@ -28,9 +28,11 @@
       "default": "./lib/index.js"
     },
     "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "files": [
+    "locale",
     "lib/index.js",
     "lib/index.d.ts",
     "lib/catalog.js",