@young1lin/dsh-gpt-sub 0.1.0

package/lib/token-store.js

@@ -0,0 +1,228 @@
+/**
+ * Codex OAuth credential access. Reads the Codex CLI's own auth.json so both
+ * tools share one login, and refreshes the access token before it expires.
+ *
+ * Expiry is judged solely from the access_token's exp claim. The id_token
+ * carries identity claims, lives one hour, and is routinely expired while the
+ * access token remains valid for days -- treating it as an expiry signal would
+ * trigger a refresh on nearly every request.
+ *
+ * @module dsh-gpt-sub/token-store
+ */
+import { readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { fetch as undiciFetch } from 'undici';
+import { jwtExpiryMs } from "./jwt.js";
+/** Codex CLI's public OAuth client, read from the aud claim of a real id_token. */
+const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+/** Issuer-derived token endpoint. */
+const TOKEN_URL = 'https://auth.openai.com/oauth/token';
+export class TokenStore {
+    #authFile;
+    #refreshMarginMs;
+    #now;
+    #dispatcher;
+    #fetch;
+    /** The in-flight exchange, shared by every caller that arrives during it. */
+    #inFlight;
+    constructor(options) {
+        this.#authFile = options.authFile;
+        this.#refreshMarginMs = options.refreshMarginMs;
+        this.#now = options.now ?? (() => Date.now());
+        this.#dispatcher = options.dispatcher;
+        // The same cast index.ts uses for undici's `request`: the real signature is
+        // wider than the seam, and the seam is what the tests stub.
+        this.#fetch = options.fetchImpl ?? undiciFetch;
+    }
+    /**
+     * Return usable credentials, refreshing first when the access token is
+     * inside the configured margin.
+     *
+     * @returns credentials valid at the moment of the call.
+     */
+    async getTokens() {
+        const file = await this.#read();
+        const tokens = this.#extract(file);
+        const expiry = jwtExpiryMs(tokens.accessToken);
+        if (expiry !== undefined && expiry - this.#now() < this.#refreshMarginMs) {
+            return await this.#refresh(file, tokens);
+        }
+        return tokens;
+    }
+    /**
+     * Report the current access token's expiry without touching the network.
+     *
+     * Reads and parses the file only -- no refresh, no matter how close to the
+     * margin the token is -- so the status endpoint can show when the next
+     * automatic refresh will happen without triggering it.
+     *
+     * @returns file-derived facts about the stored credentials.
+     */
+    async inspect() {
+        const tokens = this.#extract(await this.#read());
+        const expiry = jwtExpiryMs(tokens.accessToken);
+        return expiry === undefined ? {} : { accessTokenExpiresAt: expiry };
+    }
+    /**
+     * Point later reads at a different credential file, as a page-side switch
+     * does. The caller validates the new path before switching.
+     *
+     * @param authFile - the replacement credential file's path.
+     */
+    setAuthFile(authFile) {
+        this.#authFile = authFile;
+    }
+    /**
+     * Point later refreshes at a different dispatcher, as a proxy switch does.
+     *
+     * @param dispatcher - the dispatcher future refresh calls use; undefined for the global.
+     */
+    setDispatcher(dispatcher) {
+        this.#dispatcher = dispatcher;
+    }
+    /**
+     * Check that the credential file is readable and carries the fields the shim
+     * needs, without spending a refresh on it.
+     *
+     * Called at plugin start so a missing or unparseable auth.json fails there
+     * naming the path, as the spec's error table requires, instead of surfacing
+     * on the first request. Deliberately does not call getTokens(): that would
+     * put a network refresh on the startup path.
+     */
+    async verify() {
+        this.#extract(await this.#read());
+    }
+    /** Read and parse auth.json, naming the path in every failure. */
+    async #read() {
+        let raw;
+        try {
+            raw = await readFile(this.#authFile, 'utf8');
+        }
+        catch (error) {
+            throw new Error(`dsh-gpt-sub: cannot read Codex credentials at ${this.#authFile}`, { cause: error });
+        }
+        try {
+            return JSON.parse(raw);
+        }
+        catch (error) {
+            throw new Error(`dsh-gpt-sub: cannot parse Codex credentials at ${this.#authFile}`, { cause: error });
+        }
+    }
+    /** Pull the required fields, naming whichever one is absent. */
+    #extract(file) {
+        const accessToken = file.tokens?.access_token;
+        const refreshToken = file.tokens?.refresh_token;
+        const accountId = file.tokens?.account_id;
+        if (accessToken === undefined || refreshToken === undefined || accountId === undefined) {
+            throw new Error(`dsh-gpt-sub: ${this.#authFile} is missing tokens.access_token, tokens.refresh_token, or tokens.account_id; run 'codex' to sign in again`);
+        }
+        return { accessToken, refreshToken, accountId };
+    }
+    /**
+     * Refresh regardless of remaining lifetime. Used when the upstream rejects a
+     * token that local expiry math believed was still good.
+     *
+     * @returns freshly issued credentials.
+     */
+    async forceRefresh() {
+        const file = await this.#read();
+        return await this.#refresh(file, this.#extract(file));
+    }
+    /**
+     * Exchange the refresh token, coalescing callers that arrive together.
+     *
+     * The refresh token is single-use and rotates, so two concurrent exchanges
+     * would spend the same token: the loser gets `invalid_grant` and tells the
+     * user to sign in again in the middle of entirely normal operation. DSH
+     * issues parallel LLM calls, so that is reachable, not theoretical.
+     *
+     * Only concurrent callers share a result. Once the exchange settles the slot
+     * is cleared, so a later refresh performs a new one.
+     *
+     * @param file - the parsed auth.json, whose unrelated fields are preserved.
+     * @param tokens - the credentials whose refresh token is being spent.
+     * @returns the newly issued credentials.
+     */
+    async #refresh(file, tokens) {
+        this.#inFlight ??= this.#exchange(file, tokens).finally(() => {
+            this.#inFlight = undefined;
+        });
+        return await this.#inFlight;
+    }
+    /**
+     * Perform one token exchange and persist the result.
+     *
+     * @param file - the parsed auth.json, whose unrelated fields are preserved.
+     * @param tokens - the credentials whose refresh token is being spent.
+     * @returns the newly issued credentials.
+     */
+    async #exchange(file, tokens) {
+        let response;
+        try {
+            response = await this.#fetch(TOKEN_URL, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    client_id: CLIENT_ID,
+                    grant_type: 'refresh_token',
+                    refresh_token: tokens.refreshToken,
+                }),
+                ...(this.#dispatcher === undefined ? {} : { dispatcher: this.#dispatcher }),
+            });
+        }
+        catch (error) {
+            // A transport failure here is almost always the proxy, not the account.
+            // Say so, and still name the recovery the spec asks for.
+            throw new Error(`dsh-gpt-sub: cannot reach the Codex token endpoint at ${TOKEN_URL}; check the plugin's proxyUrl, then run 'codex' to sign in again`, { cause: error });
+        }
+        if (!response.ok) {
+            const detail = await response.text();
+            throw new Error(`dsh-gpt-sub: refreshing the Codex token failed (${response.status}: ${detail}); run 'codex' to sign in again`);
+        }
+        const payload = (await response.json());
+        if (payload.access_token === undefined) {
+            throw new Error(`dsh-gpt-sub: the token endpoint returned no access_token; run 'codex' to sign in again`);
+        }
+        const refreshed = {
+            accessToken: payload.access_token,
+            // A rotated refresh token must be kept; reusing a spent one fails next time.
+            refreshToken: payload.refresh_token ?? tokens.refreshToken,
+            accountId: tokens.accountId,
+        };
+        await this.#persist(file, refreshed, payload.id_token);
+        return refreshed;
+    }
+    /**
+     * Write the credential file atomically so a concurrent Codex CLI read never
+     * observes a partial file. Fields this plugin does not own are preserved.
+     *
+     * @param file - the previously parsed file contents.
+     * @param tokens - the credentials to store.
+     * @param idToken - a refreshed id_token when the endpoint returned one.
+     */
+    async #persist(file, tokens, idToken) {
+        const next = {
+            ...file,
+            tokens: {
+                ...file.tokens,
+                ...(idToken === undefined ? {} : { id_token: idToken }),
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                account_id: tokens.accountId,
+            },
+            last_refresh: new Date(this.#now()).toISOString(),
+        };
+        const temporary = `${this.#authFile}.tmp-${String(process.pid)}`;
+        // For as long as it exists this file holds live credentials, so create it
+        // private to the user, and never leave one on disk if the rename that
+        // should have consumed it fails.
+        await writeFile(temporary, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
+        try {
+            await rename(temporary, this.#authFile);
+        }
+        catch (error) {
+            await rm(temporary, { force: true });
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=token-store.js.map

package/lib/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEtC,mFAAmF;AACnF,MAAM,SAAS,GAAG,8BAA8B,CAAA;AAEhD,qCAAqC;AACrC,MAAM,SAAS,GAAG,qCAAqC,CAAA;AA6DvD,MAAM,OAAO,UAAU;IACrB,SAAS,CAAQ;IACR,gBAAgB,CAAQ;IACxB,IAAI,CAAc;IAC3B,WAAW,CAAS;IACX,MAAM,CAAc;IAC7B,6EAA6E;IAC7E,SAAS,CAAkC;IAE3C,YAAY,OAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAA;QACrC,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,IAAK,WAAuC,CAAA;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC9C,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAA;IACrE,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;IAC3B,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAmB;QAC/B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IACnC,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,KAAK;QACT,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACtG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAA;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,QAAQ,CAAC,IAAmB;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAA;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAA;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAA;QACzC,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,SAAS,2GAA2G,CAC1I,CAAA;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAC/B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACvD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAmB,EAAE,MAAmB;QACrD,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC5B,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,IAAI,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,IAAmB,EAAE,MAAmB;QACtD,IAAI,QAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;iBACnC,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aAC5E,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,IAAI,KAAK,CACb,yDAAyD,SAAS,kEAAkE,EACpI,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACpC,MAAM,IAAI,KAAK,CACb,mDAAmD,QAAQ,CAAC,MAAM,KAAK,MAAM,iCAAiC,CAC/G,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIrC,CAAA;QACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;QAC3G,CAAC;QACD,MAAM,SAAS,GAAgB;YAC7B,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,6EAA6E;YAC7E,YAAY,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY;YAC1D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAA;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAmB,EAAE,MAAmB,EAAE,OAA2B;QAClF,MAAM,IAAI,GAAkB;YAC1B,GAAG,IAAI;YACP,MAAM,EAAE;gBACN,GAAG,IAAI,CAAC,MAAM;gBACd,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBACvD,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B;YACD,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SAClD,CAAA;QACD,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,QAAQ,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAChE,0EAA0E;QAC1E,sEAAsE;QACtE,iCAAiC;QACjC,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5F,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;CACF"}

package/lib/types.d.ts

@@ -0,0 +1,18 @@
+/** Plugin configuration shape, validated by the schemastery schema in index.ts. */
+export interface Config {
+    /** Proxy URL for reaching the token endpoint, e.g. http://127.0.0.1:7890; empty means direct. */
+    proxyUrl: string;
+    /** Path to the Codex CLI credential file. */
+    authFile: string;
+    /** Refresh the access token when less than this many minutes remain. */
+    refreshMarginMinutes: number;
+    /** Credential the provider route names, and this plugin keeps populated. */
+    tokenRef: string;
+    /** How often to re-read the credential file and republish the token. */
+    syncIntervalMinutes: number;
+    /** Extra attempts per request after a dropped connection; 0 disables retry. */
+    bootstrapRetries: number;
+    /** Where the panel's runtime overrides (proxy, credential file) are persisted. */
+    stateFile: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,MAAM;IACrB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAA;IACxB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAA;CAClB"}

package/lib/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/lib/usage.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Subscription usage lookup for the Codex account.
+ *
+ * One GET against the same host the model calls use, authorized with the same
+ * access token. Used at startup as a reachability probe -- an unproxied egress
+ * answers 403 with a Cloudflare block page rather than an API error, and that
+ * failure is otherwise invisible until the first model call.
+ *
+ * @module dsh-gpt-sub/usage
+ */
+import { fetch as undiciFetch, type Dispatcher } from 'undici';
+/** One rate-limit window as the usage endpoint reports it. */
+export interface UsageWindow {
+    used_percent: number;
+    limit_window_seconds: number;
+    reset_after_seconds?: number;
+    reset_at?: number;
+}
+/** The subset of the usage reply this plugin reads. */
+export interface Usage {
+    plan_type?: string;
+    rate_limit?: {
+        primary_window?: UsageWindow | null;
+        secondary_window?: UsageWindow | null;
+    };
+    /** On-demand rate-limit resets the plan grants, when it reports them. */
+    rate_limit_reset_credits?: {
+        /** Resets the account owns and can still spend. */
+        available_count?: number;
+        /** Resets applicable to the current windows -- zero while none is capped. */
+        applicable_available_count?: number;
+    } | null;
+}
+/** Thrown when the usage endpoint answers with something other than JSON usage. */
+export declare class UsageError extends Error {
+}
+/**
+ * Read the account's current usage.
+ *
+ * @param accessToken - a live Codex access token.
+ * @param dispatcher - undici dispatcher; omit to use the global one.
+ * @returns the parsed usage reply.
+ * @throws UsageError when the endpoint refuses, or answers with a non-JSON
+ *   body -- which is what an unproxied egress produces, and the message says so.
+ */
+export declare function fetchUsage(accessToken: string, dispatcher?: Dispatcher, fetchImpl?: typeof undiciFetch, signal?: AbortSignal): Promise<Usage>;
+/**
+ * List every window the reply carries, primary slot first.
+ *
+ * Accounts differ here -- a plus account reports `secondary_window: null` and
+ * carries its weekly allowance on the primary, and a pro account currently
+ * reports only a weekly window with no 5-hour rolling limit at all -- so
+ * reading one chosen slot hides the 5-hour window on the accounts that have
+ * one. The panel renders whichever windows exist.
+ *
+ * @param usage - a usage reply.
+ * @returns the windows worth showing, primary slot first; empty when the reply
+ *   carries none.
+ */
+export declare function reportedWindows(usage: Usage): UsageWindow[];
+/**
+ * Count the on-demand usage resets the account can still spend -- what the
+ * usage endpoint reports as `rate_limit_reset_credits`, each one clearing a
+ * capped window without waiting out its timer.
+ *
+ * @param usage - a usage reply.
+ * @returns the resets remaining, or undefined when the reply carries none --
+ *   which plans without the feature answer.
+ */
+export declare function resetsRemaining(usage: Usage): number | undefined;
+/** A rate-limit window normalized for per-window rendering. */
+export interface ReportedWindow {
+    /** Percent of this window consumed. */
+    usedPercent: number;
+    /** Length of the window, in hours. */
+    windowHours: number;
+    /** Epoch seconds at which the window resets. */
+    resetAt?: number;
+}
+/**
+ * Every window the reply reports, primary first.
+ *
+ * The panel renders one row per window -- the 5-hour and the weekly allowance
+ * on accounts that report both -- so it needs all of them, not the single one
+ * {@link activeWindow} picks for the startup log. Window identity comes from
+ * the reported length, because which slot an account uses differs.
+ *
+ * @param usage - a usage reply.
+ * @returns the reported windows, primary before secondary.
+ */
+export declare function reportWindows(usage: Usage): ReportedWindow[];
+//# sourceMappingURL=usage.d.ts.map

package/lib/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,uDAAuD;AACvD,MAAM,WAAW,KAAK;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;QACnC,gBAAgB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KACtC,CAAA;IACD,yEAAyE;IACzE,wBAAwB,CAAC,EAAE;QACzB,mDAAmD;QACnD,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,6EAA6E;QAC7E,0BAA0B,CAAC,EAAE,MAAM,CAAA;KACpC,GAAG,IAAI,CAAA;CACT;AAED,mFAAmF;AACnF,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAKxC;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,UAAU,EACvB,SAAS,GAAE,OAAO,WAAyB,EAC3C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC,CAsBhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,WAAW,EAAE,CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,EAAE,CAM5D"}

package/lib/usage.js

@@ -0,0 +1,106 @@
+/**
+ * Subscription usage lookup for the Codex account.
+ *
+ * One GET against the same host the model calls use, authorized with the same
+ * access token. Used at startup as a reachability probe -- an unproxied egress
+ * answers 403 with a Cloudflare block page rather than an API error, and that
+ * failure is otherwise invisible until the first model call.
+ *
+ * @module dsh-gpt-sub/usage
+ */
+import { fetch as undiciFetch } from 'undici';
+/** Thrown when the usage endpoint answers with something other than JSON usage. */
+export class UsageError extends Error {
+}
+/** The usage endpoint, on the same host as the model calls. */
+const USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage';
+/**
+ * Read the account's current usage.
+ *
+ * @param accessToken - a live Codex access token.
+ * @param dispatcher - undici dispatcher; omit to use the global one.
+ * @returns the parsed usage reply.
+ * @throws UsageError when the endpoint refuses, or answers with a non-JSON
+ *   body -- which is what an unproxied egress produces, and the message says so.
+ */
+export async function fetchUsage(accessToken, dispatcher, fetchImpl = undiciFetch, signal) {
+    const response = await fetchImpl(USAGE_URL, {
+        headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json' },
+        ...(dispatcher === undefined ? {} : { dispatcher }),
+        ...(signal === undefined ? {} : { signal }),
+    });
+    const body = await response.text();
+    if (!response.ok) {
+        const blocked = body.includes('Unable to load site') || body.includes('blocked-icon');
+        throw new UsageError(blocked
+            ? `usage endpoint answered ${String(response.status)} with a Cloudflare block page; this address cannot reach chatgpt.com, so the request did not egress through the proxy`
+            : `usage endpoint answered ${String(response.status)}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new UsageError('usage endpoint did not answer with JSON');
+    }
+}
+/**
+ * List every window the reply carries, primary slot first.
+ *
+ * Accounts differ here -- a plus account reports `secondary_window: null` and
+ * carries its weekly allowance on the primary, and a pro account currently
+ * reports only a weekly window with no 5-hour rolling limit at all -- so
+ * reading one chosen slot hides the 5-hour window on the accounts that have
+ * one. The panel renders whichever windows exist.
+ *
+ * @param usage - a usage reply.
+ * @returns the windows worth showing, primary slot first; empty when the reply
+ *   carries none.
+ */
+export function reportedWindows(usage) {
+    const primary = usage.rate_limit?.primary_window;
+    const secondary = usage.rate_limit?.secondary_window;
+    return [primary, secondary].filter((window) => window != null);
+}
+/**
+ * Count the on-demand usage resets the account can still spend -- what the
+ * usage endpoint reports as `rate_limit_reset_credits`, each one clearing a
+ * capped window without waiting out its timer.
+ *
+ * @param usage - a usage reply.
+ * @returns the resets remaining, or undefined when the reply carries none --
+ *   which plans without the feature answer.
+ */
+export function resetsRemaining(usage) {
+    const count = usage.rate_limit_reset_credits?.available_count;
+    return typeof count === 'number' ? count : undefined;
+}
+/**
+ * Normalize one raw window for the panel.
+ *
+ * @param window - the window as the usage endpoint reports it.
+ * @returns the normalized window.
+ */
+const toReported = (window) => ({
+    usedPercent: window.used_percent,
+    windowHours: Math.round(window.limit_window_seconds / 3600),
+    ...(window.reset_at === undefined ? {} : { resetAt: window.reset_at }),
+});
+/**
+ * Every window the reply reports, primary first.
+ *
+ * The panel renders one row per window -- the 5-hour and the weekly allowance
+ * on accounts that report both -- so it needs all of them, not the single one
+ * {@link activeWindow} picks for the startup log. Window identity comes from
+ * the reported length, because which slot an account uses differs.
+ *
+ * @param usage - a usage reply.
+ * @returns the reported windows, primary before secondary.
+ */
+export function reportWindows(usage) {
+    const primary = usage.rate_limit?.primary_window;
+    const secondary = usage.rate_limit?.secondary_window;
+    return [primary, secondary]
+        .filter((window) => window != null)
+        .map(toReported);
+}
+//# sourceMappingURL=usage.js.map

package/lib/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,IAAI,WAAW,EAAmB,MAAM,QAAQ,CAAA;AA0B9D,mFAAmF;AACnF,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,+DAA+D;AAC/D,MAAM,SAAS,GAAG,4CAA4C,CAAA;AAE9D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,UAAuB,EACvB,YAAgC,WAAW,EAC3C,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;QAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC/E,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QACrF,MAAM,IAAI,UAAU,CAClB,OAAO;YACL,CAAC,CAAC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uHAAuH;YAC3K,CAAC,CAAC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CACzD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAU,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,cAAc,CAAA;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACpD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAA;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAkB,EAAE,CAAC,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC,YAAY;IAChC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC3D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;CACvE,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,cAAc,CAAA;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACpD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC;SACzD,GAAG,CAAC,UAAU,CAAC,CAAA;AACpB,CAAC"}

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@young1lin/dsh-gpt-sub",
+  "version": "0.1.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "Direct ChatGPT/Codex subscription access for DeepSeek Harness, replacing CLIProxyAPI.",
+  "author": "young1lin",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/young1lin/dsh-gpt-sub.git"
+  },
+  "homepage": "https://github.com/young1lin/dsh-gpt-sub#readme",
+  "bugs": "https://github.com/young1lin/dsh-gpt-sub/issues",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json",
+    "./client": "./client.js"
+  },
+  "files": [
+    "lib",
+    "src",
+    "client.js",
+    "cordis.patch.yml",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.13"
+  },
+  "packageManager": "pnpm@11.22.0",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "cordis",
+    "plugin",
+    "chatgpt",
+    "codex",
+    "openai",
+    "subscription",
+    "quota"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "undici": "^7.10.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.0-rc.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.7",
+    "@types/node": "^22.10.0",
+    "typescript": "^5.9.0",
+    "vitest": "^3.2.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [],
+      "platform": "web"
+    }
+  }
+}