@tnnevol/dsh-codex-auth 0.1.0-rc.7 → 0.1.0-rc.7.2

package/README.md

@@ -2,8 +2,6 @@
 
 一个独立的 DeepSeek Harness Codex OAuth 插件，适配 DSH `0.1.0-rc.7`。
 
-作者：tnnevol
-
 ## 功能
 
 - 在 DSH Web 的“插件”设置中提供 ChatGPT 登录和退出登录入口。

package/lib/auth-paths.d.ts

@@ -6,5 +6,7 @@ declare const CODEX_AUTH_STATUS_PATH = "/plugins/dsh-codex-auth-plugin/auth/stat
 declare const CODEX_AUTH_LOGIN_PATH = "/plugins/dsh-codex-auth-plugin/auth/login";
 declare const CODEX_AUTH_LOGOUT_PATH = "/plugins/dsh-codex-auth-plugin/auth/logout";
 declare const CODEX_USAGE_PATH = "/plugins/dsh-codex-auth-plugin/auth/usage";
+/** Same-origin settings endpoint used when DSH marks a NAS browser as remote. */
+declare const CODEX_AUTH_SETTINGS_PATH = "/plugins/dsh-codex-auth-plugin/auth/settings";
 //#endregion
-export { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH };
+export { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_SETTINGS_PATH, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH };

package/lib/auth-paths.js

@@ -6,5 +6,7 @@ const CODEX_AUTH_STATUS_PATH = "/plugins/dsh-codex-auth-plugin/auth/status";
 const CODEX_AUTH_LOGIN_PATH = "/plugins/dsh-codex-auth-plugin/auth/login";
 const CODEX_AUTH_LOGOUT_PATH = "/plugins/dsh-codex-auth-plugin/auth/logout";
 const CODEX_USAGE_PATH = "/plugins/dsh-codex-auth-plugin/auth/usage";
+/** Same-origin settings endpoint used when DSH marks a NAS browser as remote. */
+const CODEX_AUTH_SETTINGS_PATH = "/plugins/dsh-codex-auth-plugin/auth/settings";
 //#endregion
-export { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH };
+export { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_SETTINGS_PATH, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH };

package/lib/client.js

@@ -300,6 +300,8 @@ window.__ModuleLoader__.load({
 		const CODEX_AUTH_LOGIN_PATH = "/plugins/dsh-codex-auth-plugin/auth/login";
 		const CODEX_AUTH_LOGOUT_PATH = "/plugins/dsh-codex-auth-plugin/auth/logout";
 		const CODEX_USAGE_PATH = "/plugins/dsh-codex-auth-plugin/auth/usage";
+		/** Same-origin settings endpoint used when DSH marks a NAS browser as remote. */
+		const CODEX_AUTH_SETTINGS_PATH = "/plugins/dsh-codex-auth-plugin/auth/settings";
 		//#endregion
 		//#region src/client/CodexAuthCard.tsx
 		/** Expandable account card for the DSH Plugins settings section. */
@@ -1515,6 +1517,116 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/remote-settings-scope.ts
+		const INITIAL_SNAPSHOT = {
+			status: "loading",
+			value: void 0,
+			base: void 0,
+			user: void 0,
+			revision: void 0,
+			writable: false,
+			mode: "host"
+		};
+		async function requestSettings(method, value) {
+			const response = await fetch(CODEX_AUTH_SETTINGS_PATH, {
+				method,
+				headers: {
+					accept: "application/json",
+					...value === void 0 ? {} : { "content-type": "application/json" }
+				},
+				...value === void 0 ? {} : { body: JSON.stringify(value) },
+				credentials: "same-origin"
+			});
+			const payload = await response.json().catch(() => void 0);
+			if (!response.ok) {
+				const error = typeof payload === "object" && payload !== null && "error" in payload && typeof payload.error === "string" ? payload.error : `HTTP ${String(response.status)}`;
+				throw new Error(error);
+			}
+			const settings = decodeCodexAuthSettings(payload);
+			if (settings === void 0) throw new Error("Host returned invalid Codex settings");
+			return settings;
+		}
+		/**
+		* The official settings RPC is intentionally unavailable to non-loopback
+		* browser authorities. This small scope talks only to the plugin-owned,
+		* same-origin endpoint and carries no settings schema or credential data.
+		*/
+		var CodexAuthRemoteSettingsScope = class {
+			snapshot = INITIAL_SNAPSHOT;
+			listeners = /* @__PURE__ */ new Set();
+			tail = Promise.resolve();
+			disposed = false;
+			getSnapshot() {
+				return this.snapshot;
+			}
+			subscribe(listener) {
+				this.listeners.add(listener);
+				return () => {
+					this.listeners.delete(listener);
+				};
+			}
+			load() {
+				return this.enqueue(async () => {
+					try {
+						const settings = await requestSettings("GET");
+						if (this.disposed) return;
+						this.publish({
+							...this.snapshot,
+							status: "ready",
+							value: settings,
+							writable: true
+						});
+					} catch {
+						if (this.disposed) return;
+						this.publish({
+							...this.snapshot,
+							status: "unavailable",
+							writable: false
+						});
+					}
+				});
+			}
+			set(field, value) {
+				if (field !== "enableImageTool" && field !== "enableImageUpload") return Promise.reject(/* @__PURE__ */ new Error(`Unsupported Codex settings field: ${field}`));
+				if (typeof value !== "boolean") return Promise.reject(/* @__PURE__ */ new TypeError(`Codex setting ${field} must be boolean`));
+				return this.enqueue(async () => {
+					const current = this.getSnapshot().value;
+					if (current === void 0) throw new Error("Codex settings are not loaded");
+					const accepted = await requestSettings("PUT", {
+						...current,
+						[field]: value
+					});
+					if (this.disposed) return;
+					this.publish({
+						...this.snapshot,
+						status: "ready",
+						value: accepted,
+						writable: true
+					});
+				});
+			}
+			unset(field) {
+				return this.set(field, false);
+			}
+			async dispose() {
+				this.disposed = true;
+				await this.tail;
+			}
+			enqueue(operation) {
+				if (this.disposed) return Promise.resolve();
+				const task = this.tail.then(async () => {
+					if (this.disposed) return;
+					await operation();
+				});
+				this.tail = task.catch(() => void 0);
+				return task;
+			}
+			publish(next) {
+				this.snapshot = next;
+				for (const listener of [...this.listeners]) listener();
+			}
+		};
+		//#endregion
 		//#region src/client/locales.ts
 		/** Browser copy for the standalone Codex authentication card. */
 		const en = {
@@ -1639,10 +1751,17 @@ window.__ModuleLoader__.load({
 				en
 			}), "dsh-codex-auth-plugin: locale");
 			const t = ctx.locale.bind(namespace);
-			const configScope = ctx.settingsScope.bind({
-				namespace: CODEX_AUTH_SETTINGS_NAMESPACE,
+			const remoteScope = ctx.get("connection").isLoopback ? void 0 : new CodexAuthRemoteSettingsScope();
+			const configScope = remoteScope ?? ctx.settingsScope.bind({
+				namespace: "dsh-codex-auth",
 				decode: decodeCodexAuthSettings
 			});
+			if (remoteScope !== void 0) ctx.effect(() => {
+				remoteScope.load();
+				return async () => {
+					await remoteScope.dispose();
+				};
+			}, "dsh-codex-auth-plugin: remote settings scope");
 			ctx.slots.inject("settings.plugin.item", () => ctx.slots.register({
 				name: "settings.plugin.item",
 				key: CODEX_AUTH_SETTINGS_NAMESPACE,

package/lib/index.d.ts

@@ -1,6 +1,7 @@
 import { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH } from "./auth-paths.js";
 import { a as CODEX_AUTH_FILENAME, c as codexAuthPath, i as logoutCodex, n as codexAuthStatus, o as CODEX_PROVIDER, r as loginCodex, s as CodexCredentialStore, t as CodexAuthStatus } from "./auth-BBBeI24-.js";
 import { CredentialProvider } from "@deepseek-ai/dsh-credentials";
+import "@deepseek-ai/dsh-settings";
 import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { Context } from "@deepseek-ai/cordis";

package/lib/index.js

@@ -1,5 +1,5 @@
 import { a as CODEX_PROVIDER, i as CODEX_AUTH_FILENAME, n as loginCodex, o as CodexCredentialStore, r as logoutCodex, s as codexAuthPath, t as codexAuthStatus } from "./auth-DQ2F4vc6.js";
-import { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH } from "./auth-paths.js";
+import { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_SETTINGS_PATH, CODEX_AUTH_STATUS_PATH, CODEX_USAGE_PATH } from "./auth-paths.js";
 import { createModels } from "@earendil-works/pi-ai";
 import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { basename } from "node:path";
@@ -136,10 +136,29 @@ var CodexUsageService = class {
 	}
 };
 //#endregion
+//#region src/settings-contract.ts
+const DEFAULT_CODEX_AUTH_SETTINGS = Object.freeze({
+	enableImageTool: false,
+	enableImageUpload: false
+});
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Narrow the settings wire payload before it enters React state. */
+function decodeCodexAuthSettings(value) {
+	if (!isRecord(value) || typeof value["enableImageTool"] !== "boolean") return void 0;
+	return {
+		enableImageTool: value["enableImageTool"],
+		enableImageUpload: typeof value["enableImageUpload"] === "boolean" ? value["enableImageUpload"] : DEFAULT_CODEX_AUTH_SETTINGS.enableImageUpload
+	};
+}
+//#endregion
 //#region src/auth-routes.ts
 const CODEX_AUTH_URL_TIMEOUT_MS = 3e4;
 const REMOTE_WEB_ORIGIN_NOT_TRUSTED = "remote-web-origin-not-trusted";
 const CODEX_USAGE_UNAVAILABLE = "codex-usage-unavailable";
+const CODEX_SETTINGS_INVALID = "codex-settings-invalid";
+const CODEX_SETTINGS_BODY_LIMIT = 8192;
 function signedInStatus(expiresAt) {
 	return expiresAt === void 0 ? { status: "signed-in" } : {
 		status: "signed-in",
@@ -336,6 +355,71 @@ function json(res, status, value) {
 	});
 	res.end(JSON.stringify(value));
 }
+function readJsonBody(req) {
+	return new Promise((resolve, reject) => {
+		let body = "";
+		let size = 0;
+		let finished = false;
+		req.setEncoding("utf8");
+		req.on("data", (chunk) => {
+			if (finished) return;
+			size += Buffer.byteLength(chunk);
+			if (size > CODEX_SETTINGS_BODY_LIMIT) {
+				finished = true;
+				reject(/* @__PURE__ */ new Error("request body is too large"));
+				return;
+			}
+			body += chunk;
+		});
+		req.on("end", () => {
+			if (finished) return;
+			finished = true;
+			try {
+				resolve(JSON.parse(body));
+			} catch {
+				reject(/* @__PURE__ */ new Error("request body is not valid JSON"));
+			}
+		});
+		req.on("error", (error) => {
+			if (finished) return;
+			finished = true;
+			reject(error);
+		});
+	});
+}
+function decodeSettingsWrite(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (typeof record["enableImageTool"] !== "boolean" || typeof record["enableImageUpload"] !== "boolean") return;
+	return decodeCodexAuthSettings(record);
+}
+/** Register the plugin-owned settings endpoint for browsers opened through a NAS authority. */
+function registerCodexSettingsRoute(ctx, settings) {
+	ctx.effect(() => {
+		const authorize = (req, res) => {
+			if (trustedRequest(req)) return true;
+			json(res, 403, { error: REMOTE_WEB_ORIGIN_NOT_TRUSTED });
+			return false;
+		};
+		return ctx.webServer.register({
+			kind: "exact",
+			path: CODEX_AUTH_SETTINGS_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "GET" && req.method !== "PUT") return json(res, 405, { error: "method not allowed" });
+				if (!authorize(req, res)) return;
+				if (req.method === "GET") return json(res, 200, settings.get());
+				try {
+					const next = decodeSettingsWrite(await readJsonBody(req));
+					if (next === void 0) return json(res, 400, { error: CODEX_SETTINGS_INVALID });
+					await settings.update(next);
+					json(res, 200, settings.get());
+				} catch (error) {
+					json(res, 400, { error: safeMessage(error) });
+				}
+			}
+		});
+	}, "dsh-codex-auth-plugin: remote settings route");
+}
 /** Register the auth endpoints when the DSH Web server is available. */
 function registerCodexAuthRoutes(ctx, store, mirror) {
 	const auth = new CodexWebAuth(store, CODEX_AUTH_URL_TIMEOUT_MS, mirror);
@@ -460,12 +544,6 @@ var CodexCredentialMirror = class {
 	}
 };
 //#endregion
-//#region src/settings-contract.ts
-const DEFAULT_CODEX_AUTH_SETTINGS = Object.freeze({
-	enableImageTool: false,
-	enableImageUpload: false
-});
-//#endregion
 //#region src/settings.ts
 /** Host settings registration that makes the standalone auth card discoverable. */
 /** Branded namespace used by the Host settings service. */
@@ -706,6 +784,7 @@ function apply(ctx) {
 		};
 	}, "dsh-codex-auth: credential mirror");
 	registerCodexAuthRoutes(ctx, store, mirror);
+	registerCodexSettingsRoute(ctx, settings);
 	let stopped = false;
 	let imageFiber;
 	let imageTail = Promise.resolve();

package/package.json

@@ -2,7 +2,7 @@
   "name": "@tnnevol/dsh-codex-auth",
   "displayName": "Codex Auth",
   "description": "Standalone ChatGPT OAuth account management for DeepSeek Harness.",
-  "version": "0.1.0-rc.7",
+  "version": "0.1.0-rc.7.2",
   "author": "tnnevol",
   "repository": {
     "type": "git",