codex-subscription-oauth-plugin 0.1.1

package/lib/openai-codex.js

@@ -0,0 +1,574 @@
+import { t as getProviderEnvValue } from "./provider-env-DRzE1dvc.js";
+//#region node_modules/@earendil-works/pi-ai/dist/auth/oauth/device-code.js
+const CANCEL_MESSAGE = "Login cancelled";
+const TIMEOUT_MESSAGE = "Device flow timed out";
+const SLOW_DOWN_TIMEOUT_MESSAGE = "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.";
+const MINIMUM_INTERVAL_MS = 1e3;
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_INTERVAL_INCREMENT_MS = 5e3;
+function abortableSleep(ms, signal, cancelMessage) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			reject(new Error(cancelMessage));
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(new Error(cancelMessage));
+		};
+		const timeout = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+async function pollOAuthDeviceCodeFlow(options) {
+	const deadline = typeof options.expiresInSeconds === "number" ? Date.now() + options.expiresInSeconds * 1e3 : Number.POSITIVE_INFINITY;
+	let intervalMs = Math.max(MINIMUM_INTERVAL_MS, Math.floor((options.intervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS) * 1e3));
+	let slowDownResponses = 0;
+	if (options.waitBeforeFirstPoll) {
+		const remainingMs = deadline - Date.now();
+		if (remainingMs > 0) await abortableSleep(Math.min(intervalMs, remainingMs), options.signal, CANCEL_MESSAGE);
+	}
+	while (Date.now() < deadline) {
+		if (options.signal.aborted) throw new Error(CANCEL_MESSAGE);
+		const result = await options.poll();
+		if (result.status === "complete") return result.value;
+		if (result.status === "failed") throw new Error(result.message);
+		if (result.status === "slow_down") {
+			slowDownResponses += 1;
+			intervalMs = typeof result.intervalSeconds === "number" && Number.isFinite(result.intervalSeconds) && result.intervalSeconds > 0 ? Math.max(MINIMUM_INTERVAL_MS, Math.floor(result.intervalSeconds * 1e3)) : Math.max(MINIMUM_INTERVAL_MS, intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS);
+		}
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) break;
+		await abortableSleep(Math.min(intervalMs, remainingMs), options.signal, CANCEL_MESSAGE);
+	}
+	throw new Error(slowDownResponses > 0 ? SLOW_DOWN_TIMEOUT_MESSAGE : TIMEOUT_MESSAGE);
+}
+//#endregion
+//#region node_modules/@earendil-works/pi-ai/dist/auth/oauth/oauth-page.js
+const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg>`;
+function escapeHtml(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+function renderPage(options) {
+	const title = escapeHtml(options.title);
+	const heading = escapeHtml(options.heading);
+	const message = escapeHtml(options.message);
+	const details = options.details ? escapeHtml(options.details) : void 0;
+	return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>
+    :root {
+      --text: #fafafa;
+      --text-dim: #a1a1aa;
+      --page-bg: #09090b;
+      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+    }
+    * { box-sizing: border-box; }
+    html { color-scheme: dark; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      background: var(--page-bg);
+      color: var(--text);
+      font-family: var(--font-sans);
+      text-align: center;
+    }
+    main {
+      width: 100%;
+      max-width: 560px;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+    }
+    .logo {
+      width: 72px;
+      height: 72px;
+      display: block;
+      margin-bottom: 24px;
+    }
+    h1 {
+      margin: 0 0 10px;
+      font-size: 28px;
+      line-height: 1.15;
+      font-weight: 650;
+      color: var(--text);
+    }
+    p {
+      margin: 0;
+      line-height: 1.7;
+      color: var(--text-dim);
+      font-size: 15px;
+    }
+    .details {
+      margin-top: 16px;
+      font-family: var(--font-mono);
+      font-size: 13px;
+      color: var(--text-dim);
+      white-space: pre-wrap;
+      word-break: break-word;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="logo">${LOGO_SVG}</div>
+    <h1>${heading}</h1>
+    <p>${message}</p>
+    ${details ? `<div class="details">${details}</div>` : ""}
+  </main>
+</body>
+</html>`;
+}
+function oauthSuccessHtml(message) {
+	return renderPage({
+		title: "Authentication successful",
+		heading: "Authentication successful",
+		message
+	});
+}
+function oauthErrorHtml(message, details) {
+	return renderPage({
+		title: "Authentication failed",
+		heading: "Authentication failed",
+		message,
+		details
+	});
+}
+//#endregion
+//#region node_modules/@earendil-works/pi-ai/dist/auth/oauth/pkce.js
+/**
+* PKCE utilities using Web Crypto API.
+* Works in both Node.js 20+ and browsers.
+*/
+/**
+* Encode bytes as base64url string.
+*/
+function base64urlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+/**
+* Generate PKCE code verifier and challenge.
+* Uses Web Crypto API for cross-platform compatibility.
+*/
+async function generatePKCE() {
+	const verifierBytes = /* @__PURE__ */ new Uint8Array(32);
+	crypto.getRandomValues(verifierBytes);
+	const verifier = base64urlEncode(verifierBytes);
+	const data = new TextEncoder().encode(verifier);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+	return {
+		verifier,
+		challenge: base64urlEncode(new Uint8Array(hashBuffer))
+	};
+}
+//#endregion
+//#region node_modules/@earendil-works/pi-ai/dist/auth/oauth/openai-codex.js
+/**
+* OpenAI Codex (ChatGPT OAuth) flow
+*
+* NOTE: This module uses Node.js crypto and http for the OAuth callback.
+* It is only intended for CLI use, not browser environments.
+*/
+let _randomBytes = null;
+let _http = null;
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+	import("node:crypto").then((m) => {
+		_randomBytes = m.randomBytes;
+	});
+	import("node:http").then((m) => {
+		_http = m;
+	});
+}
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTH_BASE_URL = "https://auth.openai.com";
+const AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
+const TOKEN_URL = `${AUTH_BASE_URL}/oauth/token`;
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const DEVICE_USER_CODE_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`;
+const DEVICE_TOKEN_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
+const DEVICE_VERIFICATION_URI = `${AUTH_BASE_URL}/codex/device`;
+const DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
+const DEVICE_CODE_TIMEOUT_SECONDS = 900;
+const OPENAI_CODEX_BROWSER_LOGIN_METHOD = "browser";
+const OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD = "device_code";
+const SCOPE = "openid profile email offline_access";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+function getCallbackHost() {
+	return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+}
+function createState() {
+	if (!_randomBytes) throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
+	return _randomBytes(16).toString("hex");
+}
+function parseAuthorizationInput(input) {
+	const value = input.trim();
+	if (!value) return {};
+	try {
+		const url = new URL(value);
+		return {
+			code: url.searchParams.get("code") ?? void 0,
+			state: url.searchParams.get("state") ?? void 0
+		};
+	} catch {}
+	if (value.includes("#")) {
+		const [code, state] = value.split("#", 2);
+		return {
+			code,
+			state
+		};
+	}
+	if (value.includes("code=")) {
+		const params = new URLSearchParams(value);
+		return {
+			code: params.get("code") ?? void 0,
+			state: params.get("state") ?? void 0
+		};
+	}
+	return { code: value };
+}
+function decodeJwt(token) {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1] ?? "";
+		const decoded = atob(payload);
+		return JSON.parse(decoded);
+	} catch {
+		return null;
+	}
+}
+async function fetchWithLoginCancellation(input, init) {
+	try {
+		return await fetch(input, init);
+	} catch (error) {
+		if (init.signal?.aborted) throw new Error("Login cancelled");
+		throw error;
+	}
+}
+async function readTokenResponse(response, operation) {
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`OpenAI Codex token ${operation} failed (${response.status}): ${text || response.statusText}`);
+	}
+	const json = await response.json();
+	if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") throw new Error(`OpenAI Codex token ${operation} response missing fields: ${JSON.stringify(json)}`);
+	return {
+		access: json.access_token,
+		refresh: json.refresh_token,
+		expires: Date.now() + json.expires_in * 1e3
+	};
+}
+async function exchangeAuthorizationCode(code, verifier, redirectUri, signal) {
+	return readTokenResponse(await fetchWithLoginCancellation(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri
+		}),
+		signal
+	}), "exchange");
+}
+async function refreshAccessToken(refreshToken, signal) {
+	let response;
+	try {
+		response = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID
+			}),
+			signal
+		});
+	} catch (error) {
+		throw new Error(`OpenAI Codex token refresh error: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return readTokenResponse(response, "refresh");
+}
+async function startOpenAICodexDeviceAuth(signal) {
+	const response = await fetchWithLoginCancellation(DEVICE_USER_CODE_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal
+	});
+	if (!response.ok) {
+		if (response.status === 404) throw new Error("OpenAI Codex device code login is not enabled for this server. Use browser login or verify the server URL.");
+		const responseBody = await response.text().catch(() => "");
+		throw new Error(`OpenAI Codex device code request failed with status ${response.status}${responseBody ? `: ${responseBody}` : ""}`);
+	}
+	const json = await response.json();
+	const intervalSeconds = typeof json?.interval === "string" ? Number(json.interval.trim()) : json?.interval;
+	if (!json?.device_auth_id || !json.user_code || typeof intervalSeconds !== "number" || !Number.isFinite(intervalSeconds) || intervalSeconds < 0) throw new Error(`Invalid OpenAI Codex device code response: ${JSON.stringify(json)}`);
+	return {
+		deviceAuthId: json.device_auth_id,
+		userCode: json.user_code,
+		intervalSeconds
+	};
+}
+async function pollOpenAICodexDeviceAuth(device, signal) {
+	return pollOAuthDeviceCodeFlow({
+		intervalSeconds: device.intervalSeconds,
+		expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS,
+		signal,
+		poll: async () => {
+			const response = await fetchWithLoginCancellation(DEVICE_TOKEN_URL, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					device_auth_id: device.deviceAuthId,
+					user_code: device.userCode
+				}),
+				signal
+			});
+			if (response.ok) {
+				const json = await response.json();
+				if (!json?.authorization_code || !json.code_verifier) return {
+					status: "failed",
+					message: `Invalid OpenAI Codex device auth token response: ${JSON.stringify(json)}`
+				};
+				return {
+					status: "complete",
+					value: {
+						authorizationCode: json.authorization_code,
+						codeVerifier: json.code_verifier
+					}
+				};
+			}
+			if (response.status === 403 || response.status === 404) return { status: "pending" };
+			const responseBody = await response.text().catch(() => "");
+			let errorCode;
+			try {
+				const error = JSON.parse(responseBody)?.error;
+				errorCode = typeof error === "object" ? error?.code : error;
+			} catch {}
+			if (errorCode === "deviceauth_authorization_pending") return { status: "pending" };
+			if (errorCode === "slow_down") return { status: "slow_down" };
+			return {
+				status: "failed",
+				message: `OpenAI Codex device auth failed with status ${response.status}${responseBody ? `: ${responseBody}` : ""}`
+			};
+		}
+	});
+}
+async function createAuthorizationFlow(originator = "pi") {
+	const { verifier, challenge } = await generatePKCE();
+	const state = createState();
+	const url = new URL(AUTHORIZE_URL);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("redirect_uri", REDIRECT_URI);
+	url.searchParams.set("scope", SCOPE);
+	url.searchParams.set("code_challenge", challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	url.searchParams.set("state", state);
+	url.searchParams.set("id_token_add_organizations", "true");
+	url.searchParams.set("codex_cli_simplified_flow", "true");
+	url.searchParams.set("originator", originator);
+	return {
+		verifier,
+		state,
+		url: url.toString()
+	};
+}
+function startLocalOAuthServer(state) {
+	if (!_http) throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
+	let settleWait;
+	const waitForCodePromise = new Promise((resolve) => {
+		let settled = false;
+		settleWait = (value) => {
+			if (settled) return;
+			settled = true;
+			resolve(value);
+		};
+	});
+	const server = _http.createServer((req, res) => {
+		try {
+			const url = new URL(req.url || "", "http://localhost");
+			if (url.pathname !== "/auth/callback") {
+				res.statusCode = 404;
+				res.setHeader("Content-Type", "text/html; charset=utf-8");
+				res.end(oauthErrorHtml("Callback route not found."));
+				return;
+			}
+			if (url.searchParams.get("state") !== state) {
+				res.statusCode = 400;
+				res.setHeader("Content-Type", "text/html; charset=utf-8");
+				res.end(oauthErrorHtml("State mismatch."));
+				return;
+			}
+			const code = url.searchParams.get("code");
+			if (!code) {
+				res.statusCode = 400;
+				res.setHeader("Content-Type", "text/html; charset=utf-8");
+				res.end(oauthErrorHtml("Missing authorization code."));
+				return;
+			}
+			res.statusCode = 200;
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			res.end(oauthSuccessHtml("OpenAI authentication completed. You can close this window."));
+			settleWait?.({ code });
+		} catch {
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			res.end(oauthErrorHtml("Internal error while processing OAuth callback."));
+		}
+	});
+	return new Promise((resolve) => {
+		server.listen(1455, getCallbackHost(), () => {
+			resolve({
+				close: () => server.close(),
+				cancelWait: () => {
+					settleWait?.(null);
+				},
+				waitForCode: () => waitForCodePromise
+			});
+		}).on("error", (_err) => {
+			settleWait?.(null);
+			resolve({
+				close: () => {
+					try {
+						server.close();
+					} catch {}
+				},
+				cancelWait: () => {},
+				waitForCode: async () => null
+			});
+		});
+	});
+}
+function getAccountId(accessToken) {
+	const accountId = (decodeJwt(accessToken)?.[JWT_CLAIM_PATH])?.chatgpt_account_id;
+	return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+}
+function credentialsFromToken(token) {
+	const accountId = getAccountId(token.access);
+	if (!accountId) throw new Error("Failed to extract accountId from token");
+	return {
+		type: "oauth",
+		access: token.access,
+		refresh: token.refresh,
+		expires: token.expires,
+		accountId
+	};
+}
+async function exchangeAuthorizationCodeForCredentials(code, verifier, redirectUri, signal) {
+	return credentialsFromToken(await exchangeAuthorizationCode(code, verifier, redirectUri, signal));
+}
+async function loginOpenAICodexDeviceCode(interaction) {
+	const device = await startOpenAICodexDeviceAuth(interaction.signal);
+	interaction.notify({
+		type: "device_code",
+		userCode: device.userCode,
+		verificationUri: DEVICE_VERIFICATION_URI,
+		intervalSeconds: device.intervalSeconds,
+		expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS
+	});
+	const code = await pollOpenAICodexDeviceAuth(device, interaction.signal);
+	return exchangeAuthorizationCodeForCredentials(code.authorizationCode, code.codeVerifier, DEVICE_REDIRECT_URI, interaction.signal);
+}
+async function loginOpenAICodex(interaction) {
+	const { verifier, state, url } = await createAuthorizationFlow();
+	const server = await startLocalOAuthServer(state);
+	const manualAbort = new AbortController();
+	const onAbort = () => server.cancelWait();
+	interaction.signal.addEventListener("abort", onAbort, { once: true });
+	if (interaction.signal.aborted) onAbort();
+	let code;
+	let manualCode;
+	let manualError;
+	interaction.notify({
+		type: "auth_url",
+		url,
+		instructions: "A browser window should open. Complete login to finish."
+	});
+	try {
+		const manualPromise = interaction.prompt({
+			type: "manual_code",
+			message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
+			placeholder: REDIRECT_URI,
+			signal: manualAbort.signal
+		}).then((input) => {
+			manualCode = input;
+			server.cancelWait();
+		}).catch((error) => {
+			manualError = error instanceof Error ? error : new Error(String(error));
+			server.cancelWait();
+		});
+		const result = await server.waitForCode();
+		if (manualError) throw manualError;
+		if (result?.code) code = result.code;
+		else if (manualCode) {
+			const parsed = parseAuthorizationInput(manualCode);
+			if (parsed.state && parsed.state !== state) throw new Error("State mismatch");
+			code = parsed.code;
+		}
+		if (!code) {
+			await manualPromise;
+			if (manualError) throw manualError;
+			if (manualCode) {
+				const parsed = parseAuthorizationInput(manualCode);
+				if (parsed.state && parsed.state !== state) throw new Error("State mismatch");
+				code = parsed.code;
+			}
+		}
+		if (!code) throw new Error("Missing authorization code");
+		return exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI, interaction.signal);
+	} finally {
+		interaction.signal.removeEventListener("abort", onAbort);
+		manualAbort.abort();
+		server.close();
+	}
+}
+/**
+* Refresh OpenAI Codex OAuth token
+*/
+async function refreshOpenAICodexToken(refreshToken, signal) {
+	return credentialsFromToken(await refreshAccessToken(refreshToken, signal));
+}
+const openaiCodexOAuth = {
+	name: "OpenAI (ChatGPT Plus/Pro)",
+	isSubscription: true,
+	async login(interaction) {
+		const method = await interaction.prompt({
+			type: "select",
+			message: "Select OpenAI Codex login method:",
+			options: [{
+				id: OPENAI_CODEX_BROWSER_LOGIN_METHOD,
+				label: "Browser login (default)"
+			}, {
+				id: OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD,
+				label: "Device code login (headless)"
+			}]
+		});
+		if (method === OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD) return loginOpenAICodexDeviceCode(interaction);
+		if (method !== OPENAI_CODEX_BROWSER_LOGIN_METHOD) throw new Error(`Unknown OpenAI Codex login method: ${method}`);
+		return loginOpenAICodex(interaction);
+	},
+	refresh: (credential, signal) => refreshOpenAICodexToken(credential.refresh, signal),
+	async toAuth(credential) {
+		return { apiKey: credential.access };
+	}
+};
+//#endregion
+export { openaiCodexOAuth };

package/lib/provider-env-DRzE1dvc.js

@@ -0,0 +1,41 @@
+import { createRequire } from "node:module";
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+//#endregion
+//#region node_modules/@earendil-works/pi-ai/dist/utils/provider-env.js
+let procEnvCache = null;
+/**
+* Fallback for https://github.com/oven-sh/bun/issues/27802.
+* Bun compiled binaries can expose an empty process.env inside Linux sandboxes
+* even though /proc/self/environ contains the environment.
+*
+* This intentionally duplicates restoreSandboxEnv() in
+* packages/coding-agent/src/bun/restore-sandbox-env.ts. The ai package can be
+* used directly, without going through that entrypoint, so provider env lookup
+* must not depend on process.env having been patched.
+*/
+function getBunSandboxEnvValue(name) {
+	if (typeof process === "undefined" || !process.versions?.bun || Object.keys(process.env).length > 0) return;
+	if (procEnvCache === null) {
+		procEnvCache = /* @__PURE__ */ new Map();
+		try {
+			const { readFileSync } = __require("node:fs");
+			const data = readFileSync("/proc/self/environ", "utf-8");
+			for (const entry of data.split("\0")) {
+				const idx = entry.indexOf("=");
+				if (idx > 0) procEnvCache.set(entry.slice(0, idx), entry.slice(idx + 1));
+			}
+		} catch {}
+	}
+	return procEnvCache.get(name);
+}
+/**
+* Resolve a provider env value from scoped overrides, normal process.env, then
+* the duplicated Bun sandbox fallback for direct pi-ai consumers.
+*/
+function getProviderEnvValue(name, env) {
+	return env?.[name] || (typeof process !== "undefined" ? process.env[name] : void 0) || getBunSandboxEnvValue(name) || void 0;
+}
+//#endregion
+export { __commonJSMin as n, getProviderEnvValue as t };

package/package.json

@@ -0,0 +1,87 @@
+{
+  "name": "codex-subscription-oauth-plugin",
+  "version": "0.1.1",
+  "description": "Out-of-tree DSH bundle for ChatGPT Codex OAuth and live models",
+  "private": false,
+  "license": "MIT",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.ja.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+    "package.json"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "packageManager": "pnpm@11.7.0",
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "pack:check": "npm pack --dry-run"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-authorization": "0.1.2-alpha.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-base": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-commands": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-credentials": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-invariants": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-user-questions": "0.1.2-alpha.3"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/cordis-plugin-include": "1.0.7",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.3",
+    "@deepseek-ai/dsh-agent": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-atomic-write": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-attachment": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-authorization": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-base": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-commands": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-credentials": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-credentials-local": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-fs": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-home-paths": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-invariants": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-launch-environment": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-scope": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-settings": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-timeout": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-user-questions": "0.1.2-alpha.3",
+    "@earendil-works/pi-ai": "0.85.1",
+    "@types/js-yaml": "4.0.9",
+    "@types/node": "22.20.0",
+    "js-yaml": "4.3.2",
+    "tsdown": "0.22.2",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11"
+  }
+}