@tnnevol/dsh-codex-auth 0.1.0-rc.7

package/README.md

@@ -0,0 +1,56 @@
+# @tnnevol/dsh-codex-auth
+
+一个独立的 DeepSeek Harness Codex OAuth 插件，适配 DSH `0.1.0-rc.7`。
+
+作者：tnnevol
+
+## 功能
+
+- 在 DSH Web 的“插件”设置中提供 ChatGPT 登录和退出登录入口。
+- 通过 `@earendil-works/pi-ai` 发起 Codex device-code 授权，由插件展示一次性授权码并轮询登录结果。
+- 授权页面不要求选择工作空间；用户只需在 Codex 授权页面提交插件生成的一次性代码。
+- 复用 `dsh-codex-connect` 的凭据文件格式：`$DSH_HOME/.openai-codex-auth.json`。
+- 复用 `dsh-llm-pi-ai` 的官方模型设置入口，使 OpenAI Codex 在模型列表中显示登录状态，并直接展示可编辑的模型目录。
+- OAuth 登录成功后，将当前 access token 同步到 `OPENAI_CODEX_AUTH_TOKEN` 凭据引用；OAuth 文件仍是唯一登录源，凭据引用只是给通用 pi-ai adapter 和官方模型页使用的镜像。
+- Codex 编辑页隐藏通用的 API 密钥和 API 地址字段，避免用户误改 OAuth 管理的认证与端点；模型目录仍使用 DSH 官方编辑器。
+- 模型列表弹框增加“全选”，确认按钮文案为“确定”，并使用官方保存按钮的主色。
+- 在“设置 → 插件 → Codex Auth”中提供图片识别开关；开启后按 DSH 附件规范注册 `view_image`，仅允许当前图片模型读取经过文件系统权限控制的本地图片。
+- 图像生成开关会明确显示为当前不可用：DSH `rc.7` 的 Codex provider 只声明图片输入，不提供图像输出能力。
+- 通过 DSH `rc.7` 的 keyed slot `settings.plugin.item` 注册 UI，并显式提供 `key`。
+
+## 本地构建
+
+在仓库根目录执行：
+
+```sh
+pnpm --filter @tnnevol/dsh-codex-auth install
+pnpm --filter @tnnevol/dsh-codex-auth run check
+```
+
+## 使用本地 DSH CLI 调试
+
+先确保本地 DSH 源码已经安装依赖并可运行，然后在 DSH 仓库目录执行：
+
+```sh
+pnpm --filter @tnnevol/dsh-codex-auth run build
+pnpm dsh web --patch /absolute/path/to/fn-os-apps/plugins/dsh-codex-auth-plugin/cordis.patch.yml
+```
+
+`cordis.patch.yml` 使用包名加载 Host bundle；如果要调试尚未构建的源码，可将 patch 中的 `name` 改成源码入口的绝对路径，并使用 DSH skill 中的 `--patch` 调试流程。
+
+## 发布 rc 版本
+
+当前版本为 npm prerelease，发布时必须使用 `rc` dist-tag：
+
+```sh
+npm run publish:rc
+```
+
+## 安装到 profile
+
+```sh
+dsh plugin --profile web add @tnnevol/dsh-codex-auth
+dsh --profile web --dump-config
+```
+
+安装后重新启动 Web profile。该插件不应与旧的 `dsh-codex-connect` 同时注册同一套 Codex 模型能力；迁移时请先停用旧插件，再启用本插件。

package/compatibility.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": 1,
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dshPluginApi": {
+    "version": "0.1.0-rc.7",
+    "packages": [
+      "@deepseek-ai/dsh-atomic-write",
+      "@deepseek-ai/dsh-attachment",
+      "@deepseek-ai/dsh-credentials",
+      "@deepseek-ai/dsh-home-paths",
+      "@deepseek-ai/dsh-host-webserver",
+      "@deepseek-ai/dsh-invariants",
+      "@deepseek-ai/dsh-launch-environment",
+      "@deepseek-ai/dsh-llm",
+      "@deepseek-ai/dsh-llm-pi-ai",
+      "@deepseek-ai/dsh-settings",
+      "@deepseek-ai/dsh-timeout"
+    ]
+  },
+  "piAi": {
+    "package": "@earendil-works/pi-ai",
+    "version": "0.82.1"
+  }
+}

package/cordis.patch.yml

@@ -0,0 +1,28 @@
+- insert:
+    - id: dsh-codex-auth
+      name: '@tnnevol/dsh-codex-auth'
+
+# Use the official pi-ai settings family so the DSH Models page renders the
+# provider's credential status and its standard model-catalog editor. The
+# access token is mirrored to this reference by the plugin after OAuth login.
+- id: llm-pi-ai
+  config:
+    providers:
+      openai-codex:
+        displayName: OpenAI Codex
+        apiKeyEnv: OPENAI_CODEX_AUTH_TOKEN
+        models:
+          - id: gpt-5.3-codex-spark
+            name: GPT-5.3 Codex Spark
+          - id: gpt-5.4
+            name: GPT-5.4
+          - id: gpt-5.4-mini
+            name: GPT-5.4 mini
+          - id: gpt-5.5
+            name: GPT-5.5
+          - id: gpt-5.6-luna
+            name: GPT-5.6 Luna
+          - id: gpt-5.6-sol
+            name: GPT-5.6 Sol
+          - id: gpt-5.6-terra
+            name: GPT-5.6 Terra

package/lib/auth-BBBeI24-.d.ts

@@ -0,0 +1,31 @@
+import { AuthInteraction, Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+//#region src/store.d.ts
+/** pi-ai provider id used by ChatGPT Codex OAuth. */
+declare const CODEX_PROVIDER = "openai-codex";
+/** Kept compatible with dsh-codex-connect so a login can be reused. */
+declare const CODEX_AUTH_FILENAME = ".openai-codex-auth.json";
+declare function codexAuthPath(dshHome?: string): string;
+/** File-backed CredentialStore that owns only the Codex OAuth route. */
+declare class CodexCredentialStore implements CredentialStore {
+  readonly filename: string;
+  constructor(filename?: string);
+  private readCurrent;
+  read(providerId: string): Promise<Credential | undefined>;
+  list(): Promise<readonly CredentialInfo[]>;
+  modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+  delete(providerId: string): Promise<void>;
+}
+//#endregion
+//#region src/auth.d.ts
+interface CodexAuthStatus {
+  authenticated: boolean;
+  expiresAt?: Date;
+}
+/** Start provider-native ChatGPT OAuth and persist its credential. */
+declare function loginCodex(interaction: AuthInteraction, store?: CodexCredentialStore): Promise<void>;
+/** Delete the plugin-owned Codex credential. */
+declare function logoutCodex(store?: CodexCredentialStore): Promise<void>;
+/** Read login state without refreshing the token. */
+declare function codexAuthStatus(store?: CodexCredentialStore): Promise<CodexAuthStatus>;
+//#endregion
+export { CODEX_AUTH_FILENAME as a, codexAuthPath as c, logoutCodex as i, codexAuthStatus as n, CODEX_PROVIDER as o, loginCodex as r, CodexCredentialStore as s, CodexAuthStatus as t };

package/lib/auth-DQ2F4vc6.js

@@ -0,0 +1,142 @@
+import { createModels } from "@earendil-works/pi-ai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { mkdir, readFile, rm, stat } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+//#region src/store.ts
+/** Owner-only persistent storage for the shared OpenAI Codex OAuth document. */
+/** pi-ai provider id used by ChatGPT Codex OAuth. */
+const CODEX_PROVIDER = "openai-codex";
+/** Kept compatible with dsh-codex-connect so a login can be reused. */
+const CODEX_AUTH_FILENAME = ".openai-codex-auth.json";
+const AUTH_FORMAT_VERSION = 1;
+function isENOENT(error) {
+	return error?.code === "ENOENT";
+}
+async function assertOwnerOnly(filename) {
+	let mode;
+	try {
+		mode = (await stat(filename)).mode;
+	} catch (error) {
+		if (isENOENT(error)) return;
+		throw error;
+	}
+	if (process.platform === "win32") return;
+	if ((mode & 63) !== 0) throw new Error(`codex-auth: ${filename} is readable beyond its owner (mode ${(mode & 511).toString(8)}); run "chmod 600 ${filename}" before starting again`);
+}
+function parseDocument(text, filename) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		throw new Error(`codex-auth: ${filename} is not valid JSON`);
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`codex-auth: ${filename} must contain an object`);
+	const document = value;
+	if (document["version"] !== AUTH_FORMAT_VERSION) throw new Error(`codex-auth: ${filename} has unsupported auth format version ${String(document["version"])}`);
+	if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) throw new Error(`codex-auth: ${filename} contains an unknown top-level field`);
+	const raw = document["credential"];
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`codex-auth: ${filename} credential must be an object`);
+	const credential = raw;
+	if (Object.keys(credential).some((key) => ![
+		"type",
+		"access",
+		"refresh",
+		"expires",
+		"accountId"
+	].includes(key))) throw new Error(`codex-auth: ${filename} credential contains an unknown field`);
+	if (credential["type"] !== "oauth") throw new Error(`codex-auth: ${filename} credential type must be oauth`);
+	for (const key of [
+		"access",
+		"refresh",
+		"accountId"
+	]) if (typeof credential[key] !== "string" || credential[key].length === 0) throw new Error(`codex-auth: ${filename} credential ${key} must be a non-empty string`);
+	if (typeof credential["expires"] !== "number" || !Number.isFinite(credential["expires"]) || credential["expires"] <= 0) throw new Error(`codex-auth: ${filename} credential expires must be a positive finite number`);
+	return {
+		version: AUTH_FORMAT_VERSION,
+		credential
+	};
+}
+function codexAuthPath(dshHome) {
+	return resolve(join(resolveDshHome(dshHome), CODEX_AUTH_FILENAME));
+}
+/** File-backed CredentialStore that owns only the Codex OAuth route. */
+var CodexCredentialStore = class {
+	filename;
+	constructor(filename = codexAuthPath()) {
+		this.filename = resolve(filename);
+	}
+	async readCurrent() {
+		await assertOwnerOnly(this.filename);
+		let text;
+		try {
+			text = await readFile(this.filename, "utf8");
+		} catch (error) {
+			if (isENOENT(error)) return void 0;
+			throw error;
+		}
+		return structuredClone(parseDocument(text, this.filename).credential);
+	}
+	async read(providerId) {
+		return providerId === "openai-codex" ? this.readCurrent() : void 0;
+	}
+	async list() {
+		return await this.readCurrent() === void 0 ? [] : [{
+			providerId: CODEX_PROVIDER,
+			type: "oauth"
+		}];
+	}
+	async modify(providerId, fn) {
+		if (providerId !== "openai-codex") throw new Error(`codex-auth: credential store does not own provider "${providerId}"`);
+		await mkdir(dirname(this.filename), {
+			recursive: true,
+			mode: 448
+		});
+		return withFileLock(this.filename, async () => {
+			const current = await this.readCurrent();
+			const candidate = await fn(current);
+			if (candidate === void 0) return current;
+			const document = parseDocument(JSON.stringify({
+				version: AUTH_FORMAT_VERSION,
+				credential: candidate
+			}), this.filename);
+			await writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+			return structuredClone(document.credential);
+		});
+	}
+	async delete(providerId) {
+		if (providerId !== "openai-codex") return;
+		await mkdir(dirname(this.filename), {
+			recursive: true,
+			mode: 448
+		});
+		await withFileLock(this.filename, () => rm(this.filename, { force: true }));
+	}
+};
+//#endregion
+//#region src/auth.ts
+/** ChatGPT OAuth orchestration used by the Host routes and CLI consumers. */
+/** Start provider-native ChatGPT OAuth and persist its credential. */
+async function loginCodex(interaction, store = new CodexCredentialStore()) {
+	const models = createModels({ credentials: store });
+	models.setProvider(openaiCodexProvider());
+	await models.login(CODEX_PROVIDER, "oauth", interaction);
+}
+/** Delete the plugin-owned Codex credential. */
+async function logoutCodex(store = new CodexCredentialStore()) {
+	await store.delete(CODEX_PROVIDER);
+}
+/** Read login state without refreshing the token. */
+async function codexAuthStatus(store = new CodexCredentialStore()) {
+	const credential = await store.read(CODEX_PROVIDER);
+	return credential?.type === "oauth" ? {
+		authenticated: true,
+		expiresAt: new Date(credential.expires)
+	} : { authenticated: false };
+}
+//#endregion
+export { CODEX_PROVIDER as a, CODEX_AUTH_FILENAME as i, loginCodex as n, CodexCredentialStore as o, logoutCodex as r, codexAuthPath as s, codexAuthStatus as t };

package/lib/auth-paths.d.ts

@@ -0,0 +1,10 @@
+//#region src/auth-paths.d.ts
+/** Browser-facing paths owned by the standalone Codex authentication plugin. */
+/** Host settings namespace used to dispatch the browser settings card. */
+declare const CODEX_AUTH_SETTINGS_NAMESPACE = "dsh-codex-auth";
+declare const CODEX_AUTH_STATUS_PATH = "/plugins/dsh-codex-auth-plugin/auth/status";
+declare const CODEX_AUTH_LOGIN_PATH = "/plugins/dsh-codex-auth-plugin/auth/login";
+declare const CODEX_AUTH_LOGOUT_PATH = "/plugins/dsh-codex-auth-plugin/auth/logout";
+declare const CODEX_USAGE_PATH = "/plugins/dsh-codex-auth-plugin/auth/usage";
+//#endregion
+export { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH };

package/lib/auth-paths.js

@@ -0,0 +1,10 @@
+//#region src/auth-paths.ts
+/** Browser-facing paths owned by the standalone Codex authentication plugin. */
+/** Host settings namespace used to dispatch the browser settings card. */
+const CODEX_AUTH_SETTINGS_NAMESPACE = "dsh-codex-auth";
+const CODEX_AUTH_STATUS_PATH = "/plugins/dsh-codex-auth-plugin/auth/status";
+const CODEX_AUTH_LOGIN_PATH = "/plugins/dsh-codex-auth-plugin/auth/login";
+const CODEX_AUTH_LOGOUT_PATH = "/plugins/dsh-codex-auth-plugin/auth/logout";
+const CODEX_USAGE_PATH = "/plugins/dsh-codex-auth-plugin/auth/usage";
+//#endregion
+export { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH };

package/lib/auth.d.ts

@@ -0,0 +1,2 @@
+import { i as logoutCodex, n as codexAuthStatus, r as loginCodex, t as CodexAuthStatus } from "./auth-BBBeI24-.js";
+export { CodexAuthStatus, codexAuthStatus, loginCodex, logoutCodex };

package/lib/auth.js

@@ -0,0 +1,2 @@
+import { n as loginCodex, r as logoutCodex, t as codexAuthStatus } from "./auth-DQ2F4vc6.js";
+export { codexAuthStatus, loginCodex, logoutCodex };