@pure01fx/dsh-openai-codex-auth 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 0.7.3
+
+### Client model visibility
+
+- Connects the settings-panel Codex visibility controls to DSH's shared model directory: opening either model selector now caches the loaded Codex catalog, updates an already-open settings section, and filters hidden models in the current browser.
+
+### WebSocket reliability
+
+- Keeps credential-backed WebSocket connection failures inside the bounded reconnect budget and falls back to HTTP/SSE, preventing turns from remaining on “Deep diving...” forever when a server can reach Codex over HTTPS but not WebSocket.
+- Routes WebSocket v2 through the same opt-in `NODE_USE_ENV_PROXY=1`, `HTTPS_PROXY` / `HTTP_PROXY`, and `NO_PROXY` contract as Node fetch, using an HTTP CONNECT tunnel for WSS endpoints.
+
 ## 0.7.2
 
 ### Auxiliary-call compatibility

package/README.md

@@ -189,7 +189,7 @@ $DSH_HOME/openai-codex-auth.json
 
 上游 Native Codex Responses 请求没有输出 token 上限字段，因此普通会话若显式设置 `maxTokens` 仍会在 Provider I/O 前失败。DSH 的压缩与会话标题辅助调用会固定携带 `maxTokens`，并分别通过 `purpose: compaction` 与 `purpose: session-title` 标识；本适配器允许这两类 hint 通过，但不会把它序列化为 `max_output_tokens`，实际输出长度仍由 Native Codex 决定。
 
-原生 route 默认使用 Responses WebSocket v2，在会话首个请求上执行 `generate: false` prewarm，并仅在请求历史严格延伸时发送 `previous_response_id` 与增量后缀。连接重建会清除增量链；纯 WebSocket/HTTP 连接建立失败不消耗普通 stream retry 预算，而是按 Codex 的网络恢复策略从 5 秒指数退避到 60 秒并持续等待成功或取消，因此可跨越半分钟断网。连接已经建立后的首个 DSH chunk 前错误仍使用默认 5 次 stream retry 与 200ms 起步的有界指数退避，安全重试耗尽或握手返回 HTTP 426 后，该 DSH 会话会确定性地回退到 HTTP/SSE。transport 层在任何 DSH chunk 已输出后仍不会直接重放原始 stream；它会把瞬态中断重新分类为只允许 durable failed-step 恢复的错误，标准 Agent Profile 中的 `dsh-llm-retry` 再按默认 5 次策略重建请求。该外层策略不会再次匹配 transport 已在首个 chunk 前耗尽的有限 stream 错误，避免两层预算相乘；失败 attempt 的原始事件可以留作非 surface 诊断，但不会组装成模型可见的持久 assistant message。未加载该恢复插件的直接 `ctx.llm.stream()` 调用在首个 chunk 后仍保持 single-attempt，避免重复输出。WebSocket `codex.rate_limits` 事件、握手/错误 metadata 以及 HTTP/SSE response headers 中的 `x-codex-*` quota 会被边界校验后直接写入 Host 用量缓存；额外 metered limit 不会覆盖默认 `codex` 套餐卡片。`response.completed.usage_metadata.amount` 会按原始高精度字符串保留，并作为当前账号的最近响应观测出现在 status JSON 中。
+原生 route 默认使用 Responses WebSocket v2，在会话首个请求上执行 `generate: false` prewarm，并仅在请求历史严格延伸时发送 `previous_response_id` 与增量后缀。连接重建会清除增量链；凭据解析完成前的网络失败不消耗普通 stream retry 预算，而是按 Codex 的网络恢复策略从 5 秒指数退避到 60 秒并持续等待成功或取消。凭据可用后，WebSocket 连接建立失败与连接已经建立后的首个 DSH chunk 前错误都使用默认 5 次 stream retry 与 200ms 起步的有界指数退避；安全重试耗尽或握手返回 HTTP 426 后，该 DSH 会话会确定性地回退到 HTTP/SSE，因此仅 WebSocket 不可达不会让界面无限停在 Deep diving。transport 层在任何 DSH chunk 已输出后仍不会直接重放原始 stream；它会把瞬态中断重新分类为只允许 durable failed-step 恢复的错误，标准 Agent Profile 中的 `dsh-llm-retry` 再按默认 5 次策略重建请求。该外层策略不会再次匹配 transport 已在首个 chunk 前耗尽的有限 stream 错误，避免两层预算相乘；失败 attempt 的原始事件可以留作非 surface 诊断，但不会组装成模型可见的持久 assistant message。未加载该恢复插件的直接 `ctx.llm.stream()` 调用在首个 chunk 后仍保持 single-attempt，避免重复输出。WebSocket `codex.rate_limits` 事件、握手/错误 metadata 以及 HTTP/SSE response headers 中的 `x-codex-*` quota 会被边界校验后直接写入 Host 用量缓存；额外 metered limit 不会覆盖默认 `codex` 套餐卡片。`response.completed.usage_metadata.amount` 会按原始高精度字符串保留，并作为当前账号的最近响应观测出现在 status JSON 中。
 
 `<base>-fast` 只是公开选择别名：wire model 仍是 `<base>`，请求携带 `service_tier: priority`。若账号目录不声明 priority 能力，或请求前账号 authority 已改变，Fast 会直接失败，不会静默降级。Reasoning 选择在 adapter 边界按上游规则转换：`persistent` 在线上请求中写为 `disabled`；`ultra` 优先使用 Catalog 的 `multi_agent_reasoning_effort`，否则回退到 `max`、最高非 Ultra 档或 `medium`。
 
@@ -221,7 +221,7 @@ $DSH_HOME/openai-codex-auth.json
 
 ## 代理
 
-插件使用 Node.js 原生 `fetch`。若访问 OpenAI 需要 HTTP 代理，启动 DSH 前设置：
+插件的 HTTP/SSE 请求使用 Node.js 原生 `fetch`，WebSocket v2 使用 `ws`。设置 `NODE_USE_ENV_PROXY=1` 后，两条链路都会按 `HTTPS_PROXY` / `HTTP_PROXY` 选择 HTTP CONNECT 代理并遵守 `NO_PROXY`；若访问 OpenAI 需要代理，请在启动 DSH 前设置：
 
 ```sh
 NODE_USE_ENV_PROXY=1 \
@@ -230,7 +230,7 @@ HTTPS_PROXY=http://127.0.0.1:7890 \
 dsh web
 ```
 
-可按环境补充 `NO_PROXY=localhost,127.0.0.1,::1`。
+可按环境补充 `NO_PROXY=localhost,127.0.0.1,::1`。对于 `https://` / `wss://` Codex 端点应设置 `HTTPS_PROXY`；代理地址本身可以是 `http://`，WebSocket 会通过该代理向 `chatgpt.com:443` 建立 CONNECT 隧道。
 
 ## 常见问题
 

package/client.js

@@ -49,6 +49,121 @@ window.__ModuleLoader__.load({
       }
     }
 
+    function writeAvailableModels(models) {
+      try {
+        const next = JSON.stringify(models)
+        if (window.localStorage.getItem(AVAILABLE_MODELS_KEY) === next) return
+        window.localStorage.setItem(AVAILABLE_MODELS_KEY, next)
+        window.dispatchEvent(new CustomEvent(MODEL_CATALOG_EVENT, { detail: models }))
+      } catch {
+        // Browser-local catalog persistence is advisory and must never break model loading.
+      }
+    }
+
+    function codexModels(groups) {
+      const models = []
+      const seen = new Set()
+      for (const group of Array.isArray(groups) ? groups : []) {
+        if (!group || (group.id !== 'openai-codex' && group.id !== 'openai-codex-native')) continue
+        for (const model of Array.isArray(group.models) ? group.models : []) {
+          if (!model || typeof model.id !== 'string' || model.id.length === 0
+            || typeof model.name !== 'string' || model.name.length === 0 || seen.has(model.id)) continue
+          seen.add(model.id)
+          models.push({ id: model.id, name: model.name })
+          if (models.length >= 512) return models
+        }
+      }
+      return models
+    }
+
+    function visibleModelGroups(groups) {
+      if (!Array.isArray(groups)) return []
+      const hidden = new Set(readModelVisibility().hidden)
+      if (hidden.size === 0) return groups
+      return groups.flatMap((group) => {
+        if (!group || (group.id !== 'openai-codex' && group.id !== 'openai-codex-native')) return [group]
+        const models = Array.isArray(group.models)
+          ? group.models.filter((model) => model && !hidden.has(model.id)) : []
+        return [{ ...group, models }]
+      })
+    }
+
+    function installModelVisibilityBridge(ctx) {
+      const resolver = ctx.modelDirectories
+      if (!resolver || typeof resolver.directoryFor !== 'function') return () => {}
+      const originalDirectoryFor = resolver.directoryFor
+      const tracked = new Map()
+
+      const render = (directory, rawGroups) => {
+        const available = codexModels(rawGroups)
+        if (available.length > 0) writeAvailableModels(available)
+        const groups = visibleModelGroups(rawGroups)
+        if (directory.store && typeof directory.store.update === 'function') {
+          directory.store.update((state) => { state.groups = groups })
+        }
+        return groups
+      }
+
+      const track = (directory) => {
+        if (!directory || tracked.has(directory)
+          || typeof directory.load !== 'function' || typeof directory.dispose !== 'function') return directory
+        const record = {
+          load: directory.load,
+          dispose: directory.dispose,
+          wrappedLoad: undefined,
+          wrappedDispose: undefined,
+          generation: 0,
+          rawGroups: directory.store && typeof directory.store.getSnapshot === 'function'
+            ? directory.store.getSnapshot().groups : [],
+        }
+        record.wrappedLoad = async function (...args) {
+          const generation = ++record.generation
+          const value = await record.load.apply(this, args)
+          const rawGroups = Array.isArray(value && value.groups) ? value.groups : []
+          if (generation !== record.generation) {
+            const groups = visibleModelGroups(rawGroups)
+            return value && typeof value === 'object' ? { ...value, groups } : value
+          }
+          record.rawGroups = rawGroups
+          const groups = render(directory, record.rawGroups)
+          return value && typeof value === 'object' ? { ...value, groups } : value
+        }
+        record.wrappedDispose = function (...args) {
+          ++record.generation
+          tracked.delete(directory)
+          return record.dispose.apply(this, args)
+        }
+        directory.load = record.wrappedLoad
+        directory.dispose = record.wrappedDispose
+        tracked.set(directory, record)
+        if (record.rawGroups.length > 0) render(directory, record.rawGroups)
+        return directory
+      }
+
+      const bridgedDirectoryFor = function (...args) {
+        return track(originalDirectoryFor.apply(this, args))
+      }
+      resolver.directoryFor = bridgedDirectoryFor
+      if (resolver.live && resolver.live.directories && typeof resolver.live.directories.values === 'function') {
+        for (const directory of resolver.live.directories.values()) track(directory)
+      }
+      const refresh = () => {
+        for (const [directory, record] of tracked) render(directory, record.rawGroups)
+      }
+      window.addEventListener(MODEL_VISIBILITY_EVENT, refresh)
+
+      return () => {
+        window.removeEventListener(MODEL_VISIBILITY_EVENT, refresh)
+        if (resolver.directoryFor === bridgedDirectoryFor) resolver.directoryFor = originalDirectoryFor
+        for (const [directory, record] of tracked) {
+          ++record.generation
+          if (directory.load === record.wrappedLoad) directory.load = record.load
+          if (directory.dispose === record.wrappedDispose) directory.dispose = record.dispose
+        }
+        tracked.clear()
+      }
+    }
+
     const css = `
       .codexSection{box-sizing:border-box;max-width:720px;color:var(--dsw-alias-label-primary);display:flex;flex-direction:column;gap:12px}
       .codexSection *{box-sizing:border-box}.codexTitle{color:var(--dsw-alias-label-primary);margin:0;font-size:16px;font-weight:500;line-height:24px}
@@ -748,8 +863,11 @@ window.__ModuleLoader__.load({
       )
     }
 
-    const inject = ['slots']
+    const inject = ['slots', 'modelDirectories']
     function apply(ctx) {
+      ctx.inject(['modelDirectories'], (scope) => {
+        scope.effect(() => installModelVisibilityBridge(scope), 'openai-codex-auth: model visibility bridge')
+      })
       ctx.slots.inject('settings.section', () => ctx.slots.register({
         name: 'settings.section',
         id: 'openai-codex',

package/lib/native-websocket-socket.d.ts

@@ -22,6 +22,8 @@ export interface NativeCodexWebSocketConnectOptions {
 export interface NativeCodexWebSocketFactory {
     connect(options: NativeCodexWebSocketConnectOptions): Promise<NativeCodexWebSocket>;
 }
+/** Resolve the same opt-in environment proxy contract used by Node fetch. */
+export declare function nativeCodexWebSocketProxy(endpoint: string): string | undefined;
 export declare function nativeCodexWebSocketUrl(endpoint: string): string;
 export declare class NodeNativeCodexWebSocketFactory implements NativeCodexWebSocketFactory {
     connect(options: NativeCodexWebSocketConnectOptions): Promise<NativeCodexWebSocket>;

package/lib/native-websocket-socket.js

@@ -1,5 +1,7 @@
 /** Bounded Node WebSocket client seam with injectable deterministic factories. */
 import { LlmError, ProviderRequestId } from '@deepseek-ai/dsh-llm';
+import { HttpsProxyAgent } from 'https-proxy-agent';
+import { getProxyForUrl } from 'proxy-from-env';
 import { nativeCodexEndpoint } from './endpoint.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
 import WebSocket from 'ws';
@@ -34,6 +36,13 @@ function positive(value, fallback, label) {
         throw failure(`native Codex ${label} is invalid`, 'INVALID_ARGS');
     return value;
 }
+/** Resolve the same opt-in environment proxy contract used by Node fetch. */
+export function nativeCodexWebSocketProxy(endpoint) {
+    if (process.env.NODE_USE_ENV_PROXY !== '1')
+        return undefined;
+    const proxy = getProxyForUrl(nativeCodexEndpoint(endpoint, true).toString());
+    return proxy.length === 0 ? undefined : proxy;
+}
 export function nativeCodexWebSocketUrl(endpoint) {
     const url = nativeCodexEndpoint(endpoint, true);
     if (url.protocol === 'https:')
@@ -165,8 +174,11 @@ export class NodeNativeCodexWebSocketFactory {
             throw abortFailure(options.signal);
         return new Promise((resolve, reject) => {
             const responseHeaders = {};
+            const proxy = nativeCodexWebSocketProxy(options.url);
+            const agent = proxy === undefined ? undefined : new HttpsProxyAgent(proxy);
             const socket = new WebSocket(nativeCodexWebSocketUrl(options.url), {
                 headers: options.headers,
+                ...(agent === undefined ? {} : { agent }),
                 handshakeTimeout: timeout,
                 maxPayload: maximum,
                 perMessageDeflate: true,

package/lib/native-websocket.js

@@ -29,6 +29,7 @@ function reconnectable(code) {
     return [
         'WS_RETRYABLE', 'WS_RETRYABLE_RESET', 'WS_PROTOCOL_ERROR',
         'WS_FRAME_TOO_LARGE', 'WS_RESPONSE_TOO_LARGE', 'TIMEOUT',
+        NATIVE_CODEX_CONNECTION_FAILED_CODE,
     ].includes(code);
 }
 function failedStepRetryable(code) {
@@ -538,9 +539,12 @@ export class NativeCodexWebSocketTransport {
                             throw failedStepRetry(failureValue);
                         throw failureValue;
                     }
-                    if (failureValue.code === NATIVE_CODEX_CONNECTION_FAILED_CODE
-                        || (attemptedCredential === undefined
-                            && isNativeCodexConnectionFailure(failureValue))) {
+                    // Credential resolution may need the network itself, so wait until it recovers.
+                    // Once a credential is available, however, a WebSocket-only outage must consume
+                    // the bounded reconnect budget and then fall back to HTTP/SSE instead of leaving
+                    // the DSH turn in an invisible infinite reconnect loop.
+                    if (attemptedCredential === undefined
+                        && isNativeCodexConnectionFailure(failureValue)) {
                         await this.waitForConnection(connectionRetryDelayMs, signal);
                         connectionRetryDelayMs = Math.min(connectionRetryDelayMs * 2, MAX_CONNECTION_RETRY_DELAY_MS);
                         continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {
@@ -69,11 +69,6 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "prepack": "pnpm build"
-  },
   "dsh": {
     "engines": {
       "dsh": "0.1.1-rc.2"
@@ -84,6 +79,7 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-model-selection",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-settings"
       ],
@@ -100,6 +96,8 @@
     "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
     "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "^3.18.1",
+    "https-proxy-agent": "7.0.6",
+    "proxy-from-env": "1.1.0",
     "ws": "8.21.3"
   },
   "devDependencies": {
@@ -110,7 +108,12 @@
     "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
     "@deepseek-ai/dsh-session": "0.1.1-rc.2",
     "@types/node": "^22.20.0",
+    "@types/proxy-from-env": "1.0.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run"
   }
-}
+}