@pure01fx/dsh-openai-codex-auth 0.13.1 → 0.13.3

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.13.3
+
+- Supplies a replacement token-meter service through the package composition patch, so Codex encrypted reasoning participates in retained-history pricing and pressure reductions after compaction without changing Harness source. Reuses ordinary host pricing, preserves fixed heuristic projections, and corrects usage anchors without double-counting reasoning output. Preserves an explicitly reported zero reasoning count so it does not trigger the missing-detail fallback.
+
+## 0.13.2
+
+- Stops putting `is_error` on a replayed `function_call_output`. The Responses wire has no such field (Codex reports a failed tool through the output text and keeps its own `success` flag internal), one Lite model answers the unknown item field with a 400 `INVALID_REQUEST`, and because the item is replayed from durable history, a single failed tool call then fails every later request in that session.
+- Logs the provider's own rejection code, message, status and request id when an HTTP/SSE failure cannot be classified into a known code, matching the existing WebSocket diagnostic, so an opaque `INVALID_REQUEST` names its cause in the operator log.
+
 ## 0.13.1
 
 - Serves a concurrent or pool-saturated request over HTTP/SSE instead of failing the turn.

package/README.md

@@ -259,7 +259,11 @@ $DSH_HOME/openai-codex-auth.json
 
 从 0.6 开始，Native Adapter 是插件默认 Provider，并持有生产 route `openai-codex`。旧预览会话确实需要时，可显式设置 `nativeCompatibilityRoute: true`，让同一个 adapter 同时注册 `openai-codex-native` 兼容 route；启用兼容 route 时两者仍原子注册，任一 route 已被占用都会整体失败。默认只暴露生产 route。
 
-本包只定义 Codex Provider，不发布或改写任何具体 Profile。整合包必须在挂载本插件前释放已有的 `openai-codex` route，例如从自己的 `llm-pi-ai` provider map 中移除该项；本包不会清空未知的 sibling providers。只想复用 OAuth/UI 并继续使用外部 Provider 的组合可以显式设置 `nativeAdapter: false`。从 pi-ai 切到 Native 时，旧 foreign replay 会降级为可见持久历史；反向切回 pi-ai 后，已产生 Native replay 的进行中 session 不保证可续跑，应新建 session。
+本包提供 Codex Provider 和计量服务替代入口，不发布具体 Profile。整合包必须在挂载本插件前释放已有的 `openai-codex` route，例如从自己的 `llm-pi-ai` provider map 中移除该项；本包不会清空未知的 sibling providers。只想复用 OAuth/UI 并继续使用外部 Provider 的组合可以显式设置 `nativeAdapter: false`。从 pi-ai 切到 Native 时，旧 foreign replay 会降级为可见持久历史；反向切回 pi-ai 后，已产生 Native replay 的进行中 session 不保证可续跑，应新建 session。
+
+`cordis.patch.yml` 会禁用 base bundle 的 `token-meter` 节点，并挂载本包 `/token-meter` 入口作为唯一的 `ctx.tokenMeter`；无需修改 DSH 源码。自定义组合应禁用自己的默认计量服务，再挂载同一入口，不能同时运行两个计量服务。服务复用宿主的文本、图片、文件和投影实现，只对源 route 与目标 route 属于同一个活跃 Native Codex adapter 的历史补充加密推理价格；`nativeAdapter: false` 和其他模型沿用宿主价格。
+
+加密推理计量优先使用原始响应的 `usage.reasoningTokens`，每次响应计一次；缺少推理细分时以 `outputTokens` 作为生成推理的保守上界，连用量也没有时才用解码密文的字节数作体积估算。这些都是重放占用估计，不是精确的服务端输入计费。计量会同时修正节点 `tokens`、`surfaceTokens`、完整锚点与有符号的 `surfaceDeltaTokens`，服务端已计入的推理不会再加一次，压缩移除历史时会扣减隐藏占用；`heuristicTokens`、持久消息和服务端用量保持原语义。宿主 UI 的固定启发式投影仍由原实现提供，不包含本包的隐藏推理估计。
 
 上游 Native Codex Responses 请求没有输出 token 上限字段，因此普通会话若显式设置 `maxTokens` 仍会在 Provider I/O 前失败。DSH 的压缩与会话标题辅助调用会固定携带 `maxTokens`，并分别通过 `purpose: compaction` 与 `purpose: session-title` 标识；本适配器允许这两类 hint 通过，但不会把它序列化为 `max_output_tokens`，实际输出长度仍由 Native Codex 决定。
 

package/cordis.patch.yml

@@ -1,5 +1,10 @@
 # Native Codex is the package default. Integration bundles own any removal or
 # replacement of an existing openai-codex route before mounting this plugin.
+# Replace the service provider without renaming the base token-meter row.
+- id: token-meter
+  disabled: true
 - insert:
     - id: openai-codex-auth
       name: '@pure01fx/dsh-openai-codex-auth'
+    - id: codex-token-meter
+      name: '@pure01fx/dsh-openai-codex-auth/token-meter'

package/lib/index.js

@@ -9,7 +9,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import { readFile, stat, unlink } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { INVALID_CREDENTIAL_CODE, LlmError } from '@deepseek-ai/dsh-llm';
-import { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER, NativeCodexAdapter, } from './native-adapter.js';
+import { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER, NativeCodexAdapter, registerNativeCodexAdapter, } from './native-adapter.js';
 export { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER } from './native-adapter.js';
 import { NativeCodexCatalog } from './catalog.js';
 import { NativeCodexHttpTransport } from './native-http.js';
@@ -795,7 +795,7 @@ export class OpenAICodexAuth extends Service {
                 ctx.effect(() => () => { transport.dispose(); }, 'openai-codex-auth: dispose native WebSockets');
             }
             ctx.inject(['llm'], (llmCtx) => {
-                llmCtx.llm.registerAdapter([
+                registerNativeCodexAdapter(llmCtx, [
                     CODEX_PROVIDER,
                     ...(this.routeConfig.nativeCompatibilityRoute ? [NATIVE_CODEX_PROVIDER] : []),
                 ], new NativeCodexAdapter(catalog, transport));

package/lib/native-adapter.d.ts

@@ -1,10 +1,26 @@
 /** Native Codex adapter with live catalog and HTTP/WebSocket transport delegation. */
-import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmProviderInfo, type LlmResolvedModelInfo, type ResolvedRetryPolicy, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmRuntime, type LlmProviderInfo, type LlmResolvedModelInfo, type ResolvedRetryPolicy, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { type Context } from '@deepseek-ai/cordis';
 import type { NativeCodexModel, NativeCodexModelCatalog } from './catalog.js';
 /** Production provider route owned by the package native Codex adapter after M6 cutover. */
 export declare const CODEX_PROVIDER = "openai-codex";
 /** Compatibility route retained for sessions created during the native preview. */
 export declare const NATIVE_CODEX_PROVIDER = "openai-codex-native";
+/**
+ * Register native routes and their replay-pricing ownership in the same Cordis scope.
+ * @param ctx - scope owning the native adapter registration.
+ * @param providers - canonical and optional compatibility routes for this instance.
+ * @param adapter - native adapter that will replay its own continuation state.
+ */
+export declare function registerNativeCodexAdapter(ctx: Context, providers: string[], adapter: NativeCodexAdapter): void;
+/**
+ * Match the runtime's same-adapter ownership rule for native continuation replay.
+ * @param runtime - current global LLM service instance.
+ * @param sourceProvider - provider that produced the historical assistant message.
+ * @param targetProvider - provider preparing the measured request.
+ * @returns whether both routes are currently owned by the same native adapter.
+ */
+export declare function canReplayNativeCodex(runtime: LlmRuntime, sourceProvider: string, targetProvider: string): boolean;
 export declare const CODEX_FAST_ALIAS_SUFFIX = "-fast";
 export declare const CODEX_FAST_SERVICE_TIER = "priority";
 /** Pure network establishment failure; retried without consuming the finite stream budget. */

package/lib/native-adapter.js

@@ -1,10 +1,53 @@
 /** Native Codex adapter with live catalog and HTTP/WebSocket transport delegation. */
 import { LlmAdapter, LlmError, ReasoningEffortId, } from '@deepseek-ai/dsh-llm';
+import { symbols } from '@deepseek-ai/cordis';
 /** Production provider route owned by the package native Codex adapter after M6 cutover. */
 export const CODEX_PROVIDER = 'openai-codex';
 /** Compatibility route retained for sessions created during the native preview. */
 export const NATIVE_CODEX_PROVIDER = 'openai-codex-native';
 const OWNED_CODEX_PROVIDERS = new Set([CODEX_PROVIDER, NATIVE_CODEX_PROVIDER]);
+const replayOwners = new WeakMap();
+// Cordis returns scope-traced views; use the original service for ownership identity.
+function runtimeKey(runtime) {
+    return Reflect.get(runtime, symbols.original) ?? runtime;
+}
+/**
+ * Register native routes and their replay-pricing ownership in the same Cordis scope.
+ * @param ctx - scope owning the native adapter registration.
+ * @param providers - canonical and optional compatibility routes for this instance.
+ * @param adapter - native adapter that will replay its own continuation state.
+ */
+export function registerNativeCodexAdapter(ctx, providers, adapter) {
+    const runtime = ctx.get('llm');
+    if (runtime === undefined)
+        throw new Error('native Codex registration requires llm');
+    ctx.llm.registerAdapter(providers, adapter);
+    ctx.effect(() => {
+        let owners = replayOwners.get(runtimeKey(runtime));
+        if (owners === undefined)
+            replayOwners.set(runtimeKey(runtime), owners = new Map());
+        for (const provider of providers)
+            owners.set(provider, adapter);
+        return () => {
+            for (const provider of providers) {
+                if (owners.get(provider) === adapter)
+                    owners.delete(provider);
+            }
+        };
+    });
+}
+/**
+ * Match the runtime's same-adapter ownership rule for native continuation replay.
+ * @param runtime - current global LLM service instance.
+ * @param sourceProvider - provider that produced the historical assistant message.
+ * @param targetProvider - provider preparing the measured request.
+ * @returns whether both routes are currently owned by the same native adapter.
+ */
+export function canReplayNativeCodex(runtime, sourceProvider, targetProvider) {
+    const owners = replayOwners.get(runtimeKey(runtime));
+    const adapter = owners?.get(targetProvider);
+    return adapter !== undefined && owners?.get(sourceProvider) === adapter;
+}
 export const CODEX_FAST_ALIAS_SUFFIX = '-fast';
 export const CODEX_FAST_SERVICE_TIER = 'priority';
 /** Pure network establishment failure; retried without consuming the finite stream budget. */

package/lib/native-http.js

@@ -6,7 +6,7 @@ import { nativeCodexAuthorityHash } from './catalog.js';
 import { nativeCodexEndpoint } from './endpoint.js';
 import { retryAfterMs, retryError, remainingRetryDelay, sleepRetry, inheritRetryDeadline } from './retry-after.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, NATIVE_CODEX_STREAM_INTERRUPTED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
-import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, streamResponses, responsesFailure, } from './responses.js';
+import { boundedCodexTurnState, codexRequestBody, codexResponseTurnState, rejectionDiagnostic, streamResponses, responsesFailure, } from './responses.js';
 import { hasNativeCodexReplayKind } from './replay.js';
 import { parseCodexResponseUsageMetadata, publishCodexResponseUsage, } from './response-usage.js';
 import { parseCodexRateLimitEvent, parseCodexRateLimitHeaders, publishCodexRateLimits, } from './rate-limits.js';
@@ -246,7 +246,7 @@ function errorFacts(response) {
             : { requestId: ProviderRequestId(requestId) },
     };
 }
-async function httpFailure(response, signal, telemetry) {
+async function httpFailure(response, signal, telemetry, warn) {
     const facts = errorFacts(response);
     const advice = retryError('native Codex HTTP retry advice', 'SERVER', facts);
     const fail = (message, code, options) => inheritRetryDeadline(fixedFailure(message, code, options), advice);
@@ -271,6 +271,15 @@ async function httpFailure(response, signal, telemetry) {
     if (response.status >= 500) {
         return fail('native Codex server request failed', 'SERVER', facts);
     }
+    // Every classified refusal above names itself. This branch is the only place
+    // where the provider's own reason would otherwise be discarded, so record it
+    // for the operator without turning it into the provider-neutral message.
+    warn?.(rejectionDiagnostic('HTTP', {
+        status: response.status,
+        ...detail.code === undefined ? {} : { code: detail.code },
+        ...detail.message === undefined ? {} : { message: detail.message },
+        ...facts?.requestId === undefined ? {} : { requestId: String(facts.requestId) },
+    }));
     return fail('native Codex request was rejected', 'INVALID_REQUEST', facts);
 }
 function mappedFailure(error, watchdog, parent) {
@@ -520,7 +529,7 @@ export class NativeCodexHttpTransport {
                 }
             }
             if (!response.ok) {
-                let failure = await httpFailure(response, watchdog.signal, telemetry);
+                let failure = await httpFailure(response, watchdog.signal, telemetry, this.options.warn);
                 if (generation.signal?.aborted || watchdog.timedOut()) {
                     failure = mappedFailure(failure, watchdog, generation.signal);
                 }

package/lib/native-websocket.js

@@ -9,7 +9,7 @@ import { NativeCodexHttpTransport, } from './native-http.js';
 import { replayableItemId } from './replay.js';
 import { parseCodexResponseUsageMetadata, publishCodexResponseUsage, } from './response-usage.js';
 import { parseCodexRateLimitEvent, parseCodexRateLimitHeaders, publishCodexRateLimits, } from './rate-limits.js';
-import { ResponsesStreamTranslator, responsesFailure, codexResponseTurnState, } from './responses.js';
+import { ResponsesStreamTranslator, rejectionDiagnostic, responsesFailure, codexResponseTurnState, } from './responses.js';
 import { NodeNativeCodexWebSocketFactory, } from './native-websocket-socket.js';
 import { NativeCodexWebSocketSessionState } from './native-websocket-session.js';
 const WS_BETA = 'responses_websockets=2026-02-06';
@@ -191,21 +191,17 @@ function eventFailure(event) {
     }
     return retryError('native Codex WebSocket request was rejected', 'INVALID_REQUEST', facts);
 }
-/**
- * One bounded log line naming the provider's own rejection, so an operator can
- * see why the socket refused a request. The provider's free-form text stays in
- * the log; it never becomes the provider-neutral error message.
- */
-function rejectionDiagnostic(event) {
+/** Adapt one raw socket failure event to the shared operator-facing rejection line. */
+function socketRejectionDiagnostic(event) {
     const error = typeof event.error === 'object' && event.error !== null
         ? event.error : event;
-    const code = typeof error.code === 'string' && error.code.length > 0 ? error.code : undefined;
-    const raw = typeof error.message === 'string' ? error.message : '';
-    const message = raw.replace(/\s+/g, ' ').trim().slice(0, 300);
-    const status = typeof event.status === 'number' ? ` status=${String(event.status)}` : '';
-    const detail = [code, message.length === 0 ? undefined : message]
-        .filter((part) => part !== undefined).join(': ');
-    return `native Codex WebSocket rejected the request${status}${detail.length === 0 ? '' : ` (${detail})`}`;
+    const requestId = eventHeader(event, 'x-request-id');
+    return rejectionDiagnostic('WebSocket', {
+        ...typeof event.status === 'number' ? { status: event.status } : {},
+        ...typeof error.code === 'string' ? { code: error.code } : {},
+        ...typeof error.message === 'string' ? { message: error.message } : {},
+        ...requestId === undefined ? {} : { requestId },
+    });
 }
 /** Prefer WebSocket v2; once safe retries exhaust, keep that DSH session on HTTP. */
 export class NativeCodexWebSocketTransport {
@@ -416,7 +412,7 @@ export class NativeCodexWebSocketTransport {
                 ? rawEvent.headers : undefined), this.options.onRateLimits, this.options.warn);
             const wrapped = eventFailure(rawEvent);
             if (wrapped !== undefined) {
-                this.options.warn?.(rejectionDiagnostic(rawEvent));
+                this.options.warn?.(socketRejectionDiagnostic(rawEvent));
                 throw wrapped;
             }
             if (entry.turnState === undefined) {

package/lib/replay.d.ts

@@ -1,5 +1,5 @@
 /** Versioned Codex Responses continuation state. */
-import { type ContentBlock } from '@deepseek-ai/dsh-llm';
+import { type AssistantProviderMetadata, type ContentBlock, type TokenUsage } from '@deepseek-ai/dsh-llm';
 export declare const NATIVE_CODEX_REPLAY_KIND = "openai-codex-native.responses-replay";
 export declare const NATIVE_CODEX_REPLAY_VERSION = 1;
 export type CodexMessagePhase = 'commentary' | 'partial_answer' | 'final_answer';
@@ -36,6 +36,16 @@ export interface NativeCodexReplaySource {
 export declare function replayableItemId(value: string | undefined): string | undefined;
 /** True only for legacy raw state or an rc.2 envelope emitted by this package. */
 export declare function hasNativeCodexReplayKind(value: unknown): boolean;
+/**
+ * Estimate hidden reasoning only when the native continuation replays encrypted items.
+ * A response's reasoning usage is charged once, not once per reasoning item.
+ * Without reasoning details, output usage bounds the generated reasoning; without
+ * usage, decoded ciphertext bytes are a size heuristic, not exact token billing.
+ * @param source - original provider/model and native continuation state.
+ * @param usage - original response usage, when available in the durable event.
+ * @returns additional hidden replay tokens; zero for non-native or unencrypted state.
+ */
+export declare function estimateNativeCodexReplayTokens(source: AssistantProviderMetadata, usage?: TokenUsage): number;
 /** Attempt-local accumulator for completed replay descriptors. */
 export declare class NativeCodexReplayCapture {
     private readonly provider;

package/lib/replay.js

@@ -125,6 +125,29 @@ function parseState(value) {
         items,
     };
 }
+/**
+ * Estimate hidden reasoning only when the native continuation replays encrypted items.
+ * A response's reasoning usage is charged once, not once per reasoning item.
+ * Without reasoning details, output usage bounds the generated reasoning; without
+ * usage, decoded ciphertext bytes are a size heuristic, not exact token billing.
+ * @param source - original provider/model and native continuation state.
+ * @param usage - original response usage, when available in the durable event.
+ * @returns additional hidden replay tokens; zero for non-native or unencrypted state.
+ */
+export function estimateNativeCodexReplayTokens(source, usage) {
+    if (!hasNativeCodexReplayKind(source.replayState))
+        return 0;
+    const state = parseState(source.replayState);
+    if (state.provider !== source.provider || state.model !== source.model) {
+        throw failure('native Codex replay identity does not match its assistant message');
+    }
+    const encrypted = state.items.flatMap(item => item.type === 'reasoning' && item.encryptedContent !== undefined ? [item.encryptedContent] : []);
+    if (encrypted.length === 0)
+        return 0;
+    if (usage !== undefined)
+        return usage.reasoningTokens ?? usage.outputTokens;
+    return encrypted.reduce((total, content) => total + Buffer.byteLength(content, 'base64'), 0);
+}
 /** Attempt-local accumulator for completed replay descriptors. */
 export class NativeCodexReplayCapture {
     provider;

package/lib/responses.d.ts

@@ -54,6 +54,19 @@ export interface ResponsesUsage {
 export declare function mapResponsesUsage(usage: ResponsesUsage): TokenUsage;
 /** Classify in-band failure data without reflecting provider text. */
 export declare function responsesFailure(code?: string, message?: string, headers?: unknown): LlmError;
+export interface ProviderRejectionFacts {
+    status?: number;
+    code?: string;
+    message?: string;
+    requestId?: string;
+}
+/**
+ * One bounded operator-facing line naming the provider's own rejection, so a
+ * transport that cannot classify a refusal still records why it happened. The
+ * provider's free-form text stays in the log; it never becomes the
+ * provider-neutral error message.
+ */
+export declare function rejectionDiagnostic(transport: 'HTTP' | 'WebSocket', facts: ProviderRejectionFacts): string;
 interface ResponsesOutputItem {
     type?: string;
     id?: string;

package/lib/responses.js

@@ -77,7 +77,12 @@ export function toResponsesInput(messages, system) {
                 type: 'function_call_output',
                 call_id: String(message.toolCallId),
                 output: toolOutput(message.content),
-                ...message.isError === true ? { is_error: true } : {},
+                // The Responses wire has no error flag on a function call output: Codex
+                // keeps its own `success` metadata off the wire and reports a failed tool
+                // only through the output text. A Lite model rejects the unknown item
+                // field with a 400 INVALID_REQUEST, and because the item is replayed from
+                // durable history, every later request in that session fails the same way.
+                // `message.isError` stays DSH-side provenance for cloud context only.
             });
             continue;
         }
@@ -284,7 +289,7 @@ export function mapResponsesUsage(usage) {
         inputTokens: uncached, outputTokens: output,
         ...cached === 0 ? {} : { cacheReadTokens: cached },
         ...written === 0 ? {} : { cacheWriteTokens: written },
-        ...reasoning === 0 ? {} : { reasoningTokens: reasoning },
+        ...usage.output_tokens_details?.reasoning_tokens === undefined ? {} : { reasoningTokens: reasoning },
     };
 }
 function retryDelay(message) {
@@ -326,6 +331,23 @@ export function responsesFailure(code, message, headers) {
         ...delay === undefined ? {} : { providerRetryAfterMs: delay },
     });
 }
+/**
+ * One bounded operator-facing line naming the provider's own rejection, so a
+ * transport that cannot classify a refusal still records why it happened. The
+ * provider's free-form text stays in the log; it never becomes the
+ * provider-neutral error message.
+ */
+export function rejectionDiagnostic(transport, facts) {
+    const code = facts.code !== undefined && facts.code.length > 0 ? facts.code : undefined;
+    const message = (facts.message ?? '').replace(/\s+/g, ' ').trim().slice(0, 300);
+    const status = facts.status === undefined ? '' : ` status=${String(facts.status)}`;
+    const requestId = facts.requestId === undefined || facts.requestId.length === 0
+        ? '' : ` request_id=${facts.requestId}`;
+    const detail = [code, message.length === 0 ? undefined : message]
+        .filter((part) => part !== undefined).join(': ');
+    return `native Codex ${transport} rejected the request${status}${requestId}`
+        + `${detail.length === 0 ? '' : ` (${detail})`}`;
+}
 function eventItemId(event) {
     if (typeof event.item_id === 'string' && event.item_id.length > 0)
         return event.item_id;

package/lib/token-meter.d.ts

@@ -0,0 +1,26 @@
+/** Codex hidden-replay pricing layered over the host's ordinary token meter. */
+import { TokenMeter } from '@deepseek-ai/dsh-token-meter';
+import type { TokenMeasurement } from '@deepseek-ai/dsh-token-meter';
+import type { EpochHeader, Session } from '@deepseek-ai/dsh-session';
+/**
+ * Replacement tokenMeter service that charges native Codex encrypted reasoning.
+ * Ordinary prices and projections come from the host meter. Hidden prices apply
+ * only between routes currently owned by the same native adapter; fixed
+ * heuristicTokens stay unchanged. Provider usage is not charged a second time.
+ */
+export declare class CodexTokenMeter extends TokenMeter {
+    private readonly hiddenFolds;
+    /**
+     * Return a detached measurement including opaque native replay in node prices,
+     * surface totals, and signed anchor deltas. Recheck usage conservatism against
+     * the corrected full anchor before reusing the provider sample.
+     * @param session - session to price through its current durable tail.
+     * @param requestHeader - optional effective routed request envelope.
+     * @returns immutable request pressure and positional message prices.
+     */
+    measure(session: Session, requestHeader?: EpochHeader): TokenMeasurement;
+    /** Track only replay metadata and surface positions; the host validates each event first. */
+    private syncHidden;
+    private foldHidden;
+}
+export default CodexTokenMeter;

package/lib/token-meter.js

@@ -0,0 +1,135 @@
+/** Codex hidden-replay pricing layered over the host's ordinary token meter. */
+import { TokenMeter } from '@deepseek-ai/dsh-token-meter';
+import { estimateToolsTokens } from '@deepseek-ai/dsh-token-meter/estimate';
+import { assembleAssistantStream } from '@deepseek-ai/dsh-llm';
+import { canonicalHeader, deriveEventMessage, headerEquals, isSurfaceEvent, SessionSeq, } from '@deepseek-ai/dsh-session';
+import { canReplayNativeCodex } from './native-adapter.js';
+import { estimateNativeCodexReplayTokens } from './replay.js';
+function replayPrice(message, usage) {
+    if (message?.role !== 'assistant' || message.source.kind !== 'model')
+        return undefined;
+    return { source: message.source, usage };
+}
+function sameHeader(a, b) {
+    return a === undefined || b === undefined ? a === b : headerEquals(a, b);
+}
+/**
+ * Replacement tokenMeter service that charges native Codex encrypted reasoning.
+ * Ordinary prices and projections come from the host meter. Hidden prices apply
+ * only between routes currently owned by the same native adapter; fixed
+ * heuristicTokens stay unchanged. Provider usage is not charged a second time.
+ */
+export class CodexTokenMeter extends TokenMeter {
+    hiddenFolds = new WeakMap();
+    /**
+     * Return a detached measurement including opaque native replay in node prices,
+     * surface totals, and signed anchor deltas. Recheck usage conservatism against
+     * the corrected full anchor before reusing the provider sample.
+     * @param session - session to price through its current durable tail.
+     * @param requestHeader - optional effective routed request envelope.
+     * @returns immutable request pressure and positional message prices.
+     */
+    measure(session, requestHeader) {
+        const base = super.measure(session, requestHeader);
+        const state = this.syncHidden(session, base.logRevision);
+        const header = requestHeader === undefined ? state.header : canonicalHeader(requestHeader);
+        const runtime = this.ctx.get('llm');
+        const provider = header?.config?.provider;
+        if (runtime === undefined || provider === undefined)
+            return base;
+        const price = (replay) => {
+            if (replay === undefined || !canReplayNativeCodex(runtime, replay.source.provider, provider))
+                return 0;
+            return replay.tokens ??= estimateNativeCodexReplayTokens(replay.source, replay.usage);
+        };
+        const current = new Map(state.nodes.map(node => [node.seq, price(node.replay)]));
+        const hiddenCurrent = base.nodes.reduce((total, node) => total + (current.get(node.seq) ?? 0), 0);
+        const anchor = state.anchor;
+        const matched = anchor !== undefined && sameHeader(anchor.header, header);
+        const hiddenAnchor = matched
+            ? anchor.nodes.reduce((total, node) => total + price(node.replay), 0) + price(anchor.assistant)
+            : 0;
+        if (hiddenCurrent === 0 && hiddenAnchor === 0)
+            return base;
+        let baseline = base.baseline;
+        let surfaceDeltaTokens = base.surfaceDeltaTokens;
+        if (matched) {
+            surfaceDeltaTokens += hiddenCurrent - hiddenAnchor;
+            if (base.baseline.kind === 'usage') {
+                const estimatedAnchor = estimateToolsTokens(header)
+                    + base.surfaceTokens - base.surfaceDeltaTokens + hiddenAnchor;
+                if (base.baseline.tokens < estimatedAnchor) {
+                    baseline = Object.freeze({ kind: 'estimated', tokens: estimatedAnchor });
+                }
+            }
+            else if (base.baseline.kind === 'estimated') {
+                baseline = Object.freeze({ kind: 'estimated', tokens: base.baseline.tokens + hiddenAnchor });
+            }
+        }
+        else if (base.baseline.kind === 'estimated') {
+            baseline = Object.freeze({ kind: 'estimated', tokens: base.baseline.tokens + hiddenCurrent });
+        }
+        const nodes = Object.freeze(base.nodes.map(node => Object.freeze({
+            ...node, tokens: node.tokens + (current.get(node.seq) ?? 0),
+        })));
+        return Object.freeze({
+            ...base,
+            baseline,
+            surfaceDeltaTokens,
+            totalTokens: Math.max(0, baseline.tokens + surfaceDeltaTokens),
+            surfaceTokens: base.surfaceTokens + hiddenCurrent,
+            nodes,
+        });
+    }
+    /** Track only replay metadata and surface positions; the host validates each event first. */
+    syncHidden(session, revision) {
+        let state = this.hiddenFolds.get(session);
+        if (state === undefined) {
+            state = { consumed: 0, header: undefined, nodes: [], anchor: undefined };
+            this.hiddenFolds.set(session, state);
+        }
+        while (state.consumed < revision) {
+            const event = session.eventAt(SessionSeq(state.consumed));
+            if (event === undefined)
+                throw new Error('Codex token meter: missing consumed session event');
+            this.foldHidden(state, event);
+            state.consumed++;
+        }
+        return state;
+    }
+    foldHidden(state, event) {
+        const header = event.type === 'request/header' ? canonicalHeader(event.data.header) : state.header;
+        const node = isSurfaceEvent(event) ? {
+            seq: event.seq,
+            replay: replayPrice(deriveEventMessage(event), event.type === 'assistant/message' ? event.data.usage : undefined),
+        } : undefined;
+        let anchor = state.anchor;
+        if (event.type === 'assistant/message') {
+            const route = header?.config;
+            const original = event.data.usage !== undefined && route !== undefined
+                ? { source: {
+                        provider: route.provider,
+                        model: route.model,
+                        replayState: assembleAssistantStream(event.data.stream).replayState,
+                    }, usage: event.data.usage }
+                : node?.replay;
+            anchor = { header, nodes: state.nodes.slice(), assistant: original };
+        }
+        if (node !== undefined && isSurfaceEvent(event)) {
+            if (event.surfaceOp === 'append') {
+                state.nodes.push(node);
+            }
+            else {
+                const { startSeq, endSeq } = event.surfaceOp;
+                const first = state.nodes.findIndex(item => item.seq === startSeq);
+                const last = state.nodes.findIndex(item => item.seq === endSeq);
+                if (first < 0 || last < first)
+                    throw new Error('Codex token meter: invalid surface replacement');
+                state.nodes.splice(first, last - first + 1, node);
+            }
+        }
+        state.header = header;
+        state.anchor = anchor;
+    }
+}
+export default CodexTokenMeter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {
@@ -27,6 +27,10 @@
       "types": "./lib/index.d.ts",
       "default": "./lib/index.js"
     },
+    "./token-meter": {
+      "types": "./lib/token-meter.d.ts",
+      "default": "./lib/token-meter.js"
+    },
     "./client": "./client.js",
     "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
@@ -55,6 +59,8 @@
     "lib/responses.d.ts",
     "lib/replay.js",
     "lib/replay.d.ts",
+    "lib/token-meter.js",
+    "lib/token-meter.d.ts",
     "lib/retry-after.js",
     "lib/retry-after.d.ts",
     "lib/rate-limits.js",
@@ -116,12 +122,14 @@
     }
   },
   "peerDependencies": {
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
     "@deepseek-ai/cordis": "~4.0.4",
     "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
     "@deepseek-ai/dsh-credentials": "0.2.0-rc.2",
     "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
     "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
     "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-token-meter": "0.2.0-rc.2",
     "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
     "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
     "@deepseek-ai/dsh-shell": "0.2.0-rc.2",
@@ -138,7 +146,13 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.5",
+    "@deepseek-ai/cordis-plugin-include": "1.0.9",
+    "js-yaml": "^4.1.0",
+    "@types/js-yaml": "^4.0.9",
     "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-compaction-basic": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
     "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
     "@deepseek-ai/dsh-attachment-local": "0.2.0-rc.2",
     "@deepseek-ai/dsh-client-store": "0.2.0-rc.2",
@@ -147,6 +161,7 @@
     "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
     "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
     "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-token-meter": "0.2.0-rc.2",
     "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
     "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
     "@deepseek-ai/dsh-scope": "0.2.0-rc.2",