@pure01fx/dsh-openai-codex-auth 0.13.0 → 0.13.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## Unreleased
 
+## 0.13.2
+
+- Stops putting `is_error` on a replayed `function_call_output`. The Responses wire has no such field (Codex reports a failed tool through the output text and keeps its own `success` flag internal), one Lite model answers the unknown item field with a 400 `INVALID_REQUEST`, and because the item is replayed from durable history, a single failed tool call then fails every later request in that session.
+- Logs the provider's own rejection code, message, status and request id when an HTTP/SSE failure cannot be classified into a known code, matching the existing WebSocket diagnostic, so an opaque `INVALID_REQUEST` names its cause in the operator log.
+
+## 0.13.1
+
+- Serves a concurrent or pool-saturated request over HTTP/SSE instead of failing the turn.
+- Moves a session to HTTP/SSE after a 400-class WebSocket rejection, so one rejected request can no longer fail every later turn in that session.
+- Logs the provider's own rejection code, status and message instead of discarding them.
+- Keeps a Fast alias resolvable when the catalog could not be read and retries one empty catalog read, so a transient catalog outage no longer fails the whole provider group in the model picker; a catalog that answers without Fast still refuses it.
+- Memoizes the managed credential per credential-file signature with one shared resolution, so the model picker's per-model resolutions no longer take a dozen concurrent writer-lock acquisitions on the credential file (measured 2.1 s for 14 concurrent readers against a 2 s lock deadline before this change).
+- Adds `locale/en.json` and `locale/zh.json` so the DSH 0.2.0 plugin panel shows a display name and description instead of the package id.
+
 ## 0.13.0
 
 - Targets DSH 0.2.0-rc.2 with exact SDK peers, development dependencies and runtime helpers; retains the tool-message, shell and provenance migration below.

package/lib/catalog.js

@@ -265,7 +265,8 @@ export class NativeCodexCatalog {
             if (error instanceof LlmError && error.code === 'ABORTED')
                 throw error;
             if (!(error instanceof LlmError) || error.code !== 'MISSING_CREDENTIAL') {
-                this.options.warn?.('native Codex credential is unavailable; model metadata is advisory');
+                const code = error instanceof LlmError ? error.code : 'UNKNOWN';
+                this.options.warn?.(`native Codex credential is unavailable (${code}); model metadata is advisory`);
             }
             return { models: [] };
         }

package/lib/index.d.ts

@@ -132,6 +132,8 @@ export declare class OpenAICodexAuth extends Service {
     private usageAccountId;
     private responseUsage;
     private credentialAccountId;
+    private credentialMemo;
+    private credentialResolution;
     private usageError;
     private usageRefresh;
     private usageGeneration;
@@ -163,6 +165,15 @@ export declare class OpenAICodexAuth extends Service {
     private commitCredential;
     /** Return the current managed bearer token, refreshing and migrating it when needed. */
     bearerToken(signal?: AbortSignal): Promise<string | undefined>;
+    /**
+     * Resolve the managed credential for one native call, reusing a lock-free memo of
+     * the file it was read from. The model picker resolves one credential per listed
+     * model, so one shared resolution replaces a burst of lock acquisitions on the
+     * same credential file.
+     */
+    private cachedManagedCredential;
+    /** Resolve once for every concurrent caller; never memo a credential the file no longer matches. */
+    private resolveManagedCredential;
     private managedCredential;
     private externalNativeCredential;
     private resolveNativeCredential;

package/lib/index.js

@@ -6,7 +6,7 @@ import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { createServer } from 'node:http';
 import { createHash, randomBytes } from 'node:crypto';
-import { readFile, unlink } from 'node:fs/promises';
+import { readFile, stat, unlink } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { INVALID_CREDENTIAL_CODE, LlmError } from '@deepseek-ai/dsh-llm';
 import { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER, NativeCodexAdapter, } from './native-adapter.js';
@@ -256,6 +256,26 @@ async function readCredentialDocument(filename) {
         throw error;
     }
 }
+/**
+ * Cheap lock-free identity of the credential file. Every writer replaces it
+ * atomically, so both parts change and a cached read cannot outlive its file.
+ */
+async function credentialFileSignature(filename) {
+    try {
+        const info = await stat(filename);
+        // An atomic replacement renames a fresh file, so the inode changes with it.
+        return `${info.ino}:${info.mtimeMs}:${info.size}`;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return 'missing';
+        throw error;
+    }
+}
+/** Whether a managed credential still avoids the pre-refresh window `bearerToken` enforces. */
+function managedCredentialUsable(credential, now = Date.now()) {
+    return credential.expires > now + TOKEN_REFRESH_PREEMPT_MS;
+}
 function currentCredential(document) {
     if (document?.currentAccountId === null || document === undefined)
         return undefined;
@@ -722,6 +742,8 @@ export class OpenAICodexAuth extends Service {
     usageAccountId;
     responseUsage;
     credentialAccountId;
+    credentialMemo;
+    credentialResolution;
     usageError;
     usageRefresh;
     usageGeneration = 0;
@@ -1036,6 +1058,8 @@ export class OpenAICodexAuth extends Service {
         throw failure;
     }
     async commitDocument(document, signal) {
+        // A write may publish or replace the managed account, so no read memo survives it.
+        this.credentialMemo = undefined;
         const nextToken = currentCredential(document)?.access;
         const previous = await this.ctx.credentials.resolve(TOKEN_REF);
         throwIfCancelled(signal);
@@ -1143,6 +1167,37 @@ export class OpenAICodexAuth extends Service {
                 return access;
         }
     }
+    /**
+     * Resolve the managed credential for one native call, reusing a lock-free memo of
+     * the file it was read from. The model picker resolves one credential per listed
+     * model, so one shared resolution replaces a burst of lock acquisitions on the
+     * same credential file.
+     */
+    async cachedManagedCredential(signal) {
+        const signature = await credentialFileSignature(this.filename);
+        const memo = this.credentialMemo;
+        if (memo !== undefined && memo.signature === signature && managedCredentialUsable(memo.credential)) {
+            this.setCredentialAccount(memo.credential.accountId);
+            return memo.credential;
+        }
+        const pending = this.credentialResolution ??= this.resolveManagedCredential(signature);
+        return await waitForSignal(pending, signal);
+    }
+    /** Resolve once for every concurrent caller; never memo a credential the file no longer matches. */
+    resolveManagedCredential(signature) {
+        const resolution = this.managedCredential().then(async (credential) => {
+            if (credential !== undefined && await credentialFileSignature(this.filename) === signature) {
+                this.credentialMemo = { signature, credential };
+            }
+            return credential;
+        });
+        const settled = () => {
+            if (this.credentialResolution === resolution)
+                this.credentialResolution = undefined;
+        };
+        void resolution.then(settled, settled);
+        return resolution;
+    }
     async managedCredential(signal) {
         while (true) {
             const access = await this.bearerToken(signal);
@@ -1172,7 +1227,7 @@ export class OpenAICodexAuth extends Service {
     async resolveNativeCredential(signal) {
         try {
             throwIfCancelled(signal);
-            const managed = await this.managedCredential(signal);
+            const managed = await this.cachedManagedCredential(signal);
             if (managed !== undefined) {
                 throwIfCancelled(signal);
                 return { accessToken: managed.access, accountId: managed.accountId };

package/lib/native-adapter.d.ts

@@ -44,6 +44,13 @@ export declare class NativeCodexAdapter extends LlmAdapter {
     private assertNotAborted;
     providerInfo(provider: string): LlmProviderInfo;
     providerRetryPolicy(provider: string): ResolvedRetryPolicy;
+    /**
+     * Read model metadata, retrying once when a fetch returned nothing. The catalog
+     * caches nothing on failure, so a momentary outage otherwise empties every model
+     * list it touches; metadata is advisory and one extra request is cheaper than a
+     * provider that disappears from the picker until the next attempt.
+     */
+    private catalogModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
     resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;

package/lib/native-adapter.js

@@ -189,9 +189,22 @@ export class NativeCodexAdapter extends LlmAdapter {
         this.assertProvider(provider);
         return NATIVE_RETRY_POLICY;
     }
+    /**
+     * Read model metadata, retrying once when a fetch returned nothing. The catalog
+     * caches nothing on failure, so a momentary outage otherwise empties every model
+     * list it touches; metadata is advisory and one extra request is cheaper than a
+     * provider that disappears from the picker until the next attempt.
+     */
+    async catalogModels(signal) {
+        const first = await this.catalog?.list(signal) ?? [];
+        if (first.length > 0)
+            return first;
+        this.assertNotAborted(signal);
+        return await this.catalog?.list(signal) ?? [];
+    }
     async listModels(provider) {
         this.assertProvider(provider);
-        const models = await this.catalog?.list() ?? [];
+        const models = await this.catalogModels();
         const aliases = fastRoutes(models);
         return models
             .filter(model => model.visibility === 'list')
@@ -207,7 +220,7 @@ export class NativeCodexAdapter extends LlmAdapter {
     async resolveModel(provider, model, signal) {
         this.assertNotAborted(signal);
         this.assertProvider(provider);
-        const models = await this.catalog?.list(signal) ?? [];
+        const models = await this.catalogModels(signal);
         this.assertNotAborted(signal);
         const exact = models.find(candidate => candidate.slug === model);
         if (exact !== undefined)
@@ -216,7 +229,14 @@ export class NativeCodexAdapter extends LlmAdapter {
         if (fast !== undefined)
             return resolvedModel(provider, fast, true);
         if (model.endsWith(CODEX_FAST_ALIAS_SUFFIX)) {
-            throw new LlmError('native Codex Fast is not advertised for the selected model', 'FAST_UNSUPPORTED');
+            const base = model.slice(0, -CODEX_FAST_ALIAS_SUFFIX.length);
+            // Only a catalog that knows the base model can answer this negatively.
+            // Without any entry for it the metadata is missing rather than negative, and
+            // a caller that resolves every listed model (the picker) must not lose the
+            // whole provider group to an advisory fetch.
+            if (models.some(candidate => candidate.slug === base)) {
+                throw new LlmError('native Codex Fast is not advertised for the selected model', 'FAST_UNSUPPORTED');
+            }
         }
         return { provider, id: model, name: model };
     }

package/lib/native-http.js

@@ -6,7 +6,7 @@ import { nativeCodexAuthorityHash } from './catalog.js';
 import { nativeCodexEndpoint } from './endpoint.js';
 import { retryAfterMs, retryError, remainingRetryDelay, sleepRetry, inheritRetryDeadline } from './retry-after.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, NATIVE_CODEX_STREAM_INTERRUPTED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
-import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, streamResponses, responsesFailure, } from './responses.js';
+import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, rejectionDiagnostic, streamResponses, responsesFailure, } from './responses.js';
 import { hasNativeCodexReplayKind } from './replay.js';
 import { parseCodexResponseUsageMetadata, publishCodexResponseUsage, } from './response-usage.js';
 import { parseCodexRateLimitEvent, parseCodexRateLimitHeaders, publishCodexRateLimits, } from './rate-limits.js';
@@ -246,7 +246,7 @@ function errorFacts(response) {
             : { requestId: ProviderRequestId(requestId) },
     };
 }
-async function httpFailure(response, signal, telemetry) {
+async function httpFailure(response, signal, telemetry, warn) {
     const facts = errorFacts(response);
     const advice = retryError('native Codex HTTP retry advice', 'SERVER', facts);
     const fail = (message, code, options) => inheritRetryDeadline(fixedFailure(message, code, options), advice);
@@ -271,6 +271,15 @@ async function httpFailure(response, signal, telemetry) {
     if (response.status >= 500) {
         return fail('native Codex server request failed', 'SERVER', facts);
     }
+    // Every classified refusal above names itself. This branch is the only place
+    // where the provider's own reason would otherwise be discarded, so record it
+    // for the operator without turning it into the provider-neutral message.
+    warn?.(rejectionDiagnostic('HTTP', {
+        status: response.status,
+        ...detail.code === undefined ? {} : { code: detail.code },
+        ...detail.message === undefined ? {} : { message: detail.message },
+        ...facts?.requestId === undefined ? {} : { requestId: String(facts.requestId) },
+    }));
     return fail('native Codex request was rejected', 'INVALID_REQUEST', facts);
 }
 function mappedFailure(error, watchdog, parent) {
@@ -520,7 +529,7 @@ export class NativeCodexHttpTransport {
                 }
             }
             if (!response.ok) {
-                let failure = await httpFailure(response, watchdog.signal, telemetry);
+                let failure = await httpFailure(response, watchdog.signal, telemetry, this.options.warn);
                 if (generation.signal?.aborted || watchdog.timedOut()) {
                     failure = mappedFailure(failure, watchdog, generation.signal);
                 }

package/lib/native-websocket.js

@@ -9,7 +9,7 @@ import { NativeCodexHttpTransport, } from './native-http.js';
 import { replayableItemId } from './replay.js';
 import { parseCodexResponseUsageMetadata, publishCodexResponseUsage, } from './response-usage.js';
 import { parseCodexRateLimitEvent, parseCodexRateLimitHeaders, publishCodexRateLimits, } from './rate-limits.js';
-import { ResponsesStreamTranslator, responsesFailure, codexResponseTurnState, } from './responses.js';
+import { ResponsesStreamTranslator, rejectionDiagnostic, responsesFailure, codexResponseTurnState, } from './responses.js';
 import { NodeNativeCodexWebSocketFactory, } from './native-websocket-socket.js';
 import { NativeCodexWebSocketSessionState } from './native-websocket-session.js';
 const WS_BETA = 'responses_websockets=2026-02-06';
@@ -191,6 +191,18 @@ function eventFailure(event) {
     }
     return retryError('native Codex WebSocket request was rejected', 'INVALID_REQUEST', facts);
 }
+/** Adapt one raw socket failure event to the shared operator-facing rejection line. */
+function socketRejectionDiagnostic(event) {
+    const error = typeof event.error === 'object' && event.error !== null
+        ? event.error : event;
+    const requestId = eventHeader(event, 'x-request-id');
+    return rejectionDiagnostic('WebSocket', {
+        ...typeof event.status === 'number' ? { status: event.status } : {},
+        ...typeof error.code === 'string' ? { code: error.code } : {},
+        ...typeof error.message === 'string' ? { message: error.message } : {},
+        ...requestId === undefined ? {} : { requestId },
+    });
+}
 /** Prefer WebSocket v2; once safe retries exhaust, keep that DSH session on HTTP. */
 export class NativeCodexWebSocketTransport {
     options;
@@ -399,8 +411,10 @@ export class NativeCodexWebSocketTransport {
             publishCodexRateLimits(accountId, parseCodexRateLimitHeaders(typeof rawEvent.headers === 'object' && rawEvent.headers !== null
                 ? rawEvent.headers : undefined), this.options.onRateLimits, this.options.warn);
             const wrapped = eventFailure(rawEvent);
-            if (wrapped !== undefined)
+            if (wrapped !== undefined) {
+                this.options.warn?.(socketRejectionDiagnostic(rawEvent));
                 throw wrapped;
+            }
             if (entry.turnState === undefined) {
                 const nextTurnState = codexResponseTurnState(event);
                 if (nextTurnState !== undefined)
@@ -478,10 +492,16 @@ export class NativeCodexWebSocketTransport {
             throw failure('native Codex WebSocket transport was disposed', 'DISPOSED');
         const key = sessionKey(generation, prepared.routingId);
         const entry = this.entry(key);
-        if (entry.busy)
-            throw failure('native Codex WebSocket session already has an active request', 'CONCURRENT_REQUEST');
-        if (this.active.size >= this.maxSessions) {
-            throw failure('native Codex WebSocket active session limit was reached', 'WS_SESSION_LIMIT');
+        // A second request for the same DSH session (the session-title call racing
+        // the first step, for example) cannot share one socket chain, and a
+        // saturated pool has no socket to lend. Both still have a correct transport
+        // over HTTP/SSE, so neither may fail the turn.
+        if (entry.busy || this.active.size >= this.maxSessions) {
+            this.options.warn?.(entry.busy
+                ? 'native Codex WebSocket session already has an active request; serving this request over HTTP/SSE'
+                : 'native Codex WebSocket active session limit was reached; serving this request over HTTP/SSE');
+            yield* this.http.stream(activeGeneration, mode, telemetry);
+            return;
         }
         entry.busy = true;
         this.active.set(entry, lifecycle);
@@ -545,6 +565,16 @@ export class NativeCodexWebSocketTransport {
                             throw failedStepRetry(failureValue);
                         throw failureValue;
                     }
+                    // A rejected request is not a transient socket condition: retrying the
+                    // socket repeats the rejection. The same payload has a correct
+                    // transport over HTTP/SSE, so keep this DSH session on HTTP from now on
+                    // instead of failing every later turn.
+                    if (failureValue.code === 'INVALID_REQUEST') {
+                        entry.disabled = true;
+                        yield* this.http.stream(activeGeneration, fallbackMode(), telemetry);
+                        requestCompleted = true;
+                        return;
+                    }
                     // Credential resolution may need the network itself, so wait until it recovers.
                     // Once a credential is available, however, a WebSocket-only outage must consume
                     // the bounded reconnect budget and then fall back to HTTP/SSE instead of leaving

package/lib/responses.d.ts

@@ -54,6 +54,19 @@ export interface ResponsesUsage {
 export declare function mapResponsesUsage(usage: ResponsesUsage): TokenUsage;
 /** Classify in-band failure data without reflecting provider text. */
 export declare function responsesFailure(code?: string, message?: string, headers?: unknown): LlmError;
+export interface ProviderRejectionFacts {
+    status?: number;
+    code?: string;
+    message?: string;
+    requestId?: string;
+}
+/**
+ * One bounded operator-facing line naming the provider's own rejection, so a
+ * transport that cannot classify a refusal still records why it happened. The
+ * provider's free-form text stays in the log; it never becomes the
+ * provider-neutral error message.
+ */
+export declare function rejectionDiagnostic(transport: 'HTTP' | 'WebSocket', facts: ProviderRejectionFacts): string;
 interface ResponsesOutputItem {
     type?: string;
     id?: string;

package/lib/responses.js

@@ -77,7 +77,12 @@ export function toResponsesInput(messages, system) {
                 type: 'function_call_output',
                 call_id: String(message.toolCallId),
                 output: toolOutput(message.content),
-                ...message.isError === true ? { is_error: true } : {},
+                // The Responses wire has no error flag on a function call output: Codex
+                // keeps its own `success` metadata off the wire and reports a failed tool
+                // only through the output text. A Lite model rejects the unknown item
+                // field with a 400 INVALID_REQUEST, and because the item is replayed from
+                // durable history, every later request in that session fails the same way.
+                // `message.isError` stays DSH-side provenance for cloud context only.
             });
             continue;
         }
@@ -326,6 +331,23 @@ export function responsesFailure(code, message, headers) {
         ...delay === undefined ? {} : { providerRetryAfterMs: delay },
     });
 }
+/**
+ * One bounded operator-facing line naming the provider's own rejection, so a
+ * transport that cannot classify a refusal still records why it happened. The
+ * provider's free-form text stays in the log; it never becomes the
+ * provider-neutral error message.
+ */
+export function rejectionDiagnostic(transport, facts) {
+    const code = facts.code !== undefined && facts.code.length > 0 ? facts.code : undefined;
+    const message = (facts.message ?? '').replace(/\s+/g, ' ').trim().slice(0, 300);
+    const status = facts.status === undefined ? '' : ` status=${String(facts.status)}`;
+    const requestId = facts.requestId === undefined || facts.requestId.length === 0
+        ? '' : ` request_id=${facts.requestId}`;
+    const detail = [code, message.length === 0 ? undefined : message]
+        .filter((part) => part !== undefined).join(': ');
+    return `native Codex ${transport} rejected the request${status}${requestId}`
+        + `${detail.length === 0 ? '' : ` (${detail})`}`;
+}
 function eventItemId(event) {
     if (typeof event.item_id === 'string' && event.item_id.length > 0)
         return event.item_id;

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "OpenAI Codex Auth",
+    "description": "Native ChatGPT Codex provider with device-code login, its own model catalog and usage reporting, wired into the DSH Web GUI from the same origin."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "OpenAI Codex 认证",
+    "description": "原生 ChatGPT Codex 提供方：设备码登录、自带的模型目录与用量统计，与 DSH Web GUI 同源集成。"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {
@@ -28,9 +28,11 @@
       "default": "./lib/index.js"
     },
     "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "files": [
+    "locale",
     "lib/index.js",
     "lib/index.d.ts",
     "lib/catalog.js",