@sunshaobei/dsh-balance-panel 3.0.5 → 3.0.7

package/lib/client.js

@@ -95,9 +95,12 @@ window.__ModuleLoader__.load({
             }
             if (family.length === 0) {
                 var prov = String(sel.provider || "").toLowerCase();
-                // DOM-fallback selection (no provider) matching no family:
-                // show nothing — an empty prov would substring-match EVERY row.
-                if (!prov) return null;
+                // A DOM-fallback selection has no provider: the model name alone
+                // matched no known family, so this model has no known quota
+                // source. Show nothing rather than a wrong provider — an empty
+                // prov would otherwise substring-match EVERY row.
+                if (!prov)
+                    return null;
                 for (var j = 0; j < specs.rows.length; j++) {
                     var id = String(specs.rows[j].id || "").toLowerCase();
                     if (prov.indexOf(id) > -1 || id.indexOf(prov) > -1)

package/lib/index.js

@@ -264,6 +264,35 @@ async function chatgptAuthExists() {
 }
 /** In-memory token cache; refreshed on expiry or on auth failure. */
 let chatgptTokenCache = null;
+// Live handle onto the credentials service — set in apply(). Lets the
+// ChatGPT/Codex token resolver read the shared grant record that
+// dsh-codex-auth writes (llm-pi-ai/openai-codex).
+let codexCredentialsRef = null;
+// Auto-detected local proxy for ChatGPT/Codex upstream calls. The usage and
+// token endpoints are region-blocked on direct connections, and Node's fetch
+// never reads the OS proxy — so when the panel row has no explicit proxy we
+// probe the well-known local proxy ports once and remember the answer.
+let localProxyCache = null; // null = not probed yet
+async function detectLocalProxy() {
+    if (localProxyCache !== null)
+        return localProxyCache || undefined;
+    for (const port of [7897, 7890, 1087, 8118, 6152]) {
+        const ok = await new Promise((resolve) => {
+            const req = http.request({ host: '127.0.0.1', port, method: 'CONNECT', path: 'chatgpt.com:443', timeout: 2000 });
+            req.on('connect', (res, socket) => { socket.destroy(); resolve(res.statusCode === 200); });
+            req.on('error', () => resolve(false));
+            req.on('timeout', () => { req.destroy(); resolve(false); });
+            req.end();
+        });
+        if (ok) {
+            localProxyCache = 'http://127.0.0.1:' + port;
+            break;
+        }
+    }
+    if (localProxyCache === null)
+        localProxyCache = '';
+    return localProxyCache || undefined;
+}
 async function readChatGPTAuthFile() {
     const authJson = chatgptAuthJsonPath();
     let raw;
@@ -632,6 +661,31 @@ function chatgptLoginStatus() {
 async function resolveChatGPTToken(timeoutMs, proxyUrl) {
     const now = Date.now();
     const cached = chatgptTokenCache?.bundle;
+    // Source 0: the shared grant record written by dsh-codex-auth
+    // (llm-pi-ai/openai-codex). Preferred when present and fresh: the user
+    // authorized through the Codex subscription settings page, so the panel
+    // should reflect THAT credential instead of ~/.codex/auth.json.
+    try {
+        if (codexCredentialsRef?.readRecord) {
+            const rec = await codexCredentialsRef.readRecord('llm-pi-ai/openai-codex');
+            const p = rec && rec.kind === 'grant' ? rec.payload : undefined;
+            if (p && p.access) {
+                if (!p.expires || p.expires - now > 30000) {
+                    chatgptTokenCache = { bundle: { access_token: p.access, refresh_token: p.refresh, expires_at_ms: p.expires, account_id: p.accountId } };
+                    return { accessToken: p.access, accountId: p.accountId };
+                }
+                if (p.refresh) {
+                    const refreshed = await refreshChatGPTToken(p.refresh, timeoutMs, proxyUrl);
+                    if (!refreshed.account_id)
+                        refreshed.account_id = p.accountId;
+                    await codexCredentialsRef.modifyRecord('llm-pi-ai/openai-codex', async () => ({ kind: 'grant', payload: { ...p, access: refreshed.access_token, refresh: refreshed.refresh_token || p.refresh, expires: refreshed.expires_at_ms } })).catch(() => { });
+                    chatgptTokenCache = { bundle: refreshed };
+                    return { accessToken: refreshed.access_token, accountId: refreshed.account_id };
+                }
+            }
+        }
+    }
+    catch { /* record absent or unreadable — fall through to the other sources */ }
     if (cached && cached.access_token && (!cached.expires_at_ms || cached.expires_at_ms - now > 30000)) {
         return { accessToken: cached.access_token, accountId: cached.account_id };
     }
@@ -1640,7 +1694,7 @@ async function fetchRow(ctx, provider, proxies, clientProxyUrl) {
                 // query AND token refresh — same region constraints apply.
                 const cgProxy = clientProxyUrl !== undefined
                     ? clientProxyUrl
-                    : (provider.proxy !== undefined ? proxies[provider.proxy] : undefined);
+                    : (provider.proxy !== undefined ? proxies[provider.proxy] : await detectLocalProxy());
                 let { accessToken, accountId } = await resolveChatGPTToken(UPSTREAM_TIMEOUT_MS, cgProxy);
                 let body;
                 try {
@@ -1880,6 +1934,7 @@ function registerQuotaRpc(ctx, handler) {
  * @param config - raw plugin config (schema-processed by the loader).
  */
 export function apply(ctx, config = {}) {
+    codexCredentialsRef = ctx.credentials;
     const raw = config && typeof config === 'object' ? config : {};
     const refreshMs = numOf(raw.refreshMs, 60000);
     if (!(refreshMs >= 5000))

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sunshaobei/dsh-balance-panel",
   "description": "Provider quota/balance widget for the dsh web surface: an inline sidebar card above the Settings row (collapsed glanceable row expanding into a Harness-native card with a settings panel), fed by a loopback Connection RPC channel whose host half proxies each provider with credentials that never reach the browser.",
-  "version": "3.0.5",
+  "version": "3.0.7",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/client.ts

@@ -25,7 +25,7 @@
  * follows the product theme (light/dark) instead of carrying its own palette.
  */
 (window as any).__ModuleLoader__.load({
-	id: "dsh-balance-panel",
+	id: "@sunshaobei/dsh-balance-panel",
 	factory: (require) => {
 		var module = { exports: {} as any };
 		var exports = module.exports;

package/src/index.ts

@@ -287,6 +287,31 @@ interface ChatGPTTokenBundle {
 
 /** In-memory token cache; refreshed on expiry or on auth failure. */
 let chatgptTokenCache: { bundle: ChatGPTTokenBundle } | null = null;
+// Live handle onto the credentials service — set in apply(). Lets the
+// ChatGPT/Codex token resolver read the shared grant record that
+// dsh-codex-auth writes (llm-pi-ai/openai-codex).
+let codexCredentialsRef: any = null;
+
+// Auto-detected local proxy for ChatGPT/Codex upstream calls. The usage and
+// token endpoints are region-blocked on direct connections, and Node's fetch
+// never reads the OS proxy — so when the panel row has no explicit proxy we
+// probe the well-known local proxy ports once and remember the answer.
+let localProxyCache: string | undefined | null = null; // null = not probed yet
+async function detectLocalProxy(): Promise<string | undefined> {
+	if (localProxyCache !== null) return localProxyCache || undefined;
+	for (const port of [7897, 7890, 1087, 8118, 6152]) {
+		const ok = await new Promise<boolean>((resolve) => {
+			const req = http.request({ host: '127.0.0.1', port, method: 'CONNECT', path: 'chatgpt.com:443', timeout: 2000 });
+			req.on('connect', (res, socket) => { socket.destroy(); resolve(res.statusCode === 200); });
+			req.on('error', () => resolve(false));
+			req.on('timeout', () => { req.destroy(); resolve(false); });
+			req.end();
+		});
+		if (ok) { localProxyCache = 'http://127.0.0.1:' + port; break; }
+	}
+	if (localProxyCache === null) localProxyCache = '';
+	return localProxyCache || undefined;
+}
 
 async function readChatGPTAuthFile(): Promise<ChatGPTTokenBundle> {
 	const authJson = chatgptAuthJsonPath();
@@ -653,6 +678,29 @@ function chatgptLoginStatus(): { active: boolean; verificationUrl?: string; user
 async function resolveChatGPTToken(timeoutMs: number, proxyUrl?: string): Promise<{ accessToken: string; accountId?: string }> {
 	const now = Date.now();
 	const cached = chatgptTokenCache?.bundle;
+	// Source 0: the shared grant record written by dsh-codex-auth
+	// (llm-pi-ai/openai-codex). Preferred when present and fresh: the user
+	// authorized through the Codex subscription settings page, so the panel
+	// should reflect THAT credential instead of ~/.codex/auth.json.
+	try {
+		if (codexCredentialsRef?.readRecord) {
+			const rec: any = await codexCredentialsRef.readRecord('llm-pi-ai/openai-codex');
+			const p = rec && rec.kind === 'grant' ? rec.payload : undefined;
+			if (p && p.access) {
+				if (!p.expires || p.expires - now > 30_000) {
+					chatgptTokenCache = { bundle: { access_token: p.access, refresh_token: p.refresh, expires_at_ms: p.expires, account_id: p.accountId } };
+					return { accessToken: p.access, accountId: p.accountId };
+				}
+				if (p.refresh) {
+					const refreshed = await refreshChatGPTToken(p.refresh, timeoutMs, proxyUrl);
+					if (!refreshed.account_id) refreshed.account_id = p.accountId;
+					await codexCredentialsRef.modifyRecord('llm-pi-ai/openai-codex', async () => ({ kind: 'grant', payload: { ...p, access: refreshed.access_token, refresh: refreshed.refresh_token || p.refresh, expires: refreshed.expires_at_ms } })).catch(() => {});
+					chatgptTokenCache = { bundle: refreshed };
+					return { accessToken: refreshed.access_token, accountId: refreshed.account_id };
+				}
+			}
+		}
+	} catch { /* record absent or unreadable — fall through to the other sources */ }
 	if (cached && cached.access_token && (!cached.expires_at_ms || cached.expires_at_ms - now > 30_000)) {
 		return { accessToken: cached.access_token, accountId: cached.account_id };
 	}
@@ -1601,7 +1649,7 @@ async function fetchRow(ctx, provider, proxies, clientProxyUrl) {
 				// query AND token refresh — same region constraints apply.
 				const cgProxy = clientProxyUrl !== undefined
 					? clientProxyUrl
-					: (provider.proxy !== undefined ? proxies[provider.proxy] : undefined);
+					: (provider.proxy !== undefined ? proxies[provider.proxy] : await detectLocalProxy());
 				let { accessToken, accountId } = await resolveChatGPTToken(UPSTREAM_TIMEOUT_MS, cgProxy);
 				let body: any;
 				try {
@@ -1830,6 +1878,7 @@ async function fetchRow(ctx, provider, proxies, clientProxyUrl) {
 	 * @param config - raw plugin config (schema-processed by the loader).
 	 */
 export function apply(ctx, config: Record<string, any> = {}) {
+	codexCredentialsRef = ctx.credentials;
 	const raw: Record<string, any> = config && typeof config === 'object' ? config : {};
 	const refreshMs = numOf(raw.refreshMs, 60000);
 	if (!(refreshMs >= 5000)) throw new Error('quota-panel: config.refreshMs must be >= 5000');